CN110175453B - Method and device for judging cheating operation - Google Patents
Method and device for judging cheating operation Download PDFInfo
- Publication number
- CN110175453B CN110175453B CN201910409560.5A CN201910409560A CN110175453B CN 110175453 B CN110175453 B CN 110175453B CN 201910409560 A CN201910409560 A CN 201910409560A CN 110175453 B CN110175453 B CN 110175453B
- Authority
- CN
- China
- Prior art keywords
- call stack
- point event
- buried point
- value
- judging
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
Abstract
The embodiment of the application provides a method and a device for judging cheating operation, wherein the method comprises the following steps: reading a value of a first call stack of a preset judgment operation through a buried point event preset in the judgment operation; acquiring a current value of a second call stack of the current execution operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as the value of a first call stack of the preset judgment operation; if the current value of the second call stack is not the same as the value of the first call stack, the output of the buried point event is false; and under the condition that the output of the buried point event is false, judging the current execution operation as a cheating operation. The method and the device for judging the cheating operation can accurately identify the cheating behavior of modifying the preset execution rule through the change of the call stack.
Description
Technical Field
The present application relates to the field of data processing technologies, and in particular, to a method and an apparatus for determining a cheating operation.
Background
Currently, in the case of providing a public library to a third party application, it is necessary to ensure that the operation of the public library can be performed according to a predetermined operation rule. Most of the existing anti-cheating schemes preset judgment operations to judge whether data are processed according to preset logic aiming at cheating behaviors of modifying public libraries. For example, in an advertisement library, to determine whether an advertisement view is shown, the following preset determination operations are generally performed: judging whether the current view is visible; and/or judging whether the size of the current view is larger than a preset pixel point, and the like.
Based on this, the inventor of the present invention finds that there still exist cheating behaviors, such as cheating ways of modifying public library codes or modifying function pointers, which cannot be found by the existing schemes.
The information disclosed in this background section is only for enhancement of understanding of the general background of the invention and should not be taken as an acknowledgement or any form of suggestion that this information forms the prior art already known to a person skilled in the art.
Disclosure of Invention
The embodiment of the application aims to provide a method and a device for judging cheating operation, which can accurately identify cheating behaviors.
To solve the above technical problem, embodiments of the present application are achieved by the following aspects.
In a first aspect, an embodiment of the present application provides a method for determining a cheating operation, including: reading a value of a first call stack of a preset judgment operation through a buried point event preset in the judgment operation; acquiring a current value of a second call stack of the current execution operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as the value of a first call stack of the preset judgment operation; if the current value of the second call stack is not the same as the value of the first call stack, the output of the buried point event is false; and under the condition that the output of the buried point event is false, judging the current execution operation as a cheating operation.
In a possible implementation manner, after determining whether the current value of the second call stack is the same as the value of the first call stack of the preset determination operation, the method further includes: reporting the output of the buried point event, wherein the output of the buried point event is true or false; and under the condition that the output of the embedded point event is not reported within a preset time length, judging the current execution operation as a cheating operation.
In a possible implementation manner, after determining whether the current value of the second call stack is the same as the value of the first call stack of the preset determination operation, the method further includes: if the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation, the output of the buried point event is true; and when the output of the embedded point event is true and the execution result of the preset judgment operation is not equal to the preset result, judging the current execution operation as a cheating operation.
In a possible implementation manner, the buried point event is added to the class in which the preset judgment operation is located.
In a possible implementation manner, obtaining a current value of a second call stack of a currently executed operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as a value of a first call stack of the preset judgment operation includes: modifying the calling relationship of the judgment operation, and enabling the calling relationship to point to the buried point event when the judgment operation runs to a specified position; and executing the buried point event to obtain the current value of the second call stack of the current execution operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation.
In one possible implementation, the buried point event comprises a hook event.
In a second aspect, an embodiment of the present application provides an apparatus for determining a cheating operation, including: the reading module is used for reading the value of a first call stack of the preset judgment operation through a buried point event preset in the judgment operation; the judging module is used for acquiring the current value of a second call stack of the current execution operation through a buried point event preset in the judging operation, and judging whether the current value of the second call stack is the same as the value of a first call stack of the preset judging operation or not; an output module, configured to output the buried point event as false if the current value of the second call stack is different from the value of the first call stack; and the processing module is used for judging the current execution operation as a cheating operation under the condition that the output of the embedded point event is false.
In one possible implementation, the output module is further configured to: reporting the output of the buried point event after judging whether the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation, wherein the output of the buried point event is true or false; the processing module is further configured to: and under the condition that the output of the embedded point event is not reported within a preset time length, judging the current execution operation as a cheating operation.
In one possible implementation, the output module is further configured to: if the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation, the output of the buried point event is true; the processing module is further configured to: and when the output of the embedded point event is true and the execution result of the preset judgment operation is not equal to the preset result, judging the current execution operation as a cheating operation.
In a possible implementation manner, the determining module is further configured to: and adding the buried point event in the class where the preset judgment operation is located.
In a possible implementation manner, the determining module is configured to: modifying the calling relationship of the judgment operation, and enabling the calling relationship to point to the buried point event when the judgment operation runs to a specified position; and executing the buried point event to obtain the current value of the second call stack of the current execution operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation.
In a possible implementation manner, the buried point event added by the determining module includes a hook event.
In a third aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor and computer executable instructions stored on the memory and executable on the processor, which when executed by the processor implement the steps of the method as described in the first aspect above.
In a fourth aspect, embodiments of the present application provide a computer-readable storage medium for storing computer-executable instructions that, when executed by a processor, implement the steps of the method according to the first aspect.
In the embodiment of the application, the value of a first call stack of the preset judgment operation is read through a buried point event preset in the judgment operation; acquiring a current value of a second call stack of the current execution operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as the value of a first call stack of the preset judgment operation; if the current value of the second call stack is not the same as the value of the first call stack, the output of the buried point event is false; and under the condition that the output of the buried point event is false, judging the current execution operation as a cheating operation, and accurately judging the cheating operation.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below, it is obvious that the drawings in the following description are only some embodiments described in the present application, and for those skilled in the art, other drawings can be obtained according to the drawings without any creative effort.
Fig. 1 is a schematic flow chart illustrating a method for determining a cheating operation according to an embodiment of the present application;
fig. 2 is a schematic flow chart illustrating a method for determining a cheating operation according to an embodiment of the present application;
fig. 3 is a schematic flow chart illustrating a method for determining a cheating operation according to an embodiment of the present application;
fig. 4 is a schematic structural diagram illustrating an apparatus for determining a cheating operation according to an embodiment of the present application;
fig. 5 is a schematic hardware structure diagram of an electronic device for executing a method for determining a cheating operation according to an embodiment of the present application.
Detailed Description
In order to make those skilled in the art better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
Fig. 1 is a flowchart illustrating a method for determining a cheating operation according to an embodiment of the present application, where the method may be performed by an electronic device, for example, a server device. In other words, the method may be performed by software or hardware installed in the server device. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, and the like. As shown, the method may include the following steps.
S110: and reading the value of a first call stack of the preset judgment operation through a buried point event preset in the judgment operation.
In the case of providing a public library to a third party application, it is necessary to ensure that the operation of the public library can be performed according to predetermined operation rules. For the cheating behavior of modifying the public library, a judgment operation can be preset for judging whether the operation of the public library conforms to a preset operation rule. For example, in an advertisement library, in order to determine whether an advertisement view is displayed, a preset determination operation for determining whether a current view is visible may be set. The preset determining operation for determining whether the current view is visible may be, for example:
indicating that true is returned if the view is visible, false is returned otherwise. The position for invoking the preset determination operation may be, for example:
the call stack of the preset judging operation for judging whether the view is visible or not can be shown as follows:
class- > work () - > View. class- > isVisible (). The value of the first call stack in the following steps.
In one possible implementation, the buried point event may include a hook event, such as:
in a possible implementation manner, the buried point event may be added to the class in which the preset judgment operation is located, for example:
and representing that the buried point event hook () is added in the class View of the preset judgment operation isVisable (). The value of the first call stack of the preset judgment operation can be read through the buried point event.
The skilled person will know that this step is described by taking as an example the operation of determining whether the preset judgment operation is visible, but this example description should not be understood as a limitation of the scope of the present application, and without any inventive work, the skilled person will know that the operation of determining the size of the current view, for example, may also be used as the preset judgment operation.
S120: and acquiring the current value of a second call stack of the current execution operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation.
By way of example of the above hook event:
indicating that the current value stack of the second call stack of the currently executed operation is obtained, and whether the current value stack of the second call stack is equal to ' JudgGeMethod.class- > work () ' View.class- > isVisible () ' (the value of the first call stack of the judgment operation is preset) is judged.
S130: and if the current value of the second call stack is not the same as the value of the first call stack, outputting the buried point event to be false.
The above example of a hook event indicates that the hook event output is true if the current value stack of the second call stack equals "Judge method. class- > work () - > View. class- > isVisible ()", and false otherwise. It may thereby be achieved that the output of the buried point event is false if the current value of the second call stack is not the same as the value of the first call stack.
For example, the cheating operation:
indicating that true is returned regardless of whether the view is visible, in other words, true is returned in the ad library even if the ad view is not displayed, pertaining to the cheating action. Since the function pointer is modified, the preset judging operation for judging whether the view is visible in the background art cannot identify the cheating behavior, but in the operation of the cheating behavior in this step, the current value of the second call stack is as follows:
JudgeMethod.class->work()
->ViewProxy.class->isVisible()
and if the value of the first call stack is different from the Judgemethod. class- > word () - > View. class- > isVisable (), the output of the buried point event is false. Therefore, the cheating method which cannot be identified in the background technology can be identified through the embodiment of the invention.
The steps are described by taking the above cheating operations as examples, and those skilled in the art should know that the method described in the present application can be applied to the respective cheating operations without being limited to the above examples.
S140: and under the condition that the output of the buried point event is false, judging the current execution operation as a cheating operation.
If the output of the buried point event is false, the method is not executed according to a predetermined rule, and thus the currently executed operation is determined to be a cheating operation.
In step S130, since the current value of the second call stack is different from the value of the first call stack, the output of the buried point event is false, and in this step, when the output of the buried point event is false, the current execution operation is determined as a cheating operation.
Therefore, according to the method for judging the cheating operation, the value of the first call stack of the preset judging operation is read through the buried point event preset in the judging operation; acquiring a current value of a second call stack of the current execution operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as the value of a first call stack of the preset judgment operation; if the current value of the second call stack is not the same as the value of the first call stack, the output of the buried point event is false; and under the condition that the output of the buried point event is false, judging the current execution operation as a cheating operation, and accurately identifying the cheating behavior of modifying a preset execution rule through the change of a call stack.
Fig. 2 is another schematic flow chart of a method for determining a cheating operation according to an embodiment of the present application, where the method may be performed by an electronic device, for example, a server device. In other words, the method may be performed by software or hardware installed in the server device. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, and the like. As shown, the method may include the following steps.
S210: and reading the value of a first call stack of the preset judgment operation through a buried point event preset in the judgment operation.
In the case of providing a public library to a third party application, it is necessary to ensure that the operation of the public library can be performed according to predetermined operation rules. For the cheating behavior of modifying the public library, a judgment operation can be preset for judging whether the operation of the public library conforms to a preset operation rule. For example, in an advertisement library, in order to determine whether an advertisement view is displayed, a preset determination operation for determining whether a current view is visible may be set. The preset determining operation for determining whether the current view is visible may be, for example:
indicating that true is returned if the view is visible, false is returned otherwise. The position for invoking the preset determination operation may be, for example:
the call stack of the preset judging operation for judging whether the view is visible or not can be shown as follows:
JudgeMethod.class->work()
->View.class->isVisible()
the value of the first call stack in the following steps.
In one possible implementation, the buried point event may include a hook event, such as:
in a possible implementation manner, the buried point event may be added to the class in which the preset judgment operation is located, for example:
and representing that the buried point event hook () is added in the class View of the preset judgment operation isVisable (). The value of the first call stack of the preset judgment operation can be read through the buried point event.
S220: and acquiring the current value of a second call stack of the current execution operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation.
By way of example of the above hook event:
indicating that the current value stack of the second call stack of the currently executed operation is obtained, and whether the current value stack of the first call stack is equal to ' JudgGeMethod.class- > work () ' View.class- > isVisible () ' (the value of the first call stack of the judgment operation is preset) is judged.
Therefore, whether the current value of the second call stack of the current execution operation is the same as the value of the first call stack of the preset judgment operation is judged through the buried point event.
S231: and if the current value of the second call stack is not the same as the value of the first call stack, outputting the buried point event to be false.
The above example of a hook event indicates that the hook event output is true if the current value stack of the second call stack equals "Judge method. class- > work () - > View. class- > isVisible ()", and false otherwise. It may thereby be achieved that the output of the buried point event is false if the current value of the second call stack is not the same as the value of the first call stack.
The above example of a hook event indicates that if the call stack is equal to "Judge method. class- > work () - > View. class- > isVisible ()", then the hook event output is true, otherwise it is false. It may thereby be achieved that the output of the buried point event is false if the current value of the second call stack is not the same as the value of the first call stack.
For example, cheating acts:
indicating that true is returned regardless of whether the view is visible, in other words, true is returned in the ad library even if the ad view is not displayed, pertaining to the cheating action. Since the function pointer is modified, the preset judging operation for judging whether the view is visible in the background art cannot identify the cheating behavior, but in the operation of the cheating behavior in this step, the current value of the second call stack is as follows:
JudgeMethod.class->work()
->ViewProxy.class->isVisible()
and if the value of the first call stack is different from the Judgemethod. class- > word () - > View. class- > isVisable (), the output of the buried point event is false. . Therefore, the cheating method which cannot be identified in the background technology can be identified through the embodiment of the invention.
S232: reporting the output of the embedded point event, and judging the current execution operation as a cheating operation under the condition that the output of the embedded point event is not reported within a preset time length.
Reporting the output of the buried point event, wherein the output of the buried point event is true or false, and under the condition that the output of the buried point event is not reported within a preset time length, judging the current execution operation as a cheating operation. If the output of the embedded point event is not reported for a long time, the cheating event is indicated to occur, so that the embedded point event is not normally executed, and at the moment, the current execution operation is judged to be the cheating operation.
In one case, the public library code can be modified directly by the editor, returning the results directly as visible, e.g., cheating events:
by modifying the method of the function pointer, the address of the View isViewable method is changed into Viewproxy isViewable, so that when the call is called, the returned result is true forever, although the call stack is changed at this time, namely:
JudgeMethod.class->work()
->ViewProxy.class->isVisible()
however, since the buried point event for detecting the call stack change is set in the preset judgment operation view. In this step, the current execution operation is judged as a cheating operation under the condition that the output of the embedded point event is not reported within the preset time length, and a cheating behavior that the embedded point event cannot be executed due to the fact that the call relation is modified is detected.
S240: and under the condition that the output of the buried point event is false, judging the current execution operation as a cheating operation.
If the output of the buried point event is false, the method is not executed according to a predetermined rule, and thus the currently executed operation is determined to be a cheating operation.
Cheating acts such as:
the fact that true is returned no matter whether the view is visible or not is shown, in other words, true is returned even if the advertisement view is not displayed in the advertisement library, the cheating behavior cannot be identified by the preset judgment operation for judging whether the view is visible or not, but the operation is currently executed, namely the operation of the cheating behavior, and the current value of the second call stack is as follows:
JudgeMethod.class->work()
->ViewProxy.class->isVisible()
in step S230, since the current value of the second call stack is different from the value of the first call stack, judgmethodglass-class- > work () - > view-class- > isVisible (), the output of the buried point event is false, and in this step, the current execution operation is determined as a cheating operation when the output of the buried point event is false.
Therefore, according to the method for judging the cheating operation, the value of the first call stack of the preset judging operation is read through the buried point event preset in the judging operation; acquiring a current value of a second call stack of the current execution operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as the value of a first call stack of the preset judgment operation; if the current value of the second call stack is not the same as the value of the first call stack, the output of the buried point event is false; and under the condition that the output of the buried point event is false, judging the current execution operation as a cheating operation, and accurately identifying the cheating behavior of modifying a preset execution rule through the change of a call stack.
In addition, the method for judging cheating operation provided by the embodiment of the application reports the output of the embedded point event; and under the condition that the output of the embedded point event is not reported within the preset time, judging the current execution operation as a cheating operation, and detecting a cheating behavior that the calling relationship is modified so that the embedded point event cannot be executed.
Fig. 3 is another schematic flow chart of a method for determining a cheating operation according to an embodiment of the present application, where the method may be performed by an electronic device, for example, a server device. In other words, the method may be performed by software or hardware installed in the server device. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, and the like. As shown, the method may include the following steps.
S310: and reading the value of a first call stack of the preset judgment operation through a buried point event preset in the judgment operation.
In the case of providing a public library to a third party application, it is necessary to ensure that the operation of the public library can be performed according to predetermined operation rules. For the cheating behavior of modifying the public library, a judgment operation can be preset for judging whether the operation of the public library conforms to a preset operation rule. For example, in an advertisement library, in order to determine whether an advertisement view is displayed, a preset determination operation for determining whether a current view is visible may be set. The preset determining operation for determining whether the current view is visible may be, for example:
indicating that true is returned if the view is visible, false is returned otherwise.
The position for invoking the preset determination operation may be, for example:
the call stack of the preset judging operation for judging whether the view is visible or not can be shown as follows:
JudgeMethod.class->work()
->View.class->isVisible()
the value of the first call stack in the following steps.
In one possible implementation, the buried point event may include a hook event, such as:
in one possible implementation, the code for grabbing the buried point event of the call stack may be generated by a dynamic code generation technique. The code can be encrypted to prevent internal logic from being cracked, and the decrypted binary code is directly dynamically loaded in the content by utilizing a dynamic loading technology.
In a possible implementation manner, the buried point event may be added to the class in which the preset judgment operation is located, for example:
and representing that the buried point event hook () is added to the class View of the preset judgment operation isVisable (), and the value of the first call stack of the preset judgment operation can be read through the buried point event.
S320: and acquiring the current value of a second call stack of the current execution operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation.
By way of example of the above hook event:
indicating that the current value stack of the second call stack of the currently executed operation is obtained, and whether the current value stack of the first call stack is equal to ' JudgGeMethod.class- > work () ' View.class- > isVisible () ' (the value of the first call stack of the judgment operation is preset) is judged.
This step may include modifying a call relationship of the judgment operation, such as modifying a function pointer, and when the preset judgment operation is run to the specified location, causing the call relationship to point to the buried point event; and executing the buried point event to obtain the current value of the second call stack of the current execution operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation.
For example:
judging whether the current value of the second call stack of the current execution operation is the same as the value of the first call stack of the preset judgment operation or not through the buried point event.
S330: and if the current value of the second call stack is the same as the value of the first call stack, the output of the buried point event is true.
The above example of the hook event indicates that if the call stack is equal to "Judge method, class- > work () - > View, class- > isVisible ()", the output of the hook event is true, and furthermore, the buried point event reports the output of the buried point event within a predetermined time period, which indicates that the buried point event is normally executed, and the current value of the second call stack of the captured currently executed operation is the same as the value of the first call stack, which indicates that the preset judgment operation is normally executed.
S340: and when the output of the embedded point event is true and the execution result of the preset judgment operation is not equal to the preset result, judging the current execution operation as a cheating operation.
And judging whether the cheating operation occurs according to the execution result of the preset judgment operation. Taking the preset determination operation in step S310 as an example, if the execution result of the preset determination operation is visible (True) under the condition that the output of the buried point event is True, the currently executed operation is determined to be a normal operation; and if the execution result of the preset judgment operation is invisible (False), judging the current execution operation as a cheating operation.
Therefore, according to the method for judging the cheating operation, the value of the first call stack of the preset judging operation is read through the buried point event preset in the judging operation; acquiring a current value of a second call stack of the current execution operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as the value of a first call stack of the preset judgment operation; if the current value of the second call stack is not the same as the value of the first call stack, the output of the buried point event is false; and under the condition that the output of the buried point event is false, judging the current execution operation as a cheating operation, and accurately identifying the cheating behavior of modifying a preset execution rule through the change of a call stack.
In addition, the method for judging cheating operation provided by the embodiment of the application reports the output of the embedded point event; and under the condition that the output of the embedded point event is not reported within the preset time, judging the current execution operation as a cheating operation, and detecting a cheating behavior that the calling relationship is modified so that the embedded point event cannot be executed.
In addition, according to the method for judging cheating operation provided by the embodiment of the application, if the current value of the second call stack is the same as the value of the first call stack, the output of the buried point event is true; when the output of the point burying event is true and the execution result of the preset judgment operation is not equal to the preset result, the current execution operation is judged to be the cheating operation, the point burying can be added on the basis of the existing preset judgment operation, and various cheating operations can be judged quickly, accurately and comprehensively.
Fig. 4 is a schematic structural diagram illustrating an apparatus for determining a cheating operation according to an embodiment of the present application, where the apparatus 100 includes: a reading module 110, a judging module 120, an output module 130 and a processing module 140.
The reading module 110 is configured to read a value of a first call stack of a preset judgment operation through a buried point event preset in the judgment operation. The judging module 120 is configured to obtain a current value of a second call stack of the currently executed operation through a buried point event preset in the judging operation, and judge whether the current value of the second call stack is the same as a value of a first call stack of the preset judging operation. The output module 130 is configured to output the buried point event as false if the current value of the second call stack is not the same as the value of the first call stack. The processing module 140 is configured to determine the currently executed operation as a cheating operation when the output of the buried point event is false.
In one possible implementation, the output module 130 is further configured to: reporting the output of the buried point event after judging whether the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation, wherein the output of the buried point event is true or false; the processing module is further configured to: and under the condition that the output of the embedded point event is not reported within a preset time length, judging the current execution operation as a cheating operation.
In a possible implementation manner, the output module 130 is further configured to: and if the current value of the second call stack is the same as the value of the first call stack, the output of the buried point event is true. The processing module 140 is further configured to: and when the output of the embedded point event is true and the execution result of the preset judgment operation is not equal to the preset result, judging the current execution operation as a cheating operation.
In a possible implementation manner, the determining module 120 is further configured to: and adding the buried point event in the class where the preset judgment operation is located.
In a possible implementation manner, the determining module 120 is configured to: modifying the calling relationship of the judgment operation, and enabling the calling relationship to point to the buried point event when the judgment operation runs to a specified position; and executing the buried point event to obtain the current value of the second call stack of the current execution operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation.
In a possible implementation manner, the buried point event added by the determining module 120 includes a hook event.
The apparatus 100 provided in this embodiment of the application can perform the methods described in the foregoing method embodiments, and implement the functions and beneficial effects of the methods described in the foregoing method embodiments, which are not described herein again.
Fig. 5 is a schematic diagram illustrating a hardware structure of an electronic device for performing the method for determining a cheating operation according to the embodiment of the present application, where the electronic device may have a relatively large difference due to different configurations or performances, and may include one or more processors 501 and a memory 502, and one or more stored applications or data may be stored in the memory 502. Memory 502 may be, among other things, transient or persistent storage. The application program stored in memory 502 may include one or more modules (not shown), each of which may include a series of computer-executable instructions for the electronic device. Still further, the processor 501 may be disposed in communication with the memory 502, on which a series of computer-executable instructions in the memory 502 execute. The electronic device may also include one or more power supplies 503, one or more wired or wireless network interfaces 504, one or more input-output interfaces 505, one or more keyboards 506, and the like.
In a particular embodiment, the electronic device includes a memory, a processor, and computer-executable instructions stored on the memory and executable on the processor, which when executed by the processor implement the following: reading a value of a first call stack of a preset judgment operation through a buried point event preset in the judgment operation; acquiring a current value of a second call stack of the current execution operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as the value of a first call stack of the preset judgment operation; if the current value of the second call stack is not the same as the value of the first call stack, the output of the buried point event is false; and under the condition that the output of the buried point event is false, judging the current execution operation as a cheating operation.
In a possible implementation manner, after determining whether the current value of the second call stack is the same as the value of the first call stack of the preset determination operation, the method further includes: reporting the output of the buried point event, wherein the output of the buried point event is true or false; and under the condition that the output of the embedded point event is not reported within a preset time length, judging the current execution operation as a cheating operation.
In a possible implementation manner, after determining whether the current value of the second call stack is the same as the value of the first call stack of the preset determination operation, the method further includes: if the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation, the output of the buried point event is true; and when the output of the embedded point event is true and the execution result of the preset judgment operation is not equal to the preset result, judging the current execution operation as a cheating operation.
In a possible implementation manner, the buried point event is added to the class in which the preset judgment operation is located.
In a possible implementation manner, obtaining a current value of a second call stack of a currently executed operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as a value of a first call stack of the preset judgment operation includes: modifying the calling relationship of the judgment operation, and enabling the calling relationship to point to the buried point event when the judgment operation runs to a specified position; and executing the buried point event to obtain the current value of the second call stack of the current execution operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation.
In one possible implementation, the buried point event comprises a hook event.
Therefore, the electronic device executing the method for determining a cheating operation provided in the embodiment of the present application can execute the methods described in the foregoing method embodiments, and implement the functions and beneficial effects of the methods described in the foregoing method embodiments, which are not described herein again.
The electronic device of the embodiments of the present application exists in various forms, including but not limited to the following devices.
(1) Mobile communication devices, which are characterized by mobile communication capabilities and are primarily targeted at providing voice and data communications. Such terminals include smart phones (e.g., iphones), multimedia phones, functional phones, and low-end phones, among others.
(2) The ultra-mobile personal computer equipment belongs to the category of personal computers, has calculation and processing functions and generally has the characteristic of mobile internet access. Such terminals include PDA, MID, and UMPC devices, such as ipads.
(3) The server is similar to a general computer architecture, but has higher requirements on processing capability, stability, reliability, safety, expandability, manageability and the like because of the need of providing highly reliable services.
(4) And other electronic devices with data interaction functions.
Further, an embodiment of the present application also provides a computer-readable storage medium for storing computer-executable instructions, which when executed by a processor implement the following process: reading a value of a first call stack of a preset judgment operation through a buried point event preset in the judgment operation; acquiring a current value of a second call stack of the current execution operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as the value of a first call stack of the preset judgment operation; if the current value of the second call stack is not the same as the value of the first call stack, the output of the buried point event is false; and under the condition that the output of the buried point event is false, judging the current execution operation as a cheating operation.
In a possible implementation manner, after determining whether the current value of the second call stack is the same as the value of the first call stack of the preset determination operation, the method further includes: reporting the output of the buried point event, wherein the output of the buried point event is true or false; and under the condition that the output of the embedded point event is not reported within a preset time length, judging the current execution operation as a cheating operation.
In a possible implementation manner, after determining whether the current value of the second call stack is the same as the value of the first call stack of the preset determination operation, the method further includes: if the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation, the output of the buried point event is true; and when the output of the embedded point event is true and the execution result of the preset judgment operation is not equal to the preset result, judging the current execution operation as a cheating operation.
In a possible implementation manner, the buried point event is added to the class in which the preset judgment operation is located.
In a possible implementation manner, obtaining a current value of a second call stack of a currently executed operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as a value of a first call stack of the preset judgment operation includes: modifying the calling relationship of the judgment operation, and enabling the calling relationship to point to the buried point event when the judgment operation runs to a specified position; and executing the buried point event to obtain the current value of the second call stack of the current execution operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation.
In one possible implementation, the buried point event comprises a hook event.
Thus, when executed by a processor, the computer-executable instructions can perform the methods described in the foregoing method embodiments, and implement the functions and advantages of the methods described in the foregoing method embodiments, which are not described herein again.
The computer-readable storage medium includes a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk.
Further, embodiments of the present application also provide a computer program product, the computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, which when executed by a computer, implement the following process: reading a value of a first call stack of a preset judgment operation through a buried point event preset in the judgment operation; acquiring a current value of a second call stack of the current execution operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as the value of a first call stack of the preset judgment operation; if the current value of the second call stack is not the same as the value of the first call stack, the output of the buried point event is false; and under the condition that the output of the buried point event is false, judging the current execution operation as a cheating operation.
In a possible implementation manner, after determining whether the current value of the second call stack is the same as the value of the first call stack of the preset determination operation, the method further includes: reporting the output of the buried point event, wherein the output of the buried point event is true or false; and under the condition that the output of the embedded point event is not reported within a preset time length, judging the current execution operation as a cheating operation.
In a possible implementation manner, after determining whether the current value of the second call stack is the same as the value of the first call stack of the preset determination operation, the method further includes: if the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation, the output of the buried point event is true; and when the output of the embedded point event is true and the execution result of the preset judgment operation is not equal to the preset result, judging the current execution operation as a cheating operation.
In a possible implementation manner, the buried point event is added to the class in which the preset judgment operation is located.
In a possible implementation manner, obtaining a current value of a second call stack of a currently executed operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as a value of a first call stack of the preset judgment operation includes: modifying the calling relationship of the judgment operation, and enabling the calling relationship to point to the buried point event when the judgment operation runs to a specified position; and executing the buried point event to obtain the current value of the second call stack of the current execution operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation.
In one possible implementation, the buried point event comprises a hook event.
The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
The above description is only an example of the present application and is not intended to limit the present application. Various modifications and changes may occur to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.
Claims (12)
1. A method for determining a cheating operation, comprising:
reading a value of a first call stack of a judgment operation through a buried point event preset in the judgment operation;
acquiring a current value of a second call stack of the current execution operation through a buried point event preset in the judgment operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the judgment operation;
if the current value of the second call stack is not the same as the value of the first call stack, the output of the buried point event is false;
judging the current execution operation as a cheating operation under the condition that the output of the embedded point event is false;
the method further comprises the following steps: dynamically generating a code of the buried point event, and encrypting the code; when the buried point event is preset in the judging operation, decrypting the code to obtain a decrypted binary code; and dynamically loading the decrypted binary code in the judging operation to finish presetting the buried point event in the judging operation.
2. The method of claim 1, after determining whether the current value of the second call stack is the same as the value of the first call stack of the determining operation, further comprising:
reporting the output of the buried point event, wherein the output of the buried point event is true or false;
and under the condition that the output of the embedded point event is not reported within a preset time length, judging the current execution operation as a cheating operation.
3. The method of claim 1, after determining whether the current value of the second call stack is the same as the value of the first call stack of the determining operation, further comprising:
if the current value of the second call stack is the same as the value of the first call stack of the judgment operation, the output of the buried point event is true;
and when the output of the buried point event is true and the execution result of the judgment operation is not equal to the preset result, judging the current execution operation as a cheating operation.
4. The method of claim 1, prior to reading the value of the first call stack of the predicate operation, further comprising:
and adding the buried point event in the class where the judgment operation is positioned.
5. The method of claim 4, wherein obtaining a current value of a second call stack of a currently executed operation through a buried point event preset in the determining operation, and determining whether the current value of the second call stack is the same as the value of the first call stack of the determining operation comprises:
modifying the calling relationship of the judgment operation, and enabling the calling relationship to point to the buried point event when the judgment operation runs to a specified position;
and executing the buried point event to obtain the current value of the second call stack of the current execution operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the preset judgment operation.
6. The method of claim 1, wherein the buried point event comprises a hook event.
7. An apparatus for determining a cheating operation, comprising:
the reading module is used for reading the value of a first call stack of the judging operation through a buried point event preset in the judging operation;
the judging module is used for acquiring the current value of a second call stack of the current execution operation through a buried point event preset in the judging operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the judging operation;
an output module, configured to output the buried point event as false if the current value of the second call stack is different from the value of the first call stack;
the processing module is used for judging the current execution operation as a cheating operation under the condition that the output of the embedded point event is false;
the device further comprises: dynamically generating a code of the buried point event, and encrypting the code; when the buried point event is preset in the judging operation, decrypting the code to obtain a decrypted binary code; and dynamically loading the decrypted binary code in the judging operation to finish presetting the buried point event in the judging operation.
8. The apparatus of claim 7, wherein the output module is further configured to: reporting the output of the buried point event after judging whether the current value of the second call stack is the same as the value of the first call stack of the judging operation, wherein the output of the buried point event is true or false;
the processing module is further configured to: and under the condition that the output of the embedded point event is not reported within a preset time length, judging the current execution operation as a cheating operation.
9. The apparatus of claim 7, wherein the output module is further configured to:
if the current value of the second call stack is the same as the value of the first call stack of the judgment operation, the output of the buried point event is true;
the processing module is further configured to: and when the output of the buried point event is true and the execution result of the judgment operation is not equal to the preset result, judging the current execution operation as a cheating operation.
10. The apparatus of claim 7, wherein the determining module is further configured to:
and adding the buried point event in the class where the judgment operation is positioned.
11. The apparatus of claim 10, wherein the determining module is configured to:
modifying the calling relationship of the judgment operation, and enabling the calling relationship to point to the buried point event when the judgment operation runs to a specified position; and executing the buried point event to obtain the current value of the second call stack of the current execution operation, and judging whether the current value of the second call stack is the same as the value of the first call stack of the judgment operation.
12. The apparatus of claim 7, wherein the buried point events added by the determining module comprise hook events.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910409560.5A CN110175453B (en) | 2019-05-16 | 2019-05-16 | Method and device for judging cheating operation |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910409560.5A CN110175453B (en) | 2019-05-16 | 2019-05-16 | Method and device for judging cheating operation |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110175453A CN110175453A (en) | 2019-08-27 |
| CN110175453B true CN110175453B (en) | 2021-07-16 |
Family
ID=67691363
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910409560.5A Active CN110175453B (en) | 2019-05-16 | 2019-05-16 | Method and device for judging cheating operation |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110175453B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110750431B (en) * | 2019-10-24 | 2023-11-03 | 阿里巴巴（中国）有限公司 | Data embedded point configuration method and device |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101241464A (en) * | 2007-02-05 | 2008-08-13 | 中兴通讯股份有限公司 | Method for checking stack frame destruction |
| CN105893846A (en) * | 2016-04-22 | 2016-08-24 | 北京金山安全软件有限公司 | Method and device for protecting target application program and electronic equipment |
Family Cites Families (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8386628B1 (en) * | 2005-05-23 | 2013-02-26 | Glance Networks, Inc. | Method and apparatus for reducing the amount of information that must be transmitted to slower viewers over a remote viewing session |
| CN104331644B (en) * | 2014-11-24 | 2017-08-04 | 北京邮电大学 | A kind of transparent encipher-decipher method of intelligent terminal file |
| CN106571949A (en) * | 2016-09-23 | 2017-04-19 | 北京五八信息技术有限公司 | Event tracking point processing method and apparatus |
| CN107196788B (en) * | 2017-05-02 | 2020-12-18 | 创新先进技术有限公司 | Method and device for processing buried point data, server and client |
| CN107832218B (en) * | 2017-11-10 | 2019-03-12 | 平安科技（深圳）有限公司 | A processing method, device and computer equipment are buried in dynamic page |
| CN108536569B (en) * | 2018-03-21 | 2021-06-29 | 创新先进技术有限公司 | Business behavior tracking method, device and equipment |
-
2019
- 2019-05-16 CN CN201910409560.5A patent/CN110175453B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101241464A (en) * | 2007-02-05 | 2008-08-13 | 中兴通讯股份有限公司 | Method for checking stack frame destruction |
| CN105893846A (en) * | 2016-04-22 | 2016-08-24 | 北京金山安全软件有限公司 | Method and device for protecting target application program and electronic equipment |
Non-Patent Citations (2)
| Title |
|---|
| Feng Dong,et al.How do Mobile Apps Violate the Behavioral Policy of Advertisement Libraries?.《HotMobile"18：Proceedings of the 19th International Workshop on Mobile Computing Systems&Applications.ACM》.2018,第75-80页. * |
| 移动应用广告生态系统安全分析关键技术研究;董枫;《中国博士学位论文全文数据库信息科技辑（月刊）》;20180915;正文第2-3章 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110175453A (en) | 2019-08-27 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109558748B (en) | Data processing method and device, electronic equipment and storage medium | |
| CN107256349B (en) | Method and device for preventing dynamic library from being stolen, electronic equipment and readable storage medium | |
| CN108366052B (en) | Processing method and system for verification short message | |
| CN112671566B (en) | Data processing method, apparatus, computer device and readable storage medium | |
| CN109145651B (en) | Data processing method and device | |
| CN108491736B (en) | Tamper monitoring method and device | |
| CN112560022A (en) | System interface call detection method and device | |
| CN110175453B (en) | Method and device for judging cheating operation | |
| CN113641873B (en) | Data processing method and device, electronic equipment and readable storage medium | |
| CN110619204A (en) | Invitation code generation method and device, terminal equipment and storage medium | |
| CN111062035B (en) | Lesu software detection method and device, electronic equipment and storage medium | |
| CN111913743B (en) | Data processing method and device | |
| CN109672608B (en) | Method for transmitting messages according to time | |
| CN111277488A (en) | Session processing method and device | |
| CN110611675A (en) | Vector magnitude detection rule generation method and device, electronic equipment and storage medium | |
| CN114338102B (en) | Security detection method, security detection device, electronic equipment and storage medium | |
| CN110413871B (en) | Application recommendation method and device and electronic equipment | |
| CN113656286A (en) | Software testing method and device, electronic equipment and readable storage medium | |
| CN110020264B (en) | Method and device for determining invalid hyperlinks | |
| CN113590352A (en) | Data calling method, device, equipment and readable storage medium | |
| CN109062642B (en) | Control message notification method and device | |
| CN111240696A (en) | Method for extracting similar modules of mobile malicious program | |
| CN111552586B (en) | Application crash processing method and device | |
| CN109063206B (en) | Article monitoring method and device | |
| CN111124627A (en) | Method, device, terminal and storage medium for determining application program caller |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20220727 Address after: No.16 and 17, unit 1, North District, Kailin center, No.51 Jinshui East Road, Zhengzhou area (Zhengdong), Henan pilot Free Trade Zone, Zhengzhou City, Henan Province, 450000 Patentee after: Zhengzhou Apas Technology Co.,Ltd. Address before: E301-27, building 1, No.1, hagongda Road, Tangjiawan Town, Zhuhai City, Guangdong Province Patentee before: ZHUHAI TIANYAN TECHNOLOGY Co.,Ltd. |
|
| TR01 | Transfer of patent right |