A penetration testing method for Android games

Abstract

The present invention provides a penetration testing method for Android games, relating to the fields of game security testing and penetration testing technology. The method comprises: analyzing game files, identifying the game engine type, and extracting key components to obtain engine identification, version information, and key file list information; based on this information, analyzing decompiled bytecode, Smash code, dynamic library files, and resource scripts, locating anti-debugging mechanisms and encryption algorithms, and obtaining a hook framework. Through cross-engine adaptation, automated detection, and anti-detection and security mechanism bypass capabilities, the present invention improves the efficiency and concealment of penetration testing, reduces labor costs, and enhances the effectiveness and comprehensiveness of penetration testing.

Description

Technical Field

[0001] The present invention relates to the technical field of game security testing and penetration testing, and in particular to a penetration testing method for Android games. Background Art

[0002] Traditional penetration testing technologies mostly rely on a single engine or a specific environment for testing, which results in poor adaptability when facing a variety of game engines.

[0003] For example, an Android game was developed using the Unity engine, but traditional penetration testing tools only support testing against that single engine. In this case, testers would need to spend considerable time and effort finding or developing testing tools suitable for the Unity engine, which undoubtedly increased the difficulty and cost of testing. Another game was compiled using IL2CPP (Intermediate Language to C++) technology, which makes the game code more difficult to reverse engineer and dynamically debug. Traditional penetration testing tools are often unable to effectively hook and intercept IL2CPP-compiled games, and are unable to obtain key runtime information.

[0004] Furthermore, traditional penetration testing techniques require testers to possess advanced reverse engineering capabilities and specialized knowledge, and the testing process often involves significant manual intervention and a low degree of automation. When analyzing network communications, traditional techniques may require testers to manually intercept network request packets and analyze key information one by one, which is not only inefficient but also prone to errors.

[0005] For example, when games use complex encrypted communication protocols, manual analysis can miss important security vulnerabilities. Traditional techniques for monitoring memory reads and writes might require testers to manually set breakpoints using a debugger and observe changes in memory variables. This approach is not only time-consuming and labor-intensive, but also fails to cover all memory read and write operations. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a penetration testing method for Android games, enhance the cross-engine adaptation and automated testing of Android games, and improve the testing concealment and efficiency.

[0007] In order to solve the above technical problems, the technical solutions of the present invention are as follows:

[0008] In a first aspect, a penetration testing method for Android games is provided, the method comprising:

[0009] By analyzing game files, identifying the game engine type and extracting key components, we can obtain engine identification, version information, and key file list information.

[0010] Based on the relevant information, the decompiled bytecode, Smari code, dynamic library files and resource scripts are analyzed, and the anti-debugging mechanism and encryption algorithm are located to obtain the hooking framework;

[0011] Through the hooking framework, network communications, memory read and write, and logic calls during game runtime are intercepted and analyzed in real time to obtain network request packets and memory variable value data;

[0012] According to the network request packet and memory variable value data, the process debugging status and memory verification code are dynamically modified to bypass the game's anti-cheating mechanism and obtain the preset test rules;

[0013] Automatically scan key programming interfaces based on preset test rules and modify game memory variables to enable simulated players to perform specific tasks in conjunction with automated testing tool operations;

[0014] Perform batch vulnerability scans and generate penetration test reports using the preset test rule library.

[0015] Furthermore, by analyzing the game files, identifying the game engine type and extracting key components, we can obtain engine identification, version information, and key file list information, including:

[0016] Parse and decompile Android game files, extract Android manifest files, resource directories, asset directories, and library dynamic directories, and obtain package name, version information, and permission requirement data from the metadata of the Android manifest file application;

[0017] Convert Android game files into JAR files and use Java decompilation tools to view the Java source code in the JAR files. By analyzing the Java source code, determine the types unique to the game engine; check the files in the asset directory and resource directory, identify the configuration files used by the game, and extract key information related to the game logic to obtain the game engine identification, version information and key file list.

[0018] Furthermore, based on the relevant information, the decompiled bytecode, Smari code, dynamic library files, and resource scripts are analyzed to locate the anti-debugging mechanism and encryption algorithm, and obtain the hooking framework, including:

[0019] Collect relevant information about the target Android game, including game engine type, APK file, dynamic library file, and resource script;

[0020] Decompile the APK file and extract the AndroidManifest.xml file, So library, Dex code and resource files;

[0021] Use dex2jar or jadx to convert Dex code into Java code, parse Lua scripts and configuration file resource files, and extract key information, including game logic and configuration parameters, to obtain the game's static structure information and preliminary operation logic analysis; perform logic extraction and code analysis on the converted and parsed Java code, identify key logic and function calls, and ultimately form static analysis results;

[0022] Search for key functions in the static analysis results to detect the game's anti-debugging or anti-cheating mechanisms, and use readelf and IDA Pro tools to analyze the so file, identify relevant key functions in the dynamic library, and obtain the dynamic library analysis results;

[0023] By searching for key API calls and specific keywords, including frida and xposed, anti-debugging points are marked in the static analysis and dynamic library analysis results, key functions and APIs that need to be hooked are identified, and a list of hook targets is generated;

[0024] According to the hook target list, write the corresponding hook script to obtain the hook framework, namely the HOOK framework.

[0025] Furthermore, through the hooking framework, network communications, memory reads and writes, and logic calls during game runtime are intercepted and analyzed in real time to obtain network request packets and memory variable value data, including:

[0026] Use the hook framework function to hook key functions in the game process to obtain network communication, memory reading and writing, and logic calls during game runtime;

[0027] Through network communication, the hook framework intercepts network request packets in real time and extracts key information. For memory read and write operations, the hook framework monitors the read and write process of memory variables, obtains variable values, and analyzes the impact on game logic. According to logical calls, the hook framework tracks the call sequence and parameter passing, analyzes the implementation details of the game logic, and obtains network request packets and memory variable value data through the interception and analysis functions of the hook framework.

[0028] Furthermore, based on the network request packet and memory variable value data, the process debugging state and memory verification code are dynamically modified to bypass the game's anti-cheating mechanism and obtain preset test rules, including:

[0029] Analyze network request packets and memory variable value data to identify network communication and memory variable access data related to anti-cheat mechanisms. Based on the network communication data, check the debugger detection code and process debugging status in the game process.

[0030] Analyze memory variable access data, identify the code segments that verify memory data, and determine the verification logic and key variables through reverse engineering to modify the verification variable values ​​in memory;

[0031] According to the modified check variable value, an anti-cheating mechanism is implemented to perform the test operation, and according to the test result, the test strategy is adjusted to obtain the preset test rules.

[0032] Furthermore, according to preset test rules, key programming interfaces are automatically scanned and game memory variables are modified to enable simulated players to perform specific tasks in conjunction with automated testing tool operations, including:

[0033] Use automated scanning tools to scan key programming interfaces in the game process to obtain scanning results;

[0034] According to preset test rules and scanning results, identify the game memory variables that need to be modified, including game status, player data, and resource quantity, and use automated testing tools to simulate player behavior to perform specific tasks, including automatic monster killing, automatic upgrades, and automatic task completion.

[0035] Furthermore, the key programming interface includes logic processing functions, network communication functions, and memory access functions.

[0036] Furthermore, we can perform batch vulnerability scans and generate penetration test reports based on the preset test rule base, including:

[0037] Based on security vulnerability information, a preset test rule library is constructed and classified according to vulnerability type, impact scope, and difficulty of exploitation.

[0038] Use a preset test rule library to perform batch vulnerability scanning on Android games. The scanning tool automatically performs static analysis on the game code based on the test rules in the rule library, identifies potential vulnerabilities, and forms a preliminary vulnerability list, including vulnerability type, trigger conditions, and impact range information;

[0039] Based on the preliminary vulnerability list, a penetration test report is generated, including vulnerability description, severity assessment, triggering conditions, and impact scope information.

[0040] In a second aspect, a computing device includes:

[0041] one or more processors;

[0042] The storage device is used to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method.

[0043] According to a third aspect, a computer-readable storage medium stores a program, which implements the method described above when executed by a processor.

[0044] The above solution of the present invention includes at least the following beneficial effects:

[0045] This method integrates attack tools for multiple mainstream game engines, including Unity, Unreal Engine, Cocos, IL2CPP, Mono, and Lua, enabling unified and universal penetration testing. By analyzing the code structure and call flow of different engines, it provides a highly adaptable and widely covered testing solution, resolving the problem that existing testing methods require customized tools for different game engines. It provides a variety of automated attack tools, including speed modification, script decryption, and code injection, reducing manual intervention. Through predefined rules, script execution, and automated interaction, it achieves a batch and efficient testing process, thereby reducing labor costs and improving testing efficiency.

[0046] The design fully considers the anti-debugging and anti-modification mechanisms of games, and adopts memory tampering, dynamic hook, code injection, and memory snapshot comparison methods to successfully bypass the game's anti-cheating mechanism, improve the effectiveness and stealth of penetration testing, and enhance the practicality of testing. It also provides a standardized interface including API or plug-in system to support seamless access to different test modules and is compatible with existing penetration testing tools including Frida, Ghidra, and IDA Pro. This design enables users to expand new detection functions based on the API, implement customizable attack vectors, and enhance flexibility and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a flowchart of a penetration testing method for Android games provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0049] like Figure 1 As shown, an embodiment of the present invention provides a penetration testing method for Android games, the method comprising the following steps:

[0050] Step 1: Analyze the game files, identify the game engine type and extract key components to obtain engine identification, version information and key file list information;

[0051] Step 2: Analyze the decompiled bytecode, Smari code, dynamic library files, and resource scripts based on the relevant information, locate the anti-debugging mechanism and encryption algorithm, and obtain the hooking framework;

[0052] Step 3: Through the hooking framework, the network communication, memory reading and writing, and logic calls during the game runtime are intercepted and analyzed in real time to obtain network request packets and memory variable value data;

[0053] Step 4: Dynamically modify the process debugging state and memory checksum code based on the network request packet and memory variable value data to bypass the game's anti-cheating mechanism and obtain the preset test rules;

[0054] Step 5: Automatically scan key programming interfaces based on pre-set test rules and modify game memory variables to enable simulated players to perform specific tasks in conjunction with automated testing tool operations.

[0055] Step 6: Perform batch vulnerability scanning using the preset test rule library and generate a penetration test report.

[0056] In this embodiment of the present invention, by analyzing game files to identify engine types and extract key components, the testing method is customized for specific game engines, improving the accuracy and effectiveness of the test. In-depth analysis of various decompiled codes and files is performed to locate anti-debugging mechanisms and encryption algorithms. This allows the construction of a hooking framework, enabling testing to penetrate deep into the game and uncover more potential security issues. The hooking framework also intercepts and analyzes various runtime behaviors of the game in real time, including network communications, memory reads and writes, and logic calls, to obtain detailed runtime data.

[0057] Dynamically modifying process debugging status and memory checksum code effectively bypasses the game's anti-cheat mechanisms, enabling testing to be conducted in a more realistic gaming environment and improving test practicality. Based on pre-set test rules, it automatically scans key programming interfaces and modifies game memory variables. Combined with automated testing tools, it simulates player operations to perform specific tasks, improving testing efficiency. It also performs batch vulnerability scans using a pre-set test rule library and generates detailed penetration test reports.

[0058] In a preferred embodiment of the present invention, the above step 1, analyzing the game files, identifying the game engine type and extracting key components to obtain engine identification, version information and key file list related information, may include:

[0059] Step 110 , parsing and decompiling the Android game file, extracting the Android manifest file, resource directory, asset directory, and library dynamic directory, and obtaining the package name, version information, and permission requirement data from the metadata of the Android manifest file application;

[0060] Step 111: Convert the Android game file into a JAR file, and use a Java decompiler tool to view the Java source code in the JAR file. By analyzing the Java source code, determine the type unique to the game engine; check the files in the asset directory and the resource directory, identify the configuration files used by the game, and extract key information related to the game logic to obtain the game engine identification, version information and key file list.

[0061] In the embodiment of the present invention, the AndroidManifest.xml (Android manifest file), res / directory (resource directory), assets / directory (asset directory) and lib / directory (library dynamic directory) are decompressed and extracted, and the AndroidManifest.xml file is parsed to obtain the application's package name (package attribute), version information (versionName and versionCode attributes) and permission requirement data ( <uses-permission>Label).

[0062] Step 111: Extract the classes.dex file from the APK file. Use the d2j-dex2jar tool to convert the classes.dex file into a JAR file. Open the JAR file with a Java decompiler such as Jadx, CFR, or JD-GUI. View and analyze the Java source code to identify classes, methods, or variables specific to the game engine to determine the type of game engine. Check the files in the assets / and res / directories to identify the game's configuration files, including those in JSON and XML formats. Extract key information related to the game logic, including game settings, level data, and character attributes. Compile and output the game engine identifier, version information, and a list of key files.

[0063] Assume there is an Android game APK file developed using the Unity engine. Extract the AndroidManifest.xml, res / , assets / , and lib / directories. Get the package name com.example.unitygame and version information 1.0.0 from AndroidManifest.xml, and list all permission requirements.

[0064] Convert the classes.dex file to a JAR file and use a Java decompiler to open the JAR file. Find the UnityPlayerActivity class and confirm that the game engine is Unity. Locate the game_settings.json configuration file in the assets / directory and extract the game settings. Also, locate the game icon and sound effect resource files in the res / directory. The output shows the game engine identifier as Unity and version information as 1.0.0. Key files include game_settings.json, the game icon, and the sound effect resource files.

[0065] By automatically parsing and decompiling APK files, we can quickly identify game engine types and extract key components, reducing the time and cost of manual analysis. Through in-depth analysis of Java source code and configuration files, we can determine the game engine type, version information, and key game logic information. This provides important clues and evidence for engine identification, version information, and key file lists. Based on this information, security researchers can conduct targeted testing and analysis of specific engines and versions, promoting the development of game security research and enhancing the security awareness and protection capabilities of game developers and security researchers.

[0066] In a preferred embodiment of the present invention, the above step 2, based on relevant information, analyzes the decompiled bytecode, Smari code, dynamic library files and resource scripts, locates the anti-debugging mechanism and encryption algorithm, and obtains the hooking framework, which may include:

[0067] Step 220: Collect relevant information of the target Android game, including game engine type, APK file, dynamic library file, and resource script;

[0068] Step 221, decompile the APK file to extract the AndroidManifest.xml file, So library, Dex code and resource files;

[0069] Step 222: Use dex2jar or jadx to convert the Dex code into Java code, parse the Lua script and configuration file resource files, and extract key information, including game logic and configuration parameters, to obtain the static structure information and preliminary operation logic analysis of the game; perform logic extraction and code analysis on the converted and parsed Java code to identify key logic and function calls, and finally form static analysis results;

[0070] Step 223: Search for key functions in the static analysis results to detect the game's anti-debugging or anti-cheating mechanisms, and use readelf and IDA Pro tools to analyze the so file to identify relevant key functions in the dynamic library and obtain the dynamic library analysis results.

[0071] Step 224 , by searching for key API calls and specific keywords, including frida and xposed, marking anti-debugging points in the static analysis and dynamic library analysis results, determining the key functions and APIs that need to be hooked, and generating a hook target list;

[0072] Step 225: Write a corresponding hook script according to the hook target list to obtain a hook framework, namely, a HOOK framework.

[0073] In an embodiment of the present invention, the engine type used by the game, including Unity, Unreal Engine, and Cocos2d-x, is preliminarily determined through the APK file header information and in-game features, including UI style and physical engine performance. The APK file of the game is downloaded from official channels or trusted sources, and the APK analysis tool APKTool is used to decompress the APK to obtain the so file, i.e., the dynamic library, and extract the game resource files including images, sound effects, and Lua scripts to obtain the game engine type, APK file, dynamic library file list, and resource script list.

[0074] Step 221: Use APKTool to decompress the APK file to obtain a decompressed folder, including AndroidManifest.xml, classes.dex (Dex code), lib / (So library directory), and res / (resource file directory). Decompile the binary AndroidManifest.xml into a readable XML format to obtain the decompiled Dex code of the So file. Use dex2jar to convert classes.dex into a JAR file, or use jadx to directly generate Java source code to obtain the decompiled AndroidManifest.xml, So library file, Java source code, and resource file.

[0075] In step 222, code analysis tools, including SonarQube and PMD, are used to statically analyze the Java code to extract key information about the game logic and configuration parameters. Lua parsers, including LuaJIT, are then used to read and parse the scripts to extract the game logic and configuration. Configuration files are then read using appropriate parsers based on file type, including SON, XML, and INI, to generate static structure information and preliminary analysis of the game's runtime logic.

[0076] Step 223: Search the Java code and Lua scripts for functions related to anti-debugging and anti-cheating, including debugger detection and memory value modification. Use readelf to view the symbol table of the .so file and identify functions related to anti-debugging and anti-cheating. Use IDA Pro for more in-depth dynamic library analysis, including viewing the function call graph and data flow to obtain dynamic analysis results.

[0077] Step 224: Search the static and dynamic library analysis results for API calls related to the Frida and Xposed debugging frameworks. Based on the search results, mark the points in the game code that detect debuggers. Combined with the game logic and anti-debugging mechanisms, identify key functions and APIs that need to be hooked, and compile the identified hook targets into a list.

[0078] Step 225, determine the hooking framework according to the game engine type and anti-debugging mechanism, including Xposed and Frida, and write corresponding hooking scripts through the hooking target list to intercept and modify key functions and APIs.

[0079] Assume the target is an RPG game developed using the Unity engine, with the APK file named MyRPGGame.apk. Use APKTool to decompress the APK to obtain AndroidManifest.xml, classes.dex, lib / , and res files. Use dex2jar to convert classes.dex to a JAR file. Use jadx to decompile the JAR file into Java source code. Parse the res / raw / game_config.json configuration file and Java code to extract the game logic and configuration parameters.

[0080] Use readelf and IDA Pro to analyze libunity.so and identify key anti-debugging functions. Search for API calls to the Frida and Xposed debugging frameworks in the static and dynamic library analysis results. Mark the points in the game code used for debugger detection and identify key functions and APIs that need to be hooked, including android.os.Debug.isDebuggerConnected(). Write a hook script to intercept and modify the return value of android.os.Debug.isDebuggerConnected().

[0081] By using hooking framework technology, we bypass conventional anti-debugging mechanisms in games, effectively preventing debugging and analysis attempts by game hackers. We also intercept and modify key game functions and APIs to enhance game security and prevent malicious modification or cheating. We provide game developers with efficient debugging and analysis tools, leveraging hooking framework technology to quickly identify and optimize game issues, improving the efficiency and quality of game development.

[0082] In a preferred embodiment of the present invention, the above step 3, monitoring game data through a hooking framework, intercepting and analyzing network communications, memory reads and writes, and logic calls during game runtime in real time to obtain network request packets and memory variable value data, may include:

[0083] Step 330: Use the hook framework function to hook key functions in the game process to obtain network communication, memory reading and writing, and logic calls during game runtime;

[0084] Step 331, through network communication, the hook framework intercepts the network request packet in real time and extracts key information. For memory read and write operations, the hook framework monitors the read and write process of memory variables, obtains variable values, and analyzes the impact on the game logic; according to the logic call, the hook framework tracks the call sequence and parameter passing, analyzes the implementation details of the game logic, and obtains the network request packet and memory variable value data through the interception and analysis functions of the hook framework.

[0085] In this embodiment of the present invention, the basic parameters of the hooking framework are configured, including the target process name and a list of functions to be hooked. The entry address of the target function is then searched within the game process's address space. The exact location of the function is determined through pattern matching, and the target function's entry instruction is modified to direct it to the hooking framework's processing function. The entry instruction of the original function is saved, and within the hooking framework's processing function, customized logic is executed to monitor the behavior of the game process. For the original function that continues to execute, the saved original function entry instruction is called or a jump instruction is used to return to the original execution flow.

[0086] Step 331, when the game process receives a network request, the hook framework obtains the request packet and extracts key information in the network request packet, including the URL, request header, request body, and response data. The monitoring logic of memory read and write operations is set in the hook framework. When the game process performs read and write operations on memory variables, the hook framework records the address, value, and timestamp of the memory variable read and write operations, and analyzes the impact of the memory variable read and write process on the game logic. Through the tracking logic of the logic call, the hook framework records the call sequence and parameter passing, and analyzes the implementation details of the game logic, including function call relationships, parameter passing methods, and return values. The intercepted network request packets, memory variable values, and logic call information are integrated and analyzed to output to the developer in the form of a report.

[0087] Assume that a hooking framework monitors the running data of an online game and configures a list of hooked functions, including network send / receive functions, memory allocation / deallocation functions, and key functions in the game logic. Using pattern matching, it searches the game process's address space for the entry point address of the network send function, identifies its exact location, and modifies the entry point instruction of the network send function to direct it to the hooking framework's processing function. When the game process attempts to send a network request, the hooking framework captures the request packet.

[0088] Extract the URL, request header, and request body information from the request packet, monitor the game process's read and write operations on key memory variables, and record the address, value, and operation timestamp. Track the specific function call sequence and parameter passing in the game logic, and integrate the intercepted network request packet information, memory variable values, and function call details into a log file.

[0089] By intercepting and analyzing runtime game data in real time, we can promptly detect potential malicious behavior, including cheating and plug-ins, improve game security and fairness, protect player interests and gaming experience, help quickly locate in-game issues, reduce debugging and analysis time costs, and improve development efficiency and quality. By hooking in-game logic calls and memory read and write operations, we can expand and innovate gameplay, provide a rich and diverse gaming experience, and enhance the appeal and competitiveness of games.

[0090] In a preferred embodiment of the present invention, the above step 4, dynamically modifying the process debugging state and memory checksum code based on the network request packet and memory variable value data to bypass the game anti-cheating mechanism and obtain the preset test rules, may include:

[0091] Step 440 , analyzing the network request packet and memory variable value data to identify network communication and memory variable access data related to the anti-cheat mechanism, and checking the debugger detection code and process debugging status in the game process based on the network communication data;

[0092] Step 441 , analyzing the memory variable access data, identifying the code segment for verifying the memory data, and determining the verification logic and key variables through reverse engineering to modify the verification variable value in the memory;

[0093] In step 442, an anti-cheating mechanism is implemented according to the modified check variable value to perform a test operation, and a test strategy is adjusted according to the test result to obtain a preset test rule.

[0094] In an embodiment of the present invention, the acquired network request packet is parsed to identify requests related to the anti-cheating mechanism, including debugger detection requests and verification requests. Memory variable value data is parsed to locate memory areas related to the anti-cheating mechanism, including the memory address storing the debugging status and the verification code storage location. Network communication data is analyzed to identify the debugger detection code execution point in the game process, and the process debugging status is checked to confirm whether the current game process is in the debugged state, including by checking specific memory flags or calling specific API functions.

[0095] Step 441: Set memory breakpoints during the game process to monitor memory variable access operations related to the anti-cheat mechanism, and record the code segments for reading, writing, and executing memory variable operations. Reverse engineer the recorded memory access code segments to analyze the logic for verifying memory data and determine verification algorithms, including CRC and hash checks, and key variables such as checksums and seed values. Based on the reverse analysis results, locate the storage location of the check variables. Write a memory modification script, including a Lua script using Cheat Engine, to dynamically modify the check variable value in memory to pass verification.

[0096] In step 442, a custom DLL is injected into the game process or existing code is modified to bypass anti-cheat detection. Game data is modified and specific events are triggered to verify the effectiveness of the anti-cheat bypass. Logs and data from the testing process are collected to analyze the effectiveness and stability of the anti-cheat bypass. Potential factors that may cause the anti-cheat mechanism to reactivate are identified, including game updates and anti-cheat upgrades. Based on the test results, the test strategy is adjusted, including adding test scenarios and optimizing memory modification scripts to obtain pre-set test rules.

[0097] Consider an online multiplayer game whose anti-cheat mechanism includes debugger detection and memory checksums. Wireshark is used to capture network traffic between the game client and server, identifying debugger detection requests. x64dbg is then used to read the game process's memory and locate the memory address storing the debug status. The network traffic data is analyzed, and a custom DLL is injected into the game process to intercept API function calls and return a false result, indicating that the game process is not being debugged. Memory breakpoints are set within the game process to monitor variable accesses related to memory checksums. Through reverse engineering, the checksum algorithm and key variables, including the checksum storage location, are determined. A Lua script for the cheat engine is written to dynamically modify the checksum in memory to pass the checksum. Testing operations are then performed, including modifying game character attributes and triggering special events to verify the effectiveness of the anti-cheat bypass. Based on the test results, the testing strategy is adjusted, including adding test scenarios, optimizing the memory modification script, and developing pre-set test rules.

[0098] By bypassing anti-cheat mechanisms, testers can efficiently perform testing operations and streamline the testing process by using pre-set test rules, improving testing efficiency. Bypassing anti-cheat mechanisms allows testers to access more game features and scenarios, thereby increasing test coverage, uncovering more potential game issues and vulnerabilities, and improving game quality, freedom, and innovation. Developers can more freely test new game features and adjust game balance without worrying about the limitations of anti-cheat mechanisms. The use of automated test scripts and pre-set test rules can reduce testing costs and time, and help game developers release new versions and updates more quickly to meet player needs.

[0099] In a preferred embodiment of the present invention, the above step 5, which automatically scans key programming interfaces according to preset test rules and modifies game memory variables to enable simulated players to perform specific tasks in conjunction with automated testing tool operations, may include:

[0100] Step 550: Scan key programming interfaces in the game process using an automated scanning tool to obtain scan results.

[0101] Step 551, based on the preset test rules and scanning results, identify the game memory variables that need to be modified, including game status, player data, and resource quantity, and simulate the player's behavior based on the automated testing tool to perform specific tasks, including automatic monster killing, automatic upgrades, and automatic task completion.

[0102] In this embodiment of the present invention, the scanning tool's parameters, including scanning range, scanning speed, and scanning depth, are configured. An API is used to obtain the ID of the currently running game process to verify whether the game process is the target game, ensuring scanning accuracy. The game process's memory is scanned based on preset interface features, including function signatures and memory address ranges. The scanned interface information, including interface address, interface name, and interface parameters, is recorded and organized into a report format.

[0103] In step 551, the rules include the game state, player data, resource quantities, and corresponding modification logic to be monitored. By scanning the results, the key programming interfaces related to the test rules are identified, and the game memory variables that need to be modified are determined. Using memory modification tools such as Cheat Engine or custom memory manipulation functions, the identified game memory variables, including game state, player data, and resource quantities, are modified.

[0104] According to the test rules, simulate the player's behavior to perform specific tasks, including using automated testing tools or custom scripts to control the actions of the game character, including automatic monster killing, automatic upgrades, and automatic task completion. Observe changes in the game process, check whether the simulated player behavior is performed as expected, and record the test results.

[0105] Suppose you're testing an RPG game. The goal is to verify whether the game automatically unlocks new skills when the player reaches a certain level. Load Cheat Engine, configure the scan scope to target the game process memory, and use the Windows API to obtain the game process ID. Verify that the process name is "RPGGame.exe." Scan the game process memory for functions or variables related to the player's level. Suppose the scan finds memory address 0x12345678, which stores the player's current level. Read the test rule file, which states that the new skill "Fireball" should be unlocked when the player reaches level 10. Confirm that memory address 0x12345678 is relevant to the test rule. Use Cheat Engine to modify the value of memory address 0x12345678 to 10. Use an automated test script to control the game character in battle and observe whether the new skill "Fireball" is automatically unlocked. Record the test results.

[0106] By simulating player behavior to perform specific tasks, we can cover game scenarios and boundary conditions that are difficult to reach with manual testing. Automated testing tools precisely control game progress and memory variables, reducing testing errors caused by human factors. They also identify and fix in-game issues through testing. Integrating automated testing into the continuous integration process enables rapid game iteration and release, improving game stability and user experience.

[0107] In another preferred embodiment of the present invention, the key programming interface includes logic processing functions, network communication functions, and memory access functions, and may include:

[0108] In this embodiment of the present invention, based on the game's functionality and flow, key functions that handle game logic are identified, including game state updates, event handling, and AI behavior. Functions related to network communication are searched for, including functions for sending and receiving data, and functions for handling network protocols such as WebSocket, gRPC, and TCP / UDP.

[0109] Hook identified key functions and write hook scripts to monitor their calls and executions, recording function parameters and return values, as well as memory changes during function execution. Set up mitmproxy as a middleman proxy to intercept the game's network traffic and observe changes in game status to verify the validity of memory access functions. By hooking memory access functions, monitor changes in game memory variables in real time and analyze their effects and impact.

[0110] Categorize the identified logic processing functions, network communication functions, and memory access functions by function and type. Extract each function's name, parameters, return value, call history, and its role and impact within the game. Select document formats such as Markdown, Word, and PDF to create interface documentation, detailing the function, usage, parameter descriptions, and sample code for each key programming interface, ensuring accuracy and completeness.

[0111] In a preferred embodiment of the present invention, the above step 6, performing batch vulnerability scanning and generating a penetration test report using a preset test rule library, may include:

[0112] Step 660: Build a preset test rule base based on the security vulnerability information, and classify the test rule base according to vulnerability type, impact scope, and difficulty of exploitation.

[0113] Step 661: Use a preset test rule library to perform batch vulnerability scanning on Android games. The scanning tool automatically performs static analysis on the game code based on the test rules in the rule library, identifies potential vulnerabilities, and generates a preliminary vulnerability list, including vulnerability type, trigger conditions, and impact range information.

[0114] Step 662: Generate a penetration test report based on the preliminary vulnerability list, including vulnerability description, severity assessment, triggering conditions, and impact range information.

[0115] In this embodiment of the present invention, test rules are compiled based on collected vulnerability information, including vulnerability identification conditions, triggering methods, and impact assessments. These rules are organized using a unified format and naming convention. Test rules are categorized by vulnerability type, including SQL injection, XSS, and privilege escalation. The constructed test rule library is stored in a secure database to ensure data integrity and confidentiality. The test rule library is regularly updated to address new security threats and vulnerabilities.

[0116] Step 661: Based on the characteristics and security requirements of Android games, ensure that the scanning tool is compatible with the test rule library and correctly parses and executes the test rules. Set the target scope for the scan, including the game version, module, or file path to be scanned. Launch the scanning tool and perform a batch vulnerability scan of Android games according to the pre-set test rule library. After the scan is complete, collect the scan results, including a preliminary vulnerability list, vulnerability details, and trigger conditions, to ensure accuracy and readability.

[0117] Step 662: Analyze the preliminary vulnerability list in detail to confirm the authenticity and severity of the vulnerabilities, assess the difficulty of exploiting the vulnerabilities and their potential impact, and write a penetration test report, including a description of the vulnerabilities, severity assessment, triggering conditions, and impact range information. Review the report content to ensure its accuracy and completeness.

[0118] Consider an Android game app that includes user login, in-game purchases, and leaderboards. Collect information on vulnerabilities related to Android games, including SQL injection and XSS vulnerabilities. Verify that user input is adequately validated and filtered based on SQL injection vulnerability rules. Categorize and store test rules by vulnerability type, scope, and difficulty of exploitation. Identify a static analysis scanning tool, configure scan parameters, and execute the scan. The tool performs static analysis of the game code based on the test rule library, identifying potential vulnerabilities and collecting scan results to create a preliminary vulnerability list. Analyze the vulnerability list to confirm the authenticity and severity of the vulnerabilities and generate a penetration test report.

[0119] Through batch vulnerability scanning and penetration testing reports, we can promptly identify and fix security vulnerabilities in Android games, improving game security and reducing the risk of user data leakage and game crashes caused by security vulnerabilities. Penetration testing reports provide developers with clear vulnerability information and remediation suggestions, helping them quickly locate and fix vulnerabilities, reducing maintenance costs caused by security incidents, and improving game security and user trust.

[0120] An embodiment of the present invention further provides a computing device comprising: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the above-described method. All implementations in the above-described method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0121] The embodiment of the present invention further provides a computer-readable storage medium storing instructions, which, when executed on a computer, causes the computer to execute the above-described method. All implementations in the above-described method embodiment are applicable to this embodiment and can achieve the same technical effects.

[0122] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A penetration testing method for Android games, characterized in that: The method comprises: By analyzing game files, identifying the game engine type and extracting key components, we can obtain engine identification, version information, and key file list information. Based on the relevant information, the decompiled bytecode, Smari code, dynamic library files and resource scripts are analyzed, and the anti-debugging mechanism and encryption algorithm are located to obtain the hooking framework; Through the hooking framework, network communications, memory read and write, and logic calls during game runtime are intercepted and analyzed in real time to obtain network request packets and memory variable value data; According to the network request packet and memory variable value data, the process debugging status and memory verification code are dynamically modified to bypass the game's anti-cheating mechanism and obtain the preset test rules; Based on the network request packet and memory variable value data, the process debugging status and memory verification code are dynamically modified to bypass the game's anti-cheating mechanism and obtain preset test rules, including: Analyze network request packets and memory variable value data to identify network communication and memory variable access data related to anti-cheat mechanisms. Based on the network communication data, check the debugger detection code and process debugging status in the game process. Analyze memory variable access data, identify the code segments that verify memory data, and determine the verification logic and key variables through reverse engineering to modify the verification variable values ​​in memory; Implementing an anti-cheating mechanism based on the modified check variable value to perform the test operation, and adjusting the test strategy based on the test results to obtain the preset test rules; Automatically scan key programming interfaces based on preset test rules and modify game memory variables to enable simulated players to perform specific tasks in conjunction with automated testing tool operations; Perform batch vulnerability scans and generate penetration test reports using the preset test rule library.

2. The penetration testing method for Android games according to claim 1, characterized in that: By analyzing game files, identifying the game engine type and extracting key components, we can obtain engine identification, version information, and key file lists, including: Parse and decompile Android game files, extract Android manifest files, resource directories, asset directories, and library dynamic directories, and obtain package name, version information, and permission requirement data from the metadata of the Android manifest file application; Convert Android game files into JAR files and use Java decompilation tools to view the Java source code in the JAR files. By analyzing the Java source code, determine the types unique to the game engine; check the files in the asset directory and resource directory, identify the configuration files used by the game, and extract key information related to the game logic to obtain the game engine identification, version information and key file list.

3. The penetration testing method for Android games according to claim 2, characterized in that: Based on the relevant information, we analyze the decompiled bytecode, Smari code, dynamic library files, and resource scripts, locate the anti-debugging mechanism and encryption algorithm, and obtain the hooking framework, including: Collect relevant information about the target Android game, including game engine type, APK file, dynamic library file, and resource script; Decompile the APK file and extract the AndroidManifest.xml file, So library, Dex code and resource files; Use dex2jar or jadx to convert Dex code into Java code, parse Lua scripts and configuration file resource files, and extract key information, including game logic and configuration parameters, to obtain the game's static structure information and preliminary operation logic analysis; perform logic extraction and code analysis on the converted and parsed Java code, identify key logic and function calls, and ultimately form static analysis results; Search for key functions in the static analysis results to detect the game's anti-debugging or anti-cheating mechanisms, and use readelf and IDA Pro tools to analyze the so file, identify relevant key functions in the dynamic library, and obtain the dynamic library analysis results; By searching for key API calls and specific keywords, including frida and xposed, anti-debugging points are marked in the static analysis and dynamic library analysis results, key functions and APIs that need to be hooked are identified, and a list of hook targets is generated; According to the hook target list, write the corresponding hook script to obtain the hook framework, namely the HOOK framework.

4. The penetration testing method for Android games according to claim 3, characterized in that: Monitor game data through the hook framework, intercept and analyze network communications, memory reads and writes, and logic calls during game runtime in real time to obtain network request packets and memory variable value data, including: Use the hook framework function to hook key functions in the game process to obtain network communication, memory reading and writing, and logic calls during game runtime; Through network communication, the hook framework intercepts network request packets in real time and extracts key information. For memory read and write operations, the hook framework monitors the read and write process of memory variables, obtains variable values, and analyzes the impact on game logic. According to logical calls, the hook framework tracks the call sequence and parameter passing, analyzes the implementation details of the game logic, and obtains network request packets and memory variable value data through the interception and analysis functions of the hook framework.

5. The penetration testing method for Android games according to claim 4, characterized in that: Based on preset test rules, it automatically scans key programming interfaces and modifies game memory variables to enable simulated players to perform specific tasks in conjunction with automated testing tool operations, including: Use automated scanning tools to scan key programming interfaces in the game process to obtain scanning results; According to preset test rules and scanning results, identify the game memory variables that need to be modified, including game status, player data, and resource quantity, and use automated testing tools to simulate player behavior to perform specific tasks, including automatic monster killing, automatic upgrades, and automatic task completion.

6. The penetration testing method for Android games according to claim 5, characterized in that: The key programming interface includes logic processing functions, network communication functions, and memory access functions.

7. The penetration testing method for Android games according to claim 6, characterized in that: Perform batch vulnerability scans and generate penetration test reports using a preset test rule base, including: Based on security vulnerability information, a preset test rule library is constructed and classified according to vulnerability type, impact scope, and difficulty of exploitation. Use a preset test rule library to perform batch vulnerability scanning on Android games. The scanning tool automatically performs static analysis on the game code based on the test rules in the rule library, identifies potential vulnerabilities, and forms a preliminary vulnerability list, including vulnerability type, trigger conditions, and impact range information; Based on the preliminary vulnerability list, a penetration test report is generated, including vulnerability description, severity assessment, triggering conditions, and impact scope information.

8. A computing device, characterized in that include: one or more processors; A storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a program, which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images