WO2023019789A1 - Plug-in detection method and apparatus, electronic device, and storage medium - Google Patents

Abstract

Disclosed in the present invention are a plug-in detection method and apparatus, an electronic device, and a storage medium. The method comprises: determining a plurality of suspicious threads to be subjected to plug-in detection; monitoring whether each of the suspicious threads triggers a suspension event, the suspension event being used for indicating that the suspicious thread is suspended to a target program; when it is monitored that the suspicious thread triggers the suspension event, determining, within the preset collision period, the frequency that the suspicious thread triggers the suspension event; and determining, on the basis of the frequency, whether the suspicious thread is a plug-in thread. In this way, more comprehensive plug-in detection can be realized, and the detection efficiency is relatively high.

Description

Plug-in detection method, device, electronic equipment and storage medium

cross reference

This application claims the priority of the Chinese patent application filed on August 19, 2021, with application number 202110957616.8, and the title of the invention is "plug-in detection method, device, electronic equipment and storage medium", the entire content of which is incorporated by reference in this application middle.

technical field

The present invention relates to the field of computers, in particular to a plug-in detection method, device, electronic equipment and storage medium.

Background technique

With the development of computer technology and the iterative upgrade of the operating system, the method of implementing anti-cheat through patches is no longer suitable for the 64-bit Windows system that is now common. Anti-cheat in Windows system. Taking anti-cheating of game programs as an example, the so-called handle downgrade refers to traversing the handles of accessing game programs in the system with high frequency. Once cheating is found, the handle authority is reduced, for example, the handle is downgraded to the lowest level, so , the handle cannot perform data read and write operations on the game program, thus realizing anti-cheat.

However, there is a big technical flaw in the handle power reduction, specifically, the implementation of the handle power reduction depends on the white list, and once the white list is used by the plug-in thread, it will lose the effectiveness of the plug-in thread detection; and, in the driver layer (that is, the kernel layer) does not have the concept of a handle, so the above-mentioned technical means of lowering the right of the handle is not suitable for countering the plug-in thread of the driver layer (that is, the kernel layer).

It can be seen that there is an urgent need for a plug-in detection method with universal applicability and good compatibility.

Contents of the invention

In view of this, in order to solve the technical problem of extremely limited cheating detection methods and low applicability in the related art, embodiments of the present invention provide a cheating detection method, device, electronic equipment, and storage medium.

In the first aspect, according to an embodiment of the present invention, a method for detecting cheating is provided, the method comprising: determining a plurality of suspicious threads to be detected for cheating; Instructing the suspicious thread to attach to the target program; under the condition that the suspicious thread triggers the attaching event, determining the frequency of the suspicious thread triggering the attaching event within the preset collision period; based on the The above-mentioned frequency determines whether the suspicious thread is a plug-in thread.

In the second aspect, according to an embodiment of the present invention, a cheat detection device is provided, the device comprising: a first determination module, configured to determine a plurality of suspicious threads to be detected by cheats; a second determination module, configured to monitor each Whether the suspicious thread triggers an anchoring event, and the anchoring event is used to indicate that the suspicious thread is anchored to the target program; the third determining module is configured to, under the condition that the suspicious thread triggers the anchoring event, in the pre-determined It is assumed that the frequency at which the suspicious thread triggers the hanging event is determined during the collision period; a fourth determining module is configured to determine whether the suspicious thread is a hanging thread based on the frequency.

In a third aspect, according to an embodiment of the present invention, an electronic device is provided, including a memory, a processor, and a computer program stored on the memory, and when the processor executes the computer program, the method described in the first aspect above is implemented. step.

In a fourth aspect, according to an embodiment of the present invention, there is provided a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method described in the first aspect above are implemented.

In a fourth aspect, according to an embodiment of the present invention, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps of the method described in the first aspect above are implemented.

The beneficial effects of the present invention are: according to the technical solution of the embodiment of the present invention, by determining a plurality of suspicious threads to be detected for plug-ins, monitoring whether each suspicious thread triggers an anchoring event, under the condition that the suspicious thread triggers an anchoring event is detected, in The frequency at which the suspicious thread triggers the anchoring event is determined within the preset collision period, and whether the suspicious thread is a cheating thread is determined based on the frequency, thereby realizing the detection of the cheating thread. In the above technical solution, by first determining a plurality of suspicious threads to be detected for cheating, and then performing cheating detection only for suspicious threads, compared with comprehensively detecting cheating for surviving threads in the system, the efficiency of cheating detection can be improved , to reduce the consumption of computing resources of the device by plug-in detection and the impact on device performance; for plug-in threads, triggering hook events is a necessary operation, and the frequency of triggering hook events can also be regarded as the inherent characteristics of plug-in threads. Therefore, the detection of plug-ins based on the frequency of hooking events triggered by threads can be applied to various plug-ins and various scenarios (including detection of plug-in threads in the driver layer). It can be seen that the above technical solution has higher applicability and compatibility compared with the handle weight reduction in the related art, and can more comprehensively realize the detection of various plug-in threads.

In addition, according to the technical solution of the embodiment of the present invention, when monitoring whether a suspicious thread triggers an anchoring event, based on the inspiration of the Phalanx system applied on the warship, multiple detection threads are used to cyclically detect the suspicious thread for plug-in detection, which is quite The interception principle of the Phalanx system applied on warships can realize intensive and high-frequency plug-in detection of suspicious threads. Therefore, even if the attaching and unattaching operations of the cheating thread are completed instantaneously, the hooking event triggered by the hacking thread can be captured with a high probability, which provides a solid foundation for the detection of the cheating thread.

Description of drawings

These and various other advantages and benefits of the present invention will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. In the attached picture:

Fig. 1 schematically shows a flow chart of an embodiment of a cheating detection method according to an embodiment of the present invention;

Fig. 2 schematically shows an embodiment flowchart of another cheat detection method according to an embodiment of the present invention;

Fig. 3 schematically shows a block diagram of an embodiment of a cheating detection device according to an embodiment of the present invention;

FIG. 4 schematically shows a schematic structural diagram of an electronic device according to an embodiment of the present invention;

Fig. 5 schematically shows a block diagram for implementing a computer device according to the method of the present invention; and

Fig. 6 schematically shows a block diagram of a computer program product implementing the method according to the invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The cheat detection method of the present invention will be further described below with specific embodiments in conjunction with the accompanying drawings. The following description is only to illustrate the basic principles of the present invention and not to limit it.

Referring to FIG. 1 , FIG. 1 schematically shows a flow chart of an embodiment of a cheat detection method according to an embodiment of the present invention. As shown in Figure 1, the process may include the following steps 101, 102, 103 and 104:

In step 101, a plurality of suspicious threads to be detected for cheating are determined.

In practice, there are thousands of surviving threads in the system (usually more than 3,000). Facing thousands of surviving threads, if a plug-in detection is performed for each surviving thread, it will undoubtedly consume a large amount of computing resources. affect device performance. In this regard, the embodiment of the present invention proposes: when performing cheating detection, first determine some threads suspected of cheating (hereinafter referred to as suspicious threads) from multiple surviving threads in the system, and then only perform cheating detection for suspicious threads. Those skilled in the art can understand that, compared to performing cheating detection on thousands of surviving threads in the system, only performing cheating detection on suspicious threads can reduce the consumption of device computing resources by cheating detection and reduce the risk of cheating. Detect impact on device performance. The following describes how to determine suspicious threads from the surviving threads in the system by way of example.

In practice, the cheat thread usually reads and writes the target program (such as a game program) based on two system API functions, ReadMemory and WriteMemory, so as to realize the cheating function. In some embodiments, the plug-in thread has very high real-time performance, and the read/write operations triggered by it can reach at least 3000-50000 times per second. That is to say, from the perspective of the index of thread activity, the plug-in thread is an extremely active thread, and, as time goes by, the activity of the plug-in thread shows a trend of increasing or maintaining. On the contrary, normal threads belong to inactive or moderately active threads, and, as time goes by, the activity of normal threads is not regular.

Based on this, in some implementations, the surviving threads in the system can be preliminarily screened based on the index of activity to obtain suspicious threads. In some implementations, the activity of each surviving thread in the system is determined, and the surviving thread whose activity meets a set condition is determined as a suspicious thread to be detected for cheating.

In some implementations, determining the activity of each surviving thread in the system may include: calling the corresponding system API function according to a set period to obtain the swapcontext value of the surviving thread until a set number of swapcontext values are obtained; and At the same time, for each surviving thread, starting from the second cycle, the swapcontext value obtained in the two cycles before and after is made a difference to obtain the swapcontext difference. The swapcontext difference is positively correlated with the thread activity, that is, the larger the swapcontext difference, the higher the thread activity; conversely, the smaller the swapcontext difference, the lower the thread activity. Therefore, the swapcontext difference of the surviving thread can be used to represent the activity of the surviving thread.

On this basis, in some implementations, determining a thread whose activity satisfies the set condition as a suspicious thread to be detected by cheating may include: for each surviving thread in the system, according to the order of acquisition time, the acquired The swapcontext difference values of the surviving threads are sorted to obtain the swapcontext difference sequence of the surviving threads. If the swapcontext difference sequence is an increasing sequence, it means that the activity of the thread is increasing over time. According to the above description, the surviving thread can be determined as a suspicious thread to be detected for cheating.

For example, every 1 second (that is, the above-mentioned setting period), call the corresponding system API function to obtain the swapcontext value of the surviving thread, until the swapcontext value of the surviving thread is obtained 5 times in 5 consecutive setting periods. According to the above description, for each surviving thread, starting from the second cycle, the swapcontext values obtained in the two cycles before and after are sequentially made a difference, and a total of 4 swapcontext differences are obtained. Afterwards, the four swapcontext differences are sorted according to the order of acquisition time to obtain the swapcontext difference sequence of the surviving threads. If the swapcontext difference sequence is an increasing sequence, it means that the activity of the thread increases with time. According to the above description, the surviving thread can be determined as a suspicious thread to be detected by the plug-in.

In addition, it should be noted that if the swapcontext difference is 0, it means that the thread is not active. Therefore, before sorting the swapcontext difference values of the surviving threads, the inactive surviving threads can be filtered out based on the swapcontext difference values.

In step 102, it is monitored whether each suspicious thread triggers a hooking event, and the hooking event is used to indicate that the suspicious thread is hooked to the target program.

At present, Windows stipulates that when a thread reads and writes across processes (that is, reads and writes data of other processes other than the process it belongs to), it must first be attached to the other process (hereinafter referred to as the target program), and after the read and write operations are completed , and then unhook from the target program. As mentioned above, the plug-in thread can trigger at least 3,000-50,000 read/write operations per second, which means that the plug-in thread can trigger 3,000-50,000 times of hooking events per second. It can be seen that, for the plug-in thread, the frequency of triggering the hooking event is relatively high.

In some implementations, when a thread is attached to the target program, the specified offset address in the thread kernel object, such as offset 0xb8, will save the kernel object address of the target program. After the thread is unhooked from the target program, The data content at the specified offset address will change from the kernel object address of the target program to the kernel object address of the process to which the thread belongs. It can be seen that every time a thread triggers a hooking event, the data content at the specified offset address in its kernel object will change once.

Based on the above description, the embodiment of the present invention proposes to capture whether the thread triggers the hooking event by acquiring the data content at the specified offset address in the thread kernel object.

However, although the frequency of hooking events triggered by the plug-in thread is relatively high, that is, the frequency of changing the data content at the specified offset address in the thread kernel object to the kernel object address of the target program is relatively high; The hooking operation is completed instantaneously, that is, the data content at the specified offset address in the thread kernel object is the kernel object address of the target program, which is fleeting. Therefore, how to capture the thread triggering the anchor event has become a technical pain point.

In this regard, the embodiment of the present invention is based on the inspiration of the Phalanx system applied on warships: the launch speed of supersonic missiles is very fast, but the Phalanx that launches 20,000 rounds of intercepting missiles per second can still intercept supersonic missiles, and proposes the following to determine suspicious Whether the thread triggers the implementation of the anchor event, the specific process is shown in Figure 2. As shown in Figure 2, according to an embodiment of the present invention, another plug-in detection method may include the following steps:

Step 201. Obtain the data content at the specified offset address in the suspicious thread kernel object.

Step 202. Determine whether the obtained data content is the kernel object address of the target program; if yes, execute step 203; if not, execute step 204.

Step 203, determine that the suspicious thread triggers the hooking event.

Step 204 , determine whether the set duration is reached; if yes, execute step 205 , if not, return to execute step 201 .

Step 205, determine that the suspicious thread does not trigger a hooking event.

It can be seen from steps 201 to 205 that in the embodiment of the present invention, for each suspicious thread, within a set period of time (for example, 1 second), cyclically obtain the specified offset address in the suspicious thread kernel object without delay. In this way, the high-frequency acquisition of the data content at the specified offset address in the suspicious thread kernel object is realized. After obtaining the data content at the specified offset address in the suspicious thread kernel object each time, determine whether the obtained data content is the kernel object address of the target program. ; If not, the above steps can continue to be executed in a loop without delay until the set duration is reached. When the set duration is reached, if the content of the data obtained each time is not the kernel object address of the target program, it can be determined that the suspicious thread has not triggered the anchoring event. Here, no delay means that there is no time interval between two executions of the above-mentioned acquisition of the data content at the specified offset address in the kernel object of the suspicious thread.

In the process shown in Figure 2, the high-frequency detection of suspicious threads is equivalent to the interception principle of the Phalanx system used on warships, which realizes intensive and high-frequency detection of suspicious threads. Therefore, even if the external threads The attaching and unattaching operations are completed instantly, and it is also possible to capture the attaching event triggered by the hooking thread with a high probability.

In addition, it should be noted that, in order to improve the efficiency and accuracy of cheating detection, the embodiment of the present invention proposes to execute the process shown in FIG. Suspicious threads for cheating detection.

In some implementations, the embodiment of the present invention proposes to group multiple suspicious threads according to activity, wherein the activity of suspicious threads in the same group is within the same set activity range, and the set activity corresponding to different groups The ranges do not overlap, and then for each group, batch monitor whether the suspicious threads in the group trigger the anchor event.

For example, according to the swapcontext difference that can represent activity, the suspicious threads with the swapcontext difference greater than 1000 are divided into one group, the suspicious threads with the swapcontext difference greater than 200 and less than 1000 are divided into another group, and the swapcontext Suspicious threads whose difference is lower than 200 are divided into another group, that is, three groups are obtained. Afterwards, for each group, whether the suspicious thread in the group triggers the hooking event is monitored in batches. Here, the swapcontext difference based on the grouping is the last swapcontext difference obtained according to the set period.

In practice, the number of threads with high activity in the Windows system is relatively small compared to the number of threads with low activity (generally speaking, threads with high activity account for less than 10%). Therefore, in the above multiple groups Among them, the higher the activity corresponding to the group, that is, the larger the swapcontext difference, the fewer threads in the group. In some implementations, within the same set time period, the fewer threads are monitored in batches, the more times each thread is monitored, so the monitoring hit rate is higher. This can improve the accuracy of plug-in detection.

In addition, when a suspicious thread that triggers a hang-up event is captured through batch monitoring, the suspicious thread that triggers a hang-up event captured during the batch monitoring process can be determined as a high-risk thread, and then, for the high-risk thread, monitor whether it is Trigger the anchor event. That is to say, in the embodiment of the present invention, under the condition that any suspicious thread in the above group is detected to trigger the hooking event, for the suspicious thread again, whether the suspicious thread triggers the hanging event is individually monitored. It can be seen that, in the embodiment of the present invention, by combining batch detection and individual detection, while improving the accuracy of cheat detection results, the efficiency of cheat detection can also be taken into account.

In step 103, under the condition that the suspicious thread triggers the hanging event, the frequency of the suspicious thread triggering the hanging event is determined within a preset collision period.

It can be understood that when a suspicious thread is detected to trigger an anchoring event, it means that the suspicious thread is more likely to be a plug-in thread. In order to further determine whether the suspicious thread is a Under the condition that the thread triggers the hang event, determine the frequency of the suspicious thread triggering the hang event within the preset collision period.

In some embodiments, within the preset collision period, for example, within 0.1 second (here, the setting of 0.1 second is mainly to consider reducing the impact of the implementation of the technical solution of the present invention on the user, such as a game player), for triggering and hanging The suspicious thread of the event, that is, the above-mentioned high-risk thread respectively performs the following steps: Obtain the data content at the specified offset address in the kernel object of the high-risk thread, determine whether the obtained data content is the kernel object address of the target program, and if so, use Add 1 to the flag value representing the number of times that suspicious threads trigger hooking events, then, at the end of the preset collision period, the number of times that suspicious threads are detected to trigger hooking events within the preset collision period can be obtained, and then based on this number, Then the frequency of the hooking event triggered by the suspicious thread can be obtained.

It should be noted that the preset collision period here may be the same as or different from the set duration described in step 102 above, which is not limited in this embodiment of the present invention.

In step 104, it is determined based on the frequency whether the suspicious thread is a plug-in thread.

In some implementations, the frequency at which the suspicious thread triggers the hooking event is compared with the set threshold. If the frequency is greater than the set threshold, it means that the frequency of the suspicious thread triggering the hanging event is relatively high. Combined with the above description "plug-in The frequency of threads triggering hooking events is relatively high", here the suspicious thread can be identified as a hanging thread. On the contrary, if the comparison shows that the frequency is less than or equal to the set threshold, it means that the frequency of the suspicious thread triggering the hanging event is moderate, so it can be determined that the suspicious thread is not a hanging thread.

It should be noted that in practice, the above-mentioned set thresholds are not static, that is, users can adjust the set thresholds according to actual business needs or foresight experience, and artificial intelligence algorithms can also be used according to historical plug-in detection results. The set threshold is adjusted intelligently, which is not limited in this embodiment of the present invention.

It should also be noted that the method of determining whether a suspicious thread is a plug-in thread based on the frequency described in the above embodiment is only an optional implementation method, and in practice, it can also be implemented in other ways. For example, multiple suspicious threads may be sorted in descending order of frequency, and the suspicious threads ranked in the top N places in the sorting result may be determined as cheating threads. The embodiment of the present invention does not limit the specific implementation manner of determining whether a suspicious thread is a plug-in thread based on frequency.

According to the technical solution of the embodiment of the present invention, by determining a plurality of suspicious threads to be detected by plug-ins, monitoring whether each suspicious thread triggers an anchoring event, under the condition that a suspicious thread triggers an anchoring event is detected, the suspicious threads are determined within the preset collision period. The frequency at which the thread triggers the hooking event determines whether the suspicious thread is a cheating thread based on the frequency, and realizes the detection of the cheating thread. In some embodiments, by first determining a plurality of suspicious threads to be detected by cheating, and then only performing cheating detection on suspicious threads, compared with comprehensively performing cheating detection on surviving threads in the system, the accuracy of cheating detection can be improved. Efficiency, reducing the consumption of computing resources of the device by plug-in detection and the impact on device performance; for plug-in threads, triggering hook events is a necessary operation, and the frequency of triggering hook events can also be regarded as an inherent feature of plug-in threads , therefore, the plug-in detection can be applied to various plug-ins and various scenarios (including detecting the plug-in thread of the driver layer) by the frequency of the thread triggering the hooking event. It can be seen that the above technical solution is compared with the related art. In terms of lowering the right of the handle, it has high applicability and compatibility, and can more comprehensively realize the detection of various plug-in threads.

Corresponding to the above embodiments of the cheating detection method, according to the embodiment of the present invention, a cheating detection device is also provided. The plug-in detection device of the present invention will be described below with specific embodiments in conjunction with the accompanying drawings.

Referring to FIG. 3 , FIG. 3 schematically shows a block diagram of an embodiment of a cheat detection device according to an embodiment of the present invention. As shown in Figure 3, the device may include:

The first determination module 31 is configured to determine a plurality of suspicious threads to be detected by cheating;

The second determining module 32 is configured to monitor whether each of the suspicious threads triggers a hooking event, and the hanging event is used to indicate that the suspicious thread is hooked to a target program;

The third determination module 33 is configured to determine the frequency of the suspicious thread triggering the hanging event within a preset collision period under the condition that the suspicious thread triggers the hanging event;

The fourth determining module 34 is configured to determine whether the suspicious thread is a cheating thread based on the frequency.

In some possible implementations, the first determination module 31 may include (not shown in the figure):

The liveness determination submodule is used to determine the liveness of each surviving thread in the system;

The suspicious thread determination sub-module is configured to determine the surviving thread whose activity meets a set condition as a suspicious thread to be detected by cheating.

In some possible implementations, the activity determination submodule can be used to perform the following steps for each surviving thread in the system:

Acquire the swapcontext value of the surviving thread according to the set cycle until the swapcontext value of the set number is obtained; and, starting from the second cycle, the swapcontext value obtained in the two cycles before and after is made a difference to obtain swapcontext difference; the swapcontext difference is positively correlated with the activity of the surviving thread.

The suspicious thread determination submodule can be used for:

For each surviving thread in the system, sort the acquired swapcontext difference values of the surviving threads according to the order of acquisition time, to obtain the swapcontext difference sequence of the surviving threads;

If the swapcontext difference sequence is an increasing sequence, then determine the surviving thread as a suspicious thread to be detected for cheating.

In some possible implementation manners, the second determination module 32 may be configured to execute the following steps within a set period of time for each suspicious thread:

Obtain the data content at the specified offset address in the suspicious thread kernel object;

determining whether the data content is the kernel object address of the target program;

If so, then stop the loop, and determine that the suspicious thread triggers the hook event;

If not, the loop continues until the set duration is reached, and it is determined that the suspicious thread does not trigger a hooking event.

In some possible implementation manners, the second determination module 32 may be used to:

Grouping multiple suspicious threads according to the activity, wherein the activity of the suspicious threads in the same group is within the same set activity range, and the set activity ranges corresponding to different groups do not overlap;

For each of the groups, determine in batches whether the suspicious thread in the group triggers a hooking event; wherein, the set durations corresponding to different groups are different, and the settings corresponding to the groups are active The upper limit of the degree range is positively related to the set duration.

In some possible implementation manners, the second determination module 32 may also be used for:

Under the condition that any of the suspicious threads in the group is detected to trigger a hang event, it is monitored again whether any of the suspicious threads triggers a hang event.

In some possible implementation manners, the fourth determining module 34 may be used to:

comparing said frequency with a set threshold;

If it is compared that the frequency is greater than the set threshold, it is determined that the suspicious thread is a plug-in thread;

If it is compared that the frequency is less than the set threshold, it is determined that the suspicious thread is not a plug-in thread.

Fig. 4 schematically shows a schematic structural diagram of an electronic device according to an embodiment of the present invention. The electronic device 400 shown in FIG. 4 may include: at least one processor 401 , a memory 402 , at least one network interface 404 and other user interfaces 403 . Various components in the electronic device 400 are coupled together through the bus system 405 . It can be understood that the bus system 405 is used to realize connection and communication between these components. In addition to the data bus, the bus system 405 also includes a power bus, a control bus and a status signal bus. However, for clarity of illustration, the various buses are labeled as bus system 405 in FIG. 4 .

In some implementations, the user interface 403 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen, etc.).

It can be understood that the memory 402 in the embodiment of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. In some implementations, the non-volatile memory can be a read-only memory (Read-OnlyMemory, ROM), a programmable read-only memory (ProgrammableROM, PROM), an erasable programmable read-only memory (ErasablePROM, EPROM), an electronic Erasable programmable read-only memory (Electrically EPROM, EEPROM) or flash memory. The volatile memory may be random access memory (Random Access Memory, RAM), which acts as an external cache. By way of illustration and not limitation, many forms of RAM are available such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (Synchronous DRAM, SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DoubleDataRate SDRAM, DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (Enhanced SDRAM, ESDRAM), Synchronous Connection Dynamic Random Access Memory (SynchlinkDRAM, SLDRAM) and Direct Memory Bus Random Access Memory Access memory (DirectRambusRAM, DRRAM). Memory 402 described herein is intended to include, but is not limited to, these and any other suitable types of memory.

In some implementations, the memory 402 stores the following elements, executable units or data structures, or their subsets, or their extended sets: an operating system 4021 and an application program 4022 .

In some implementations, the operating system 4021 may include various system programs, such as framework layer, core library layer, driver layer, etc., for implementing various basic services and processing hardware-based tasks. The application program 4022 includes various application programs, such as a media player (MediaPlayer), a browser (Browser), etc., and is used to implement various application services. The program for realizing the method of the embodiment of the present invention may be included in the application program 4022 .

In this embodiment of the present invention, by calling the program or instruction stored in the memory 402, which may be the program or instruction stored in the application program 4022, the processor 401 is used to execute the method steps provided by each method embodiment, for example, the executable Steps include:

Determine multiple suspicious threads to be detected for cheating;

Monitoring whether each of the suspicious threads triggers a hooking event, and the hooking event is used to indicate that the suspicious thread is hooked to a target program;

Under the condition that the suspicious thread triggers the hanging event, determine the frequency of the suspicious thread triggering the hanging event within a preset collision period;

Determine whether the suspicious thread is a plug-in thread based on the frequency.

The methods disclosed in the foregoing embodiments of the present invention may be applied to the processor 401 or implemented by the processor 401 . The processor 401 may be an integrated circuit chip and has signal processing capability. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 401 or an instruction in the form of software. The above-mentioned processor 401 may be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), an off-the-shelf programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates Or transistor logic devices, discrete hardware components. Various methods, steps and logic block diagrams disclosed in the embodiments of the present invention may be implemented or executed. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like. The steps of the methods disclosed in connection with the embodiments of the present invention may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software units in the decoding processor. The software unit may be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register. The storage medium is located in the memory 402, and the processor 401 reads the information in the memory 402, and completes the steps of the above method in combination with its hardware.

It should be understood that the embodiments described herein may be implemented by hardware, software, firmware, middleware, microcode or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (Application Specific Integrated Circuits, ASIC), digital signal processor (Digital Signal Processing, DSP), digital signal processing device (DSPDevice, DSPD), programmable logic device (ProgrammableLogicDevice, PLD ), Field-Programmable Gate Array (Field-Programmable GateArray, FPGA), general-purpose processor, controller, microcontroller, microprocessor, other electronic units for performing the functions described in this application, or a combination thereof.

For a software implementation, the techniques described herein are implemented by means of units that perform the functions described herein. Software codes can be stored in memory and executed by a processor. Memory can be implemented within the processor or external to the processor.

The electronic device according to the embodiment of the present invention may be an electronic device as shown in FIG. 4, which can perform all the steps of the cheat detection method shown in FIG. 1-FIG. 2, and then realize the technology of the cheat detection method shown in FIG. For the effect, please refer to the relevant descriptions in Fig. 1-Fig. 2 for details.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components in the cheat detection device according to the embodiment of the present invention. The present invention can also be implemented as programs/instructions (eg, computer programs/instructions and computer program products) of devices or means for performing part or all of the methods described herein. Such programs/instructions for implementing the present invention may be stored on a computer-readable medium, or may exist in the form of one or more signals, such signals may be downloaded from an Internet website, or provided on a carrier signal, or in any form Available in other formats.

According to an embodiment of the present invention, a storage medium is also provided, which may be a computer-readable medium. One or more programs in the storage medium can be executed by one or more processors, so as to realize the above-mentioned cheating detection method executed on the electronic device side. The processor is used to execute the cheat detection program stored in the memory, so as to realize the following steps of the cheat detection method performed on the electronic device side:

Determine multiple suspicious threads to be detected for cheating;

Monitoring whether each of the suspicious threads triggers a hooking event, and the hooking event is used to indicate that the suspicious thread is hooked to a target program;

When it is detected that the suspicious thread triggers the hanging event, determine the frequency of the suspicious thread triggering the hanging event within a preset collision period;

Determine whether the suspicious thread is a plug-in thread based on the frequency.

Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can be implemented by any method or technology for storage of information. Information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by computing devices.

FIG. 5 schematically shows a computer device capable of implementing the cheat detection method according to the present invention. The computer device includes a processor 510 and a computer-readable medium in the form of a memory 520 . The memory 520 is one example of a computer readable medium having a storage space 530 for storing a computer program 531 . When the computer program 531 is executed by the processor 510, various steps in the cheating detection method described above can be realized.

Fig. 6 schematically shows a block diagram of a computer program product implementing the method according to the invention. The computer program product includes a computer program 610. When the computer program 610 is executed by a processor such as the processor 510 shown in FIG. 5, various steps in the cheat detection method described above can be realized.

The foregoing describes certain embodiments of the specification which, together with other embodiments, are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily follow the particular order shown, or sequential order, to achieve desirable results. Multitasking and parallel processing are also possible or advantageous in certain embodiments.

It should also be noted that the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes Other elements not expressly listed, or elements inherent in the process, method, commodity, or apparatus are also included. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

It should be understood that the above-mentioned embodiments are only for the purpose of illustrating the present invention rather than limiting the present invention. Without departing from the basic spirit and characteristics of the present invention, those skilled in the art can implement the present invention in other ways. The scope of the present invention shall be based on the appended claims, and any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of one or more embodiments of the present specification shall be covered therein.

Claims (12)

A plug-in detection method, the method comprising: Determine multiple suspicious threads to be detected for cheating; Monitoring whether each of the suspicious threads triggers a hooking event, and the hooking event is used to indicate that the suspicious thread is hooked to a target program; Under the condition that the suspicious thread triggers the hanging event, determine the frequency of the suspicious thread triggering the hanging event within the preset collision period; Determine whether the suspicious thread is a plug-in thread based on the frequency. The method according to claim 1, wherein said determining a plurality of suspicious threads to be detected by cheating comprises: Determine the activity of each surviving thread in the system; Determining the surviving thread whose activity satisfies the set condition as a suspicious thread to be detected by cheating. The method according to claim 2, wherein said determining the activity of each surviving thread in the system comprises: For each surviving thread in the system, perform the following steps: Obtaining the swapcontext value of the surviving thread according to a set period until a set number of the swapcontext values are obtained; and, Starting from the second cycle, the swapcontext value obtained in the two cycles before and after is made a difference to obtain a swapcontext difference; the swapcontext difference is positively correlated with the activity of the surviving thread; The determining the surviving thread whose activity meets the set condition as a suspicious thread to be detected by plug-in includes: For each surviving thread in the system, sort the acquired swapcontext difference values of the surviving threads according to the order of acquisition time, to obtain the swapcontext difference sequence of the surviving threads; If the swapcontext difference sequence is an increasing sequence, then determine the surviving thread as a suspicious thread to be detected for cheating. The method according to claim 1, wherein said monitoring whether each said suspicious thread triggers a hooking event comprises: For each suspicious thread, execute the following steps in a loop within a set duration: Obtain the data content at the specified offset address in the suspicious thread kernel object; determining whether the data content is the kernel object address of the target program; If so, then stop the loop, and determine that the suspicious thread triggers the hook event; If not, the loop continues until the set duration is reached, and it is determined that the suspicious thread does not trigger a hooking event. The method according to claim 4, wherein said monitoring whether each said suspicious thread triggers a hooking event comprises: Grouping multiple suspicious threads according to the activeness, the activeness of the suspicious threads in the same group is within the same set activeness range, and the set activeness ranges corresponding to different groups do not overlap; For each group, whether the suspicious thread in the group triggers a hang event is monitored in batches. The method according to claim 5, wherein, after the batch monitoring whether the suspicious thread in the group triggers a hanging event, further comprising: Under the condition that any of the suspicious threads in the group is detected to trigger a hang event, it is monitored again whether any of the suspicious threads triggers a hang event. The method according to claim 1, wherein said determining whether said suspicious thread is a plug-in thread based on said frequency comprises: comparing said frequency with a set threshold; If it is compared that the frequency is greater than the set threshold, it is determined that the suspicious thread is a plug-in thread; If it is compared that the frequency is less than the set threshold, it is determined that the suspicious thread is not a plug-in thread. A plug-in detection device, said device comprising: A first determination module, configured to determine a plurality of suspicious threads to be detected by plug-ins; The second determination module is configured to monitor whether each of the suspicious threads triggers a hooking event, and the hooking event is used to indicate that the suspicious thread is hooked to a target program; The third determination module is configured to determine the frequency of the suspicious thread triggering the hanging event within the preset collision period under the condition that the suspicious thread triggers the hanging event; A fourth determining module, configured to determine whether the suspicious thread is a plug-in thread based on the frequency. The device according to claim 8, wherein the second determining module is specifically configured to: For each suspicious thread, execute the following steps in a loop within a set duration: Obtain the data content at the specified offset address in the suspicious thread kernel object; determining whether the data content is the kernel object address of the target program; If so, then stop the loop, and determine that the suspicious thread triggers the hook event; If not, the loop continues until the set duration is reached, and it is determined that the suspicious thread does not trigger a hooking event. An electronic device, comprising a memory, a processor, and a computer program stored on the memory, when the processor executes the computer program, the steps of the cheat detection method according to any one of claims 1-7 are realized. A storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the cheat detection method according to any one of claims 1-7 are realized. A computer program product, comprising a computer program, when the computer program is executed by a processor, the steps of the cheat detection method according to any one of claims 1-9 are realized.

Images