KR101235517B1 - Method for Detecting Modification of Computer Program Executing in Memory - Google Patents

Abstract

The present invention makes it possible to detect whether a computer program running on a computer memory is tampered with. To this end, the protected program to be protected from tampering is configured to include the original stored code, which is executed when the protected program is loaded into memory to store the original information. The original information refers to information about a certain protected area of the protected program, and the tamper detection program periodically compares the protected area information of the protected program loaded in the memory with the original information to check whether tampering has occurred. According to the present invention, since tampering is detected based on original information of a computer program running in a memory, tampering by unknown malicious code can be detected, and it is necessary to separately distribute original information for judging tampering. As a result, it is possible to detect the modification of the execution time of the computer program conveniently and efficiently.

Description

Method for Detecting Modification of Computer Program Executing in Memory}

The present invention detects whether a computer program running in computer memory is tampered with by malicious code, thereby preventing the computer program from being used illegally and taking appropriate measures.

There are a wide variety of malicious codes related to computers, and there are many attempts to achieve unjust goals by altering normal computer programs running on computers.

For example, in the case of online games, the value of in-game goods such as game items increases, and the act of acquiring in-game goods is progressing through the automated process through a robot program.

The robot program modulates a program module loaded by the game client into memory to control the game to proceed according to its purpose.

To prevent such a situation, it is necessary to detect whether the computer program running in the memory of the computer has been tampered with.

Accordingly, an object of the present invention is to provide a method capable of efficiently detecting whether a computer program executed in a memory of a computer has been tampered with.

In order to achieve the above object, a first embodiment according to the present invention comprises: an original storage step of storing information about a predetermined protection area of a computer program loaded in a memory as original information; And a modulation detection step of detecting whether or not the computer program has been tampered with by comparing the original information with information about the protection area of the computer program loaded in the memory. The original storing step is performed by an original storing code set in the computer program to be executed when the computer program is loaded into the memory.

The original storage code may store the data of the protection area as the original information.

The original storage code may encrypt the data of the protected area in a decryptable encryption manner and store the original information.

The original storage code may store a hash value of the data of the protected area as the original information.

The original information may be deleted when the computer program is unloaded from the memory.

In the second embodiment according to the present invention, the computer program to be protected is configured to have a cipher value in which data of a certain protected area is encrypted according to a specific encryption method.

According to a second embodiment of the present invention, an encryption step of encrypting data relating to a predetermined protection area of a computer program in which a tamper detection program is periodically loaded into a memory is performed; And a tamper detection step for the tamper detection program to detect whether the computer program has been tampered with by comparing a result value processed in the encryption step with a cryptographic value possessed by the computer program.

In the second embodiment, the specific encryption method may be a method of calculating a hash value using a hash function.

In the first and second embodiments, the predetermined protection area of the computer program may be an area in which data whose contents are not changed when executed is stored.

When the computer program loaded in the memory is modulated, the modulation detection program may transmit information related to the modulation to a specific server.

In this case, the information related to the modulation transmitted to the specific server may include a modulated position, data before modulation, data after modulation, length of modulated data, program information branched by the modulation, and the like.

The modulation detection program may terminate execution of the computer program or restore the modulated data when the computer program loaded in the memory is modulated.

The computer program may include a program module which a specific application loads into the memory during its execution.

The application may be a game client that runs on a user's computer device and performs an online game while communicating with a game server through a communication network.

According to the present invention, since tampering is detected based on original information of a computer program executed in a memory, tampering by unknown malicious code can be detected.

In addition, it is not affected by computer programs for other purposes, such as packers and executable file compression programs that use IAT Wrapping technology or obfuscation (virtualization) technology.

In addition, it is not necessary to distribute original information on the protection area separately in order to determine the correct modulation position or modulation data.

This effectively detects the tampering of computer programs running on computer memory, and allows for rapid response.

1 is an example of a computer device,
2 is an overview of a program to be protected according to the first embodiment of the present invention;
3 is a view showing a state in which a program to be protected and a tamper detection program are loaded in a memory in the first embodiment according to the present invention;
4 is a flowchart for explaining a modulation detection method of a first embodiment according to the present invention;
5 is an overview of a program to be protected according to a second embodiment of the present invention;
6 is a view showing a state in which a program to be protected and a modulation detection program are loaded in a memory in a second embodiment according to the present invention;
7 is a flowchart for explaining a modulation detection method of a second embodiment according to the present invention;
8 illustrates an example in which an application loads several modules into a memory as needed.
9 and 10 are examples of applying the modulation detection method according to the present invention to an online game service.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The present invention relates to a method for detecting whether a computer program running in a memory of a computer device is modulated.

A computer device refers to any device that can load and execute a computer program such as a personal computer (PC), a notebook computer, a tablet computer, a smartphone, a personal digital assistant (PDA), and the like in a memory.

1 shows an example of a computer device 11, in which each element is connected to each other via a system bus 11-9, which may have various structures, and a central processing unit (CPU) 11-1. It plays its role by exchanging data with each other under the general control of).

The storage medium 11-2 has a non-volatile property, and in general, an internal hard disk drive (HDD) is used in a personal computer, but internal, external, and external devices accessible by the computer device 11 may be used. It can have a variety of forms, both separable and non-separable.

The input means 11-3 allows the user to input various commands or information to the computer device 11, and the display means 11-4 displays the information to be visually output on the display screen.

The memory 11-5 refers to a random access memory (RAM) that holds a computer program or data that the central processing unit 11-1 immediately accesses. The computer program is stored in the memory by the central processing unit 11-1. It is loaded in (11-5) and executed.

The network interface 11-6 allows the computer device 11 to connect and communicate with various communication networks 13 such as a wired internet network or a wireless internet network.

In the description of the present invention, a computer program to be protected may be a program module (eg, a DLL or an EXE) that is loaded and executed in the memory 11-5 by the main computer program. It may be.

Hereinafter, for convenience of description, a computer program to be protected from tampering will be referred to as a 'protected program'. That is, the program to be protected may be a main computer program or may be a program module which the main computer program loads into the memory 11-5 as necessary.

2, in the modulation detection method of the first embodiment according to the present invention, the protected program 310 is configured to include an original storage code 311.

The original storage code 311 is a code included in the program to be protected 310, and when the program to be protected 310 is loaded into the memory 11-5, information about a certain protection area of the program to be protected 310 is stored. Save it as original information.

The original storage code 311 stores original information when the protected program 310 loaded in the memory 11-5 is first executed.

Which area of the program to be protected 310 is a protected area can be set in various ways as necessary.

As a specific example of the protected area, an area in which data whose contents are not changed when the protected program 310 is executed, such as .text, .rdata, .rsrc, or the like, may be set as the protected area.

The original storage code 311 may store the data of the protection area as the original information, or may encrypt the data of the protection area by a specific encryption method and store it as the original information to prevent exposure. In the latter case, the hash value of the data in the protected area can be stored as the original information.

If the tamper detection process is configured to compare the data of the protected area as it is, the encryption method should use a decryptable method.

FIG. 3 shows the state of the memory 11-5 related to the modulation detection method of the first embodiment according to the present invention, in which the protected program 310 and the modulation detection program 321 are stored in the memory 11-5. Is loaded.

In the first embodiment, the tamper detection program 321 monitors whether the protected program 310 is modulated by using the original information stored in the original storage code 311 of the protected program 310.

4 shows a modulation detection method of the first embodiment according to the present invention.

First, the protected program 310 is loaded into the memory 11-5 (S211), and the information about the protected area of the protected program 310 when the original storage code 311 is initially executed. The original information 331 is stored (S212).

The modulation detection program 321 then detects whether the protection target module 310 of the memory 11-5 is modulated in accordance with steps S213 to S216.

That is, the tamper detection program 321 may include the original information 331 in which the original storage code 311 stores information about a protected area of the protected program 310 that is periodically loaded into the memory 11-5. Compare and check whether they match each other (S213). If the result of the check coincides with each other, it is determined that no modulation has occurred (S214, S215), and if it does not coincide with each other, it is determined that modulation has occurred (S214, S216).

At this time, when the original information 331 is the data of the protection area, the protection area data of the protection target program 310 loaded in the memory 11-5 is read as it is and compared with the original information 331.

However, when the original information 331 is a hash value, the hash value of the protection area data of the protected program 310 loaded in the memory 11-5 is obtained and compared with each other.

In addition, if the original information 331 is a value encrypted by the decryption method that can be decrypted, the value obtained by decrypting the original information 331 and the protection area data of the protected program 310 loaded in the memory 11-5 are stored. Compare.

The original information 331 may be configured to be deleted when the program to be protected 310 is unloaded from the memory 11-5. The deletion of the original information 331 may be performed by the protected program 310, the main program calling the protected program, the tamper detection program 321, or a separate program.

Referring to FIG. 5, in the modulation detection method of the second embodiment of the present invention, the program to be protected 310 is configured to include an encryption value 313 of a protected area.

The cipher value of the protected area refers to a value obtained by encrypting data related to the protected area of the protected program 310 according to a specific encryption method.

Which area of the program to be protected 310 is a protected area can be set in various ways as necessary. As a specific example, an area in which data whose contents are not changed when the program to be protected 310 is executed, such as .text, .rdata, or .rsrc, may be set as a protection area.

An encryption method for generating an encryption value of a protection area may be configured in various ways. As a specific example, a hash value for data of the protection area may be generated using a hash function.

FIG. 6 shows the state of the memory 11-5 related to the modulation detection method of the second embodiment according to the present invention, in which the protected program 310 and the modulation detection program 321 are stored in the memory 11-5. Is loaded.

In the second embodiment, the tamper detection program 321 monitors whether the protected program 310 is modulated by using the encryption value 313 of the protected area of the protected program 310.

Referring to FIG. 7, a second embodiment of a modulation detection method of a computer program according to the present invention will be described.

First, the protected program 310 is loaded into the memory 11-5 (S231), and the protected program 310 loaded into the memory 11-5, as shown in FIG. 313).

The modulation detection program 321 then detects whether the protection target module 310 of the memory 11-5 is modulated in accordance with steps S232 to S236.

That is, the modulation detection program 321 reads the protection area data of the protection target program 310 loaded in the memory 11-5 and encrypts the data according to a specific encryption method. At this time, the specific encryption method is the same as the encryption method used when generating the encryption value 313 of the protected area that the protected program 310 has (S232).

The tamper detection program 321 now compares the result of encryption in step S232 with the cipher value 313 of the program to be protected 310 and checks whether they match (S233). If the result of the check in step S233 coincides with each other, it is determined that no modulation has occurred (S234, S235), and if it does not match with each other, it is determined that modulation has occurred (S234, S236).

The modulation detection program 321 of the first and second embodiments may take various measures when it is determined that the program to be protected 310 is modulated.

The modulation detection program 321 transmits various information related to modulation, such as a modulated position, data before modulation, data after modulation, length of modulated data, program information branched by the modulation, and the like to a specific server through the communication network 13. Can transmit

In addition, the modulation detection program 321 forcibly terminates execution of the program to be protected 310 when it is determined that the program to be protected 310 has been modulated, or restores the modulated data of the memory 11-5. You can also restore it.

Meanwhile, the program to be protected 310 may be a program module which a specific application loads into the memory 11-5 during its execution.

For example, the application may be a game client that runs on a user's computer device and performs an online game while communicating with a game server through the communication network 13. Such a game client loads several game modules (DLL, EXE, etc.) into the memory 11-5 as needed during execution.

Referring to FIG. 8, an application 351 running in the memory 11-5, such as a game client, may store various program modules (game modules) stored in the storage medium 11-2 as needed. Load in 5).

At this time, if the program module that the application 351 loads in the memory 11-5 is a protected program (protected module), the protected module includes the original stored code in accordance with the first embodiment, or In connection with the embodiment, it has a password value of a protected area.

Then, the tamper detection program 321 detects whether each protected module is modulated by using original information of each protected module loaded in the memory 11-5 or a cipher value of the protected area.

In this case, the tamper detection program 321 may be provided separately for each program to be protected to perform its role, or may collectively process the tamper detection for each program to be protected.

9 shows an outline of a system for providing an online game service, wherein the game service system 15 is connected to a game client 371 installed in the computer device 11 of each user through a communication network 13 to play an online game. Provide service.

The game service system 15 transmits the game client 371 via the communication network 13, and also keeps the latest version at all times. The game client 371 generally consists of a main program and several game modules.

A user who illegally uses an online game modulates the game client 371 or each game module executed in the computer device 11 to use the game.

Referring to FIG. 10, an example of applying the modulation detection method according to the present invention to an online game service will be described.

First, the game service system 15 selects a protected target module from each game module of the game client 371 (S251), sets an original storage code in each protected target module, or includes a password value of a protected area ( S252).

Then, a game client (main program, each game module, a tamper detection program, etc.) is transmitted to the computer device 11 of each user (S253).

When the game client is executed in the computer device 11 and the game is started (S254), the game client loads the necessary game module into the memory 11-5 according to the progress of the game, and the module to be protected is the memory 11-5. ), Whether or not modulation is detected by the modulation detection program 321 (S255).

That is, in the first embodiment according to the present invention, whether or not the modulation is detected using the original information, and in the second embodiment, whether or not the tampering is detected using the encryption value of the protection area.

If it is determined that the modulation has occurred in the module to be protected (S256), the modulation detection program 321 transmits the information related to the modulation to the game service system 15 (S257).

Then, the game service system 15 may take necessary measures according to the illegal user sanction policy such as terminating the game access of the corresponding user or restricting the use of the game later (S258).

It is to be understood that the present invention is not limited to the above-described embodiment, and various changes and modifications may be made by those skilled in the art without departing from the technical spirit of the present invention. to be.

11: Computer Unit 11-1: Central Processing Unit
11-2: Storage medium 11-3: Input means
11-4: Display Means 11-5: Memory
11-6: Network Interface 13: Network
15: game service system 310: protected program
311: Source code 313: Password value for protected area
321: tamper detection program 331: source information
371: game client

Claims (13)

In the modulation detection method of a computer program running in the memory,
An original storage step of storing information on a predetermined protection area of the computer program loaded in the memory as original information; And
A modulation detection step of detecting whether or not the computer program has been tampered by comparing the original information with information on the protection area of the computer program loaded in the memory periodically by a modulation detection program;
The original storing step is performed by an original storing code set in the computer program to be executed when the computer program is loaded into the memory,
And a protected area of the computer program is an area in which data is stored that does not change its contents when executed. The method of claim 1,
And the original storage code stores the data of the protected area as the original information. The method of claim 1,
And the original storage code encrypts the data of the protected area using an encryption method that can be decrypted and stores the original information as the original information. The method of claim 1,
And the original storage code stores a hash value of the data of the protected area as the original information. The method of claim 1,
And the original information is deleted when the computer program is unloaded from the memory. In the modulation detection method of a computer program running in the memory,
The computer program is configured to have a cipher value in which data of a certain protected area is encrypted according to a specific encryption method,
An encryption step of encrypting data relating to a protected area of the computer program loaded in the memory by a modulation detection program periodically according to the specific encryption method; And
And a tamper detection step for detecting whether the computer program has been tampered with by the tamper detection program by comparing the result value processed in the encryption step with the encryption value of the computer program.
And a protected area of the computer program is an area in which data is stored that does not change its contents when executed. The method according to claim 6,
The specific encryption method is a modulation detection method of a computer program executed in a memory, characterized in that for calculating a hash value using a hash (Hash) function. delete 8. The method according to any one of claims 1 to 7,
And the modulation detection program transmits information related to the modulation to a specific server when the computer program loaded in the memory is modulated. The method of claim 9,
In the memory, characterized in that the information related to the modulation transmitted to the particular server includes at least one of the modulated position, the data before the modulation, the data after the modulation, the length of the modulated data, and the program information branched by the modulation. How to detect tampering with computer programs running. 8. The method according to any one of claims 1 to 7,
The tamper detection program is configured to terminate execution of the computer program or restore the modulated data when the computer program loaded in the memory is modulated. . 8. The method according to any one of claims 1 to 7,
And the computer program comprises a program module which a specific application loads into the memory during its execution. 13. The method of claim 12,
And wherein said application is a game client running on a user's computer device and performing an online game while communicating with a game server via a communication network.

Images