Game cheat detection method and device, storage medium, and electronic device

Abstract

The present application discloses a method and device for detecting game plug-ins, a storage medium, and an electronic device. The method includes: obtaining a first data structure of a processor on a terminal, in which the current running thread on the processor is recorded; obtaining thread information of the current running thread; determining whether the current running thread is a plug-in thread according to the thread information of the current running thread, and the plug-in thread is used to run the plug-in code in the memory, and the plug-in code is the code loaded into the memory when the startup file is running and used to execute the plug-in task in the game. The present application solves the technical problem of low accuracy in judging game plug-ins in the related art.

Description

Technical Field

[0001] The present application relates to the field of computer security, and more specifically, to a method and device for detecting game cheats, a storage medium, and an electronic device. Background Art

[0002] With the development of online games, there has been a great improvement in both the number of products and the scale of users. However, with the development of online games, cheating behaviors have also emerged in an endless stream. Some users use cheating programs to gain benefits in the game, which seriously undermines fairness and even causes a surge in the workload of the server running the game, bringing adverse effects to the operators of online games. Therefore, how to combat cheating users in online games is the primary task to promote the development of the online game industry.

[0003] The existing anti-cheating scheme is implemented by analyzing the collected game data. If the game data meets specific rules, the user is determined to be cheating. This method will lead to inaccurate results for determining cheating users in online games and prone to misjudgment. Therefore, how to improve the accuracy of cheating user judgment results is one of the technical problems that need to be solved urgently.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a method and device for detecting game plug-ins, a storage medium, and an electronic device to at least solve the technical problem of low accuracy in judging game plug-ins in the related art.

[0006] According to one aspect of an embodiment of the present application, a method for detecting game plug-ins is provided, including: obtaining a first data structure of a processor on a terminal, the first data structure recording a current running thread on the processor; obtaining thread information of the current running thread; determining whether the current running thread is a plug-in thread based on the thread information of the current running thread, the plug-in thread is used to run plug-in code in memory, the plug-in code is code loaded into memory when a startup file is run and used to execute plug-in tasks in the game.

[0007] According to another aspect of an embodiment of the present application, a game plug-in detection device is also provided, including: a first acquisition unit, used to acquire a first data structure of a processor on a terminal, the first data structure recording a current running thread on the processor; a second acquisition unit, used to acquire thread information of the current running thread; a determination unit, used to determine whether the current running thread is a plug-in thread based on the thread information of the current running thread, the plug-in thread is used to run plug-in code in memory, the plug-in code is code loaded into memory when the startup file is running and used to execute plug-in tasks in the game.

[0008] According to another aspect of an embodiment of the present application, a storage medium is further provided, which includes a stored program, and the above method is executed when the program is run.

[0009] According to another aspect of an embodiment of the present application, an electronic device is further provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the above method through the computer program.

[0010] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps of any one of the embodiments of the above method.

[0011] In an embodiment of the present application, a first data structure of a processor on a terminal is obtained, in which the current running thread on the processor is recorded; thread information of the current running thread is obtained; and it is determined whether the current running thread is a plug-in thread based on the thread information of the current running thread. The plug-in thread is used to run plug-in code on the memory. The plug-in code is loaded into the memory when the startup file is run and is used to execute plug-in tasks in the game. This makes it possible to monitor plug-in threads that cannot be detected in related technologies, and can solve the technical problem of low accuracy in judging game plug-ins in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0013] Figure 1 is a schematic diagram of a hardware environment of a method for detecting game cheats according to an embodiment of the present application;

[0014] Figure 2 is a flow chart of an optional game cheat detection method according to an embodiment of the present application;

[0015] Figure 3 is a schematic diagram of an optional game cheat detection device according to an embodiment of the present application; and

[0016] Figure 4 It is a structural block diagram of a terminal according to an embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0018] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0019] After analyzing the game cheating software (hereinafter referred to as game plug-ins), the inventors realized that its development pattern is: it started with application layer plug-ins, then turned to kernel layer plug-ins, and finally turned to plug-ins using UEFI technology (UEFI generally refers to the Unified Extensible Firmware Interface, which is a personal computer system specification used to define the software interface between the operating system and the system firmware as an alternative to BIOS) (commonly known as BIOS plug-ins, full name Basic Input Output System). It can be seen that the technology used is getting lower and lower, and its purpose is to hide the plug-in itself as much as possible.

[0020] This solution is mainly aimed at the research after the plug-in enters the kernel layer. After the plug-in enters the kernel, it needs to be run, and the carrier of the operation must be a thread, that is, the plug-in code must be executed based on the thread, so hiding the thread can well improve the technical threshold for its detection.

[0021] In order to achieve thread hiding, the following two technologies can be used:

[0022] 1) Processing of PspCidTable (PspCidTable is a handle table, its format is the same as that of an ordinary handle table, but it is different from the private handle table of each process: the objects stored in PspCidTable are all process thread objects in the system, and its index is PID and TID; PspCidTable directly stores the object body EPROCESS and ETHREAD, while the private handle table of each process stores the object header OBJECT_HEADER; PspCidTable is an independent handle table, and the private handle table of each process is connected by a double link) for the PsLookupThreadByThreadId function.

[0023] 2) Using UEFI technology, enumerating threads and obtaining the kernel object of the thread based on the thread ID will eventually call the system function PsLookupThreadByThreadId. Inside this function, the main operation is the PspCidTable table. There is a chain in this table that records all threads and processes. Just find the chain node of the thread to be hidden and then disconnect it. Similarly, the principle of hiding the process is the same.

[0024] Although the above threads are hidden, they are created in a normal way after all and need to be managed by the Windows operating system. They can be enumerated based on the ThreadListEntry chain of ETHREAD of any kernel thread. However, if a thread is created before the Windows operating system, then this is where the focus of this solution is, that is, the UEFI plug-in.

[0025] UEFI plug-in, the current machine boot methods are MBR and UEFI, MBR is the old boot method, UEFI is a new system boot method.

[0026] The normal Windows system boot process is as follows: the computer is powered on and the CPU is initialized. After the CPU is initialized, the UEFI operating environment is initialized, the Windows operating system loader (winload.efi) is loaded, and then the loader (winload.efi) loads the kernel file (ntoskrnl.exe). At this point, control is handed over to the Windows operating system.

[0027] The boot process of the UEFI plug-in Windows system is as follows: first configure the BIOS to boot from the USB flash drive, power on the computer to initialize the CPU, and after the CPU is initialized, initialize the UEFI operating environment, load EFI\BOOT\bootx64.efi in the USB flash drive directory, bootx64.efi loads the Windows operating system loader (winload.efi), and then the loader (winload.efi) loads the kernel file (ntoskrnl.exe), at this point, control is handed over to the Windows operating system.

[0028] Based on the above details, we can find that we need to focus on bootx64.efi because the UEFI operating environment will be initialized after the CPU is initialized. Different from the MBR boot method, this operating environment has rich functions, including event services, memory management, driver management, image management, lightweight file system, mouse and keyboard control, and screen drawing. It is precisely because the UEFI operating environment supports so many functions and is earlier than the boot of the Windows operating system that it has become the focus of some plug-ins.

[0029] The process of the plug-in: The plug-in bootx64.efi is started, and the file system and memory management functions supported by UEFI are used to load the sys driver that the plug-in specializes in into the memory, and create a thread, then load winload.efi and pass the control to winload.efi in order to successfully load ntoskrnl.exe.

[0030] The operation of ntoskrnl.exe is also relatively obscure. When it is initialized, it can know the memory loaded by the plug-in and the threads created by the plug-in. However, since it is not created by itself, it simply handles it: for example, ntoskrnl.exe does not record the memory loaded and used by the plug-in in detail, at least the normal Windows function cannot enumerate and locate it. For the threads created by the plug-in, it only allocates an ETHREAD structure for it, but does not register this thread information in the PspCidTable table and ThreadListEntry chain. In fact, it is understandable that the system does this, after all, these resources exist before it is loaded.

[0031] In order to address the problem that plug-ins are difficult to detect because threads are hidden after plug-ins enter the kernel layer, according to one aspect of an embodiment of the present application, a method embodiment of a method for detecting game plug-ins is provided.

[0032] Optionally, in this embodiment, the game cheat detection method can be executed by the terminal 101 running the game, or by the game client installed thereon. If the game is an online game, the hardware environment can also include a game server 103, such as Figure 1 As shown, the server 103 is connected to the terminal 101 via a network, and can be used to provide game services for the terminal or a client installed on the terminal. A database 105 can be set on the server or independently of the server to provide data storage services for the server 103. The above-mentioned network includes but is not limited to: a wide area network, a metropolitan area network or a local area network, and the terminal 101 is not limited to a PC, a mobile phone, a tablet computer, etc.

[0033] Figure 2 is a flow chart of an optional game cheat detection method according to an embodiment of the present application, such as Figure 2 As shown, the method may include the following steps:

[0034] Step S21: The terminal obtains a first data structure of the processor, where the first data structure records the current running thread on the processor.

[0035] Optionally, this step can be implemented as follows:

[0036] Step S211, create a kernel thread and obtain the number of cores N (N is a positive integer) of the processor.

[0037] Step S212, mount the kernel threads one by one to the N cores of the processor, for example, use the KeSetSystemGroupAffinityThread function to mount, so as to read the storage address of a second data structure (such as the storage address of the KPCR data structure) from the register of each core, and obtain the storage addresses of N second data structures, each second data structure has an associated first data structure.

[0038] Step S213: read the second data structure according to the storage address of the second data structure.

[0039] Step S214, obtaining the address of the first data structure recorded in the second data structure of the processor (such as the storage address of the KPRCB data structure).

[0040] Step S215: read the first data structure according to the address of the first data structure recorded in the second data structure.

[0041] Step S22: The terminal obtains thread information (such as thread ID, process ID) of the currently running thread.

[0042] Each processor has at least one core. Each core can run one process or more than one process. Each process has its own address space and resources, such as memory, I / O, and CPU. It is the basic unit of resource allocation on the computing processor, the basic unit of operation scheduling, and the unit of concurrent execution in the system. Each process contains at least one thread, and these threads are sharing the resource space of the process. When the thread changes, it will only cause the CPU execution process to change, and will not change the resources owned by the process.

[0043] Step S23, the terminal determines whether the current running thread is a plug-in thread according to the thread information of the current running thread. The plug-in thread is used to run the plug-in code in the memory. The plug-in code is loaded into the memory when the startup file is running and is used to execute the plug-in task in the game.

[0044] Optionally, this step can be implemented as follows:

[0045] Step S231, obtaining the thread ID of the currently running thread and the process ID of the process in which it is located.

[0046] Step S232: When the thread identifier of the currently running thread is a preset thread identifier and the process identifier of the process in which the thread is located is a preset process identifier, it is determined that the currently running thread is a plug-in thread.

[0047] Step S233: When the thread identifier of the currently running thread is not a preset thread identifier and / or the process identifier of the process in which the thread is located is not a preset process identifier, it is determined that the currently running thread is not a plug-in thread.

[0048] Optionally, since a computer often runs not only one thread, but several or even dozens of threads, these threads are generally run on the processor in a time-sharing multiplexing manner. That is to say, executing the above steps S21-S23 only once cannot guarantee that the plug-in thread can be detected. Therefore, the above steps S21-S23 are executed in a loop and can be executed multiple times in a short period of time to ensure that the running plug-in thread can be captured.

[0049] Optionally, when it is determined that the currently running thread is a plug-in thread, reporting can be performed, such as: reporting the thread information of the plug-in thread to the game server; reporting the plug-in code to the game server; reporting the game account on the terminal to the game server.

[0050] Optionally, after reporting the thread information of the plug-in thread to the game server, the game server can perform the following operations: 1) freeze the game account to ensure the fairness of the game; 2) send instructions to the game client, instructing the kernel thread to perform the following operations: always run on the processor core and monitor the thread that is about to be mounted. If it is found that the plug-in thread is about to be mounted, stop mounting the plug-in thread to avoid game unfairness and other security risks caused by the plug-in thread running the plug-in code; if it is detected that the plug-in thread is in a running state, monitor all operations of the plug-in thread and block all operations of the plug-in thread, so as to achieve the purpose of blocking its cheating behavior in the game.

[0051] Through the above steps, a first data structure of the processor on the terminal is obtained, in which the current running thread on the processor is recorded; thread information of the current running thread is obtained; and it is determined whether the current running thread is a plug-in thread according to the thread information of the current running thread. The plug-in thread is used to run the plug-in code on the memory. The plug-in code is loaded into the memory when the startup file is running and is used to execute plug-in tasks in the game. In this way, plug-in threads that cannot be detected in related technologies can be monitored, and the technical problem of low accuracy in judging game plug-ins in related technologies can be solved.

[0052] As an optional embodiment, the technical solution of the present application is further described in detail below in combination with specific implementation methods:

[0053] Although the Windows system does not register the UEFI plug-in thread information, the thread must be executed, which means it will definitely be scheduled by the CPU. This application is based on the CPU to find a breakthrough. In the system, each CPU has its own data structure KPCR (Processor Control Region). The extended structure of this structure is called KPRCB. KPRCB has a member named CurrentThread, which records which thread is currently running on the CPU core. That is to say, if the CPU has 8 cores, there will be 8 KPCRs and KPRCBs, each recording the ETHREAD thread currently running on its own core.

[0054] The steps to read KPCR and its CurrentThread and ETHREAD are as follows:

[0055] Step 1: Create a kernel thread of your own and obtain the number of CPU cores of the current machine;

[0056] Step 2: Make the above threads attached to each CPU core in sequence (using KeSetSystemGroupAffinityThread function to attach). If there are 8 cores, attach them 8 times.

[0057] Step 3: After each docking, get the value of the gs register, which is the KPCR address of the current CPU core. If the CPU has 8 cores, then save 8 KPCR addresses.

[0058] Step 4: KPCR is a structure that stores CPU runtime and some configuration information.

[0059] Since Windows needs to support multiple CPUs, a set of data structures with the Processor Control Region (KPCR) as the hub is defined in the Windows kernel, so that each CPU has a KPCR. The KPCR structure has a field called KPRCB (Kernel Processor Control Block), which extends KPCR. These two structures are used to store global information related to thread switching.

[0060] For example, there is information indicating which thread is currently running on this CPU, which is the KPCR structure that describes the CPU. In the system, if there is an 8-core CPU, then there are 8 such structures. In KPCR, the KPRCB structure can be determined based on the offset value (such as 0x180 offset). It can be seen that KPRCB is next to KPCR.

[0061] Step 5: This solution involves the KPCRB structure, which is an extension of KPCR. Generally speaking, it exists right after KPCR. Therefore, CurrentThread is based on the 0x188 offset of KPCR (0x8 offset of KPRCB). And these structures based on CPU information rarely change. Facts have also proved that this offset has remained unchanged from XP to Win11. KPRCB exists as an extension of KPCR. Generally speaking, the 0x8 offset is CurrentThread. This solution reads this place frequently. Every thread read will be detected. If the PID is 4 and the tid is 0, it will be considered a UEFI plug-in thread.

[0062] Since Windows thread scheduling is highly frequent, the value in CurrentThread is also fleeting and changes frequently. In order to intercept these changing values, this solution can read the values ​​of the above 8 positions without interval within a certain period of time (0.2 seconds) (that is, read in a dense array manner), and then this hidden thread can be intercepted.

[0063] From the intercepted data analysis of the plug-in, this thread is quite special, and the process ID recorded in its ETHREAD structure is: 4; the thread ID is: 0. And the memory location of the plug-in code can be obtained from the thread code start address value recorded in ETHREAD. When the plug-in thread ETHREAD address is read, the start address of the code executed by this thread can be further obtained, that is, the plug-in code address. As mentioned above, the plug-in code address is also hidden, and based on this method, the hidden code address can be obtained.

[0064] The plug-in data here refers to the plug-in using BIOS (UEFI) technology. Its execution thread belongs to the kernel thread, but it is also different from the ordinary kernel thread. The plug-in thread is characterized by PID 4, tid 0, and the plug-in thread is not registered in Windows, so it does not exist in PspCidTable, so it is impossible to detect it by conventional means. However, this thread must be executed, so directly obtaining it based on the CPU is the most scientific way, which is the core of this solution.

[0065] The key point of this kind of plug-in is to hide itself, including hiding the memory where the code is located and hiding the thread that executes the plug-in code. This solution can detect hidden threads. This solution can stably detect such hidden threads. Since such threads are quite different from normal kernel threads, or they are quite special and have obvious features, they can be directly reported based on these features. In fact, this is the case, and the reported data is not false.

[0066] The technical solution of this application has the following beneficial effects: it is applicable to all UEFI plug-ins (commonly known as BIOS plug-ins). It is applicable to all Windows games; the detection solution is stable and efficient, and has minimal impact on system performance; there is no false alarm, and no operation and maintenance cost.

[0067] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0068] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0069] According to another aspect of an embodiment of the present application, a game cheat detection device for implementing the above-mentioned game cheat detection method is also provided. Figure 3 is a schematic diagram of an optional game cheat detection device according to an embodiment of the present application, such as Figure 3 As shown, the device may include:

[0070] A first acquisition unit 31 is used to acquire a first data structure of a processor on the terminal, wherein the first data structure records a current running thread on the processor;

[0071] The second acquisition unit 33 is used to acquire thread information of the currently running thread;

[0072] The determination unit 35 is used to determine whether the current running thread is a plug-in thread according to the thread information of the current running thread, wherein the plug-in thread is used to run the plug-in code on the memory, and the plug-in code is the code loaded into the memory when the startup file is run and used to execute the plug-in task in the game.

[0073] It should be noted that the first acquisition unit 31 in this embodiment can be used to execute step S21 in the embodiment of the present application, the second acquisition unit 33 in this embodiment can be used to execute step S22 in the embodiment of the present application, and the determination unit 35 in this embodiment can be used to execute step S23 in the embodiment of the present application.

[0074] Through the above module, a first data structure of the processor on the terminal is obtained, in which the current running thread on the processor is recorded; thread information of the current running thread is obtained; and it is determined whether the current running thread is a plug-in thread based on the thread information of the current running thread. The plug-in thread is used to run the plug-in code on the memory. The plug-in code is loaded into the memory when the startup file is running and is used to execute plug-in tasks in the game. In this way, plug-in threads that cannot be detected in related technologies can be monitored, and the technical problem of low accuracy in judging game plug-ins in related technologies can be solved.

[0075] Optionally, the first acquisition unit is also used to: before acquiring the first data structure of the processor of the terminal, acquire the second data structure of the processor, wherein the address of the first data structure is recorded in the second data structure; and read the first data structure according to the address of the first data structure recorded in the second data structure.

[0076] Optionally, the first acquisition unit is further used to: before acquiring the second data structure of the processor, read the storage address of the second data structure from the register of the processor; and read the second data structure according to the storage address of the second data structure.

[0077] Optionally, the first acquisition unit is also used to: create a kernel thread and obtain the number of cores N of the processor before reading the storage address of the second data structure from the register of the processor, where N is a positive integer; mount the kernel thread to the N cores of the processor one by one to read the storage address of a second data structure from the register of each core, and obtain the storage addresses of N second data structures, where each second data structure has an associated first data structure.

[0078] Optionally, the first acquisition unit is also used to: execute the following steps multiple times within a preset time length and at a preset frequency: mount the kernel threads one by one to the N cores of the processor to read the storage address of a second data structure from the register of each core to obtain the storage addresses of N second data structures.

[0079] Optionally, when the operating system started on the terminal is a Windows operating system, the second data structure is a KPCR data structure, the first data structure is a KPRCB data structure, and the register is a GS register.

[0080] Optionally, the determination unit is also used to: obtain the thread identifier of the currently running thread and the process identifier of the process in which it is located; when the thread identifier of the currently running thread is a preset thread identifier and the process identifier of the process in which it is located is a preset process identifier, determine that the currently running thread is a plug-in thread; when the thread identifier of the currently running thread is not a preset thread identifier, and / or the process identifier of the process in which it is located is not a preset process identifier, determine that the currently running thread is not a plug-in thread.

[0081] Optionally, the device of the present application may also include: a reporting unit, used to perform at least one of the following after determining that the currently running thread is a plug-in thread: reporting the thread information of the plug-in thread to the game server; reporting the plug-in code to the game server; reporting the game account on the terminal to the game server.

[0082] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments. It should be noted that the above modules as part of the device can be run in Figure 1 In the hardware environment shown, it can be implemented by software or by hardware, wherein the hardware environment includes a network environment.

[0083] According to another aspect of the embodiments of the present application, a server or terminal for implementing the above-mentioned game plug-in detection method is also provided.

[0084] Figure 4 is a structural block diagram of a terminal according to an embodiment of the present application, such as Figure 4 As shown, the terminal may include: one or more ( Figure 4 (only one is shown) processor 401, memory 403, and transmission device 405, as shown in Figure 4 As shown, the terminal may also include an input and output device 407.

[0085] Among them, the memory 403 can be used to store software programs and modules, such as the program instructions / modules corresponding to the detection method and device of the game plug-in in the embodiment of the present application, and the processor 401 executes various functional applications and data processing by running the software programs and modules stored in the memory 403, that is, realizing the detection method of the game plug-in mentioned above. The memory 403 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 403 may further include a memory remotely arranged relative to the processor 401, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0086] The above-mentioned transmission device 405 is used to receive or send data via a network, and can also be used for data transmission between a processor and a memory. Specific examples of the above-mentioned network may include a wired network and a wireless network. In one example, the transmission device 405 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 405 is a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet wirelessly.

[0087] Specifically, the memory 403 is used to store application programs.

[0088] The processor 401 may call the application stored in the memory 403 through the transmission device 405 to perform the following steps:

[0089] Obtain a first data structure of a processor on a terminal, wherein the first data structure records a current running thread on the processor; obtain thread information of the current running thread; and determine whether the current running thread is a plug-in thread based on the thread information of the current running thread, wherein the plug-in thread is used to run plug-in code in memory, and the plug-in code is code loaded into memory when a startup file is run and used to execute plug-in tasks in a game.

[0090] The processor 401 is further configured to execute the following steps:

[0091] Create a kernel thread and obtain the number of cores N of the processor; mount the kernel threads one by one to the N cores of the processor, for example, use the KeSetSystemGroupAffinityThread function to mount, so as to read a storage address of a second data structure (such as the storage address of the KPCR data structure) from the register of each core, and obtain the storage addresses of N second data structures, each second data structure has an associated first data structure; read the second data structure according to the storage address of the second data structure; obtain the address of the first data structure recorded in the second data structure of the processor; read the first data structure according to the address of the first data structure recorded in the second data structure.

[0092] By using the embodiment of the present application, a first data structure of a processor on a terminal is obtained, in which the current running thread on the processor is recorded; thread information of the current running thread is obtained; and it is determined whether the current running thread is a plug-in thread based on the thread information of the current running thread. The plug-in thread is used to run plug-in code in the memory. The plug-in code is loaded into the memory when the startup file is running and is used to execute plug-in tasks in the game. In this way, plug-in threads that cannot be detected in related technologies can be monitored, and the technical problem of low accuracy in judging game plug-ins in related technologies can be solved.

[0093] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0094] It can be understood by those skilled in the art that Figure 4 The structure shown is for illustration only, and the terminal may be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Figure 4It does not limit the structure of the above electronic device. For example, the terminal may also include Figure 4 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 4 Different configurations shown.

[0095] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0096] The embodiment of the present application also provides a storage medium. Optionally, in this embodiment, the storage medium can be used to execute the program code of the game cheat detection method.

[0097] Optionally, in this embodiment, the storage medium may be located on at least one network device among a plurality of network devices in the network shown in the above embodiment.

[0098] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps:

[0099] Obtain a first data structure of a processor on a terminal, wherein the first data structure records a current running thread on the processor; obtain thread information of the current running thread; and determine whether the current running thread is a plug-in thread based on the thread information of the current running thread, wherein the plug-in thread is used to run plug-in code in memory, and the plug-in code is code loaded into memory when a startup file is run and used to execute plug-in tasks in a game.

[0100] Optionally, the storage medium is further configured to store program codes for executing the following steps:

[0101] Create a kernel thread and obtain the number of cores N of the processor; mount the kernel threads one by one to the N cores of the processor, for example, use the KeSetSystemGroupAffinityThread function to mount, so as to read a storage address of a second data structure (such as the storage address of the KPCR data structure) from the register of each core, and obtain the storage addresses of N second data structures, each second data structure has an associated first data structure; read the second data structure according to the storage address of the second data structure; obtain the address of the first data structure recorded in the second data structure of the processor; read the first data structure according to the address of the first data structure recorded in the second data structure.

[0102] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0103] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store program codes.

[0104] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0105] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.

[0106] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0107] In the several embodiments provided in the present application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0108] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0109] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0110] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting game cheats, characterized in that: include: Acquire a first data structure of a processor on the terminal, wherein the first data structure records a current running thread on the processor; Obtain thread information of the currently running thread; Determining whether the currently running thread is a plug-in thread according to thread information of the currently running thread, wherein the plug-in thread is used to run plug-in code in memory, and the plug-in code is code loaded into memory when the startup file is run and used to execute plug-in tasks in the game; Before acquiring the first data structure of the processor of the terminal, the method further includes: acquiring a second data structure of the processor, wherein the second data structure records the address of the first data structure; Acquiring a first data structure of a processor of a terminal, comprising: reading the first data structure according to an address of the first data structure recorded in the second data structure; Before acquiring the second data structure of the processor, the method further includes: reading a storage address of the second data structure from a register of the processor; Acquiring a second data structure of the processor includes: reading the second data structure according to a storage address of the second data structure; Before reading the storage address of the second data structure from the register of the processor, the method further includes: creating a kernel thread and obtaining the number of cores N of the processor, where N is a positive integer; Reading the storage address of the second data structure from the register of the processor includes: mounting the kernel threads one by one to the N cores of the processor to read a storage address of the second data structure from the register of each core to obtain N storage addresses of the second data structures, wherein each second data structure has an associated first data structure; The method further includes: performing the following steps multiple times at a preset frequency within a preset time period: The kernel threads are mounted one by one on the N cores of the processor to read a storage address of the second data structure from a register of each core to obtain N storage addresses of the second data structure.

2. The method according to claim 1, characterized in that In the case where the operating system started on the terminal is a Windows operating system, the second data structure is a KPCR data structure, the first data structure is a KPRCB data structure, and the register is a GS register.

3. The method according to any one of claims 1 to 2, characterized in that: Determining whether the currently running thread is a plug-in thread according to the thread information of the currently running thread includes: Obtaining the thread ID of the currently running thread and the process ID of the process in which it exists; When the thread identifier of the currently running thread is a preset thread identifier and the process identifier of the process in which the thread is located is a preset process identifier, determining that the currently running thread is a plug-in thread; When the thread identifier of the currently running thread is not the preset thread identifier and / or the process identifier of the process is not the preset process identifier, it is determined that the currently running thread is not a plug-in thread.

4. The method according to claim 1, characterized in that: After determining that the currently running thread is a plug-in thread, the method further includes at least one of the following: Reporting thread information of the plug-in thread to the game server; Reporting the cheat code to the game server; Reporting the game account on the terminal to the game server.

5. A game cheat detection device, characterized in that: include: A first acquisition unit, configured to acquire a first data structure of a processor on a terminal, wherein the first data structure records a currently running thread on the processor; A second acquisition unit, used to acquire thread information of the currently running thread; a determination unit, configured to determine whether the currently running thread is a plug-in thread according to thread information of the currently running thread, wherein the plug-in thread is used to run plug-in code in memory, and the plug-in code is code loaded into memory when a startup file is run and used to execute plug-in tasks in the game; The first acquisition unit is further used to: before acquiring the first data structure of the processor of the terminal, acquire a second data structure of the processor, wherein the second data structure records the address of the first data structure; and read the first data structure according to the address of the first data structure recorded in the second data structure; The first acquisition unit is further used to: before acquiring the second data structure of the processor, read the storage address of the second data structure from the register of the processor; read the second data structure according to the storage address of the second data structure; The first acquisition unit is further used to: before reading the storage address of the second data structure from the register of the processor, create a kernel thread and obtain the number of cores N of the processor, where N is a positive integer; mount the kernel threads to the N cores of the processor one by one to read the storage address of a second data structure from the register of each core, and obtain the storage addresses of N second data structures, where each second data structure has an associated first data structure; The first acquisition unit is also used to: execute the following steps multiple times at a preset frequency within a preset time length: mount the kernel threads one by one to the N cores of the processor to read the storage address of a second data structure from the register of each core to obtain the storage addresses of N second data structures.

6. A storage medium, characterized in that: The storage medium includes a stored program, wherein the program executes the method described in any one of claims 1 to 4 when executed.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: The processor executes the method described in any one of claims 1 to 4 through the computer program.

Images