DENNIS LEE
Pilots at Harvard Ave, Seattle, WA

6014513, Jan 11, 2000

Dec 23, 1997

8/996839

Geoffrey Michael Voelker - Seattle WA
Theodore H. Romer - Seattle WA
Alastair Wolman - Seattle WA
Dennis Chua Lee - Seattle WA
Brian N. Bershad - Seattle WA
John Bradley Chen - Winchester MA
Henry M. Levy - Seattle WA
Wayne Anthony Wong - Hillsboro OR

University of Washington - Seattle WA

G06F 9445

395703

A computer software tool used for automatically identifying code portions and data portions of a binary executable software program in which the code portions include machine instructions that are of arbitrary length. Software products are typically distributed as binary, executable files, which comprise a string of binary values. In general, an executable file has no structure or meaning, except as determined by its behavior when dynamically executed, one instruction at a time, by a digital computer. The software tool determines a set of addresses for any known code and data portions. The tool is then used to disassemble machine instructions, beginning at a starting address for each known code portion, to identify the target addresses of other code portions and other data portions. Other sections of the binary executable software program that could be either code or data are then analyzed to identify additionAL code and data portions. As new portions are identified, the steps are repeated, until no further code or data portions are identifiable.

5953534, Sep 14, 1999

Dec 23, 1997

8/996838

Theodore H. Romer - Seattle WA
Alastair Wolman - Seattle WA
Dennis Chua Lee - Seattle WA
Geoffrey Michael Voelker - Seattle WA
Brian N. Bershad - Seattle WA
John Bradley Chen - Winchester MA
Henry M. Levy - Seattle WA
Wayne Anthony Wong - Hillsboro OR

University of Washington - Seattle WA

G06F 9445

395712

A method and procedure for modifying modules comprising a binary executable software program in such a way that, despite the transformations performed and the creation of new versions of the modules, the transformed program appears (to that program, including all of its components) as if it is running in the identical environment as the original program. The environment includes environment variables, the name of the program, the names of all of the dynamically loaded library (DLL) files that the program references, the directory in which the program resides, and the current directory at the time the program started execution. When the program has been transformed, e. g. , for the purposes of monitoring or measurement, the environment also includes the effective addresses of data and instruction references made by the program. By employing the present invention, a modified software program will have the same behavior as the original unmodified program from which it is derived, even though it and many of its environment characteristics have been changed.