A method, device, equipment and medium for identifying game speed-changing plug-ins

Abstract

The present application discloses a method, device, equipment and medium for identifying game speed-changing plug-ins, and the present application belongs to the field of Internet technology. The method includes: if an anti-plug-in trigger event is detected, a startup instruction is generated to start the anti-speed-changing plug-in system; a first detection mechanism is used to perform a Hook detection on the API of the operating system to obtain a first detection result; a second detection mechanism is used to perform a time anomaly detection on the game system to obtain a second detection result; a third detection mechanism is used to detect the execution time of the game task to obtain a third detection result; according to one or more of the first detection result, the second detection result and the third detection result, it is determined whether a speed-changing plug-in is used during the game operation. This technical solution can start the anti-speed-changing plug-in system when the user runs the game, and use a variety of mechanisms to detect parameters related to interfaces and time in the game system, accurately combat speed-changing plug-ins, maintain the fairness of the game, and provide a harmonious gaming environment.

Description

Technical Field

[0001] The present application belongs to the field of Internet technology, and specifically relates to a method, device, equipment and medium for identifying game speed change plug-ins. Background Art

[0002] Game plug-ins generally refer to cheating programs that are created by changing some of the software programs, that is, using computer technology to tamper with the original normal settings and rules of the game, so as to easily obtain the benefits of victory, rewards and pleasure. Among them, there is a speed-changing plug-in that can change the speed by modifying the system time obtained by the game, or calling the time in the game engine.

[0003] After using the speed-changing plug-in, you can speed up the material collection progress in the game, speed up the progress of daily tasks, and shorten the game development cycle. When attacking NPCs (non-player characters), you can slow down, so that users have more reaction time and the level difficulty is reduced. The speed-changing plug-in destroys the fairness of the game and seriously threatens the harmonious environment in the game. However, as the crackdown on plug-ins intensifies, the speed-changing plug-in is becoming more and more hidden. It is difficult to play a role by simply detecting the game code, and there is even a risk of identification errors, which affects the experience of normal players.

[0004] Therefore, how to accurately identify speed-changing plug-ins in game applications is a technical problem that needs to be solved urgently by technical personnel in this field. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a method, device, equipment and medium for identifying game speed-changing plug-ins. When a user runs a game, an anti-speed-changing plug-in system can be started, and multiple mechanisms can be used to detect parameters related to interfaces and time in the game system, accurately combat speed-changing plug-ins, maintain the fairness of the game, and provide users with a more harmonious gaming environment.

[0006] In a first aspect, an embodiment of the present application provides a method for identifying a game speed change plug-in, the method comprising:

[0007] If an anti-cheating trigger event is detected, a start command is generated to start the anti-speed-change cheating system;

[0008] The first detection mechanism is used to perform a Hook detection on the API of the operating system to obtain a first detection result; the second detection mechanism is used to perform a time anomaly detection on the game system to obtain a second detection result; the third detection mechanism is used to detect the execution time of the game task to obtain a third detection result;

[0009] Determine whether a speed-changing plug-in is used during game operation according to one or more of the first detection result, the second detection result, and the third detection result;

[0010] Wherein, the second detection mechanism is:

[0011] Synchronously collect game system time and CPU time according to the preset cycle;

[0012] Compare the synchronously collected game system time with the CPU time;

[0013] If the game system time is inconsistent with the CPU time, the second detection result is that the game system time is abnormal;

[0014] If the game system time is consistent with the CPU time, the second detection result is that there is no abnormality in the game system time.

[0015] Furthermore, after the anti-speed-shifting plug-in system is started, the method further includes:

[0016] Determine the sensitivity level of the anti-speed-changing cheat system based on the game detection requirements;

[0017] According to the sensitivity level of the anti-speed-shift cheating system, the identification mechanism of the anti-speed-shift cheating system is determined;

[0018] Accordingly, determining whether a speed-changing plug-in is used during game operation according to one or more of the first detection result, the second detection result, and the third detection result includes:

[0019] According to one or more of the first detection result, the second detection result and the third detection result, and the discrimination mechanism, it is determined whether a speed-changing plug-in is used during the running of the game.

[0020] Furthermore, before performing a Hook detection on the API of the operating system to obtain a first detection result, the method includes:

[0021] Checking the integrity of the game program to identify whether there are any changes in the program content of the game program;

[0022] If so, it is determined that the game program has been abnormally modified and the game program is exited.

[0023] Furthermore, the integrity of the game program is detected to identify whether there is any change in the program content of the game program, including:

[0024] Identify whether there is a digital signature in the game program, and if there is no digital signature, determine that there is a program content change in the game program;

[0025] or,

[0026] The MD5 value in the game program is calculated, and the MD5 value is compared with the pre-saved initial MD5 value. If the MD5 value is inconsistent with the initial MD5 value, it is determined that there is a program content change in the game program.

[0027] Furthermore, a first detection mechanism is used to perform a Hook detection on the API of the operating system to obtain a first detection result, including:

[0028] Create a detection thread;

[0029] Identify through the detection thread whether the memory value of the key API and the name and address of the interface are modified;

[0030] If it is modified, the first detection result is that there is a Hook in the operating system API;

[0031] If it has not been modified, the first detection result is that the Hook does not exist in the API of the operating system.

[0032] Furthermore, a third detection mechanism is used to detect the execution time of the game task, and a third detection result is obtained, including:

[0033] When detecting that a user is performing a game task, report the task start node and task end node to the server;

[0034] Obtaining the start time of the task start node and the end time of the task end node received by the server;

[0035] Calculate the task execution time according to the start time and the end time;

[0036] Get the difference between the task execution time and the preset standard task time;

[0037] If the difference exceeds the preset difference range, the third detection result is that there is an abnormal task execution time;

[0038] If the difference is within the preset difference range, the third detection result is that there is no abnormality in the task execution time.

[0039] In a second aspect, an embodiment of the present application provides a device for identifying a game speed change plug-in, the device comprising:

[0040] The anti-speed-change external-cheat system startup module is used to generate a startup instruction to start the anti-speed-change external-cheat system when an anti-cheat trigger event is detected;

[0041] The detection result acquisition module is used to use the first detection mechanism to perform Hook detection on the API of the operating system to obtain a first detection result; use the second detection mechanism to perform time anomaly detection on the game system to obtain a second detection result; use the third detection mechanism to detect the execution time of the game task to obtain a third detection result;

[0042] A speed change plug-in determination module, used to determine whether a speed change plug-in is used during game operation according to one or more of the first detection result, the second detection result and the third detection result;

[0043] Wherein, the second detection mechanism is:

[0044] Synchronously collect game system time and CPU time according to the preset cycle;

[0045] Compare the synchronously collected game system time with the CPU time;

[0046] If the game system time is inconsistent with the CPU time, the second detection result is that the game system time is abnormal;

[0047] If the game system time is consistent with the CPU time, the second detection result is that there is no abnormality in the game system time.

[0048] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.

[0049] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0050] In a fifth aspect, an embodiment of the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the method described in the first aspect.

[0051] In an embodiment of the present application, if an anti-cheating trigger event is detected, a startup instruction is generated to start the anti-speed-changing cheating system; a first detection mechanism is used to perform a Hook detection on the API of the operating system to obtain a first detection result; a second detection mechanism is used to perform a time anomaly detection on the game system to obtain a second detection result; a third detection mechanism is used to detect the execution time of the game task to obtain a third detection result; and according to one or more of the first detection result, the second detection result, and the third detection result, it is determined whether a speed-changing cheating is used during the game operation. Through the above method of identifying game speed-changing cheating, the anti-speed-changing cheating system can be started when the user runs the game, and multiple mechanisms can be used to detect parameters related to interfaces and time in the game system, accurately combat speed-changing cheating, maintain the fairness of the game, and provide users with a more harmonious gaming environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is a flowchart of a method for identifying a game speed-changing plug-in provided in the first embodiment of the present application;

[0053] Figure 2 It is a flowchart of a method for identifying a game speed change plug-in provided in Embodiment 2 of the present application;

[0054] Figure 3 It is a flowchart of a method for identifying a game speed change plug-in provided in Embodiment 3 of the present application;

[0055] Figure 4 It is a flowchart of a method for identifying a game speed change plug-in provided in the fourth embodiment of the present application;

[0056] Figure 5 It is a flowchart of a method for identifying a game speed change plug-in provided in Embodiment 5 of the present application;

[0057] Figure 6 It is a flowchart of a method for identifying a game speed change plug-in provided in Embodiment 6 of the present application;

[0058] Figure 7 It is a flowchart of a method for identifying a game speed change plug-in provided in Embodiment 7 of the present application;

[0059] Figure 8 It is a structural schematic diagram of a device for identifying a game speed change plug-in provided in Embodiment 8 of the present application;

[0060] Fig. 9 It is a structural diagram of an electronic device provided in Example 9 of the present application. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical scheme and advantages of the present application clearer, the specific embodiments of the present application are further described in detail below in conjunction with the accompanying drawings. It is understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for the convenience of description, only the part related to the present application but not all the contents are shown in the accompanying drawings. Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow chart describes each operation (or step) as a sequential process, many of the operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of each operation can be rearranged. The process can be terminated when its operation is completed, but it can also have additional steps not included in the accompanying drawings. The process can correspond to a method, a function, a procedure, a subroutine, a subprogram, etc.

[0062] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0063] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0064] In conjunction with the accompanying drawings, the method, device, equipment and medium for identifying game speed change plug-ins provided in the embodiments of the present application are described in detail through specific embodiments and their application scenarios.

[0065] Embodiment 1

[0066] Figure 1 1 is a flow chart of a method for identifying a game speed change plug-in provided in the first embodiment of the present application. Figure 1 As shown, the specific steps include:

[0067] S101, if an anti-cheating trigger event is detected, generating a start instruction to start the anti-speed-change cheating system;

[0068] The application scenario of this solution may be that when the smart terminal recognizes that the user is running a game, the anti-speed-changing plug-in system is turned on, the speed-changing plug-in in the game is identified through the first detection mechanism, the second detection mechanism, and the third detection mechanism, and based on one or more of the first detection result, the second detection result, and the third detection result, it is determined whether the speed-changing plug-in is used during the game operation.

[0069] Based on the above usage scenarios, it can be understood that the executor of the present application can be the smart terminal, such as a desktop computer, a laptop computer, a tablet computer, and an interactive multimedia device, etc., and no excessive limitations are made here.

[0070] Anti-cheating trigger events may be events such as a user logging into the game or the start of a game process. To ensure that speed-changing cheats can be detected more accurately, the game startup can be set as the startup condition of the anti-speed-changing cheat system to identify speed-changing cheats in a timely manner to avoid affecting the gaming experience of other users.

[0071] The anti-speed-changing plug-in system can be started when the user logs into the game using the account and password, or when the CPU detects the running of the game thread, the trigger condition generates a start instruction, and the start instruction is sent to the anti-speed-changing plug-in system to activate the system and start the detection task of the speed-changing plug-in.

[0072] S102, using a first detection mechanism to perform a Hook detection on the API of the operating system to obtain a first detection result; using a second detection mechanism to perform a time anomaly detection on the game system to obtain a second detection result; using a third detection mechanism to detect the execution time of the game task to obtain a third detection result;

[0073] The first detection mechanism may be to detect the program code of the API (Application Programming Interface) to identify whether there is a speed change plug-in. Among them, API can be a set of definitions, programs and protocols, and the mutual communication between computer software is realized through the API interface. Programmers can reduce programming tasks by developing applications by calling API functions. API is also a kind of middleware that provides data sharing for various platforms.

[0074] Hook detection can be used to identify the Hook speed-changing plug-in program inserted into the API program. Among them, the Hook speed-changing plug-in can monitor the API thread, intercept the specified message and obtain the control right first, and modify the return result of the API by changing the window information content or forcibly ending the information transmission, thereby changing the time data obtained by the game system and changing the speed of the game process.

[0075] The first detection result can be obtained by verifying the program code of the operating system's API to identify whether there is any insertion code of the Hook speed change plug-in during the operation of the program code. Alternatively, the corresponding interface in the API code can be detected to determine whether the API code has been modified by the Hook speed change plug-in by identifying whether the interface is consistent with the original interface. If the insertion code of the Hook speed change plug-in is detected, or the API code is modified by the Hook speed change plug-in, the first detection result is that the program of the Hook speed change plug-in is detected in the API program; if the insertion code of the Hook speed change plug-in is not detected, or the API code is modified by the Hook speed change plug-in, etc., the first detection result is that the program of the Hook speed change plug-in is not detected in the API program.

[0076] The second detection mechanism may be to verify the time of the game system. If the user uses a speed-changing plug-in, the time in the game system will change when the speed-changing plug-in is running to achieve the purpose of speed changing. If the user does not use the speed-changing plug-in, the time of the game system should be consistent with the CPU (Central Processing Unit) time of the terminal device running the game system.

[0077] The second detection result can be obtained by the anti-speed-changing plug-in system sending request instructions for obtaining the current time to the game system and the CPU respectively, receiving feedback information from the game system and the CPU, respectively extracting the uploaded current time in each feedback information, and comparing the current time fed back by the game system with the current time fed back by the CPU. If the time of the game system is consistent with the time of the CPU, the second detection result is that there is no abnormality in the game system time; if the time of the game system is inconsistent with the time of the CPU, the second detection result is that there is an abnormality in the game system time.

[0078] The third detection mechanism can detect the duration of the user's task execution and then determine whether the user uses a speed-changing plug-in. Since the time node recorded by the server is not easy to be modified, when the user executes the game task, the game system can be used to report the task start node and the task end node to the server, obtain the start time and end time of the task start node and the task end node recorded by the server, and calculate the actual duration of the user's task execution. If the user uses a speed-changing plug-in, the actual duration of the user's task execution is different from the standard completion duration set for the game task. For example, the game task is to collect materials, and the standard duration for completing the collection progress is 5 minutes. The actual duration of the user's task execution is calculated to be 20 seconds through the task start time and task end time of the server. Then the user's task execution duration is abnormal, and it is very likely that a speed-changing plug-in is used.

[0079] The third detection result can be obtained by extracting the start time of the task start node and the end time of the task end node reported by the game system received by the server when the user executes the game task, calculating the difference between the start time and the end time as the task execution time recorded by the server. The standard execution time of the current task is obtained through the game system, and the task execution time recorded by the server is compared with the standard execution time. If the task execution time is inconsistent with the standard execution time, the third result is that there is an abnormality in the game task execution time; if the task execution time is consistent with the standard execution time, the third result is that there is no abnormality in the game task execution time.

[0080] S103: Determine whether a speed-changing plug-in is used during game execution based on one or more of the first detection result, the second detection result, and the third detection result.

[0081] A method for determining whether a speed-changing plug-in is used during the operation of the game may be to obtain a first detection result, a second detection result, and a third detection result. If in the first result, a program for hooking the speed-changing plug-in is detected in the API program, or, in the second result, there is an abnormality in the game system time, or, in the third result, there is an abnormality in the execution time of the game task, if any one or more of the above detection results exist, it is determined that a speed-changing plug-in is used during the operation of the game; if the first detection result, the second detection result, and the third detection result are all inconsistent with the above detection results, it is determined that a speed-changing plug-in is not used during the operation of the game.

[0082] In the present scheme, a progressive detection method can be used to determine whether a speed-changing plug-in is used during the game operation. For example, the first detection mechanism is executed first. If the first detection result is that the Hook speed-changing plug-in program is detected, it is determined that the speed-changing plug-in is used; if the first detection result is that the Hook speed-changing plug-in program is not detected, the second detection mechanism is executed. If the second detection result is that there is an abnormality in the game system time, it is determined that the speed-changing plug-in is used; if the second detection result is that there is no abnormality in the game system time, the third detection mechanism is executed. If the third result is that there is an abnormality in the execution time of the game task, it is determined that the speed-changing plug-in is used; if the third result is that there is no abnormality in the execution time of the game task, it is determined that the speed-changing plug-in is not used.

[0083] In addition to the above methods, a parallel detection method can also be used to determine whether a speed-changing plug-in is used during the game. For example, the staff sets the judgment standard in advance (that is, sets the number of abnormal results required to determine the use of the speed-changing plug-in), and executes the first detection mechanism, the second detection mechanism, and the third detection mechanism at the same time, and obtains the first detection result, the second detection result, and the third detection result, and counts the number of abnormal results, and compares the number with the judgment standard. If the number meets the judgment standard, it is determined that the speed-changing plug-in is used; if the number does not meet the judgment standard, it is determined that the speed-changing plug-in is not used.

[0084] In this solution, if it is detected that a user is using a speed-changing plug-in during game operation, the user can be warned through the game interface, prompting the user not to use the speed-changing plug-in, and forced to exit the game, turn off the speed-changing plug-in and log in again. At the same time, the speed-changing plug-in detected this time and the program location of the speed-changing plug-in and other related information are recorded and filed, so that the staff can check the operating mechanism of the speed-changing plug-in and formulate a more accurate anti-speed-changing plug-in solution.

[0085] In an embodiment of the present application, if an anti-cheating trigger event is detected, a startup instruction is generated to start the anti-speed-changing cheating system; a first detection mechanism is used to perform a Hook detection on the API of the operating system to obtain a first detection result; a second detection mechanism is used to perform a time anomaly detection on the game system to obtain a second detection result; a third detection mechanism is used to detect the execution time of the game task to obtain a third detection result; and according to one or more of the first detection result, the second detection result, and the third detection result, it is determined whether a speed-changing cheating is used during the game operation. Through the above method of identifying game speed-changing cheating, the anti-speed-changing cheating system can be started when the user runs the game, and multiple mechanisms can be used to detect parameters related to interfaces and time in the game system, accurately combat speed-changing cheating, maintain the fairness of the game, and provide users with a more harmonious gaming environment.

[0086] Embodiment 2

[0087] Figure 2It is a flow chart of the method for identifying game speed-changing plug-ins provided in the second embodiment of the present application. This solution makes a better improvement on the above embodiment, and the specific improvement is: after starting the anti-speed-changing plug-in system, the method also includes: determining the sensitivity level of the anti-speed-changing plug-in system according to the game detection requirements; determining the discrimination mechanism of the anti-speed-changing plug-in system according to the sensitivity level of the anti-speed-changing plug-in system; correspondingly, determining whether the speed-changing plug-in is used during the game operation according to one or more of the first detection result, the second detection result and the third detection result, including: determining whether the speed-changing plug-in is used during the game operation according to one or more of the first detection result, the second detection result and the third detection result, and the discrimination mechanism.

[0088] like Figure 2 As shown, specifically including the following:

[0089] S201, if an anti-cheating trigger event is detected, generating a start instruction to start the anti-speed-change cheating system;

[0090] S202, determining a sensitivity level of the anti-speed-changing cheating system according to the game detection requirements;

[0091] The sensitivity level of the anti-speed cheat system can be the rigor of identifying speed cheats. When the sensitivity level is low, the confirmation standard for speed cheats can be appropriately relaxed, while when the sensitivity level is high, the confirmation scope of speed cheats will be increased. For example, when the sensitivity level is low, only when the program of the speed cheat is detected in the program of the game system and there is an abnormality in the time of the game system can it be determined that the user has used the speed cheat; if the sensitivity level is high, the program of the speed cheat is detected in the program of the game system, or it is identified that there is an abnormality in the time of the game system, and either of the above two conditions is met, it can be determined that the user has used the speed cheat.

[0092] The sensitivity level of the anti-speed-changing plug-in system can be determined by the staff through the background control or adjustment of the sensitivity level of the corresponding anti-speed-changing plug-in system. When the sensitivity level is high, there will be recognition errors, and the user who normally runs the game will be judged as a user using plug-ins and forced to quit, affecting the user's gaming experience; when the sensitivity level is low, it is impossible to detect the more hidden speed-changing plug-ins. Therefore, the setting of the sensitivity level requires the staff to simulate the anti-speed-changing plug-in for the game system with the speed-changing plug-in, so as to obtain the sensitivity level that can accurately identify the game speed-changing plug-in but does not hinder other normal users.

[0093] S203, determining a discrimination mechanism of the anti-speed-shift cheating system according to the sensitivity level of the anti-speed-shift cheating system;

[0094] The discrimination mechanism of the anti-speed-changing plug-in system may be a criterion for determining whether a speed-changing plug-in is used during the running of the game, and different discrimination mechanisms may be formulated according to the sensitivity level of the anti-speed-changing plug-in. For example, the discrimination mechanism may be that when the sensitivity level is low, it is necessary to comprehensively determine whether a speed-changing plug-in is used based on the first detection result, the second detection result, and the third detection result; when the sensitivity level is high, it is only necessary to comprehensively determine whether a speed-changing plug-in is used based on the first detection result and the second detection result; when the sensitivity level is extremely high, it may be determined whether a speed-changing plug-in is used based on any one of the first detection result, the second detection result, and the third detection result.

[0095] The method for determining the identification mechanism of the anti-speed-shift cheating system may be that the staff inputs the identification mechanisms corresponding to each sensitivity level into the anti-speed-shift cheating system in advance, and the anti-speed-shift cheating system stores the related identification mechanisms. When the sensitivity level sent by the staff in the background is received, the identification mechanism of the associated anti-speed-shift cheating system is obtained according to the specific content of the sensitivity level.

[0096] S204, using the first detection mechanism to perform a Hook detection on the API of the operating system to obtain a first detection result; using the second detection mechanism to perform a time anomaly detection on the game system to obtain a second detection result; using the third detection mechanism to detect the execution time of the game task to obtain a third detection result;

[0097] S205. Determine whether a speed-changing plug-in is used during the game operation according to one or more of the first detection result, the second detection result, and the third detection result, and the discrimination mechanism.

[0098] Correspondingly, the method for determining whether a speed-changing plug-in is used during the game process can be that the anti-speed-changing plug-in system obtains the first detection result, the second detection result, and the third detection result. The discrimination mechanism is identified. When the discrimination mechanism needs to comprehensively determine whether a speed-changing plug-in is used based on the first detection result, the second detection result, and the third detection result, the first detection result is that a program for hooking a speed-changing plug-in is detected in the API program, and the second result is that there is an abnormality in the game system time, and the third result is that there is an abnormality in the execution time of the game task, it can be determined that a speed-changing plug-in is used during the game operation; when the discrimination mechanism is to comprehensively determine whether a speed-changing plug-in is used based on only the first detection result and the second detection result, the first detection result is that a program for hooking a speed-changing plug-in is detected in the API program. If a program that hooks a speed-changing plug-in is detected and the second result is that there is an abnormality in the game system time, it can be determined that a speed-changing plug-in is used during the game operation; when the discrimination mechanism is to determine whether a speed-changing plug-in is used based on any one of the first detection result, the second detection result and the third detection result, the first detection result is that a program that hooks a speed-changing plug-in is detected in the API program, or the second result is that there is an abnormality in the game system time, or the third result is that there is an abnormality in the execution time of the game task. If any one of the detection results meets the conditions, it can be determined that a speed-changing plug-in is used during the game operation.

[0099] The advantage of this arrangement is that the sensitivity level of the anti-speed-changing plug-in system and the corresponding discrimination mechanism can be determined according to the game detection requirements, which is conducive to accurately identifying the speed-changing plug-ins in the game system, avoiding the impact of identification errors on users who run the game normally, and the failure to detect hidden speed-changing plug-ins.

[0100] Embodiment 3

[0101] Figure 3 This is a flow chart of the method for identifying game speed change plug-ins provided in the third embodiment of the present application. This solution makes a better improvement on the above embodiment, and the specific improvement is: before performing a Hook detection on the API of the operating system and obtaining the first detection result, the method includes: detecting the integrity of the game program to identify whether there is a change in the program content of the game program; if so, it is determined that the game program has been abnormally modified and the game program is exited.

[0102] like Figure 3 As shown, specifically including the following:

[0103] S301, if an anti-cheating trigger event is detected, generating a start instruction to start the anti-speed-change cheating system;

[0104] S302, detecting the integrity of the game program to identify whether there is any change in the program content of the game program;

[0105] Integrity testing can be used to detect whether the game program has problems such as inserting other programs, modifying the original program, etc., which change the program content and function.

[0106] A method for identifying whether there are any changes in the program content of a game program is that the anti-speed-changing cheat system requests the game system to perform a program integrity check. After the game system responds, the game program is extracted, the content of the function called in the program is checked, and compared with the original called function. If the function currently called in the game program is consistent with the content of the original function, and the number of called functions is consistent with the original number of functions, then there is no change in the program content of the game program; if the function currently called in the game program is inconsistent with the content of the original function, or the total number of called functions is inconsistent with the total number of original functions, then there is a change in the program content of the game program.

[0107] S303, if yes, determine that the game program has been abnormally modified, and exit the game program;

[0108] The method of determining whether the game program has been abnormally modified is that, under normal circumstances, the user cannot modify the content of the game program when running the game normally, but when the user uses a speed-changing plug-in, the speed-changing plug-in needs to change the time obtained by the game system, so the game program content needs to be modified or added. Therefore, when it is detected that the game program has a program content change, it can be determined that the game program has been abnormally modified. At this time, the user may have used a speed-changing plug-in, and it is necessary to forcibly exit the user's game program, and prompt the user to close the speed-changing plug-in and log in to the game again to ensure the fairness of the game.

[0109] S304, using the first detection mechanism to perform a Hook detection on the API of the operating system to obtain a first detection result; using the second detection mechanism to perform a time anomaly detection on the game system to obtain a second detection result; using the third detection mechanism to detect the execution time of the game task to obtain a third detection result;

[0110] S305: Determine whether a speed-changing plug-in is used during game execution based on one or more of the first detection result, the second detection result, and the third detection result.

[0111] The advantage of setting up this scheme is that the integrity of the game program can be tested in advance, and whether the user has used a speed-changing plug-in can be determined by whether the game program content has been modified. This is conducive to standardizing the detection process of speed-changing plug-ins, identifying and prohibiting the use of speed-changing plug-ins, and maintaining the fairness of the game.

[0112] Embodiment 4

[0113] Figure 4This is a flow chart of the method for identifying game speed change plug-ins provided in the fourth embodiment of the present application. This solution makes a better improvement on the above embodiment, and the specific improvement is: detecting the integrity of the game program and identifying whether the game program has any program content changes, including: identifying whether there is a digital signature in the game program, and if there is no digital signature, determining that the game program has a program content change; or, calculating the MD5 value in the game program, comparing the MD5 value with the pre-saved initial MD5 value, and if the MD5 value is inconsistent with the initial MD5 value, determining that the game program has a program content change.

[0114] like Figure 4 As shown, specifically including the following:

[0115] S401, if an anti-cheating trigger event is detected, a start instruction is generated to start the anti-speed-change cheating system;

[0116] S402, identifying whether there is a digital signature in the game program, and if there is no digital signature, determining that there is a program content change in the game program;

[0117] or,

[0118] Calculate the MD5 value in the game program, compare the MD5 value with the pre-saved initial MD5 value, and if the MD5 value is inconsistent with the initial MD5 value, determine that there is a program content change in the game program;

[0119] A digital signature can be a string of numbers that can only be generated by the sender of the information and cannot be forged by others. This string of numbers is also a valid proof of the authenticity of the information sent by the sender.

[0120] The method of determining whether the game program has changed is that when the staff completes the game program, they can use a hash function to generate a summary from the game program, and then encrypt the summary with a private key. The encrypted summary will be used as the digital signature of the game program. Due to the integrity of the digital signature. After the game program content is modified, the original digital signature will no longer exist. Therefore, the anti-speed-changing cheating system can determine whether the game program content has changed by identifying whether there is a game signature in the game program. If no digital signature is detected, it is determined that the game program has changed.

[0121] MD5 value is a widely used cryptographic hash function that can generate a 128-bit (16-byte) hash value to ensure that information transmission is complete and consistent. Using the MD5 algorithm, you can generate a unique "digital fingerprint" for any file (regardless of its size, format, or quantity). With this "digital fingerprint", you can check whether the MD5 value before and after the file has changed to know whether the source file has been modified. For example, when downloading software, in addition to providing the software download address, the software download page will also provide a long string of characters. This string of characters is actually the MD5 value of the software. After downloading the software, use special software (such as Windows MD5 check, etc.) to perform an MD5 check on the downloaded file to ensure that the file we obtain is the same file as the file provided by the site.

[0122] Correspondingly, a method for determining whether a game program has a program content change is that after the staff has written the game program, the MD5 value algorithm can be used to calculate an input string of any length to obtain an output of a fixed length, and the game program is used as plain text to generate an initial MD5 value. Only when the plain text is the same can the same initial MD5 value be obtained, and this algorithm is irreversible. Even if the encrypted initial MD5 value is obtained, it is impossible to calculate the plain text through the decryption algorithm. Therefore, the anti-speed-changing plug-in system can calculate the MD5 value of the current game program again, and compare the current MD5 value with the initial MD5 value. If the MD5 value is inconsistent with the initial MD5 value, it is determined that the game program has a program content change.

[0123] S403, if it is determined that there is a change in the game program content, exit the game program;

[0124] S404, using the first detection mechanism to perform a Hook detection on the API of the operating system to obtain a first detection result; using the second detection mechanism to perform a time anomaly detection on the game system to obtain a second detection result; using the third detection mechanism to detect the execution time of the game task to obtain a third detection result;

[0125] S405. Determine whether a speed-changing plug-in is used during game execution based on one or more of the first detection result, the second detection result, and the third detection result.

[0126] The advantage of this setting is that the integrity of the game program can be verified by identifying the digital signature and whether the MD5 value has changed, which simplifies the process of game program content identification, effectively improves the efficiency of game program integrity detection, and is conducive to quickly and accurately determining whether the user has used a speed-changing plug-in.

[0127] Embodiment 5

[0128] Figure 5 This is a flow chart of the method for identifying game speed change plug-ins provided in Example 5 of the present application. This solution makes a better improvement on the above-mentioned embodiment, and the specific improvement is: adopting a first detection mechanism to perform Hook detection on the API of the operating system to obtain a first detection result, including: creating a detection thread; identifying through the detection thread whether the memory value of the key API and the name and address of the interface have been modified; if modified, the first detection result is that there is a Hook in the API of the operating system; if not modified, the first detection result is that there is no Hook in the API of the operating system.

[0129] like Figure 5 As shown, specifically including the following:

[0130] S501, if an anti-cheating trigger event is detected, generating a start instruction to start the anti-speed-change cheating system;

[0131] S502, creating a detection thread;

[0132] A thread is the smallest unit that an operating system can schedule operations on. It is contained in a process and is the actual operating unit in the process. A thread refers to a single sequential control flow in a process. A process can have multiple threads running concurrently, and each thread executes different tasks in parallel. A detection thread is a thread used to execute the variable speed plug-in detection task.

[0133] The detection thread can be created by using the game as the main thread to perform operations such as recording game progress and rendering game screens during the game running process to ensure the game experience of each player, so that users can run the game smoothly. While the main thread is running the game, a sub-thread can be created to execute the first detection mechanism to identify the speed-changing plug-in in the game, maintain the game order, and ensure the fairness of the game.

[0134] S503, identifying through the detection thread whether the memory value of the key API and the name and address of the interface have been modified; if modified, executing S504; if not modified, executing S505;

[0135] Key APIs can be time-related APIs in the game system, such as APIs for obtaining clock frequency, time setting APIs, etc. The game system determines the time in the game system through APIs, and speed-changing plug-ins change the time value fed back to the game system by APIs by modifying the API interface or memory value, thereby achieving speed change. Therefore, the time-related APIs in the game system can be tested as key APIs. Memory values ​​can be modified by forcibly modifying the execution process in reverse engineering, directly modifying the value in the memory, and thus changing the time of the game system. The name and address of the API interface can be the interface and address of the API to obtain time. The speed-changing plug-in can hijack the name and address of the API interface, change the location where the API obtains time, and then cause the API to obtain the wrong time and feed it back to the game system.

[0136] A method for identifying whether a key API has been modified is to pre-acquire the correct initial memory value and interface name and address of the key API when the game is running normally, identify the key API in the current game program through the anti-speed-changing plug-in system, and extract the current memory value of the key API and the name and address of the current interface, and compare the currently acquired memory value and interface name and address with the initial memory value and interface name and address. If the currently acquired memory value and interface name and address are consistent with the initial memory value and interface name and address, the key API has not been modified; if any of the currently acquired memory value and interface name and address are inconsistent with the initial memory value and interface name and address, the key API has been modified.

[0137] S504: The first detection result is that a Hook exists in the API of the operating system;

[0138] After the anti-speed-changing plug-in detects that the key API has been modified, the existence of a Hook in the API of the operating system can be taken as the first detection result.

[0139] S505: The first detection result is that there is no Hook in the API of the operating system;

[0140] After the anti-speed-changing plug-in detects that the key API has not been modified, the absence of the Hook in the API of the operating system can be taken as the first detection result.

[0141] It is understandable that in this embodiment, when the first detection mechanism, the second detection mechanism and the third detection mechanism are used to detect the game system, the first detection mechanism is described separately for the convenience of explanation. However, the three detection mechanisms are actually performed in parallel without any order.

[0142] S506, using a second detection mechanism to perform time anomaly detection on the game system to obtain a second detection result;

[0143] S507, using a third detection mechanism to detect the execution time of the game task to obtain a third detection result;

[0144] S508. Determine whether a speed-changing plug-in is used during game execution based on one or more of the first detection result, the second detection result, and the third detection result.

[0145] The advantage of setting up this scheme is that the first detection mechanism can be executed on the game program by identifying the memory value of the key API and the name and address of the interface, which standardizes the process of the first detection mechanism, is conducive to the rapid and accurate detection of speed-changing plug-ins in the game program, maintains the fairness of the game to a certain extent, and provides users with a harmonious gaming environment.

[0146] Embodiment 6

[0147] Figure 6 This is a flow chart of the method for identifying game speed change plug-ins provided in Example 6 of the present application. This solution makes a better improvement on the above-mentioned embodiment, and the specific improvement is: adopting a second detection mechanism to perform time anomaly detection on the game system to obtain a second detection result, which specifically includes: synchronously collecting the game system time and the CPU time according to a preset period; comparing the synchronously collected game system time with the CPU time; if the game system time is inconsistent with the CPU time, the second detection result is that there is an anomaly in the game system time; if the game system time is consistent with the CPU time, the second detection result is that there is no anomaly in the game system time.

[0148] like Figure 6 As shown, specifically including the following:

[0149] S601, if an anti-cheating trigger event is detected, generating a start instruction to start the anti-speed-change cheating system;

[0150] S602: Using a first detection mechanism, perform a Hook detection on an API of the operating system to obtain a first detection result;

[0151] S603, synchronously collect the game system time and CPU time according to a preset period;

[0152] The preset period can be a pre-set time interval for collecting game system time and CPU time. Since there is a high probability that there will be errors in the game system time and CPU time collected once, the game system time and CPU time can be collected multiple times and the data group can be used as the analysis unit to increase the accuracy of the detection results. The preset period can be the collection interval between adjacent data when collecting each group of data.

[0153] The method for synchronously collecting the game system time and the CPU time can be that the anti-speed-changing cheating system generates a game system time acquisition request and a CPU time acquisition request respectively, and sends them to the game system and the CPU at the same time. After the game system and the CPU respond, they respectively feed back the current time value to the anti-speed-changing cheating system.

[0154] S604, compare the synchronously collected game system time with the CPU time; if the game system time is inconsistent with the CPU time, execute S605; if the game system time is consistent with the CPU time, execute S606;

[0155] The method of comparing the synchronously collected game system time with the CPU time can be that the anti-speed-changing plug-in system sends a time acquisition request at the same time, and then compares the received game system time with the feedback of the CPU time. Since the CPU time is accurate, by comparing the consistency of the game system time and the CPU time, it can be identified whether the game system time has been changed by the speed-changing plug-in. If the game system time is inconsistent with the CPU time, there is an abnormality in the game system time, and there may be a speed-changing plug-in in the current game system; if the game system time is consistent with the CPU time, there is no abnormality in the game system time.

[0156] S605: The second detection result is that the game system time is abnormal;

[0157] After the anti-speed-changing plug-in detects that the game system time is inconsistent with the CPU time, the abnormality of the game system time can be used as the second detection result.

[0158] S606: The second detection result is that there is no abnormality in the game system time;

[0159] After the anti-speed-changing plug-in detects that the game system time is consistent with the CPU time, the presence of abnormality in the game system time can be taken as the second detection result.

[0160] It is understandable that in this embodiment, when the first detection mechanism, the second detection mechanism and the third detection mechanism are used to detect the game system, the second detection mechanism is described separately for the convenience of explanation. However, the three detection mechanisms are actually performed in parallel without any order.

[0161] S607, using a third detection mechanism to detect the execution time of the game task and obtain a third detection result;

[0162] S608. Determine whether a speed-changing plug-in is used during game operation based on one or more of the first detection result, the second detection result, and the third detection result.

[0163] The advantage of this setting is that the second detection mechanism can be executed on the game program by identifying whether the game system time is consistent with the CPU time, which standardizes the process of the second detection mechanism, is conducive to the rapid and accurate detection of speed-changing plug-ins in the game program, maintains the fairness of the game to a certain extent, and provides users with a harmonious gaming environment.

[0164] Embodiment 7

[0165] Figure 7 It is a flow chart of the method for identifying game speed change plug-ins provided in the seventh embodiment of the present application. This scheme makes a better improvement on the above embodiment, and the specific improvement is: adopting a third detection mechanism to detect the execution time of the game task and obtain a third detection result, including: when detecting that the user executes the game task, reporting the task start node and the task end node to the server; obtaining the start time of the task start node and the end time of the task end node received by the server; calculating the task execution time according to the start time and the end time; obtaining the difference between the task execution time and the preset standard task time; if the difference exceeds the preset difference range, the third detection result is that there is an abnormality in the task execution time; if the difference is within the preset difference range, the third detection result is that there is no abnormality in the task execution time.

[0166] like Figure 7 As shown, specifically including the following:

[0167] S701, if an anti-cheating trigger event is detected, generating a start instruction to start the anti-speed-change cheating system;

[0168] S702: Using a first detection mechanism, perform a Hook detection on an API of the operating system to obtain a first detection result;

[0169] S703, using a second detection mechanism to perform time anomaly detection on the game system to obtain a second detection result;

[0170] S704: When it is detected that the user is executing a game task, report the task start node and the task end node to the server;

[0171] The method of reporting the task start node and the task end node to the server can be that when the user performs a game task (for example, fighting a monster, completing item collection, etc.), the node where the user starts to execute the task (for example, starting to attack a monster, starting to put items into a backpack, or accepting the current task, etc.) is reported to the server, and when the user triggers the task end node (for example, defeating a monster, completing all item collection, or receiving a task reward, etc.), it is reported to the server again.

[0172] S705, obtaining the start time of the task start node and the end time of the task end node received by the server;

[0173] The method for obtaining the start time of the task start node and the end time of the task end node received by the server is that when the server receives the task start node reported by the game system, the server time at this time is recorded as the start time; when the server receives the task end node reported by the game system, the server time at this time is recorded as the end time.

[0174] S706, calculating the task execution duration according to the start time and the end time;

[0175] To calculate the task execution duration, the anti-speed-changing plug-in system may obtain the start time and end time of the same task from the server, and calculate the interpolation value between the start time and the end time as the task execution duration of the current task.

[0176] S707, obtaining the difference between the task execution time and the preset standard task time; if the difference exceeds the preset difference range, executing S708; if the difference is within the preset difference range, executing S709;

[0177] The standard task duration may be a pre-set estimated completion time for each task in the game and stored as the standard task duration for each game task.

[0178] The preset difference range may be due to different users' different game proficiency and operation fluency, so the time it takes for each user to complete the same task is also different, and there may be fluctuations above and below the standard task duration. This numerical floating range is the preset difference range.

[0179] The method for obtaining the difference between the task execution time and the pre-set standard task time can be to obtain the standard task time of each task from the game system, subtract the calculated current task execution time from the corresponding standard task execution time, and compare the difference with the preset difference range. When the difference exceeds the preset difference range, the user is likely to have used a speed-changing plug-in, which greatly speeds up or slows down the total time to execute the task; if the difference does not exceed the preset difference range, the total time for the user to execute the task is within the normal range, and the speed-changing plug-in is usually not used.

[0180] S708: The third detection result is that there is an abnormal task execution time;

[0181] After the anti-speed-change plug-in detects that the difference between the task execution time and the preset standard task time exceeds the preset difference range, the presence of an abnormal task execution time can be regarded as the third detection result.

[0182] S709: The third detection result is that there is no abnormality in the task execution time;

[0183] After the anti-speed-change plug-in detects that the difference between the task execution time and the preset standard task time is within the preset difference range, the task execution time can be regarded as normal as the third detection result.

[0184] It is understandable that in this embodiment, when the first detection mechanism, the second detection mechanism and the third detection mechanism are used to detect the game system, the third detection mechanism is described separately for the convenience of explanation. However, the three detection mechanisms are actually performed in parallel without any order.

[0185] S710. Determine whether a speed-changing plug-in is used during game execution based on one or more of the first detection result, the second detection result, and the third detection result.

[0186] The advantage of this setting is that the third detection mechanism can be executed on the game program through the difference between the task execution time and the pre-set standard task time, which standardizes the process of the third detection mechanism, is conducive to the rapid and accurate detection of speed-changing plug-ins in the game program, maintains the fairness of the game to a certain extent, and provides users with a harmonious gaming environment.

[0187] Embodiment 8

[0188] Figure 8 It is a structural diagram of the device for identifying game speed change plug-ins provided in Example 8 of the present application.

[0189] like Figure 8 As shown, specifically including the following:

[0190] The anti-speed-change external-cheat system starting module 801 is used to generate a starting instruction to start the anti-speed-change external-cheat system when an anti-cheat trigger event is detected;

[0191] The detection result acquisition module 802 is used to use the first detection mechanism to perform a Hook detection on the API of the operating system to obtain a first detection result; use the second detection mechanism to perform a time anomaly detection on the game system to obtain a second detection result; use the third detection mechanism to detect the execution time of the game task to obtain a third detection result;

[0192] The speed change plug-in determination module 803 is used to determine whether a speed change plug-in is used during the game operation according to one or more of the first detection result, the second detection result and the third detection result.

[0193] In the embodiment of the present application, the anti-speed-changing plug-in system startup module is used to generate a startup instruction to start the anti-speed-changing plug-in system when an anti-plug-in trigger event is detected; the detection result acquisition module is used to use a first detection mechanism to perform a Hook detection on the API of the operating system to obtain a first detection result; use a second detection mechanism to perform a time anomaly detection on the game system to obtain a second detection result; use a third detection mechanism to detect the execution time of the game task to obtain a third detection result; the speed-changing plug-in determination module is used to determine whether a speed-changing plug-in is used during the game operation according to one or more of the first detection result, the second detection result, and the third detection result. Through the above-mentioned device for identifying game speed-changing plug-ins, the anti-speed-changing plug-in system can be started when the user runs the game, and multiple mechanisms can be used to detect parameters related to interfaces and time in the game system, accurately combat speed-changing plug-ins, maintain the fairness of the game, and provide users with a more harmonious gaming environment.

[0194] The device for identifying the game speed change plug-in in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a palmtop computer, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and the non-mobile electronic device can be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0195] The device for identifying a game speed change plug-in in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0196] The device for identifying game speed change plug-ins provided in the embodiments of the present application can implement the various processes implemented in the above-mentioned method embodiments. To avoid repetition, they will not be described here.

[0197] Embodiment 9

[0198] like Fig. 9 As shown, an embodiment of the present application also provides an electronic device 900, including a processor 901, a memory 902, and a program or instruction stored in the memory 902 and executable on the processor 901. When the program or instruction is executed by the processor 901, each process of the above-mentioned device embodiment for identifying game speed change plug-ins is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0199] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0200] Embodiment 10

[0201] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned device embodiment for identifying game speed change plug-ins are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0202] The processor is a processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0203] Embodiment 11

[0204] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned device embodiment for identifying game speed change plug-ins, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0205] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0206] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0207] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0208] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0209] The above are only preferred embodiments of the present application and the technical principles used. The present application is not limited to the specific embodiments described herein, and various obvious changes, readjustments and substitutions that can be made by those skilled in the art will not deviate from the scope of protection of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the claims.

Claims

1. A method for identifying a game speed-changing plug-in, characterized in that: The method comprises: If an anti-cheating trigger event is detected, a start command is generated to start the anti-speed-change cheating system; The first detection mechanism is used to perform a Hook detection on the API of the operating system to obtain a first detection result; the second detection mechanism is used to perform a time anomaly detection on the game system to obtain a second detection result; the third detection mechanism is used to detect the execution time of the game task to obtain a third detection result; Determine whether a speed-changing plug-in is used during game operation according to one or more of the first detection result, the second detection result, and the third detection result; Wherein, the second detection mechanism is: Synchronously collect game system time and CPU time according to the preset cycle; Compare the synchronously collected game system time with the CPU time; If the game system time is inconsistent with the CPU time, the second detection result is that the game system time is abnormal; If the game system time is consistent with the CPU time, the second detection result is that there is no abnormality in the game system time.

2. The method for identifying game speed-changing cheats according to claim 1, characterized in that: After the anti-speed-change plug-in system is activated, the method further includes: Determine the sensitivity level of the anti-speed-changing cheat system based on the game detection requirements; According to the sensitivity level of the anti-speed-shift cheating system, the identification mechanism of the anti-speed-shift cheating system is determined; Accordingly, determining whether a speed-changing plug-in is used during game operation according to one or more of the first detection result, the second detection result, and the third detection result includes: According to one or more of the first detection result, the second detection result and the third detection result, and the discrimination mechanism, it is determined whether a speed-changing plug-in is used during the running of the game.

3. The method for identifying game speed-changing cheats according to claim 1, characterized in that: Before performing a Hook detection on an API of the operating system to obtain a first detection result, the method includes: Checking the integrity of the game program to identify whether there are any changes in the program content of the game program; If so, it is determined that the game program has been abnormally modified and the game program is exited.

4. The method for identifying game speed-changing cheats according to claim 3, characterized in that: Check the integrity of the game program to identify whether the game program has any program content changes, including: Identify whether there is a digital signature in the game program, and if there is no digital signature, determine that there is a program content change in the game program; or, The MD5 value in the game program is calculated, and the MD5 value is compared with the pre-saved initial MD5 value. If the MD5 value is inconsistent with the initial MD5 value, it is determined that there is a program content change in the game program.

5. The method for identifying game speed-changing cheats according to claim 1, characterized in that: The first detection mechanism is used to perform Hook detection on the API of the operating system to obtain a first detection result, including: Create a detection thread; Identify through the detection thread whether the memory value of the key API and the name and address of the interface are modified; If it is modified, the first detection result is that there is a Hook in the operating system API; If it has not been modified, the first detection result is that the Hook does not exist in the API of the operating system.

6. The method for identifying game speed-changing cheats according to claim 1, characterized in that: The third detection mechanism is used to detect the execution time of the game task, and the third detection result is obtained, including: When detecting that a user is performing a game task, report the task start node and task end node to the server; Obtaining the start time of the task start node and the end time of the task end node received by the server; Calculate the task execution time according to the start time and the end time; Get the difference between the task execution time and the preset standard task time; If the difference exceeds the preset difference range, the third detection result is that there is an abnormal task execution time; If the difference is within the preset difference range, the third detection result is that there is no abnormality in the task execution time.

7. A device for identifying game speed-changing plug-ins, characterized in that: The device comprises: The anti-speed-change external-cheat system startup module is used to generate a startup instruction to start the anti-speed-change external-cheat system when an anti-cheat trigger event is detected; The detection result acquisition module is used to use the first detection mechanism to perform Hook detection on the API of the operating system to obtain a first detection result; use the second detection mechanism to perform time anomaly detection on the game system to obtain a second detection result; use the third detection mechanism to detect the execution time of the game task to obtain a third detection result; A speed change plug-in determination module, used to determine whether a speed change plug-in is used during game operation according to one or more of the first detection result, the second detection result and the third detection result; Wherein, the second detection mechanism is: Synchronously collect game system time and CPU time according to the preset cycle; Compare the synchronously collected game system time with the CPU time; If the game system time is inconsistent with the CPU time, the second detection result is that the game system time is abnormal; If the game system time is consistent with the CPU time, the second detection result is that there is no abnormality in the game system time.

8. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor. When the program or instruction is executed by the processor, the steps of the method for identifying a game speed change plug-in as described in any one of claims 1-6 are implemented.

9. A readable storage medium, characterized in that: The readable storage medium stores programs or instructions, and when the programs or instructions are executed by the processor, the steps of the method for identifying game speed change plug-ins as described in any one of claims 1-6 are implemented.

Images