Screen recording detection method, device, equipment and storage medium

Abstract

A screen recording detection method, device, equipment and storage medium, the method comprising: when a multimedia playback application is in a running state, obtaining the first address of a target function, wherein the target function is a function called when the multimedia playback application performs playback processing; modifying the original information in the memory space of the first address to jump information from the target function to a preloaded jump function; monitoring whether the jump information changes; if the jump information changes, determining that there is a screen recording hijacking program that records the playback content of the multimedia playback application. The present invention can detect whether a third-party application performs screen recording in a process injection manner, which is conducive to reducing the risk of multimedia resources being stolen and improving the security of multimedia resources.

Description

Technical Field

[0001] The present application relates to the field of multimedia technology, and in particular to a screen recording detection method, device, equipment and storage medium. Background Art

[0002] With the development of the Internet, multimedia resources are spreading all the time in the network. Various media companies have invested a lot of resources to produce rich multimedia resources. Resource providers and copyright buyers are also constantly improving the security of multimedia resources through various methods to reduce the possibility of multimedia resources being pirated. In the prior art, the method of improving the security of multimedia resources is mainly to display a watermark on the client of the multimedia playback software, and to prevent the playback content from being stolen by setting window anti-screenshot and other means. However, there are still some third-party applications that hijack the multimedia playback software through process injection, record the playback content of the multimedia playback software, and thus obtain the playback content. Therefore, when a third-party application records the screen by this method, there is no corresponding method in the prior art for detection and identification, which will lead to the risk of multimedia resources being stolen, reducing the security of multimedia resources. Summary of the invention

[0003] In order to solve the above technical problems or at least partially solve the above technical problems, the present application provides a screen recording detection method, device, equipment and storage medium, which can detect whether there is a third-party application recording the screen by process injection, which is conducive to reducing the risk of multimedia resources being stolen and improving the security of multimedia resources.

[0004] In a first aspect, the present application provides a screen recording detection method, the method comprising:

[0005] When the multimedia playback application is in a running state, obtaining the first address of a target function, wherein the target function is a function called when the multimedia playback application performs playback processing;

[0006] Modify the original information in the memory space of the first address into jump information for jumping from the target function to the preloaded jump function;

[0007] Monitoring whether the jump information changes;

[0008] If the jump information changes, it is determined that there is a screen recording hijacking program that records the playback content of the multimedia playback application.

[0009] Among them, obtaining the first address of the target function includes:

[0010] Obtaining an address offset of the target function relative to a dynamic link library that packages the target function;

[0011] The first address of the target function is calculated according to the address of the dynamic link library and the address offset.

[0012] The target function is a rendering function called when the multimedia playback application performs playback and display.

[0013] Wherein, the method further comprises:

[0014] The original information in the memory space of the first address is modified to be before or after the jump information from the target function to the preloaded jump function, the original information is written into the first address of the jump function, and the jump information after the jump from the jump function to the first address of the target function is written into the jump function.

[0015] The monitoring of whether the jump information has changed includes:

[0016] Get the blacklist of screen recording hijacking programs;

[0017] Detect whether there is a screen recording hijacking program started that matches the screen recording hijacking program blacklist;

[0018] If a screen recording hijacking program matching the screen recording hijacking program blacklist is started, the jump information is obtained;

[0019] Determine whether the jump information has changed.

[0020] The monitoring of whether the jump information has changed includes:

[0021] Acquire the jump information at preset time intervals;

[0022] Determine whether the jump information has changed.

[0023] After modifying the original information in the memory space of the first address into jump information for jumping from the target function to the preloaded jump function, the method further includes:

[0024] When an instruction to stop screen recording detection is received, the jump information in the memory space of the first address is modified to the original information.

[0025] After determining that there is a screen recording hijacking program for recording the screen, the method further includes:

[0026] Display a reminder message indicating that screen recording exists on the display interface; and / or

[0027] The multimedia playback application is prohibited from playing multimedia files.

[0028] In a second aspect, the present application provides a screen recording detection device, the device comprising:

[0029] An address acquisition module, used for acquiring the first address of a target function when the multimedia playback application is in operation, wherein the target function is a function called when the multimedia playback application performs playback processing;

[0030] An information modification module, used for modifying the original information in the memory space of the first address into jump information for jumping from the target function to the preloaded jump function;

[0031] A monitoring module, used for monitoring whether the jump information has changed;

[0032] The determination module is used to determine the presence of a screen recording hijacking program that records the playback content of the multimedia playback application if the jump information changes.

[0033] In a third aspect, the present application provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0034] Memory, used to store computer programs;

[0035] The processor is used to implement the steps of the screen recording detection method described in any one of the embodiments of the first aspect when executing the program stored in the memory.

[0036] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the screen recording detection method described in any one of the embodiments of the first aspect are implemented.

[0037] The method provided by the embodiment of the present application obtains the first address of the target function when the multimedia playback application is in running state. The target function is the function called by the multimedia playback application when performing playback processing, and then modifies the original information in the memory space of the first address to jump information from the target function to the preloaded jump function, and monitors whether the jump information changes. When the jump information changes, it is determined that there is a screen recording hijacking program that records the playback content of the multimedia playback application.

[0038] Since when process injection hijacks multimedia playback software to record the screen, the function called by the playback process often outputs the playback content of the multimedia playback application during the playback process to other addresses, thereby achieving screen recording. Therefore, the method provided in the embodiment of the present application rewrites the content of the target function in advance, and then detects whether there is a change in the rewritten content, which can accurately determine the existence of a screen recording hijacking program. Therefore, the embodiment of the present application can detect whether there is a third-party application recording the screen in the form of process injection, which is conducive to reducing the risk of multimedia resources being stolen and improving the security of multimedia resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0041] Figure 1 A flowchart of a screen recording detection method provided in an embodiment of the present application.

[0042] Figure 2 A schematic diagram of the structure of a screen recording detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0044] The embodiment of the present invention provides a screen recording detection method. The execution subject of this embodiment is a device that needs screen recording detection. For example: the execution subject is a desktop computer, notebook, server, etc. running a multimedia playback application.

[0045] See also Figure 1 , Figure 1 A flowchart of a screen recording detection method provided in an embodiment of the present application.

[0046] Step S110, when the multimedia playback application is in a running state, obtaining the first address of the target function, wherein the target function is a function called by the multimedia playback application when performing playback processing.

[0047] In this embodiment, the multimedia playback application is an application that can play video or audio, and the multimedia playback application can be installed in different operating systems.

[0048] For example, the multimedia player application is an application installed in the Windows operating system that can play videos.

[0049] In this embodiment, the multimedia player application being in a running state includes the multimedia player application being in any running state from startup to shutdown, that is, the first address of the target function can be obtained at any time from when the multimedia player application receives a startup instruction to when the multimedia player application is shut down.

[0050] Preferably, the multimedia playback application is in a running state when the multimedia playback application is in any startup state during the startup period from the beginning to the complete startup, or the multimedia playback application is in a running state when the multimedia playback application is in any playback state during the playback period from the beginning to the end of the multimedia file playback.

[0051] For example, when the multimedia playback application starts to start, the first address of the target function is obtained, or when the multimedia playback application starts to play the multimedia file, the first address of the target function is obtained.

[0052] In this embodiment, the target function includes any function used by the multimedia playback application to perform playback processing, for example, the target function is a function used for video decryption, or the target function is a function used for video decoding.

[0053] Preferably, the target function is a rendering function called when the multimedia playback application performs playback and display.

[0054] For example, a multimedia playback application runs on a Windows operating system. During runtime, the multimedia playback application calls a member function (such as a present function) of an interface in Direct 3D provided by the Windows operating system. The member function is a rendering function called by the multimedia playback application when playing and displaying. The first address of the member function (present function) is obtained, wherein Direct 3D is the underlying drawing API of the Windows system and can implement hardware accelerated rendering.

[0055] Regardless of when the multimedia playback application is displayed, or how it is decoded or encrypted, it will eventually be rendered, and the rendering interface is relatively universal. Therefore, in the embodiment of the present invention, when the target function is a rendering function called by the multimedia playback application when playing and displaying, it is not necessary to analyze the decryption process and decryption interface information again due to the different multimedia playback applications, and the first address of the target function can be directly and quickly obtained, which is conducive to obtaining the result of the screen recording detection as soon as possible, and the first address of the target function is highly universal and has strong universality.

[0056] In this embodiment, the address of the function mentioned is the first address of the function. Specifically, the first address of the target function refers to the address of the target function, which can also be called the entry address of the target function.

[0057] In this embodiment, the address of the object corresponding to the interface can be obtained by instantiating the interface where the target function is located. Since the memory space pointed to by the address of the object is a virtual table, the virtual table contains multiple entries, and each entry represents the address of a different member function in the interface. Therefore, by determining which entry in the interface the target function belongs to, and then obtaining the address of the target entry, the address of the target function can be obtained. The address of the target function is the starting address of the target function.

[0058] For example, by using an object creation method (such as the D3D11CreateDeviceAndSwapChain method) to create an object corresponding to an interface (such as creating an IDXGISwapChain object), you can get the address obj_addr of the object. If the target function is located at the 8th entry in the interface, get the first address of the target function *(uintptr_t**)obj_addr[8], where *(uintptr_t**) indicates data type conversion.

[0059] Further, in an optional embodiment, obtaining the first address of the target function includes:

[0060] Obtaining an address offset of the target function relative to a dynamic link library that packages the target function;

[0061] The first address of the target function is calculated according to the address of the dynamic link library and the address offset.

[0062] In this embodiment, the address offset of the target function relative to the dynamic link library that packages the target function is the offset address of the target function relative to the dynamic link library in the memory after the dynamic link library is loaded into the memory.

[0063] Usually, when a multimedia application is running, commonly used interfaces and their member functions are packaged into a dynamic link library, and when used, the dynamic link library is loaded to obtain these functions.

[0064] In this embodiment, the dynamic link library packages multiple interfaces and member functions included in the multiple interfaces, and the target function is a member function (ie, a method function) in a certain interface used for a certain processing.

[0065] For example, the dynamic link library is dxgi.dll, the interface is the IDXGISwapChain interface, the target function is the present function, and the present function is a member function in the IDXGISwapChain interface.

[0066] Among them, dxgi.dll represents DXGI, which is a set of DirectX graphics frameworks in Windows. It is used to manage the underlying tasks independent of the DirectX graphics runtime, such as enumerating hardware devices and displaying frames. The DXGI contains a subset of Direct 3D, which contains multiple interfaces for rendering.

[0067] In this embodiment, the address offset of the target function relative to the dynamic link library that packages the target function can be pre-calculated and stored. During one operation of the multimedia playback application, the program segments have been loaded into the memory, that is, the memory addresses have been allocated to these program segments and will not be allocated repeatedly. Therefore, the address offset of the target function relative to the dynamic link library that packages the target function will not change. The address offset is only calculated once and saved, and then the address offset can be directly obtained.

[0068] When the address offset of the target function relative to the dynamic link library that packages the target function is obtained for the first time, the address offset can be calculated by the following steps:

[0069] Obtaining the base address of the dynamic link library that packages the target function;

[0070] Get the address of the object corresponding to the interface where the target function is located;

[0071] Obtaining the first address of the target function according to the address of the object;

[0072] The address offset is calculated according to the first address of the target function and the base address.

[0073] Specifically, the base address of the dynamic link library that packages the target function can be obtained by loading the dynamic link library function. For example, dxgi.dll is loaded through the Loadlibrary function to obtain the base address module_addr of the dynamic link library.

[0074] The steps of obtaining the address of the object corresponding to the interface where the target function is located and obtaining the first address of the target function according to the address of the object have been described above, and thus will not be described in detail.

[0075] Subtract the first address of the target function from the base address of the dynamic link library to obtain the address offset of the target function relative to the dynamic link library.

[0076] For example, when the first address of the target function is *(uintptr_t**)obj_addr[8], subtract the first address from the base address to obtain the address offset offset0 of the target function relative to the dynamic link library that packages the target function, that is, *(uintptr_t**)obj_addr[8]–module_addr. By performing data type conversion with *(uintptr_t**), the address in the virtual table can be converted into an integer, which is more convenient for calculating the offset.

[0077] Since the calculation of the address offset and the acquisition of the first address of the target function according to the address offset are usually not performed in the same processing unit, it is more convenient to pre-calculate and store the address offset and then directly acquire the first address of the target function according to the address offset.

[0078] Step S120, modifying the original information in the memory space of the first address into jump information for jumping from the target function to the preloaded jump function.

[0079] In an optional embodiment, the jump information may include the jump instruction and the address of the jump function.

[0080] Preferably, in this embodiment, the jump information includes a jump instruction and a jump offset from the target function to the jump function, and the original information in the memory space of the first address is modified into the jump information from the target function to the preloaded jump function, including:

[0081] Determining the number of bytes of the jump instruction and the jump offset;

[0082] Calculating an offset from the jump function according to the first address of the jump function, the first address of the target function and the number of bytes;

[0083] The original information in the memory space of the first address is modified into the jump instruction and the jump offset.

[0084] In this embodiment, the jump offset represents the address offset between the first address of the jump function and the first address of the target function. Through the jump instruction and the jump offset, it is possible to directly jump from the first address of the target function to the first address of the jump function.

[0085] The first address of a jump function is the address of the entry of the jump function loaded into the memory, and the address can be directly obtained through the function name of the jump function.

[0086] For example, when the jump instruction is jmp, the jump instruction occupies 1 byte. Usually, the offset occupies 4 bytes, so the number of bytes of the jump instruction and the offset is 5. If the first address of the jump function is hook_addr, the first address of the target function is func_addr, and the jump offset is offset1, the jump offset offset1 is calculated by the following formula:

[0087] offset1=hook_addr-func_addr-5

[0088] Then the information in the internal space of the target function's first address is modified to "jmp offset1", where jmp is a jump instruction and offset1 is a jump offset. At the same time, before modifying the memory space of the target function's first address, you can first modify the read and write permissions of the memory space, and then modify the content of the memory space after the permissions are modified.

[0089] In this embodiment, after the original information in the memory space of the first address is modified to jump information from the target function to the preloaded jump function, if the target function is executed, it jumps according to the jump offset, that is, when the target function starts to be executed, it jumps directly to the jump function.

[0090] In this embodiment, the jump function may include an execution statement or may not include an execution statement.

[0091] Preferably, the method described in this embodiment further includes:

[0092] The original information in the memory space of the first address is modified to be before or after the jump information from the target function to the preloaded jump function, the original information is written into the first address of the jump function, and the jump information after the jump from the jump function to the first address of the target function is written into the jump function.

[0093] In this embodiment, the jump information after jumping from the jump function to the first address of the target function includes: a jump instruction and an address offset after jumping from the first address of the jump function to the first address of the target function. Specifically, the address offset can be obtained based on the difference between the first address of the jump function and the first address of the jump function.

[0094] For example, if the first address of the jump function is hook_addr and the first address of the target function is func_addr, the address offset offset2 after jumping from the first address of the jump function to the first address of the target function is calculated by the following formula:

[0095] offset2 = func_addr - hook_addr

[0096] If the original information in the memory space of the target function's first address is an instruction for saving the target function's stack frame, the instruction is stored at the first address of the jump function, and "jmp offset2" is stored after the instruction, so that when the program runs to the target function, it jumps directly to the jump function to save the stack frame, and then jumps directly back to the target function's first address to run, thereby realizing the function of the target function.

[0097] In this process, after jumping to the jump function, the function in the memory space of the first address of the target function can be directly implemented, and the target function can be directly jumped back to continue execution, which does not affect the execution speed and efficiency of the target function at all. Therefore, when performing screen recording detection, it does not affect the operating efficiency of the multimedia playback application itself, and can perform efficient detection.

[0098] Step S130, monitoring whether the jump information has any change.

[0099] In this embodiment, monitoring whether the jump information changes is used to determine whether other injected programs have performed jumps to other addresses.

[0100] When the jump information changes, it means that the target function no longer jumps to the jump function, but jumps from the target function to other functions. When the jump information does not change, it means that the target function still jumps to the jump function.

[0101] Specifically, when the jump information includes a jump instruction and an address of a jump function, monitor whether the address of the jump function changes; when the jump information includes a jump instruction and an address offset from a target function to a jump function, monitor whether the address offset changes.

[0102] Further, in another optional embodiment of the present invention, the monitoring whether the jump information has changed includes:

[0103] Acquire the jump information at preset time intervals;

[0104] Determine whether the jump information has changed.

[0105] In this embodiment, the preset time may be pre-set.

[0106] For example, if the preset time is 5 seconds, the address offset offset1 from the target function to the jump function is obtained every 5 seconds to determine whether the value has changed.

[0107] Further, in an optional embodiment of the present invention, the monitoring whether the jump information has changed includes:

[0108] Get the blacklist of screen recording hijacking programs;

[0109] Detect whether there is a screen recording hijacking program started that matches the screen recording hijacking program blacklist;

[0110] If a screen recording hijacking program matching the screen recording hijacking program blacklist is started, the jump information is obtained;

[0111] Determine whether the jump information has changed.

[0112] In this embodiment, the screen recording hijacking program may be a common screen recording program that is pre-saved or a screen recording program that is detected within a period of time in the past.

[0113] In this embodiment, when a screen recording hijacking program that matches the screen recording hijacking program blacklist is started, the jump information is obtained and the change of the jump information is judged. This can be based on the operating environment of the multimedia playback application, thereby reducing unnecessary polling detection and judging whether the jump information has changed as timely as possible, thereby reducing the resource consumption required for screen recording detection.

[0114] Step S140: If the jump information changes, it is determined that there is a screen recording hijacking program that records the playback content of the multimedia playback application.

[0115] Step S150: If the jump information changes, it is determined that there is no screen recording hijacking program that records the playback content of the multimedia playback application.

[0116] Further, in an optional embodiment of the present invention, after determining that there is a screen recording hijacking program for recording the screen, the method further includes:

[0117] Display a reminder message indicating that screen recording exists on the display interface; and / or

[0118] The multimedia playback application is prohibited from playing multimedia files.

[0119] In this embodiment, prohibiting the multimedia playback application from playing multimedia files includes, when the multimedia playback application is performing playback processing (such as playing a video), exiting the playback; when the multimedia playback application is not performing playback processing and receives an instruction to play the multimedia file, not performing playback processing, and prompting that there is screen recording, and not playing the file.

[0120] After determining that there is a screen recording hijacking program recording the screen, sending a reminder message and / or using a multimedia playback application to play the multimedia file can more effectively prevent the multimedia file from being stolen and improve the security of the multimedia file.

[0121] Further, in another optional embodiment of the present invention, after modifying the original information in the memory space of the first address into jump information for jumping from the target function to the preloaded jump function, the method further includes:

[0122] When an instruction to stop screen recording detection is received, the jump information in the memory space of the first address is modified to the original information.

[0123] When no instruction to stop screen recording detection is received, after the original information in the memory space of the first address is modified to the jump information from the target function to the preloaded jump function, the jump information is still monitored for changes, so as to determine whether there is a screen recording hijacking program that records the playback content of the multimedia playback application.

[0124] In this embodiment, the instruction to stop screen recording detection can be triggered by the user clicking on a designated operable control.

[0125] When an instruction to stop screen recording detection is received at any time after the original information in the memory space of the first address of the target function is modified, the original information in the memory space of the first address of the target function can be directly restored to exit the screen recording detection.

[0126] In this embodiment, by modifying the jump information in the memory space of the first address to the original information, the screen recording detection can be stopped as needed when the multimedia playback application is running.

[0127] Since when process injection hijacks multimedia playback software to record the screen, the function called by the playback process often outputs the playback content of the multimedia playback application during the playback process to other addresses, thereby achieving screen recording. Therefore, the method provided in the embodiment of the present application rewrites the content of the target function in advance, and then detects whether there is a change in the rewritten content, which can accurately determine the existence of a screen recording hijacking program. Therefore, the embodiment of the present application can detect whether there is a third-party application recording the screen in the form of process injection, which is conducive to reducing the risk of multimedia resources being stolen and improving the security of multimedia resources.

[0128] See also Figure 2 , Figure 2 The screen recording detection device 200 includes an address acquisition module 201 , an information modification module 202 , a monitoring module 203 and a determination module 204 .

[0129] The address acquisition module 201 is used to acquire the first address of the target function when the multimedia playback application is in the running state, wherein the target function is the function called when the multimedia playback application performs playback processing.

[0130] In this embodiment, the multimedia playback application is an application that can play video or audio, and the multimedia playback application can be installed in different operating systems.

[0131] For example, the multimedia player application is an application installed in the Windows operating system that can play videos.

[0132] In this embodiment, the multimedia player application being in a running state includes the multimedia player application being in any running state from startup to shutdown, that is, the first address of the target function can be obtained at any time from when the multimedia player application receives a startup instruction to when the multimedia player application is shut down.

[0133] Preferably, the multimedia playback application is in a running state when the multimedia playback application is in any startup state during the startup period from the beginning to the complete startup, or the multimedia playback application is in a running state when the multimedia playback application is in any playback state during the playback period from the beginning to the end of the multimedia file playback.

[0134] For example, when the multimedia playback application starts to start, the first address of the target function is obtained, or when the multimedia playback application starts to play the multimedia file, the first address of the target function is obtained.

[0135] In this embodiment, the target function includes any function used by the multimedia playback application to perform playback processing, for example, the target function is a function used for video decryption, or the target function is a function used for video decoding.

[0136] Preferably, the target function is a rendering function called when the multimedia playback application performs playback and display.

[0137] For example, a multimedia playback application runs on a Windows operating system. During runtime, the multimedia playback application calls a member function (such as a present function) of an interface in Direct 3D provided by the Windows operating system. The member function is a rendering function called by the multimedia playback application when playing and displaying. The first address of the member function (present function) is obtained, wherein Direct 3D is the underlying drawing API of the Windows system and can implement hardware accelerated rendering.

[0138] Regardless of when the multimedia playback application is displayed, or how it is decoded or encrypted, it will eventually be rendered, and the rendering interface is relatively universal. Therefore, in the embodiment of the present invention, when the target function is a rendering function called by the multimedia playback application when playing and displaying, it is not necessary to analyze the decryption process and decryption interface information again due to the different multimedia playback applications, and the first address of the target function can be directly and quickly obtained, which is conducive to obtaining the result of the screen recording detection as soon as possible, and the first address of the target function is highly universal and has strong universality.

[0139] In this embodiment, the address of the function mentioned is the first address of the function. Specifically, the first address of the target function refers to the address of the target function, which can also be called the entry address of the target function.

[0140] In this embodiment, the address of the object corresponding to the interface can be obtained by instantiating the interface where the target function is located. Since the memory space pointed to by the address of the object is a virtual table, the virtual table contains multiple entries, and each entry represents the address of a different member function in the interface. Therefore, by determining which entry in the interface the target function belongs to, and then obtaining the address of the target entry, the address of the target function can be obtained. The address of the target function is the starting address of the target function.

[0141] For example, by using an object creation method (such as the D3D11CreateDeviceAndSwapChain method) to create an object corresponding to an interface (such as creating an IDXGISwapChain object), you can get the address obj_addr of the object. If the target function is located at the 8th entry in the interface, get the first address of the target function *(uintptr_t**)obj_addr[8], where *(uintptr_t**) indicates data type conversion.

[0142] Further, in an optional embodiment, the address acquisition module 201 is specifically used for:

[0143] When the multimedia playback application is in a running state, obtaining an address offset of the target function relative to a dynamic link library that packages the target function;

[0144] The first address of the target function is calculated according to the address of the dynamic link library and the address offset.

[0145] In this embodiment, the address offset of the target function relative to the dynamic link library that packages the target function is the offset address of the target function relative to the dynamic link library in the memory after the dynamic link library is loaded into the memory.

[0146] Usually, when a multimedia application is running, commonly used interfaces and their member functions are packaged into a dynamic link library, and when used, the dynamic link library is loaded to obtain these functions.

[0147] In this embodiment, the dynamic link library packages multiple interfaces and member functions included in the multiple interfaces, and the target function is a member function (ie, a method function) in a certain interface used for a certain processing.

[0148] For example, the dynamic link library is dxgi.dll, the interface is the IDXGISwapChain interface, the target function is the present function, and the present function is a member function in the IDXGISwapChain interface.

[0149] Among them, dxgi.dll represents DXGI, which is a set of DirectX graphics frameworks in Windows. It is used to manage the underlying tasks independent of the DirectX graphics runtime, such as enumerating hardware devices and displaying frames. The DXGI contains a subset of Direct 3D, which contains multiple interfaces for rendering.

[0150] In this embodiment, the address offset of the target function relative to the dynamic link library that packages the target function can be pre-calculated and stored. During one operation of the multimedia playback application, the program segments have been loaded into the memory, that is, the memory addresses have been allocated to these program segments and will not be allocated repeatedly. Therefore, the address offset of the target function relative to the dynamic link library that packages the target function will not change. The address offset is only calculated once and saved, and then the address offset can be directly obtained.

[0151] When the address offset of the target function relative to the dynamic link library of the packaged target function is obtained for the first time, the offset address can be calculated by the address acquisition module 201, and the address acquisition module 201 is further used to:

[0152] Obtaining the base address of the dynamic link library that packages the target function;

[0153] Get the address of the object corresponding to the interface where the target function is located;

[0154] Obtaining the first address of the target function according to the address of the object;

[0155] The address offset is calculated according to the first address of the target function and the base address.

[0156] Specifically, the base address of the dynamic link library that packages the target function can be obtained by loading the dynamic link library function. For example, dxgi.dll is loaded through the Loadlibrary function to obtain the base address module_addr of the dynamic link library.

[0157] The steps of obtaining the address of the object corresponding to the interface where the target function is located and obtaining the first address of the target function according to the address of the object have been described above, and thus will not be described in detail.

[0158] Subtract the first address of the target function from the base address of the dynamic link library to obtain the address offset of the target function relative to the dynamic link library.

[0159] For example, when the first address of the target function is *(uintptr_t**)obj_addr[8], subtract the first address from the base address to obtain the address offset offset0 of the target function relative to the dynamic link library that packages the target function, that is, *(uintptr_t**)obj_addr[8]–module_addr. By performing data type conversion with *(uintptr_t**), the address in the virtual table can be converted into an integer, which is more convenient for calculating the offset.

[0160] Since the calculation of the address offset and the acquisition of the first address of the target function according to the address offset are usually not performed in the same processing unit, it is more convenient to pre-calculate and store the address offset and then directly acquire the first address of the target function according to the address offset.

[0161] The information modification module 202 is used to modify the original information in the memory space of the first address into jump information for jumping from the target function to the preloaded jump function.

[0162] In an optional embodiment, the jump information may include the jump instruction and the address of the jump function.

[0163] Preferably, in this embodiment, the jump information includes a jump instruction and a jump offset from the target function to the jump function, and the information modification module 202 is specifically used for:

[0164] Determining the number of bytes of the jump instruction and the jump offset;

[0165] Calculating an offset from the jump function according to the first address of the jump function, the first address of the target function and the number of bytes;

[0166] The original information in the memory space of the first address is modified into the jump instruction and the jump offset.

[0167] In this embodiment, the jump offset represents the address offset between the first address of the jump function and the first address of the target function. Through the jump instruction and the jump offset, it is possible to directly jump from the first address of the target function to the first address of the jump function.

[0168] The first address of a jump function is the address of the entry of the jump function loaded into the memory, and the address can be directly obtained through the function name of the jump function.

[0169] For example, when the jump instruction is jmp, the jump instruction occupies 1 byte. Usually, the offset occupies 4 bytes, so the number of bytes of the jump instruction and the offset is 5. If the first address of the jump function is hook_addr, the first address of the target function is func_addr, and the jump offset is offset1, the jump offset offset1 is calculated by the following formula:

[0170] offset1=hook_addr-func_addr-5

[0171] Then the information in the internal space of the target function's first address is modified to "jmp offset1", where jmp is a jump instruction and offset1 is a jump offset. At the same time, before modifying the memory space of the target function's first address, you can first modify the read and write permissions of the memory space, and then modify the content of the memory space after the permissions are modified.

[0172] In this embodiment, after the original information in the memory space of the first address is modified to jump information from the target function to the preloaded jump function, if the target function is executed, it jumps according to the jump offset, that is, when the target function starts to be executed, it jumps directly to the jump function.

[0173] In this embodiment, the jump function may include an execution statement or may not include an execution statement.

[0174] Preferably, the information modification module 202 described in this embodiment is also used to: modify the original information in the memory space of the first address to before or after the jump information of jumping from the target function to the preloaded jump function, write the original information into the first address of the jump function, and write the jump information after jumping from the jump function to the first address of the target function in the jump function.

[0175] In this embodiment, the jump information after jumping from the jump function to the first address of the target function includes: a jump instruction and an address offset after jumping from the first address of the jump function to the first address of the target function. Specifically, the address offset can be obtained based on the difference between the first address of the jump function and the first address of the jump function.

[0176] For example, if the first address of the jump function is hook_addr and the first address of the target function is func_addr, the address offset offset2 after jumping from the first address of the jump function to the first address of the target function is calculated by the following formula:

[0177] offset2 = func_addr - hook_addr

[0178] If the original information in the memory space of the target function's first address is an instruction for saving the target function's stack frame, the instruction is stored at the first address of the jump function, and "jmp offset2" is stored after the instruction, so that when the program runs to the target function, it jumps directly to the jump function to save the stack frame, and then jumps directly back to the target function's first address to run, thereby realizing the function of the target function.

[0179] In this process, after jumping to the jump function, the function in the memory space of the first address of the target function can be directly implemented, and the target function can be directly jumped back to continue execution, which does not affect the execution speed and efficiency of the target function at all. Therefore, when performing screen recording detection, it does not affect the operating efficiency of the multimedia playback application itself, and can perform efficient detection.

[0180] The monitoring module 203 is used to monitor whether the jump information has changed.

[0181] In this embodiment, monitoring whether the jump information changes is used to determine whether other injected programs have performed jumps to other addresses.

[0182] When the jump information changes, it means that the target function no longer jumps to the jump function, but jumps from the target function to other functions. When the jump information does not change, it means that the target function still jumps to the jump function.

[0183] Specifically, when the jump information includes a jump instruction and an address of a jump function, monitor whether the address of the jump function changes; when the jump information includes a jump instruction and an address offset from a target function to a jump function, monitor whether the address offset changes.

[0184] Furthermore, in another optional embodiment of the present invention, the monitoring module 203 is specifically used for:

[0185] Acquire the jump information at preset time intervals;

[0186] Determine whether the jump information has changed.

[0187] In this embodiment, the preset time may be pre-set.

[0188] For example, if the preset time is 5 seconds, the address offset offset1 from the target function to the jump function is obtained every 5 seconds to determine whether the value has changed.

[0189] Furthermore, in an optional embodiment of the present invention, the monitoring module 203 is specifically used for:

[0190] Get the blacklist of screen recording hijacking programs;

[0191] Detect whether there is a screen recording hijacking program started that matches the screen recording hijacking program blacklist;

[0192] If a screen recording hijacking program matching the screen recording hijacking program blacklist is started, the jump information is obtained;

[0193] Determine whether the jump information has changed.

[0194] In this embodiment, the screen recording hijacking program may be a common screen recording program that is pre-saved or a screen recording program that is detected within a period of time in the past.

[0195] In this embodiment, when a screen recording hijacking program that matches the screen recording hijacking program blacklist is started, the jump information is obtained and the change of the jump information is judged. This can be based on the operating environment of the multimedia playback application, thereby reducing unnecessary polling detection and judging whether the jump information has changed as timely as possible, thereby reducing the resource consumption required for screen recording detection.

[0196] The determination module 204 is used to determine the presence of a screen recording hijacking program that records the playback content of the multimedia playback application if the jump information changes.

[0197] The determination module 204 is further used to determine whether there is a screen recording hijacking program that records the playback content of the multimedia playback application if the jump information changes.

[0198] Furthermore, in an optional embodiment of the present invention, the determining module 204 is further configured to:

[0199] After determining that there is a screen recording hijacking program recording the screen, a reminder message indicating the screen recording is displayed on the display interface; and / or

[0200] After determining that there is a screen recording hijacking program for screen recording, the multimedia playback application is prohibited from playing multimedia files.

[0201] In this embodiment, prohibiting the multimedia playback application from playing multimedia files includes, when the multimedia playback application is performing playback processing (such as playing a video), exiting the playback; when the multimedia playback application is not performing playback processing and receives an instruction to play the multimedia file, not performing playback processing, and prompting that there is screen recording, and not playing the file.

[0202] After determining that there is a screen recording hijacking program recording the screen, sending a reminder message and / or using a multimedia playback application to play the multimedia file can more effectively prevent the multimedia file from being stolen and improve the security of the multimedia file.

[0203] Furthermore, in another optional embodiment of the present invention, the information modification module is further used to:

[0204] After modifying the original information in the memory space of the first address to jump from the target function to the preloaded jump function, when receiving an instruction to stop screen recording detection, the jump information in the memory space of the first address is modified to the original information.

[0205] When no instruction to stop screen recording detection is received, after the original information in the memory space of the first address is modified to the jump information from the target function to the preloaded jump function, the jump information is still monitored for changes, so as to determine whether there is a screen recording hijacking program that records the playback content of the multimedia playback application.

[0206] In this embodiment, the instruction to stop screen recording detection can be triggered by the user clicking on a designated operable control.

[0207] When an instruction to stop screen recording detection is received at any time after the original information in the memory space of the first address of the target function is modified, the original information in the memory space of the first address of the target function can be directly restored to exit the screen recording detection.

[0208] In this embodiment, by modifying the jump information in the memory space of the first address to the original information, the screen recording detection can be stopped as needed when the multimedia playback application is running.

[0209] Since when process injection hijacks multimedia playback software to record the screen, the function called by the playback process often outputs the playback content of the multimedia playback application during the playback process to other addresses, thereby achieving screen recording. Therefore, the method provided in the embodiment of the present application rewrites the content of the target function in advance, and then detects whether there is a change in the rewritten content, which can accurately determine the existence of a screen recording hijacking program. Therefore, the embodiment of the present application can detect whether there is a third-party application recording the screen in the form of process injection, which is conducive to reducing the risk of multimedia resources being stolen and improving the security of multimedia resources.

[0210] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0211] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A screen recording detection method, characterized in that: The method comprises: When the multimedia playback application is in a running state, obtaining the first address of a target function, wherein the target function is a function called when the multimedia playback application performs playback processing; Modify the original information in the memory space of the first address into jump information for jumping from the target function to the preloaded jump function; Monitoring whether the jump information changes; If the jump information changes, it is determined that there is a screen recording hijacking program that records the playback content of the multimedia playback application; The target function is a rendering function called when the multimedia playback application performs playback and display; The jump information includes a jump instruction and a jump offset from a target function to a jump function.

2. The method according to claim 1, characterized in that The obtaining of the first address of the target function comprises: Obtaining an address offset of the target function relative to a dynamic link library that packages the target function; The first address of the target function is calculated according to the address of the dynamic link library and the address offset.

3. The method according to claim 1, characterized in that The method further comprises: The original information in the memory space of the first address is modified to be before or after the jump information from the target function to the preloaded jump function, the original information is written into the first address of the jump function, and the jump information after the jump from the jump function to the first address of the target function is written into the jump function.

4. The method according to claim 1, characterized in that The monitoring whether the jump information has changed includes: Get the blacklist of screen recording hijacking programs; Detect whether there is a screen recording hijacking program started that matches the screen recording hijacking program blacklist; If a screen recording hijacking program matching the screen recording hijacking program blacklist is started, the jump information is obtained; Determine whether the jump information has changed.

5. The method according to claim 1, characterized in that The monitoring whether the jump information has changed includes: Acquire the jump information at preset time intervals; Determine whether the jump information has changed.

6. The method according to claim 1, characterized in that After modifying the original information in the memory space of the first address into jump information for jumping from the target function to the preloaded jump function, the method further includes: When an instruction to stop screen recording detection is received, the jump information in the memory space of the first address is modified to the original information.

7. The method according to any one of claims 1 to 6, characterized in that After determining that there is a screen recording hijacking program for recording the screen, the method further includes: Display a reminder message indicating that screen recording exists on the display interface; and / or The multimedia playback application is prohibited from playing multimedia files.

8. A screen recording detection device, characterized in that: The device comprises: An address acquisition module, used for acquiring the first address of a target function when the multimedia playback application is in operation, wherein the target function is a function called when the multimedia playback application performs playback processing; An information modification module, used for modifying the original information in the memory space of the first address into jump information for jumping from the target function to the preloaded jump function; A monitoring module, used for monitoring whether the jump information has changed; A determination module, used for determining the presence of a screen recording hijacking program for recording the playback content of the multimedia playback application if the jump information changes; the target function is a rendering function called when the multimedia playback application performs playback and display; The jump information includes a jump instruction and a jump offset from a target function to a jump function.

9. The device according to claim 8, characterized in that The target function is a rendering function called when the multimedia playback application performs playback and display.

10. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; The processor is used to implement the steps of the screen recording detection method as described in any one of claims 1 to 7 when executing the program stored in the memory.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the screen recording detection method as described in any one of claims 1 to 7 are implemented.

Images