KR101252185B1 - method for blocking hack using thread check - Google Patents

Abstract

The present invention relates to a method of blocking a nucleus by inspecting a thread loaded in a game process and detecting an illegally inserted thread.
In the nuclear blocking method according to the present invention, a first step in which a security process reads a PID of a protected process, and the security process reads a thread list address inserted into the protected process using the PID of the protected process. A second step, wherein the secure process reads start addresses of threads inserted into the protected process using the thread list address of the protected process, and the secure process starts the threads of the protected process. A fourth step of searching for the threads of the protected process in the pre-stored allowed thread list by using addresses; and determining that the security process is a nuclear thread among the threads of the protected processes that are not included in the allowed thread list. And a fifth step of blocking execution of the nuclear thread.

Description

Nuclear blocking method using thread check {method for blocking hack using thread check}

The present invention relates to a nuclear blocking method using a thread check, and more particularly, to a method for blocking nuclear by inspecting a thread loaded in a game process and detecting an illegally inserted thread.

The widespread use of high-speed Internet has led to the rapid growth of the online game population and the development of numerous online games. However, the concept and concept of game security is still very weak. Illegal programs in computers are called hacks or hacking programs, and hacks or hacking programs in games are called game hacks. These game hacks refer to programs that manipulate files, memory, etc. of a particular game process.

Game hacks allow gamers to easily win games by manipulating the game's memory to change certain data, such as stats and stamina, increasing the speed or number of blows in martial arts games, or granting macro functions. This is why gamers want to install game hacks for online games. However, the use of game hacks in online games can cause problems such as a balance breakdown among users, a heavy load on the game server, and the like. In other words, if some users play games while benefiting in an abnormal way, the balance with other users is broken, and in serious cases, the overall balance of the online game is broken and the game server is overloaded. Done.

Therefore, game providers have installed a security program along with the game on the gamer client system. When the user executes the game program, the game process is executed and the security process is executed with the game. In addition, if the gamers interrupt the security process while the game is running, the game process is also stopped. That is, the security process is executed together with the game process during the online game, and the executed security process blocks the execution of the game hack.

Generally, a 'program' or a 'file' refers to a command set written in order to execute a computer, and a 'process' refers to a program running in the computer. That is, the game program is executed as a game process on the gamer computer, the security program is executed as the security process, and the security process detects and blocks the game hacks executed on the computer.

Usually, as a method of detecting game nuclei, there is a pattern matching method. It collects unique strings (hack patterns) in hacks, stores them in a database, and detects game hacks using a method where the security process matches hack patterns against processes running on a computer system. Since the game nucleus detection method detects a game nucleus by comparing the same string pattern, there is a problem in that the game nucleus cannot be detected when some of the nucleus patterns are modified.

As another method of detecting a game hack, recently, there is a method of determining a game hack based on the API command by learning a unique combination of API commands mainly used by game hacks. However, this method has a problem in that even a security process that mainly uses API commands similar to game hacks will be falsely detected as game hacks.

An object of the present invention devised to solve the above-mentioned problems of the prior art is to provide a method of blocking a nucleus by detecting and blocking a nuclear thread inserted illegally by checking a thread loaded in a game process in real time.

Nuclear blocking method using a thread check according to an embodiment of the present invention for achieving the above object, in the method that the security process running on the computer system detects and blocks the nucleus,

A first step of the security process reading the PID of the process to be protected;

A second step of the security process reading a thread list address inserted into the protected process using the PID of the protected process;

A third step of the security process reading the starting addresses of the threads inserted into the protected process using the thread list address of the protected process;

A fourth step of the security process searching for the threads of the protected process in the pre-stored allowed thread list using the starting addresses of the threads of the protected process;

And a fifth step in which the security process determines that a thread not included in the allowed thread list among the threads of the protected processes is a nuclear thread, and blocks execution of the nuclear thread.

As described above, according to the present invention, since nuclear threads loaded in the game process can be detected and blocked in real time, there is an advantage of protecting in good faith gamers caused by illegal nuclear use.

1 is a functional block diagram of a computer system including a security process according to the present invention.
2 is a flowchart illustrating a nuclear blocking method using a thread check according to the present invention.

Hereinafter, a nuclear blocking method using a thread check according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

The invention detects game hacks by checking the threads loaded in a process, which first describes the threads in a computer system.

In As the game process, security processes and games nuclear processes are running on your computer, typically the Windows operating system ^(Windows? OS) is offering a number of dynamic link library (DLL) required when the process runs by default, drive under Windows operating systems Running processes (game processes, security processes, game hack processes, etc.) load the dynamic link libraries (DLLs) needed for their execution into the Windows kernel memory.

Dynamic link libraries (DLLs) are executed in units of threads. That is, this thread is the basic minimum unit to run a program, and every program contains at least one thread. For example, 'notepad.exe', one of the executable programs provided by the Windows operating system, consists of one thread, but 'paint', one of the more complicated executable programs, consists of three threads. As such, very complex executables, such as online games, have a larger number of threads.

If the game hack process is executed while the game process is running, the game hack process inserts a thread that performs a nuclear function (hereinafter referred to as a hack thread) into the game process so that the game process runs the hack thread as the game progresses. .

The present invention proposes a method for detecting and blocking a nuclear thread loaded in a game process in real time.

The nuclear screening method according to the present invention is provided in the form of a program. A security program that executes the nuclear blocking method of the present invention creates and executes a security process in a computer system, and the security process includes one or more security threads. Executable code and data of this security process are loaded into memory.

1 is a functional block diagram of a computer system including a security process according to the present invention. The case where the security program is executed while the game program is executed in the computer system and the game hack is executed is described as an example.

When the game program and the security program are launched, the game process 110 and the security process 120 are executed in the Windows operating system (OS), respectively. The game process 110 includes one or more game threads 111 and one or more system threads 112, and the security process 120 includes one or more security threads 121. When the game hack is executed, the game hack process 130 is driven to insert the hack thread 131 into the game process 110. The security thread 121 of the security process 120 according to the present invention detects the nuclear thread 131 inserted into the game process 110 by the game hack. In this embodiment, the security process 120 is intended to protect the game process, but the present invention is not limited thereto and may be applied to prevent any hacking process from changing the function of any execution process. The target process to be protected is called the protected process.

The Windows operating system includes a process management structure 140 and a thread management structure 150. The process management structure 140 stores information about processes running on a computer system under the Windows operating system, and stores address information (thread list address) in which a thread list included in each execution process is stored. The thread management structure 150 stores addresses at which threads included in respective execution processes are stored. That is, the process management structure 140 stores the protected process, that is, the address where the thread list included in the game process 110 is stored, and the thread management structure 150 of the thread list address is included in the game process 110. The starting addresses of the created threads are stored.

2 is a flowchart illustrating a nuclear blocking method using a thread check according to the present invention.

This invention is implemented in a security process. The security process includes at least one security thread to implement the functions according to the invention. That is, the security process may implement the nuclear blocking method according to the present invention as two or more security threads.

First, the security process stores a list of allowed threads required for driving the protected process (S201). This list of allowed threads includes system threads and game threads. This list of allowed threads is preferably secured and stored before the protected process is hacked by the hack.

Next, the security process reads the PID (process ID) of the protected process (S202). Normally, when the security process is executed, the PID information of the protected process can be read.

Next, the security process applies the PID of the protected process to the process management structure to read the thread list address included in the current protected process (S203).

Next, the security process reads the start addresses of the threads of the protected process by applying the thread list address of the protected process to the thread management structure (S204).

Next, the security process selects one thread from the list of threads of the protected process (S205), and reads the selection thread using the start address of the selection thread (S206). In operation S207, the selected thread is read from the list of allowed threads.

As a result of the search in step S207, if the selection thread is included in the allowable thread list (S208), it is determined whether the selection thread is the last thread in the thread list, and if it is not the last thread (S209), the process proceeds to step S205 for the next selection thread. S205 to step S208 are repeated, and if it is the last thread (S209), the process proceeds to step S203 after a predetermined time and repeatedly checks whether a nuclear thread has been inserted into the protected process.

As a result of the search in step S207, if the selection thread is not included in the list of allowed threads (S208), the selection thread is determined to be a nuclear thread and the execution of the nuclear thread is blocked (S210).

The nuclear blocking method according to the present invention as shown in FIG. 2 described above can detect a running nuclear thread and block its execution.

On the other hand, some of the nuclear processes can be terminated immediately after the thread is created. In this way, information about the terminated nuclear thread is also stored in the process information structure. In the present invention, the present invention applies not only to the running thread list address of the process to be protected but also to the terminated thread list address in step S203, to the terminated thread.

110: game process 111: game thread
112: system thread 120: security process
121: Security Thread 130: Game Hack Process
131: nuclear thread 140: process management structure
150: thread management structure

Claims (3)

In a method for detecting and blocking a hack by a security process running on a computer system,
A first step of the security process reading the PID of the process to be protected;
A second step of the security process applying a PID of the protected process to a process management structure to read a thread list address including a running thread and a stopped thread included in the protected process;
A third step of the security process applying the thread list address of the protected process to a thread management structure to read starting addresses of running threads and stopped threads included in the protected process;
A fourth step of the security process searching for a running thread and a stopped thread included in the protected process by using the start addresses of the threads of the protected process in a previously stored allowed thread list;
The security process includes a fifth step of determining that a thread not included in the allowable thread list among the running threads and the stopped threads included in the protected process as a nuclear thread, and blocking execution of the nuclear thread. Nuclear blocking method using a thread check characterized in. delete The method of claim 1, wherein the list of allowed threads includes a game thread and a system thread.

Images