WO2020019485A1

WO2020019485A1 - Simulator identification method, identification device, and computer readable medium

Info

Publication number: WO2020019485A1
Application number: PCT/CN2018/107748
Authority: WO
Inventors: 李骁
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-07-27
Filing date: 2018-09-26
Publication date: 2020-01-30
Also published as: CN109062667A; CN109062667B

Abstract

Disclosed are a simulator identification method, an identification device, and a computer readable medium. The method comprises: obtaining router information of a Wi-Fi hotspot connected to a target terminal, the router information comprising a name and an MAC address of a router; detecting whether the name of the router is the same as that of a router in a preset first blacklist, and whether the MAC address is within an MAC address set in a preset second blacklist; and if the name of the router is the same as that of any router in the first blacklist, and the MAC address is within the MAC address set, determining that the target terminal runs in a simulator environment. Use of the present application facilitates improving the accuracy of simulator identification.

Description

Simulator recognition method, recognition equipment and computer-readable medium

This application claims the priority of a Chinese patent application filed on July 27, 2018 with the Chinese Patent Office, application number 201810855586.8, and application name "A Simulator Identification Method, Identification Device, and Computer-readable Media", its entire content Incorporated by reference in this application.

Technical field

The present application relates to the field of communication technologies, and in particular, to a simulator identification method, an identification device, and a computer-readable medium.

Background technique

The Android emulator is an application that can simulate the operating environment of the Android system on various platforms such as Windows and Linux. Users can run the Android system application on the Android emulator in a terminal such as a personal computer. When using the application of the Android system, for certain services, such as those requiring risk monitoring, it is not desired to be run on the simulator, so it is necessary to identify whether the terminal is running in the Android simulator environment. At present, the risk recognition device has limited recognition ability of the Android simulator, and cannot effectively identify whether the terminal is running in the simulator environment.

Summary of the Invention

The application provides a simulator recognition method, a recognition device and a computer-readable medium, which are helpful to improve the accuracy of the simulator recognition.

In a first aspect, the present application provides a simulator identification method, including:

Acquiring router information of a wireless fidelity Wi-Fi hotspot connected to a target terminal, where the router information includes a router name and a Media Access Control (MAC) address;

Detecting whether the name of the router is the same as the router name in the preset first blacklist, and whether the MAC address is in a set of MAC addresses in the preset second blacklist;

When the name of the router is the same as the name of any router in the first blacklist, and the MAC address is in the MAC address set, it is determined that the target terminal is running in a simulator environment.

In a second aspect, the present application provides an identification device including a unit for performing the method of the first aspect.

In a third aspect, the present application provides another identification device, including a processor, a user interface, a communication interface, and a memory, and the processor, the user interface, the communication interface, and the memory are connected to each other, where the memory is used for storing support A computer program that identifies the device to execute the method, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method of the first aspect.

In a fourth aspect, the present application provides a computer-readable storage medium, where the computer storage medium stores a computer program, the computer program includes program instructions, and the program instructions, when executed by a processor, cause the processor to execute The method of the first aspect described above.

In the embodiment of the present application, by acquiring router information of a Wi-Fi hotspot connected to a terminal, and detecting and analyzing the router information such as the router's name and MAC address, any one of the router's name and a preset blacklist can be detected. When the router name is the same and the MAC address is in a preset MAC address set, it can be determined that the terminal is running in the simulator environment, which helps to improve the accuracy of the simulator recognition.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to explain the technical solution of the embodiment of the present application more clearly, the accompanying drawings used in the description of the embodiment will be described below.

FIG. 1 is a schematic flowchart of a simulator recognition method according to an embodiment of the present application; FIG.

FIG. 2 is a schematic flowchart of another simulator recognition method according to an embodiment of the present application; FIG.

3 is a schematic structural diagram of an identification device according to an embodiment of the present application;

FIG. 4 is a schematic structural diagram of another identification device according to an embodiment of the present application.

detailed description

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

The technical solution of the present application can be applied to an identification device, which can include various terminals, servers, or risk identification products (devices) connected to the terminal, etc., for identifying the behavior of the simulator in the terminal (referred to as " Simulator recognition ") to identify whether the terminal (or an application in the terminal, such as an application embedded in the SDK) is running in the simulator environment, or is called identifying whether the terminal is logged in using the simulator. In this application, the simulator may refer to an Android simulator or another simulator. The terminals involved in this application may be mobile phones, computers, tablets, personal computers, smart watches, etc., and this application is not limited.

Specifically, this application can obtain various device information of the terminal, such as connected Wi-Fi hotspot information, model information, CPU manufacturer information, module configuration information, memory space information, number of installed applications, and stored One or more of the number of files, the network system used, system file abnormal information, running status and other information are used to identify the simulator, thereby improving the accuracy of the simulator recognition. The details are described below.

Please refer to FIG. 1, which is a schematic flowchart of a simulator recognition method provided by an embodiment of the present application. Specifically, as shown in FIG. 1, the simulator recognition method may include the following steps:

101. Obtain router information of a Wi-Fi hotspot connected to a target terminal, where the router information includes a router name and a MAC address.

The target terminal may be any terminal that needs to be identified by the simulator, such as a terminal connected to a risk identification product, or a terminal in a specific risk control scenario, or triggered (such as by a preset button or gesture or preset Other triggering methods) are terminals identified by the simulator, etc., which are not limited in this application. The risk control scenario may include a login scenario, a transaction scenario, an APP discount domain scenario, and so on.

Specifically, when it is necessary to identify a terminal by a simulator, the identification device can obtain router information of the Wi-Fi hotspot connected to the terminal, such as the name of the router and its MAC address, so as to facilitate the calculation based on the name and MAC address of the router. Determine if the terminal is running in a simulator environment.

102. Detect whether the name of the router is the same as the router name in the preset first blacklist, and whether the MAC address is in a set of MAC addresses in the preset second blacklist.

The first blacklist includes one or more router names, and the first or more router names may be connected to a terminal identified as a simulator in the historical data (that is, a terminal identified as running in a simulator environment). The name of the Wi-Fi router; the second blacklist may include one or more MAC address sets and / or one or more MAC addresses, the one or more MAC addresses are identified by the terminal identified as the simulator in the historical data The MAC address of the connected router. The one or more MAC address sets are calculated based on the MAC address of the router connected to the terminal identified as the simulator in the historical data. Optionally, the first blacklist and the second blacklist may be the same (that is, each router name and MAC address set may be configured in a blacklist), or they may be different (that is, configured separately). The MAC address set that detects whether the MAC address is in the preset second blacklist can also be referred to as detecting whether the MAC address is the same as the MAC address in the MAC address set in the preset second blacklist; accordingly, the MAC address is in The MAC address set may mean that the MAC address is the same as any MAC address in the MAC address set.

Optionally, the first blacklist includes names that are counted more frequently among the names of routers connected to the terminals identified as simulators in the historical data, such as the top M with the most counts (M is an integer greater than 0, such as taking 10) names, or names whose number of counts is greater than a preset number threshold (first threshold); the second blacklist includes MAC addresses with more counts in the MAC address of the router connected to the terminal identified as the simulator in the historical data An address or a set of MAC addresses composed of the MAC address, such as the first N (N is an integer greater than 0, such as 50) MAC addresses with the most statistics, or the MAC whose statistics are greater than a preset number threshold (second threshold) Addresses, or a set of MAC addresses determined by these MAC addresses, etc., are not limited in this application. The first threshold value and the second threshold value can be set in advance, and the first threshold value and the second threshold value can be the same, for example, both are set to 80; or they can be different, such as the first threshold value is 80 and the second threshold value. It is 60, and vice versa.

103. When the name of the router is the same as the name of any router in the first blacklist, and the MAC address is in the MAC address set, determine that the target terminal is running in the simulator environment.

Specifically, the identification device may match the name of the router corresponding to the target terminal with the router name in the first blacklist described above, and match the MAC address of the router corresponding to the target terminal with the MAC address in the second blacklist described above. Or MAC address set. When the router name corresponding to the router corresponding to the target terminal is obtained in the first blacklist by matching, and the MAC address set where the MAC address of the router corresponding to the target terminal is located in the second blacklist by matching ( Or match to obtain the MAC address of the router corresponding to the target terminal), it can be identified that the target terminal is running in the simulator environment.

In the embodiment of the present application, the identification device can obtain the router information of the Wi-Fi hotspot connected to the terminal, and detect and analyze the router information such as the router's name and MAC address. After detecting the router's name and preset black When any router in the list has the same name and the MAC address is in a preset MAC address set, it can be determined that the target terminal is running in the simulator environment. The embodiment of the present application can perform simulator recognition according to the router information of the Wi-Fi hotspot connected to the terminal, which helps to improve the accuracy of the simulator recognition.

Please refer to FIG. 2, which is a schematic flowchart of another simulator recognition method provided by an embodiment of the present application. Specifically, as shown in FIG. 2, the simulator recognition method may include the following steps:

201. Obtain router information of a Wi-Fi hotspot connected to a target terminal, where the router information includes a router name and a MAC address.

Specifically, for a description of step 201, refer to the related description of step 101 in the embodiment shown in FIG. 1 above, and details are not described herein.

Optionally, when performing simulator recognition, the identifying device may obtain multiple device information of the target terminal ’s device, for example, the device information may include one or more of the following: router information of the connected Wi-Fi hotspot (including Router name (or Wi-Fi name) such as Wi-Fi Service Set Identifier (SSID), router MAC address (or Wi-Fi MAC address) such as Wi-Fi Basic Service Set Identifier (BSSID) ), Etc.), model (model and / or brand), CPU manufacturer information, Bluetooth information, sensor information, user trace information such as memory space value, network system used, Android status (or called operating status, such as whether In the root state), system file exception information (such as whether there are system files with a preset path and name), the number of installed applications, the number of stored files, the package name of the connected app, the version number of the connected app, and the SDK Version number, operating system type, operating system version, device unique identification code (UDID), whether it has been jailbroken (such as 1 for jailbroken, 0 for jailbroken), latitude and longitude information, network Type, specify whether the app is installed (such as 1 for installed, 0 for not installed), whether Ali trumpet is installed, whether v8 plugin is installed, current timestamp (such as millisecond precision), advertising identifier, Vendor identifier, Device model, host name, number of CPU cores, CPU type, CPU subtype, screen resolution, total storage space, remaining storage space, time zone, language, power, battery status, operator name, country ISO, boot time, keyboard list , Did is erased or tampered with, did is stored in the localfile, whether the GPS switch is turned on (for example, 0 means off, 1 means on), GPS authorization status, dynamic link library list loaded by the APP, etc., for simulator recognition. Specifically, the recognition device may perform simulator recognition by acquiring multiple pieces of device information to improve the reliability of recognition. In addition, the identification device can use part of the obtained device information items for simulator identification according to a preset simulator identification rule, so that illegal elements cannot determine which information is specifically used for simulator identification. It helps prevent illegal elements from tampering with related device information after learning a certain identification rule, which prevents the simulator from being identified in a timely manner, that is, prevents the identification rule from being cracked, which further improves the reliability of simulator recognition.

202. Obtain a flag value of an objective function corresponding to the router information, and determine whether the objective function is hooked according to the flag value.

Optionally, before identifying whether the device is an emulator according to the device information, the identification device can detect whether the function corresponding to the device information has been tampered with, and obtain real device information in a timely manner when tampering is detected, based on the real device information. Perform simulator recognition, thereby improving the accuracy and reliability of simulator recognition. In addition, optionally, this application may use Android underlying source API to collect device information, so that the device information cannot be easily tampered with.

The flag value can be used to mark the state of the objective function. The state can refer to a state that has been tampered with, or can refer to a read-write state, a blocking and non-blocking state, an exit process or program state, and / or a change. The status of the content of the file, etc., so that whether the objective function is hooked can be determined according to the flag value. Specifically, each function has a corresponding flag. The flag is a variable. When a function is tampered, the flag corresponding to the function will change. Therefore, the identification device can determine whether the function is hooked by detecting whether the flag of the function has changed, that is, whether the device information corresponding to the function has been tampered with. The value of the flag may be stored in a memory corresponding to the objective function. In the embodiment of the present application, if the name and MAC address of the router correspond to the same function, the identification device may perform hook detection using the function as the target function; if the name and MAC address of the router correspond to different functions, the device is identified The hook detection function can be performed for the function corresponding to the name of the router and the function corresponding to the MAC address, that is, the function corresponding to the name of the router and the function corresponding to the MAC address can be used as target functions to restore the real device information.

Optionally, when determining whether the objective function is hooked according to the flag value, the recognition device may compare a character at a preset position in the flag value with a preset fixed character; when the comparison obtains the preset position When the character of is different from the fixed character, it is determined that the objective function is hooked. The number of characters of the character at the preset position is the same as the number of characters of the fixed character, so as to facilitate comparison and comparison. That is, the change in the flag may refer to a change in one or more bits of the flag value, and the one or more bits may refer to one or more bits in a preset position of the flag. Therefore, the recognition device can compare one or more bits at the preset position of the obtained flag value with the fixed character when it has not been tampered with. If the one or more bits of the flag value change, that is, one bit of the flag value If one or more bits are different from the fixed character, it indicates that the objective function is hooked, that is, the device information corresponding to the objective function has been tampered with.

For example, for systems with Android versions above 4.4 and below 5.0, some Xposed plugins set a bit at a fixed position of the function's flag value to 1 when a function is hooked; For tampered functions, this bit of the flag value is 0 (the fixed character described above). Therefore, by detecting whether the fixed bit of the flag value of the function is 0, it can be known whether the function is hooked by the Xposed plugin. That is, if the fixed bit of the flag value of the measurement function is not 0, it can indicate that the function is hooked and the function is tampered with.

Optionally, when determining whether the objective function is hooked according to the flag value, the recognition device may also perform a logical operation on the flag value according to a preset logic algorithm to obtain an operation result value; when the operation result value is a positive integer When it is determined, the objective function is hooked. The logic algorithm may be determined according to a preset character string and a jump address when a native function in the system is executed. That is to say, the value processed by the flag can also be compared with a fixed character such as 0 when it has not been tampered with according to a preset logic algorithm. If the value after processing changes, it is not 0, such as a positive value. An integer indicates that the function is hooked.

For example, for systems with Android version 5.0 and above, if the result of a logical algorithm such as the logical expression EntryPointFromJni && AccessFlags & 0x10000000 is equal to a positive integer, the function can be tampered with; if the result of the logical calculation is equal to 0 (that is, a fixed character), Indicates that the function has not been tampered with. The EntryPointFromJni may refer to a jump address when a native function such as a native function is executed, and AccessFlags is the above-mentioned flag.

Further optionally, before determining whether the objective function is hooked according to the flag value, the identification device may determine a system version used by the target terminal target, and then select the target terminal to determine the target based on the flag value according to the system version of the target terminal. Whether the function is hooked to improve the efficiency of hook detection. The correspondence between the system version and the way of hook detection can be set in advance.

203. When it is determined that the objective function is hooked, obtain an objective function pointer corresponding to the objective function from the memory of the objective function.

Among them, the function pointer and the hooked function are stored in different fields in the same block of memory, and there is a mapping relationship between different function pointers and the original function, or a mapping relationship between different function pointers and the storage address of the original function. The target function being hooked may mean that the function corresponding to the name of the router and the MAC address is hooked; or, the function corresponding to the name of the router is hooked and / or the function corresponding to the MAC address is hooked.

Optionally, after the target function is determined to be hooked, the hooked target function may also be restored, so as to determine the real device information corresponding to the target function. Specifically, after determining that a function such as the objective function is hooked, a function pointer corresponding to the objective function can be quickly obtained from its memory, that is, the objective function pointer described above, so as to determine the objective function according to the objective function pointer. Corresponding primitive functions, such as native APIs, are real functions that have not been hooked.

204. Determine the original function corresponding to the target function pointer according to the corresponding relationship between the function pointers and functions stored in advance, and determine the original router information according to the original function.

After the target function pointer in the memory corresponding to the target function is determined, the original function corresponding to the target function pointer can be further determined, that is, the actual Method. Furthermore, the original function can be used to replace the objective function to achieve the reduction of the hooked function. Therefore, the recognition device can determine the real router information corresponding to the target terminal through the original function, so as to perform simulator recognition based on the real router information. Specifically, if the function corresponding to the router name and MAC address is hooked, the real original router name and MAC address can be restored; if the function corresponding to the router name is hooked, the real original router can be restored. If the function corresponding to the MAC address is hooked, the original MAC address can be restored.

It should be understood that the original function pointer stored in the memory will not be tampered with. According to the working principle of the Xposed plugin, before tampering with the target function, the original information of the function will be backed up and stored at a specific address in memory, that is, The address to which the objective function pointer points. Once these backup information has also been tampered with, the Xposed plugin will not work properly. Therefore, the original function obtained at the specific address pointed by the target function pointer must be the correct function, and it cannot be tampered with.

205. Detect whether the name of the router included in the original router information is the same as the name of the router in the preset first blacklist, and whether the MAC address included in the original router information is in the set of MAC addresses in the preset second blacklist. .

206. When the name of the router is the same as the name of any router in the first blacklist, and the MAC address is in the MAC address set, determine that the target terminal is running in an emulator environment.

Specifically, for the description of steps 205-206, refer to the related description of steps 102-103 in the embodiment shown in FIG. 1 above, and details are not described herein.

Optionally, in other embodiments, the identification device may further combine other device information to further identify whether the target terminal is running in the simulator environment. For example, in some embodiments, the identification device may also obtain model information of the target terminal, where the model information includes the model and / or brand of the target terminal; and detecting whether the model information is related to a preset third blacklist The terminal model information is the same, and the third blacklist includes at least one group of terminal model information. Further, when the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the model information is the same as any set of terminal models in the third blacklist. When the information is the same, the identification device can determine that the target terminal is running in the simulator environment. The model information is the same as any set of terminal model information in the third blacklist. When the model information is a model, the model is the same as any terminal model in the third blacklist. When the type information is a brand, the brand is the same as any terminal brand in the third blacklist; when the model information includes the model and brand, the model is the same as any terminal model in the third blacklist, and The brand is the same as any terminal brand on the third blacklist. Optionally, the third blacklist includes one or more sets of terminal model information, and the one or more sets of terminal model information may be model information of a terminal identified as a simulator in historical data, such as counting times The most previous L (L is an integer greater than 0, such as taking 8) sets of model information, or model information whose number of counts is greater than a preset number threshold (third threshold), etc., is not repeated here. In other words, the identification device can perform simulator recognition by combining the router information of the Wi-Fi hotspot connected to the terminal and the model information of the terminal, which further improves the reliability of the simulator recognition.

As another example, in some embodiments, the identification device may also obtain the manufacturer ID of the CPU of the target terminal, and detect whether the manufacturer ID of the CPU is the same as the manufacturer ID in the preset whitelist, and then when the router ’s When the name is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the manufacturer ID of the CPU is different from all the manufacturer IDs in the whitelist, the target terminal is determined Run in the simulator environment. The white list may include the identifications of one or more legal CPU manufacturers. In other words, the identification device can perform simulator recognition by combining the router information of the Wi-Fi hotspot connected to the terminal and the CPU manufacturer information of the terminal to improve the reliability of the simulator recognition.

As another example, in some embodiments, the identification device may also perform simulator identification in combination with router information of the Wi-Fi hotspot connected to the terminal and terminal model information to improve the reliability of the simulator identification, which will not be described here.

As another example, in some embodiments, the identification device may also detect whether the device information of the target terminal meets a preset rule, where the device information of the target terminal meets the preset rule may mean that any one or more of the following rules are met :

1) The target terminal is not configured with a preset module, and the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor;

The preset module is a module that is not configured in the terminal identified as the simulator according to historical data statistics, such as a Bluetooth module, a temperature sensor, and a light sensor. Therefore, if it is recognized that the terminal is not configured with the preset module, it may be an emulator.

2) The memory space value of the target terminal is less than a preset memory threshold;

3) the first number of applications installed by the target terminal is less than a preset first number threshold;

4) the second number of files stored by the target terminal is less than a preset second number threshold;

The first number threshold and the second number threshold can be preset.

5) The network standard used by the target terminal is different from all the network standards in the preset network standard list;

Optionally, the identification device may determine which are the normal network standards in combination with the target area where the target terminal is located, for example, by pre-configuring different areas and their corresponding network standard lists to determine a list of network standards corresponding to the target area, the network The network standard in the standard list is the normal network standard in the target area. If it is detected that the network standard used by the target terminal is not the network standard in its corresponding network standard list, the target terminal may run in the simulator environment because the simulator may tamper with the network standard information.

6) There is a system file with a preset path and name in the system of the target terminal;

If there is an abnormal system file in the target terminal, it may be an emulator. For example, the abnormal system file can include system files with the following paths and names: / dev / qemu_pipe, / dev / socket / qemud, /system/lib/libc_malloc_debug_qemu.so, / sys / qemu_trace, / proc / tty / drivers / goldfish and more.

7) The target terminal is in the root state and so on. If it is detected that the target terminal is in the Android root state, it may be an emulator.

In some embodiments, when the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the device information of the target terminal meets the preset rule, the device is identified It can be determined that the target terminal is running in a simulator environment. In other words, the identification device can combine the router information, module configuration information, memory space information, number of installed applications, number of stored files, network standards used, system file exception information, and operation of the Wi-Fi hotspot connected to the terminal. Status and other information to perform simulator recognition to further improve the reliability of simulator recognition.

For another example, in some embodiments, the identification device may further be based on the router information, model information, CPU manufacturer information, module configuration information, memory space information, number of installed applications, Wi-Fi hotspots connected to the terminal, Any one or more of the number of stored files, used network system, system file abnormal information, running status and other information are used to identify the simulator, and details are not described here.

Optionally, based on the model information of the target terminal, CPU manufacturer information, module configuration information, memory space information, number of installed applications, number of stored files, network system used, system file exception information, and operating status Before any or more of the device information is recognized by the simulator, it can also detect whether the device information used for the simulator recognition has been tampered with. If tampered, the real device information can be restored and then based on the real device Information for simulator identification. For detecting whether the device information has been tampered with and how to restore it, refer to the descriptions of detecting whether the router information has been tampered with and how to restore it in steps 202-204, which are not described here.

Further optionally, if it is determined that the target terminal is running in the simulator environment, the identification device may generate alarm information. For example, the alarm information may include one or more of a risk level, user information, and malicious behavior of the device. The risk level can be determined according to the target risk control scenario of the terminal, and the corresponding relationship between different risk control scenarios and risk levels can be specifically set in advance; or the risk level can be determined according to the application that the terminal target runs, and can be specifically determined in advance. Correspondence between different applications and risk levels can be obtained by setting; or, the risk level can also be determined according to the number of hooked functions of the terminal, and specific correspondences between different numbers of hooks and risk levels can be set in advance; or, It can be determined according to the priority of the tampered device information of the terminal. Specifically, the priority of different device information can be set in advance, and the corresponding relationship between each priority and risk level, etc., is not limited in this application. For example, the risk level can be classified as high-risk, medium-risk, low-risk, or first-, second-, third-, and so on. The user information may include a user identification (UID), a mobile phone number, an ID number (if collected during registration of an application), and the like. The malicious behavior may include tampering with the MAC address, tampering with the CPU manufacturer, tampering with the model and brand of the mobile phone, tampering with the mobile phone number, etc., which can be specifically determined through the aforementioned hook detection.

In addition, optionally, the identification device may also issue an instruction to the target terminal according to the alarm information to control operations on the target terminal (such as an APP client running on the terminal). For example, if the identification device determines that the risk level is low-risk, the identification device may issue an instruction to instruct the client to output a prompt to require the user to enter verification information. The verification method includes, but is not limited to, a short message verification code, a picture verification code, and the like. If the verification fails, no further operation is possible. As another example, if the identification device determines that the risk level is medium risk, the identification device may issue an instruction instructing the client to prohibit the user from requesting access in the target risk control scenario (such as logging in, receiving red envelopes, redeeming coupons, spending, transferring money, etc.) operating. For another example, if the identification device determines that the risk level is high, the identification device may issue an instruction to instruct the client to prohibit the user from requesting all access operations, etc., which are not listed here one by one.

For example, for some mobile games, using the simulator can obtain stronger performance than the mobile phone (actually a game cheating). This application can identify whether the game application is running in the simulator environment through the above-mentioned recognition rules, which can promptly Discover the behavior of the game running in the simulator, which can stop the behavior and prevent the loss of cheating to the user.

As another example, the risk control strategy of a small loan launched by a financial institution is to allow only users in specific areas, such as the user of Beishangguang. Illegal users may use simulators to modify GPS positioning to bypass the risk control strategy and deceive them. loan. Therefore, the present application can identify whether the device is running in the simulator environment through the above recognition rules, and reject the user's loan request after determining that the device is running in the simulator environment. Further, this application can also restore the GPS positioning by using the above-mentioned hook detection method to obtain the user's true positioning information.

For another example, illegal persons set up information such as the phone model, brand, and manufacturer in the simulator to achieve the purpose of one simulator software to simulate multiple different Android phones, thereby creating fake identity to cheat preferential activities, registration rewards, and so on. Through this application, after the information of the mobile phone model, brand, and manufacturer has been tampered with according to the above-mentioned hook detection method, the real mobile phone model, brand, and manufacturer and other information can be restored and the simulator can be identified, so as to identify whether the device operation is timely. When running in the simulator environment, and when it is recognized that it is running in the simulator environment, it can stop the behavior in time and avoid causing losses to legitimate users.

In the embodiment of the present application, the identification device may perform simulator identification by collecting multiple pieces of device information, such as router information of a Wi-Fi hotspot connected to the terminal, so as to improve the accuracy of the simulator identification. Based on the device information to identify whether the terminal is running in the simulator environment, it can identify whether the device information has been tampered with, and restore real device information in a timely manner when tampering is detected, so as to identify the simulator based on the real device information. The accuracy of the simulator recognition is further improved.

The foregoing method embodiments are examples of the simulator identification method of the present application, and the description of each embodiment has its own emphasis. For a part that is not described in detail in an embodiment, reference may be made to related descriptions in other embodiments.

Please refer to FIG. 3, which is a schematic structural diagram of an identification device according to an embodiment of the present application. The recognition device in the embodiment of the present application includes a unit for executing the above-mentioned simulator recognition method. Specifically, the identification device 300 in this embodiment may include: an obtaining unit 301 and an identification unit 302. among them,

The obtaining unit 301 is configured to obtain router information of a wireless fidelity Wi-Fi hotspot connected to a target terminal, where the router information includes a router name and a media access control MAC address;

An identification unit 302, configured to detect whether the name of the router is the same as the router name in the preset first blacklist, and whether the MAC address is in a set of MAC addresses in the preset second blacklist;

The identification unit 302 is further configured to determine that the target terminal is running when the name of the router is the same as the name of any router in the first blacklist, and the MAC address is in the MAC address set. Emulator environment.

Optionally, the obtaining unit 301 is further configured to obtain model information of the target terminal, where the model information includes a model and / or a brand of the target terminal;

The identification unit 302 is further configured to detect whether the model information is the same as the terminal model information in a preset third blacklist, where the third blacklist includes at least one set of terminal model information;

The identifying unit 302 is specifically configured to: when the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the model information is the same as the When the information of any set of terminal models in the third blacklist is the same, it is determined that the target terminal is running in the simulator environment.

Optionally, the obtaining unit 301 is further configured to obtain a manufacturer identifier of a central processing unit CPU of the target terminal;

The identification unit 302 is further configured to detect whether a manufacturer ID of the CPU is the same as a manufacturer ID in a preset white list;

The identification unit 302 is specifically configured to: when the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the manufacturer identifier of the CPU is When all the manufacturer IDs in the white list are different, it is determined that the target terminal is running in an simulator environment.

Optionally, the identification unit 302 is further configured to detect whether the device information of the target terminal meets a preset rule, where the device information of the target terminal satisfies the preset rule includes:

The target terminal is not configured with a preset module, and the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor; and / or,

A memory space value of the target terminal is less than a preset memory threshold; and / or,

The first number of applications installed by the target terminal is less than a preset first number threshold; and / or,

The second number of files stored by the target terminal is less than a preset second number threshold; and / or,

The network standard used by the target terminal is different from all the network standards in the preset network standard list; and / or,

A system file of a preset path and name exists in the system of the target terminal; and / or,

A running state of the target terminal is a root state;

The identifying unit 302 is specifically configured to: when the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the device information of the target terminal satisfies When the preset rule is determined, the target terminal is determined to be running in a simulator environment.

Optionally, the identification device further includes: a hook detection unit 303 and a restoration unit 304;

The obtaining unit 301 is further configured to obtain a flag value of an objective function corresponding to the router information;

a hook detection unit 303, configured to determine whether the objective function is hooked according to the flag value;

The obtaining unit 301 is further configured to obtain an objective function pointer corresponding to the objective function from the memory of the objective function when it is determined that the objective function is hooked;

A restoration unit 304, configured to determine an original function corresponding to the target function pointer according to a corresponding relationship between function pointers and functions stored in advance, and determine original router information according to the original function;

The identifying unit 302 is specifically configured to detect whether the name of the router included in the original router information is the same as the name of the router in the preset first blacklist, and whether the MAC address included in the original router information is in the preset MAC address set in the second blacklist.

Optionally, the hook detection unit 303 is specifically configured to compare a character at a preset position in the flag value with a preset fixed character, and the number of characters of the character at the preset position is the same as that of the character at the preset position. The number of characters of the fixed character is the same; when the character at the preset position is different from the fixed character, it is determined that the objective function is hooked.

Optionally, the hook detection unit 303 is specifically configured to perform a logical operation on the flag value according to a preset logical algorithm to obtain an operation result value, where the logical algorithm is based on a preset character string and the system. The jump address when the native function is executed is determined; when the value of the operation result is a positive integer, it is determined that the target function is hooked.

Specifically, the recognition device may implement some or all steps in the simulator recognition method in the embodiments shown in FIG. 1 to FIG. 2 by using the foregoing units. It should be understood that the embodiments of the present application are device embodiments corresponding to the method embodiments, and the description of the method embodiments is also applicable to the embodiments of the present application.

Please refer to FIG. 4, which is a schematic structural diagram of another identification device according to an embodiment of the present application. The identification device is used to perform the method described above. As shown in FIG. 4, the identification device 400 in this embodiment may include: one or more processors 401 and a memory 402. Optionally, the identification device may further include one or more user interfaces 403, and / or, one or more communication interfaces 404. The processor 401, the user interface 403, the communication interface 404, and the memory 402 may be connected through a bus 405, or may be connected through other methods. FIG. 4 illustrates the examples by using a bus method. The memory 402 is configured to store a computer program. The computer program includes program instructions, and the processor 401 is configured to execute the program instructions stored in the memory 402.

The processor 401 may be used to call the program instructions to perform the following steps: obtaining router information of a wireless fidelity Wi-Fi hotspot connected to a target terminal, the router information including a router name and a media access control MAC address; detecting the Whether the name of the router is the same as the name of the router in the preset first blacklist, and whether the MAC address is in the set of MAC addresses in the preset second blacklist; when the name of the router matches the first blacklist When any router in the list has the same name and the MAC address is in the MAC address set, it is determined that the target terminal is running in an emulator environment.

Optionally, before the processor 401 invokes the program instruction to execute the determination that the target terminal runs in the simulator environment, it is further configured to perform the following steps: obtaining model information of the target terminal, and the model information Including the model and / or brand of the target terminal; detecting whether the model information is the same as the terminal model information in a preset third blacklist, and the third blacklist includes at least one set of terminal model information ;

The processor 401 invokes the program instruction to execute the target when the name of the router is the same as the name of any router in the first blacklist, and the MAC address is in the MAC address set. When the terminal is running in the simulator environment, the following steps are specifically performed: when the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the model When the information is the same as that of any set of terminal models in the third blacklist, it is determined that the target terminal is running in the simulator environment.

Optionally, before the processor 401 invokes the program instructions to execute the determination that the target terminal is running in the simulator environment, the processor 401 is further configured to perform the following steps: obtain a manufacturer identifier of a central processing unit CPU of the target terminal; Detecting whether the manufacturer ID of the CPU is the same as the manufacturer ID in a preset white list;

The processor 401 invokes the program instruction to execute the target when the name of the router is the same as the name of any router in the first blacklist, and the MAC address is in the MAC address set. When the terminal is running in the simulator environment, the following steps are specifically performed: when the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the CPU's When the manufacturer identification is different from all the manufacturer identifications in the white list, it is determined that the target terminal is running in an simulator environment.

Optionally, before the processor 401 invokes the program instruction to execute the determination that the target terminal is running in the simulator environment, the processor 401 is further configured to perform the following steps: detecting whether the device information of the target terminal meets a preset rule, where The device information of the target terminal meeting the preset rule includes: the target terminal is not configured with a preset module, and the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor; and / Or, a memory space value of the target terminal is less than a preset memory threshold; and / or, a first number of applications installed by the target terminal is less than a preset first number threshold; and / or, the target terminal stores The second number of files is less than a preset second number threshold; and / or, the network standard used by the target terminal is different from all the network standards in the preset network standard list; and / or, the target A system file with a preset path and name exists in the terminal system; and / or, the running state of the target terminal is the root state;

The processor 401 invokes the program instruction to execute the target when the name of the router is the same as the name of any router in the first blacklist, and the MAC address is in the MAC address set. The terminal runs in the simulator environment, and specifically performs the following steps: when the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the target terminal ’s When the device information meets the preset rule, it is determined that the target terminal is running in a simulator environment.

Optionally, the processor 401 invokes the program instruction to perform the detection to check whether the name of the router is the same as the router name in the preset first blacklist, and whether the MAC address is in the preset second black Before the set of MAC addresses in the list, it is also used to perform the following steps: obtain the flag value of the target function corresponding to the router information, and determine whether the target function is hooked according to the flag value; when it is determined that the target function is When hooking, the target function pointer corresponding to the target function is obtained from the memory of the target function; the original function corresponding to the target function pointer is determined according to the corresponding relationship between the function pointers and functions stored in advance, and according to the The original function described above determines the original router information;

The processor 401 invokes the program instruction to execute the detection to determine whether the name of the router is the same as the router name in the preset first blacklist, and whether the MAC address is in a MAC in the preset second blacklist. When address collection is performed, the following steps are specifically performed: detecting whether the router name included in the original router information is the same as the router name in the preset first blacklist, and whether the MAC address included in the original router information is in the preset MAC address set in the second blacklist.

Optionally, when the processor 401 invokes the program instruction to execute the determination of whether the objective function is hooked according to the flag value, the processor 401 specifically performs the following steps: the character at a preset position in the flag value and The preset fixed characters are compared, and the number of characters of the character at the preset position is the same as the number of characters of the fixed character; when the comparison obtains that the character at the preset position is different from the fixed character, the determined The objective function is hooked.

Optionally, when the processor 401 invokes the program instruction to execute the determination of whether the objective function is hooked according to the flag value, the processor 401 specifically performs the following steps: performs a logical operation on the flag value according to a preset logic algorithm To obtain an operation result value, wherein the logical algorithm is determined according to a preset character string and a jump address when a native function in the system is executed; when the operation result value is a positive integer, the objective function is determined Was hooked.

The processor 401 may be a central processing unit (CPU), and the processor may also be another general-purpose processor, a digital signal processor (DSP), or an application specific integrated circuit (Application Specific Integrated). Circuit (ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The user interface 403 may include an input device and an output device, the input device may include a touch panel, a microphone, and the like, and the output device may include a display (LCD, etc.), a speaker, and the like.

The communication interface 404 may include a receiver and a transmitter for communicating with other devices.

The memory 402 may include a read-only memory and a random access memory, and provide instructions and data to the processor 401. A part of the memory 402 may further include a non-volatile random access memory. For example, the memory 402 may also store the corresponding relationship between the function pointer and the function described above.

In specific implementation, the processor 401 and the like described in the embodiment of the present application may execute the implementation manners described in the method embodiments shown in FIG. 1 to FIG. 3 described above, and may also execute each of the methods described in FIG. 4 of the embodiment of the present application. The implementation of the unit is not repeated here.

An embodiment of the present application further provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the program described in the corresponding embodiments in FIG. 1 to FIG. 2 can be implemented. Some or all of the steps in the simulator recognition method may also implement the function of the recognition device in the embodiment shown in FIG. 3 or FIG. 4 of the present application, and details are not described herein.

An embodiment of the present application further provides a computer program product containing instructions, which when executed on a computer, causes the computer to execute part or all of the steps in the above method.

The computer-readable storage medium may be an internal storage unit of the identification device according to any one of the foregoing embodiments, such as a hard disk or a memory of the identification device. The computer-readable storage medium may also be an external storage device of the identification device, such as a plug-in hard disk, a Smart Media Card (SMC), and a secure digital (SD) device. ) Cards, flash cards, etc.

In the present application, the term "and / or" is merely an association relationship describing an associated object, which means that there can be three kinds of relationships, for example, A and / or B can mean: A exists alone, and A and B exist simultaneously. There are three cases of B alone. In addition, the character "/" in this article generally indicates that the related objects are an "or" relationship.

In various embodiments of the present application, the size of the sequence numbers of the above processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not deal with the implementation process of the embodiments of the present application. Constitute any limitation.

The above description is only part of the implementation of this application, but the scope of protection of this application is not limited to this. Any person skilled in the art can easily think of various equivalents within the technical scope disclosed in this application. Modifications or replacements, and these modifications or replacements should be covered by the protection scope of this application.

Claims

A simulator identification method, which comprises:

Acquiring router information of a wireless fidelity Wi-Fi hotspot connected to a target terminal, where the router information includes a router name and a media access control MAC address;

Detecting whether the name of the router is the same as the router name in the preset first blacklist, and whether the MAC address is in a set of MAC addresses in the preset second blacklist;

When the name of the router is the same as the name of any router in the first blacklist, and the MAC address is in the MAC address set, it is determined that the target terminal is running in a simulator environment.
The method according to claim 1, wherein before the determining that the target terminal runs in an simulator environment, the method further comprises:

Acquiring model information of the target terminal, where the model information includes a model and / or brand of the target terminal;

Detecting whether the model information is the same as the terminal model information in a preset third blacklist, and the third blacklist includes at least one set of terminal model information;

When the name of the router is the same as the name of any router in the first blacklist, and the MAC address is in the MAC address set, determining that the target terminal is running in a simulator environment includes:

When the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the model information is the same as any group in the third blacklist When the terminal model information is the same, it is determined that the target terminal runs in a simulator environment.
The method according to claim 1, wherein before the determining that the target terminal runs in an simulator environment, the method further comprises:

Acquiring a manufacturer identifier of a central processing unit CPU of the target terminal;

Detecting whether the manufacturer ID of the CPU is the same as the manufacturer ID in a preset white list;

When the name of the router is the same as the name of any router in the first blacklist, and the MAC address is in the MAC address set, determining that the target terminal is running in a simulator environment includes:

When the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the manufacturer identification of the CPU is the same as all manufacturers in the whitelist When the identifiers are different, it is determined that the target terminal is running in a simulator environment.
The method according to claim 1, wherein before the determining that the target terminal runs in an simulator environment, the method further comprises:

Detecting whether the device information of the target terminal satisfies a preset rule, wherein the device information of the target terminal satisfies the preset rule includes:

The target terminal is not configured with a preset module, and the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor; and / or,

A memory space value of the target terminal is less than a preset memory threshold; and / or,

The first number of applications installed by the target terminal is less than a preset first number threshold; and / or,

The second number of files stored by the target terminal is less than a preset second number threshold; and / or,

The network standard used by the target terminal is different from all the network standards in the preset network standard list; and / or,

A system file of a preset path and name exists in the system of the target terminal; and / or,

A running state of the target terminal is a root state;

When the name of the router is the same as the name of any router in the first blacklist, and the MAC address is in the MAC address set, determining that the target terminal is running in a simulator environment includes:

When the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the device information of the target terminal satisfies the preset rule, The target terminal runs in a simulator environment.
The method according to any one of claims 1-4, wherein in the detecting whether the name of the router is the same as a router name in a preset first blacklist, and whether the MAC address is in a preset Before setting the set of MAC addresses in the second blacklist, the method further includes:

Acquiring a flag value of an objective function corresponding to the router information, and determining whether the objective function is hooked according to the flag value;

When it is determined that the objective function is hooked, obtaining an objective function pointer corresponding to the objective function from the memory of the objective function;

Determining the original function corresponding to the target function pointer according to the corresponding relationship between the function pointers and functions stored in advance, and determining the original router information according to the original function;

The detecting whether the name of the router is the same as the router name in the preset first blacklist, and whether the MAC address is in a set of MAC addresses in the preset second blacklist includes:

Detecting whether the name of the router included in the original router information is the same as the name of the router in the preset first blacklist, and whether the MAC address included in the original router information is in a set of MAC addresses in the preset second blacklist .
The method according to claim 5, wherein the determining whether the objective function is hooked according to the flag value comprises:

Comparing a character at a preset position in the flag value with a preset fixed character, and the number of characters of the character at the preset position is the same as the number of characters of the fixed character;

When the character at the preset position is different from the fixed character, it is determined that the objective function is hooked.
The method according to claim 5, wherein the determining whether the objective function is hooked according to the flag value comprises:

Perform logical operation on the flag value according to a preset logical algorithm to obtain an operation result value, wherein the logical algorithm is determined according to a preset string and a jump address when a native function in the system is executed;

When the operation result value is a positive integer, it is determined that the objective function is hooked.
An identification device, comprising: an obtaining unit and an identification unit;

The obtaining unit is configured to obtain router information of a wireless fidelity Wi-Fi hotspot connected to a target terminal, where the router information includes a router name and a media access control MAC address;

The identification unit is configured to detect whether the name of the router is the same as the router name in the preset first blacklist, and whether the MAC address is in a set of MAC addresses in the preset second blacklist;

The identification unit is further configured to determine that the target terminal is running in a simulation when the name of the router is the same as the name of any router in the first blacklist, and the MAC address is in the MAC address set. Device environment.
The identification device according to claim 8, characterized in that:

The obtaining unit is further configured to obtain model information of the target terminal, where the model information includes a model and / or a brand of the target terminal;

The identification unit is further configured to detect whether the model information is the same as the terminal model information in a preset third blacklist, where the third blacklist includes at least one set of terminal model information;

The identifying unit is specifically configured to: when the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the model information is the same as the first When the information of any set of terminal models in the three blacklists is the same, it is determined that the target terminal is running in the simulator environment.
The identification device according to claim 8, characterized in that:

The obtaining unit is further configured to obtain a manufacturer identifier of a central processing unit CPU of the target terminal;

The identification unit is further configured to detect whether a manufacturer ID of the CPU is the same as a manufacturer ID in a preset white list;

The identification unit is specifically configured to: when the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the manufacturer ID of the CPU When all the manufacturer IDs in the whitelist are different, it is determined that the target terminal is running in the simulator environment.
The identification device according to claim 8, characterized in that:

The identification unit is further configured to detect whether device information of the target terminal meets a preset rule, where the device information of the target terminal satisfies the preset rule includes:

The target terminal is not configured with a preset module, and the preset module includes one or more of a Bluetooth module, a temperature sensor, and a light sensor; and / or,

A memory space value of the target terminal is less than a preset memory threshold; and / or,

The first number of applications installed by the target terminal is less than a preset first number threshold; and / or,

The second number of files stored by the target terminal is less than a preset second number threshold; and / or,

The network standard used by the target terminal is different from all the network standards in the preset network standard list; and / or,

A system file of a preset path and name exists in the system of the target terminal; and / or,

A running state of the target terminal is a root state;

The identification unit is specifically configured to: when the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the device information of the target terminal satisfies all requirements When the preset rule is described, it is determined that the target terminal runs in a simulator environment.
The identification device according to any one of claims 8-11, wherein the identification device further comprises: a hook detection unit and a reduction unit;

The acquiring unit is further configured to acquire a flag value of an objective function corresponding to the router information;

The hook detection unit is configured to determine whether the objective function is hooked according to the flag value;

The obtaining unit is further configured to obtain an objective function pointer corresponding to the objective function from the memory of the objective function when it is determined that the objective function is hooked;

The restoration unit is configured to determine an original function corresponding to the target function pointer according to a corresponding relationship between function pointers and functions stored in advance, and determine original router information according to the original function;

The identification unit is specifically configured to detect whether the name of the router included in the original router information is the same as the router name in the preset first blacklist, and whether the MAC address included in the original router information is in the preset first MAC address set in the second blacklist.
The identification device according to claim 12, characterized in that:

The hook detection unit is specifically configured to compare a character at a preset position in the flag value with a preset fixed character, and the number of characters of the character at the preset position and the number of characters of the fixed character The same; when the character at the preset position is different from the fixed character, it is determined that the objective function is hooked.
The identification device according to claim 12, characterized in that:

The hook detection unit is specifically configured to perform a logical operation on the flag value according to a preset logical algorithm to obtain an operation result value, wherein the logical algorithm is executed according to a preset string and a native function in the system. The jump address is determined; when the value of the operation result is a positive integer, it is determined that the objective function is hooked.
An identification device, comprising a processor and a memory, wherein the processor and the memory are connected to each other, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to use When calling the program instruction, the following steps are performed:

Obtaining router information of a wireless fidelity Wi-Fi hotspot connected to a target terminal, the router information including a router name and a media access control MAC address; detecting whether the name of the router matches a router name in a preset first blacklist Are the same, and whether the MAC address is in a preset second blacklist MAC address set; when the name of the router is the same as the name of any router in the first blacklist, and the MAC address is in the When the MAC address set is described, it is determined that the target terminal runs in a simulator environment.
The identification device according to claim 15, wherein before the processor calls the program instruction to execute the determination that the target terminal is running in a simulator environment, the processor is further configured to perform the following step: obtaining the target Terminal model information, the model information including the model and / or brand of the target terminal; detecting whether the model information is the same as the terminal model information in a preset third blacklist, and the third The blacklist includes at least one set of terminal model information;

When the processor calls the program instruction to execute the target terminal when the name of the router is the same as the name of any router in the first blacklist and the MAC address is in the MAC address set When running in the simulator environment, the following steps are specifically performed: when the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the model information When the information of the terminal model is the same as that of any set of terminal models in the third blacklist, it is determined that the target terminal runs in a simulator environment.
The identification device according to claim 15, wherein the processor is further configured to execute the following steps before calling the program instruction to execute the determining that the target terminal is running in an simulator environment:

Acquiring the manufacturer identifier of the central processing unit CPU of the target terminal; detecting whether the manufacturer identifier of the CPU is the same as the manufacturer identifier in a preset white list;

Determining, by the processor, when the name of the router is the same as any router name in the first blacklist when the program instruction is called, and the MAC address is in the MAC address set, determining the When the target terminal is running in the simulator environment, perform the following steps:

When the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the manufacturer identification of the CPU is the same as all manufacturers in the whitelist When the identifiers are different, it is determined that the target terminal is running in a simulator environment.
The identification device according to claim 15, wherein the processor is further configured to execute the following steps before calling the program instruction to execute the determining that the target terminal is running in an simulator environment:

Detecting whether the device information of the target terminal satisfies a preset rule, wherein the device information of the target terminal satisfies the preset rule includes: the target terminal is not configured with a preset module, and the preset module includes Bluetooth One or more of a module, a temperature sensor, and a light sensor; and / or, a memory space value of the target terminal is less than a preset memory threshold; and / or, a first number of applications installed by the target terminal is less than a preset And / or, the second number of files stored by the target terminal is less than a preset second number threshold; and / or, the network standard used by the target terminal and the preset network standard list are All network standards are different; and / or, a system file with a preset path and name exists in the system of the target terminal; and / or, the running state of the target terminal is root;

Determining, by the processor, when the name of the router is the same as any router name in the first blacklist when the program instruction is called, and the MAC address is in the MAC address set, determining the The target terminal runs in the simulator environment and specifically performs the following steps: when the name of the router is the same as the name of any router in the first blacklist, the MAC address is in the MAC address set, and the target terminal When the device information meets the preset rule, it is determined that the target terminal is running in a simulator environment.
The identification device according to any one of claims 15 to 18, wherein the processor invokes the program instruction to execute the detecting whether the name of the router matches a router in a preset first blacklist It is also used to perform the following steps before the same MAC address and whether the MAC address is in the preset MAC address set in the second blacklist:

Obtain a flag value of an objective function corresponding to the router information, and determine whether the objective function is hooked according to the flag value; when it is determined that the objective function is hooked, obtain the objective from the memory of the objective function A target function pointer corresponding to a function; determining an original function corresponding to the target function pointer according to a corresponding relationship between each function pointer and a function stored in advance, and determining original router information according to the original function;

When the processor invokes the program instruction to perform the detection, whether the name of the router is the same as the router name in the preset first blacklist, and whether the MAC address is in the preset second blacklist. When the MAC address is collected, the following steps are specifically performed: detecting whether the router name included in the original router information is the same as the router name in the preset first blacklist, and whether the MAC address included in the original router information is in the preset MAC address set in the second blacklist.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes The method according to any one of 1-7 is required.