CN109062667A - A kind of simulator recognition methods, identification equipment and computer-readable medium - Google Patents
A kind of simulator recognition methods, identification equipment and computer-readable medium Download PDFInfo
- Publication number
- CN109062667A CN109062667A CN201810855586.8A CN201810855586A CN109062667A CN 109062667 A CN109062667 A CN 109062667A CN 201810855586 A CN201810855586 A CN 201810855586A CN 109062667 A CN109062667 A CN 109062667A
- Authority
- CN
- China
- Prior art keywords
- router
- title
- mac address
- target terminal
- preset
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45504—Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators
- G06F9/45508—Runtime interpretation or emulation, e g. emulator loops, bytecode interpretation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D30/00—Reducing energy consumption in communication networks
- Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks
Abstract
The embodiment of the invention discloses a kind of simulator recognition methods, identification equipment and computer-readable mediums, wherein this method comprises: obtaining the route-map of the Wi-Fi Hotspot of target terminal connection, the route-map includes the title and MAC Address of router；Whether the title MAC Address whether identical and described with the router rs name in the first preset blacklist for detecting the router is in MAC Address set in preset the second blacklist；When the title of the router is identical as the either router title in first blacklist, and the MAC Address is in the MAC Address set, determine that the target terminal runs on simulator environment.Using the embodiment of the present invention, facilitate the accuracy for promoting simulator identification.
Description
Technical field
The present invention relates to fields of communication technology more particularly to a kind of simulator recognition methods, identification equipment and computer can
Read medium.
Background technique
Android simulator, which is one, to go out the operation of android system in the various platform simulations such as Windows, Linux
The application of environment, user can run answering for android system in the Android simulator in the terminals such as personal computer
With., in application, for certain business, such as needing to carry out the business of Risk Monitoring using android system, it is undesirable that it
It is running on simulator, it is therefore desirable to be identified to whether terminal runs on Android simulator environment.And current risk
It identifies that equipment is limited to the recognition capability of Android simulator, can not effectively identify whether terminal runs on simulator environment.
Summary of the invention
The embodiment of the present invention provides a kind of simulator recognition methods, identification equipment and computer-readable medium, helps to mention
Rise the accuracy of simulator identification.
In a first aspect, the embodiment of the invention provides a kind of simulator recognition methods, comprising:
The route-map of the Wireless Fidelity Wi-Fi Hotspot of target terminal connection is obtained, the route-map includes road
By address title and media access control (Media Access Control, MAC) of device；
Whether the title for detecting the router is identical and described as the router rs name in the first preset blacklist
Whether MAC Address is in the MAC Address set in the second preset blacklist；
When the title of the router is identical as the either router title in first blacklist, and the MAC
When location is in the MAC Address set, determine that the target terminal runs on simulator environment.
Optionally, before the determination target terminal runs on simulator environment, the method also includes:
The model information of the target terminal is obtained, the model information includes the model and/or product of the target terminal
Board；
Whether identical as the terminal models information in preset third blacklist detect the model information, the third is black
It include at least one set of terminal models information in list；
It is described when the title of the router and the either router title in first blacklist are identical and described
When MAC Address is in the MAC Address set, determine that the target terminal runs on simulator environment, comprising:
When the title of the router is identical as the either router title in first blacklist, the MAC Address
In the MAC Address set, and the model information is identical as any group of terminal models information in the third blacklist
When, determine that the target terminal runs on simulator environment.
Optionally, before the determination target terminal runs on simulator environment, the method also includes:
Obtain the producer identification of the central processor CPU of the target terminal；
Whether the producer identification for detecting the CPU is identical as the producer identification in preset white list；
It is described when the title of the router and the either router title in first blacklist are identical and described
When MAC Address is in the MAC Address set, determine that the target terminal runs on simulator environment, comprising:
When the title of the router is identical as the either router title in first blacklist, the MAC Address
In the MAC Address set, and the producer identification of the CPU and all producer identifications in the white list not phase
Meanwhile determining that the target terminal runs on simulator environment.
Optionally, before the determination target terminal runs on simulator environment, the method also includes:
Whether the facility information for detecting the target terminal meets preset rules, wherein the equipment of the target terminal is believed
Breath meets the preset rules and includes:
Presetting module is not configured in the target terminal, the presetting module includes bluetooth module, temperature sensor, light
One or more of line sensor；And/or
The memory headroom value of the target terminal is less than default memory threshold；And/or
First number of the application of the target terminal installation is less than preset first quantity threshold；And/or
Second number of the file of the target terminal storage is less than preset second quantity threshold；And/or
The network formats that the target terminal uses and the all-network standard in preset network formats list not phase
Together；And/or
There are the system files of preset path and title in the system of the target terminal；And/or
The operating status of the target terminal is root state；
It is described when the title of the router and the either router title in first blacklist are identical and described
When MAC Address is in the MAC Address set, determine that the target terminal runs on simulator environment, comprising:
When the title of the router is identical as the either router title in first blacklist, the MAC Address
In the MAC Address set, and when the facility information of the target terminal meets the preset rules, determine that the target is whole
End runs on simulator environment.
Optionally, the title of the detection router whether with the first preset blacklist in router rs name
Whether the identical and described MAC Address is in front of the MAC Address set in the second preset blacklist, and the method is also wrapped
It includes:
The flag value of the corresponding objective function of the route-map is obtained, and the target is determined according to the flag value
Whether function is by hook；
When determining the objective function by hook, it is corresponding that the objective function is obtained from the memory of the objective function
Objective function pointer；
The corresponding relationship of each function pointer and function according to the pre-stored data determines that the objective function pointer is corresponding
Original function, and primary routing device information is determined according to the original function；
Whether the title of the detection router is identical as the router rs name in the first preset blacklist, and
Whether the MAC Address is in the MAC Address set in the second preset blacklist, comprising:
Detect the router that the primary routing device information includes title whether with the road in the first preset blacklist
Whether it is in by the MAC Address that device title is identical and the primary routing device information includes in preset the second blacklist
MAC Address set.
It is optionally, described to determine the objective function whether by hook according to the flag value, comprising:
The character of predetermined position in the flag value is compared with preset fixed character, the predeterminated position
The number of characters of the character at place is identical as the number of characters of the fixed character；
When the character and the fixed character difference for comparing to obtain the predetermined position, the objective function quilt is determined
hook。
It is optionally, described to determine the objective function whether by hook according to the flag value, comprising:
Logical operation is carried out to the flag value according to preset logical algorithm, to obtain operation result value, wherein described
Logical algorithm is that jump address when being executed according to the primary function in preset characters string and system determines；
When the operation result value is positive integer, determine the objective function by hook.
Second aspect, the embodiment of the invention provides a kind of identification equipment, which includes for executing above-mentioned
The unit of the method for one side.
The third aspect, the embodiment of the invention provides another kinds to identify that equipment, including processor, user interface, communication connect
Mouth and memory, the processor, user interface, communication interface and memory are connected with each other, wherein the memory is for depositing
Storage supports identification equipment to execute the computer program of the above method, and the computer program includes program instruction, the processor
It is configured for calling described program instruction, the method for executing above-mentioned first aspect.
Fourth aspect, the embodiment of the invention provides a kind of computer readable storage medium, the computer storage medium
It is stored with computer program, the computer program includes program instruction, and described program instruction makes institute when being executed by a processor
State the method that processor executes above-mentioned first aspect.
The embodiment of the present invention can be by obtaining the route-map of the Wi-Fi Hotspot of terminal connection, and to the router
The title and MAC Address of information such as router are tested and analyzed, in the title and default blacklist for detecting the router
Either router title it is identical, and when the MAC Address is in preset MAC Address set, that is, can determine the terminal operating in
Simulator environment.The embodiment of the present invention can carry out simulator identification according to the route-map of Wi-Fi Hotspot, this is just helped
In the accuracy for promoting simulator identification.
Detailed description of the invention
Technical solution in order to illustrate the embodiments of the present invention more clearly, below will be to needed in embodiment description
Attached drawing is briefly described, it should be apparent that, drawings in the following description are some embodiments of the invention, general for this field
For logical technical staff, without creative efforts, it is also possible to obtain other drawings based on these drawings.
Fig. 1 is a kind of flow diagram of simulator recognition methods provided in an embodiment of the present invention；
Fig. 2 is the flow diagram of another simulator recognition methods provided in an embodiment of the present invention；
Fig. 3 is a kind of structural schematic diagram for identifying equipment provided in an embodiment of the present invention；
Fig. 4 is the structural schematic diagram of another identification equipment provided in an embodiment of the present invention.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete
Site preparation description, it is clear that described embodiments are some of the embodiments of the present invention, instead of all the embodiments.Based on this hair
Embodiment in bright, every other implementation obtained by those of ordinary skill in the art without making creative efforts
Example, shall fall within the protection scope of the present invention.
The technical solution of the application can be applied to identification equipment in, the identification equipment may include various terminals, server or
Risk identification product (equipment) being connect with terminal etc., for being identified (referred to as " simulation to the simulator behavior in terminal
Device identification "), whether simulator environment is run on identification terminal (or application in terminal, such as application of identification implantation SDK),
Or referred to as whether identification terminal is logged in using simulator.In this application, simulator can refer to Android simulator or its
His simulator.This application involves terminal can be mobile phone, computer, plate, personal computer, smartwatch etc., the application is not
It limits.
Specifically, the application can by obtain terminal various facility informations, such as connect Wi-Fi Hotspot information, machine
Type information, manufacturer's information of CPU, module configuration information, memory headroom information, the number of the application of installation, storage file
Number, one or more in the information such as the network formats, system file exception information, the operating status that use, to carry out mould
Quasi- device identification, so as to promote the accuracy of simulator identification.It is described in detail individually below.
Referring to Figure 1, Fig. 1 is a kind of flow diagram of simulator recognition methods provided in an embodiment of the present invention.Specifically
, as shown in Figure 1, the simulator recognition methods may comprise steps of:
101, the route-map of the Wi-Fi Hotspot of target terminal connection is obtained, which includes router
Title and MAC Address.
Wherein, which can refer to any terminal for needing to carry out simulator identification, for example produce with risk identification
The terminal of product connection, perhaps the terminal under specific air control scene or triggering (for example pass through programmable button or gesture or pre-
If other triggering modes) simulator identification terminal, etc., the application is without limitation.The air control scene may include stepping on
Record scene, transaction scene, the preferential field scene of APP etc..
Specifically, identification equipment can obtain the Wi- of terminal connection when needing to carry out simulator identification to a certain terminal
The title of the route-map of Fi hot spot such as router and its MAC Address etc., in order to according to the title of the router and MAC
Location determines whether the terminal runs on simulator environment.
102, whether the title for detecting the router is identical as the router rs name in the first preset blacklist, and should
Whether MAC Address is in the MAC Address set in the second preset blacklist.
Wherein, which includes one or more router rs names, which can
To be the Wi-Fi for being identified as the terminal (being identified as operating in the terminal of simulator environment) of simulator in historical data and being connected
Router title；Second blacklist may include one or more MAC Address set and/or one or more MAC Address,
The MAC Address for the router that the one or more MAC Address is connected by the terminal for being identified as simulator in historical data, this one
A or multiple MAC Address set are the MAC Address of the router connected according to the terminal for being identified as simulator in historical data
It counts.Optionally, first blacklist and the second blacklist can identical (i.e. each router rs name and MAC Address set
Can be configured in a blacklist), it can also be different and (independently configure).Whether preset detect MAC Address
Whether with the MAC in the second preset blacklist MAC Address set in second blacklist can also be known as detection MAC Address
MAC Address in the set of location is identical；Correspondingly, MAC Address, which is in MAC Address set, can refer to MAC Address and the MAC Address
MAC address in set is identical.
Optionally, which includes the name that the router that the terminal of simulator is connected is identified as in historical data
The more title of statistics number in title, such as preceding M that statistics number is most (M is the integer greater than 0, such as takes 10) a title, or
Person's statistics number is greater than the title of preset number threshold value (first threshold)；Second blacklist includes that mould is identified as in historical data
It the more MAC Address of statistics number or is made of the MAC Address in the MAC Address for the router that the terminal of quasi- device is connected
MAC Address set, for example (N is the integer greater than 0 to the preceding N of statistics number at most, such as takes 50) a MAC Address, or statistics time
Number is greater than the MAC Address of preset number threshold value (second threshold), or the MAC Address set determined by these MAC Address, etc.
Deng the application is without limitation.Wherein, the first threshold and second threshold can preset to obtain, the first threshold and second
Threshold value can be identical, for example is disposed as 80；Alternatively, the two can also be different, for example first threshold is 80, and second threshold is
60, vice versa, does not repeat herein.
103, when the title of the router is identical as the either router title in first blacklist, and the MAC Address
When in the MAC Address set, determine that the target terminal runs on simulator environment.
Specifically, identification equipment can be by will be in the title of the corresponding router of target terminal and the first above-mentioned blacklist
Router rs name matched, and will be in the MAC Address of the corresponding router of target terminal and the second above-mentioned blacklist
MAC Address or MAC Address set are matched.When matching obtains routing corresponding with the target terminal in first blacklist
The identical router rs name of the title of device, and matching obtains the corresponding router of the target terminal in second blacklist
MAC Address set locating for MAC Address (or matching obtains the identical MAC of MAC Address of router corresponding with the target terminal
Address), then it can recognize and be operate in simulator environment for the target terminal.
In embodiments of the present invention, identification equipment can by obtain terminal connection Wi-Fi Hotspot route-map,
And the title and MAC Address of the route-map such as router are tested and analyzed, the title that detects the router with
Either router title in default blacklist is identical, and when the MAC Address is in preset MAC Address set, that is, can determine
The target terminal runs on simulator environment.The embodiment of the present invention can be believed according to the router for the Wi-Fi Hotspot that terminal connects
For breath to carry out simulator identification, this helps to the accuracy for promoting simulator identification.
Fig. 2 is referred to, Fig. 2 is the flow diagram of another simulator recognition methods provided in an embodiment of the present invention.Tool
Body, as shown in Fig. 2, the simulator recognition methods may comprise steps of:
201, the route-map of the Wi-Fi Hotspot of target terminal connection is obtained, which includes router
Title and MAC Address.
Specifically, the description of the step 201 please refers to the associated description of step 101 in above-mentioned embodiment illustrated in fig. 1, herein
It does not repeat.
Optionally, when carrying out simulator identification, identification equipment multinomial can be set by obtaining the equipment bottom of target terminal
Standby information, for example the facility information may include following one or more: route-map (including the road of the Wi-Fi Hotspot of connection
Such as Wi-Fi service set (Service Set Identifier, SSID) by device title (or Wi-Fi title), router mac
Address (or Wi-Fi MAC Address) such as Wi-Fi basic service set identification (Basic Service Set Identifier,
BSSID) etc.), type (model and/or brand), CPU manufacturer information, Bluetooth information, sensor information, user use trace
Information for example memory headroom value, the network formats used, Android state (or be operating status, such as whether be in root shape
State), system file exception information (such as whether there are the system files of preset path and title), installation application number, deposit
The number of the file of storage, the packet name for accessing App, the access version number of App, the version number of SDK, OS Type, operation system
System version, equipment exclusive identification code (UDID), whether escaped from prison (for example 1 representative has been escaped from prison, and 0 representative is not escaped from prison), longitude and latitude
Whether information, network type, specified App install (for example 1 representative has been installed, and 0 representative is not installed), whether are mounted with that Ali is small
Number, whether be mounted with v8 plug-in unit, current time stamp (such as precision be millisecond), advertisement identifier, Vendor identifier, equipment type
Number, host name, CPU core calculation, cpu type, CPU subtype, screen resolution, storage gross space, storage fragmentation, when
Area, language, electricity, battery status, operator name, country ISO, starting time, keyboard list, did erased or distorted,
The did that is stored in localfile, GPS switch (for example 0 represent and close, 1 represent open), GPS licensing status, APP whether are opened
Dynamic link library list of load etc., to carry out simulator identification.Specifically, identification equipment can be believed by obtaining multinomial equipment
Breath is to carry out simulator identification, to promote the reliability of identification.It is advised moreover, the identification equipment can be identified according to preset simulator
It is then identified using the partial information in the facility information item of the acquisition for simulator, so that illegal person, which can not determine, specifically to be made
Which information simulator identification is carried out with, this helps to after preventing illegal person from recognizing a certain recognition rule distort phase
The generation that facility information leads to not the case where identifying simulator in time is closed, that is, prevents recognition rule to be cracked, so that further
Improve the reliability of simulator identification.
202, the flag value of the corresponding objective function of the route-map is obtained, and the target letter is determined according to the flag value
Whether number is by hook.
Optionally, before identifying whether as simulator according to facility information, identification equipment can be believed by detection device
It ceases whether corresponding function is tampered, and obtains true facility information when being tampered in time detecting, based on true
Facility information carry out simulator identification, thus improve simulator identification accuracy and reliability.In addition, it is optional, this
The raw API acquisition facility information in Android bottom source can be used in application, so that facility information is not easy to be tampered.
Wherein, which can be used for marking the state of the objective function, which can refer to whether be tampered
State, or can refer to read-write state, obstruction and non-blocking state, the state for exiting process or program and/or change file
The state of content etc., so as to determine the objective function whether by hook according to the flag value.Specifically, each
Function has corresponding flag, which is a variable, and when a certain function is tampered, the corresponding flag of the function can occur
Change.Whether identification equipment can be changed by the flag of detection function as a result, come determine the function whether by hook,
That is whether the corresponding facility information of the function is tampered.Wherein, it is corresponding can be stored in the objective function for the value of the flag
In memory.In embodiments of the present invention, if the title of the router and MAC Address correspond to the same function, equipment is identified
Hook detection can be carried out using the function as objective function；If the title and MAC Address of the router correspond to different functions,
Then identify that equipment can carry out hook inspection for the corresponding function of title of the router and the corresponding function of MAC Address respectively
It surveys, namely respectively realizes the corresponding function of the title of the router and the corresponding function of MAC Address very as objective function
The reduction of real facility information.
Optionally, when whether determining the objective function by hook according to the flag value, identification equipment can be by the flag
The character of predetermined position in value is compared with preset fixed character；When compare to obtain the character of the predetermined position with
When the fixed character difference, determine the objective function by hook.Wherein, the number of characters of the character of the predetermined position is fixed with this
The number of characters of character is identical, compares in order to match.That is, the flag, which changes, can refer to one of the flag value
Or multidigit changes, and the one or more predetermined positions that can refer to flag is one or more.To which identification is set
It is standby to be compared by the one or more fixed characters with when being not tampered with for the flag value predetermined position that will acquire,
If flag value this it is one or more change, i.e., flag value is one or more different from the fixed character, then shows
By hook, i.e. the corresponding facility information of the objective function is tampered the objective function.
For example, for Android version in 4.4 or more and 5.0 systems below, some Xposed plug-in units to certain function into
When row hook, 1 can be set by 1 (bit) of the fixed position of the flag value of the function；And the letter being normally not tampered with
Number, the position of flag value is 0 (i.e. above-mentioned fixed character).Therefore, can be by the fixed bit of the flag value of detection function
No is 0, so that it may know whether the function by Xposed plug-in unit has carried out hook.That is, if the flag value of the survey function
The fixed bit is not 0, that is, can be shown that the function by hook, which is tampered.
Optionally, when whether determining the objective function by hook according to the flag value, identification equipment can also be according to pre-
If logical algorithm to the flag value carry out logical operation, to obtain operation result value；When the operation result value is positive integer,
Determine the objective function by hook.Wherein, which can be holds according to the primary function in preset characters string and system
What jump address when row determined.That is, can also will according to logic of propositions algorithm to flag treated value with do not usurped
Fixed character such as 0 when changing is compared, if treated, the value changes, i.e., is not 0, for example be a certain positive integer
When, then show the function by hook.
For example, for Android version 5.0 and its above system, if logically algorithm such as logical expression
EntryPointFromJni&&AccessFlags&0x10000000 result is equal to positive integer, then can be shown that the function is tampered；
If the logical expression result is equal to 0 (as fixed character), it can be shown that the function is not tampered with.Wherein, should
EntryPointFromJni can refer to jump address when primary function such as native function executes, and AccessFlags is
Above-mentioned flag.
It is further alternative, identify that equipment before determining the objective function whether by hook according to the flag value, may be used also
It determines the system version that the target terminal target uses, and then goes selection according to the flag according to the system version of the target terminal
It is worth and determines the objective function whether by the mode of hook, to promote the efficiency of hook detection.Wherein, the system version and hook inspection
The corresponding relationship of the mode of survey can be preset to obtain.
203, when determining the objective function by hook, it is corresponding that the objective function is obtained from the memory of the objective function
Objective function pointer.
Wherein, it the function pointer and is stored in the different field of same memory by the function of hook, and different
There are mapping relations for function pointer and original function, and the storage address of different functions pointer and original function has mapping in other words
Relationship.The objective function can refer to the title of the router and the corresponding function of MAC Address by hook by hook；Alternatively, should
The corresponding function of the title of router is by hook and/or the corresponding function of the MAC Address by hook.
Optionally, after determining the objective function by hook, this can also be restored by the objective function of hook, with
Convenient for determining the corresponding real equipment information of the objective function.Specifically, determining a certain function such as the objective function quilt
After hook, can from its memory the corresponding function pointer of the quick obtaining objective function, i.e., above-mentioned objective function pointer, with
Convenient for determining for example primary API of the corresponding original function of the objective function according to the objective function pointer, i.e., not by the true of hook
Real function.
204, the corresponding relationship of each function pointer and function according to the pre-stored data determines that the objective function pointer is corresponding
Original function, and primary routing device information is determined according to the original function.
After determining the objective function pointer in the corresponding memory of the objective function, the mesh can be further determined that out
The corresponding original function of scalar functions pointer, i.e., true Method.And then the objective function can be replaced by the original function, it is real
Now to by the reduction of the function of hook.To identify that equipment can determine that the target terminal is corresponding true by the original function
Route-map, to carry out simulator identification based on real router information.Specifically, if the title and MAC of the router
The corresponding function in address can be restored to obtain the title and MAC Address of true primary routing device by hook；If the router
The corresponding function of title by hook, can restore to obtain the title of true primary routing device；If the MAC Address is corresponding
Function can be restored to obtain true original MAC address by hook.
It should be understood that the original function pointer stored in memory will not be tampered, according to the work of Xposed plug-in unit
Principle can back up the raw information of function before distorting objective function, and save particular address in memory,
That is the address of objective function pointer direction.And once these backup informations are also tampered, that Xposed plug-in unit will be unable to normally
Work.Therefore, the original function got in the particular address that the objective function pointer is directed toward, must be correct function,
It will not be tampered.
205, detect the router that the primary routing device information includes title whether in the first preset blacklist
Whether the MAC Address that router rs name is identical and the primary routing device information includes is in the second preset blacklist
MAC Address set.
206, when the title of the router is identical as the either router title in first blacklist, and the MAC Address
When in the MAC Address set, determine that the target terminal runs on simulator environment.
Specifically, the description of step 205-206 please refers to the correlation of step 102-103 in above-mentioned embodiment illustrated in fig. 1
Description, does not repeat herein.
Optionally, in other embodiments, identification equipment may also be combined with other equipment information further to identify the target
Whether terminal runs on simulator environment.For example, in some embodiments, identification equipment can also obtain the type of the target terminal
Information, the model information include the model and/or brand of the target terminal；Whether black with preset third detect the model information
Terminal models information in list is identical, includes at least one set of terminal models information in the third blacklist.Further, when this
The title of router is identical as the either router title in first blacklist, which is in the MAC Address set,
And the model information it is identical as any group of terminal models information in the third blacklist when, identification equipment can determine the target end
End runs on simulator environment.It includes: to work as that the model information is identical as any group of terminal models information in the third blacklist
When the model information is model, the model is identical as any terminal model in the third blacklist；When the model information is product
When board, the brand is identical as any terminal brand in the third blacklist；It, should when the model information includes model and brand
Model is identical as any terminal model in the third blacklist, and any terminal brand in the brand and the third blacklist
It is identical.It optionally, include one or more groups of terminal models information, one or more groups of terminal models information in the third blacklist
It can be the model information that the terminal of simulator is identified as in historical data, for example (L is greater than 0 to the preceding L that statistics number is most
Integer such as takes and 8) organizes the model information etc. of model information or statistics number greater than preset number threshold value (third threshold value), this
Place does not repeat.That is, the route-map for the Wi-Fi Hotspot that identification equipment is connected in combination with terminal and the type of terminal are believed
For breath to carry out simulator identification, this just further improves the reliability of simulator identification.
For another example, in some embodiments, identification equipment can also obtain the producer identification of the CPU of the target terminal, detection
Whether the producer identification of the CPU identical as the producer identification in preset white list, so when the router title with
Either router title in first blacklist is identical, which is in the MAC Address set, and the manufacturer of the CPU
When mark is all different with all producer identifications in the white list, determine that the target terminal runs on simulator environment.Its
In, it may include the mark of one or more legal CPU manufacturers in the white list.That is, identification equipment is in combination with eventually
The CPU manufacturer information of the route-map and terminal of holding the Wi-Fi Hotspot of connection carries out simulator identification, to promote simulation
The reliability of device identification.
For another example, in some embodiments, identification equipment may also be combined with terminal connection Wi-Fi Hotspot route-map,
The model information of terminal carries out simulator identification, to promote the reliability of simulator identification, does not repeat herein.
For another example, in some embodiments, it is default whether the facility information that identification equipment also can detect the target terminal meets
Rule, wherein the facility information of target terminal, which meets the preset rules, can refer to the following any one of satisfaction or multinomial rule:
1) presetting module is not configured in target terminal, presetting module includes bluetooth module, temperature sensor, light level
One or more of device；
The presetting module is the module for being identified as in the terminal of simulator not having configuring counted according to historical data, such as blue
Tooth module, temperature sensor, light sensor.So if recognizing terminal does not configure the presetting module, then it may be mould
Quasi- device.
2) the memory headroom value of target terminal is less than default memory threshold；
3) the first number of the application of target terminal installation is less than preset first quantity threshold；
4) the second number of the file of target terminal storage is less than preset second quantity threshold；
Wherein, first quantity threshold and the second quantity threshold can preset to obtain.
5) network formats that target terminal uses are all different with the all-network standard in preset network formats list；
Optionally, identification equipment can determine which is normal network system with the target area where combining target terminal
Formula, such as by being pre-configured with different zones and its corresponding network formats list, to determine net corresponding with the target area
Network standard list, the network formats in the network formats list are the proper network standard of the target area.If detected
The network formats that the target terminal uses are not the network formats in its corresponding network formats list, then the target terminal may
Simulator environment is run on, because simulator may distort network formats information.
6) there are the system files of preset path and title in the system of target terminal；
It may be simulator if there is abnormal system file in target terminal.For example, the system file of the exception
It may include the system file of following path and title :/dev/qemu_pipe ,/dev/socket/qemud ,/system/lib/
Libc_malloc_debug_qemu.so ,/sys/qemu_trace ,/proc/tty/drivers/goldfish etc..
7) target terminal is in root state etc..If detecting that target terminal is in Android root state,
It may be simulator.
In some embodiments, when the title of the router is identical as the either router title in first blacklist,
The MAC Address is in the MAC Address set, and when the facility information of the target terminal meets the preset rules, and identification equipment can
Determine that the target terminal runs on simulator environment.That is, the road for the Wi-Fi Hotspot that identification equipment is connected in combination with terminal
By device information, module configuration information, memory headroom information, the number of the application of installation, the number of the file of storage, the net that uses
The information such as network standard, system file exception information, operating status carry out simulator identification, further to promote simulator identification
Reliability.
For another example, in some embodiments, the router for the Wi-Fi Hotspot that identification equipment can also be connected according to above-mentioned terminal
Information, model information, CPU manufacturer information, module configuration information, memory headroom information, installation application number, storage
Any one of information such as the number of file, the network formats used, system file exception information, operating status or multinomial progress
Simulator identification, does not repeat herein.
Optionally, believe according to the model information of target terminal, CPU manufacturer information, module configuration information, memory headroom
It ceases, number, the number of file of storage, the network formats used, system file exception information, operating status of the application of installation
Before any one of equal facility informations or multinomial carry out simulator identification, the equipment for carrying out simulator identification also can detect
Whether information is tampered, if be tampered, carries out mould based on true facility information again after can restoring true facility information
Quasi- device identification.Wherein, whether detection device information is tampered and its mode of restoring can refer in above-mentioned steps 202-204 and detect road
The associated description of mode whether is tampered and its restored by device information, is not repeated herein.
It is further alternative, if it is determined that target terminal operates in simulator environment, and identification equipment produces alarm letter
Breath.For example, the warning information may include: risk class, it is user information, one or more in equipment malicious act.Wherein,
The risk class can be determined according to the target air control scene of terminal, specifically can be preset to obtain different air control scenes and wind
The corresponding relationship of dangerous grade；Alternatively, the application that the risk class can be run according to end objectives is determined, can specifically set in advance
It sets to obtain the corresponding relationship of different application and risk class；Alternatively, the risk class can also be according to terminal by the function of hook
Number is determined, specifically can be preset to obtain the corresponding relationship of different hook numbers and risk class；Alternatively, the risk class
It can also be determined according to the priority for the facility information that terminal is tampered, specifically can be preset to obtain the excellent of distinct device information
First grade and each priority and the corresponding relationship of risk class, etc., the application is without limitation.For example, the risk class can be with
It is divided into high-risk, middle danger, low danger or level-one, second level, three-level etc..The user information may include user identifier (User
Identification, UID), phone number, ID card No. (if register application when collect if) etc..The malice row
To may include distorting MAC Address, distorting CPU manufacturer, distort mobile phone model and brand, distort phone number etc., specifically may be used
It is determined by above-mentioned hook detection.
In addition, optional, identification equipment can also according to the warning information, to target terminal under send instructions, to target end
Operation on end (the APP client run in such as terminal) is controlled.For example, if identification equipment determines that the risk class is
Low danger, identification equipment, which can send instructions down, indicates client output prompt, it is desirable that user's validation information, verification mode include
But it is not limited to the modes such as short message verification code, picture validation code.Subsequent operation can not be carried out if verifying does not pass through.For another example, such as
Fruit identification equipment determines that the risk class is middle danger, and identification equipment, which can send instructions down, indicates that client forbids user in target wind
Control scene (such as log in, get red packet, coupon redemption, consume, transfer accounts etc.) requests access to operation.For another example, if known
Other equipment determine the risk class be it is high-risk, identification equipment, which can send instructions down, indicates client to forbid user that all are requested access to
Operation, etc., is not listed one by one herein.
For example, can obtain performance more stronger than mobile phone for certain mobile phone games using simulator and (actually belong to swim
Play cheating), the application can identify whether game application operates in simulator environment by above-mentioned recognition rule, can
Timely discovery runs on the game behavior in simulator, and then can prevent the behavior, prevents cheating from losing to user's bring.
For another example, the air control strategy for the petty load that a certain financial institution releases is only the user of specific region to be allowed such as to go up north
Wide user's loan, illegal user may use simulator to modify GPS positioning, achieve the purpose that gain loan by cheating around air control strategy
Money.The application can identify whether equipment runs on simulator environment by above-mentioned recognition rule as a result, and determine equipment
It runs on after simulator environment, refuses the loan requests of the user.Further, above-mentioned hook inspection also can be used in the application
Survey mode restores the GPS positioning, to acquire the true location information of user.
For another example, illegal person realizes a simulation by the way that the information such as mobile phone model, brand, manufacturer are arranged in simulator
Device software simulates the purpose of more different Android mobile phones, so that creating false identity gains preferential activity, registration reward etc. by cheating.Pass through
The application, after capable of determining that the information such as mobile phone model, brand, manufacturer are tampered according to above-mentioned hook detection mode, reduction is true
The information such as real mobile phone model, brand, manufacturer simultaneously carry out simulator identification, and then whether can identify equipment operation in time
Operate in simulator environment, and can be prevented in time the behavior when operating in simulator environment identifying, avoid to
Legitimate user causes damages.
In embodiments of the present invention, identification equipment can be by acquiring multinomial facility information, such as the Wi-Fi heat of terminal connection
The facility informations such as route-map of point carry out simulator identification, so that the accuracy of simulator identification is improved, moreover,
Before whether running on simulator environment according to facility information identification terminal, whether can be tampered by identification facility information,
And true facility information is restored when being tampered in time detecting, to carry out simulator knowledge based on true facility information
Not, this just further improves the accuracy of simulator identification.
Above method embodiment is all the simulator recognition methods to the application for example, retouching to each embodiment
It states and all emphasizes particularly on different fields, there is no the part being described in detail in some embodiment, reference can be made to the related descriptions of other embodiments.
Fig. 3 is referred to, Fig. 3 is a kind of structural schematic diagram for identifying equipment provided in an embodiment of the present invention.The present invention is implemented
The identification equipment of example includes the unit for executing above-mentioned simulator recognition methods.Specifically, the identification equipment 300 of the present embodiment
Can include: acquiring unit 301 and recognition unit 302.Wherein,
Acquiring unit 301, the route-map of the Wireless Fidelity Wi-Fi Hotspot for obtaining target terminal connection are described
Route-map includes the title and MAC address of router；
Recognition unit 302, for detect the router title whether with the router in the first preset blacklist
Title is identical and whether the MAC Address is in the MAC Address set in preset the second blacklist；
The recognition unit 302 is also used to when any routing in the title of the router and first blacklist
Device title is identical, and when the MAC Address is in the MAC Address set, determines that the target terminal runs on simulator ring
Border.
Optionally, the acquiring unit 301 is also used to obtain the model information of the target terminal, the model information
Model and/or brand including the target terminal；
The recognition unit 302, be also used to detect the model information whether with the terminal in preset third blacklist
Model information is identical, includes at least one set of terminal models information in the third blacklist；
The recognition unit 302, specifically for when any road in the title of the router and first blacklist
Identical by device title, the MAC Address is in the MAC Address set, and in the model information and the third blacklist
Any group of terminal models information it is identical when, determine that the target terminal runs on simulator environment.
Optionally, the acquiring unit 301, is also used to obtain the manufacturer of the central processor CPU of the target terminal
Mark；
The recognition unit 302, be also used to detect the CPU producer identification whether with the life in preset white list
Business men mark is identical；
The recognition unit 302, specifically for when any road in the title of the router and first blacklist
Identical by device title, the MAC Address is in the MAC Address set, and the producer identification of the CPU and the white list
When interior all producer identifications are all different, determine that the target terminal runs on simulator environment.
Optionally, whether the recognition unit 302, the facility information for being also used to detect the target terminal meet default rule
Then, wherein the facility information of the target terminal meets the preset rules and includes:
Presetting module is not configured in the target terminal, the presetting module includes bluetooth module, temperature sensor, light
One or more of line sensor；And/or
The memory headroom value of the target terminal is less than default memory threshold；And/or
First number of the application of the target terminal installation is less than preset first quantity threshold；And/or
Second number of the file of the target terminal storage is less than preset second quantity threshold；And/or
The network formats that the target terminal uses and the all-network standard in preset network formats list not phase
Together；And/or
There are the system files of preset path and title in the system of the target terminal；And/or
The operating status of the target terminal is root state；
The recognition unit 302, specifically for when any road in the title of the router and first blacklist
Identical by device title, the MAC Address is in the MAC Address set, and described in the facility information satisfaction of the target terminal
When preset rules, determine that the target terminal runs on simulator environment.
Optionally, the identification equipment further include: hook detection unit 303 and reduction unit 304；
The acquiring unit 301 is also used to obtain the flag value of the corresponding objective function of the route-map；
Hook detection unit 303, for determining the objective function whether by hook according to the flag value；
The acquiring unit 301 is also used to when determining the objective function by hook, from the memory of the objective function
It is middle to obtain the corresponding objective function pointer of the objective function；
Reduction unit 304 determines the mesh for the corresponding relationship of each function pointer and function according to the pre-stored data
The corresponding original function of scalar functions pointer, and primary routing device information is determined according to the original function；
The recognition unit 302, specifically for detect the router that the primary routing device information includes title whether
Whether the MAC Address that the primary routing device information identical and described with the router rs name in the first preset blacklist includes
MAC Address set in the second preset blacklist.
Optionally, the hook detection unit 303, specifically for by the character of the predetermined position in the flag value with
Preset fixed character is compared, the number of characters phase of the number of characters of the character of the predetermined position and the fixed character
Together；When the character and the fixed character difference for comparing to obtain the predetermined position, determine the objective function by hook.
Optionally, the hook detection unit 303 is specifically used for carrying out the flag value according to preset logical algorithm
Logical operation, to obtain operation result value, wherein the logical algorithm is according to the primary function in preset characters string and system
What jump address when execution determined；When the operation result value is positive integer, determine the objective function by hook.
Specifically, the identification equipment can realize that simulator of the above-mentioned Fig. 1 into embodiment illustrated in fig. 2 is known by said units
Step some or all of in other method.It should be understood that the embodiment of the present invention is the Installation practice of corresponding method embodiment, other side
The description of method embodiment, is also applied for the embodiment of the present invention.
In embodiments of the present invention, identification equipment can by obtain terminal connection Wi-Fi Hotspot route-map,
And the title and MAC Address of the route-map such as router are tested and analyzed, the title that detects the router with
Either router title in default blacklist is identical, and when the MAC Address is in preset MAC Address set, that is, can determine
The target terminal runs on simulator environment.The embodiment of the present invention can be believed according to the router for the Wi-Fi Hotspot that terminal connects
For breath to carry out simulator identification, this helps to the accuracy for promoting simulator identification.
Fig. 4 is referred to, Fig. 4 is the structural schematic diagram of another identification equipment provided in an embodiment of the present invention.The identification is set
It is ready for use on and executes above-mentioned method.As shown in figure 4, the identification equipment 400 in the present embodiment may include: one or more processing
Device 401 and memory 402.Optionally, which may also include one or more user interfaces 403, and/or, one or
Multiple communication interfaces 404.Above-mentioned processor 401, user interface 403, communication interface 404 and memory 402 can pass through bus 405
Connection, or can connect by other means, it is illustrated in Fig. 4 with bus mode.Wherein, memory 402 is used for
Computer program is stored, the computer program includes program instruction, and processor 401 is used to execute the journey of the storage of memory 402
Sequence instruction.
Wherein, processor 401 can be used for calling described program instruction execution following steps: obtain the nothing of target terminal connection
The route-map of line fidelity Wi-Fi Hotspot, the route-map include title and the media access control MAC of router
Location；With detecting the title MAC whether identical and described with the router rs name in the first preset blacklist of the router
Whether location is in the MAC Address set in the second preset blacklist；Title and first blacklist when the router
Interior either router title is identical, and when the MAC Address is in the MAC Address set, determines the target terminal fortune
Row is in simulator environment.
Optionally, processor 401 is calling the determining target terminal described in described program instruction execution to run on simulation
It before device environment, is also used to execute following steps: obtaining the model information of the target terminal, the model information includes described
The model and/or brand of target terminal；Detect whether the model information is believed with the terminal models in preset third blacklist
Manner of breathing is same, includes at least one set of terminal models information in the third blacklist；
Processor 401 is calling described in described program instruction execution when the title of the router and first blacklist
Interior either router title is identical, and when the MAC Address is in the MAC Address set, determines the target terminal fortune
Row specifically executes following steps: when title and any in first blacklist of the router when simulator environment
Router rs name is identical, and the MAC Address is in the MAC Address set, and the model information and the third blacklist
When any group of interior terminal models information is identical, determine that the target terminal runs on simulator environment.
Optionally, processor 401 is calling the determining target terminal described in described program instruction execution to run on simulation
It before device environment, is also used to execute following steps: obtaining the producer identification of the central processor CPU of the target terminal；Inspection
Whether the producer identification for surveying the CPU is identical as the producer identification in preset white list；
Processor 401 is calling described in described program instruction execution when the title of the router and first blacklist
Interior either router title is identical, and when the MAC Address is in the MAC Address set, determines the target terminal fortune
Row specifically executes following steps: when title and any in first blacklist of the router when simulator environment
Router rs name is identical, and the MAC Address is in the MAC Address set, and the producer identification of the CPU and the white name
When all producer identifications in list are all different, determine that the target terminal runs on simulator environment.
Optionally, processor 401 is calling the determining target terminal described in described program instruction execution to run on simulation
Before device environment, be also used to execute following steps: whether the facility information for detecting the target terminal meets preset rules,
In, it includes: to be not configured with presetting module in the target terminal that the facility information of the target terminal, which meets the preset rules,
The presetting module includes one or more of bluetooth module, temperature sensor, light sensor；And/or the target is whole
The memory headroom value at end is less than default memory threshold；And/or the first number of the application of the target terminal installation is less than default
The first quantity threshold；And/or the second number of the file of the target terminal storage is less than preset second quantity threshold；
And/or the network formats that the target terminal uses are all different with the all-network standard in preset network formats list；
And/or there are the system files of preset path and title in the system of the target terminal；And/or the fortune of the target terminal
Row state is root state；
Processor 401 is calling described in described program instruction execution when the title of the router and first blacklist
Interior either router title is identical, and when the MAC Address is in the MAC Address set, determines the target terminal fortune
Row specifically executes following steps in simulator environment: any road in the title of the router and first blacklist
Identical by device title, the MAC Address is in the MAC Address set, and described in the facility information satisfaction of the target terminal
When preset rules, determine that the target terminal runs on simulator environment.
Optionally, processor 401 the title for calling the detection router described in described program instruction execution whether with
Router rs name in the first preset blacklist is identical and whether the MAC Address is in preset the second blacklist
MAC Address set before, be also used to execute following steps: obtaining the flag of the corresponding objective function of the route-map
Value, and determine the objective function whether by hook according to the flag value；When determining the objective function by hook, from institute
It states and obtains the corresponding objective function pointer of the objective function in the memory of objective function；Each function pointer according to the pre-stored data
With the corresponding relationship of function, the corresponding original function of the objective function pointer is determined, and determined according to the original function
Primary routing device information out；
Whether processor 401 is in the title for calling the detection router described in described program instruction execution with preset the
Router rs name in one blacklist is identical and whether the MAC Address is in the MAC Address in preset the second blacklist
When set, specifically execute following steps: detect the router that the primary routing device information includes title whether with it is preset
Whether the MAC Address that the router rs name in the first blacklist is identical and the primary routing device information includes is in preset
The second blacklist in MAC Address set.
Optionally, processor 401 according to the flag value determines the target described in described program instruction execution calling
When whether function is by hook, specifically execute following steps: by the character of the predetermined position in the flag value with it is preset solid
Determine character to be compared, the number of characters of the character of the predetermined position is identical as the number of characters of the fixed character；When comparing
When obtaining the character of the predetermined position with the fixed character difference, determine the objective function by hook.
Optionally, processor 401 according to the flag value determines the target described in described program instruction execution calling
When whether function is by hook, following steps are specifically executed: logical operation being carried out to the flag value according to preset logical algorithm,
To obtain operation result value, wherein the logical algorithm is when being executed according to the primary function in preset characters string and system
What jump address determined；When the operation result value is positive integer, determine the objective function by hook.
Wherein, the processor 401 can be central processing unit (Central Processing Unit, CPU), should
Processor can also be other general processors, digital signal processor (Digital Signal Processor, DSP), specially
With integrated circuit (Application Specific Integrated Circuit, ASIC), ready-made programmable gate array
(Field-Programmable Gate Array, FPGA) either other programmable logic device, discrete gate or transistor are patrolled
Collect device, discrete hardware components etc..General processor can be microprocessor or the processor be also possible to it is any conventional
Processor etc..
User interface 403 may include input equipment and output equipment, and input equipment may include Trackpad, microphone etc.,
Output equipment may include display (LCD etc.), loudspeaker etc..
Communication interface 404 may include receiver and transmitter, for being communicated with other equipment.
Memory 402 may include read-only memory and random access memory, and provide instruction sum number to processor 401
According to.The a part of of memory 402 can also include nonvolatile RAM.For example, memory 402 can also store
The corresponding relationship etc. of above-mentioned function pointer and function.
In the specific implementation, above-mentioned Fig. 1 can be performed to shown in Fig. 3 in processor 401 described in the embodiment of the present invention etc.
The implementation of each unit described in Fig. 4 of the embodiment of the present invention also can be performed in implementation described in embodiment of the method,
It does not repeat herein.
The embodiment of the invention also provides a kind of computer readable storage medium, the computer-readable recording medium storage
There is computer program, mould described in embodiment corresponding to Fig. 1 to Fig. 2 can be realized when the computer program is executed by processor
Step some or all of in quasi- device recognition methods, can also realize the function of the identification equipment of Fig. 3 of the present invention or embodiment illustrated in fig. 4
Can, it does not repeat herein.
The embodiment of the invention also provides a kind of computer program products comprising instruction, when it runs on computers
When, so that step some or all of in the computer execution above method.
The computer readable storage medium can be the storage inside list of identification equipment described in aforementioned any embodiment
Member, such as the hard disk or memory of identification equipment.The computer readable storage medium is also possible to the outside of the identification equipment
The plug-in type hard disk being equipped in storage equipment, such as the identification equipment, intelligent memory card (Smart Media Card, SMC),
Secure digital (Secure Digital, SD) card, flash card (Flash Card) etc..
In this application, term "and/or", only a kind of incidence relation for describing affiliated partner, indicates may exist
Three kinds of relationships, for example, A and/or B, can indicate: individualism A exists simultaneously A and B, these three situations of individualism B.Separately
Outside, character "/" herein typicallys represent the relationship that forward-backward correlation object is a kind of "or".
In the various embodiments of the application, magnitude of the sequence numbers of the above procedures are not meant to the elder generation of execution sequence
Afterwards, the execution sequence of each process should be determined by its function and internal logic, the implementation process structure without coping with the embodiment of the present invention
At any restriction.
The above, some embodiments only of the invention, but scope of protection of the present invention is not limited thereto, and it is any
Those familiar with the art in the technical scope disclosed by the present invention, can readily occur in various equivalent modifications or replace
It changes, these modifications or substitutions should be covered by the protection scope of the present invention.
Claims (10)
1. a kind of simulator recognition methods characterized by comprising
The route-map of the Wireless Fidelity Wi-Fi Hotspot of target terminal connection is obtained, the route-map includes router
Title and MAC address；
Detect the title MAC whether identical and described with the router rs name in the first preset blacklist of the router
Whether address is in the MAC Address set in the second preset blacklist；
When the title of the router is identical as the either router title in first blacklist, and at the MAC Address
When the MAC Address set, determine that the target terminal runs on simulator environment.
2. the method according to claim 1, wherein running on simulator ring in the determination target terminal
Before border, the method also includes:
The model information of the target terminal is obtained, the model information includes the model and/or brand of the target terminal；
Whether identical as the terminal models information in preset third blacklist detect the model information, the third blacklist
In include at least one set of terminal models information；
It is described when the title of the router is identical as the either router title in first blacklist, and the MAC
When location is in the MAC Address set, determine that the target terminal runs on simulator environment, comprising:
When the title of the router is identical as the either router title in first blacklist, the MAC Address is in
The MAC Address set, and when the model information is identical as any group of terminal models information in the third blacklist, really
The fixed target terminal runs on simulator environment.
3. the method according to claim 1, wherein running on simulator ring in the determination target terminal
Before border, the method also includes:
Obtain the producer identification of the central processor CPU of the target terminal；
Whether the producer identification for detecting the CPU is identical as the producer identification in preset white list；
It is described when the title of the router is identical as the either router title in first blacklist, and the MAC
When location is in the MAC Address set, determine that the target terminal runs on simulator environment, comprising:
When the title of the router is identical as the either router title in first blacklist, the MAC Address is in
The MAC Address set, and the producer identification of the CPU is all different with all producer identifications in the white list
When, determine that the target terminal runs on simulator environment.
4. the method according to claim 1, wherein running on simulator ring in the determination target terminal
Before border, the method also includes:
Whether the facility information for detecting the target terminal meets preset rules, wherein the facility information of the target terminal is full
The preset rules include: enough
Presetting module is not configured in the target terminal, the presetting module includes bluetooth module, temperature sensor, light biography
One or more of sensor；And/or
The memory headroom value of the target terminal is less than default memory threshold；And/or
First number of the application of the target terminal installation is less than preset first quantity threshold；And/or
Second number of the file of the target terminal storage is less than preset second quantity threshold；And/or
The network formats that the target terminal uses are all different with the all-network standard in preset network formats list；
And/or
There are the system files of preset path and title in the system of the target terminal；And/or
The operating status of the target terminal is root state；
It is described when the title of the router is identical as the either router title in first blacklist, and the MAC
When location is in the MAC Address set, determine that the target terminal runs on simulator environment, comprising:
When the title of the router is identical as the either router title in first blacklist, the MAC Address is in
The MAC Address set, and when the facility information of the target terminal meets the preset rules, determine the target terminal fortune
Row is in simulator environment.
5. method according to claim 1-4, which is characterized in that be in the title of the detection router
Whether the no MAC Address identical and described with router rs name in the first preset blacklist is in the second preset black name
Before MAC Address set in list, the method also includes:
The flag value of the corresponding objective function of the route-map is obtained, and the objective function is determined according to the flag value
Whether by hook；
When determining the objective function by hook, the corresponding mesh of the objective function is obtained from the memory of the objective function
Scalar functions pointer；
The corresponding relationship of each function pointer and function according to the pre-stored data determines that the objective function pointer is corresponding original
Function, and primary routing device information is determined according to the original function；
Whether the title of the detection router is identical and described as the router rs name in the first preset blacklist
Whether MAC Address is in the MAC Address set in the second preset blacklist, comprising:
Detect the router that the primary routing device information includes title whether with the router in the first preset blacklist
Whether the MAC Address that title is identical and the primary routing device information includes is with being in the MAC in the second preset blacklist
Location set.
6. according to the method described in claim 5, it is characterized in that, described determine that the objective function is according to the flag value
It is no by hook, comprising:
The character of predetermined position in the flag value is compared with preset fixed character, the predetermined position
The number of characters of character is identical as the number of characters of the fixed character；
When the character and the fixed character difference for comparing to obtain the predetermined position, the objective function quilt is determined
hook。
7. according to the method described in claim 5, it is characterized in that, described determine that the objective function is according to the flag value
It is no by hook, comprising:
Logical operation is carried out to the flag value according to preset logical algorithm, to obtain operation result value, wherein the logic
Algorithm is that jump address when being executed according to the primary function in preset characters string and system determines；
When the operation result value is positive integer, determine the objective function by hook.
8. a kind of identification equipment, which is characterized in that including for executing the side as described in any one of claim 1-7 claim
The unit of method.
9. a kind of identification equipment, which is characterized in that including processor, user interface, communication interface and memory, the processing
Device, user interface, communication interface and memory are connected with each other, wherein the memory is for storing computer program, the meter
Calculation machine program includes program instruction, and the processor is configured for calling described program instruction, executes claim 1-7 such as and appoints
Method described in one.
10. a kind of computer readable storage medium, which is characterized in that the computer storage medium is stored with computer program,
The computer program includes program instruction, and described program instruction makes the processor execute such as right when being executed by a processor
It is required that the described in any item methods of 1-7.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810855586.8A CN109062667B (en) | 2018-07-27 | 2018-07-27 | Simulator identification method, simulator identification equipment and computer readable medium |
| PCT/CN2018/107748 WO2020019485A1 (en) | 2018-07-27 | 2018-09-26 | Simulator identification method, identification device, and computer readable medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810855586.8A CN109062667B (en) | 2018-07-27 | 2018-07-27 | Simulator identification method, simulator identification equipment and computer readable medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109062667A true CN109062667A (en) | 2018-12-21 |
| CN109062667B CN109062667B (en) | 2023-04-18 |
Family
ID=64831519
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810855586.8A Active CN109062667B (en) | 2018-07-27 | 2018-07-27 | Simulator identification method, simulator identification equipment and computer readable medium |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN109062667B (en) |
| WO (1) | WO2020019485A1 (en) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109902500A (en) * | 2019-03-11 | 2019-06-18 | 北京城市网邻信息技术有限公司 | A kind of method and system for realizing calling service data safety by chained library |
| CN110248372A (en) * | 2019-04-25 | 2019-09-17 | 深圳壹账通智能科技有限公司 | A kind of method, apparatus, storage medium and the computer equipment of simulator detection |
| CN110427758A (en) * | 2019-08-08 | 2019-11-08 | 北京智游网安科技有限公司 | Position cheat detecting method, intelligent terminal and storage medium |
| CN110532774A (en) * | 2019-07-24 | 2019-12-03 | 阿里巴巴集团控股有限公司 | Hook inspection method, device, server and readable storage medium storing program for executing |
| CN110619210A (en) * | 2019-08-27 | 2019-12-27 | 苏宁云计算有限公司 | Simulator detection method and system |
| CN112905301A (en) * | 2021-03-04 | 2021-06-04 | 中国科学院信息工程研究所 | Detection method and device for Android simulator |
| CN113282304A (en) * | 2021-05-14 | 2021-08-20 | 杭州云深科技有限公司 | System for identifying virtual machine based on app installation list |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104134041A (en) * | 2014-07-31 | 2014-11-05 | 北京奇虎科技有限公司 | Anti-detecting method and device of terminal simulator system |
| CN105162768A (en) * | 2015-07-31 | 2015-12-16 | 腾讯科技（深圳）有限公司 | Method and device for detecting phishing Wi-Fi hotspots |
| CN107633170A (en) * | 2017-09-30 | 2018-01-26 | 北京梆梆安全科技有限公司 | A kind of Android simulator detection method and device of combination ardware feature and sensor |
| CN107729121A (en) * | 2017-09-30 | 2018-02-23 | 北京梆梆安全科技有限公司 | Simulator detection method and device |
| CN107729749A (en) * | 2017-09-30 | 2018-02-23 | 北京梆梆安全科技有限公司 | With reference to system information and the Android simulator detection method and device of ardware feature |
| CN107729750A (en) * | 2017-09-30 | 2018-02-23 | 北京梆梆安全科技有限公司 | With reference to configuration information and the Android simulator detection method and device of ardware feature |
| CN108021805A (en) * | 2017-12-18 | 2018-05-11 | 上海众人网络安全技术有限公司 | Detect method, apparatus, equipment and the storage medium of Android application program running environment |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP5698614B2 (en) * | 2011-06-22 | 2015-04-08 | インターナショナル・ビジネス・マシーンズ・コーポレーションＩｎｔｅｒｎａｔｉｏｎａｌ Ｂｕｓｉｎｅｓｓ Ｍａｃｈｉｎｅｓ Ｃｏｒｐｏｒａｔｉｏｎ | Context information processing system and method |
| CN105162799A (en) * | 2015-09-24 | 2015-12-16 | 北京奇虎科技有限公司 | Method for checking whether client is legal mobile terminal or not and server |
| CN108156268B (en) * | 2016-12-05 | 2020-05-26 | 腾讯科技（深圳）有限公司 | Method for acquiring device identifier, server and terminal device |
-
2018
- 2018-07-27 CN CN201810855586.8A patent/CN109062667B/en active Active
- 2018-09-26 WO PCT/CN2018/107748 patent/WO2020019485A1/en active Application Filing
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104134041A (en) * | 2014-07-31 | 2014-11-05 | 北京奇虎科技有限公司 | Anti-detecting method and device of terminal simulator system |
| CN105162768A (en) * | 2015-07-31 | 2015-12-16 | 腾讯科技（深圳）有限公司 | Method and device for detecting phishing Wi-Fi hotspots |
| CN107633170A (en) * | 2017-09-30 | 2018-01-26 | 北京梆梆安全科技有限公司 | A kind of Android simulator detection method and device of combination ardware feature and sensor |
| CN107729121A (en) * | 2017-09-30 | 2018-02-23 | 北京梆梆安全科技有限公司 | Simulator detection method and device |
| CN107729749A (en) * | 2017-09-30 | 2018-02-23 | 北京梆梆安全科技有限公司 | With reference to system information and the Android simulator detection method and device of ardware feature |
| CN107729750A (en) * | 2017-09-30 | 2018-02-23 | 北京梆梆安全科技有限公司 | With reference to configuration information and the Android simulator detection method and device of ardware feature |
| CN108021805A (en) * | 2017-12-18 | 2018-05-11 | 上海众人网络安全技术有限公司 | Detect method, apparatus, equipment and the storage medium of Android application program running environment |
Cited By (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109902500A (en) * | 2019-03-11 | 2019-06-18 | 北京城市网邻信息技术有限公司 | A kind of method and system for realizing calling service data safety by chained library |
| CN109902500B (en) * | 2019-03-11 | 2021-02-26 | 北京城市网邻信息技术有限公司 | Method and system for realizing service call data security through link library |
| CN110248372A (en) * | 2019-04-25 | 2019-09-17 | 深圳壹账通智能科技有限公司 | A kind of method, apparatus, storage medium and the computer equipment of simulator detection |
| CN110248372B (en) * | 2019-04-25 | 2023-04-11 | 深圳壹账通智能科技有限公司 | Simulator detection method and device, storage medium and computer equipment |
| CN110532774A (en) * | 2019-07-24 | 2019-12-03 | 阿里巴巴集团控股有限公司 | Hook inspection method, device, server and readable storage medium storing program for executing |
| CN110427758A (en) * | 2019-08-08 | 2019-11-08 | 北京智游网安科技有限公司 | Position cheat detecting method, intelligent terminal and storage medium |
| CN110427758B (en) * | 2019-08-08 | 2021-06-01 | 北京智游网安科技有限公司 | Position spoofing detection method, intelligent terminal and storage medium |
| CN110619210A (en) * | 2019-08-27 | 2019-12-27 | 苏宁云计算有限公司 | Simulator detection method and system |
| CN112905301A (en) * | 2021-03-04 | 2021-06-04 | 中国科学院信息工程研究所 | Detection method and device for Android simulator |
| CN113282304A (en) * | 2021-05-14 | 2021-08-20 | 杭州云深科技有限公司 | System for identifying virtual machine based on app installation list |
| CN113282304B (en) * | 2021-05-14 | 2022-04-29 | 杭州云深科技有限公司 | System for identifying virtual machine based on app installation list |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2020019485A1 (en) | 2020-01-30 |
| CN109062667B (en) | 2023-04-18 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109117250A (en) | A kind of simulator recognition methods, identification equipment and computer-readable medium | |
| CN109144665A (en) | A kind of simulator recognition methods, identification equipment and computer-readable medium | |
| CN109062667A (en) | A kind of simulator recognition methods, identification equipment and computer-readable medium | |
| CN109492378A (en) | A kind of auth method based on EIC equipment identification code, server and medium | |
| CN109561085A (en) | A kind of auth method based on EIC equipment identification code, server and medium | |
| CN107820210B (en) | Sign-in method, mobile terminal and computer readable storage medium | |
| CN104009977B (en) | A kind of method and system of information protection | |
| US9530064B2 (en) | Vehicle data collection and verification | |
| CN103440456B (en) | The method and device that a kind of application security is assessed | |
| ES2808954T3 (en) | Procedure and device for use in risk management of application information | |
| CN109145590B (en) | Function hook detection method, detection equipment and computer readable medium | |
| CN106716436A (en) | Information display method and system | |
| CN107729750A (en) | With reference to configuration information and the Android simulator detection method and device of ardware feature | |
| CN110933113A (en) | Block chain-based interactive behavior detection method, device, equipment and storage medium | |
| US20220164423A1 (en) | Method and apparatus for user recognition | |
| CN106412078B (en) | Accurate information method for pushing, device and system | |
| CN110365685A (en) | A kind of data processing method, device, equipment and computer readable storage medium | |
| CN112700287A (en) | Anti-cheating method and device for application program | |
| CN112560114A (en) | Method and device for calling intelligent contract | |
| CN111582868A (en) | Transaction request processing method, device and equipment | |
| CN108712253B (en) | Counterfeit mobile terminal identification method and device based on fingerprint of mobile phone sensor | |
| JP6656281B2 (en) | System, method, and non-transitory computer-readable storage medium for performing secure computer-based candidate evaluation | |
| CN110363648B (en) | Multi-dimensional attribute verification method and device based on same geographic type and electronic equipment | |
| CN113468541A (en) | Operating environment recognition method and device, electronic equipment and storage medium | |
| CN107567627B (en) | Device with test execution environment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |