Detection method, device and equipment for plug-in injection, medium and product

Abstract

The invention discloses a plug-in injection detection method, device and equipment, a medium and a product. The method comprises the following steps: acquiring an executable file list loaded to a game process by a linker, and determining a file detection result; reading environment variable information in the executable file, and determining a variable detection result; comparing the shared library path information obtained from the environment variable of the game process with the shared library path information obtained from the mapping file, and determining a shared library detection result; according to an executable file list loaded to the game process by the linker, scanning a memory matched with the game process, and determining a memory detection result; and determining a plug-in injection detection result according to the detection result. According to the technical scheme, the problem of low game plug-in identification accuracy is solved, the plug-in injection detection accuracy is improved through multi-level plug-in injection detection of the executable file, the environment variable, the shared library, the hidden memory and the like, and the reliability and fairness of the game environment are guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a method, device, electronic equipment, storage medium and program product for detecting plug-in injection. Background Art

[0002] Cheats injection is a form of attack in video games that modifies the game program or injects additional code to gain gaming advantages, such as changing the rules of the game, increasing or modifying character attributes, adding resources and items, etc.

[0003] Injecting a shared library by setting environment variables in the system environment of the user terminal so that the game process will prioritize loading the shared library when loading is a common behavior of tampering with the game process. This plug-in injection behavior destroys the fairness and competitiveness of the game. Therefore, a plug-in detection method for injecting game plug-ins by setting environment variables is needed to promptly identify plug-in anomalies during the injection process. Summary of the invention

[0004] The present invention provides a method, device, electronic device, storage medium and program product for detecting plug-in injection, so as to solve the problem of low game plug-in recognition accuracy when game plug-ins are injected by setting environment variables. By detecting plug-in injection at multiple levels such as executable files, environment variables, shared libraries and hidden memory, the detection accuracy of plug-in injection is improved, and the reliability and fairness of the game environment are guaranteed.

[0005] According to one aspect of the present invention, a method for detecting plug-in injection is provided, the method comprising:

[0006] If it is detected that the game application of the user terminal is started, then according to the link library address matched by the user terminal, a list of executable files loaded into the game process by the linker is obtained to determine the file detection result;

[0007] Read the environment variable information in the executable file loaded into the game process by the linker to determine the variable detection result;

[0008] Obtaining the environment variables of the game process, comparing the shared library path information obtained from the environment variables of the game process and the shared library path information obtained from the mapping file, and determining the shared library detection result;

[0009] According to the list of executable files loaded into the game process by the linker, the memory matching the game process is scanned to determine the memory detection result;

[0010] The plug-in injection detection result is determined according to the file detection result, the variable detection result, the shared library detection result and the memory detection result.

[0011] According to another aspect of the present invention, a detection device for plug-in injection is provided, the device comprising:

[0012] A file detection result determination module, for, if it is detected that the game application of the user terminal is started, obtaining a list of executable files loaded into the game process by the linker according to the link library address matched by the user terminal, and determining the file detection result;

[0013] A variable detection result determination module is used to read the environment variable information in the executable file loaded into the game process by the linker to determine the variable detection result;

[0014] A shared library detection result determination module is used to obtain the environment variables of the game process, compare the shared library path information obtained from the environment variables of the game process and the shared library path information obtained from the mapping file, and determine the shared library detection result;

[0015] A memory detection result determination module is used to scan the memory matching the game process according to the executable file list loaded into the game process by the linker to determine the memory detection result;

[0016] The injection detection result determination module is used to determine the plug-in injection detection result according to the file detection result, the variable detection result, the shared library detection result and the memory detection result.

[0017] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0018] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for detecting plug-in injection described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for detecting plug-in injection described in any embodiment of the present invention when executed.

[0020] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the method for detecting plug-in injection according to any embodiment of the present invention is implemented.

[0021] The technical solution of the embodiment of the present invention is as follows: if it is detected that the game application of the user terminal is started, then according to the link library address matched by the user terminal, the executable file list loaded by the linker into the game process is obtained to determine the file detection result; the environment variable information in the executable file loaded by the linker into the game process is read to determine the variable detection result; the environment variable of the game process is obtained, and the shared library path information obtained from the environment variable of the game process and the shared library path information obtained from the mapping file are compared to determine the shared library detection result; according to the executable file list loaded by the linker into the game process, the memory matched by the game process is scanned to determine the memory detection result; according to the file detection result, the variable detection result, the shared library detection result and the memory detection result, the plug-in injection detection result is determined. This technical solution solves the problem of low game plug-in recognition accuracy when injecting game plug-ins by setting environment variables. Through plug-in injection detection at multiple levels such as executable files, environment variables, shared libraries and hidden memory, the plug-in injection detection accuracy is improved to ensure the reliability and fairness of the game environment.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 This is a flow chart of a method for detecting plug-in injection provided according to the first embodiment of the present invention;

[0025] Figure 2 This is a flow chart of a method for detecting plug-in injection provided according to Embodiment 2 of the present invention;

[0026] Figure 3 is a schematic diagram of the structure of a detection device for plug-in injection provided according to Embodiment 3 of the present invention;

[0027] Figure 4 It is a structural schematic diagram of an electronic device that implements the method for detecting plug-in injection according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. The acquisition, storage, use, processing, etc. of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0030] Embodiment 1

[0031] Figure 1 The present invention provides a flowchart of a method for detecting plug-in injection in the first embodiment of the present invention. This embodiment can be applied to the plug-in injection behavior detection scenario during the running of the game process. The method can be executed by a plug-in injection detection device, which can be implemented in the form of hardware and / or software, and the device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0032] S110: If it is detected that the game application of the user terminal is started, a list of executable files loaded into the game process by a linker is obtained according to the link library address matched by the user terminal, and a file detection result is determined.

[0033] This solution can be executed by a user terminal, which can be a device such as a mobile phone, a tablet computer, and a laptop computer with a game application installed. When the user terminal starts, the executable file of the daemon process is executed, the system environment of the user terminal is initialized, and the daemon process is started. The daemon process can be used to start and manage application processes, such as the Zygote process of the Android system. The daemon process preloads the core libraries and resources of the user terminal operating system, and provides a software environment with preloaded content for the newly started game application process to increase the startup speed of the game application.

[0034] When the user terminal detects that the game application is started, the daemon process can create a new process as the game process. If the environment variable is set in the game process, such as LD_PRELOAD, the user terminal will first load the link library at the address specified by the environment variable. LD_PRELOAD injection is a method of injecting a shared library in the Linux environment by setting the environment variable LD_PRELOAD, so that the game process will prioritize loading the shared library when loading, thereby tampering with the game process.

[0035] It is understandable that different user terminals have different operating system versions, and different operating system versions have different link library addresses. The user terminal can load the executable file list in the link library by calling the linker according to the link library address matched by the user terminal to obtain the dynamic library file required by the game application. The user terminal can identify each executable file in the executable file list loaded by the linker into the game process according to the pre-acquired executable file whitelist to determine the file detection result.

[0036] The executable file may be an ELF (Executable and Linkable Format) file, which is an executable file and linkable library format, and a universal binary file format. In a Linux system, an ELF file is usually created by a linker, which combines multiple object files (.o) and library files (.so) into an executable file or linkable library. A user terminal can obtain the ELF file list of a game process through the / proc file system. In a Linux system, the information of each process can be found in / proc / <pid>Found in the directory, where <pid>Indicates the process. For the ELF file list, the user terminal can view / proc / <pid> / maps file, the maps file contains the memory map of the game process, including the information of the ELF file.

[0037] S120, reading the environment variable information in the executable file loaded into the game process by the linker, and determining the variable detection result.

[0038] After identifying the executable files in the executable file list loaded by the linker into the game process, if the executable files in the executable file list are all legal (the executable files belonging to the game application and the operating system), the user terminal can read the environment variables in each executable file and perform further plug-in injection detection to identify disguised plug-in injection behavior. Specifically, the user terminal can identify the environment variables of each executable file based on the pre-acquired environment variable whitelist, filter abnormal environment variables, and obtain variable detection results.

[0039] It should be noted that the environment variable whitelist pre-acquired by the user terminal can be actively issued, rather than statically stored locally. The dynamic issuance method can effectively reduce the possibility of plug-ins obtaining the environment variable whitelist in advance, thereby preventing plug-ins from bypassing operations.

[0040] S130, obtaining the environment variables of the game process, comparing the shared library path information obtained from the environment variables of the game process and the shared library path information obtained from the mapping file, and determining the shared library detection result.

[0041] After the game process is loaded, the user terminal can obtain the environment variables of the game process, and obtain the shared library path information according to the environment variables of the game process. According to the shared library path information obtained from the environment variables of the game process, the shared library path information in the mapping file is scanned to filter out the shared libraries that do not belong to the system and game applications, and obtain the shared library detection results.

[0042] Specifically, in Linux and Android systems, the user terminal can find the <pid>The LD_PRELOAD variable can be obtained from the / environ file, or the LD_PRELOAD variable can be obtained through the getenv function. The user terminal can compare the shared library path information obtained from the LD_PRELOAD variable with the shared library path information obtained from the / proc / [pid] / maps file, filter out shared libraries that do not belong to the system and game applications, and obtain shared library detection results.

[0043] S140. Scan the memory matching the game process according to the executable file list loaded into the game process by the linker to determine the memory detection result.

[0044] For plug-ins that are disguised and injected into executable files, it is possible to bypass the plug-in injection detection of S110-S130. The user terminal can scan the memory of the game process based on the executable file list loaded into the game process by the linker, filter out the hidden memory that is inconsistent with the executable file format in the executable file list, and obtain the memory detection result.

[0045] S150. Determine a plug-in injection detection result according to the file detection result, the variable detection result, the shared library detection result, and the memory detection result.

[0046] After obtaining the file detection results, variable detection results, shared library detection results and memory detection results, the user terminal can determine the plug-in injection detection results based on the file detection results, variable detection results, shared library detection results and memory detection results. The plug-in injection detection results may include information such as whether there is plug-in injection behavior, the number of plug-in injections and the detection method of plug-in injection.

[0047] If a game application has plug-in injection, the user terminal can exit the game application, or obtain the user account currently logged in to the game application and block the user account to ensure the security of the game.

[0048] The technical solution of the embodiment of the present invention is as follows: if it is detected that the game application of the user terminal is started, then according to the link library address matched by the user terminal, the executable file list loaded by the linker into the game process is obtained to determine the file detection result; the environment variable information in the executable file loaded by the linker into the game process is read to determine the variable detection result; the environment variable of the game process is obtained, and the shared library path information obtained from the environment variable of the game process and the shared library path information obtained from the mapping file are compared to determine the shared library detection result; according to the executable file list loaded by the linker into the game process, the memory matched by the game process is scanned to determine the memory detection result; according to the file detection result, the variable detection result, the shared library detection result and the memory detection result, the plug-in injection detection result is determined. This technical solution solves the problem of low game plug-in recognition accuracy when injecting game plug-ins by setting environment variables. Through plug-in injection detection at multiple levels such as executable files, environment variables, shared libraries and hidden memory, the plug-in injection detection accuracy is improved to ensure the reliability and fairness of the game environment.

[0049] Embodiment 2

[0050] Figure 2 This is a flow chart of a method for detecting plug-in injection provided in the second embodiment of the present invention. This embodiment refines the above embodiment. Figure 2 As shown, the method includes:

[0051] S210: If it is detected that the game application of the user terminal is started, a list of executable files loaded into the game process by the linker is obtained according to the link library address matched by the user terminal, and a file detection result is determined.

[0052] In this solution, obtaining the executable file list loaded into the game process by the linker according to the link library address matched by the user terminal and determining the file detection result include:

[0053] According to the link library address matched by the user terminal, a list of executable files loaded into the game process by the linker is obtained, and the list of executable files is compared with a pre-acquired white list of executable files;

[0054] If there is at least one executable file in the executable file list that is not in the executable file whitelist, it is determined that there is a risk of plug-in injection in the game process;

[0055] If all executable files in the executable file list are in the executable file whitelist, it is determined that there is no risk of plug-in injection in the game process.

[0056] It is easy to understand that functions such as __dl__ZL13g_ld_preloads and __dl__ZL6solist are part of the dynamic linker, which is used to process the link library specified by the LD_PRELOAD variable. In this solution, the user terminal can obtain the list of executable files loaded by the linker into the game process by actively calling the function address matched by the linker. By comparing the executable file list with the pre-acquired executable file whitelist, the user terminal can determine whether there is a risk of plug-in injection in the game process. Specifically, if all executable files in the executable file list are in the executable file whitelist, it is determined that there is no risk of plug-in injection in the game process. If there is at least one executable file in the executable file list that is not in the executable file whitelist, the executable file not in the executable file whitelist may be a plug-in file, so there is a risk of plug-in injection in the game process.

[0057] S220, reading the environment variable information in the executable file loaded into the game process by the linker, and determining the variable detection result.

[0058] In a feasible solution, the step of reading the environment variable information in the executable file loaded into the game process by the linker and determining the variable detection result includes:

[0059] Reading the environment variable information in the executable file loaded into the game process by the linker, and comparing the environment variable information with the pre-acquired environment variable whitelist;

[0060] If the environment variable information is consistent with the environment variable whitelist, it is determined that there is no risk of plug-in injection in the game process;

[0061] If the environment variable information is inconsistent with the environment variable whitelist, it is determined that there is a risk of plug-in injection in the game process.

[0062] The user terminal can read the environment variable information of each executable file in the executable file list in turn, and compare the environment variable information with the environment variable whitelist. Wherein, the environment variable whitelist may include information such as executable file identification, environment variables associated with the executable file. If the environment variable information of the executable file is consistent with the environment variables associated with the executable file in the environment variable whitelist, it is determined that there is no risk of plug-in injection in the game process. If the environment variable information of the executable file is inconsistent with the environment variables associated with the executable file in the environment variable whitelist, the environment variable information inconsistent with the environment variables associated with the executable file in the environment variable whitelist may be the environment variable information of the plug-in file, so it is determined that there is a risk of plug-in injection in the game process.

[0063] S230, obtaining the environment variables of the game process, comparing the shared library path information obtained from the environment variables of the game process and the shared library path information obtained from the mapping file, and determining the shared library detection result.

[0064] Optionally, comparing the shared library path information obtained from the environment variable of the game process and the shared library path information obtained from the mapping file to determine the shared library detection result includes:

[0065] If the shared library path information obtained from the environment variables of the game process is consistent with the shared library path information obtained from the mapping file, it is determined that there is no risk of plug-in injection in the game process;

[0066] If the shared library path information obtained from the environment variables of the game process is inconsistent with the shared library path information obtained from the mapping file, it is determined that the game process is at risk of plug-in injection.

[0067] It can be understood that if the shared library path information obtained from the environment variables of the game process is consistent with the shared library path information obtained from the mapping file, it means that the shared library called by the game process belongs to the shared library of the system and the game application, and the game process does not have the risk of plug-in injection. If the shared library path information obtained from the environment variables of the game process is inconsistent with the shared library path information obtained from the mapping file, it means that there are shared libraries that do not belong to the system and the game application in the shared libraries called by the game process, and the shared libraries that do not belong to the system and the game application may store plug-in programs, so the game process is at risk of plug-in injection.

[0068] S240: Scan the memory matching the game process according to the executable file list loaded into the game process by the linker to determine the memory detection result.

[0069] In a preferred solution, the step of scanning the memory matched by the game process according to the executable file list loaded into the game process by the linker to determine the memory detection result includes:

[0070] Extracting the file format of each executable file in the executable file list according to the executable file list loaded into the game process by the linker;

[0071] If the memory header format in the memory matched by the game process does not match the file format of the executable file in the executable file list, it is determined that the game process has a risk of plug-in injection;

[0072] If there is no memory header format in the memory matched by the game process that does not match the file format of the executable file in the executable file list, it is determined that there is no risk of plug-in injection in the game process.

[0073] Among them, the file format of the executable file may include information such as a file header, a program header table, a section, and a section header table. The file header contains a series of structured bytes, which are used to describe the basic information of the executable file, and define the type, architecture, version, entry point address, offset of the program header table and section header table of the executable file. The program header table may include multiple program headers, each of which describes the position and size of a segment in the executable file, as well as its position and size in the memory. The program header table may be used to instruct the operating system how to load and execute the program. The section header table may include multiple section headers, each of which describes the information of a section, such as the section name, type, attributes, and size. The section header table may be used by the linker in the linking process. The section is the basic unit of the executable file and may include the actual data and code of the program. For example, in an ELF file, the .text section contains the execution code of the program, and the .data section contains initialized global variables and local static variables.

[0074] The user terminal can extract the file format of each executable file in the executable file list in turn, and compare the file format of the executable file in the executable file list with the memory header format of the memory associated with the game process. If there is a memory header format in the memory matched by the game process that does not match the file format of the executable file in the executable file list, it means that the plug-in may be disguised and injected into the hidden memory, and the game process is at risk of plug-in injection. If there is no memory header format in the memory matched by the game process that does not match the file format of the executable file in the executable file list, the game process is not at risk of plug-in injection.

[0075] S250. If it is determined that the game process has a risk of plug-in injection based on at least one of the file detection result, the variable detection result, the shared library detection result, and the memory detection result, then it is determined that the game application has plug-in injection behavior.

[0076] In order to ensure the security and reliability of the game process, the user terminal can determine that the game application has plug-in injection behavior under the condition that at least one of the file detection results, variable detection results, shared library detection results and memory detection results determines that the game process has plug-in injection risks. The user terminal can exit the game application, or obtain the user account that the game application is logging in, and block the user account to ensure the security of the game.

[0077] The technical solution of the embodiment of the present invention is as follows: if it is detected that the game application of the user terminal is started, then according to the link library address matched by the user terminal, the executable file list loaded by the linker into the game process is obtained to determine the file detection result; the environment variable information in the executable file loaded by the linker into the game process is read to determine the variable detection result; the environment variable of the game process is obtained, and the shared library path information obtained from the environment variable of the game process and the shared library path information obtained from the mapping file are compared to determine the shared library detection result; according to the executable file list loaded by the linker into the game process, the memory matched by the game process is scanned to determine the memory detection result; according to the file detection result, the variable detection result, the shared library detection result and the memory detection result, the plug-in injection detection result is determined. This technical solution solves the problem of low game plug-in recognition accuracy when injecting game plug-ins by setting environment variables. Through plug-in injection detection at multiple levels such as executable files, environment variables, shared libraries and hidden memory, the plug-in injection detection accuracy is improved to ensure the reliability and fairness of the game environment.

[0078] Embodiment 3

[0079] Figure 3 This is a schematic diagram of the structure of a detection device for plug-in injection provided in the third embodiment of the present invention. Figure 3 As shown, the device comprises:

[0080] The file detection result determination module 310 is used to obtain the executable file list loaded into the game process by the linker according to the link library address matched by the user terminal, and determine the file detection result if it is detected that the game application of the user terminal is started;

[0081] The variable detection result determination module 320 is used to read the environment variable information in the executable file loaded into the game process by the linker and determine the variable detection result;

[0082] A shared library detection result determination module 330 is used to obtain the environment variables of the game process, compare the shared library path information obtained from the environment variables of the game process and the shared library path information obtained from the mapping file, and determine the shared library detection result;

[0083] A memory detection result determination module 340 is used to scan the memory matching the game process according to the executable file list loaded into the game process by the linker to determine the memory detection result;

[0084] The injection detection result determination module 350 is used to determine the plug-in injection detection result according to the file detection result, the variable detection result, the shared library detection result and the memory detection result.

[0085] In this solution, the file detection result determination module 310 is specifically used to:

[0086] According to the link library address matched by the user terminal, a list of executable files loaded into the game process by the linker is obtained, and the list of executable files is compared with a pre-acquired white list of executable files;

[0087] If there is at least one executable file in the executable file list that is not in the executable file whitelist, it is determined that there is a risk of plug-in injection in the game process;

[0088] If all executable files in the executable file list are in the executable file whitelist, it is determined that there is no risk of plug-in injection in the game process.

[0089] In a feasible solution, the variable detection result determination module 320 is specifically used to:

[0090] Reading the environment variable information in the executable file loaded into the game process by the linker, and comparing the environment variable information with the pre-acquired environment variable whitelist;

[0091] If the environment variable information is consistent with the environment variable whitelist, it is determined that there is no risk of plug-in injection in the game process;

[0092] If the environment variable information is inconsistent with the environment variable whitelist, it is determined that there is a risk of plug-in injection in the game process.

[0093] Optionally, the shared library detection result determination module 330 is specifically used to:

[0094] If the shared library path information obtained from the environment variables of the game process is consistent with the shared library path information obtained from the mapping file, it is determined that there is no risk of plug-in injection in the game process;

[0095] If the shared library path information obtained from the environment variables of the game process is inconsistent with the shared library path information obtained from the mapping file, it is determined that the game process is at risk of plug-in injection.

[0096] In this embodiment, the memory detection result determination module 340 is specifically used to:

[0097] Extracting the file format of each executable file in the executable file list according to the executable file list loaded into the game process by the linker;

[0098] If the memory header format in the memory matched by the game process does not match the file format of the executable file in the executable file list, it is determined that the game process has a risk of plug-in injection.

[0099] In a preferred solution, the injection detection result determination module 350 is specifically used to:

[0100] If it is determined that the game process has a risk of plug-in injection based on at least one of the file detection result, the variable detection result, the shared library detection result and the memory detection result, then it is determined that the game application has plug-in injection behavior.

[0101] The plug-in injection detection device provided in the embodiment of the present invention can execute the plug-in injection detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0102] Embodiment 4

[0103] Figure 4 A schematic diagram of an electronic device 410 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0104] like Figure 4 As shown, the electronic device 410 includes at least one processor 411, and a memory connected to the at least one processor 411 in communication, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or the computer program loaded from the storage unit 418 to the random access memory (RAM) 413. In the RAM 413, various programs and data required for the operation of the electronic device 410 can also be stored. The processor 411, the ROM 412, and the RAM 413 are connected to each other via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0105] Multiple components in the electronic device 410 are connected to the I / O interface 415, including: an input unit 416, such as a keyboard, a mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a disk, an optical disk, etc.; and a communication unit 419, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 419 allows the electronic device 410 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0106] Processor 411 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. Processor 411 executes the various methods and processes described above, such as a method for detecting plug-in injection.

[0107] In some embodiments, the method for detecting plug-in injection may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 418. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 410 via the ROM 412 and / or the communication unit 419. When the computer program is loaded into the RAM 413 and executed by the processor 411, one or more steps of the method for detecting plug-in injection described above may be performed. Alternatively, in other embodiments, the processor 411 may be configured to execute the method for detecting plug-in injection by any other appropriate means (e.g., by means of firmware).

[0108] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0109] The computer program for implementing the method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable plug-in injection detection device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0110] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0111] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0112] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0113] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0114] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0115] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.< / pid> < / pid> < / pid> < / pid>

Claims

1. A method for detecting plug-in injection, characterized in that: The method comprises: If it is detected that the game application of the user terminal is started, then according to the link library address matched by the user terminal, a list of executable files loaded into the game process by the linker is obtained to determine the file detection result; Read the environment variable information in the executable file loaded into the game process by the linker to determine the variable detection result; Obtaining the environment variables of the game process, comparing the shared library path information obtained from the environment variables of the game process and the shared library path information obtained from the mapping file, and determining the shared library detection result; According to the list of executable files loaded into the game process by the linker, the memory matching the game process is scanned to determine the memory detection result; The plug-in injection detection result is determined according to the file detection result, the variable detection result, the shared library detection result and the memory detection result.

2. The method according to claim 1, characterized in that The step of obtaining a list of executable files loaded into the game process by a linker according to the link library address matched by the user terminal and determining a file detection result includes: According to the link library address matched by the user terminal, a list of executable files loaded into the game process by the linker is obtained, and the list of executable files is compared with a pre-acquired white list of executable files; If there is at least one executable file in the executable file list that is not in the executable file whitelist, it is determined that there is a risk of plug-in injection in the game process; If all executable files in the executable file list are in the executable file whitelist, it is determined that there is no risk of plug-in injection in the game process.

3. The method according to claim 1, characterized in that The step of reading the environment variable information in the executable file loaded into the game process by the linker and determining the variable detection result includes: Reading the environment variable information in the executable file loaded into the game process by the linker, and comparing the environment variable information with the pre-acquired environment variable whitelist; If the environment variable information is consistent with the environment variable whitelist, it is determined that there is no risk of plug-in injection in the game process; If the environment variable information is inconsistent with the environment variable whitelist, it is determined that there is a risk of plug-in injection in the game process.

4. The method according to claim 1, characterized in that: The comparing the shared library path information obtained from the environment variable of the game process and the shared library path information obtained from the mapping file to determine the shared library detection result includes: If the shared library path information obtained from the environment variables of the game process is consistent with the shared library path information obtained from the mapping file, it is determined that there is no risk of plug-in injection in the game process; If the shared library path information obtained from the environment variables of the game process is inconsistent with the shared library path information obtained from the mapping file, it is determined that the game process is at risk of plug-in injection.

5. The method according to claim 1, characterized in that The step of scanning the memory matched by the game process according to the executable file list loaded into the game process by the linker to determine the memory detection result includes: Extracting the file format of each executable file in the executable file list according to the executable file list loaded into the game process by the linker; If the memory header format in the memory matched by the game process does not match the file format of the executable file in the executable file list, it is determined that the game process has a risk of plug-in injection; If there is no memory header format in the memory matched by the game process that does not match the file format of the executable file in the executable file list, it is determined that there is no risk of plug-in injection in the game process.

6. The method according to claim 1, characterized in that The step of determining the plug-in injection detection result according to the file detection result, the variable detection result, the shared library detection result, and the memory detection result includes: If it is determined that the game process has a risk of plug-in injection based on at least one of the file detection result, the variable detection result, the shared library detection result and the memory detection result, then it is determined that the game application has plug-in injection behavior.

7. A detection device for external plug-in injection, characterized in that: The device comprises: A file detection result determination module, for, if it is detected that the game application of the user terminal is started, obtaining a list of executable files loaded into the game process by the linker according to the link library address matched by the user terminal, and determining the file detection result; A variable detection result determination module is used to read the environment variable information in the executable file loaded into the game process by the linker to determine the variable detection result; A shared library detection result determination module is used to obtain the environment variables of the game process, compare the shared library path information obtained from the environment variables of the game process and the shared library path information obtained from the mapping file, and determine the shared library detection result; A memory detection result determination module is used to scan the memory matching the game process according to the executable file list loaded into the game process by the linker to determine the memory detection result; The injection detection result determination module is used to determine the plug-in injection detection result according to the file detection result, the variable detection result, the shared library detection result and the memory detection result.

8. An electronic device, characterized in that: The electronic device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for detecting plug-in injection as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for detecting plug-in injection according to any one of claims 1 to 6 when executed.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method for detecting plug-in injection according to any one of claims 1 to 6.

Images