KR100457405B1 - Method of detecting whether speed hack is in use - Google Patents

Abstract

The present invention relates to a method for detecting whether or not to use a speed hack to manipulate the internal time of the computer by determining whether the timer API hooking.

A speed hack detection method using a timer API hooking determination method according to the present invention is a process including a main module for executing a program and an import address table (IAT) for storing an address of an API (Application Programming Interface) processing routine. A raw code value storing step of storing an original code value of a processing routine of the timer API to determine whether to hook; A usage code value obtaining step of reading a code value of a position indicated by an address of a processing routine of the timer API stored in the IAT when a hooking detection of the timer API is requested; A comparison step of comparing the code value stored in the original code value storing step with the code value read in the use code value obtaining step; If the two code values do not match as a result of the comparison step, it is determined that the use of speed hacking by the hooking of the timer API, and if the two code values match, the determination step of determining that the hooking of the timer API.

Description

Method of detecting whether speed hack is used by timer APC hooking determination method {Method of detecting whether speed hack is in use}

The present invention relates to an online game security method, and more particularly, to a method for detecting whether or not to use a speed hack to manipulate the internal time of the computer by determining whether the timer API hooking.

With the widespread use of high speed internet, the online game population has increased rapidly and numerous online games have been developed, but the concept and concept of game security is still weak. Hacking in games is called hacking. In general, hacking refers to gaining administrator privileges on a particular computer or accessing and manipulating data on that computer. Points to a program that manipulates files, memory, etc.

One type of game hack is the speed hack. This speed hack is a program that tricks a computer's time as if it's flowing more real time, thereby increasing the response speed of the game program. When using speed hacks, the movement and attack speed of characters in the game is several to hundreds of times faster, and the packets sent by the client to the game server are also faster.

When the client uses the speed hack, the attacker moves faster than the normal player and the character grows faster. Therefore, the normal user who does not use the speed hack will be harmed. In addition, when the client uses the speed hack, the amount of packets sent to the game server increases during the unit time, and the game server is overloaded while processing an excessive amount of packets. Therefore, failure to sanction the use of speed hacks in online games eventually breaks the balance among the users in online games, which leads to an increase in the dissatisfaction of normal users, and a serious problem that causes other characters in the game to collapse due to the characters growing much faster than normal speed. Can cause.

To solve this problem, we need to prevent the game client from using speed hacks. To do this, we need to detect whether speed hacks are used. Currently, online game developers and online game security companies are developing technology to detect the use of speed hacks.

An online game developer detects the use of speed hacks by calculating the time difference between the game client and the game server and using the amount of packets arriving at the game server. The online game security company adds a pattern of speed hack programs to the security engine configured using an anti-virus engine, and periodically scans processes to force a program to terminate if there is a program that matches the registered speed hack pattern. Detects the use of speed hacks.

However, the speed hacking detection method developed by a conventional online game developer is difficult to accurately detect whether the speed hack is used when the client uses the speed hack weakly or at a specific moment. In other words, if the client uses the speed nucleus tens or hundreds of times, it is easy to detect whether the speed nucleus is used. However, if the client uses one or two times, it is difficult to accurately determine whether the speed nucleus is used. In addition, if you normally play games at normal speed and use speed hacks several times only during certain moments, such as attacks, the game server can determine that packets arrived at once due to network delays. Accurate detection is difficult. In addition, the speed hack detection method developed by the conventional on-line game developer has a problem of overloading the game server. In other words, if the game server checks the speed hack for all packets coming from all clients, the load on the game server increases and the number of clients that the game server can accommodate decreases, which is expensive to accommodate the same number of clients. There is a problem that must add the game server.

The speed hack detection method developed by the conventional online game security company has a problem in that all the patterns of the speed hack program should be added to the security engine. To add a pattern to a security program, you'll need to get that speed hack, and it's almost impossible to get all the speed hacks of all kinds. In addition, even if a pattern added to the security engine is compressed or even a slight change in the executable file, the program pattern is changed, so the speed hack program cannot detect any more.

As described above, the use of speed hacking by clients in today's online games must be sanctioned. Due to the technical reasons described above, most online games today are unable to detect whether a client uses speed hacking, and thus, use speed hacking by clients. It is not even sanctioned.

An object of the present invention devised to solve the problems of the prior art as described above is to provide a method for quickly and accurately detecting the use of a speed hack by determining whether the timer API is hooked.

1 is a memory structure diagram of a game process in which a speed hack of an IAT hooking system is used;

2 is a memory structure diagram of a game process in which a speed hack of an API processing routine change method is used;

3 is a flowchart illustrating a method of detecting a speed hack using a timer API hooking determination method according to an embodiment of the present invention.

Speed hack detection method according to the timer API hooking determination method according to the present invention for achieving the above object is, IAT (stores the address of the main module to execute the program and the API (Application Programming Interface) processing routine) In a process that includes an Import Address Table,

An original code value storing step of storing an original code value of a processing routine of the timer API to determine whether to hook;

A usage code value obtaining step of reading a code value of a position indicated by an address of a processing routine of the timer API stored in the IAT when a hooking detection of the timer API is requested;

A comparison step of comparing the code value stored in the original code value storing step with the code value read in the use code value obtaining step;

And if the two code values do not match as a result of the comparing step, determining that the speed hack is used by the hooking of the timer API, and if the two code values match, determining that the hook code is not hooking of the timer API. It is done.

According to the present invention, there is provided a computer-readable recording medium having recorded thereon a program for executing a speed hack use detection method by the timer API hooking determination method as described above in a process of a computer system.

Hereinafter, referring to the accompanying drawings, a method for detecting speed hacking by a timer API hooking determination method according to an embodiment of the present invention will be described in detail.

In a conventional game program, a PIT type speed hack is used to manipulate a computer clock so as to adjust the latch value of a programmable interval timer (PIT) of a computer. However, because the operating system does not work well with the latch value of the PIT on Windows NT / 2000 / XP series computers, the PIT speed hack works well on Windows 9x series computers, but some Windows NT / 2000 / XP series computers do not. Will not work.

Therefore, the speed hack of PIT method is gradually disappearing, and the recent speed hack is a timer API hooking method that manipulates the timer API functions (e.g., GetTickCount, timeGetTime, QueryPerformanceCounter) used by the game process as if it has passed a lot of time. use.

The present invention proposes a method for quickly and accurately detecting whether a timer API hooking is used or not using a speed hack.

Timer API functions include GetTickCount, timeGetTime, and QueryPerformanceCounter. Most game programs use one or more of these three timer APIs. Therefore, Speed Hack also hooks one or more of these three timer APIs used in game programs. Hooking the timer API includes directly modifying the import address table (IAT) and changing the API processing routine to overwrite the jump instruction to the speed hacking routine with the actual timer API processing routine.

FIG. 1 is a diagram showing a memory structure of a game process using a speed hack of an IAT hooking method, and FIG. 2 is a diagram showing a memory structure of a game process using a speed hack of an API processing routine change method.

The game process includes a main module 11, an IAT 12 in which an address of an API processing routine is written, and a system dynamic linking library (DLL) 14 loaded with an actual API processing routine. When the user executes the game program, the main module 11 and the IAT 12 are loaded into the memory as shown in Fig. 1, and the system DLL 14 is loaded with this. Here, when the speed hack is executed, the speed hack hooking routine 13 is added to the game process.

When the game process executes an API (Application Programming Interface) command provided by Windows, the computer operating system finds the address of the API processing routine from the game process's IAT 12 and executes the API processing routine included in the system DLL 14. Let's do it.

At this time, the method of manipulating the speed of the computer by hooking the timer API includes the IAT hooking method and the API processing routine changing method as described above.

With reference to FIG. 1, the operation method of the speed hack of an IAT hooking system is demonstrated. The IAT 12 stores the address of the API processing routine. The speed hack of the IAT hooking method changes the address of the timer API processing routine recorded in the IAT 12 into the speed hacking routine 13.

In the case of the timer API hooked by the speed hack, when the main module 11 of the game process executes the timer API hooked by the speed hack, the speed hack hooking routine 13 recorded in the IAT 12 is called ( After 1a), the speed hacking routine 13 executes the actual timer API processing routine (1b). At this time, the value executed in the timer API processing routine is returned to the speed hacking routine 13, and the speed hacking routine 13 manipulates this execution value and returns it to the game process. When the speed hacking routine returns twice the normal value to the game process, the game process waits 0.5 seconds to wait for 1 second before running, resulting in a 2x overall response.

In the case of an API not hooked by the speed hack, when the main module 11 of the game process executes the normal API, the actual API processing routine recorded in the IAT 12 is called (2a) and executed normally.

A method of operating a speed hack in the API processing routine changing method will be described with reference to FIG. 2. The speed hack of the API processing routine change method is a method of overwriting the jump instruction to the speed hacking routine at the beginning of the corresponding timer API processing routine of the system DLL 14 loaded in the memory of the game process.

In the case of the timer API hooked by the speed hack, when the game process executes the timer API hooked by the speed hack, the timer API processing routine of the system DLL is normally called (3a), but as soon as the timer API processing routine is called, the jump instruction is executed. The speed hacking routine is executed (3b).

In the case of the normal API not hooked by the speed hack, when the main module 11 of the game process executes the normal API, the actual API processing routine recorded in the IAT 12 is called (4a) and executed normally.

The present invention proposes a speed hack detection method capable of detecting both speed hacks using the API hooking method.

3 is a flowchart illustrating a method of detecting a speed hack using a timer API hooking determination method according to an embodiment of the present invention.

When the game program is initially driven, the code comparison routine according to the present invention is loaded into the game process (S301).

Next, the code comparison routine stores an original code value of a timer API processing routine for checking whether hooking is performed (S302). GetTickCount and QueryPerformanceCounter have the processing routine in KERNEL32.DLL, and timeGetTime has the processing routine in WINMM.DLL. Therefore, in step S302, the code value of the timer API processing routine is read and stored from the DLL file in which the actual processing routine of the timer API for which hooking is to be checked is stored. At this time, only some code values that may be hooked by the speed hack may be stored instead of the entire code values of the timer API processing routine. In particular, only some code values of the first portion of the timer API processing routine may be stored.

Then, the code comparison routine detects whether the speed API is used by determining whether the timer API is hooked when the periodic or game process uses the timer API.

That is, when it is necessary to detect whether the speed hack is used (S303), the code comparison routine obtains a code value from the address value of the timer API processing routine stored in the IAT (S304). In this case, only some code values, particularly some code values of the first part, may be obtained from the address value of the timer API processing routine.

The code value stored in step S302 is compared with the code value obtained in step S304 (S305). As a result of the comparison, if the two code values match (S306), it is recognized that the speed hack is not used, and the flow proceeds to step S303. If the codes of the two partial bytes do not match as a result of the comparison in step S305 (S306), it is determined that the speed hack is used, and the game program is notified (S307).

By applying the speed nucleus detection method according to the present invention as shown in FIG. 3, it is possible to detect whether the speed nucleus of the IAT hooking method and the speed nucleus of the API processing routine change method are used. The process of detecting the speed nucleus is described.

The speed hack of the IAT hooking method changes the address value of the timer API processing routine stored in the IAT to the address value of the location where the speed hacking routine is stored. Therefore, when the comparison processing routine according to the present invention reads the code value from the address of the timer API processing routine stored in the IAT, the code value of the speed hacking routine is read, not the code value of the actual API processing routine. That is, in the case of the timer API hooked by the speed hack, it is possible to detect whether the timer API is hooked because the code value of the previously stored API processing routine and the code value of the speed hacking routine read out at the time of the speed hack detection are different from each other.

Speed hacks in the API handling routine modification scheme override API handling routines with jump instructions to the speed hacking routine. That is, the code value of the API processing routine is changed. When the comparison processing routine according to the present invention reads the code value from the address of the timer API processing routine stored in the IAT, the code value of the API processing routine hooked by the speed hack is read. Therefore, in the case of the timer API hooked by the speed hack, it is possible to detect whether the timer API is hooked because the code value of the original API processing routine differs from the code value read when the speed hack is detected.

The code comparison routine according to the present invention must be included in the main module and executed in the main module according to the hooking method of the speed hack, or may exist as a separate module.

This is described below. Every module loaded into the process has a separate IAT, and each module uses its own IAT to get the address of the API processing routine. IAT hooking speed hacks include a speed hack that hooks only the IAT of the main module and a speed hack that hooks the IAT of all modules loaded into the process.

If the speed hack only hooks the IAT of the main module, other modules other than the main module are not affected by the speed hack, so that the code comparison routine can detect the address value of the API processing routine from the main module's IAT. Must be obtained and executed in the main module. To do this, the code comparison routine should be inserted into a game program executable (eg, an exe file) and included in the main module of the game process when the game program is run. On the other hand, if the speed hack hooks the IAT of all modules, all modules loaded in the process are affected by the speed hack, so that the code comparison routine exists as a separate module, and thus the speed hack is affected even if it has a separate IAT. Therefore, the code comparison routine does not necessarily need to be executed in the main module when detecting whether the speed hack that hooks the IAT of all the modules of the process is present, but may exist as a separate module. That is, the code comparison routine may be inserted into an executable file (for example, an exe file) of a game program and included in a main module of the process, or exist in a separate independent file (for example, a dll file) and then exist in the game process. May be loaded into the system DLL.

The speed hack in the API processing routine change method changes the code value of the API processing routine and does not hook the IAT. Therefore, whether the code comparison routine accesses the API processing routine using the IAT of the main module or accesses the API processing routine using a separate IAT, the API processing routine hooked by the speed hack is called. That is, when detecting whether the speed hack using the API processing routine change method is used, the code comparison routine may be included in the main module of the process, or may exist as a separate file and loaded into the system DLL of the game process. do.

In summary, the code comparison routine must be executed in the main module of the game process to detect whether the main module uses a speed hack that hooks only the IAT. The code comparison routine does not need to be executed in the main module of the game process, but may be executed as a separate module to detect whether a speed hack that hooks the IAT of all modules or a speed hack using an API processing routine change method is used.

In another embodiment of the present invention, there is an address comparison method as a method for detecting whether a speed hack is used in the IAT hooking method. This address comparison method inserts an address comparison routine into the game process, saves the address of the API processing routine when the game process is initially started, and compares the address of the API processing routine with the stored address. It is a method of judging whether the API is hooked and whether the speed hack is used.

Here, the address comparison routine may be executed in the main module when the speed hack hooks only the IAT of the main module, or may be executed as a separate module when the IATs of all the modules are hooked. However, this address comparison method cannot detect whether a speed hack is used by the API processing routine change method.

Although the technical spirit of the present invention has been described above with reference to the accompanying drawings, it is intended to exemplarily describe the best embodiment of the present invention, but not to limit the present invention. In addition, it is obvious that any person skilled in the art may make various modifications and imitations without departing from the scope of the technical idea of the present invention.

The present invention can determine whether or not to use the latest speed hack by determining whether the timer API hooking can be applied to various programs and services, including online games that can be damaged by the speed hack. In addition, since the server detects whether a speed hack is used by comparing a few bytes of code values, the server does not determine whether the speed hack is used, and there is little load and a fast and accurate inspection can be performed.

In addition, when the present invention is used in online games, gamers can all compete in good faith under the same conditions, thereby contributing to the healthy adjustment of online game culture.

Claims (6)

In a process that includes a main module that executes a program, and an import address table (IAT) that stores the address of the processing routine of the timer application programming interface (API), An original code value storing step of storing an original code value of a processing routine of the timer API to determine whether to hook; A usage code value obtaining step of reading a code value of a position indicated by an address of a processing routine of the timer API stored in the IAT when a hooking detection of the timer API is requested; A comparison step of comparing the code value stored in the original code value storing step with the code value read in the use code value obtaining step; And if the two code values do not match as a result of the comparing step, determining that the speed hack is used by the hooking of the timer API, and if the two code values match, determining that the hook code is not hooking of the timer API. Speed hack detection method using a timer API hooking determination method. The method of claim 1, wherein the storing of the original code value stores a partial code value of a first portion of an original code value of a processing routine of the timer API, and the acquiring use code value is an address of a processing routine of the timer API. Speed hack detection method using a timer API hooking determination method, characterized in that the first part of the code value is read from. 2. The method of claim 1, wherein the storing of the original code value and the comparing step are performed in a main module of the process. The method of claim 1, wherein the determining step, If the two code values do not match and the address values of the two code values do not coincide, the timer API hooking determination method is determined as using the speed hack of the IAT hooking method among the speed hacks by the hooking of the timer API. Method for detecting the use of speed hack by The method of claim 1, wherein the determining step, If the two code values do not match and the address values of the two code values match, it is determined whether the timer API hooking is determined by using a speed hack using an API processing routine change method among speed hacks caused by hooking of the timer API. Speed nucleus detection method by the method. A computer that records a program for executing a speed hack detection method in a process including a main module that executes a program and an import address table (IAT) that stores an address of a processing routine of an application programming interface (API). In a recording medium, The speed hack detection method includes: an original code value storing step of storing an original code value of a processing routine of the timer API for determining whether to hook or not; A usage code value obtaining step of reading a code value of a position indicated by an address of a processing routine of the timer API stored in the IAT when a hooking detection of the timer API is requested; A comparison step of comparing the code value stored in the original code value storing step with the code value read in the use code value obtaining step; If the two code values do not match as a result of the comparison step, the speed hack is determined to use the speed hacking by the hooking of the timer API, and if the two code values match, the speed hack including a determination step of determining that it is not hooking of the timer API A computer-readable recording medium having recorded thereon a program for executing a detection method.