CN109992467B

CN109992467B - Method and system for analyzing data generated by interactive application

Info

Publication number: CN109992467B
Application number: CN201711477057.0A
Authority: CN
Inventors: 徐亦伟; 徐强; 刘方圆; 李燕涛
Original assignee: Tianjin Yake Interactive Technology Co ltd
Current assignee: Tianjin Yake Interactive Technology Co ltd
Priority date: 2017-12-29
Filing date: 2017-12-29
Publication date: 2023-04-18
Anticipated expiration: 2037-12-29
Also published as: CN109992467A

Abstract

The embodiment of the invention discloses a method and a system, which are used for performing reverse engineering analysis on original data generated in the running process of a target application to obtain a key algorithm used by the target application, and processing the original data according to the obtained key algorithm to obtain result data in a custom format. The method and the system can better present the internal information of the interaction between the user and the target application and help the user to know the preferred mode or strategy of the interaction between the user and the target application.

Description

Method and system for analyzing data generated by interactive application

Technical Field

The present invention relates to data processing techniques using computer programs, and in particular to the use of computer programs to parse data generated during the operation of an interactive computer application and display the results of the analysis.

Background

Many computer applications interact with users during the running process, for example, the computer game program receives the operation instructions of the players (for example, the "killing" operation sent by the players by using the keyboard) during the running process and displays the result or influence generated by the operation instructions to the players (for example, some monsters or other players are hit or even killed by the "killing" action of the players). For some computer applications, users operate individually, while in some other computer applications, a group of users operate in concert. In many of these applications, the user may have objects against which to compete, including objects that are pre-defined in the application or other players. Computer game programs, particularly large network game programs, are good examples of such computer applications.

At the same time, these applications may provide some metrics or rules to measure the "success" or efficiency of a user's actions, such as whether the user has completed a certain preset goal within a specified time, or whether the user has defeated another user against whom (e.g., represented as a virtual "kill" in a computer game).

As computer game programs become more complex, so too does the operation of the user and the interaction of the program with the user. For some computer applications, this increase in complexity creates a need for how users can deeply review and analyze their own operation modes for the users to determine the success rate or efficiency of their adopted operation strategies.

Disclosure of Invention

The embodiment of the invention discloses a method for processing data generated during the running of an interactive target application, which comprises the following steps: a reverse analysis step, which is used for performing reverse engineering analysis on the original data generated in the running process of the target application to obtain a key algorithm used by the target application; and a data conversion step, which is used for processing the original data according to the obtained key algorithm so as to obtain result data in a custom format.

According to the preferred embodiment of the invention, the video recording module carried by the target application is utilized to generate the video recording file for the user to run the target application process. The video file is the original data.

According to a preferred embodiment of the present invention, the inverse analysis step comprises: obtaining the original data; running the target application by taking the original data as input, and simultaneously running a reverse engineering analysis tool module corresponding to the target application to monitor the running of the target application to generate a target code; analyzing the target code to identify target features; and constructing a key algorithm of the target application according to the target characteristics.

According to a preferred embodiment of the present invention, the data conversion step includes: constructing a data conversion module according to a key algorithm; and operating the data conversion module by taking the original data as input to obtain result data with a custom structure. Where the custom format may be a format of "key-value" pairs.

According to a preferred embodiment of the present invention, further comprising: and a presentation step for analyzing the result data and presenting the analyzed result. The presenting step includes presenting to the user in a visualized manner.

Another aspect of the invention is a system for processing data generated during runtime of a target application, comprising: the reverse analysis device is used for performing reverse engineering analysis on original data generated in the running process of the target application to obtain a key algorithm used by the target application; and the data conversion device is used for processing the original data according to the obtained key algorithm so as to obtain result data in a custom format.

Another aspect of the invention is a storage medium containing computer-executable instructions that, when executed by a computer, perform a method comprising: a reverse analysis step, which is used for performing reverse engineering analysis on the original data generated in the running process of the target application to obtain a key algorithm used by the target application; and a data conversion step, which is used for processing the original data according to the obtained key algorithm so as to obtain result data in a custom format.

Benefits of embodiments of the present invention include, but are not limited to, at least one of the following: the user experience is not influenced; analyzing and selecting the original data to better help a user to know the preferred mode or strategy of the interaction with the target application; the storage space is saved; user data is presented more intuitively.

Drawings

For a more complete understanding of this disclosure, reference is made to the following detailed description of the exemplary embodiments taken in conjunction with the accompanying drawings.

FIG. 1 illustrates a method of processing data generated during the execution of an interactive target application in accordance with an embodiment of the present invention;

FIG. 2 illustrates a process of reverse engineering raw data generated during the runtime of a target application to derive key algorithms used by the target application, in accordance with an embodiment of the present invention;

FIG. 3 shows an example of the output results of the reverse engineering analysis in accordance with the method of FIG. 2;

FIG. 4 illustrates a process of deriving result data having a custom structure from raw data generated during the running of a target application according to a derived key algorithm, according to an embodiment of the present invention; and is provided with

FIG. 5 illustrates an example of parsing and visually presenting result data having a custom structure.

Detailed Description

As a typical interactive application, a computer game program (including a standalone game and a network-based single-player or multi-player game) interacts with a user (player) at a high frequency during the running process, for example, the player sends various operation instructions (e.g., various actions) or data (e.g., dialogue with other players) to the program through an input device such as a keyboard, a mouse, a joystick, a microphone, etc., and also receives output and feedback of the game program (e.g., results of player actions, progress of the game, dynamics of other players, etc.) through an output device such as a display screen and a speaker. At many times, the user's inputs and the program's outputs are synchronized or interleaved in real time. The user needs to adjust his own actions and strategies in time according to the output and feedback of the game program to obtain better success rate or efficiency.

Referring to FIG. 1, according to an embodiment of the present invention, a user starts an interactive application, such as a network game program, and starts to interact with the application, and simultaneously starts an acquisition module to "record" the application in real time during the running process (step 102). The acquisition module may be an inherent module carried by the application itself, or may be an additional module independent of the application. As a preferred embodiment, this "video recording" process does not change the binary file of the target application, so that the efficiency of the running of the application itself is not affected; of course, this "video recording" process can also "break-in" the process of application execution for special purposes, as system performance allows. As an example, the acquisition module of the game program may record the input of the player and the evolution state of the game in units of frames.

The form and format of the raw data obtained in step 102 varies from application to application. For example, the obtaining module may send the obtained original data from the player to the game server in a streaming manner for saving (e.g., in a file format with ". Play" as suffix); meanwhile, the user can actively download the original data from the server and store the original data in a local game directory. Or, after the permission of the user is obtained, the game program directly saves the original data in the form of a file to the local of the user, and does not cache the original data in the server.

In some embodiments, step 102 is relatively independent in the flow chart shown in FIG. 1; one manifestation of this relative independence is that the acquisition module may be deployed in a different location than the functional modules required to perform other steps, e.g., the functional modules performing other steps may be located on a server and the acquisition module may be located on the user's local computer. Of course, the acquisition module may also be deployed on a server. A similar situation applies to step 108.

With continued reference to FIG. 1, embodiments of the present invention then reverse engineer the raw data to derive the key algorithms used by the target application (step 104). Fig. 2 shows one embodiment of the present invention implementing step 104. First, raw data is acquired (step 202) and prepared as input for subsequent processing. The target application is then run with the raw data as input, while a reverse engineering analysis tool is launched to monitor the running of the target application (step 204). The execution of the target application in step 204 is independent of the execution of step 102 in fig. 1, for example, the execution of step 204 may simulate the player to play back the game process by operating the raw data.

In some embodiments, as a preparation, the process of the reverse engineering analysis tool is first attached to the process of the target application (i.e., game) to debug the game process. And then setting an interruption breakpoint at an entrance of a file IO Interface (API) of the operating system. Next, the simulated player opens the raw data for playback in the target application. In the process, the target application is interrupted at the breakpoint of the file IO interface API; and performing single-step trace debugging at the moment, and recording related logic and data change of the operation on the original data in the execution process of the target application.

There are some tools available in the prior art that can be used as reverse engineering analysis tools (some adaptations may be needed depending on the actual situation) for use in the present invention, such as Ollydbg, x64dbg, windbg, ida Pro, cheat Engine and Process Monitor.

The output of the reverse engineering analysis is, for example, object code in the form of machine code instructions, such as shown in fig. 3.

The target code is then analyzed at step 206 to identify target features. The target feature may be custom, such as a machine instruction (a single instruction or a sequence of instructions) that the target application operates on a file data block of the raw data. In some embodiments, the results of the analysis operations herein are, for example, as shown in table 1 below:

number of times	Offset of	Reading instruction label	Operational instruction label
				3	5	(9)(17)	(203)
1	7	(105)

TABLE 1

The first row of table 1 shows that there are 3 operations on a data block with an offset of 5 from the head of the file of the original data, including 2 read operations by two read instructions at position numbers 9 and 17, respectively, and 1 arithmetic operation by an arithmetic instruction at position number 203. The interpretation of the second row of table 1 is similar.

Then, in step 208, based on the identified target features, a key algorithm adopted by the target application is constructed according to actual needs. For computer game programs, the key algorithm of interest is, for example, its encoding algorithm. In some embodiments, from the target features and their associated offset values as shown in table 1, the data structure of the original data and the machine instruction stream operating on the data structure can be derived, and the key algorithm of the target application can be obtained.

For example, the operation instruction flow of the first row of table 1 is:

mov ax，[data_addr+pos]

movzx eax, ax ← reference numeral 203

add eax,pos

mov[ecx+F0h],eax

Data _ addr is here represented as the base address of the original data, pos as the offset. This section of the instruction stream embodies the algorithm: the target application reads a word value at the original data offset of 5, then performs an addition operation with the word value and the current offset, i.e., 5, and then stores the operation result in the memory pointed to by ecx +0xf 0. For example, the result of the operation here (i.e. the value in eax after the last mov operation) is found to be involved in other operations later as an offset value, so it can be inferred that the word value of offset 5 is the size of the data block, which plus the offset of this data block in the file (value 5) results in an offset to the next data structure. It can be known that the data resulting from the operation at reference numeral 203 is the starting address of a structure. This start address may be used as a parameter during subsequent parsing of the raw data.

Returning to fig. 1, after the key algorithm of the target application is obtained in step 104, the process continues to step 106, and the raw data is processed according to the obtained key algorithm to obtain the result data of the custom structure. FIG. 4 illustrates one embodiment of the present invention for step 106. First, at step 402, a data transformation module is constructed according to a key algorithm. In some embodiments, a static library is first implemented, embodying the key algorithm. The static library is called to run with the original data as input and is parsed. Besides the static library, the data conversion module also comprises a selection module which is used for selecting the data which is interested in the data structure analyzed by the static library and packaging the selected data into another self-defined data structure. Depending on the requirements of the actual application, this selection module can simultaneously have other functions, for example control of the operation of the entire data conversion module. For a target application of the game class, the raw data may be user data cumulatively generated by the player during game play; according to the requirement, the selection module selects the content of the original user data, and the selected content can embody the intrinsic information of the user in the game playing process more intensively, such as the most effective action mode or strategy of the user.

The data conversion module is then run with the raw data as input at step 404. In the operation process, the original data is firstly analyzed by the static library and encapsulated into a tree-shaped data structure with a structure of a key-value pair, and the tree-shaped data structure is used as an intermediate result, wherein the key represents the name of a member in the tree-shaped structure, and the value represents the value of corresponding data. The selection module then generates result data having a custom data structure for the intermediate results.

The data structure represented by key-value pairs has its advantages: addition, deletion, modification, etc. of the keys of the members in the structure does not require recompilation of the parsing software. The disadvantage is that it is inconvenient to use: errors in a particular member key in a data structure can only be discovered at runtime and are not efficient enough. Since the members of interest in a particular data structure are fixed in many target applications, in some embodiments of the present invention, a selection module may be utilized to convert the "key-value" data structure into a custom C + + like class to overcome the above-described disadvantages.

The following is an example of an intermediate result parsed from the raw data, having a structure of "key-value" pairs:

/>

the data structure of the above example represents the attributes of a player, and this data structure is made up of a number of members, each member having a corresponding "key-value" pair representation. Screening according to the requirement of player information, and extracting interested data members to form a new data structure, namely a class, as shown in the following figure:

/>

OwnerHandle and ModifierParentHandle in the converted Unit-like _ Hero store dependency information, XP stores experience information of a character, lifeFlag stores survival information of a player, rigiddBodyComponent stores coordinate information of a player, teamNum stores team information, playerIndex stores id of a player, and HeroNameHandle stores a character name index of a player. The structure has two advantages: firstly, the access can depend on a compiler for checking, and the reading of a nonexistent field can be warned by the compiler; and secondly, only interested fields are reserved, and the memory space is saved.

In actual operation, the above intermediate result and the result data of the custom structure generated by the selection module may both be temporarily stored in the memory, or may be saved in the file system of the operating system in the form of a file. In some embodiments, the data having the structure of "key-value" pairs described above as intermediate results may also be used as result data for custom structures.

Returning to FIG. 1, after the custom structured results data is obtained, it is parsed at step 108 and the parsed results are presented in an appropriate manner, e.g., visually to the user, as desired.

For example, in one embodiment of the present invention, the target application is a battle game. The result data obtained from the game is as follows:

in one embodiment of the invention, the resulting data is then parsed and presented as shown in FIG. 5. The position data for the player (i.e., gridX and GridY in RigidDodmomponent members in the Unit _ Hero class) is extracted and visually displayed, enabling the player's character movements in the game to be more visually seen. The result of the visual display is for example seen in the top left-hand irregular graphical area in fig. 5, where different grey-scale areas indicate the frequency of player positions. The visual presentation can help the user to more quickly and intuitively see the player information contained in the result data, such as experience, success rate, and the like.

Each step of the flow charts in fig. 1, 2 and 4 can be implemented by a person skilled in the art by selecting a suitable device as required; suitable means include, but are not limited to, software programs, dedicated hardware modules, and hybrid modules of a combination of software and hardware. Each step may correspond to a separate device, or one or more steps may be performed in one device as needed. When a step or a method is implemented by a software program, the instructions of the software program (including the source program instructions and the compiled executable instructions) may be stored in a suitable storage medium; the storage medium includes all media types that can be stored and read by a computer, including but not limited to ROM, RAM, DRAM, cache, memory, hard disk, disk array, network disk, distributed storage. The storage medium is not limited to a physically single storage device but includes a distributed storage system of storage devices physically distributed at different locations.

It is to be understood that the embodiments described herein are merely exemplary and that a person of ordinary skill in the art may make numerous variations and modifications without departing from the spirit and scope of the claimed subject matter. All such variations and modifications are intended to be included within the scope of the present disclosure.

Claims

1. A method for processing raw data generated during runtime of a target application, comprising:

a reverse analysis step, configured to perform reverse engineering analysis on the raw data to obtain a key algorithm used by the target application, where the raw data records interaction between a user and the target application, and the key algorithm includes a coding algorithm of the target application; and

a data conversion step, configured to process the original data according to the obtained key algorithm to obtain result data in a custom format, where the data conversion step includes:

constructing a data conversion module according to the key algorithm; and

and operating the data conversion module by taking the original data as input to generate the result data with the custom format.

2. The method of claim 1, further comprising the step of obtaining the raw data during the running of the target application.

3. The method of claim 2, wherein the obtaining step includes the step of generating a video clip file of the user running the target application process using a video clip module that is onboard the target application, wherein the video clip file is the raw data.

4. The method of claim 2, wherein the obtaining step does not change the binary file of the target application.

5. The method of claim 2, wherein the acquiring step records the input of the player and the evolving state of the game in units of frames.

6. The method of claim 1, the inverse analyzing step comprising:

obtaining the original data;

running the target application with the raw data as input;

starting a reverse engineering analysis tool to monitor the operation of the target application with the original data as input, and outputting a target code related to the target application;

analyzing the target code to identify target features; and

and constructing a key algorithm of the target application according to the target characteristics.

7. The method of claim 6, wherein the step of launching a reverse engineering analysis tool to monitor the running of the target application with the raw data as input comprises:

attaching the process of the reverse engineering analysis tool to the process of the target application to debug the target application;

setting an interrupt breakpoint at an API (application program interface) inlet of a file IO (input/output) interface of an operating system; and

simulating a user opening original data in the target application, playing back,

and the target application is interrupted at the interruption point of the file IO interface API, single-step trace debugging is carried out at the moment, and the related logic and data change of the operation of the original data in the execution process of the target application are recorded.

8. The method of claim 6, wherein the target feature causes the target application to apply instructions that operate on file data blocks of the original data.

9. The method of claim 6, wherein the step of constructing a key algorithm of the target application according to the target features comprises:

and deducing a data structure of the original data and a machine instruction stream for operating the data structure according to the target characteristics and the related offset value thereof, thereby obtaining the key algorithm of the target application.

10. The method of claim 1, wherein the data transformation module comprises a static library embodying the key algorithm that is invokeable runtime to take as input and parse the raw data.

11. The method of claim 1, wherein the data conversion module comprises a selection module for selecting data of interest from data parsed from the raw data and encapsulating the selected data into the result data in the custom format.

12. The method of claim 1, wherein the custom format is a tree data structure in the form of a "key-value" pair.

13. The method of claim 1, wherein the custom format is a class.

14. The method of claim 1, further comprising:

and a presentation step for analyzing the result data and presenting the analyzed result.

15. A system for processing raw data generated during a target application run, comprising:

the reverse analysis device is used for performing reverse engineering analysis on the original data to obtain a key algorithm used by the target application, wherein the original data records the interaction between a user and the target application, and the key algorithm comprises an encoding algorithm of the target application; and

a data conversion device, configured to process the original data according to the obtained key algorithm to obtain result data in a custom format, where the data conversion device includes:

means for constructing a data conversion module according to the key algorithm; and

means for running the data conversion module with the raw data as input, generating the result data in the custom format.

16. The system of claim 15, further comprising means for acquiring the raw data during operation of the target application.

17. The system of claim 16, wherein the obtaining means comprises the step of generating a video clip file of the user running the target application process using a video clip module onboard the target application, wherein the video clip file is the raw data.

18. The system of claim 16, wherein the obtaining means does not change a binary file of the target application.

19. The system of claim 16, wherein the acquiring means records the input of the player and the evolution state of the game in units of frames.

20. The system of claim 15, the reverse analysis device comprising:

means for retrieving the raw data;

means for running the target application with the raw data as input;

means for initiating a reverse engineering analysis tool to monitor the operation of the target application with the raw data as input and to output a target code associated with the target application;

means for analyzing the target code to identify a target feature; and

means for constructing the key algorithm for the target application from target features.

21. The system of claim 20, wherein the means for launching a reverse engineering analysis tool to monitor the running of the target application with the raw data as input comprises:

means for attaching a process of the reverse engineering analysis tool to a process of the target application to debug the target application;

the device is used for setting an interrupt breakpoint at an API (application program interface) inlet of a file IO interface of an operating system; and

means for simulating a user opening raw data in the target application for playback,

22. The system of claim 20, wherein the target feature is an instruction of the target application to operate on a file data block of the raw data.

23. The system of claim 20, wherein the means for constructing the key algorithm of the target application according to target features comprises:

and deriving a data structure of the raw data and a machine instruction stream for operating the data structure according to the target feature and the offset value related to the target feature, thereby obtaining the key algorithm of the target application.

24. The system of claim 15, wherein the data transformation module comprises a static library embodying the key algorithm that is invokeable runtime to take as input and parse the raw data.

25. The system of claim 15, wherein the data conversion module comprises a selection module to select data of interest from data parsed from the raw data and package the selected data into the custom format of the resultant data.

26. The system of claim 15, wherein the custom format is a tree data structure in the form of a "key-value" pair.

27. The system of claim 15, wherein the custom format is a class.

28. The system of claim 15, further comprising:

and the presentation device is used for analyzing the result data and presenting the analyzed result.

29. A storage medium containing computer-executable instructions which, when executed by a computer, are capable of performing the method of any one of claims 1 to 14.