Anti-external hanging code binding method, device and program product

Abstract

The application discloses an anti-external hanging code binding method, device and program product, and relates to the technical field of game security. The method adds a first jump instruction pointing to a bridge code unit at the starting position of the game module binding code, and designs the bridge code unit to point to a repair unit in the anti-external hanging module, so as to obtain the backup binding code address sent by the repair unit. Further, the original binding code is copied to the anti-external hanging module, and a second jump instruction pointing to the game module is added after the backup code. The second jump instruction points to the game module, so that after the backup binding code is executed, the game module is returned to and the subsequent code is executed through the second jump instruction. Finally, the original binding code position in the game module is filled with random data, so that the effect that the game cannot be normally played without loading the anti-external hanging module is achieved, the code binding strength of the anti-external hanging module is enhanced, and the game can be prevented from bypassing the anti-external hanging module and running.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of game security, and particularly relates to an anti-hacking code binding method, device and program product. BACKGROUND

[0002] Currently, because there is a significant difference between the technical expertise required for the development of anti-hacking technology and the development of game content, few developers can be proficient in both fields, so the anti-hacking module is usually developed independently of the game module. This independent module design allows game developers to focus their main efforts on the design of game content and gameplay, without having to delve into the details of complex anti-hacking technology. The anti-hacking module can hijack the game startup process after the game module is compiled by using binary hardening technology, ensuring that the anti-hacking module is automatically loaded and executed when the game starts, thereby achieving the effect of anti-hacking.

[0003] However, this independence also poses a certain security risk. If the hacking developer can successfully identify and bypass the startup mechanism of the anti-hacking module, so that the anti-hacking module cannot be normally loaded, the game module can still run unaffected. In this case, the game will lose the ability to monitor and defend against hacking behavior, which may threaten the fairness and security of the game.

[0004] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0005] The main purpose of the present application is to provide an anti-hacking code binding method, device and program product, aiming to solve the technical problem of how to prevent the game from bypassing the anti-hacking module to run.

[0006] To achieve the above purpose, the present application provides an anti-hacking code binding method, which comprises:

[0007] A first jump instruction is added to the start position of the binding code in the game module, the first jump instruction points to a bridge code unit in the game module, the bridge code unit points to a repair unit in the anti-hacking module, wherein the repair unit is used to determine a backup binding code address, and the bridge code unit is used to obtain the backup binding code address sent by the repair unit, so that the game module runs the backup binding code based on the backup binding code address;

[0008] copy the binding code into the anti-hooking module as the backup binding code, and add a second jump instruction at the end of the backup binding code, the second jump instruction pointing to the game module, so that after the backup binding code in the anti-hooking module is executed, the game module is returned through the second jump instruction and subsequent code is executed;

[0009] replace the position corresponding to the binding code in the game module with random data.

[0010] In an embodiment, after the step of adding a first jump instruction at the start position of the binding code in the game module, it includes:

[0011] determine the binding function information based on the binding code;

[0012] add the binding function information to the anti-hooking module;

[0013] confirm the address information of the backup binding code in the anti-hooking module, and save the address information to the binding function information.

[0014] In an embodiment, before the step of adding a first jump instruction at the start position of the binding code in the game module, it further includes:

[0015] add a first code section to the game module, the first code section being used to store the bridge code corresponding to the bridge code unit;

[0016] add an import function item in the bridge code unit, the import function item being used to import the repair function corresponding to the repair unit of the anti-hooking module, the repair function being used to determine the backup binding code address according to the identifier of the binding function.

[0017] In an embodiment, before the step of adding a first jump instruction at the start position of the binding code in the game module, it further includes:

[0018] add a second code section to the anti-hooking module, the second code section being used to store the binding function information, the backup binding code, the second jump instruction, and the backup binding code and the second jump instruction after obfuscation.

[0019] In addition, in order to achieve the above-mentioned purpose, the present application also provides an anti-hooking code binding method applied to an anti-hooking module, the method comprising:

[0020] receive the identifier of the binding function sent by the bridge code unit in the game module through the repair unit;

[0021] If the identifier does not exist in the identifier address index table, the backup binding code address is determined by the repair unit according to the identifier and the binding function information, and the backup binding code address is sent to the bridge code unit, so that the game module runs the backup binding code based on the backup binding code address.

[0022] In an embodiment, the step of determining the backup binding code address by the repair unit according to the identifier and the binding function information comprises:

[0023] Based on the identifier, the corresponding binding function information is matched, and the first address of the backup binding code in the anti-hacking module is determined;

[0024] Based on the first address, the backup binding code and the second jump instruction are obtained;

[0025] The backup binding code and the second jump instruction are subjected to instruction obfuscation, and the obfuscated backup binding code and the second jump instruction are saved;

[0026] The second address of the obfuscated backup binding code in the anti-hacking module is determined, and the second address is taken as the backup binding code address.

[0027] In an embodiment, after the step of obfuscating the backup binding code and the second jump instruction, and saving the obfuscated backup binding code and the second jump instruction, the method further comprises:

[0028] The first address of the backup binding code in the anti-hacking module is replaced with random data.

[0029] In addition, to achieve the above-mentioned purpose, the present application also proposes an anti-hacking code binding method applied to a game module, the method comprising:

[0030] The identifier of the binding function is sent to the repair unit by the bridge code unit;

[0031] The backup binding code address sent by the repair unit based on the identifier is received;

[0032] Based on the backup binding code address, the backup binding code is run.

[0033] In addition, to achieve the above-mentioned purpose, the present application also proposes an anti-hacking code binding device, comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the anti-hacking code binding method as described above.

[0034] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the anti-cheat code binding method described above.

[0035] This application provides an anti-cheat code binding method. It involves adding a first jump instruction pointing to a bridging code unit at the beginning of the binding code in the game module. This bridging code unit points to a repair unit within the anti-cheat module to obtain the address of the backup binding code sent by the repair unit. This allows the game module to run the backup binding code based on that address. Further, the original binding code is copied to the anti-cheat module, and a second jump instruction pointing to the game module is added after the backup code. This second jump instruction ensures that after the backup binding code in the anti-cheat module completes its execution, the second jump instruction returns to the game module to run subsequent code. Finally, the original binding code location in the game module is filled with random data. These steps effectively remove the critical binding code portion from the game module, preventing normal gameplay without loading the anti-cheat module. This strengthens the code binding of the anti-cheat module and prevents the game from bypassing it. Attached Figure Description

[0036] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0037] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a flowchart illustrating an embodiment of the anti-cheat code binding method of this application.

[0039] Figure 2 This is a flowchart illustrating Embodiment 2 of the anti-cheat code binding method of this application;

[0040] Figure 3 This is a flowchart illustrating Embodiment 3 of the anti-cheat code binding method of this application;

[0041] Figure 4 This is a flowchart illustrating Embodiment 4 of the anti-cheat code binding method of this application;

[0042] Figure 5 This is a flowchart illustrating Embodiment 5 of the anti-cheat code binding method of this application;

[0043] Figure 6 A flowchart provided for the anti-hacking code binding method embodiment six of the present application;

[0044] Figure 7 A flowchart provided for the anti-hacking code binding method embodiment seven of the present application;

[0045] Figure 8 A flowchart provided for the anti-hacking code binding method embodiment seven of the present application;

[0046] Figure 9 A flowchart provided for the anti-hacking code binding method embodiment seven of the present application;

[0047] The object, function features and advantages of the present application will be further explained with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0048] It should be understood that the specific embodiments described herein are merely intended to explain the technical solutions of the present application, and not to limit the present application.

[0049] In order to better understand the technical solutions of the present application, the following will be described in detail in conjunction with the drawings and specific embodiments.

[0050] At present, because there is a significant difference between the technical expertise required for the development of anti-hacking technology and the development of game content, few developers can master both fields, so the anti-hacking module is usually developed independently of the game module. This independent module design allows game developers to focus their main efforts on game content and gameplay design, without having to delve into the details of complex anti-hacking technology. The anti-hacking module can hijack the game startup process after the game module is compiled by using binary hardening technology, ensuring that the anti-hacking module is automatically loaded and executed when the game starts, thereby achieving the effect of anti-hacking.

[0051] However, this independence also poses a certain security risk. If the hacking developer can successfully identify and bypass the startup mechanism of the anti-hacking module, so that the anti-hacking module cannot be normally loaded, the game module can still run unaffected. In this case, the game will lose the ability to monitor and defend against hacking behavior, which may threaten the fairness and security of the game.

[0052] In view of the above problems, the present application provides an anti-hacking code binding method, which adds a first jump instruction pointing to a bridge code unit at the start of the binding code in the game module, and designs the bridge code unit to point to a repair unit in the anti-hacking module to obtain a backup binding code address. Further, the original binding code is encrypted and backed up to the anti-hacking module, and a second jump instruction pointing to the game module is added after the backup code. Finally, the original binding code position in the game module is filled with random data. The above steps make the key binding code part in the game module be erased from the game module, so as to achieve the effect that the game cannot be normally played without loading the anti-hacking module, enhance the code binding strength of the anti-hacking module, and prevent the game from running around the anti-hacking module.

[0053] It should be noted that the execution subject of the present embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions. The present embodiment and the following embodiments will be described below by taking an anti-hacking device as an example.

[0054] Based on this, the first embodiment of the present application provides an anti-hacking code binding method, which is described with reference to Figure 1 In the present embodiment, the anti-hacking code binding method comprises steps S10-S30:

[0055] Step S10, a first jump instruction is added at the start position of the binding code in the game module, the first jump instruction points to a bridge code unit in the game module, the bridge code unit points to a repair unit in the anti-hacking module, wherein the repair unit is used to determine a backup binding code address, and the bridge code unit is used to obtain the backup binding code address sent by the repair unit, so that the game module runs the backup binding code based on the backup binding code address.

[0056] It should be noted that the game module refers to the main program part of the game, which contains the logic, rendering, input and other codes of the game. The binding code is a selected game code segment used for deep binding with the anti-hacking module.

[0057] It should be noted that the first jump instruction is a machine instruction used to jump to another location in the game module at a specific location. In this embodiment, the purpose of this instruction is to set a "hook" at the start of the bound code in the game module, so that when the game starts, the execution flow can be redirected to the anti-hack module to start executing the backup bound code migrated from the game module. This step can achieve dynamic linking between the game module and the anti-hack module. By inserting jump instructions at key code locations in the game module, the anti-hack device can capture calls to these key codes when the game is running, ensuring that the anti-hack module has the opportunity to verify and repair these calls.

[0058] For example, first, the developer needs to manually select some key functions that are frequently called during the game process as binding objects. These functions are usually the core part of the game logic and the place where the hacking program is most likely to try to modify or bypass. Using the symbol file generated during the game compilation process, such as the.pdb file, the developer can obtain the names of all functions and their corresponding memory addresses. This helps to accurately locate the key code positions that need to be bound. In the binary file of the game module, find the starting position of the selected function and insert a jump instruction such as jmp instruction at this position. The target address of this instruction is the address of the bridge code unit in the game module. The bridge code unit is a special code located in the game module, which functions to save the current register environment, then call the repair unit in the anti-hack module and pass the binding function ID (Identifier, identifier) as a parameter. The repair unit returns the backup backup bound code address in the anti-hack module, and the bridge code unit restores the register environment and jumps to the bridge code unit address to continue executing the original game code.

[0059] Optionally, select the function that needs to be bound in the game module and insert multi-level jump instructions at its starting position. Each level of jump instruction points to an intermediate code segment, and finally points to the bridge code unit segment. By using multi-level jump, the difficulty of static analysis can be increased and the security of the anti-hack code can be improved.

[0060] For example, assume that there is a function func1 in the game module with an address of 0x6000. Insert a first level jump instruction at 0x6000 to jump to the intermediate code segment 0x7000. The intermediate code segment 0x7000 inserts a second level jump instruction to jump to the bridge code unit segment 0x8000. After the bridge code unit segment 0x8000 performs a series of operations, it jumps to the func3 code address in the anti-hack module for execution.

[0061] Optionally, when the game module is loaded, a trigger condition is set through dynamic analysis or modification. When the trigger condition is met, a jump instruction is dynamically inserted in the game module, and points to a dynamically generated bridge code unit, which is responsible for calling the repair unit in the anti-hacking module. Through dynamic generation and insertion, the detection of the static analysis tool of the plug-in is bypassed, and the difficulty of static analysis of the plug-in is increased.

[0062] Step S20, copy the binding code to the anti-hacking module as the backup binding code, and add a second jump instruction at the end of the backup binding code, the second jump instruction points to the game module, so that after the backup binding code in the anti-hacking module is executed, it returns to the game module through the second jump instruction and executes the subsequent code.

[0063] It should be noted that because the binding code is closely related to the game logic and needs to be protected from being tampered with or analyzed by plug-ins or malicious software, these codes can be encrypted and backed up to the anti-hacking module. Backup binding code refers to a copy of the binding code stored in the anti-hacking module, which can be restored or verified when necessary, thereby enhancing the security of the game.

[0064] Illustratively, the binding code that needs to be protected is extracted from the game module. A suitable encryption algorithm such as AES (Advanced Encryption Standard) is selected to encrypt the extracted binding code to ensure that the encrypted code cannot be easily cracked during storage and transmission. During encryption, a key or key pair can be generated for subsequent decryption operations. The encrypted code is backed up to a designated location in the anti-hacking module. In the anti-hacking module, a dedicated storage area can be set up to save these encrypted codes. When the binding code needs to be restored or verified, the encrypted code is decrypted using the previously generated key pair.

[0065] The encrypted second jump instruction is added at the end of the backup binding code, so that after the backup binding code is executed, the program flow can be safely guided back to the game module to continue executing the subsequent code. This not only ensures the normal operation of the game, but also effectively prevents plug-in software from tampering with the program flow to damage the integrity of the game.

[0066] Exemplarily, the jump target address is determined first. In the game module, a suitable jump target point is determined, which is the starting address of the code segment that needs to be executed after the backup binding code is executed. Then, according to the target address and the instruction set architecture of the current program, a corresponding second jump instruction is generated. The format and specific content of the jump instruction should comply with the specification of the instruction set architecture to ensure its correctness and executability. The second jump instruction is encrypted, and the encrypted second jump instruction and the backup binding code are stored in the anti-hacking module to avoid being easily obtained by hacking software.

[0067] In step S30, the position corresponding to the binding code in the game module is replaced with random data.

[0068] It should be noted that the random data refers to random binary data used to fill the original position of the binding code in the game module. The original position of the binding code in the game module is filled with randomly generated binary data. The purpose of this is to disrupt the disassembly process, making it difficult for hacking authors to determine the position and content of the binding code through static analysis, thereby increasing the difficulty of hacking.

[0069] Exemplarily, after the game module is compiled, all binding code positions in the compiled binary executable file are found, and then random data is generated to fill the binding code positions. The random data can be of any type, such as integer, floating point number, string, etc. Optionally, to ensure randomness, a random number generator such as the "rand()" function in C language or other random number library can be used to generate data.

[0070] In this embodiment, by inserting a jump instruction at the key code position in the game module, the execution flow is redirected to the anti-hacking module, and the binding code is encrypted and backed up to the anti-hacking module, and a jump instruction is added after the backup code to safely return to the game module. This design effectively enhances the binding strength of the anti-hacking code, not only improves the game security through dynamic linking and encryption backup, but also increases the difficulty of static analysis by filling random data in the game module, thereby effectively avoiding the hacking developer from identifying and bypassing the startup mechanism of the anti-hacking module, achieving the effect that the game module cannot run normally without the normal loading of the anti-hacking module, and protecting the integrity of the anti-hacking module and the fairness of the game.

[0071] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as the above embodiment one can be referred to the above introduction, and will not be described in detail. On this basis, please refer to Figure 2 , after step S10, the anti-hacking code binding method further includes steps S40-S60:

[0072] In step S40, based on the binding code, the binding function information is determined.

[0073] It should be noted that the binding function information refers to a collection of information about the function name, parameter type, return value type, function body address, etc. of the binding code, which is the key to understanding how the binding code works and how it is called.

[0074] Optionally, the binding code is parsed to extract metadata information such as function name, parameter, return value, and function address through static analysis or dynamic debugging tools. These information is recovered from the binary code using the symbol table or debugging information generated by the compiler, or through reverse engineering techniques.

[0075] Illustratively, the symbol file.pdb file of the game is parsed to export all symbols and their corresponding addresses, obtaining a symbol list. For each binding function corresponding to the binding code in the game module, the function name is matched with the symbol list to find the function address. If the address cannot be found, it means that the function has been canceled or modified in the new version, and it is skipped. From the function start position, the disassembly engine is used to disassemble each instruction, and the process is ended when a jump instruction is encountered, obtaining the size of the binary code that can be bound. In addition, according to all the relocation items contained in the binding code, the offset of each relocation item in the current binding code block is recorded to obtain a relocation item list. It should be noted that in a computer program, a relocation item is a data structure used to describe address information that needs to be modified in the program. When the program code is loaded into memory or when it is linked with other object files or target functions, these relocation items are processed to ensure that all address references in the program are correct.

[0076] In addition, the binding function information can include the binding function ID corresponding to the binding code, the address of the binding function in the game module, the offset of the game module name string, the number of relocation items contained in the binding code, etc.

[0077] Step S50, adding the binding function information to the anti-hacking module.

[0078] Adding binding function information to the anti-hacking module means allowing the anti-hacking module to recognize and monitor the behavior of these functions. For example, if the binding function is handling in-game transactions, the anti-hacking module can monitor the calling frequency and parameter values of the function to detect abnormal transaction behavior.

[0079] Step S60, determining the first address of the backup binding code in the anti-hacking module and saving the first address to the binding function information.

[0080] It should be noted that the address information of the backup binding code is confirmed and saved to the binding function information, so that the repair unit can accurately locate the backup binding code, so that when the game module executes to the position corresponding to the original binding code, the repair unit can decrypt and obfuscate the corresponding backup binding code according to the binding function information, to ensure the integrity of the game code logic.

[0081] Illustratively, after loading the backup binding code in the anti-hacking module, the address thereof, i.e., the first address, is obtained using a debugger or a memory analysis tool, and then the first address is associated with the binding function information. Memory space is allocated in the anti-hacking module through a memory management function such as VirtualAlloc, and the backup binding code is copied to the space, and then the start address of the space is recorded.

[0082] To better understand the scheme given in this example, the example is further described in combination with a specific application scenario.

[0083] Specifically, a PE section is first added in the anti-hacking module for storing the binding function information and the backup binding code. In the Windows operating system, the PE (Portable Executable) format is a file format used for executable files (.exe), object files (.obj), dynamic link libraries (.dll), and other executable contents. The PE section is a structure in the PE file, which represents a data area in the file, and is used to store code, data, resources, etc. In the added PE section, the size information of the statically used space in the PE section and the number information of the binding functions are first saved, and then the binding function information is saved, which includes the binding function ID, the address of the binding function in the game module, the size of the binding code, the offset of the string of the game module name in the PE section, the default relocation base of the game module, the number of relocation items contained in the binding code, the offset of the relocation item list in the PE section, the first address of the backup binding code in the anti-hacking module, i.e., the offset of the backup binding code in the PE section, etc. Then the string of the game module name, the relocation item list of all binding codes, the backup binding code, and the second jump instruction are saved, wherein the backup binding code and the second jump instruction are stored after encryption.

[0084] In this embodiment, the detailed information of the key functions in the game module is extracted through static analysis and dynamic debugging tools, and these information is integrated into the anti-hacking module, so as to be able to realize deep binding and monitoring of the core logic of the game. This process not only enhances the ability of the anti-hacking module, so that it can identify and monitor the behavior of the key functions, such as detecting abnormal transaction behavior, but also ensures that the original function of the binding code can be accurately restored when the game is started by backing up the key code in the anti-hacking module and recording the address information thereof.

[0085] Based on the above embodiments of the present application, in the third embodiment of the present application, the same or similar contents as the above embodiments can be referred to the above description, and the subsequent will not be described. On this basis, please refer to Figure 3 , before step S10, the anti-hook code binding method further comprises steps S70-S80:

[0086] Step S70, adding a first code section in the game module, the first code section is used to store the bridge code corresponding to the bridge code unit.

[0087] Step S80, adding an import function item in the bridge code unit, the import function item is used to import the repair function corresponding to the repair unit of the anti-hook module, and the repair function is used to determine the backup binding code address according to the identifier of the binding function.

[0088] It should be noted that the first code section is a special area newly added in the game module, which is used to store specific codes or data, such as PE section. This section is specially used to store bridge code units, which play a role in connecting the game module and the anti-hook module.

[0089] Exemplarily, in the compilation or linking stage of the game module, a new section is added in the binary file of the game module according to the needs. The attribute of this section is set as code section, so that the code in it can be executed at runtime. Enough space is reserved to store the bridge code, and it is ensured that the memory address of this section is valid at runtime. In the implementation of code binding stage, according to the needs, the import function item is added, so that the game module can call the repair function in the anti-hook module through the import function item at runtime.

[0090] In this embodiment, by adding a special first code section in the game module to store the bridge code, and adding an import function item in the bridge code unit to import the repair function of the anti-hook module, the scheme realizes the efficient communication and cooperation between the game module and the anti-hook module. This design enables the game module to directly call the repair function of the anti-hook module through the bridge code unit at runtime, obtain the backup binding code address, execute the binding code to successfully run the game, and ensure the deep binding of the game module and the anti-hook module.

[0091] Based on the above embodiments of the present application, in the fourth embodiment of the present application, the same or similar contents as the above embodiments can be referred to the above description, and the subsequent will not be described. On this basis, please refer to Figure 4 , before step S10, the anti-hook code binding method further comprises step S90:

[0092] Step S90, adding a second code section in the anti-hooking module, the second code section is used to store the binding function information, the backup binding code, the second jump instruction, and the obfuscated backup binding code and the second jump instruction.

[0093] In the embodiment, a second code section, for example, a new PE section, is added in the anti-hooking module, which is used to store the content related to the binding function, the backup binding code, the jump instruction, and the like. The above steps can improve the scalability and flexibility of the anti-hooking module, facilitate the subsequent addition of new functions or codes, and separate the key codes and instructions from other parts of the anti-hooking module, thereby reducing the coupling degree of the codes. Since the key codes and the jump instruction are centrally managed in the second code section, it is convenient to perform security measures such as encryption and obfuscation, and the security and stability of the anti-hooking module can be improved.

[0094] Based on the above embodiments, in the fifth embodiment of the present application, the same or similar content as the above embodiments can be referred to the above description, and will not be described hereinafter. On this basis, the fifth embodiment proposes an anti-hooking code binding method applied to an anti-hooking module, please refer to Figure 5 , the anti-hooking code binding method further includes steps A10-A20:

[0095] Step A10, receiving the identifier of the binding function sent by the bridge code unit in the game module through the repair unit.

[0096] It should be noted that each binding code block corresponds to a bridge code unit, which is used to save the register environment. The bridge code unit realizes the cross-module call of the repair unit in the anti-hooking module through the newly added import function, that is, the repair unit in the anti-hooking module, obtains the backup binding code address in the anti-hooking module, restores the register environment, and jumps to the backup binding code for execution.

[0097] When the game module starts running, the bridge code unit can transmit the binding function ID corresponding to the binding code to the repair unit in the anti-hooking module. The repair unit obtains the binding function ID and matches the corresponding binding function information according to the binding function ID to return the backup binding code address.

[0098] Step A20, if the identifier does not exist in the identifier address index table, determining the backup binding code address according to the identifier and the binding function information through the repair unit, and transmitting the backup binding code address to the bridge code unit, so that the game module runs the backup binding code based on the backup binding code address.

[0099] It should be noted that the identifier address index table is a mapping table for storing the mapping of the binding function ID and the corresponding backup binding code address, and is used to quickly find the corresponding backup binding code address according to the binding function ID. If an identifier does not exist in the identifier address index table, it means that the binding function is executed for the first time and has not been recorded, and at this time the backup binding code needs to be found to obtain the backup binding code address.

[0100] Optionally, the binding function ID is matched in the binding function information, and the first address of the corresponding backup binding code in the anti-hacking module, that is, the offset of the backup binding code in the PE section, is found as the backup binding code address.

[0101] Optionally, step A20 includes steps A21-A24:

[0102] Step A21, based on the identifier, matching the corresponding binding function information, determining the first address of the backup binding code in the anti-hacking module.

[0103] Step A22, based on the first address, obtaining the backup binding code and the second jump instruction.

[0104] The anti-hacking module receives the binding function ID passed by the bridge code unit, uses the received binding function ID as a key, finds the corresponding entry in the binding function information maintained inside the anti-hacking module, and extracts the address information of the backup binding code from the entry. According to the address information of the backup binding code, the backup binding code and the second jump instruction are read.

[0105] Step A23, the backup binding code and the second jump instruction are instruction obfuscated, and the obfuscated backup binding code and the second jump instruction are saved.

[0106] Step A24, determining the second address of the obfuscated backup binding code in the anti-hacking module, and taking the second address as the backup binding code address.

[0107] It should be noted that the purpose of instruction obfuscation is to change the number and complexity of instructions while ensuring the function of the instruction sequence does not change, and to increase the difficulty of reading and understanding instructions, thereby preventing malicious users or plug-in makers from reverse analyzing or tampering with instructions. The way of instruction obfuscation includes but is not limited to equivalent instruction replacement such as replacing one instruction with multiple instructions with the same function, control flow flattening such as converting simple control flow structures into complex and difficult to understand structures, and inserting useless instructions such as no-operation, conditional jump, etc.

[0108] Exemplarily, firstly, if the backup binding code and the second jump instruction are encrypted, the encryption manner used by the backup binding code and the second jump instruction is identified, then the encrypted code and instruction are restored to the original executable binary form by using the corresponding decryption algorithm and key. The obfuscated backup binding code and the second jump instruction are then saved to a secure storage location. The second address of the obfuscated backup binding code in the anti-hacking module is recorded as the backup binding code address.

[0109] It can be understood that, after the backup binding code is obfuscated, the number of instructions increases and the complexity is improved, and the code space of the original binding code in the game module will not be enough to accommodate these new instructions. If a hacking maker wants to bypass the anti-hacking module to load the game module, he needs to understand the logic and structure of the obfuscated code, and also convert it back to the original, unobfuscated instructions and write them into the original location in the game module, greatly increasing the difficulty of restoration, thereby enhancing the anti-disassembly effect of the anti-hacking module.

[0110] Optionally, the identifier and the backup binding code address are stored in association in the identification address index table. When the repair unit receives the identifier of the binding function sent by the bridge code unit, the identifier is matched in the identification address index table, and if the identifier exists in the identification address index table, the backup binding code address is determined based on the identification address index table.

[0111] Wherein, when the backup binding code is executed for the first time, the repair unit decrypts and obfuscates the backup binding code, then returns the backup binding code address to the bridge code unit, and adds the backup binding code address to the identification address index table, which is stored in correspondence with the binding function ID.

[0112] Exemplarily, the identification address index table allows the repair unit to quickly find the backup binding code address corresponding to a certain binding function ID. When the repair unit obtains the binding function ID and the binding function ID already exists in the identification address index table, the repair unit can directly obtain the corresponding backup binding code address and return it to the game module, simplifying the code management and improving the efficiency of code access and execution.

[0113] The binding function ID and the backup binding code address are stored in the identification address index table to establish a mapping relationship. In this way, in subsequent function calls, the corresponding code address can be quickly found through the binding function ID.

[0114] To better understand the scheme given in this example, the example is further described in conjunction with a specific application scenario.

[0115] Assuming that the binding function information, the backup binding code and the second jump instruction are stored in the newly added PE section of the anti-hacking module. When the repair unit is running, an identification address index table is defined, which can be a static map, used to save the binding function ID and the backup binding code address. When the repair unit obtains a binding function ID and finds that the identification address index table does not exist for the binding function ID, the address of the PE section is obtained, and then the binding function ID is compared, and the corresponding binding function information is read. For example, first, the encrypted backup binding code and the second jump instruction are read according to the first address of the backup binding code in the anti-hacking module, that is, the offset of the backup binding code in the PE section, and then decrypted; and then the backup binding code and the second jump instruction are subjected to binary instruction obfuscation, and the obfuscated backup binding code and the second jump instruction are written into the reserved space behind the PE section, and the obfuscated backup binding code address = the address of the PE section + the size of the statically used space in the PE section.

[0116] Optionally, in order to enable the binding code to be successfully loaded, before the backup binding code and the second jump instruction are subjected to binary instruction obfuscation, the backup binding code can be subjected to relocation item repair according to the binding function information. For example, the string of the game module name is read, and the loading base address of the game module is obtained; the relocation item list is read, and each relocation item in the binding code is repaired: the difference between the loading base address of the game module and the default relocation base address of the game module is calculated, and the difference is the offset that needs to be added to each address that needs to be corrected. The calculated offset is added to the value of the current address to complete the relocation correction. Then, the offset of the second jump instruction is repaired: offset = (the loading base address of the game module + the offset of the end position of the binding code in the game module) - (the address of the PE section + the offset of the backup binding code in the PE section + the size of the binding code + the size of the second jump instruction).

[0117] In the embodiment, when the game module is running, the anti-hacking module uses the binding function ID delivered by the bridging code unit to obtain the backup binding code address through the repair unit, and establishes the mapping relationship between the binding function ID and the backup binding code address in the identification address index table, thereby achieving dynamic protection and rapid recovery of the game key function. When it is found that a certain binding function ID is missing in the identification address index table, the anti-hacking module can determine the address of the backup binding code by matching the binding function information, and perform decryption and instruction obfuscation, thereby increasing the difficulty of hacking analysis and tampering. This mechanism not only improves the security of the game and prevents illegal access to the key function by the hacking, but also effectively resists reverse engineering attacks through the instruction obfuscation technology.

[0118] Based on the above embodiments of the present application, in the sixth embodiment of the present application, the same or similar contents as the above embodiments can be referred to the above description, and will not be described hereinafter. On this basis, please refer toFigure 6 After step A23, the anti-hooking code binding method further comprises step A25:

[0119] Step A25: replacing the position corresponding to the first address of the backup binding code in the anti-hooking module with random data.

[0120] In this embodiment, after the backup binding code and the second jump instruction are mixed and stored, the position corresponding to the first address where the backup binding code and the second jump instruction originally exist is filled with random data. Thus, the original binding code does not exist in the anti-hooking module. Even if the hooking program or malicious software attempts to analyze or tamper with the code of the anti-hooking module, it is difficult to accurately find and locate the original binding code and the second jump instruction. The mixed backup binding code and the second jump instruction in the anti-hooking module further increase the difficulty of restoring the code and enhance the anti-peeling effect of the anti-hooking module.

[0121] Based on the above embodiments of the present application, in the seventh embodiment of the present application, the same or similar contents as the above embodiments can be referred to the above description, and will not be described in detail. On this basis, the fifth embodiment proposes an anti-hooking code binding method applied to a game module, please refer to Figure 7 The anti-hooking code binding method comprises steps B10-B30:

[0122] Step B10: sending an identifier of a binding function to a repair unit through a bridging code unit.

[0123] Step B20: receiving a backup binding code address sent by the repair unit based on the identifier.

[0124] Step B30: running the backup binding code based on the backup binding code address.

[0125] In this embodiment, when the game module starts, the bridging code unit sends an identifier of a binding function corresponding to the binding code to the repair unit. The repair unit in the anti-hooking module will find the corresponding backup binding code in the anti-hooking module according to the received identifier, and return the memory address of the code to the bridging code unit. The bridging code unit will load and execute the backup binding code from the anti-hooking module using the received backup binding code address. In this way, the runtime logic of the game code remains unchanged, but the logic of the game code normally depends on the support of the anti-hooking module, which ensures the deep binding of the anti-hooking module and the game module and enhances the anti-peeling effect of the anti-hooking module.

[0126] For example, in order to help understand the implementation process of the anti-hooking code binding method obtained by combining the above embodiments with the first embodiment, please refer to Figure 8 , Figure 8A brief flowchart of an anti-hacking code binding method is provided, specifically: a first code section is added in a game module, and a second code section is added in an anti-hacking module. Then a bridging code unit is written in the game module, and an import function item is added, which points to a repair unit in the anti-hacking module. The binding code in the game module is copied first, and the binding function information is obtained, then a first jump instruction is added at the start position of the binding code, and the first jump instruction is used to execute S1 to jump to the bridging code unit. After jumping to the bridging code unit, the first jump instruction in the game module is removed, and the corresponding code space of the binding code is filled with random data. Then the obtained binding function information is written into the second code section in the anti-hacking module, and the second code section also saves the size of the space statically used in the second code section and the number of binding functions. The copied binding code is backed up to the second code section to form a backup binding code, and a second jump instruction is added at the end of the backup binding code. When the game starts, the game module executes S2 to pass the binding function ID into the repair unit of the anti-hacking module through the import function item, the repair unit returns the backup binding code address, then the game module executes S3 to run the backup binding code through the backup binding code address, to complete the running of the game critical code, and then executes S4 to jump back to the subsequent code part of the original binding code in the game module through the second jump instruction, to continue to execute other codes of the game module.

[0127] It should be noted that the above examples are only used for understanding the present application, and do not constitute a limitation on the anti-hacking code binding method of the present application, and more forms of simple transformation based on this technical concept are within the protection scope of the present application.

[0128] The present application provides an anti-hacking code binding device, which comprises: at least one processor; and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the anti-hacking code binding method in Embodiment I.

[0129] Reference will be made to the following description Figure 9 which shows a structural schematic diagram of an anti-hacking code binding device suitable for being used to implement the embodiments of the present application. The anti-hacking code binding device in the embodiments of the present application can include but is not limited to mobile terminals such as notebook computers, PAD (Portable Application Description: tablet computers), and fixed terminals such as digital TVs and desktop computers. Figure 9 The illustrated anti-hacking code binding device is only an example, and should not bring any limitation on the functions and use range of the embodiments of the present application.

[0130] As Figure 9As shown, the anti-hook code binding device can include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 1002 or programs loaded from a storage device 1003 into a random access memory (RAM) 1004. In the RAM 1004, various programs and data required for the operation of the anti-hook code binding device are also stored. The processing device 1001, the ROM 1002, and the RAM 1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; the storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the anti-hook code binding device to communicate with other devices wirelessly or by wire to exchange data. Although the anti-hook code binding device with various systems is shown in the figure, it should be understood that all the shown systems are not required to be implemented or possessed. More or fewer systems can be alternatively implemented or possessed.

[0131] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by a communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the methods of the embodiments of the present disclosure are performed.

[0132] The anti-hook code binding device provided by the present application adopts the anti-hook code binding method in the above-mentioned embodiments, and can solve the technical problem of preventing game bypassing the anti-hook module to run. Compared with the prior art, the anti-hook code binding device provided by the present application has the same beneficial effects as the anti-hook code binding method provided by the above-mentioned embodiments, and other technical features in the anti-hook code binding device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0133] It should be understood that various parts of the present application can be realized in hardware, software, firmware, or a combination thereof. In the description of the above-mentioned embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0134] The above merely provides a part of the embodiments of the present application, but the protection scope of the present application is not limited to this, any person skilled in the art can easily think of the changes or replacements within the technical scope disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0135] The present application also provides a computer program product comprising a computer program, which, when executed by a processor, implements the steps of the anti-hacking code binding method as described above.

[0136] The computer program product provided by the present application can solve the technical problem of preventing game bypassing the anti-hacking module from running. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as those of the anti-hacking code binding method provided by the above-mentioned embodiments, which will not be described here.

[0137] The above merely provides a part of the embodiments of the present application, but the protection scope of the present application is not limited to this, any person skilled in the art can easily think of the changes or replacements within the technical scope disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method of anti-hook code binding, characterized by, The method comprises: adding a second code section in the anti-hooking module; adding a first jump instruction at the start position of the binding code in the game module, the first jump instruction pointing to a bridge code unit in the game module, the bridge code unit pointing to a repair unit in the anti-hooking module, wherein the repair unit is used to determine a backup binding code address, and the bridge code unit is used to obtain the backup binding code address sent by the repair unit, so that the game module runs backup binding code based on the backup binding code address; determining binding function information based on the binding code; adding the binding function information into the anti-hooking module; determining a first address of the backup binding code in the anti-hooking module and saving the first address into the binding function information; copying the binding code into the anti-hooking module as the backup binding code, and adding a second jump instruction at the end position of the backup binding code, the second jump instruction pointing to the game module, so that after the backup binding code in the anti-hooking module is run to the end, the game module is returned through the second jump instruction and subsequent code is run; replacing the position corresponding to the binding code in the game module with random data, wherein the second code section is used to store the binding function information, the backup binding code, the second jump instruction, and the backup binding code and the second jump instruction after obfuscation.

2. The anti-hooking code binding method of claim 1, wherein, Before the step of adding a first jump instruction at the start position of the binding code in the game module, the method further comprises: adding a first code section in the game module, the first code section being used to store bridge code corresponding to the bridge code unit; adding an import function item in the bridge code unit, the import function item being used to import a repair function corresponding to the repair unit of the anti-hooking module, the repair function being used to determine the backup binding code address according to an identifier of a binding function.

3. The anti-hooking code binding method of claim 1, wherein, The method applied to an anti-hooking module comprises: receiving, by the repair unit, an identifier of a binding function sent by the bridge code unit in the game module; if the identifier does not exist in an identifier address index table, determining, by the repair unit, a backup binding code address according to the identifier and the binding function information, and sending the backup binding code address to the bridge code unit, so that the game module runs backup binding code based on the backup binding code address.

4. The anti-hooking code binding method of claim 3, wherein, The step of determining, by the repair unit, a backup binding code address according to the identifier and the binding function information comprises: based on the identifier, matching corresponding binding function information to determine a first address of the backup binding code in the anti-hooking module; based on the first address, obtaining the backup binding code and a second jump instruction; obfuscating the backup binding code and the second jump instruction, and saving the backup binding code and the second jump instruction after obfuscation; determining a second address of the obfuscated backup binding code in the anti-hacking module, and taking the second address as the backup binding code address.

5. The anti-hooking code binding method of claim 4, wherein, After the step of performing instruction obfuscation on the backup binding code and the second jump instruction, and saving the obfuscated backup binding code and the second jump instruction, the method further comprises: replacing a position corresponding to a first address of the backup binding code in the anti-hacking module with random data.

6. The anti-hook code binding method of claim 1, wherein, The method is applied to a game module, and the method comprises: sending, by the bridge code unit, an identifier of a binding function to the repair unit; receiving, by the bridge code unit, the backup binding code address sent by the repair unit based on the identifier; running the backup binding code based on the backup binding code address.

7. An anti-hooking code binding device, characterized by, The device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the anti-hacking code binding method according to any one of claims 1 to 6.

8. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program is executable by a processor to implement the steps of the anti-hacking code binding method according to any one of claims 1 to 6.

Images