Anti-plug-in code binding method, device and program product

Abstract

The invention discloses an anti-plug-in code binding method and device and a program product, and relates to the technical field of game safety. According to the method, the first jump instruction pointing to the bridge code unit is added at the starting position of the binding code of the game module, the bridge code unit is designed to point to the repair unit in the anti-plug-in module, the repair unit is used for obtaining the backup binding code address sent by the repair unit, further, the original binding code is copied to the anti-plug-in module, and the anti-plug-in module is used for repairing the original binding code. And a second jump instruction pointing to the game module is added behind the backup code, and the second jump instruction points to the game module, so that after the backup binding code is operated, the game module is returned through the second jump instruction and subsequent codes are operated, and finally, the position of the original binding code in the game module is filled with random data. Therefore, the effect that the game cannot be normally played without loading the anti-plug-in module is achieved, the code binding strength of the anti-plug-in module is enhanced, and the game can be prevented from bypassing the anti-plug-in module to run.

Description

Technical Field

[0001] The present application relates to the field of game security technology, and in particular to an anti-cheating code binding method, device and program product. Background Art

[0002] Currently, because there is a significant difference in the technical expertise required for the development of anti-cheating technology and the development of game content, few developers are proficient in both fields at the same time, so the anti-cheating module is usually developed independently of the game module. The design of this independent module allows game developers to focus their main efforts on the design of game content and gameplay without having to delve into the complex details of anti-cheating technology. The anti-cheating module can hijack the game startup process after the game module is compiled through binary hardening technology, ensuring that the anti-cheating module is automatically loaded and executed when the game starts, thereby achieving the anti-cheating effect.

[0003] However, this independence also brings certain security risks. If the cheat developer can successfully identify and bypass the anti-cheating module's startup mechanism, making it impossible to load the anti-cheating module normally, the game module can still run unaffected. In this case, the game will lose the ability to monitor and defend against cheating behavior, which may threaten the fairness and security of the game.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide an anti-cheating code binding method, device and program product, aiming to solve the technical problem of how to prevent the game from bypassing the anti-cheating module.

[0006] To achieve the above purpose, the present application proposes an anti-cheating code binding method, the method comprising: Adding a first jump instruction at the start position of the binding code in the game module, wherein the first jump instruction points to a bridge code unit in the game module, and the bridge code unit points to a repair unit in the anti-cheating module, wherein the repair unit is used to determine a backup binding code address, and the bridge code unit is used to obtain the backup binding code address sent by the repair unit, so that the game module runs the backup binding code based on the backup binding code address; The binding code is copied to the anti-cheating module as the backup binding code, and a second jump instruction is added at the end of the backup binding code, wherein the second jump instruction points to the game module, so that after the backup binding code in the anti-cheating module is run, the second jump instruction returns to the game module and runs subsequent codes; The position corresponding to the binding code in the game module is replaced with random data.

[0007] In one embodiment, after the step of adding the first jump instruction at the start position of the binding code in the game module, the following steps are included: Based on the binding code, determining binding function information; Adding the binding function information to the anti-cheating module; Confirm the address information of the backup binding code in the anti-plug-in module, and save the address information into the binding function information.

[0008] In one embodiment, before the step of adding the first jump instruction at the start position of the binding code in the game module, the method further includes: Adding a first code section in the game module, wherein the first code section is used to store the bridge code corresponding to the bridge code unit; An import function item is added in the bridging code unit, wherein the import function item is used to import a repair function corresponding to the repair unit of the anti-plug-in module, and the repair function is used to determine the backup binding code address according to an identifier of a binding function.

[0009] In one embodiment, before the step of adding the first jump instruction at the start position of the binding code in the game module, the method further includes: A second code section is added to the anti-cheating module, and the second code section is used to store the binding function information, the backup binding code, the second jump instruction, and the obfuscated backup binding code and the second jump instruction.

[0010] In addition, to achieve the above purpose, the present application also proposes an anti-cheating code binding method, which is applied to the anti-cheating module, and the method includes: Receiving, by the repair unit, an identifier of a binding function sent by the bridge code unit in the game module; If the identifier does not exist in the identification address index table, the repair unit determines the backup binding code address based on the identifier and binding function information, and sends the backup binding code address to the bridging code unit so that the game module runs the backup binding code based on the backup binding code address.

[0011] In one embodiment, the step of determining the backup binding code address according to the identifier and the binding function information by the repair unit includes: Based on the identifier, matching the corresponding binding function information, determining the first address of the backup binding code in the anti-cheating module; Based on the first address, obtaining the backup binding code and a second jump instruction; Obfuscating the backup binding code and the second jump instruction, and saving the obfuscated backup binding code and the second jump instruction; Determine a second address of the obfuscated backup binding code in the anti-cheating module, and use the second address as the backup binding code address.

[0012] In one embodiment, after the step of performing instruction obfuscation on the backup binding code and the second jump instruction and saving the obfuscated backup binding code and the second jump instruction, the method further includes: The position of the backup binding code corresponding to the first address in the anti-cheating module is replaced with random data.

[0013] In addition, to achieve the above purpose, the present application also proposes an anti-cheating code binding method, which is applied to the game module, and the method includes: Sending an identifier of the binding function to the repair unit via the bridge code unit; receiving a backup binding code address sent by the repair unit based on the identifier; Based on the backup binding code address, the backup binding code is run.

[0014] In addition, to achieve the above-mentioned purpose, the present application also proposes an anti-cheating code binding device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the anti-cheating code binding method described above.

[0015] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the anti-cheating code binding method described above.

[0016] The present application provides an anti-cheating code binding method, by adding a first jump instruction pointing to a bridge code unit at the beginning of the game module binding code, and designing the bridge code unit to point to a repair unit in the anti-cheating module, for obtaining the backup binding code address sent by the repair unit, so that the game module runs the backup binding code based on the backup binding code address, further, the original binding code is copied to the anti-cheating module, and a second jump instruction pointing to the game module is added after the backup code, the second jump instruction points to the game module, so that after the backup binding code in the anti-cheating module is run, the second jump instruction returns to the game module and runs the subsequent code, and finally, the original binding code position in the game module is filled with random data. The above steps make the key binding code part in the game module be erased from the game module, so as to achieve the effect that the game cannot be played normally without loading the anti-cheating module, enhance the code binding strength of the anti-cheating module, and prevent the game from bypassing the anti-cheating module. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 A flowchart diagram of the first embodiment of the anti-cheating code binding method of the present application is provided; Figure 2 A flowchart diagram of the second embodiment of the anti-cheating code binding method of the present application is provided; Figure 3 A flowchart diagram of the third embodiment of the anti-cheating code binding method of the present application is provided; Figure 4 A flowchart diagram of the fourth embodiment of the anti-cheating code binding method of the present application is provided; Figure 5 A flowchart diagram of the fifth embodiment of the anti-cheating code binding method of the present application is provided; Figure 6 A flowchart diagram of the sixth embodiment of the anti-cheating code binding method of the present application; Figure 7 A flowchart diagram of the seventh embodiment of the anti-cheating code binding method of the present application is provided; Figure 8 A brief flowchart of the anti-cheating code binding method in an embodiment of the present application; Fig. 9 This is a schematic diagram of the device structure of the hardware operating environment involved in the anti-cheating code binding method in the embodiment of the present application.

[0020] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0021] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0022] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0023] Currently, because there is a significant difference in the technical expertise required for the development of anti-cheating technology and the development of game content, few developers are proficient in both fields at the same time, so the anti-cheating module is usually developed independently of the game module. The design of this independent module allows game developers to focus their main efforts on the design of game content and gameplay without having to delve into the complex details of anti-cheating technology. The anti-cheating module can hijack the game startup process after the game module is compiled through binary hardening technology, ensuring that the anti-cheating module is automatically loaded and executed when the game starts, thereby achieving the anti-cheating effect.

[0024] However, this independence also brings certain security risks. If the cheat developer can successfully identify and bypass the anti-cheating module's startup mechanism, making it impossible to load the anti-cheating module normally, the game module can still run unaffected. In this case, the game will lose the ability to monitor and defend against cheating behavior, which may threaten the fairness and security of the game.

[0025] In view of the above problems, the present application proposes an anti-cheating code binding method, by adding a first jump instruction pointing to a bridge code unit at the beginning of the game module binding code, and designing the bridge code unit to point to a repair unit in the anti-cheating module to obtain a backup binding code address, further, encrypting the original binding code and backing it up to the anti-cheating module, and adding a second jump instruction pointing to the game module after the backup code, and finally, filling the original binding code position in the game module with random data. The above steps enable the key binding code part in the game module to be erased from the game module, thereby achieving the effect that the game cannot be played normally without loading the anti-cheating module, enhancing the code binding strength of the anti-cheating module, and preventing the game from bypassing the anti-cheating module.

[0026] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, etc. The following takes the anti-cheating device as an example to illustrate this embodiment and the following embodiments.

[0027] Based on this, the first embodiment proposed in this application provides an anti-cheating code binding method, referring to Figure 1 In this embodiment, the anti-cheating code binding method includes steps S10 to S30: Step S10, add a first jump instruction at the starting position of the binding code in the game module, the first jump instruction points to the bridging code unit in the game module, the bridging code unit points to the repair unit in the anti-cheating module, wherein the repair unit is used to determine the backup binding code address, and the bridging code unit is used to obtain the backup binding code address sent by the repair unit, so that the game module runs the backup binding code based on the backup binding code address.

[0028] It should be noted that the game module refers to the main program part of the game, including the game logic, rendering, input and other codes. The binding code is the game code fragment selected for deep binding with the anti-cheating module.

[0029] It should also be noted that the first jump instruction is a machine instruction for jumping the execution flow to another position at a specific position in the game module. In the present embodiment, the purpose of the instruction is to set a "hook" at the beginning position of the binding code in the game module so that the execution flow can be redirected to the anti-cheating module when the game is started, so as to start the execution of the backup binding code migrated from the game module in the anti-cheating module. This step can realize the dynamic link between the game module and the anti-cheating module. By inserting the jump instruction at the key code position of the game module, the anti-cheating device can capture the call of these key codes when the game is running, thereby ensuring that the anti-cheating module has the opportunity to verify and repair these calls.

[0030] For example, first, the developer needs to manually select some key functions that are frequently called during the game as binding objects. These functions are usually the core part of the game logic and are also the places where the plug-in program is most likely to try to modify or bypass. Using the symbol files generated during the game compilation process, such as .pdb files, developers can obtain the names of all functions and their corresponding memory addresses. This helps to accurately locate the key code locations that need to be bound. In the binary file of the game module, find the starting position of the selected function and insert a jump instruction such as a jmp instruction at that position. The target address of this instruction is the address of the bridge code unit in the game module. Among them, the bridge code unit is a special code located in the game module. Its function is to save the current register environment, then call the repair unit in the anti-plug-in module, and pass the ID (Identifier) ​​of the binding function as a parameter. The repair unit will return the backup binding code address backed up in the anti-plug-in module, and the bridge code unit will restore the register environment and jump to the bridge code unit address to continue executing the original game code.

[0031] Optionally, select the function to be bound in the game module and insert multi-level jump instructions at its starting position. Each level of jump instructions points to an intermediate code segment and finally points to the bridge code unit segment. Multi-level jumps can increase the difficulty of static analysis and improve the security of anti-cheating code.

[0032] For example, suppose there is a function func1 in the game module, and its address is 0x6000. Insert the first-level jump instruction at 0x6000 to jump to the intermediate code segment 0x7000. Insert the second-level jump instruction in the intermediate code segment 0x7000 to jump to the bridge code unit segment 0x8000. After the bridge code unit segment 0x8000 performs a series of operations, it jumps to the func3 code address backed up in the anti-cheating module for execution.

[0033] Optionally, when the game module is loaded, the trigger condition is set through dynamic analysis or modification. When the trigger condition is met, the jump instruction is dynamically inserted into the game module and points to the dynamically generated bridge code unit, which is responsible for calling the repair unit in the anti-plug-in module. By dynamically generating and inserting, the detection of the plug-in static analysis tool is bypassed, increasing the difficulty of plug-in static analysis.

[0034] Step S20, copy the binding code to the anti-cheating module as the backup binding code, and add a second jump instruction at the end of the backup binding code, the second jump instruction points to the game module, so that after the backup binding code in the anti-cheating module is run, it returns to the game module through the second jump instruction and runs subsequent codes.

[0035] It should be noted that because the binding code is closely related to the game logic and needs to be protected to prevent tampering or analysis by plug-ins or malware, these codes can be encrypted and backed up in the anti-plug-in module. The backup binding code refers to a copy of the binding code stored in the anti-plug-in module, which can be restored or verified when necessary, thereby enhancing the security of the game.

[0036] Exemplarily, the binding code that needs to be protected is extracted from the game module. A suitable encryption algorithm such as AES (Advanced Encryption Standard) is selected to encrypt the extracted binding code to ensure that the encrypted code cannot be easily cracked during storage and transmission. During the encryption process, a key or key pair can be generated for subsequent decryption operations. The encrypted code is backed up to a specified location in the anti-cheating module, in which a special storage area can be set to save these encrypted codes. When the binding code needs to be restored or verified, the encrypted code is decrypted using the previously generated key.

[0037] The encrypted second jump instruction is added at the end of the backup binding code, so that after the backup binding code is executed, the encrypted second jump instruction can be used to safely guide the program flow back to the game module to continue executing subsequent codes. This can not only ensure the normal operation of the game, but also effectively prevent plug-in software from destroying the integrity of the game by tampering with the program flow.

[0038] Exemplarily, the jump target address is first determined. In the game module, a suitable jump target point is determined, which is the starting address of the code segment that needs to be continued to be executed after the backup binding code is executed. Then, according to the target address and the instruction set architecture of the current program, a corresponding second jump instruction is generated. The format and specific content of the jump instruction should follow the specification of the instruction set architecture to ensure its correctness and executability. The second jump instruction is encrypted, and the encrypted second jump instruction and the backup binding code are stored in the anti-plug-in module to prevent them from being easily obtained by plug-in software.

[0039] Step S30, replacing the position corresponding to the binding code in the game module with random data.

[0040] It should be noted that random data refers to random binary data used to fill the original location of the binding code in the game module. The original location of the binding code in the game module is filled with randomly generated binary data. The purpose of this is to disrupt the disassembly process, making it difficult for the plug-in author to determine the location and content of the binding code through static analysis, and increasing the difficulty of plug-in cracking.

[0041] Exemplarily, after the game module is compiled, all binding code locations are found in the compiled binary executable file, and then random data is generated to fill the binding code locations. The random data can be of any type, such as integers, floating point numbers, strings, etc. Optionally, in order to ensure randomness, a random number generator such as the "rand()" function in the C language, or other random number libraries can be used to generate data.

[0042] In this embodiment, a jump instruction is inserted at a key code position in the game module to redirect the execution process to the anti-cheating module. At the same time, the binding code is encrypted and backed up to the anti-cheating module, and a jump instruction is added after the backup code to safely return to the game module. This design effectively enhances the binding strength of the anti-cheating code. It not only improves the game security through dynamic linking and encrypted backup, but also increases the difficulty of static analysis by filling random data in the game module, thereby effectively preventing cheat developers from identifying and bypassing the startup mechanism of the anti-cheating module, achieving the effect that if the anti-cheating module is not loaded normally, the game module cannot run normally, thereby protecting the integrity of the anti-cheating module and the fairness of the game.

[0043] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can refer to the above introduction, and will not be repeated later. Figure 2 After step S10, the anti-cheating code binding method further includes steps S40 to S60: Step S40: determining binding function information based on the binding code.

[0044] It should be noted that the binding function information refers to a collection of information about the binding code, such as the function name, parameter type, return value type, function body address, etc. It is the key to understanding how the binding code works and how it is called.

[0045] Optionally, static analysis or dynamic debugging tools are used to parse the binding code and extract metadata information such as function name, parameters, return value, function address, etc. This information can be recovered from the binary code using the symbol table or debugging information generated by the compiler or through reverse engineering technology.

[0046] Exemplarily, the symbol file .pdb file of the game is parsed, all symbols and addresses corresponding to the symbols are exported, and a symbol list is obtained. For the binding function corresponding to each binding code in the game module, the function name and the symbol list are matched, and the address of the function is found. If the address cannot be found, it means that the function has been cancelled or modified in the new version, and then it is skipped and not processed. From the starting position of the function, a disassembly engine is used to disassemble instructions one by one, and when a jump class instruction is encountered, the binary code size that can be bound is obtained. It is also necessary to record the offset of each relocation item in the current binding code block according to all relocation items contained in the output code in the binding code to obtain a relocation item list. It should be noted that in a computer program, a relocation item is a data structure used to describe the address information that needs to be modified in the program. When the program code is loaded into the memory, or when it is connected with other target files or target functions, these relocation items will be processed to ensure that all address references in the program are correct.

[0047] In addition, the binding function information may also include the binding function ID corresponding to the binding code, the address of the binding function in the game module, the offset of the string of the game module name, the number of relocation items contained in the binding code, etc.

[0048] Step S50: adding the binding function information to the anti-cheating module.

[0049] Adding bound function information to the anti-cheating module means that the anti-cheating module can identify and monitor the behavior of these functions. For example, if the bound function is to process in-game transactions, the anti-cheating module can monitor the function's call frequency, parameter values, etc. to detect abnormal transaction behavior.

[0050] Step S60, determining a first address of the backup binding code in the anti-cheating module, and saving the first address into the binding function information.

[0051] It should be noted that the address information of the backup binding code is confirmed and saved in the binding function information so that the repair unit can accurately locate the backup binding code, so that when the game module executes to the corresponding position of the original binding code, the repair unit can decrypt and obfuscate the corresponding backup binding code according to the binding function information to ensure the integrity of the game code logic.

[0052] Exemplarily, after the backup binding code is loaded in the anti-hanging module, a debugger or a memory analysis tool is used to obtain its address, i.e., the first address, and then the first address is associated with the binding function information. Memory space is allocated in the anti-hanging module through a memory management function such as VirtualAlloc, and the backup binding code is copied to the space, and then the starting address of the space is recorded.

[0053] To better understand the solution provided in this example, this example is further explained in combination with specific application scenarios.

[0054] Specifically, a new PE section is first added to the anti-cheating module to store binding function information and backup binding code. Among them, in the Windows operating system, the PE (Portable Executable) format is a file format used for executable files (.exe), target files (.obj), dynamic link libraries (.dll) and other executable content. The PE section is a structure in the PE file, which represents the data area in the file and is used to store code, data, resources, etc. In the newly added PE section, the size information of the statically used space in the PE section and the number of binding functions are first saved, and then the binding function information is saved. The binding function information includes the binding function ID, the address of the binding function in the game module, the size of the binding code, the offset of the string of the game module name in the PE section, the default relocation base address of the game module, the number of relocation items contained in the binding code, the offset of the relocation item list in the PE section, the first address of the backup binding code in the anti-cheating module, that is, the offset of the backup binding code in the PE section, etc. Then, the character string of the game module name, the relocation item list of all binding codes, the backup binding code and the second jump instruction are saved, wherein the backup binding code and the second jump instruction are stored after being encrypted.

[0055] In this embodiment, detailed information of key functions in the game module is extracted through static analysis and dynamic debugging tools, and this information is integrated into the anti-cheating module to achieve deep binding and monitoring of the core logic of the game. This process not only enhances the ability of the anti-cheating module to identify and monitor the behavior of key functions, such as detecting abnormal transaction behavior, but also ensures that the original function of the binding code can be accurately restored when the game is started by backing up the key code in the anti-cheating module and recording its address information.

[0056] Based on the above embodiments of the present application, in the third embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and will not be described in detail later. Figure 3 Before step S10, the anti-cheating code binding method further includes steps S70 to S80: Step S70, adding a first code section to the game module, wherein the first code section is used to store the bridge code corresponding to the bridge code unit.

[0057] Step S80, adding an import function item in the bridge code unit, the import function item is used to import the repair function corresponding to the repair unit of the anti-plug-in module, and the repair function is used to determine the backup binding code address according to the identifier of the binding function.

[0058] It should be noted that the first code section is a specific area newly added in the game module, which is used to store specific code or data, such as the PE section. This section is specifically used to store bridge code units, which play the role of connecting the game module and the anti-cheating module.

[0059] Exemplarily, during the compilation or linking phase of the game module, a new section is added to the binary file of the game module as required. The attribute of the section is set to a code section so that the code therein can be executed at runtime. Sufficient space is reserved to store the bridge code, and it is ensured that the memory address of the section is valid at runtime. During the implementation of the code binding phase, an import function item is added as required, so that when the game module is running, the bridge code unit can call the repair function in the anti-cheating module through the import function item.

[0060] In this embodiment, by adding a special first code section in the game module to store the bridge code, and adding an import function item in the bridge code unit to import the repair function of the anti-cheating module, this solution realizes efficient communication and collaboration between the game module and the anti-cheating module. This design enables the game module to directly call the repair function of the anti-cheating module through the bridge code unit during runtime, obtain the backup binding code address and execute the binding code to successfully run the game, ensuring the deep binding of the game module and the anti-cheating module.

[0061] Based on the above embodiments of the present application, in the fourth embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and will not be described in detail later. Figure 4 Before step S10, the anti-cheating code binding method further includes step S90: Step S90, adding a second code section to the anti-cheating module, wherein the second code section is used to store the binding function information, the backup binding code, the second jump instruction, and the obfuscated backup binding code and the second jump instruction.

[0062] In this embodiment, a second code section is added to the anti-hang module, such as a new PE section, which is specifically used to store content related to binding functions, backup binding codes, jump instructions, etc. The above steps can improve the scalability and flexibility of the anti-hang module, facilitate the subsequent addition of new functions or codes, and also realize the separation of key codes and instructions from other parts of the anti-hang module, reducing the coupling degree of the code, because the key codes and jump instructions are centrally managed in the second code section, which is convenient for encryption, obfuscation and other security measures, and can improve the security and stability of the anti-hang module.

[0063] Based on the above embodiments of the present application, in the fifth embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and no further description will be given later. On this basis, the fifth embodiment proposes an anti-cheating code binding method, which is applied to the anti-cheating module, please refer to Figure 5 The anti-cheating code binding method further includes steps A10 to A20: Step A10: receiving, through the repair unit, the identifier of the binding function sent by the bridge code unit in the game module.

[0064] It should be noted that each binding code block corresponds to a bridge code unit, which is used to save the register environment. The bridge code unit implements cross-module calling of the repair unit in the anti-plug-in module through the newly added import function, that is, the repair unit in the anti-plug-in module. After obtaining the backup binding code address in the anti-plug-in module, it restores the register environment and jumps to the backup binding code execution.

[0065] When the game module starts running, the binding function ID corresponding to the binding code can be passed to the repair unit in the anti-cheating module through the bridging code unit. The repair unit obtains the binding function ID and matches the corresponding binding function information according to the binding function ID to return the backup binding code address.

[0066] Step A20, if the identifier does not exist in the identification address index table, the repair unit determines the backup binding code address according to the identifier and binding function information, and sends the backup binding code address to the bridging code unit, so that the game module runs the backup binding code based on the backup binding code address.

[0067] It should be noted that the identification address index table is a mapping table for storing the binding function ID and its corresponding backup binding code address, and is used to quickly find the corresponding backup binding code address according to the binding function ID. If an identifier does not exist in the identification address index table, it means that the binding function is executed for the first time and has not been recorded. At this time, it is necessary to find the backup binding code to obtain the backup binding code address.

[0068] Optionally, the binding function ID is matched in the binding function information, and the first address of the corresponding backup binding code in the anti-hang-out module, ie, the offset of the backup binding code in the PE section, is found as the backup binding code address.

[0069] Optionally, step A20 includes steps A21 to A24: Step A21, based on the identifier, matching the corresponding binding function information, and determining the first address of the backup binding code in the anti-cheating module.

[0070] Step A22: based on the first address, obtain the backup binding code and the second jump instruction.

[0071] The anti-hang module receives the binding function ID transmitted by the bridge code unit, uses the received binding function ID as a key, searches for the corresponding entry in the binding function information maintained inside the anti-hang module, and extracts the address information of the backup binding code from the entry. According to the address information of the backup binding code, the backup binding code and the second jump instruction are read.

[0072] Step A23, obfuscating the backup binding code and the second jump instruction, and saving the obfuscated backup binding code and the second jump instruction.

[0073] Step A24, determining a second address of the obfuscated backup binding code in the anti-cheating module, and using the second address as the backup binding code address.

[0074] It should be noted that the purpose of instruction obfuscation is to change the number and complexity of instructions while ensuring that the function of the instruction sequence remains unchanged, increase the difficulty of reading and understanding the instructions, and thus prevent malicious users or plug-in makers from reverse analyzing or tampering with the instructions. Instruction obfuscation methods include but are not limited to equivalent instruction replacement, such as replacing one instruction with multiple instructions with the same function, control flow flattening, such as converting a simple control flow structure into a complex, difficult-to-understand structure, and inserting useless instructions such as no operations and conditional jumps.

[0075] Exemplarily, first, if the backup binding code and the second jump instruction are encrypted, the encryption method used by the backup binding code and the second jump instruction is identified, and then, the encrypted code and instruction are restored to the original, executable binary form using the corresponding decryption algorithm and key. The obfuscated backup binding code and the second jump instruction are then saved to a secure storage location. The second address of the obfuscated backup binding code in the anti-cheating module is recorded and used as the backup binding code address.

[0076] It is understandable that the number of instructions in the obfuscated backup binding code increases and its complexity will be higher. The code space of the original binding code in the game module will not be enough to accommodate these new instructions. If the plug-in maker wants to bypass the anti-plug-in module to load the game module, he needs to understand the logic and structure of the obfuscated code, and convert it back to the original, unobfuscated instructions and write it to the original location in the game module, which greatly increases the difficulty of restoration, thereby enhancing the anti-stripping effect of the anti-plug-in module.

[0077] Optionally, the identifier and the backup binding code address are associated and stored in the identification address index table. When the repair unit receives the identifier of the binding function sent by the bridging code unit, the identifier is matched in the identification address index table, and if the identifier exists in the identification address index table, the backup binding code address is determined based on the identification address index table.

[0078] Among them, when the backup binding code is executed for the first time, the repair unit will decrypt and confuse the backup binding code, and then return the backup binding code address to the bridge code unit, and add the backup binding code address to the identification address index table and store it corresponding to the binding function ID.

[0079] Exemplarily, the identification address index table allows the repair unit to quickly find the backup binding code address corresponding to a binding function ID. When the repair unit obtains the binding function ID and the binding function ID already exists in the identification address index table, the repair unit can directly obtain the corresponding backup binding code address and return it to the game module, which simplifies code management and improves the efficiency of code access and execution.

[0080] The binding function ID and the backup binding code address are stored in the identification address index table to establish a mapping relationship. In this way, in subsequent function calls, the corresponding code address can be quickly found directly through the binding function ID.

[0081] To better understand the solution provided in this example, this example is further explained in combination with specific application scenarios.

[0082] Assume that the binding function information, backup binding code and second jump instruction are all stored in the newly added PE section in the anti-plug-in module. When the repair unit is running, define an identification address index table, which can be a static map, for saving the binding function ID and the backup binding code address. When the repair unit obtains a binding function ID and finds that the binding function ID does not exist in the identification address index table, obtain the address of the PE section, then compare the incoming binding function ID, and read the corresponding binding function information. For example, first read the encrypted backup binding code and the second jump instruction according to the first address of the backup binding code in the anti-plug-in module, that is, the offset of the backup binding code in the PE section, and decrypt it; then perform binary instruction obfuscation on the backup binding code and the second jump instruction, and write the obfuscated backup binding code and the second jump instruction into the space reserved behind the PE section. The address of the obfuscated backup binding code = the address of the PE section + the size of the statically used space in the PE section.

[0083] Optionally, in order to allow the binding code to be loaded smoothly, before the backup binding code and the second jump instruction are binary-obfuscated, the backup binding code can be repaired with relocation items based on the binding function information. For example, read the string of the game module name to obtain the loading base address of the game module; read the relocation item list and repair each relocation item in the binding code: calculate the difference between the loading base address of the game module and the default relocation base address of the game module. This difference is the offset that needs to be added to each address that needs to be corrected. Add the calculated offset to the value of the current address to complete the relocation correction. After that, repair the offset of the second jump instruction: offset = (loading base address of the game module + offset of the end position of the binding code in the game module) - (address of the PE section + offset of the backup binding code in the PE section + size of the binding code + size of the second jump instruction).

[0084] In this embodiment, when the game module is running, the anti-plug-in module uses the binding function ID transmitted by the bridge code unit to obtain the backup binding code address through the repair unit, and establishes a mapping relationship between the binding function ID and the backup binding code address in the identification address index table, thereby realizing dynamic protection and rapid recovery of key game functions. When it is found that a binding function ID is missing in the identification address index table, the anti-plug-in module can determine the address of the backup binding code by matching the binding function information, and perform decryption and instruction obfuscation, thereby increasing the difficulty of plug-in analysis and tampering. This mechanism not only improves the security of the game and prevents illegal access to key functions by plug-ins, but also effectively resists reverse engineering attacks through instruction obfuscation technology.

[0085] Based on the above embodiments of the present application, in the sixth embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and will not be described in detail later. Figure 6 After step A23, the anti-cheating code binding method further includes step A25: Step A25: Replace the backup binding code at a position corresponding to the first address in the anti-cheating module with random data.

[0086] In this embodiment, after the backup binding code and the second jump instruction are obfuscated and stored, the location where the backup binding code and the second jump instruction originally reside, i.e., the location corresponding to the first address, is filled with random data, so that the original binding code will not exist in the anti-plug-in module, and even if the plug-in program or malware attempts to analyze or tamper with the code of the anti-plug-in module, it is difficult to accurately find and locate the original binding code and the second jump instruction. The obfuscated backup binding code and the second jump instruction in the anti-plug-in module further increase the difficulty of restoring the code, thereby enhancing the anti-stripping effect of the anti-plug-in module.

[0087] Based on the above embodiments of the present application, in the seventh embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and no further description will be given later. On this basis, the fifth embodiment proposes an anti-cheating code binding method, which is applied to the game module, please refer to Figure 7 The anti-cheating code binding method includes steps B10 to B30: Step B10: Sending the identifier of the binding function to the repair unit through the bridge code unit.

[0088] Step B20: receiving a backup binding code address sent by the repair unit based on the identifier.

[0089] Step B30: running the backup binding code based on the backup binding code address.

[0090] In this embodiment, when the game module is started, the identifier of the binding function corresponding to the binding code is sent to the repair unit through the bridge code unit. The repair unit in the anti-cheating module will search for the corresponding backup binding code in the anti-cheating module according to the received identifier, and return the memory address of the code to the bridge code unit. The bridge code unit will use the received backup binding code address to load and execute the backup binding code from the anti-cheating module. In this way, the runtime logic of the game code remains unchanged, but the logic of the game code normally relies on the support of the anti-cheating module, which ensures the deep binding of the anti-cheating module and the game module and enhances the anti-peeling effect of the anti-cheating module.

[0091] For example, in order to help understand the implementation process of the anti-cheating code binding method obtained by combining this embodiment with the above-mentioned embodiment 1, please refer to Figure 8 , Figure 8A brief flow diagram of an anti-cheating code binding method is provided, specifically: first add a first code section to a game module, and add a second code section to an anti-cheating module. Then write a bridge code unit in the game module, and add an import function item to point to a repair unit in the anti-cheating module. First copy the binding code in the game module, obtain the binding function information, and then add a first jump instruction at the starting position of the binding code, the first jump instruction is used to execute S1 to jump to the bridge code unit. After jumping to the bridge code unit, remove the first jump instruction in the game module, and fill the corresponding code space of the binding code with random data. Then write the obtained binding function information into the second code section in the anti-cheating, wherein the second code section also saves the size of the space used statically in the second code section and the number of binding functions. Back up the copied binding code to the second code section to form a backup binding code, and add a second jump instruction at the end of the backup binding code. When the game starts, the game module executes S2 to pass the binding function ID to the repair unit of the anti-cheating module by importing the function item. The repair unit returns the backup binding code address. Then the game module executes S3 to run the backup binding code through the backup binding code address to complete the operation of the game's key code. After that, S4 is executed to jump back to the subsequent code part of the original binding code in the game module through the second jump instruction to continue executing other codes of the game module.

[0092] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the anti-cheating code binding method of the present application. More simple transformations based on this technical concept are all within the protection scope of the present application.

[0093] The present application provides an anti-cheating code binding device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the anti-cheating code binding method in the above-mentioned embodiment one.

[0094] Reference below Fig. 9 , which shows a schematic diagram of the structure of an anti-cheating code binding device suitable for implementing the embodiment of the present application. The anti-cheating code binding device in the embodiment of the present application may include but is not limited to mobile terminals such as laptops, PADs (Portable Application Description: tablet computers), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig. 9 The anti-cheating code binding device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0095] like Fig. 9As shown, the anti-cheating code binding device may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the anti-cheating code binding device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the anti-cheating code binding device to communicate wirelessly or wired with other devices to exchange data. Although the anti-cheating code binding device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0096] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0097] The anti-cheating code binding device provided by the present application adopts the anti-cheating code binding method in the above embodiment, which can solve the technical problem of preventing the game from bypassing the anti-cheating module. Compared with the prior art, the beneficial effects of the anti-cheating code binding device provided by the present application are the same as the beneficial effects of the anti-cheating code binding method provided by the above embodiment, and the other technical features in the anti-cheating code binding device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0098] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0099] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0100] The present application also provides a computer program product, including a computer program, which implements the steps of the anti-cheating code binding method as described above when executed by a processor.

[0101] The computer program product provided by the present application can solve the technical problem of preventing the game from bypassing the anti-cheating module. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the anti-cheating code binding method provided by the above embodiment, which will not be repeated here.

[0102] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. An anti-cheating code binding method, characterized in that: The method comprises: Adding a first jump instruction at the start position of the binding code in the game module, wherein the first jump instruction points to a bridge code unit in the game module, and the bridge code unit points to a repair unit in the anti-cheating module, wherein the repair unit is used to determine a backup binding code address, and the bridge code unit is used to obtain the backup binding code address sent by the repair unit, so that the game module runs the backup binding code based on the backup binding code address; The binding code is copied to the anti-cheating module as the backup binding code, and a second jump instruction is added at the end of the backup binding code, wherein the second jump instruction points to the game module, so that after the backup binding code in the anti-cheating module is run, the second jump instruction returns to the game module and runs subsequent codes; The position corresponding to the binding code in the game module is replaced with random data.

2. The anti-cheating code binding method according to claim 1, characterized in that: After the step of adding the first jump instruction at the start position of the binding code in the game module, the method further comprises: Based on the binding code, determining binding function information; Adding the binding function information to the anti-cheating module; Determine a first address of the backup binding code in the anti-cheating module, and save the first address in the binding function information.

3. The anti-cheating code binding method according to claim 2, characterized in that: Before the step of adding the first jump instruction at the start position of the binding code in the game module, the step further includes: Adding a first code section in the game module, wherein the first code section is used to store the bridge code corresponding to the bridge code unit; An import function item is added in the bridging code unit, wherein the import function item is used to import a repair function corresponding to the repair unit of the anti-plug-in module, and the repair function is used to determine the backup binding code address according to an identifier of a binding function.

4. The anti-cheating code binding method according to claim 2, characterized in that: Before the step of adding the first jump instruction at the start position of the binding code in the game module, the step further includes: A second code section is added to the anti-cheating module, and the second code section is used to store the binding function information, the backup binding code, the second jump instruction, and the obfuscated backup binding code and the second jump instruction.

5. An anti-cheating code binding method, characterized in that: Applied to the anti-cheating module, the method includes: Receiving, by the repair unit, an identifier of a binding function sent by the bridge code unit in the game module; If the identifier does not exist in the identification address index table, the repair unit determines the backup binding code address based on the identifier and binding function information, and sends the backup binding code address to the bridging code unit so that the game module runs the backup binding code based on the backup binding code address.

6. The anti-cheating code binding method according to claim 5, characterized in that: The step of determining the backup binding code address according to the identifier and the binding function information by the repair unit comprises: Based on the identifier, matching the corresponding binding function information, determining the first address of the backup binding code in the anti-cheating module; Based on the first address, obtaining the backup binding code and a second jump instruction; Obfuscating the backup binding code and the second jump instruction, and saving the obfuscated backup binding code and the second jump instruction; Determine a second address of the obfuscated backup binding code in the anti-cheating module, and use the second address as the backup binding code address.

7. The anti-cheating code binding method according to claim 6, characterized in that: After the step of obfuscating the backup binding code and the second jump instruction and saving the obfuscated backup binding code and the second jump instruction, the method further includes: The position of the backup binding code corresponding to the first address in the anti-cheating module is replaced with random data.

8. An anti-cheating code binding method, characterized in that: Applied to the game module, the method comprises: Sending an identifier of the binding function to the repair unit via the bridge code unit; receiving a backup binding code address sent by the repair unit based on the identifier; Based on the backup binding code address, the backup binding code is run.

9. An anti-cheating code binding device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the anti-cheating code binding method according to any one of claims 1 to 8.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the anti-cheating code binding method according to any one of claims 1 to 8 are implemented.

Images