Game plug-in detection method and device for kernel layer, equipment, medium and product
Through multi-level detection methods, including system environment detection, file detection and memory space analysis, the problem of low accuracy of plug-in detection in the kernel layer is solved, and a comprehensive kernel activity monitoring is achieved, ensuring the security and fairness of the game environment.
Patent Information
- Application Number
- CN202411475569.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-22
- Publication Date
- 2024-12-31
AI Technical Summary
The prior art is difficult to effectively detect and identify game plug-ins at the kernel layer, making it difficult to guarantee the security and fairness of the game environment.
Through multi-level detection methods, including system environment detection, file detection and memory space analysis, the callback function and target application program interface are used to determine whether there are game plug-ins in the kernel layer to achieve comprehensive kernel activity monitoring.
It improves the accuracy of kernel-layer plug-in detection, promptly detects kernel abnormalities, and ensures the reliability and fairness of the game environment.
Smart Images
Figure CN119215427A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer security technology, and in particular to a kernel-layer game cheat detection method, device, electronic device, storage medium and program product. Background Art
[0002] During the development of electronic games, it is necessary to detect cheats in electronic games to ensure the safety and fairness of the gaming environment.
[0003] At present, game cheats have evolved from the application layer to the kernel layer. Existing cheat detection technology is mainly limited to the application layer and is unable to detect cheats at the kernel layer. Game cheats at the kernel layer can penetrate into the core part of the operating system and directly interfere with hardware operations. They are also more hidden and complex. Therefore, powerful means are needed to detect cheats at the kernel layer, accurately identify game cheats at the kernel layer, and prevent them from running in a timely manner. Summary of the invention
[0004] The present invention provides a kernel-layer game cheat detection method, device, electronic device, storage medium and program product to solve the problem of low cheat detection and recognition accuracy at the kernel layer. Through multi-level cheat detection, all-round kernel activity monitoring is achieved, which is conducive to timely discovery of kernel anomalies and ensures the reliability and fairness of the game environment.
[0005] According to one aspect of the present invention, a method for detecting game cheats at a kernel layer is provided, the method comprising:
[0006] If it is detected that the game application of the user terminal is running, determining the environment detection result of the user terminal through a system environment detection command;
[0007] If it is determined according to the environment detection result that the user terminal is in the system environment, the file detection result under the target directory is determined by calling the target application program interface; wherein the target directory includes a temporary file directory and a game application directory;
[0008] If it is determined according to the file detection result that there is a risk of game cheating in the kernel layer, then the calling memory space of the target function is determined through the callback function; wherein the target function is a function associated with the memory calling process;
[0009] If the called memory space is within the memory space range of the game application, it is determined that a game plug-in exists in the kernel layer.
[0010] According to another aspect of the present invention, a game cheat detection device at a kernel layer is provided, the device comprising:
[0011] An environment detection module, for determining an environment detection result of the user terminal through a system environment detection command if it is detected that a game application of the user terminal is running;
[0012] A file detection module, for determining the file detection result under a target directory by calling a target application program interface if it is determined that the user terminal is in a system environment according to the environment detection result; wherein the target directory includes a temporary file directory and a game application directory;
[0013] A memory detection module, for determining the calling memory space of the target function through a callback function if it is determined according to the file detection result that there is a risk of game cheating in the kernel layer; wherein the target function is a function associated with the memory calling process;
[0014] The first plug-in determination module is used to determine whether a game plug-in exists in the kernel layer if the called memory space is within the memory space range of the game application.
[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:
[0016] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the kernel layer game cheat detection method described in any embodiment of the present invention.
[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the kernel layer game cheat detection method described in any embodiment of the present invention when executed.
[0018] According to another aspect of the present invention, a computer program product is provided, including a computer program, which, when executed by a processor, implements the kernel layer game cheat detection method described in any embodiment of the present invention.
[0019] The technical solution of the embodiment of the present invention is as follows: if it is detected that the game application of the user terminal is running, the environment detection result of the user terminal is determined through the system environment detection command; if it is determined that the user terminal is in the system environment according to the environment detection result, the file detection result under the target directory is determined by calling the target application program interface; if it is determined that there is a risk of game plug-in in the kernel layer according to the file detection result, the calling memory space of the target function is determined through the callback function; if the calling memory space is within the memory space range of the game application, it is determined that there is a game plug-in in the kernel layer. This technical solution solves the problem of low plug-in detection and recognition accuracy at the kernel layer, and realizes all-round kernel activity monitoring through multi-level plug-in detection, which is conducive to timely detection of kernel anomalies and ensures the reliability and fairness of the game environment.
[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS
[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0022] Figure 1 This is a flowchart of a method for detecting game cheats at the kernel layer provided according to the first embodiment of the present invention;
[0023] Figure 2 This is a flowchart of a method for detecting game cheats at the kernel layer provided according to the second embodiment of the present invention;
[0024] Figure 3 This is a schematic diagram of the structure of a game cheat detection device at the kernel layer provided according to Embodiment 3 of the present invention;
[0025] Figure 4 It is a structural schematic diagram of an electronic device that implements the game cheat detection method at the kernel layer of an embodiment of the present invention. DETAILED DESCRIPTION
[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.
[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. The acquisition, storage, use, processing, etc. of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.
[0028] Embodiment 1
[0029] Figure 1 The present invention provides a flowchart of a method for detecting game cheats at the kernel layer. This embodiment is applicable to game cheat detection scenarios in the process of game software development. The method can be executed by a game cheat detection device at the kernel layer. The device can be implemented in the form of hardware and / or software, and the device can be configured in an electronic device. Figure 1 As shown, the method includes:
[0030] S110: If it is detected that the game application of the user terminal is running, determine the environment detection result of the user terminal through a system environment detection command.
[0031] This solution can be executed by a user terminal, and the user terminal can be a device such as a mobile phone, a tablet computer, and a laptop computer that has a game application installed. The user terminal can periodically detect the currently running application. If it is detected that the game application is running, the user terminal can use the system environment detection command to determine whether the user terminal is in the system environment and generate an environment detection result. The system environment is the operating system environment of the root user who has all system permissions, such as the Root environment. Specifically, in the Android operating system environment, the system environment detection command can be the su command executed by the function fork() and the function execve(), and the user terminal can determine whether the user terminal is in the Root environment based on the return value of the su command. The environment detection result can be the return value of the su command, which is used to characterize whether the user terminal is in the Root environment. For example, a return value of "0" indicates that the user terminal is in the Root environment, and "1" indicates that the user terminal is not in the Root environment.
[0032] S120: If it is determined according to the environment detection result that the user terminal is in the system environment, determine the file detection result under the target directory by calling the target application program interface; wherein the target directory includes a temporary file directory and a game application directory.
[0033] It is understandable that the environmental detection result can characterize whether the user terminal is in the system environment. If the user terminal is in the system environment, for example, in the root environment, the user terminal has the authority to call the system application program interface. The user terminal can call the target application program interface and scan whether there is an executable file in the target directory. Among them, the target application program interface can be one or more of the application program interfaces that can be called within the scope of the root user's authority. The target directory can include a temporary file directory, such as ... / data / local / tmp, and can also include a game application directory.
[0034] In a feasible solution, the file detection result includes a first detection result and a second detection result; wherein the first detection result is a detection result of the existence of the executable file in the temporary file directory; the second detection result is a detection result of the existence of the executable file in the game application directory;
[0035] Determining the risk of game cheating in the kernel layer according to the file detection result includes:
[0036] If there are executable files in the temporary file directory, or there are executable files in the game application directory, it is determined that there is a risk of game cheating in the kernel layer.
[0037] The user terminal can scan the files in the temporary file directory and the game application directory respectively to obtain the first detection result and the second detection result. Among them, the first detection result can be whether there is an executable file in the temporary file directory, and can also include the number of executable files in the temporary file directory; the second detection result can be whether there is an executable file in the game application directory, and can also include the number of executable files in the game application directory. If it is determined that there is an executable file in the temporary file directory according to the first detection result, or if it is determined that there is an executable file in the game application directory according to the second detection result, the user terminal can determine that there is a risk of game cheating in the kernel layer. In other words, if there is an executable file in at least one of the temporary file directory and the game application directory, there is a risk of game cheating in the kernel layer.
[0038] The executable file in the target directory may be an executable file of a game plug-in in the kernel layer. Therefore, the user terminal can determine that there is a risk of game plug-in in the kernel layer. In order to ensure the security of the game, the user terminal can exit the game application when determining that there is a risk of game plug-in in the kernel layer.
[0039] S130. If it is determined that there is a risk of game cheating in the kernel layer according to the file detection result, the calling memory space of the target function is determined through the callback function; wherein the target function is a function associated with the memory calling process.
[0040] It is easy to understand that after the game application is started, the user terminal will allocate a preset memory space for it. If there is a game plug-in in the kernel layer, when the kernel drives the game plug-in to run, it is necessary to convert the data on the virtual address and the physical address, so it is necessary to call the memory-related function. By detecting the call of the memory-related function, it can be determined whether there is a game plug-in when the game application is running.
[0041] In this solution, if it is determined that there is a risk of game plug-ins in the kernel layer based on the file detection results, the user terminal can further perform memory call detection and obtain the call memory space of the target function through the callback function. The callback function can be a Hook function based on inlineHook technology. The target function can be a function involved in the memory call process. The user terminal can move the first N bytes of the target function to the first N bytes of the callback function, and then fill the first N bytes of the target function with instructions to jump to the callback function, and finally fill the last few bytes of the callback function with jump instructions to jump back to the original function + N to obtain the call memory space of the target function. Among them, N can be a preset number.
[0042] Optionally, the target function includes one or more of a memory protection attribute changing function, a dynamic memory allocation function, a dynamic memory release function, a memory mapping function, and a memory mapping release function.
[0043] In a specific example, the user terminal can obtain the calling memory space of the memory mapping function by hooking mmap, and obtain the calling memory space of the memory mapping release function by hooking mprotect.
[0044] S140: If the called memory space is within the memory space range of the game application, it is determined that a game plug-in exists in the kernel layer.
[0045] The user terminal can compare the target function's calling memory space with the game application's memory space to determine whether the target function's calling memory space is within the game application's memory space range. If so, there is a game cheat in the kernel layer. If not, the user terminal can further determine whether there is a game cheat in the kernel layer through kernel log detection, program loading detection, and driver detection.
[0046] If it is determined that there is a game plug-in in the kernel layer, the user terminal can obtain the user account that the game application is logging in to and block the user account.
[0047] The technical solution of the embodiment of the present invention is as follows: if it is detected that the game application of the user terminal is running, the environment detection result of the user terminal is determined through the system environment detection command; if it is determined that the user terminal is in the system environment according to the environment detection result, the file detection result under the target directory is determined by calling the target application program interface; if it is determined that there is a risk of game plug-in in the kernel layer according to the file detection result, the calling memory space of the target function is determined through the callback function; if the calling memory space is within the memory space range of the game application, it is determined that there is a game plug-in in the kernel layer. This technical solution solves the problem of low plug-in detection and recognition accuracy at the kernel layer, and realizes all-round kernel activity monitoring through multi-level plug-in detection, which is conducive to timely detection of kernel anomalies and ensures the reliability and fairness of the game environment.
[0048] Embodiment 2
[0049] Figure 2 This is a flowchart of a method for detecting game cheats at the kernel layer provided by Embodiment 2 of the present invention. This embodiment refines the above embodiment. Figure 2 As shown, the method includes:
[0050] S201: If it is detected that a game application of a user terminal is running, determine an environment detection result of the user terminal through a system environment detection command.
[0051] S202: If it is determined according to the environment detection result that the user terminal is in the system environment, the file detection result under the target directory is determined by calling the target application program interface; wherein the target directory includes a temporary file directory and a game application directory.
[0052] S203. If it is determined according to the file detection result that there is a risk of game cheating in the kernel layer, the calling memory space of the target function is determined through the callback function; wherein the target function is a function associated with the memory calling process.
[0053] S204: Determine whether the called memory space is within the memory space range of the game application.
[0054] If the called memory space is within the memory space range of the game application, S205 is executed; if the called memory space is not within the memory space range of the game application, S206 is executed.
[0055] S205: Determine whether a game plug-in exists in the kernel layer.
[0056] S206. Obtain kernel layer logs through a log acquisition command, and determine an abnormal log set in the kernel layer logs.
[0057] It is understandable that game plug-ins usually insert logs for debugging when the kernel driver is written. After the development of the game plug-in is completed, the inserted logs will not be closed or commented. Therefore, the user terminal can capture the kernel layer logs based on the log characteristics of the game plug-in to determine whether there is a game plug-in in the kernel layer.
[0058] Wherein, the log acquisition command can be a dmesg command in ADB (Android Debug Bridge). By executing the dmesg command, the user terminal can obtain the kernel layer log.
[0059] The user terminal may compare the kernel layer log with the pre-acquired log whitelist, and add the kernel layer log that is not in the log whitelist to the pre-established abnormal log set.
[0060] The user terminal may also compare the kernel layer log with the pre-acquired log blacklist, and add the kernel layer log in the log blacklist to the pre-established abnormal log set.
[0061] S207: Determine whether the abnormal log set is a non-empty set.
[0062] If the abnormal log set is an empty set, the user terminal can execute S208-S209 and S210-S211 at the same time. If the abnormal log set is a non-empty set, it means that there are abnormal logs in the kernel layer log, and the user terminal can determine that there are game plug-ins in the kernel layer.
[0063] S208: Obtain a loading program list through a loading program acquisition command, and determine an abnormal loading detection result according to the loading program list.
[0064] It can be understood that the command for obtaining the loading level can be to open a file storing a list of loading programs and read the list of loading programs therein. For example, open the modules file recorded in ... / proc / modules. The modules file stores a list of loading programs, and the list of loading programs can include information such as the program name, the size of memory occupied, the number of loading times, and the current program status of each loading program.
[0065] The user terminal can obtain the loader whitelist in advance, compare the loader whitelist with the loader list one by one, and determine whether there is a loader in the loader list that is not in the loader whitelist. If so, the loader in the loader list that is not in the loader whitelist is an abnormal loading; if not, there is no abnormal loading situation.
[0066] The user terminal can obtain the abnormal program blacklist in advance, compare the abnormal program blacklist with the loader list one by one, and determine whether there is a loader in the loader list that is in the abnormal program blacklist. If so, the loader in the loader list that is in the abnormal program blacklist is an abnormal load; if not, there is no abnormal loading situation.
[0067] The abnormal loading detection result may be a comparison result of the loader whitelist and the loader list, or a comparison result of the abnormal program blacklist and the loader list. According to the abnormal loading detection result, the user terminal may determine whether there is abnormal loading in the kernel layer.
[0068] S209: If it is determined that abnormal loading exists according to the abnormal loading detection result, it is determined that a game plug-in exists in the kernel layer.
[0069] If the kernel layer is abnormally loaded, it is determined that there is a game plug-in in the kernel layer. If it is determined that there is a game plug-in in the kernel layer, the user terminal can obtain the user account that the game application is logging in to, and block the user account.
[0070] S210: Determine the abnormal drive detection result under the device directory of the user terminal by calling a file detection function.
[0071] For the driver, the user terminal can obtain the driver file in the device directory of the user terminal by calling the file detection function. According to the driver file in the device directory, it is determined whether there is an abnormal driver and an abnormal driver detection result is generated.
[0072] The file detection function may include a file status acquisition function written in inline assembly code, such as a stat function, and may also include a file access permission determination function written in inline assembly code, such as an access function. The device directory is a directory used to store device files in the operating system, such as the / dev directory under the Linux system. Files related to hardware devices and drivers are stored in the device directory.
[0073] Inline assembly is a technique that directly embeds assembly instructions in high-level language codes such as C and C++. Through inline assembly code, hardware control can be more directly implemented. SVC (Supervisor Call) is an exception in the ARM architecture, which is used to request software interrupts for operating system services. Using SVC to call file detection functions can prevent game plug-ins from bypassing and increase code security.
[0074] In a feasible solution, the user terminal can call the stat function in SVC mode to determine whether the driver corresponding to the driver file in the device directory of the user terminal is an abnormal driver. The stat function can obtain file status information such as the file size and modification time of the driver file in the device directory. According to the file status information returned by the stat function, the user terminal can determine the abnormal driver detection result by comparing the pre-acquired driver whitelist or abnormal driver blacklist. The abnormal driver detection result may include information such as whether there is an abnormal driver, an abnormal driver identifier, and the number of abnormal drivers.
[0075] In another feasible solution, the file detection function includes a file status acquisition function and a file access permission determination function;
[0076] The step of determining the abnormal drive detection result under the device directory of the user terminal by calling the file detection function includes:
[0077] Determine the file status information of the driver program file in the device directory of the user terminal by calling the file status acquisition function;
[0078] Determine the access permission information of the driver program file in the device directory of the user terminal by calling the file access permission determination function;
[0079] An abnormal drive detection result under a device directory of the user terminal is determined according to the file status information and the access permission information.
[0080] It is easy to understand that game plug-ins usually set their drivers to non-readable and non-writable mode. The access function can check whether the calling process has the permission to access the driver files in the device directory, that is, to determine whether the current user identity has the permission to read, write or execute the driver files in the device directory. The user terminal can call the stat function and the access function in SVC mode respectively, and determine the abnormal driver detection results in the device directory of the user terminal by combining the file status information returned by the stat function and the access permission information returned by the access function.
[0081] The user terminal can first determine the abnormal driver risk list according to the file status information returned by the stat function, and then determine the non-readable and writable drivers in the abnormal driver risk list as abnormal drivers according to the access permission information returned by the access function to generate an abnormal driver detection result.
[0082] The user terminal can also first determine the unreadable and writable drivers based on the access permission information returned by the access function, and then determine the abnormal drivers among the unreadable and writable drivers based on the file status information returned by the stat function, by comparing them with the pre-acquired driver whitelist or abnormal driver blacklist, and generate abnormal driver detection results.
[0083] S211. If it is determined that an abnormal driver program exists in the device directory according to the abnormal driver detection result, it is determined that a game plug-in exists in the kernel layer.
[0084] According to the abnormal driver detection result, the user terminal can determine whether there is an abnormal driver program in the device directory. If there is an abnormal driver program in the device directory, the user terminal can determine that there is a game plug-in in the kernel layer. If it is determined that there is a game plug-in in the kernel layer, the user terminal can obtain the user account that the game application is logging in and block the user account.
[0085] The technical solution of the embodiment of the present invention is as follows: if it is detected that the game application of the user terminal is running, the environment detection result of the user terminal is determined through the system environment detection command; if it is determined that the user terminal is in the system environment according to the environment detection result, the file detection result under the target directory is determined by calling the target application program interface; if it is determined that there is a risk of game plug-in in the kernel layer according to the file detection result, the calling memory space of the target function is determined through the callback function; if the calling memory space is within the memory space range of the game application, it is determined that there is a game plug-in in the kernel layer. This technical solution solves the problem of low plug-in detection and recognition accuracy at the kernel layer, and realizes all-round kernel activity monitoring through multi-level plug-in detection, which is conducive to timely detection of kernel anomalies and ensures the reliability and fairness of the game environment.
[0086] Embodiment 3
[0087] Figure 3 This is a schematic diagram of the structure of a game cheat detection device at the kernel layer provided by the third embodiment of the present invention. Figure 3 As shown, the device comprises:
[0088] The environment detection module 310 is used to determine the environment detection result of the user terminal through a system environment detection command if it is detected that the game application of the user terminal is running;
[0089] The file detection module 320 is used to determine the file detection result under the target directory by calling the target application program interface if it is determined that the user terminal is in the system environment according to the environment detection result; wherein the target directory includes a temporary file directory and a game application directory;
[0090] The memory detection module 330 is used to determine the calling memory space of the target function through the callback function if it is determined that there is a risk of game cheating in the kernel layer according to the file detection result; wherein the target function is a function associated with the memory calling process;
[0091] The first plug-in determination module 340 is used to determine whether a game plug-in exists in the kernel layer if the called memory space is within the memory space range of the game application.
[0092] In this solution, the file detection result includes a first detection result and a second detection result; wherein the first detection result is a detection result of the existence of the executable file in the temporary file directory; the second detection result is a detection result of the existence of the executable file in the game application directory;
[0093] The memory detection module 330 is specifically used for:
[0094] If there are executable files in the temporary file directory, or there are executable files in the game application directory, it is determined that there is a risk of game cheating in the kernel layer.
[0095] The device also includes:
[0096] A log detection module is used to obtain a kernel layer log through a log acquisition command after determining the calling memory space of the target function, if the calling memory space is not within the memory space range of the game application, and determine an abnormal log set in the kernel layer log;
[0097] The second plug-in determination module is used to determine whether there is a game plug-in in the kernel layer if the abnormal log set is a non-empty set.
[0098] Based on the above solution, optionally, the device further includes:
[0099] an abnormal loading detection module, configured to, after determining an abnormal log set in the kernel layer log, obtain a loader list through a loader acquisition command if the abnormal log set is an empty set, and determine an abnormal loading detection result according to the loader list;
[0100] The third plug-in determination module is used to determine whether a game plug-in exists in the kernel layer if abnormal loading is determined according to the abnormal loading detection result.
[0101] In a feasible solution, the device further includes:
[0102] An abnormal drive detection module is used to determine the abnormal drive detection result under the device directory of the user terminal by calling a file detection function after determining the abnormal log set in the kernel layer log, if the abnormal log set is an empty set;
[0103] The fourth plug-in determination module is used to determine whether there is a game plug-in in the kernel layer if it is determined that there is an abnormal driver program in the device directory according to the abnormal driver detection result.
[0104] In a preferred solution, the file detection function includes a file status acquisition function and a file access permission determination function;
[0105] The abnormal drive detection module is specifically used for:
[0106] Determine the file status information of the driver program file in the device directory of the user terminal by calling the file status acquisition function;
[0107] Determine the access permission information of the driver program file in the device directory of the user terminal by calling the file access permission determination function;
[0108] An abnormal drive detection result under a device directory of the user terminal is determined according to the file status information and the access permission information.
[0109] The kernel layer game cheat detection device provided in the embodiment of the present invention can execute the kernel layer game cheat detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.
[0110] Embodiment 4
[0111] Figure 4 A schematic diagram of an electronic device 410 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.
[0112] like Figure 4 As shown, the electronic device 410 includes at least one processor 411, and a memory connected to the at least one processor 411 in communication, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or the computer program loaded from the storage unit 418 to the random access memory (RAM) 413. In the RAM 413, various programs and data required for the operation of the electronic device 410 can also be stored. The processor 411, the ROM 412, and the RAM 413 are connected to each other via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.
[0113] Multiple components in the electronic device 410 are connected to the I / O interface 415, including: an input unit 416, such as a keyboard, a mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a disk, an optical disk, etc.; and a communication unit 419, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 419 allows the electronic device 410 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.
[0114] Processor 411 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. Processor 411 executes the various methods and processes described above, such as a game cheat detection method at the kernel layer.
[0115] In some embodiments, the game cheat detection method at the kernel layer may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 418. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 410 via the ROM 412 and / or the communication unit 419. When the computer program is loaded into the RAM 413 and executed by the processor 411, one or more steps of the game cheat detection method at the kernel layer described above may be executed. Alternatively, in other embodiments, the processor 411 may be configured to execute the game cheat detection method at the kernel layer by any other appropriate means (e.g., by means of firmware).
[0116] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
[0117] The computer program for implementing the method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other game cheat detection device of a programmable kernel layer, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, partially on the machine as an independent software package and partially on a remote machine, or completely on a remote machine or server.
[0118] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0119] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).
[0120] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.
[0121] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.
[0122] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.
[0123] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims
1. A method for detecting game cheats at the kernel layer, characterized in that: The method comprises: If it is detected that the game application of the user terminal is running, determining the environment detection result of the user terminal through a system environment detection command; If it is determined according to the environment detection result that the user terminal is in the system environment, the file detection result under the target directory is determined by calling the target application program interface; wherein the target directory includes a temporary file directory and a game application directory; If it is determined according to the file detection result that there is a risk of game cheating in the kernel layer, then the calling memory space of the target function is determined through the callback function; wherein the target function is a function associated with the memory calling process; If the called memory space is within the memory space range of the game application, it is determined that a game plug-in exists in the kernel layer.
2. The method according to claim 1, characterized in that The file detection result includes a first detection result and a second detection result; wherein the first detection result is a detection result of the existence of the executable file in the temporary file directory; the second detection result is a detection result of the existence of the executable file in the game application directory; Determining the risk of game cheating in the kernel layer according to the file detection result includes: If there are executable files in the temporary file directory, or there are executable files in the game application directory, it is determined that there is a risk of game cheating in the kernel layer.
3. The method according to claim 1, characterized in that After determining the calling memory space of the target function, the method further includes: If the called memory space is not within the memory space range of the game application, obtaining the kernel layer log through a log acquisition command, and determining an abnormal log set in the kernel layer log; If the abnormal log set is a non-empty set, it is determined that there is a game plug-in in the kernel layer.
4. The method according to claim 3, characterized in that After determining the abnormal log set in the kernel layer log, the method further includes: If the abnormal log set is an empty set, obtaining a loading program list through a loading program acquisition command, and determining an abnormal loading detection result according to the loading program list; If it is determined that abnormal loading exists according to the abnormal loading detection result, it is determined that a game plug-in exists in the kernel layer.
5. The method according to claim 3, characterized in that: After determining the abnormal log set in the kernel layer log, the method further includes: If the abnormal log set is an empty set, determining the abnormal drive detection result under the device directory of the user terminal by calling a file detection function; If it is determined that an abnormal driver program exists in the device directory according to the abnormal driver detection result, it is determined that a game plug-in exists in the kernel layer.
6. The method according to claim 5, characterized in that The file detection function includes a file status acquisition function and a file access permission determination function; The step of determining the abnormal drive detection result under the device directory of the user terminal by calling the file detection function includes: Determine the file status information of the driver program file in the device directory of the user terminal by calling the file status acquisition function; Determine the access permission information of the driver program file in the device directory of the user terminal by calling the file access permission determination function; An abnormal drive detection result under a device directory of the user terminal is determined according to the file status information and the access permission information.
7. A game cheat detection device at the kernel layer, characterized in that: The device comprises: An environment detection module, for determining an environment detection result of the user terminal through a system environment detection command if it is detected that a game application of the user terminal is running; A file detection module, for determining the file detection result under a target directory by calling a target application program interface if it is determined that the user terminal is in a system environment according to the environment detection result; wherein the target directory includes a temporary file directory and a game application directory; A memory detection module, for determining the calling memory space of the target function through a callback function if it is determined according to the file detection result that there is a risk of game cheating in the kernel layer; wherein the target function is a function associated with the memory calling process; The first plug-in determination module is used to determine whether a game plug-in exists in the kernel layer if the called memory space is within the memory space range of the game application.
8. An electronic device, characterized in that: The electronic device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the kernel layer game cheat detection method described in any one of claims 1-6.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the kernel layer game cheat detection method described in any one of claims 1-6 when executed.
10. A computer program product, comprising a computer program, which, when executed by a processor, implements the game cheat detection method for the kernel layer according to any one of claims 1-6.