KR101216485B1 - Detecting method of gamehack dll - Google Patents

Abstract

The present invention relates to a method for detecting a game core dynamic link library inserted and operated in a game process.
In the method of detecting a game core dynamic link library according to the present invention, the security process includes a first step of extracting a dynamic link library list inserted in the game process and memory address information loaded with each dynamic link library included in the list; The security process includes a second step of selecting a diagnostic target dynamic link library of the dynamic link library list, the security process is a third step of reading the machine code of the diagnostic target dynamic link library and converting to an assembling code; If the assembling code converted in the third step includes a command code for calling the game process or another dynamic link library included in the game process, the security target dynamic link library is converted into a game core dynamic link library. And a fourth step of diagnosing.

Description

How to detect game core dynamic link library {DETECTING METHOD OF GAMEHACK DLL}

The present invention relates to a method for detecting a game hack, and more particularly, to a method for detecting a game hack dynamic link library inserted and operated in a game process.

With the widespread use of high speed internet, the online game population has increased rapidly and numerous online games have been developed. However, the concept and concept of game security is still insufficient. Malicious programs that run on computers are called hacks or hacking programs, and in particular, hacks or hacking programs in games are called game hacks.

Game hacks allow gamers to easily win games by manipulating the game's memory to change certain data, such as stats and stamina, increase the speed or number of hits in a martial arts game, or give macros to the game. This is why gamers want to install game hacks for online games. However, the use of game hacks in online games can lead to problems such as poor balance among users, heavy loads on game servers, and the like.

In other words, in online games, when some users install game hacks on their computers and play games in an abnormal way, they lose their balance with other users. Is broken and the game server is overloaded.

Therefore, game providers are required to install a security program along with the game program in the game client. When the game process starts, the security process starts. If the execution of the security process stops, the game process stops. Blocks game hacks from running.

In the specification of the present invention, 'game hack', 'program', 'file', etc. refer to a set of instructions written in order to execute a computer, and the 'program' is launched from a computer and loaded into a memory. In other words, a state running in a computer is called a process. That is, the game program is executed as a game process, the security program is executed as a security process, and the game hack is executed as a game hack process. The security process blocks the execution of various hacking processes including game hacks running on the computer.

In general, when an arbitrary process is executed, a linking structure is created to manage dynamic linking library (DLL) files inserted into the process. When checking the linking structure, the list of DLLs inserted into the process and the list of DLLs You can check the loaded memory address of each DLL included in. Typically, information about a DLL inserted into a process is obtained using the FindProcess or OpenProcess command.

Similarly, when the game process is executed, a linkage structure (hereinafter referred to as a game linkage structure) that manages DLL files inserted into the game process is created. This game linkage structure contains a list of DLLs inserted into the game process and the memory address information loaded for each DLL included in the DLL list.

Types of game hacks include a game hack in the form of an external operation that independently executes a separate process to hook and operate the game process, and a game hack DLL that is injected into the game process as a DLL file and operates inside the game process. have.

As a general method for diagnosing game hacks that run inside or outside the game process, the security process extracts and stores the pattern of the detected game hacks in the database, and the game stored in the database for processes running on the computer. Detects game hacks compared to hack patterns.

In this general game nucleus diagnosis method, as the number of game nuclei increases, the pattern to be stored in the database increases, so that a larger capacity database is required and the game nucleus diagnosis and detection time becomes longer. In addition, since the game nucleus is diagnosed according to whether or not the pattern matches, there is a problem in that unknown or unknown game nuclei are not detected.

Disclosure of Invention The object of the present invention devised to solve the above-mentioned problems of the prior art is to provide a method for detecting a game nucleus DLL more easily and accurately by using the characteristics of a game nucleus DLL inserted and operated in a game process.

Game nucleus dynamic link library detection method according to an embodiment of the present invention for achieving the above object, the security process is a dynamic link library list inserted into the game process and each dynamic link library included in the list is loaded memory A first step of extracting address information;

The security process includes a second step of selecting a diagnostic target dynamic link library of the dynamic link library list;

The security process is a third step of reading the machine code of the dynamic link library to be diagnosed and converted to assembling code;

If the assembling code converted in the third step includes a command code for calling the game process or another dynamic link library included in the game process, the security target dynamic link library is converted into a game core dynamic link library. And a fourth step of diagnosing.

According to another aspect of the present invention, there is provided a game core dynamic link library detection method, wherein a security process includes: a first list of extracting a dynamic link library list inserted in a game process and memory address information loaded with each dynamic link library included in the list; Steps,

The security process includes a second step of selecting a diagnostic target dynamic link library of the dynamic link library list;

The security process is a third step of reading the machine code of the dynamic link library to be diagnosed and converted to assembling code;

When the assembling code converted in the third step includes an instruction code for moving to the game process or another dynamic link library included in the game process, the security target library is transferred to the game core dynamic link library. And a fourth step of diagnosing.

As described above, according to the present invention, since the DLL including the command code for calling the game process (CALL) or moving to the game process (JUMP) among the DLLs inserted in the game process is detected as the game nucleus DLL, it is more accurate and faster. Not only can it detect game hacks, but it can also detect unknown game hack DLLs whose patterns are unknown.

1 is a functional block diagram of a computer system to which a method for detecting a game core dynamic link library according to the present invention is applied.
2 is a flowchart illustrating a method for detecting a game core dynamic link library according to the present invention.

Hereinafter, a method for detecting a game core dynamic link library according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

The game core dynamic link library detection method according to the present invention is provided as part of a security program. A security program that executes this game hack dynamic link library detection method generates and executes a security process in a computer system, and the execution code and data of the security process are loaded into memory. The CPU performs the game core dynamic link library detection function according to the present invention by sequentially processing the execution code of the security process loaded in the memory.

1 is a functional block diagram of a computer system to which a method for detecting a game core dynamic link library according to the present invention is applied.

In general, a plurality of dynamic link libraries (DLLs) 111 and 112 are inserted into a game process 100 executed in a computer system, and the game link structure 113 includes a plurality of DLLs inserted into a game process 100. Store and manage lists for (111, 112).

The security process 120 for executing the game core dynamic link library detection method according to the present invention is a DLL for extracting the DLL list inserted in the game process 110 and the memory address information of each DLL loaded from the game connection structure 113 Reads the machine code from the information extracting unit 121, the disassembly unit 122 for disassembling the machine codes of the DLLs, and the memory address of any DLL extracted by the DLL information extracting unit 121 The game unit DLL diagnosis unit 123 converts the assembly code through the ring unit 122 and analyzes the assembly code to diagnose whether the game core DLL is included.

In addition, the security process 120 according to the present invention further includes a white list storage unit 124 for storing the list of DLLs allowed by the game process 110, the game nucleus DLL diagnostic unit 123 is the DLL information extraction Among DLLs extracted by the unit 121, DLLs not included in the white list storage unit 124 are diagnosed as game nucleus DLLs. Here, the white list storage unit 124 stores a unique value of the DLL allowed by the game process, and this unique value may be a hash value or PE header information.

In addition, the game nucleus DLL diagnosis unit 123 diagnoses the game nucleus DLL with respect to the remaining DLLs except for the digitally signed DLL among the DLLs extracted by the DLL information extraction unit 121. In addition, the game nucleus DLL diagnosis unit 123 checks whether the game nucleus DLL is the other DLLs except for the DLL including the Microsoft Corporation (MicroSoft Corporation) authentication information among the DLLs extracted by the DLL information extraction unit 121. Diagnose

The game hack DLL diagnosis unit 123 analyzes the assembly code of the DLL, and if the DLL includes a command code for calling (CALL) or moving to the game process (JUMP), the DLL is diagnosed as a game hack DLL. do. In detail, when the machine code of the DLL is converted to the assembling code, the CALL instruction code is "E8", and the next 8 digits are the address values to call. Therefore, if the 8-digit address value after the CALL command code "E8" is the address of the memory space in which the game process is loaded, the game nucleus DLL diagnosis unit 123 recognizes that the DLL calls the game process and the corresponding DLL. Is diagnosed as a game hack DLL.

On the other hand, the assembling code indicating the JUMP instruction is " E9 ", and the next 8 digits are the difference value between the address value to be moved and the current address value. Therefore, the sum of the 8-digit address value after the jump command code “E9” and the current address value of the move command code becomes the address value to be jumped, and the address value to be moved is loaded by the game process. If it is the address of the memory space, the game hack DLL diagnostic unit 123 diagnoses the DLL as a game hack DLL.

In addition, if the present invention is extended, one DLL inserted into the game process calls another DLL inserted into the game process or moves to another DLL inserted into the game process to diagnose the DLL as a game core DLL. .

2 is a flowchart illustrating a method for detecting a game core dynamic link library according to the present invention.

The security process extracts a list of DLLs inserted into the game process and memory address information loaded with each DLL (S31). As described above, the security process can obtain a list of DLLs inserted into the game process and memory address information of each DLL through the game connection structure.

Next, the security process selects one DLL to be diagnosed from the DLL list (S32). In this case, the DLL, the digitally signed DLL, and the DLL including Microsoft's authentication information, which are permitted by the game process, are excluded from the DLL to be diagnosed.

Next, the security process reads the machine code of the diagnosis target DLL using the memory address information of the diagnosis target DLL selected in step S32 (S33) and converts the machine code into an assembling code (S34).

If the assembling code of the diagnosis target DLL includes a call instruction or a jump instruction (S35), the call target address value or the jump target address value is calculated (S36).

If the call target address value or the move target address value is in the memory space of the game process (S37), the diagnosis process DLL diagnoses the diagnosis target DLL as a game hack DLL (S38).

Steps S33 to 39 are repeated until all the machine codes of the DLLs to be diagnosed are read, and steps S32 to S40 are repeatedly performed until the diagnosis on all the DLLs to be diagnosed is completed.

In step S37, the diagnosis target DLL can be diagnosed as a game nucleus DLL even if the call target address value or the move target address value is in the memory space of another DLL inserted into the game process.

In this specification, a technology for detecting a game hack DLL inserted into a game process in the form of a DLL file has been described in detail. However, the present invention is not limited thereto and may be applied to detecting a game hack in a thread unit constituting the game hack DLL. have.

110: game process 111, 112: dynamic link library
113: game connection structure 120: security process
121: DLL information extraction unit 122: de-assembly unit
123: game nucleus DLL diagnosis unit 124: white list storage unit

Claims (6)

The security process includes a first step of extracting a dynamic link library list inserted into the game process and memory address information loaded with each dynamic link library included in the list;
The security process includes a second step of selecting a diagnostic target dynamic link library of the dynamic link library list;
The security process is a third step of reading the machine code of the dynamic link library to be diagnosed and converted to assembling code;
If the assembling code converted in the third step includes a command code for calling the game process or another dynamic link library included in the game process, the security target dynamic link library is converted into a game core dynamic link library. Game core dynamic link library detection method comprising the step of diagnosing. The security process includes a first step of extracting a dynamic link library list inserted into the game process and memory address information loaded with each dynamic link library included in the list;
The security process includes a second step of selecting a diagnostic target dynamic link library of the dynamic link library list;
The security process is a third step of reading the machine code of the dynamic link library to be diagnosed and converted to assembling code;
When the assembling code converted in the third step includes an instruction code for moving to the game process or another dynamic link library included in the game process, the security target library is transferred to the game core dynamic link library. Game core dynamic link library detection method comprising the step of diagnosing. The method of claim 1 or 2, wherein in the second step,
And the security process excludes from the dynamic link library to be diagnosed the dynamic link library allowed by the game process in the dynamic link library list. 4. The method according to claim 3, wherein the security process stores in advance a unique value of a dynamic link library allowed by the game process in a white list. The method of claim 1 or 2, wherein in the second step,
And the security process excludes the digitally signed dynamic link library from the dynamic link library list from the diagnostic target dynamic link library. The method of claim 1 or 2, wherein in the second step,
The security process is a game core dynamic link library detection method, characterized in that the dynamic link library including Microsoft authentication information in the dynamic link library list to exclude from the diagnostic dynamic link library.

Images