Method for preventing code of a software program from being analyzed by an external debugger application

Abstract

Disclosed is a method for preventing an external debugger application from analyzing the code of a software program 306 installed on a computing device 202, 300. The method includes initializing a software program including an application program 308 and an internal debugger application 310. The software program, upon its initialization, instructs the internal debugger application to load the application program within the internal debugger application. The internal debugger application is configured to utilize kernel resources 312 of an operating system 204 of the computing device. The method includes executing the internal debugger application to set one or more breakpoints in the code of the application program for a defined execution path of the code of the application program, executing the application program according to the defined execution path of the code of the application program, stopping the execution of the code of the application program when reaching any of the one or more breakpoints in the code of the application program, and transferring control to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path of the code of the application program.

Description

Technical Field

[0001] The present disclosure generally relates to systems and methods for preventing software piracy; and more particularly to methods, systems, and computing devices for preventing an external debugger application from analyzing the code of a software program. Background Art

[0002] Software piracy and unauthorized access, modification, and exploitation of software applications such as computer games, console game applications, simulation applications, coding and testing console-based applications, etc. have become an increasingly serious problem. Software piracy may result in revenue loss due to the unauthorized distribution of pirated copies of software programs. In addition, in addition to the revenue loss caused by the distribution of pirated copies, software piracy also poses a threat of exposing valuable trade secrets that may be embodied in a particular software program. In addition, software piracy also poses a threat to intellectual property rights that individuals and / or companies may seek to protect. In particular, software program companies can gain a significant competitive advantage by unauthorized access to the software programs of competitors.

[0003] Generally, a software program consists of electronic files or code segments arranged in a specific manner to be compatible with known microprocessors and operating systems, making the software program vulnerable to modification by hackers or crackers. Generally, there are many available software security mechanisms that can be used to restrict unauthorized access to software programs. Most software security mechanisms are inherently simple, such as introducing genuine ("genuity") licenses, encrypted passwords or keys to block malicious users. However, skilled hackers can easily bypass such security checks using widely available tools such as "ProcDump" as a memory dumping tool together with powerful debugging tools. Such tools are capable of capturing any data content from any memory location (regardless of how protected the memory is considered), or monitoring the file system and transcribing files to access data, or copying the entire OS, for example by using an internal circuit emulator. Hackers typically use such tools to step by step analyze the software code, thus helping the hackers to reverse engineer, modify, or copy the content of the software program. In addition, to overcome this, many software programs employ software security mechanisms such as encrypting parts to block the ability of hackers or crackers to overcome software license restrictions, or to prevent hackers from understanding the code segments of the software program. However, such security mechanisms are also often easily breached by skilled hackers or crackers.

[0004] Therefore, in view of the foregoing discussion, there is a need to utilize software security mechanisms to overcome the above-mentioned deficiencies to protect software programs from unauthorized modification or exploitation by preventing the analysis of the code of the software program. Summary of the Invention

[0005] The present disclosure seeks to provide methods for preventing an external debugger application from analyzing the code of a software program installed on a computing device. The present disclosure also attempts to provide a computer program product installed on a computing device that, when accessed by a processing device associated with the computing device, prevents an external debugger application from analyzing the code of a software program installed on the computing device. The present disclosure also seeks to provide a computer program product including an application and an internal debugger application that, when executed, prevents an external debugger application from analyzing the code of a software program installed on the computing device. The present disclosure also seeks to provide a computing device for preventing an external debugger application from analyzing the code of a software program installed on the computing device. The present disclosure also attempts to provide a system for preventing an external debugger application from analyzing the code of an application installed on a computing device.

[0006] The present disclosure aims to provide solutions to the existing problems of software piracy and unauthorized access, modification, or exploitation of software programs. The object of the present disclosure is to provide solutions that at least partially overcome the problems encountered in the prior art and to provide a reliable and efficient method for preventing an external debugger application from analyzing the code of a software program installed on a computing device.

[0007] In a first aspect, embodiments of the present disclosure provide a method for preventing an external debugger application from analyzing the code of a software program installed on a computing device, the method comprising:

[0008] - Initializing a software program including an application and an internal debugger application, wherein the software program, upon its initialization, instructs the internal debugger application to load the application within the internal debugger application, and wherein the internal debugger application is configured to utilize kernel resources of the operating system of the computing device;

[0009] - Executing the internal debugger application to set one or more breakpoints in the code of the application to define an execution path for the code of the application;

[0010] - Executing the application according to the defined execution path for the code of the application;

[0011] - Stopping the execution of the code of the application when reaching any of the one or more breakpoints in the code of the application; and

[0012] - Transferring control to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application.

[0013] In a second aspect, embodiments of the present disclosure provide a computer program product including a computer-readable code device that, when run on a processing device, will cause the processing device to perform a method according to any embodiment of this specification. In particular, a computer program product installed on a computing device is provided, the computer program product including a non-transitory machine-readable data storage medium storing program instructions of a software program, the program instructions, when accessed by a processing device associated with the computing device, will cause the processing device to:

[0014] - Initialize a software program including an application program and an internal debugger application, wherein the software program, when initialized, instructs the internal debugger application to load the application program in the internal debugger application, and wherein the internal debugger application is configured to utilize kernel resources of the operating system of the computing device;

[0015] - Execute the internal debugger application to set one or more breakpoints in the code of the application program to define an execution path for the code of the application program;

[0016] - Execute the application program according to the defined execution path for the code of the application program;

[0017] - Stop the execution of the code of the application program when reaching any of the one or more breakpoints in the code of the application program; and

[0018] - Transfer control to the internal debugger application to provide the address of the next instruction that is to be executed in the defined execution path for the code of the application program.

[0019] In a third aspect, embodiments of the present disclosure provide a computer program product embodied as a non-transitory machine-readable data storage medium for a computing device, the computer program product including a software program, wherein the software program includes:

[0020] - An application program; and

[0021] - An internal debugger application configured to utilize kernel resources of the operating system of the computing device to prevent an external debugger application from analyzing the code of the software program, the internal debugger application, when executed, causes the computing device to:

[0022] - Load the application program in the internal debugger application;

[0023] - Set one or more breakpoints in the code of the application program to define an execution path for the code of the application program;

[0024] - Execute the application program according to the defined execution path for the code of the application program;

[0025] - Stop the execution of the code of the application when reaching any one of one or more breakpoints in the code of the application; and

[0026] - Transfer control to an internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application.

[0027] The computer program product according to the present invention can be stored in and executed in the computer device or system outlined below to prevent an external debugger application from analyzing the code of a software program.

[0028] In a fourth aspect, embodiments of the present disclosure provide a computing device for preventing an external debugger application from analyzing the code of a software program installed on a computing device, the computing device being configured to:

[0029] - Initialize a software program including an application and an internal debugger application, wherein the software program instructs the internal debugger application to load the application in the internal debugger application when initialized, and wherein the internal debugger application is configured to utilize kernel resources of the operating system of the computing device;

[0030] - Execute the internal debugger application to set one or more breakpoints in the code of the application to define an execution path for the code of the application;

[0031] - Execute the application according to the defined execution path for the code of the application;

[0032] - Stop the execution of the code of the application when reaching any one of one or more breakpoints in the code of the application; and

[0033] - Transfer control to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application.

[0034] In a fifth aspect, embodiments of the present invention provide a system for preventing an external debugger application from analyzing the code of an application installed on a computing device, the system including:

[0035] - A debug server communicatively coupled to the computing device, the debug server being configured to attach an internal debugger application to the application, wherein the internal debugger application is configured to utilize kernel resources of the operating system of the computing device, and the internal debugger application causes the computing device when executed to:

[0036] - Load the application in the internal debugger application;

[0037] - Set one or more breakpoints in the code of the application to qualify the execution path for the code of the application;

[0038] - Execute the application according to the qualified execution path for the code of the application;

[0039] - Stop the execution of the code of the application when reaching any of the one or more breakpoints in the code of the application; and

[0040] - Transfer control to an internal debugger application to provide the address of the next instruction to be executed in the qualified execution path for the code of the application.

[0041] Embodiments of the present disclosure substantially eliminate or at least partially address the above problems in the prior art, and provide a reliable and efficient method to prevent the analysis of the code of an application.

[0042] Other aspects, advantages, features, and objects of the present disclosure will become apparent from the drawings and the detailed description of the illustrative embodiments interpreted in conjunction with the appended claims.

[0043] It should be understood that the features of the present disclosure are readily combinable in various combinations without departing from the scope of the present disclosure defined by the appended claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] When read in conjunction with the drawings, the above summary and the following detailed description of the illustrative embodiments will be better understood. To illustrate the present disclosure, exemplary configurations of the present disclosure are shown in the drawings. However, the present disclosure is not limited to the specific methods and tools disclosed herein. In addition, those skilled in the art will understand that the drawings are not drawn to scale. Wherever possible, the same elements are denoted by the same reference numerals.

[0045] Embodiments of the present disclosure will now be described by way of example only with reference to the following diagrams, in which:

[0046] Figure 1 is a flowchart depicting steps of a method for preventing an external debugger application from analyzing the code of a software program installed on a computing device according to an embodiment of the present disclosure;

[0047] Figure 2 is a block diagram of a computing device according to an embodiment of the present disclosure;

[0048] Figure 3 is a block diagram depicting the operation of a computing device (such as, Figure 1 a computing device) according to an embodiment of the present disclosure; and

[0049] Figure 4A block diagram of a system for preventing an external debugger application from analyzing the code of an application installed on a computing device, according to an embodiment of the present disclosure.

[0050] In the figures, underlined numbers are used to indicate items on which the underlined number is located or items adjacent to the underlined number. Non-underlined numbers are associated with the items identified by the lines linking the non-underlined number to the item. When a number is non-underlined and has an associated arrow, the non-underlined number is used to identify the general item to which the arrow points. Detailed Description of the Embodiments

[0051] The following detailed description illustrates embodiments of the present disclosure and ways in which they may be implemented. Although some modes for carrying out the present disclosure have been disclosed, those skilled in the art will recognize that other embodiments for carrying out or practicing the present disclosure are also possible.

[0052] In a first aspect, embodiments of the present disclosure provide a method for preventing an external debugger application from analyzing the code of a software program installed on a computing device, the method comprising:

[0053] - Initializing a software program including an application and an internal debugger application, wherein the software program, upon initialization, instructs the internal debugger application to load the application within the internal debugger application, and wherein the internal debugger application is configured to utilize kernel resources of the operating system of the computing device;

[0054] - Executing the internal debugger application to set one or more breakpoints in the code of the application to define an execution path for the code of the application;

[0055] - Executing the application according to the defined execution path for the code of the application;

[0056] - Stopping the execution of the code of the application when reaching any of the one or more breakpoints in the code of the application; and

[0057] - Transferring control to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application.

[0058] In a second aspect, embodiments of the present disclosure provide a computer program product installed on a computing device, the computer program product comprising a non-transitory machine-readable data storage medium having program instructions for a software program stored thereon, the program instructions, when accessed by a processing device associated with the computing device, will cause the processing device to:

[0059] - Initialize a software program including an application and an internal debugger application, where the software program, upon initialization, instructs the internal debugger application to load the application in the internal debugger application, and where the internal debugger application is configured to utilize kernel resources of an operating system of a computing device;

[0060] - Execute the internal debugger application to set one or more breakpoints in the code of the application to define an execution path for the code of the application;

[0061] - Execute the application according to the defined execution path for the code of the application;

[0062] - Stop the execution of the code of the application when reaching any of the one or more breakpoints in the code of the application; and

[0063] - Transfer control to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application.

[0064] In a third aspect, embodiments of the present disclosure provide a computer program product embodied as a non-transitory machine-readable data storage medium for a computing device, the computer program product including a software program, where the software program includes:

[0065] - An application; and

[0066] - An internal debugger application configured to utilize kernel resources of an operating system of a computing device to prevent an external debugger application from analyzing the code of the software program, the internal debugger application, when executed, causing the computing device to:

[0067] - Load the application in the internal debugger application;

[0068] - Set one or more breakpoints in the code of the application to define an execution path for the code of the application;

[0069] - Execute the application according to the defined execution path for the code of the application;

[0070] - Stop the execution of the code of the application when reaching any of the one or more breakpoints in the code of the application; and

[0071] - Transfer control to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application.

[0072] In a fourth aspect, embodiments of the present disclosure provide a computing device for preventing an external debugger application from analyzing the code of a software program installed on a computing device, the computing device being configured to:

[0073] - Initialize a software program including an application program and an internal debugger application, wherein the software program, upon its initialization, instructs the internal debugger application to load the application program in the internal debugger application, and wherein the internal debugger application is configured to utilize kernel resources of the operating system of the computing device;

[0074] - Execute the internal debugger application to set one or more breakpoints in the code of the application program to define an execution path for the code of the application program;

[0075] - Execute the application program according to the defined execution path for the code of the application program;

[0076] - Stop the execution of the code of the application program when reaching any of the one or more breakpoints in the code of the application program; and

[0077] - Transfer control to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application program.

[0078] In a fifth aspect, embodiments of the present invention provide a system for preventing an external debugger application from analyzing the code of an application program installed on a computing device, the system including:

[0079] - A debug server communicatively coupled to the computing device, the debug server being configured to attach an internal debugger application to the application program, wherein the internal debugger application is configured to utilize kernel resources of the operating system of the computing device, and the internal debugger application, when executed, causes the computing device to:

[0080] - Load the application program in the internal debugger application;

[0081] - Set one or more breakpoints in the code of the application program to define an execution path for the code of the application program;

[0082] - Execute the application program according to the defined execution path for the code of the application program;

[0083] - Stop the execution of the code of the application program when reaching any of the one or more breakpoints in the code of the application program; and

[0084] - Transfer control to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application program.

[0085] The present disclosure provides methods for preventing an external debugger application from analyzing the code of a software program installed on a computing device by implementing an internal debugger application in combination with an application at runtime. The present disclosure provides methods and systems for allowing a software program to be executed in a manner that prevents the analysis of the code of the application, thereby preventing unauthorized access to and modification of the code of the application. The present disclosure provides methods and systems for preventing an external debugger application by integrating the code of an application with the code of an internal debugger application. Advantageously, such methods prevent piracy of software programs in an inexpensive, time-consuming, and efficient manner. The present disclosure provides methods for attaching an internal debugger application integrated with an application to prevent a user from attaching an external debugger application to the software program, thereby restricting unauthorized users from analyzing the code of the software program.

[0086] Throughout the present disclosure, the term "software program" refers to a set of instructions or instruction set installed on a computing device, also referred to as code. The set of instructions or instruction set is executable by a computing device or other digital system to configure the computer or digital system to perform tasks intended as the software program. Herein, the term "software program" includes the code of an application program embedded with the code of an internal debugger application such that the initialization of the software program loads the internal debugger application, followed by the loading of the application program in the internal debugger application. It should be understood that the term "software program" as used herein is used to refer to a complete software package including an application program and an internal debugger application, and this complete software package prevents an external debugger application from attaching to the software program when executed in a computing device, and thus prevents the analysis of the code of the software program.

[0087] In one or more embodiments, the term "software program" is intended to cover instructions stored in a storage medium such as RAM, hard disk, optical disc, etc., and is also intended to cover so-called "firmware", which is a software program stored on ROM, etc. Optionally, the software program refers to a software application. Such software programs are organized in various ways, for example, the software program includes software components organized as libraries, Internet-based programs stored on a remote server, etc., source code, interpreted code, object code, directly executable code, etc. It can be understood that the software program can call system-level code or call other software residing on a server or other location to perform certain functions. In addition, the software program can be pre-configured and pre-integrated with an operating system to build a software device.

[0088] Throughout this disclosure, as used herein, the term "application" refers to a collection of instructions or a set of instructions installed on a computing device, also referred to as code. The term "application program" is used herein broadly and includes applications written by programmers (also referred to as developers), kernels, drivers, interrupt handlers, libraries. In other words, the term "application program" includes a complete and independent computer program that is designed to perform a specific function, task, or activity when the application program is executed in a computing device. Optionally, the application program is a game application program. For example, the game application program can include various types of game applications, such as racing games, adventure games, puzzle games, action games, role-playing games (RPGs), strategy games, shooting games, simulation games, etc.

[0089] Additionally, the application program can be stored in a storage medium such as RAM, hard disk, optical disc, etc., and is also intended to cover the so-called "firmware", that is, software stored in ROM, etc. Such application programs are organized in various ways. For example, the application program includes components organized as libraries, Internet-based programs stored on remote servers, etc., source code, interpreted code, object code, directly executable code, etc. It can be understood that the application program can call system-level code or call other software residing on a server or other location to perform certain functions.

[0090] Additionally, the term "code" as used herein refers to processor instructions, data (including constants, variables, and data structures), or both instructions and data. It should be understood that by implementing this method, unauthorized users can be prevented from analyzing the code. Similarly, such a term can include or contain what is designed to implement subroutines, functions, procedures, object methods, software programs executed on a computing device, interface, or object, executable applications, applets, servlets, source code, object code, or intermediate code, shared libraries, and / or dynamically loaded / linked libraries, and / or other sequences of instructions or groups of instruction numbers.

[0091] Optionally, the code of the application program includes a plurality of code blocks. The term "code block" as used herein refers to a module of executable code that is configured to perform a specific task among one or more expected tasks of the application program. Generally, the code block is configured to receive input, process the input, and return a result as output based on the processing of the input. Each of the one or more code blocks is associated with a memory in the computing device.

[0092] Optionally, the application program is developed in a suitable operating environment, including but not limited to Java ®environments, and some include environments that utilize languages such as C, C++, C#, Python, R programming language, Oracle, etc. It should be understood that those skilled in the art will understand that the disclosed methods and systems are applicable to a variety of programming languages, programming models and programs, as well as technical endeavors outside the field of software development, and are not limited to game applications only.

[0093] As previously mentioned, the application is installed on a computing device. Throughout this disclosure, the term "computing device" as used herein generally refers to an electronic device associated with (or used by) a user, which is capable of enabling the user to perform specific tasks associated with the application. In addition, the computing device is intended to be interpreted broadly to include any electronic device that can be used for voice and / or data communication via a wireless communication network. The computing device may include, but is not limited to: mobile phones, smartphones, mobile Internet devices (MIDs), tablet computers, ultra-mobile personal computers (UMPCs), tablet computers, personal digital assistants (PDAs), tablet computers, personal computers (PCs), handheld PCs, laptop computers, desktop computers, network-attached storage (NAS) devices, large-size touchscreens with embedded PCs, and interactive entertainment devices, such as game consoles, televisions (TVs) and set-top boxes (STBs), kiosks, and generally includes many or all of the above elements related to gaming devices.

[0094] It is worth noting that the term "computing device" as used herein refers to an electronic device, such as a general-purpose computer on which a software program is installed, as a package including the application and an internal debugger application. In addition, the term "computing device" is also used to cover game consoles, such as Microsoft Xbox TM , Nintendo Wii TM , Sony PlayStation TM etc.

[0095] In addition, the computing device includes a processing device and a memory. The processing device may be one or more known processors, such as those by Intel TM or AMD TMA microprocessor manufactured or licensed by ARM. The processing device can be a single-core or multi-core processor that performs parallel processing simultaneously. For example, the processor can be a single-core processor configured with virtual processing technology. In some embodiments, the processing device can use logical processors to execute and control multiple processes simultaneously. The processing device can implement virtual machine technology or other known technologies to provide the ability to execute, control, run, manipulate, and store multiple software processes, applications, programs, etc. In another embodiment, the processing device can include a multi-core processor arrangement (e.g., dual-core, quad-core, etc.) configured to provide parallel processing functionality to allow the computing device to execute multiple processes simultaneously. Those of ordinary skill in the art will understand that other types of processing device arrangements can be implemented to provide the capabilities disclosed herein. Additionally, the memory can include volatile or non-volatile, magnetic, semiconductor, solid-state, tape, optical, removable, non-removable, or other types of storage devices or tangible (i.e., non-transitory) computer-readable media that store one or more programs (such as (multiple) applications). In one example, the computing device includes one or more modules, namely, a first module and a second module for executing software programs. Specifically, the first module is for executing application programs, and the second module is for executing an internal debugger application.

[0096] The (multiple) programs can include an operating system that, when executed by one or more processing devices, performs known operating system functions. For example, the operating system can include Microsoft Windows™, Unix™, Linux™, Android™, Microsoft XP™, AIX™, IBM's i5os, and Apple™ operating systems, personal digital assistant (PDA)-type operating systems (such as Microsoft CE™), or other types of operating systems. Thus, the disclosed embodiments can operate and function with computing devices running any type of operating system. The computing device can also include communication software that, when executed by the processor, provides communication with a network and / or a local network, such as web browser software, tablet computer or smart handheld device networking software, etc.

[0097] Throughout this disclosure, the term "user" refers to a person or human being associated with a computing device and capable of running application programs on the computing device. It is worth noting that the terms "authorized user" and "unauthorized user" are different in a sense, that is, an authorized user is a programmer or developer who has the right to analyze the code, that is, an authorized user has the right to view, modify, or delete the code of an application program, while an unauthorized user is a user (or a player in the case of a game application) who has no right to analyze the code of the application program.

[0098] The method includes: initializing a software program including an application program and an internal debugger application. The software program, upon its initialization, instructs the internal debugger application to load the application program within the internal debugger application, and wherein the internal debugger application is configured to utilize the kernel resources of the operating system of the computing device. Throughout this disclosure, the term "operating system" as used herein refers to the system software layer that schedules threads (i.e., individual sequences of flow within a process) and provides the functionality to make operating system resources available to the threads (including memory access, access to input / output (I / O) resources, etc.). The operating system also controls the allocation and authorization of access to computer resources. The operating system performs low-level basic tasks such as receiving input from a keyboard, sending output to a display, maintaining the tracking of files and directories on a disk drive, and controlling peripheral devices such as disk drives and printers.

[0099] Throughout this disclosure, the "internal debugger application" which is referred to as or commonly known as a "debugger" is a computer program or software application for testing and debugging other programs (referred to as the program under debug). Generally, the internal debugger application is used to test application programs and identify the causes of known problems or "bugs" in the application. The testing of an application program is commonly referred to as "debugging". Notably, the internal debugger application is configured to execute one program instruction at a time (referred to as "stepping" through the program) and determine what the next instruction to execute is. Additionally, the internal debugger application is used to examine and / or modify computer registers and memory locations. The internal debugger application provides information to the program about the execution state of the running application program and control over it. The state of an application program includes program and data memory; hardware registers; program stack; and operating system objects such as queues, synchronization objects, and program accounting information. The internal debugger application is configured to control the execution of the application program, and its operations include stopping (or alternatively starting, pausing, terminating, stepping through instructions, stepping through branches, stepping through statements, stepping through subroutine calls, stopping at a breakpoint (discussed in detail later), and stopping at a data watchpoint).

[0100] Specifically, when the internal debugger application is attached to the application program and the software program is running, an external debugger is prevented from attaching to the software program, thereby preventing the analysis of the code of the application program. Hereinafter, the term "external debugger application" is used to refer to a debugger application that is not integral with the software program and attempts to attach to the application program to analyze the code of the software program. Additionally, the "external debugger application" is an unauthorized debugger application that is prevented by implementing this method and system. In fact, as an example, running the internal debugger application can prevent the running of an external debugger application in the same computing device. In an example embodiment, the operating system (kernel, etc.) of the computing device is configured to allow only one debugger application to attach to a single process at the same time.

[0101] In addition, as previously described, the internal debugger application utilizes the kernel resources of the operating system. Throughout this disclosure, "kernel resources" as used herein refers to the central module of the operating system associated with a computing device. It is noted that the kernel is the first part of the operating system to be loaded and it remains in memory. The kernel is responsible for memory management, process and task management, and disk management. The kernel connects the device hardware to the application programs. It is noted that the kernel is part of the software or operating system and is responsible for providing secure access to the hardware of the computing device on behalf of the execution threads in the application. In addition, the kernel also provides access to other components of the computing device, including access to memory, processing capabilities, input / output resources, etc. The kernel typically also provides hardware abstraction as an instruction set common to all devices of a certain type, thereby aiming to hide the underlying complexity from the application programs and other components of the operating system. Advantageously, the kernel resources provide kernel services that control and mediate access to the hardware of the computing device, implement and support basic abstractions such as processes, threads, files, devices, etc., allocate and schedule operating system resources such as memory, processors, disks, file descriptors, process descriptors, thread descriptors, etc., and provide security and protection for the operating system resources. It should be understood that the functions and operations of the operating system and kernel resources as described above should not unduly limit the scope of the appended claims herein, and the operating system and kernel resources can perform various functions and operations known in the art.

[0102] In addition, the method includes: instructing the internal debugger application to load an application program within the internal debugger application. Herein, the software program may also include one or more batch files that, upon initialization of the software program, instruct to load the application program within the internal debugger application. Optionally, the method includes: configuring the application program to be loaded within the internal debugger application. Herein, loading the application program within the internal debugger application indicates that the application program is configured to run within the internal debugger application. It should be understood that the application program is configured to run within the internal debugger application during runtime, thereby preventing an external debugger application from debugging a specific application program.

[0103] Optionally, the application is configured to initialize an internal debugger application when a software program is launched by a user of the computing device. The user can launch the software program in various ways, for example, by clicking on the executable file of the application, and loading the application in the internal debugger application. Optionally, the internal debugger application initializes the execution of the code of the application. It should be understood that the application is configured to execute only after the initialization of the internal debugger application. This approach ensures that an external debugger application is not attached to the application, thereby eliminating the opportunity for unauthorized access to analyze or modify the code of the application. It can be understood that the code of the internal debugger application is integrated into the code of the application to form the software program, such that the initialization of the software program will trigger the initialization of the internal debugger application in a manner that the code of the application is configured to run in the internal debugger application.

[0104] Further, the method includes: executing the internal debugger application to set one or more breakpoints in the code of the application to define an execution path for the code of the application. It is noted that the internal debugger application is configured to introduce one or more breakpoints in the code of the application after one or more instruction sets of the code of the application. Herein, the term "breakpoint" is used to refer to an intentional stop or pause during the execution of the application. It is noted that breakpoints are typically inserted to determine whether the execution of the application is running as expected. A breakpoint is used to immediately interrupt the running application after the breakpoint is encountered. It is noted that breakpoints are inserted at different instructions in the code of the application, and a new execution path is accordingly defined according to the inserted breakpoints. As previously mentioned, the application is configured to be loaded in the internal debugger application. In an example, the execution of the internal debugger application is the parent process, and the execution of the application is the child process, and the execution path can be defined accordingly.

[0105] Optionally, one or more breakpoints are set to include an instruction to move from one code block to another after the execution of a code block. Herein, the instruction can include a memory address of a memory associated with the computing device. The memory address is obtained from the code of the internal debugging application and accordingly moved to the execution of another code block. Optionally, one or more breakpoints are set at the end of one or more predetermined code blocks in the code of the application. Optionally, one or more breakpoints are set based on the execution frequency of one or more code blocks in the code of the application. Optionally, one or more breakpoints are randomly set at the end of one or more code blocks in the code of the application.

[0106] In addition, the method includes: executing an application according to a defined execution path for the code of the application. Herein, the term "execution path" refers to the path that an executable instruction set has to follow to access a specified unique location in the memory of a computing device where an executable file is located. It is noted that the execution path is defined before execution and after obtaining the kernel resources of the operating system of the computing device. It should be understood that when a breakpoint is inserted for an instruction after a specific breakpoint, the execution path is redefined. In addition, the method includes: stopping the execution of the code of the application when any of one or more breakpoints in the code of the application is reached. Herein, when a breakpoint is encountered, the execution of the code of the application in the first execution path is paused, and the execution of the code of the application in the second execution path is initiated. In addition, the method includes: transferring control to an internal debugger application to provide the address of the next instruction to be executed in the execution path defined for the code of the application. Herein, after the execution of the application in the first execution path stops, the control is transferred to the internal debugger application via the second execution path. The code of the internal debugger application provides the address of the next instruction to be executed according to a third execution path for the code of the application.

[0107] In one case, when one or more breakpoints are set at the end of one or more predetermined code blocks in the code of the application, the breakpoint is inserted after the last executable instruction of the first code block, such that the memory address of the first executable instruction of the second code block to be executed is stored in the code of the internal debugger application. Herein, when the corresponding breakpoint is encountered, the execution of the application stops after the execution of the last executable instruction of the first code block, and the control is transferred to the internal debugger application. In addition, the memory address of the first executable instruction of another code block to be executed is obtained from the code of the internal debugger application. It should be understood that this method ensures that unauthorized users cannot access the entire code of the application. In a scenario, when a user can access a specific code portion of the application, when a breakpoint is encountered, the execution of the application stops, and the address of the next instruction is not available to unauthorized users, thus preventing software piracy of the software program.

[0108] In one case, when one or more breakpoints are set based on the execution frequency of one or more code blocks in the code of the application, the breakpoints are periodically inserted after or before the most frequently used code blocks in the application, such as in the case of a game application. The breakpoints are inserted in a similar manner as described above by accessing the memory of the computing device. Herein, the case where the breakpoint is before the frequently used code block ensures the security of the code block with a higher risk of being accessed by unauthorized users.

[0109] In one case, when one or more breakpoints are randomly set at the end of one or more code blocks in the code of an application, the breakpoints are randomly inserted either after or before any of the code blocks in the code block. Herein, the breakpoints can be dynamically inserted at one or more positions such that the positions of the breakpoints change randomly each time the software program is initialized. It can be understood that the method of inserting breakpoints is the same as that discussed above, but the breakpoints are dynamically set.

[0110] The present disclosure also provides a system for preventing an external debugger application from analyzing the code of an application installed on a computing device. The system includes a debug server communicatively coupled to the computing device. Throughout the present disclosure, the term "server" as used in "debug server" refers to a structure and / or module including programmable and / or non-programmable components configured to store, process, and / or share information related to remote debugging. Optionally, the server includes any arrangement of physical or virtual computing entities capable of enhancing information to perform various computing tasks such as remote debugging. Additionally, it should be understood that the server can be either a single hardware server and / or multiple hardware servers operating in a parallel or distributed architecture. In an example, the server can include components such as a memory, a processor, a network adapter, etc. to store, process, and / or share information with other computing components such as the computing device.

[0111] Notably, the computing device is communicatively coupled to the debug server via a communication network. In an exemplary network environment, multiple computing devices are connected to the debug server, and the debug server is configured to provide remote debugging services to each of the computing devices connected via the communication network. As described above, the application is installed on the computing device and is configured to access the debug server when the application is initialized on the computing device. It can be understood that the application is configured to run on the computing device only when the computing device is connected to the debug server, thereby preventing an external debugger from analyzing the code of the application.

[0112] Herein, the communication network can be a collection of individual networks that are interconnected with each other and operate as a single large network. Such individual networks can be wired, wireless, or a combination thereof. Examples of such individual networks include, but are not limited to, local area network (LAN), wide area network (WAN), metropolitan area network (MAN), wireless LAN (WLAN), wireless WAN (WWAN), wireless MAN (WMAN), the Internet, second generation (2G) telecommunication networks, third generation (3G) telecommunication networks, fourth generation (4G) telecommunication networks, and Worldwide Interoperability for Microwave Access (WiMAX) networks.

[0113] Additionally or alternatively, the computing device can use its own Bluetooth ® network and connect to Bluetooth® A server for synchronizing with other electronic devices. Depending on various possible scenarios, the network environment can be implemented in various ways. In one example scenario, the network environment can be implemented by a co-located arrangement of a server and a database. In another example scenario, the network environment can be implemented by a spatially distributed arrangement of a server and a database that are communicatively coupled to each other via a communication network. In yet another example scenario, the server and the database can be implemented via a cloud computing service.

[0114] In addition, the debug server is configured to attach an internal debugger application to an application. Herein, the internal debugger application is configured to utilize the kernel resources of the operating system of the computing device. It is noteworthy that the function of the internal debugger application is the same as that previously described in this disclosure. However, it should be understood that the internal debugger application used in the system is not integrated with the application program. Herein, the internal debugger application is configured to be remotely accessed by the computing device via a communication network. When executed, the internal debugger application causes the computing device to load the application program in the internal debugger application. Further, the internal debugger application sets one or more breakpoints in the code of the application program to define an execution path for the code of the application program. The internal debugger application executes the application program according to the execution path defined for the code of the application program. The internal debugger application stops the execution of the code of the application program when reaching any of the one or more breakpoints in the code of the application program. In addition, the internal debugger application transfers control to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application program.

[0115] As previously mentioned, this disclosure also relates to a computer program product installed on a computing device, the computer program product including a non-transitory machine-readable data storage medium having program instructions with a software program stored thereon. The embodiments and details disclosed above are analogously applicable to the above computer program product, which, when executed, prevents an external debugger application from analyzing the code of the software program.

[0116] Optionally, the code of the application program includes a plurality of code blocks, and one or more of the breakpoints include an instruction to move from one code block to another code block after the execution of one code block.

[0117] Optionally, the program instructions of the computer program product, when accessed by a processing device, will cause the processing device to transfer control to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application program.

[0118] Optionally, the program instructions of the computer program product, when accessed by a processing device, will cause the processing device to set one or more breakpoints at the end of one or more predetermined code blocks in the code of the application program.

[0119] Optionally, when the program instructions of the computer program product are accessed by a processing device, the processing device will set one or more breakpoints based on the execution frequency of one or more code blocks in the code of the application program.

[0120] Optionally, when the program instructions of the computer program product are accessed by a processing device, the processing device will randomly set one or more breakpoints at the end of one or more code blocks in the code of the application program.

[0121] Optionally, when the program instructions of the computer program product are accessed by a processing device, the processing device will configure the application program to initialize an internal debugger application when the user of the computing device starts the application program.

[0122] Optionally, when the program instructions of the computer program product are accessed by a processing device, the internal debugger application will initialize the execution of the code of the application program.

[0123] Optionally, the application program is a game application program.

[0124] As described above, the present disclosure also provides a computing device for preventing an external debugger application from analyzing the code of a software program installed on a computing device. The above-described embodiments and details are equally applicable to the above computing device to prevent an external debugger application from analyzing the code of a software program.

[0125] Optionally, the code of the application program includes a plurality of code blocks, and one or more of the breakpoints include instructions for moving from one code block to another code block after the execution of one code block.

[0126] Optionally, the computing device is further configured to transfer control to the internal debugger application to provide the address of the next instruction to be executed in a defined execution path for the code of the application program.

[0127] Optionally, the computing device is further configured to set one or more breakpoints at the end of one or more predetermined code blocks in the code of the application program.

[0128] Optionally, the computing device is further configured to set one or more breakpoints based on the execution frequency of one or more code blocks in the code of the application program.

[0129] Optionally, the computing device is further configured to randomly set one or more breakpoints at the end of one or more code blocks in the code of the application program.

[0130] Optionally, the computing device is configured to initialize an internal debugger application when the user of the computing device starts the application program.

[0131] Optionally, the computing device is configured to initialize the execution of the code of the application program upon initialization of the internal debugger application.

[0132] Detailed Description of the Drawings

[0133] Reference Figure 1 , shows a flowchart 100 that depicts steps of a method for preventing an external debugger application from analyzing the code of a software program installed on a computing device according to an embodiment of the present disclosure. At step 102, software programs including the application program and the internal debugger application are initialized, and the internal debugger application is configured to utilize kernel resources of the operating system of the computing device. At step 104, the internal debugger application is executed to set one or more breakpoints in the code of the application program to define an execution path for the code of the application program. At step 106, the application program is executed according to the execution path defined for the code of the application program. At step 108, the execution of the code of the application program is stopped when any of the one or more breakpoints in the code of the application program is reached. At step 110, control is transferred to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application program.

[0134] Steps 102 to 110 are merely illustrative, and other alternatives may also be provided, where one or more steps are added, one or more steps are deleted, or one or more steps are provided in a different order without departing from the scope of the claims herein.

[0135] Reference Figure 2 , shows a block diagram of a computing device 200 according to an embodiment of the present disclosure. As shown, the computing device 200 includes a processing device 202, an operating system (OS) 204, a basic input / output system (BIOS) 206, and kernel resources 208. The processing device 202 further includes a memory 210, including a random access memory (RAM) 212 and a flash memory 214. Herein, the processing device 202 is configured to access the kernel resources 208 of the operating system 204 upon initialization of the software program. In addition, the processing device 202 allocates memory locations to the code of the software program in the RAM 212. In addition, the flash memory 214 is configured to store boot code from the BIOS 206 and the OS 204 to enable the operation of the computing device 200.

[0136] Reference Figure 3 , shows a depiction of a computing device 300 (such as Figure 1Block diagram of the operation of a computing device 200). As shown, the computing device 300 includes a processing device 302 that communicates with a memory 304. Herein, the code of the software program 306 is stored in the memory 304. The software program 306 includes an application program 308 and an internal debugger application 310. The processing device 302 is configured to access the code of the software program 306 from the memory 304. In addition, the processing device 302 is configured to utilize kernel resources 312 upon initialization of the software program 306.

[0137] Reference Figure 4 , shows a block diagram of a system 400 for preventing an external debugger application from analyzing the code of an application installed on a computing device 402 according to an embodiment of the present disclosure. As shown, the system 400 includes a computing device 402 communicatively coupled to a debug server 404. In addition, the computing device 402 and the debug server 4A communicatively connected via a communication network 406. Herein, the debug server 404 is configured to provide debug services to the computing device 402 by attaching an internal debugger application to the application program, thereby preventing an external debugger application.

[0138] Modifications to the foregoing embodiments of the present disclosure are possible without departing from the scope of the present disclosure as defined by the appended claims. Expressions such as "comprising," "including," "incorporating," "having," "is," etc., used to describe and claim the present disclosure are intended to be interpreted in a non-exclusive manner, i.e., to allow the presence of items, components, or elements not expressly described. References to the singular should also be construed as relating to the plural.

Claims

1. A method for preventing an external debugger application from analyzing the code of a software program (306) installed on a computing device (200, 300), the method comprising: - Initializing the software program including an application (308) and an internal debugger application (310), wherein the code of the application has the code of the internal debugger application embedded therein, wherein the software program loads the internal debugger application upon its initialization, and instructs the internal debugger application to load the application within the internal debugger application, and wherein the internal debugger application is configured to utilize kernel resources (312) of an operating system (204) of the computing device, further wherein loading the application within the internal debugger application prevents the external debugger application from attaching to the software program and analyzing the code of the software program; - Executing the internal debugger application to set one or more breakpoints in the code of the application to define an execution path for the code of the application; - Executing the application according to the defined execution path for the code of the application; - When any of the one or more breakpoints in the code of the application is reached, stopping the execution of the code of the application; And - Transferring control to the internal debugger application to provide an address for the next instruction to be executed in the defined execution path for the code of the application.

2. The method according to claim 1, wherein the code of the application includes a plurality of code blocks, and wherein the one or more breakpoints include an instruction that moves from one code block to another code block after the execution of one code block.

3. The method according to claim 1 or 2 further comprises: Transferring control to the internal debugger application to provide an address for the next code block to be executed in the defined execution path for the code of the application.

4. The method according to claim 1 or 2, wherein the one or more breakpoints are set at the end of one or more predetermined code blocks in the code of the application.

5. The method according to claim 1 or 2, wherein the one or more breakpoints are set based on the execution frequency of one or more code blocks in the code of the application.

6. The method according to claim 1 or 2, wherein the one or more breakpoints are randomly set at the end of one or more code blocks in the code of the application.

7. The method according to claim 1 or 2, wherein the application is configured to initialize the internal debugger application when the application is launched by a user of the computing device.

8. The method according to claim 1 or 2, wherein the internal debugger application initializes the execution of the code of the application.

9. The method according to claim 1 or 2, wherein the application is a game application.

10. A computer program product installed on a computing device (200), the computer program product including a non-transitory machine-readable data storage medium having program instructions of a software program stored thereon, the software program, when accessed by a processing device associated with the computing device, causing the processing device to: - Initialize the software program including an application program and an internal debugger application, wherein the code of the application program is embedded with the code of the internal debugger application, wherein the software program loads the internal debugger application upon its initialization and instructs the internal debugger application to load the application program within the internal debugger application, and wherein the internal debugger application is configured to utilize kernel resources of the operating system of the computing device, and further wherein loading the application program within the internal debugger application prevents an external debugger application from attaching to the software program and analyzing the code of the software program; - Execute the internal debugger application to set one or more breakpoints in the code of the application program to define an execution path for the code of the application program; - Execute the application program according to the defined execution path for the code of the application program; - Stop the execution of the code of the application program when reaching any of the one or more breakpoints in the code of the application program; And - Transfer control to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application program.

11. The computer program product according to claim 10, wherein the code of the application program includes a plurality of code blocks, and wherein the one or more breakpoints include instructions for moving from one code block to another code block after the execution of one code block.

12. The computer program product according to claim 10 or 11, wherein the program instructions, when accessed by the processing device, cause the processing device to transfer control to the internal debugger application to provide the address of the next code block to be executed in the defined execution path for the code of the application program.

13. The computer program product according to claim 10 or 11, wherein the program instructions, when accessed by the processing device, cause the processing device to set the one or more breakpoints at the end of one or more predetermined code blocks in the code of the application program.

14. The computer program product according to claim 10 or 11, wherein the program instructions, when accessed by the processing device, cause the processing device to set the one or more breakpoints based on the execution frequency of one or more code blocks in the code of the application program.

15. The computer program product according to claim 10 or 11, wherein the program instructions, when accessed by the processing device, will cause the processing device to randomly set one or more breakpoints at the end of one or more code blocks in the code of the application program.

16. The computer program product according to claim 10 or 11, wherein the program instructions, when accessed by the processing device, will cause the processing device to configure the application program to initialize the internal debugger application when the application program is launched by a user of the computing device.

17. The computer program product according to claim 10 or 11, wherein the program instructions, when accessed by the processing device, will cause the internal debugger application to initialize the execution of the code of the application program.

18. The computer program product according to claim 10 or 11, wherein the application program is a game application program.

19. A computer program product embodied as a non-transitory machine-readable data storage medium for a computing device (200, 300), the computer program product comprising a software program, wherein the software program comprises: - an application program; and - an internal debugger application (310) configured to utilize kernel resources (312) of an operating system (204) of the computing device to prevent an external debugger application from analyzing the code of the software program, wherein the code of the application program is embedded with the code of the internal debugger application, and the internal debugger application, when executed, causes the computing device to: - load the application program in the internal debugger application, thereby preventing the external debugger application from attaching to the software program and analyzing the code of the software program; - set one or more breakpoints in the code of the application program to define an execution path for the code of the application program; - execute the application program according to the defined execution path for the code of the application program; - stop the execution of the code of the application program when reaching any of the one or more breakpoints in the code of the application program; and - transfer control to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application program.

20. A computing device (200, 300) for preventing an external debugger application from analyzing the code of a software program installed on the computing device, the computing device being configured to: - Initialize the software program including the application (308) and the internal debugger application (310), wherein the code of the application is embedded with the code of the internal debugger application, wherein the software program loads the internal debugger application upon its initialization, and instructs the internal debugger application to load the application in the internal debugger application, and wherein the internal debugger application is configured to utilize the kernel resources (312) of the operating system (204) of the computing device, and further wherein loading the application in the internal debugger application prevents the external debugger application from attaching to the software program and analyzing the code of the software program; - Execute the internal debugger application to set one or more breakpoints in the code of the application to define an execution path for the code of the application; - Execute the application according to the defined execution path for the code of the application; - Stop the execution of the code of the application when reaching any of the one or more breakpoints in the code of the application; And - Transfer control to the internal debugger application to provide the address of the next instruction to be executed in the defined execution path for the code of the application.

21. The computing device according to claim 20, wherein the code of the application comprises a plurality of code blocks, and wherein the one or more breakpoints comprise an instruction to move from one code block to another code block after the execution of one code block.

22. The computing device according to claim 20 or 21, further configured to transfer control to the internal debugger application to provide the address of the next code block to be executed in the defined execution path for the code of the application.

23. The computing device according to claim 20 or 21, further configured to set the one or more breakpoints at the end of one or more predetermined code blocks in the code of the application.

24. The computing device according to claim 20 or 21, further configured to set the one or more breakpoints based on the execution frequency of one or more code blocks in the code of the application.

25. The computing device according to claim 20 or 21, further configured to randomly set the one or more breakpoints at the end of one or more code blocks in the code of the application.

26. The computing device according to claim 20 or 21, configured to initialize the internal debugger application when the application is launched by a user of the computing device.

27. The computing device according to claim 20 or 21, configured to initialize the execution of the code of the application upon the initialization of the internal debugger application.

28. A system (400) for preventing an external debugger application from analyzing the code of an application (308) installed on a computing device (300), the system comprising: - A debug server (404) communicatively coupled to the computing device, the debug server being configured to attach an internal debugger application (310) to the application, wherein the internal debugger application is configured to utilize kernel resources (312) of an operating system (204) of the computing device, the internal debugger application causing the computing device, when executed, to: - Load the application in the internal debugger application, thereby preventing the external debugger application from attaching to the application and analyzing the code of the application; - Set one or more breakpoints in the code of the application to define an execution path for the code of the application; - Execute the application according to the defined execution path for the code of the application; - Stop the execution of the code of the application when reaching any of the one or more breakpoints in the code of the application; And - Transfer control to the internal debugger application to provide an address for the next instruction to be executed in the defined execution path for the code of the application.

Images