Account security monitoring method, device, storage medium and electronic device

Abstract

The present invention discloses a method, device, storage medium and electronic device for monitoring account security. The method comprises: obtaining the running assembly instructions compiled from each running application code during the running process of the target application to obtain a running assembly instruction set; verifying each running assembly instruction in the running assembly instruction set according to target verification information, wherein the target verification information is used to indicate the target assembly instructions compiled from each application code of the target application when there is no cheating behavior on the target application; when there is a tampered assembly instruction that fails the verification in the running assembly instruction set, it is determined that the target account that logs into the target application has cheating behavior. The present invention solves the technical problem of monitoring efficiency for monitoring account security in applications.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a method, device, storage medium and electronic equipment for monitoring account security. Background Art

[0002] With the development of Internet technology, most of people's life needs can be met by operating on applications. With the popularity of applications, the security and fairness of users when using applications need to be guaranteed, and preventing cheating on applications has become an urgent problem to be solved.

[0003] At present, the way to monitor the security of accounts on applications is generally to first obtain the specific method of a certain cheating behavior. Then the characteristic code of the cheating method will be analyzed and extracted. Then the developer will detect the logic and update the security plan to detect the cheating method.

[0004] However, when implementing the above-mentioned process of obtaining the specific method of cheating behavior, generally, the cheating method has already had a negative impact on normal users, so the above-mentioned account security monitoring process will first have a certain lag. Secondly, the feature code extracted in the above process can generally only detect one or several similar cheating methods, resulting in a small coverage of the above-mentioned monitoring method. In addition, after the feature code is extracted, the existing technology requires developers to continuously update the confrontation process, resulting in large manpower costs and low efficiency.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present invention provide a method, device, storage medium and electronic device for monitoring account security, so as to at least solve the technical problem of monitoring efficiency of account security in application programs.

[0007] According to one aspect of an embodiment of the present invention, a method for monitoring account security is provided, comprising:

[0008] Obtaining the running assembly instructions compiled from each running application code during the running process of the target application to obtain a running assembly instruction set;

[0009] Verifying each of the running assembly instructions in the running assembly instruction set according to the target verification information, wherein the target verification information is used to indicate the target assembly instructions compiled from each application code of the target application when there is no cheating behavior on the target application;

[0010] When there is a tampered assembly instruction that fails verification in the running assembly instruction set, it is determined that there is cheating behavior in the target account that logs into the target application.

[0011] According to another aspect of an embodiment of the present invention, there is also provided a device for monitoring account security, including:

[0012] A first acquisition module is used to acquire the running assembly instructions compiled from each running application code during the running process of the target application to obtain a running assembly instruction set;

[0013] a verification module, configured to verify each of the running assembly instructions in the running assembly instruction set according to target verification information, wherein the target verification information is used to indicate a target assembly instruction compiled from each application code of the target application when there is no cheating behavior on the target application;

[0014] The determination module is used to determine that a target account logging into the target application has cheating behavior when there is a tampered assembly instruction that fails verification in the running assembly instruction set.

[0015] Optionally, the first verification unit includes:

[0016] A transformation subunit, configured to perform a hash transformation on the operation instruction data to obtain second hash data;

[0017] The verification subunit is used to verify whether the second hash data meets the verification condition recorded in the target verification information.

[0018] Optionally, the device further comprises:

[0019] A second acquisition module is used to acquire the penalty operation corresponding to the instruction type of the tampering assembly instruction after determining that the target account that logs into the target application has cheated;

[0020] The first execution module is used to execute the penalty operation on the target account.

[0021] Optionally, the device further comprises:

[0022] A creation module, used to create a first thread and a second thread;

[0023] A second execution module is used to execute, through the first thread, an operation of obtaining a set of running assembly instructions compiled from each running application code in the running process of the target application, and obtain the target verification information;

[0024] The third execution module is used to execute, through the second thread, an operation of verifying each of the running assembly instructions in the running assembly instruction set according to the target verification information, and an operation of determining that a target account that logs into the target application has cheated when there is a tampered assembly instruction that fails the verification in the running assembly instruction set.

[0025] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned account security monitoring method when running.

[0026] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the account security monitoring method through the computer program.

[0027] In an embodiment of the present invention, each running application code during the running process of the target application will be compiled into a running assembly instruction, and these running assembly instructions are obtained to obtain a running assembly instruction set. Each running assembly instruction in the running assembly instruction set is verified according to the target verification information of the target assembly instruction compiled into each application code of the target application when there is no cheating behavior on the target application. If there is a tampered assembly instruction that fails the verification in the running assembly instruction set, it can be determined that the target account that logs into the target application has cheating behavior, thereby achieving the purpose of detecting the cheating behavior of the account by fully verifying the assembly instructions. First, since any cheating behavior of the account will affect the application code of the application, and the application will compile the application code into assembly instructions at runtime, if the account has cheating behavior, then its cheating behavior will make the compiled running assembly instructions different from the target assembly instructions when there is no cheating behavior. The verification process of the assembly instructions can be used to verify the full amount of application code when the application is running, detect the cheating behavior of the account more comprehensively and accurately, and monitor the security of the account more efficiently, thereby achieving the technical effect of improving the monitoring efficiency of monitoring the security of the account in the application, thereby solving the technical problem of monitoring the efficiency of monitoring the security of the account in the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0029] Figure 1 is a schematic diagram of an application environment of an optional method for monitoring account security according to an embodiment of the present invention;

[0030] Figure 2 is a schematic diagram of a process of an optional method for monitoring account security according to an embodiment of the present invention;

[0031] Figure 3 is a schematic diagram of an optional method for monitoring account security according to an embodiment of the present invention;

[0032] Figure 4 is a schematic diagram of another optional method for monitoring account security according to an embodiment of the present invention;

[0033] Figure 5 is a schematic diagram of another optional method for monitoring account security according to an embodiment of the present invention;

[0034] Figure 6 is a schematic diagram of another optional method for monitoring account security according to an embodiment of the present invention;

[0035] Figure 7 is a schematic diagram of another optional method for monitoring account security according to an embodiment of the present invention;

[0036] Figure 8 is a schematic diagram of another optional method for monitoring account security according to an embodiment of the present invention;

[0037] Fig. 9 is a schematic diagram of an application scenario of an optional method for monitoring account security according to an embodiment of the present invention;

[0038] Fig.10 is a schematic diagram of an optional account security monitoring device according to an embodiment of the present invention;

[0039] Fig.11 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0041] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0042] First, to facilitate understanding of the embodiments of the present invention, some terms or nouns involved in the present invention are explained below:

[0043] Mono: A compilation method for C# scripts in the Unity engine that is different from il2cpp. Based on this compilation method, the C# code written by Unity mobile game developers will exist in the apk in the form of Dll, dynamically compiled during execution, and finally exist in the memory as discontinuous assembly instruction blocks.

[0044] Function: In mathematics, it is a correspondence between two sets that are not empty. In computers, it refers to a part of the code in a large program, consisting of one or more blocks of statements. It is responsible for completing a specific task and is relatively independent compared to other codes.

[0045] C# function: a function written in C# language.

[0046] FNV algorithm: The full name of FNV hash algorithm is Fowler-Noll-Vo algorithm, named after Glenn Fowler, Landon Curt Noll, and Phong Vo. It was first proposed in 1991. FNV hash algorithm can quickly hash large amounts of data while keeping a low conflict rate.

[0047] According to one aspect of an embodiment of the present invention, a method for monitoring account security is provided. Optionally, as an optional implementation, the above-mentioned method for monitoring account security can be applied to, but is not limited to, Figure 1 In the environment shown, it may include but is not limited to a user device 102, a network 110 and a server 112, wherein the user device 102 may include but is not limited to a display 108, a processor 106 and a memory 104.

[0048] The specific process can be as follows: Step S102, each running application code during the running process of the target application installed on the user device 102 is compiled into a running assembly instruction; Steps S104-S106, the server 112 obtains the running assembly instructions compiled from each running application code during the running process of the target application installed on the user device 102 through the network 110, and obtains a running assembly instruction set; Step S108, the server 112 searches the database 114 for target verification information, and verifies each running assembly instruction in the running assembly instruction set according to the target verification information through the processing engine 116; Step S110, when there are tampered assembly instructions that fail the verification in the running assembly instruction set, the server 112 determines that the target account that logs into the target application has cheated.

[0049] remove Figure 1 In addition to the examples shown, the above steps can be completed independently by the user device 102, that is, the user device 102 executes the steps of obtaining and verifying the running assembly instructions, judging the detection results, etc., thereby reducing the processing pressure of the server. The user device 102 includes but is not limited to a handheld device (such as a mobile phone), a laptop computer, a desktop computer, a vehicle-mounted device, etc., and the present invention does not limit the specific implementation of the user device 102.

[0050] In a game development scenario, when using the Unity engine for game development, there may be the following C# script development code:

[0051]

[0052]

[0053] When dynamically compiling based on mono, the above C# code will be processed by the engine into the following assembly instructions:

[0054] loc A757EA98

[0055] MOV R12,SP

[0056] STMFD SP!, (R4, R11, R12, LR)

[0057] SUB

[0058] MOV R11,SP

[0059] STR

[0060] STR R1,[R11,#8]

[0061] STR

[0062] MOV

[0063] LDR Read the word data at memory address R11+4 into register R0

[0064] CMP Compare whether R0 is equal to 2

[0065] MOV If R0 is equal to 2, then set R0 to 0

[0066] MOVGT If R0 is greater than 2, set R0 to 1.

[0067] CMP

[0068] BEQ loc_A757EAE4

[0069] LDR

[0070] LDR R1,[R11,#8]

[0071] ADD

[0072] STR

[0073] MOV R4,#1

[0074] loc A7S7EAE4

[0075] STR R4,[R11]

[0076] MOV

[0077] ADD

[0078] LDMFD SP,{R4,R11,SP,PC}

[0079] If some malicious players use some memory modification tools to modify CMP R0,#2 in the above assembly instruction to andeq r0,r0,r0 (the corresponding instruction opcode is 0x00000000), it may cause the execution of the if statement in the above C# code to be abnormal, and then cause the assignment of the d variable to be abnormal, and then affect the execution logic of the subsequent overall code and affect the security of the game.

[0080] By adopting the account security monitoring method provided in this embodiment, security protection can be performed on all the above-mentioned assembly instructions, and assembly instructions with cheating behavior can be detected, thereby ensuring the security of the game.

[0081] Optionally, as an optional implementation, as Figure 2 As shown, the methods for monitoring account security include:

[0082] S202, obtaining the running assembly instructions compiled from each running application code during the running process of the target application, and obtaining a running assembly instruction set;

[0083] S204, verifying each of the running assembly instructions in the running assembly instruction set according to the target verification information, wherein the target verification information is used to indicate the target assembly instructions compiled from each application code of the target application when there is no cheating behavior on the target application;

[0084] S206, when there is a tampered assembly instruction that fails verification in the running assembly instruction set, determining that the target account that logs into the target application has cheating behavior.

[0085] Optionally, in this embodiment, the above-mentioned method for monitoring the security of an account can be applied, but is not limited to, to a scenario where the security of an account using an application is monitored. When a user uses an account to start an application, the application code of the application will be compiled into corresponding assembly instructions, and these assembly instructions will be obtained and verified using correct assembly instructions. If the user has cheated by tampering, deleting, adding, or other cheating behaviors to the application code of the application, some assembly instructions that do not conform to the correct assembly instructions will be verified from the obtained assembly instructions, and it can be determined that the account used by the user has cheated. Certain penalties can be imposed on the account according to the penalty rules.

[0086] Through the embodiments provided by the present application, each running application code during the running process of the target application will be compiled into a running assembly instruction, and these running assembly instructions are obtained to obtain a running assembly instruction set. Each running assembly instruction in the running assembly instruction set is verified according to the target verification information of the target assembly instruction compiled into each application code of the target application when there is no cheating behavior on the target application. If there is a tampered assembly instruction that fails the verification in the running assembly instruction set, it can be determined that the target account that logs into the target application has cheating behavior, thereby achieving the purpose of detecting the cheating behavior of the account by fully verifying the assembly instructions. First, since any cheating behavior of the account will affect the application code of the application, and the application will compile the application code into assembly instructions at runtime, if the account has cheating behavior, then its cheating behavior will make the compiled running assembly instructions different from the target assembly instructions when there is no cheating behavior. The verification process of the assembly instructions can be used to verify the full amount of application code when the application is running, detect the cheating behavior of the account more comprehensively and accurately, and monitor the security of the account more efficiently, thereby achieving the technical effect of improving the monitoring efficiency of monitoring the security of the account in the application, thereby solving the technical problem of monitoring the efficiency of monitoring the security of the account in the application.

[0087] In the technical solution provided in the above step S202, the above target application can be but is not limited to any application that compiles application code into assembly instructions during operation, such as: multimedia applications, live broadcast applications, short video applications, instant messaging applications, financial applications, shopping applications, as well as stand-alone games on computer platforms, video games on game console platforms, games on mobile devices (such as the above-mentioned mobile games compiled based on Unity-mono), etc.

[0088] Optionally, in this embodiment, the running application code refers to the program code currently used by the target application, which may be somewhat different from the initial development code when the target program was developed, and this difference may be caused by the running or updating of the target application, or by the tampering of the code. For the difference in code caused by the running or updating of the target application, since the application code for verification indicated by the target verification information will also change or update with respect to the initial content, the difference in code caused by these running or updating will not be identified as cheating behavior, and only the difference in code caused by the tampering of the code will be detected as cheating behavior of the account.

[0089] Optionally, in this embodiment, each running application code can be but is not limited to being compiled into one or more running assembly instructions, and the set of all running assembly instructions obtained after compiling all the running application codes of the target application is used as the set of running assembly instructions. That is to say, the account security monitoring process provided in this embodiment can verify the full assembly instructions of the target application, thereby comprehensively detecting all cheating behaviors existing in the account.

[0090] In the technical solution provided in the above step S204, the target verification information is used to indicate the target assembly instructions compiled from each application code of the target application when there is no cheating behavior on the target application. The target verification information may include, but is not limited to, the target assembly instruction itself, or may include, but is not limited to, the assembly rules that the target assembly instruction needs to satisfy, or may store a part of the target assembly instruction and then store a part of the assembly rules that the target assembly instruction needs to satisfy.

[0091] Optionally, in this embodiment, the method of verifying the running assembly instruction may be, but is not limited to, verifying whether the running assembly instruction is consistent with the target assembly instruction stored in the target verification information, or it may be verifying whether the running assembly instruction satisfies the assembly rules that the target assembly instruction stored in the target verification information needs to satisfy.

[0092] Optionally, in this embodiment, the target verification information may be stored in the form of, but not limited to, files, lists, databases, etc. For example, the target verification information may be stored in the form of, but not limited to, white value files.

[0093] As an optional solution, verifying each of the running assembly instructions in the running assembly instruction set according to the target verification information includes:

[0094] S11, determining the instruction type to which each of the running assembly instructions belongs;

[0095] S12, when each of the running assembly instructions belongs to the address-related type, extracting running instruction data from each of the running assembly instructions; verifying whether the running instruction data meets the verification condition recorded in the target verification information, wherein the assembly instructions belonging to the address-related type are assembly instructions that allow instruction data to be changed;

[0096] S13, when each of the running assembly instructions belongs to the address-independent type, performing a hash transformation on each of the running assembly instructions to obtain first hash data; and verifying whether the first hash data is consistent with the target hash data recorded in the target verification information, wherein the assembly instructions belonging to the address-independent type are assembly instructions with fixed instruction data.

[0097] Optionally, in this embodiment, assembly instructions are divided into different instruction types according to the characteristics of each assembly instruction. For example, the instruction types can be divided into address-related types and address-independent types according to whether the assembly instruction is address-related, but not limited to. This division method also indicates whether the assembly instruction will change the instruction data as the running data changes. The assembly instructions belonging to the address-related type are assembly instructions that allow the instruction data to change, and the assembly instructions belonging to the address-independent type are assembly instructions with fixed instruction data.

[0098] Optionally, in this embodiment, for the address-related type of running assembly instructions, since the characteristic of this type of assembly instruction is that the instruction data is allowed to change, this type of assembly instruction is not fixed, but will change according to different running processes. For assembly instructions with this characteristic, part of the instruction data can be extracted from the assembly instruction as running instruction data for verification. And what is verified is whether the extracted running instruction data meets the verification conditions recorded in the target verification information.

[0099] Optionally, in this embodiment, for the running assembly instruction of the address-independent type, since the characteristic of this type of assembly instruction is that the instruction data is fixed, for the assembly instruction with this characteristic, a hash transformation can be directly performed on it to obtain first hash data, and the first hash data can be directly verified to be consistent with the target hash data recorded in the target verification information.

[0100] Optionally, in this embodiment, the manner of performing hash transformation on the running assembly instruction may include but is not limited to any type of algorithm for calculating hash values, such as the above-mentioned FNV algorithm.

[0101] Optionally, in this embodiment, the FNV algorithm is used to calculate the hash value of the running assembly instruction, and the hash value is verified with the target hash data recorded in the target verification information to ensure the security of the running assembly instruction.

[0102] Through the above process, assembly instructions of different instruction types are verified in a manner adapted to their characteristics according to their different characteristics, which can make the verification process more adaptable and comprehensive.

[0103] In an optional embodiment, a process for checking each running assembly instruction is provided, such as Figure 3 As shown, for a running assembly instruction to be verified, first determine its instruction type. If it is an address-related type, extract the running instruction data from the running assembly instruction, and then verify whether the extracted running instruction data meets the verification conditions. If it is an address-independent type, perform a hash conversion on it, and verify whether the converted first hash data is consistent with the target hash data.

[0104] As an optional solution, extracting the running instruction data from each of the running assembly instructions includes:

[0105] S21, determining a target instruction category to which each of the running assembly instructions belongs, wherein the address-related type is divided into a plurality of instruction categories, and the plurality of instruction categories include the target instruction category;

[0106] S22, extracting instruction data corresponding to the target instruction classification from each of the running assembly instructions as the running instruction data.

[0107] Optionally, in this embodiment, the classification of assembly instructions can be but is not limited to multi-level, and the first level is divided into address-related types and address-independent types. Assembly instructions belonging to the address-related type can be further subdivided according to the characteristics of the assembly instructions. For example: the second level can further subdivide the assembly instructions belonging to the address-related type into 4 instruction categories, and determine the target instruction category to which the running assembly instruction belongs from these 4 instruction categories.

[0108] Optionally, in this embodiment, the address-independent type can be further divided, for example, 7 instruction categories are divided. Then all assembly instructions can be divided into two major categories and 11 minor categories, so that the complicated assembly instructions can be divided in an orderly manner, laying a solid foundation for the feasibility of the subsequent verification process.

[0109] Optionally, in this embodiment, according to different characteristics of assembly instructions of different instruction categories, instruction data corresponding to the target instruction category may be extracted from the running assembly instructions as running instruction data, but is not limited to it.

[0110] Optionally, in this embodiment, the assembly instructions corresponding to all C# functions are processed in a classified manner. Figure 4 As shown, based on the classification rules, the full amount of ARM assembly instructions corresponding to the C# function under the Unity-mono compilation mode are divided into two types of instruction types (A-type instructions and B-type instructions). Based on this basis, the subdivision is continued, and the A-type instructions (equivalent to the above-mentioned address-related types) are divided into 4 types of instructions (a1-type assembly instructions to a4-type assembly instructions), and the B-type instructions (equivalent to the above-mentioned address-independent types) are divided into 7 types of instructions (b1-type assembly instructions to b7-type assembly instructions). For B-type instructions, the instruction hash is directly calculated and verified. For A-type instructions, different information is extracted from this type of assembly instructions according to different instruction classifications and instruction data, such as function information, special instruction information, etc., and the extracted information is subjected to instruction hash calculation and verification.

[0111] In the above optional implementation, a process for checking the running assembly instructions belonging to the address-related type is also provided, such as Figure 5 As shown, for the running assembly instructions belonging to the address-related type, they are further subdivided, and the target instruction category to which they belong is determined from the four instruction categories (category 1, category 2, category 3 and category 4), such as category 3, and the instruction data corresponding to category 3 is extracted from the running assembly instructions as the running instruction data.

[0112] As an optional solution, extracting instruction data corresponding to the target instruction classification from each of the running assembly instructions as the running instruction data includes:

[0113] S31, when the target instruction is classified as an intra-function jump type, determining all instruction data of each of the running assembly instructions as the running instruction data;

[0114] S32, when the target instruction is classified as an external function jump class or a memory read-write class, determine whether each of the running assembly instructions has an inline phenomenon, and obtain a determination result, wherein the inline phenomenon refers to the mutual conversion phenomenon between the assembly instructions of the external function jump class and the assembly instructions of the memory read-write class; extract part of the instruction data corresponding to the determination result from each of the running assembly instructions as the running instruction data.

[0115] Optionally, in this embodiment, jump instructions can be subdivided from the address-related types, and according to the characteristics of jump instructions (such as instruction size), they can be further subdivided into intra-function jump instructions and extra-function jump instructions. For the two different types of jump instructions, corresponding detection is performed respectively: for intra-function jump instructions, all instruction contents of the assembly instructions of the intra-function jump class are detected to ensure the security of all contents of the entire instruction.

[0116] Optionally, in this embodiment, for the assembly instruction of the function jump class, another instruction classification memory read-write class divided from the address-related type may be inlined, and the inline phenomenon refers to the mutual conversion phenomenon between the assembly instruction of the function jump class and the assembly instruction of the memory read-write class. If the target instruction is classified as the function jump class or the memory read-write class, it is first determined whether the running assembly instruction has an inline phenomenon to obtain a determination result, and then according to the obtained determination result, the part of the instruction data corresponding to the determination result is extracted from the running assembly instruction as the running instruction data.

[0117] For example: if the above classification 3 is an intra-function jump class, all instruction data of the running assembly instruction will be determined as the running instruction data; if the above classification 3 is an extra-function jump class, first determine whether the running assembly instruction has an inline phenomenon, or whether there is an running assembly instruction in the running assembly instruction set that produces an inline phenomenon with it, so as to obtain a determination result, and then extract part of the instruction data corresponding to the determination result from the running assembly instruction as the running instruction data.

[0118] As an optional solution, extracting part of instruction data corresponding to the determination result from each of the running assembly instructions as the running instruction data includes:

[0119] S41, when the determination result indicates that each of the running assembly instructions does not have an inline phenomenon, determining the operation code and position information of each of the running assembly instructions as the running instruction data;

[0120] S42: When the determination result indicates that each of the running assembly instructions has an inline phenomenon, determine the location information of each of the running assembly instructions as the running instruction data.

[0121] Optionally, in this embodiment, for an operation assembly instruction without inline phenomenon, the operation code and position information of the operation assembly instruction are extracted as the operation instruction data. For an operation assembly instruction with inline phenomenon, its position information is extracted as the operation instruction data.

[0122] Optionally, in this embodiment, the above position information may refer to, but is not limited to, the offset of the current assembly instruction relative to the function header. The opcode of the assembly instruction may refer to, but is not limited to, the action type of the assembly instruction, such as MOV, ADD, SUB, etc. The assembly instruction may also have an operand, and the operand of the assembly instruction refers to the action object of the assembly instruction.

[0123] Optionally, in this embodiment, for assembly instructions of the out-of-function jump type that do not have the inline phenomenon, the opcode and the location information of the assembly instruction are detected to ensure the security of the opcode and location information of the assembly instructions of the out-of-function jump type. Since out-of-function jumps are generally function calls, simply modifying the instruction operand will most likely cause the game program to crash directly, so ensuring the security of the instruction opcode can ensure the security of most of the assembly instructions of the out-of-function jump type).

[0124] Optionally, in this embodiment, by analyzing the application code (such as the game engine code) and actually developing and testing, it is confirmed that the impact of the inline phenomenon of functions in the application program on the assembly instructions is mainly concentrated on the mutual changes between memory read and write instructions and function-external jump instructions. Based on the analysis conclusion, the assembly instructions of the memory read and write class and the assembly instructions of the function-external jump class with the inline phenomenon are abstracted, and the location information of the memory read and write instructions (the location information refers to the offset of the current instruction relative to the function header) and the location information of the function-external jump instructions are recorded, such as Figure 6 As shown, the two types of assembly instruction information are abstracted into the same offset through the above instruction refinement process. After obtaining the offset, an increasing integer sequence can be obtained as the running instruction data.

[0125] As an optional solution, verifying whether the operation instruction data meets the verification condition recorded in the target verification information includes:

[0126] S51, performing a hash transformation on the operation instruction data to obtain second hash data;

[0127] S52: Verify whether the second hash data satisfies the verification condition recorded in the target verification information.

[0128] Optionally, in this embodiment, the manner of performing hash transformation on the running assembly instruction may include but is not limited to any type of algorithm for calculating hash values, such as the above-mentioned FNV algorithm.

[0129] Optionally, in this embodiment, the FNV algorithm is used to calculate the hash value of the running instruction data, and the hash value is verified with the verification condition recorded in the target verification information to ensure the security of running the assembly instruction.

[0130] In the technical solution provided in the above step S206, if there are tampered assembly instructions that fail verification in the running assembly instruction set, it can be determined that the target account that logs into the target application has cheated.

[0131] As an optional solution, after determining that the target account for logging into the target application has cheating behavior, the method further includes:

[0132] S61, obtaining the penalty operation corresponding to the instruction type of the tampered assembly instruction;

[0133] S62: Execute the penalty operation on the target account.

[0134] Optionally, in this embodiment, different instruction types correspond to different penalty operations, ie, penalty measures, so that the severity of the penalty operation is reflected according to the characteristics of the instruction type of the assembly instruction.

[0135] Optionally, in this embodiment, the penalty operation may include, but is not limited to, any operation that has a moderate negative impact or a punitive effect on the account, such as, but is not limited to, blocking the account for a period of time, and the length of the blocking period may be determined based on the consequences of the cheating behavior and the degree of application code tampering. The penalty operation may also include, but is not limited to, removing certain specific titles, deducting virtual currency, etc.

[0136] As an optional solution, the above account security monitoring method also includes:

[0137] S71, creating a first thread and a second thread;

[0138] S72, obtaining, by the first thread, an operation of obtaining a set of running assembly instructions compiled from each running application code in the running process of the target application, and obtaining the target verification information;

[0139] S73, executing, through the second thread, an operation of verifying each of the running assembly instructions in the running assembly instruction set according to the target verification information, and executing an operation of determining that a target account that logs into the target application has cheated when there is a tampered assembly instruction that fails the verification in the running assembly instruction set.

[0140] Optionally, in this embodiment, the account security monitoring process may be implemented, but not limited to, through multiple threads. For example, two threads may be created, one for acquiring data used in the monitoring process and the other for executing various operations in the monitoring process using the acquired data.

[0141] Optionally, in this embodiment, the data used in the monitoring process may include but is not limited to: running assembly instructions compiled from each running application code during the running of the target application, and target assembly instruction target verification information compiled from each application code of the target application for indicating that there is no cheating behavior on the target application, etc.

[0142] Through the above process, multiple threads are divided to respectively realize the process of obtaining data and the process of account security monitoring, which can effectively improve the processing efficiency of the account security monitoring process and make the account security monitoring speed faster.

[0143] In an optional implementation, a processing procedure of the above-mentioned account security monitoring method is provided, such as Figure 7 As shown, taking the monitoring of account security in a game application as an example, the processing process is completed in two threads (Thread A and Thread B):

[0144] Thread A: This thread is used to complete the acquisition of the data source required in the processing process, including: HashTable pointer (which is used to obtain the fully compiled function information (i.e. the above-mentioned set of running assembly instructions)), white value file memory address (which is used to parse the content of the locally generated white value file for subsequent verification work), hookBuffer pointer (which is used to parse and record the hook information of the security solution itself and the function information modified by the hot update on the game side).

[0145] Thread B: The account security monitoring process is executed in this process, which may include but is not limited to the parsing and storage of function information in various function pools, the parsing of all function assembly instructions, and the final verification process.

[0146] In order to explain the above-mentioned account security monitoring process in more detail and clarity, in an optional embodiment, a process for monitoring the security of a game account in a mobile game compiled based on Unity-mono is also provided, such as Figure 8 As shown, the process may include but is not limited to the following processes:

[0147] Step S802, obtaining the running assembly instructions compiled from the running code of the game during the running of the game, and obtaining a running assembly instruction set.

[0148] Step S804: determine the instruction type to which each execution assembly instruction in the execution assembly instruction set belongs.

[0149] Step S806: for the running assembly instruction belonging to the address-related type, determine the target instruction category to which the running assembly instruction belongs.

[0150] Step S808: For an execution assembly instruction whose target instruction is classified as an intra-function jump type, all instruction data of the execution assembly instruction are determined as execution instruction data, and the process jumps to step S816.

[0151] Step S810, for the running assembly instruction whose target instruction is classified as an external function jump type or a memory read / write type, determine whether there is an inline phenomenon.

[0152] Step S812: If there is no inline phenomenon, the operation code and position information of the running assembly instruction are determined as the running instruction data, and the process jumps to step S816.

[0153] Step S814: If the inline phenomenon exists, the location information of the running assembly instruction is determined as the running instruction data, and the process jumps to step S816.

[0154] Step S816, execute the FNV algorithm on the running instruction data to obtain a hash value.

[0155] Step S818, verify whether the hash value meets the hash white value condition recorded in the white value file.

[0156] Step S820, for the running assembly instruction of the address-independent type, execute the FNV algorithm on it to obtain a hash value.

[0157] Step S822, verify whether the hash value is consistent with the hash white value recorded in the white value file.

[0158] In this optional embodiment, an application scenario of using the above method to monitor the security of a game account in a mobile game is also provided, such as Fig. 9 As shown, the running assembly instructions compiled by each running application code in the running process of the mobile game application are obtained to obtain the running assembly instruction set. Through the above process, each running assembly instruction in the running assembly instruction set is verified according to the target verification information. It can be determined that there are tampered assembly instructions that have not passed the verification in the running assembly instruction set, and it can be determined that the game account that logs into the mobile game application has cheating behavior. And it can be determined that the cheating behavior used by the game account is to tamper with the parameter of the number of bullets of the game character to 100000000. According to the cheating behavior, it can be obtained that the penalty operation performed on the game account is to kick out the game and block the account for 365 days. Then, the penalty operation can be performed on the game account, and a prompt window is displayed on the game interface of the game account to prompt that the player has been kicked out of the game. When the player uses the game account to log in to the game again, he will not be able to log in, and a pop-up window will be displayed to prompt the player the reason for the penalty and the remaining penalty time. For example: if the player logs in again immediately after being kicked out of the game, the player will be prompted that there is illegal game behavior, and the remaining penalty time is 365 days, 00 hours, 00 minutes, and 00 seconds. This will promptly detect players' cheating behavior and impose corresponding penalties, ensuring a good gaming environment for other players.

[0159] Through the optional embodiments provided in this application, a universal security monitoring solution for all assembly instructions is provided for the security issues of assembly instructions corresponding to C# functions in Unity-mono games. Only one configuration is required to perform security protection on assembly instructions corresponding to all C# functions in Unity-mono games, greatly improving the security of assembly instructions corresponding to C# functions in Unity-mono games, and solving the problems of small coverage, lag, low efficiency, etc. of existing security solutions.

[0160] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0161] According to another aspect of an embodiment of the present invention, there is also provided an account security monitoring device for implementing the above-mentioned account security monitoring method. Fig.10 As shown, the device comprises:

[0162] The first acquisition module 1002 is used to acquire the running assembly instructions compiled from each running application code during the running process of the target application to obtain a running assembly instruction set;

[0163] A verification module 1004 is used to verify each of the running assembly instructions in the running assembly instruction set according to target verification information, wherein the target verification information is used to indicate the target assembly instructions compiled from each application code of the target application when there is no cheating behavior on the target application;

[0164] The determination module 1006 is used to determine that the target account that logs into the target application has cheating behavior when there is a tampered assembly instruction that fails the verification in the running assembly instruction set.

[0165] Through the embodiments provided by the present application, each running application code during the running process of the target application will be compiled into a running assembly instruction, and these running assembly instructions are obtained to obtain a running assembly instruction set. Each running assembly instruction in the running assembly instruction set is verified according to the target verification information of the target assembly instruction compiled into each application code of the target application when there is no cheating behavior on the target application. If there is a tampered assembly instruction that fails the verification in the running assembly instruction set, it can be determined that the target account that logs into the target application has cheating behavior, thereby achieving the purpose of detecting the cheating behavior of the account by fully verifying the assembly instructions. First, since any cheating behavior of the account will affect the application code of the application, and the application will compile the application code into assembly instructions at runtime, if the account has cheating behavior, then its cheating behavior will make the compiled running assembly instructions different from the target assembly instructions when there is no cheating behavior. The verification process of the assembly instructions can be used to verify the full amount of application code when the application is running, detect the cheating behavior of the account more comprehensively and accurately, and monitor the security of the account more efficiently, thereby achieving the technical effect of improving the monitoring efficiency of monitoring the security of the account in the application, thereby solving the technical problem of monitoring the efficiency of monitoring the security of the account in the application.

[0166] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for monitoring account security, which will not be described in detail in this example.

[0167] As an optional solution, the verification module includes:

[0168] A determination unit, used to determine the instruction type to which each of the running assembly instructions belongs;

[0169] A first verification unit is used to extract running instruction data from each running assembly instruction when each running assembly instruction belongs to an address-related type; verify whether the running instruction data meets the verification condition recorded in the target verification information, wherein the assembly instruction belonging to the address-related type is an assembly instruction that allows instruction data to be changed;

[0170] The second verification unit is used to perform a hash transformation on each of the running assembly instructions to obtain first hash data when each of the running assembly instructions belongs to an address-independent type; and verify whether the first hash data is consistent with the target hash data recorded in the target verification information, wherein the assembly instructions belonging to the address-independent type are assembly instructions with fixed instruction data.

[0171] As an optional solution, the first verification unit includes:

[0172] A determination subunit, configured to determine a target instruction category to which each of the running assembly instructions belongs, wherein the address-related type is divided into a plurality of instruction categories, and the plurality of instruction categories include the target instruction category;

[0173] The extraction subunit is used to extract instruction data corresponding to the target instruction classification from each of the running assembly instructions as the running instruction data.

[0174] As an optional solution, the extraction subunit is used to:

[0175] In the case where the target instruction is classified as an intra-function jump type, all instruction data of each of the execution assembly instructions are determined as the execution instruction data;

[0176] In the case where the target instruction is classified as an out-of-function jump class or a memory read-write class, determine whether each of the running assembly instructions has an inline phenomenon, and obtain a determination result, wherein the inline phenomenon refers to a mutual conversion phenomenon between the assembly instructions of the out-of-function jump class and the assembly instructions of the memory read-write class; extract part of the instruction data corresponding to the determination result from each of the running assembly instructions as the running instruction data.

[0177] As an optional solution, the extraction subunit is used to:

[0178] In a case where the determination result indicates that each of the running assembly instructions does not have an inline phenomenon, determining the operation code and position information of each of the running assembly instructions as the running instruction data;

[0179] When the determination result indicates that each of the running assembly instructions has an inline phenomenon, the location information of each of the running assembly instructions is determined as the running instruction data.

[0180] As an optional solution, the first verification unit includes:

[0181] A transformation subunit, configured to perform a hash transformation on the operation instruction data to obtain second hash data;

[0182] The verification subunit is used to verify whether the second hash data meets the verification condition recorded in the target verification information.

[0183] As an optional solution, the device further includes:

[0184] A second acquisition module is used to acquire the penalty operation corresponding to the instruction type of the tampering assembly instruction after determining that the target account that logs into the target application has cheated;

[0185] The first execution module is used to execute the penalty operation on the target account.

[0186] As an optional solution, the device further includes:

[0187] A creation module, used to create a first thread and a second thread;

[0188] A second execution module is used to execute, through the first thread, an operation of obtaining a set of running assembly instructions compiled from each running application code in the running process of the target application, and obtain the target verification information;

[0189] The third execution module is used to execute, through the second thread, an operation of verifying each of the running assembly instructions in the running assembly instruction set according to the target verification information, and an operation of determining that a target account that logs into the target application has cheated when there is a tampered assembly instruction that fails the verification in the running assembly instruction set.

[0190] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for monitoring account security, which will not be described in detail in this example.

[0191] According to another aspect of the embodiments of the present invention, there is also provided an electronic device for implementing the above-mentioned account security monitoring method, such as Fig.11 As shown, the electronic device includes a memory 1102 and a processor 1104. The memory 1102 stores a computer program, and the processor 1104 is configured to execute the steps in any of the above method embodiments through the computer program.

[0192] Optionally, in this embodiment, the electronic device may be located in at least one network device among a plurality of network devices of a computer network.

[0193] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0194] S1, obtaining the running assembly instructions compiled from each running application code during the running process of the target application, and obtaining a running assembly instruction set;

[0195] S2, verifying each of the running assembly instructions in the running assembly instruction set according to the target verification information, wherein the target verification information is used to indicate the target assembly instructions compiled from each application code of the target application when there is no cheating behavior on the target application;

[0196] S3, when there is a tampered assembly instruction that fails verification in the running assembly instruction set, determining that the target account that logs into the target application has cheating behavior.

[0197] Alternatively, a person skilled in the art may understand that: Fig.11 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Fig.11 The structure of the electronic device is not limited. Fig.11 More or fewer components (such as network interfaces, etc.) as shown in, or with Fig.11 Different configurations are shown.

[0198] Among them, the memory 1102 can be used to store software programs and modules, such as the program instructions / modules corresponding to the account security monitoring method and device in the embodiment of the present invention. The processor 1104 executes various functional applications and data processing by running the software programs and modules stored in the memory 1102, that is, to implement the above-mentioned account security monitoring method. The memory 1102 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1102 may further include a memory remotely arranged relative to the processor 1104, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Among them, the memory 1102 may be specifically, but not limited to, used to store information such as false touch signals, touch positions, and detection areas. As an example, if Fig.11 As shown, the memory 1102 may include but is not limited to the first acquisition module 1002, the verification module 1004 and the determination module 1006 in the above-mentioned account security monitoring device. In addition, it may also include but is not limited to other module units in the above-mentioned account security monitoring device, which will not be repeated in this example.

[0199] Optionally, the transmission device 1106 is used to receive or send data via a network. Specific examples of the network may include a wired network and a wireless network. In one example, the transmission device 1106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 1106 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0200] In addition, the electronic device further includes: a display 1108 for displaying the false touch signal, touch position, detection area and other information; and a connection bus 1110 for connecting various module components in the electronic device.

[0201] In other embodiments, the terminal device or server may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes through network communication. Among them, the nodes may form a peer-to-peer (P2P) network, and any form of computing device, such as a server, terminal or other electronic device, may become a node in the blockchain system by joining the peer-to-peer network.

[0202] According to one aspect of the present application, a computer program product or computer program is provided, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the above-mentioned account security monitoring method, wherein the computer program is configured to execute the steps of any of the above-mentioned method embodiments when running.

[0203] Optionally, in this embodiment, the computer-readable storage medium may be configured to store a computer program for performing the following steps:

[0204] S1, obtaining the running assembly instructions compiled from each running application code during the running process of the target application, and obtaining a running assembly instruction set;

[0205] S2, verifying each of the running assembly instructions in the running assembly instruction set according to the target verification information, wherein the target verification information is used to indicate the target assembly instructions compiled from each application code of the target application when there is no cheating behavior on the target application;

[0206] S3, when there is a tampered assembly instruction that fails verification in the running assembly instruction set, determining that the target account that logs into the target application has cheating behavior.

[0207] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0208] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0209] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling one or more computer devices (which can be personal computers, servers or network devices, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.

[0210] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0211] In the several embodiments provided in the present application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0212] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0213] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0214] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for monitoring account security, characterized in that: include: Obtaining the running assembly instructions compiled from each running application code during the running process of the target application to obtain a running assembly instruction set; In the case where each running assembly instruction in the running assembly instruction set is of an address-related type, extracting running instruction data from each running assembly instruction; Verifying whether the running instruction data satisfies the verification condition recorded in the target verification information, wherein the target verification information is used to indicate the target assembly instruction compiled from each application code of the target application when there is no cheating behavior on the target application, and the assembly instruction belonging to the address-related type is an assembly instruction that allows the instruction data to be changed; when each of the running assembly instructions belongs to the address-independent type, performing a hash transformation on each of the running assembly instructions to obtain first hash data; verifying whether the first hash data is consistent with the target hash data recorded in the target verification information, wherein the assembly instruction belonging to the address-independent type is an assembly instruction with fixed instruction data; When there is a tampered assembly instruction that fails verification in the running assembly instruction set, it is determined that there is cheating behavior in the target account that logs into the target application.

2. The method according to claim 1, characterized in that: Extracting operation instruction data from each of the operation assembly instructions includes: Determine a target instruction category to which each of the running assembly instructions belongs, wherein the address-related type is divided into a plurality of instruction categories, and the plurality of instruction categories include the target instruction category; Instruction data corresponding to the target instruction classification is extracted from each of the execution assembly instructions as the execution instruction data.

3. The method according to claim 2, characterized in that Extracting instruction data corresponding to the target instruction classification from each of the running assembly instructions as the running instruction data comprises: In the case where the target instruction is classified as an intra-function jump type, all instruction data of each of the execution assembly instructions are determined as the execution instruction data; In the case where the target instruction is classified as an out-of-function jump class or a memory read-write class, determine whether each of the running assembly instructions has an inline phenomenon, and obtain a determination result, wherein the inline phenomenon refers to a mutual conversion phenomenon between the assembly instructions of the out-of-function jump class and the assembly instructions of the memory read-write class; extract part of the instruction data corresponding to the determination result from each of the running assembly instructions as the running instruction data.

4. The method according to claim 3, characterized in that Extracting part of instruction data corresponding to the determination result from each of the running assembly instructions as the running instruction data includes: When the determination result indicates that each of the running assembly instructions does not have an inline phenomenon, determining the operation code and position information of each of the running assembly instructions as the running instruction data; When the determination result indicates that each of the running assembly instructions has an inline phenomenon, the location information of each of the running assembly instructions is determined as the running instruction data.

5. The method according to claim 1, characterized in that Verifying whether the operation instruction data meets the verification condition recorded in the target verification information includes: Performing a hash transformation on the operation instruction data to obtain second hash data; Verify whether the second hash data meets the verification condition recorded in the target verification information.

6. The method according to claim 1, characterized in that After determining that the target account that logs into the target application has cheating behavior, the method further includes: Obtaining the penalty operation corresponding to the instruction type of the tampered assembly instruction; The penalty operation is performed on the target account.

7. The method according to claim 1, characterized in that The method further comprises: Create a first thread and a second thread; Obtaining, by the first thread, an operation of obtaining a set of running assembly instructions compiled from each running application code in the running process of the target application, and obtaining the target verification information; The second thread executes an operation of verifying each of the running assembly instructions in the running assembly instruction set according to the target verification information, and executes an operation of determining that a target account that logs into the target application has cheated when there are tampered assembly instructions that fail the verification in the running assembly instruction set.

8. A device for monitoring account security, characterized in that: include: A first acquisition module is used to acquire the running assembly instructions compiled from each running application code during the running process of the target application to obtain a running assembly instruction set; A verification module, configured to extract operation instruction data from each operation assembly instruction in the operation assembly instruction set when each operation assembly instruction belongs to an address-related type; Verifying whether the running instruction data satisfies the verification condition recorded in the target verification information, wherein the target verification information is used to indicate the target assembly instruction compiled from each application code of the target application when there is no cheating behavior on the target application, and the assembly instruction belonging to the address-related type is an assembly instruction that allows the instruction data to be changed; when each of the running assembly instructions belongs to the address-independent type, performing a hash transformation on each of the running assembly instructions to obtain first hash data; verifying whether the first hash data is consistent with the target hash data recorded in the target verification information, wherein the assembly instruction belonging to the address-independent type is an assembly instruction with fixed instruction data; The determination module is used to determine that a target account logging into the target application has cheating behavior when there is a tampered assembly instruction that fails verification in the running assembly instruction set.

9. The device according to claim 8, characterized in that The verification module comprises: A determination subunit, configured to determine a target instruction category to which each of the running assembly instructions belongs, wherein the address-related type is divided into a plurality of instruction categories, and the plurality of instruction categories include the target instruction category; The extraction subunit is used to extract instruction data corresponding to the target instruction classification from each of the running assembly instructions as the running instruction data.

10. The device according to claim 9, characterized in that The extraction subunit is used to: when the target instruction is classified as an intra-function jump class, determine all instruction data of each of the running assembly instructions as the running instruction data; In the case where the target instruction is classified as an out-of-function jump class or a memory read-write class, determine whether each of the running assembly instructions has an inline phenomenon, and obtain a determination result, wherein the inline phenomenon refers to a mutual conversion phenomenon between the assembly instructions of the out-of-function jump class and the assembly instructions of the memory read-write class; extract part of the instruction data corresponding to the determination result from each of the running assembly instructions as the running instruction data.

11. The device according to claim 10, characterized in that The extracting subunit is used to: when the determination result indicates that each of the running assembly instructions does not have an inline phenomenon, determine the operation code and position information of each of the running assembly instructions as the running instruction data; When the determination result indicates that each of the running assembly instructions has an inline phenomenon, the location information of each of the running assembly instructions is determined as the running instruction data.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program executes the method described in any one of claims 1 to 7 when executed.

13. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 7 through the computer program.

Images