KR20060059759A - Method for preventing from inventing data of memory in a computer application program - Google Patents

Abstract

After hooking the memory data API function during execution of a specific application program on the computer, it is possible to prevent the execution result of the function from affecting the program to be protected by blocking access to the memory data by the hacking program. A method of preventing memory data manipulation of a computer application is disclosed. The method includes (A) hooking a memory data access related API function by a hooking handler during execution of a protected program; (B) when the API function is called by a predetermined program, determining, by the hooking handler, whether the predetermined program is a malicious abnormal memory data access program based on a predetermined comparison condition; And (C) if the predetermined program is a malicious abnormal memory data access program as a result of the determination of step (B), the hooking handler reporting the determination result to a control processor.

Hacking, Hooking, API, Handle, Handler, PID

Description

METHOD FOR PREVENTING FROM INVENTING DATA OF MEMORY IN A COMPUTER APPLICATION PROGRAM}

The following drawings, which are attached in this specification, illustrate the preferred embodiments of the present invention, and together with the detailed description of the present invention which serves to further understand the technical spirit of the present invention, the present invention includes matters described in such drawings. It should not be construed as limited to.

1 is an exemplary view showing the configuration of a general program model according to the prior art.

2 is a system model for explaining a memory data manipulation prevention method of a computer application program according to the present invention.

3 is a flowchart illustrating a method of preventing memory data manipulation of a computer application program according to the present invention.

4 is an operation flowchart showing the operation of the hooking handler according to the present invention.

5 is an operation flowchart showing the operation of the control module according to the present invention.

* Explanation of Codes on Major Parts of Drawings *

100: Program

110: executable

120: system DLL

130: IAT

140, 420: hooking handler

150: control module

200: surveillance system

210: control processing unit

220: hooking processing unit

300: system memory

310: control processing unit recording memory

320: hook handler notification history memory

400: service table

The present invention relates to a security technology of a computer application program, and more particularly, after hooking a memory data-related API function during execution of a specific application program of a computer, the execution result of the function by blocking the memory data access by the hacking program. The present invention relates to a method of preventing manipulation of memory data of a computer application so that the program can be prevented from affecting a program to be protected early.

Recently, as the Internet is combined with the development and dissemination of information and communication networks and PCs, various information providing services and commerce activities that have been processed offline can be processed regardless of time and place in an online manner. Accordingly, as real-time multimedia communication is possible between the system server and the client, various network games using an online network are developed, and computer programs providing virtual reality are rapidly spreading by the Internet network.

The computer program using the Internet is configured to enable dialogue and collaboration as well as the game itself online.

There are also games where two people participate, such as Baduk and Chess, but there are MUD (Multi-user Dungeon or Multi-user Dimension) games that make the best use of the Internet.

Mud games are a mix of role-playing and adventure games that were originally operated only in text mode, but are gradually evolving into services through various media. In addition, the mud game, in addition to the basic rules of the game, the game participant performs his role by performing his or her imagination and ability in a certain virtual environment without a given script, and solves a task by cooperating with other game participants.

However, there are cases where game participants participate in the game by using a method for automatically setting a game progress through an automatic input method using a computer program (for example, automatically generating a keyboard / mouse event using an auto mouse program). have. This will be described in more detail as follows.

1 is a view briefly showing the configuration of a general program model according to the prior art.

As shown here, the model includes a program 100 in a predetermined operating system and a system memory 300 to which the program refers.

The program 100 may include an executable file 110, a system DLL 120 storing an API function performed by the executable file 100 for each predetermined DLL file, and an IAT (Import Address) including an address of the API function. Table (130), each of the separate IAT 130 and system DLL 120 is included for each program.

The system dynamic linking library (DLL) 120 has order information on an API function processed by the executable file 110. Accordingly, the system DLL 120 includes at least one DLL file, and each DLL file includes at least one API function.

When the general program (for example, the game program 100a) 100 configured as described above is executed by the operating system, and a memory access program (for example, a hacking program, etc.) that adversely affects the game is executed, the execution file 110 is executed. Memory-related API functions (e.g., OpenProcess API functions, Read / WriteProcessMemory API functions, etc.) called by the < RTI ID = 0.0 >) are automatically manipulated by the memory access program. That is, a memory access program that adversely affects a game modulates execution values of memory-related API functions supported by an operating system using an API function hooking method or an IAT hooking method.

As such, as the number of users who use an unjust method increases, the game itself does not progress fairly, and thus there is a problem that general users are damaged.

Such damages result in a decrease in the number of users of the game, and as a result, there is a problem that directly affects the game company's sales.

Therefore, computer security companies are researching and proposing various methods to prevent and prevent this early.

The present invention was devised to solve the above problems, and an object of the present invention is to pass over when the API function is called by a hacking program after hooking an API function related to memory data during execution of a specific application program of a computer. By checking the unique number (PID; Process ID), it blocks the memory data access by the hacking program so that the execution result of the function can be prevented from affecting the program to be protected early. The present invention provides a method for preventing memory data manipulation.

Memory data manipulation prevention method of a computer application program according to the present invention for achieving the above object, (A) during the execution of the protection program, the hooking handler hooks a memory data access-related API function; (B) when the API function is called by a predetermined program, determining, by the hooking handler, whether the predetermined program is a malicious abnormal memory data access program based on a predetermined comparison condition; And (C) if the predetermined program is a malicious abnormal memory data access program as a result of the determination of step (B), the hooking handler reporting the determination result to a control processor.

According to the present invention, by hooking the API functions related to memory data access of the application program periodically during execution of a specific application program of the computer, it is possible to prevent the tampering of the memory data of the application program to be protected.

Many specific details are set forth in the following description and in the accompanying drawings, in order to provide a more thorough understanding of the present invention. It will be apparent to those skilled in the art that the present invention may be practiced without these specific details. In addition, detailed description of well-known functions and configurations that may unnecessarily obscure the subject matter of the present invention will be omitted.

The present invention periodically hooks an API function related to memory data access while executing an application program, and then checks a unique number (PID; Process ID) that is received when the API function is called by a hacking program. The program can initially block access to memory data. In addition, the application by the hacking program by checking whether the abnormal API hooking for the running application program at regular intervals, and whether the information used for a predetermined condition and the shared information between the protection module is modified at regular intervals. Memory data manipulation of the program can be prevented in advance.

Hereinafter, with reference to the accompanying drawings will be described a preferred embodiment of the memory data manipulation prevention method of a computer application program according to the present invention.

2 is a program model for explaining a method of preventing memory data manipulation of a computer application program according to the present invention.

As shown here, the model checks / monitors a malicious memory data access program among the activated game programs 100a and the activated programs 100a, 100b,..., 100n that are run under a predetermined operating system. Monitoring system 200 and a system memory 300 referenced by the game program.

The game program 100a protected by the monitoring system 200 is different from the activated programs 100a, 100b,..., 100n shown in FIG. 1 in the following points.

That is, under a predetermined operating system, when the game program 100a protected by the present invention is driven, a) the monitoring system 200 injects the DLL file containing the executable code of the hooking handler 140 into the control module 150. Hooking the memory data access related API function of the system DLL 120, and b) by the monitoring system 200, the API function address in the IAT 130 is overwritten with the address of the hooking handler 140. C) a control module 150 having a code for determining hooking modulation of an API function at a predetermined time interval is added to the game program 100a, and d) a control processor recording memory 310 in the system memory 300. ) And the hook handler notification recording memory 320 are shared.

This will be described below.

The monitoring system 200 may include a control processor 210 that controls the game program 100a when an input access by a malicious memory data access program occurs, and an API function hooking and / or IAT hooking when the game program 100a is driven. It comprises a hooking processing unit 220 to perform.

In this case, when the game program 100a is activated, the hooking processor 220 injects the DLL file including the execution code of the hooking handler 140 into the control module 150. When the injection is performed, the API functions related to memory data access of the corresponding DLL file are hooked, a handler function for the hooked API function is performed, and a function of notifying input / output information of memory data to the control processor 210 is performed. .

The hooking processor 220 may be included in the game program 100a, may exist in the form of a program independent from the game program 100a, or may exist as a DLL file, but all of the above-described unique functions are the same. Do.

On the other hand, the system memory 300 is a hook handler notification recording memory 320 for recording the memory data access monitoring results by the control processor recording memory 310 and the hooking handler 140 for the recording of the control processor 210. ). Here, the control processor 210 records the protected program ID list and the event name for communicating with the control processor 210 in the control processor recording memory 310. If the hooking handler 140 finds a malicious memory data access program, the hooking handler 140 records the program ID, the program name, and the calling API function name in the system memory 300.

Hereinafter, a method of preventing memory data manipulation of a computer application program according to the present invention will be described with reference to FIGS. 3 and 4.

3 is a flowchart illustrating a method of preventing memory data manipulation of a computer application program according to the present invention.

First, when the game program 100a is driven, the hooking processor 220 is executed to acquire memory data access-related API functions (eg, handles) referenced by all programs currently executed and programs subsequently executed. Hook the upper level OpenProcess function, etc. only) (S201). In this case, as the hooking method, any hooking method among the API function hooking method and the IAT hooking method may be used.

In the case of using the IAT hooking method, since the address of the hooking handler 140 is overwritten in the IAT 130 referenced in the API function call, the hooking handler 140 is executed to compare the condition as shown in FIG. 4. In the case of using the king method after the API function, part of the first execution code of the function to be called when the API function is called is changed so that the hooking handler 140 is executed first. It will be performed (S202).

Subsequently, when it is determined that malicious memory data is accessed by the hacking program, the hooking handler 140 notifies the control processor 210 to the control processor 210, and the control processor 210 is currently executing a game program ( 100a) is stopped (S203-S204).

Hereinafter, the step S202 will be described in detail with reference to FIG. 4.

First, during the execution of the hooking handler 140, if a currently activated program calls a memory data access related API function, the hooking handler 140 determines whether the currently activated program that has called the API function is a protected program. It determines (S202a). That is, it is checked whether the currently activated program is the game program 100a.

As a result of the determination in step S202a, if it is not the program to be protected, it is determined whether the program to be accessed through the parameter at the time of the API function call belongs to the game program 100a (for example, the program to be protected) (S202b). . That is, the parameter is a PID (Process ID) and a unique identifier obtained when an application program calls the API function.

As a result of the determination of step 202b, if the window is a program belonging to the game program 100a, it is determined that the malicious abnormal memory data is accessed and reported to the control processor 210 (S202c). This is because the currently activated program is a program that calls a memory data access-related API function, and is a program that affects the memory of the game program 100a instead of the game program 100a.

However, as a result of the determination of step 202b, if the parameter input related window does not belong to the game program 100a, it is determined that the access is normal and the corresponding API function is called (S202d). That is, although the currently activated program calls the memory data access API function, it is not related to the game program 100a and thus is determined to be a normal program.

On the other hand, if the determination result of the step 202a corresponds to the program to be protected (that is, the game program), the corresponding API function is called (S202d).

In the above embodiment, only the hooking of high-level memory data access API functions (eg, OpenProcess function, etc.) in the Windows 9X series is described.

However, other API functions in the Windows 9X family (eg, ReadProcessMemory, WriteProcessMemory, etc.) follow the same method, and all API functions in the Windows NT family (OpenProcess, Read / WriteProcessMemory, etc.) are all in Kernel Mode. The service table 400 is hooked.

Hereinafter, as another embodiment of the embodiment, hooking of the service table will be described.

When the API functions are called, internally the functions provided by the kernel are called again. The service table is a list table of functions provided by the kernel, and the API functions are called by this table. It finds the function address of the kernel to be called and calls it.

In addition, the hooking on the service table means that the hooking handler 420 replaces the function address stored in the table with its own address, and then operates the same as the hooking of the API function. Since the service table function hooking is implemented through a kernel mode driver, it is difficult to implement, but is not easily detected by a hacker, and is more stable than the API function hooking.

On the other hand, the hooking of the memory data access-related API function, because it changes the execution code of the specific API functions of each program area or the relevant function address in the IAT 130 associated with the function, can be easily found and tampered with. .

Therefore, when the game program 100a is executed, the control module 150 performing the operation as shown in FIG. 5 may be inserted into the game program 100a to determine whether the API function hooking is performed. (S205). This determination can be divided into two types: determination of whether an API function hooked by an API function hooked by API function hooking and determination of whether an API function hooked by the memory data access hooked by IAT hooking.

First, in the case of API function hooking, the control module 150 determines whether the first byte of the API function address is a JMP code (S205a). If it is determined that the step 205a is not a JMP code, the control unit 210 reports that the API function has been modulated (S205b).

However, if it is determined that the step 205a is a JMP code, it is determined whether the address of the JMP code points to the code region of the injected DLL (S205c).

If the determination result of the step 205c indicates that the code region of the injected DLL is a normally hooked API function (S205d), and if the determination result of the step 205c does not point, the hooked API function is modified. The determination is made and reported to the control processing unit 210 (S205b).

On the other hand, in the case of IAT hooking, the control module 150 monitors whether the memory address area of the injected DLL has been modified through a comparison routine as follows.

That is, the control module 150 determines whether the address of the input function in the IAT 130 hooked by the hooking processor 220 indicates a code region of the injected DLL containing the execution code of the hooking processor 220. Determine if it is modulated. That is, if the pointed out result indicates the injected DLL code region, it is a normally hooked API function. If not, the hooked API function is determined to be modulated and notified to the control processor 210.

On the other hand, the DLL injected by the API function hooking handler 140 for each program to report the information necessary for the comparison condition as shown in FIG. 4 and the related information according to the memory data access determination result to the control processor 210. And the system memory 300 are shared between the control processor 210.

In order to protect the system memory 300 information, the system memory 300 is divided into two parts. That is, the two portions are the control processing unit recording memory 310 which is a storage area recorded by the control processing unit 210 and the hooking handler notification recording memory 320 which is a storage area where related information according to the memory data access determination result is recorded. Separated by. For example, a list of protected program IDs and an event name for communicating with the control processor 210 are recorded in the storage area 310, and a program ID, a program name, and an API function name are recorded in the storage area 320. .

Subsequently, the control processor 210 checks whether or not the recording information is modulated in the storage area 310 at predetermined time intervals (S206).

That is, when the content of the storage area 310 is changed, the control processor 210 generates or updates a Cyclic Redundancy Code (CRC) value for the storage area 310, and stores the same at a predetermined time. The CRC value of the storage area 310 is compared with the stored CRC value to determine whether the shared information of the system memory 300 is modulated, thereby protecting automatic input by a computer program.

Meanwhile, the shared memory shared by each program may be used without using a shared section of the DLL to be injected.

In the above example, the operation of blocking the malicious application program from accessing a higher level API function related to memory data access by the hooking handler according to the present invention has been described above.

In this case, the lower level API function (eg, Read / WriteProcessMemory function, etc.) is a function that can be used only when there is a handle acquired through the upper level API function (eg, OpenProcess function, etc.). Therefore, if the upper level API function is defended, the memory access blocking function may seem unnecessary, but since the process handle can be arbitrarily generated, the two API functions (ReadProcessMemory function and WriteProcessMemory function) can be called. Thus, additional protection for memory access functions is needed for more robust access blocking.

 The hooking method of the hooking handler for the API function (Read / WriteProcessMemory function) in the Windows 9X series and the Windows NT series is also performed based on the comparison condition of FIG. 4, and thus the detailed description thereof will be omitted.

Although the present invention has been described as a specific preferred embodiment, the present invention is not limited to the above-described embodiments, and the present invention is not limited to the above-described embodiments without departing from the gist of the present invention as claimed in the claims. Anyone with a variety of variations will be possible.

Therefore, according to the present invention, after hooking an API function related to memory data access while executing an application program, a unique number (PID; Process ID) received when the API function is called by a hacking program is checked, Memory data access by the hacking program may be initially blocked.

In addition, the application by the hacking program by checking whether the abnormal API hooking for the running application program at regular intervals, and whether the information used for a predetermined condition and the shared information between the protection module is modified at regular intervals. Memory data manipulation of the program can be prevented in advance.

Claims (20)

(A) hooking a memory data access related API function by a hooking handler during execution of a protection program; (B) when the API function is called by a predetermined program, determining, by the hooking handler, whether the predetermined program is a malicious abnormal memory data access program based on a predetermined comparison condition; And And (C) if the predetermined program is a malicious abnormal memory data access program as a result of the determination in step (B), the hooking handler reporting the determination result to a control processing unit. To prevent memory data tampering The method of claim 1, wherein step (A) comprises: A method of preventing manipulation of memory data in a computer application, using an import address table (IAT) hooking method and / or an API function hooking method. The method of claim 1, wherein step (B) is B-1) determining, by the hooking handler, whether an active program that has called the API function is a protected program; B-2) as a result of the determination in step (B-1), if it is not a protected program, determining whether a program to be accessed through a parameter at the time of calling the API function is a protected program; And B-3) A method of preventing manipulation of memory data of a computer application program comprising determining that the program is protected by malicious abnormal memory data when the determination result of the step (B-2). The method of claim 3, wherein step (B-2), The method of preventing the manipulation of the memory data of the computer application program, characterized in that further comprising the step of calling the native API function, if the protection target program, as a result of the step (B-1). The method of claim 3, wherein the parameter is, PID (Process ID), and is a unique identifier obtained when a computer application calls the API function, memory data manipulation prevention method of a computer application, characterized in that. The method of claim 3, wherein step (B-3), If it is determined that the step (B-2) is not a protected program, the currently activated program calls a memory data access related API function, but is not related to the protected program, and thus calling a native API function. Memory data manipulation prevention method of a computer application, characterized in that it further comprises. The method of claim 1, wherein the method is (D) the control module further comprises the step of monitoring the modulation of the API function hooked in the step (A) at a predetermined time interval, the method of preventing memory data manipulation of a computer application. The method of claim 7, wherein the step (D), (D-1) determining whether the first byte of the hooked API function address is a JMP code; (D-2) determining that the address of the JMP code indicates a code region of the injected DLL when the determination result of the step (D-1) is a JMP code; And (D-3) When the determination result of the step (D-2) indicates the injected DLL code region, it is determined as an unmodulated API function, and as a result of the determination of the step (D-2), the injected DLL And notifying the control processor by determining that the hooked API function has been tampered with if it does not point to a code region. The method of claim 8, wherein the step (D-2), If it is determined that the step (D-1) is not a JMP code, determining that the hooked API function has been modified to report to the control processing unit, characterized in that it further comprises the step of preventing memory data manipulation of the computer application Way. The method of claim 1, wherein the method is (E) a method of preventing memory data manipulation of a computer application program, further comprising the step of inspecting whether or not the recording information of the storage area recorded by the control processing unit is modulated at regular intervals. The method of claim 10, wherein step (E) comprises: (E-1) generating or updating a Cyclic Redundancy Code (CRC) value for the recording information when the storage area recording information is changed; And (E-2) comparing the stored Cyclic Redundancy Code (CRC) value with the Cyclic Redundancy Code (CRC) value of the storage area at a predetermined time interval, and determining that the stored Cyclic Redundancy Code (CRC) value has been modified to stop the protected program. A method of preventing manipulation of memory data of a computer application, characterized in that: (A) hooking a memory data access related API function by a hooking handler during execution of a protection program; (B) when the API function is called by a predetermined program, determining, by the hooking handler, whether the predetermined program is a malicious abnormal memory data access program based on a predetermined comparison condition; And And (C) if the predetermined program is a malicious abnormal memory data access program as a result of the determination in step (B), the hooking handler reporting the determination result to a control processing unit. A computer-readable recording medium having recorded thereon a program for executing a method of preventing memory data manipulation. The method of claim 12, wherein step (A) comprises: A computer-readable recording medium having recorded thereon a program for executing a method of preventing manipulation of memory data of a computer application, wherein the method of hooking an import address table (IAT) and / or an API function hooking method is used. The method of claim 12, wherein step (B) comprises B-1) determining, by the hooking handler, whether an active program that has called the API function is a protected program; B-2) as a result of the determination in step (B-1), if it is not a protected program, determining whether a program to be accessed through a parameter at the time of calling the API function is a protected program; And B-3) If the result of the determination in the step (B-2), in the case of the program to be protected, executing the memory data manipulation prevention method of the computer application, characterized in that it comprises the step of determining the malicious abnormal memory data access. A computer-readable recording medium that contains a program for making a program. The method of claim 14, wherein step (B-2), As a result of the determination in the step (B-1), if the program to be protected, the method comprising the step of calling a native API function to a computer that records a program for executing the memory data manipulation prevention method of a computer application, characterized in that it comprises Readable record carrier. The method of claim 12, wherein the recording medium, (D) a control module for monitoring a program at a predetermined time interval whether the modulation of the API function hooked in the step (A) program for executing a memory data manipulation prevention method of a computer application Recordable computer-readable recording media. The method of claim 16, wherein the step (D), (D-1) determining whether the first byte of the hooked API function address is a JMP code; (D-2) determining that the address of the JMP code indicates a code region of the injected DLL when the determination result of the step (D-1) is a JMP code; And (D-3) When the determination result of the step (D-2) indicates the injected DLL code region, it is determined as an unmodulated API function, and as a result of the determination of the step (D-2), the injected DLL Determining that the hooked API function has been tampered with and notifying the control processor if the code region does not point to a code region, the program having a program for executing a memory data manipulation prevention method of a computer application. Readable record carrier. The method of claim 17, wherein the step (D-2), If it is determined that the step (D-1) is not a JMP code, determining that the hooked API function is modulated and further comprising the step of reporting to the control processing unit, characterized in that the automatic input prevention method by a computer program A computer-readable recording medium having recorded thereon a program for executing the program. The method of claim 12, wherein the recording medium, (E) checking whether or not the recording information of the storage area recorded by the control processing unit is modulated at a predetermined time interval to a computer having recorded thereon a program for executing a method of preventing memory data manipulation of a computer application program. Readable record carrier. 20. The method of claim 19, wherein step (E) comprises (E-1) generating or updating a Cyclic Redundancy Code (CRC) value for the recording information when the storage area recording information is changed; And (E-2) if the stored Cyclic Redundancy Code (CRC) value is different from the Cyclic Redundancy Code (CRC) value of the storage area at regular intervals, determining that the stored Cyclic Redundancy Code (CRC) value is modulated and stopping the protected program. A computer-readable recording medium having recorded thereon a program for executing a method for preventing memory data manipulation of a computer application program.

Images