WO2022237120A1 - 游戏应用的抓帧防御方法及装置、存储介质、计算机设备 - Google Patents

游戏应用的抓帧防御方法及装置、存储介质、计算机设备 Download PDF

Info

Publication number
WO2022237120A1
WO2022237120A1 PCT/CN2021/132545 CN2021132545W WO2022237120A1 WO 2022237120 A1 WO2022237120 A1 WO 2022237120A1 CN 2021132545 W CN2021132545 W CN 2021132545W WO 2022237120 A1 WO2022237120 A1 WO 2022237120A1
Authority
WO
WIPO (PCT)
Prior art keywords
frame capture
preset
detection program
frame
game application
Prior art date
Application number
PCT/CN2021/132545
Other languages
English (en)
French (fr)
Inventor
郑直
Original Assignee
上海完美时空软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 上海完美时空软件有限公司 filed Critical 上海完美时空软件有限公司
Publication of WO2022237120A1 publication Critical patent/WO2022237120A1/zh

Links

Images

Classifications

    • A—HUMAN NECESSITIES
    • A63—SPORTS; GAMES; AMUSEMENTS
    • A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
    • A63F13/00—Video games, i.e. games using an electronically generated display having two or more dimensions
    • A63F13/70—Game security or game management aspects
    • A63F13/77—Game security or game management aspects involving data related to game devices or game servers, e.g. configuration data, software version or amount of memory
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software
    • G06F11/3668—Software testing
    • G06F11/3672—Test management
    • G06F11/368—Test management for test version control, e.g. updating test cases to a new software version

Definitions

  • the present invention relates to the field of computer technology, and in particular to a frame grabbing defense method and device for game applications, a storage medium, and computer equipment.
  • the dynamic picture is actually composed of static pictures one by one. It is a video. Each static picture is called a frame in the video. Frame capture means to capture all the data resources used in drawing a certain frame in the video and save them.
  • the present invention provides a game application frame grab defense method and device, a storage medium, and a computer device, which help to identify and prevent the frame grab behavior of the game application, thereby achieving the purpose of protecting the game.
  • a frame grab defense method for a game application comprising: running the game application in response to a start signal of the game application;
  • the process running information under the frame monitoring directory identifies whether there is a frame-grabbing process for the game application, wherein the frame-grabbing process detection program includes a frame-grabbing software injection detection program, a debugger detection program, an anti-hook injection detection program, and a reverse hook injection detection program.
  • the frame-grabbing process detection program includes a frame-grabbing software injection detection program, a debugger detection program, an anti-hook injection detection program, and a reverse hook injection detection program.
  • At least one of the function injection detection programs when it is recognized that the frame capture process exists, the game application is terminated.
  • a frame grab defense device for a game application, including: a game startup module, configured to run the game application in response to a startup signal of the game application; a frame grab detection module , for starting the frame capture process detection program, identifying whether there is a frame capture process for the game application based on the process running information in the preset frame capture monitoring directory, wherein the frame capture process detection program includes frame capture software injection detection At least one of a program, a debugger detection program, an anti-hook injection detection program, and an anti-function injection detection program; a frame-grabbing defense module, configured to terminate the running of the game application when it is recognized that the frame-grabbing process exists.
  • a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned frame grabbing defense method for game applications are implemented. .
  • a computer device including a storage medium, a processor, and a computer program stored on the memory, and when the processor executes the computer program, the frame-grabbing defense of the above-mentioned game application is realized method steps
  • a computer program product including a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned frame grabbing defense method for game applications are implemented.
  • a frame-grabbing defense method and device after the game application starts running, start the frame-grabbing process detection program at the same time, through the frame-grabbing process
  • the detection program analyzes the process running information in the preset frame capture monitoring directory to identify whether there is frame capture software injection, anti-debugging of the debugger, specific types of hooks, function injection, etc.
  • a frame capture process terminates the running of the game application to prevent the frame capture process from continuing to capture frames for the game application.
  • the embodiment of the present invention starts the frame capture process detection program while the game application is running, based on the process running information in the preset frame capture monitoring directory, various types of frame capture behaviors can be identified, and the game application is terminated in time to realize
  • the defense of game frame capture raises the threshold for cracking game resources and game programs, reduces the possibility of game resources being maliciously stolen, and improves game security.
  • FIG. 1 schematically shows a schematic flowchart of a frame grab defense method for a game application according to an embodiment of the present invention
  • FIG. 2 schematically shows a schematic flowchart of another frame grab defense method for a game application according to an embodiment of the present invention
  • FIG. 3 schematically shows a schematic structural diagram of a frame grabbing defense device for a game application according to an embodiment of the present invention
  • Fig. 4 schematically shows the computer equipment that can realize the frame-grabbing defense method of the game application according to the present invention
  • Fig. 5 schematically shows a block diagram of a computer program product implementing the method according to the invention.
  • a frame grab defense method for game applications according to an embodiment of the present invention, as shown in FIG. 1 , the method may include:
  • Step 101 responding to the start signal of the game application, running the game application
  • Step 102 start the frame capture process detection program, identify whether there is a frame capture process for the game application based on the process running information in the preset frame capture monitoring directory, wherein the frame capture process detection program includes frame capture software injection detection At least one of programs, debugger detection programs, anti-hook injection detection programs, and anti-function injection detection programs;
  • Step 103 when it is recognized that the frame grabbing process exists, terminate the running of the game application.
  • the embodiments of the present invention are mainly applied to client devices running game applications.
  • the clients may be smart electronic devices such as smart phones and tablet computers. Taking smart phones as an example, a player starts a game application on the mobile phone, and after the game application starts running, At the same time, start the pre-compiled frame capture process detection program to analyze the process running information under the preset frame capture monitoring directory.
  • the default frame capture monitoring directory may include the /proc/self/maps directory to identify whether there is a frame capture process running concurrently with the game application, and terminate the game process when the frame capture process is identified to prevent frame capture Process the game to capture frames and enhance the defense against frame capture.
  • the frame capture process detection program may include frame capture software injection detection program, debugger detection program, anti-hook injection detection program, inverse function injection detection program, etc.
  • Each frame capture process detection program can implement different frame capture means of detection.
  • some frame grabbing software realizes the frame grabbing of the game by injecting itself into the game process. This type of frame grabbing software injects a so library file (so library refers to the dynamic link library of linux) into During the game process, you can use the frame capture software injection detection program to detect whether there is injection in some specific so library files.
  • RenderDoc (RenderDoc is a standalone open source graphics debugger that can be used to perform single frame capture and inspection) will inject a file called libVkLayer_GLES_RenderDoc.so file
  • Qualcomm profiler (Snapdragon Profiler is an analysis software that can run on Windows, Mac and Linux platforms, it connects Android devices via USB
  • QualcommProfiler can be used to capture game resources directly through the hardware level, even if Encrypted game resources can also be captured by this software
  • libq3dtools_esx.so will be injected, and some frame capture software realizes frame capture by compiling the debugger, which can be detected by the debugger detection program Whether the debugger has been anti-debugged, in addition, the anti-hook injection detection program can be used to detect whether there is a PLT hook (procedure linkage table hook PLT, Procedure Linkage Table, procedure linkage table) or intercept-lib (lib interceptor) Add a hook to de
  • the identification of different frame capture methods can be realized, so that when it is recognized that the game application has a frame capture risk, the game operation is terminated in time, so as to prevent the frame capture software from continuously capturing frames of the game application, cracking game resources, Game content such as game programs and rendering processes helps to protect the game.
  • step 103 may be: when it is recognized that the frame grabbing process exists, sending an end signal to the game process to terminate the running of the game application.
  • the end signal can specifically be SIGKILL.
  • SIGKILL is a signal sent to a process to cause it to terminate immediately.
  • a SIGKILL signal is sent to the game process to Causes the game application process to terminate.
  • the embodiment of the present invention starts the frame capture process detection program while the game application is running, based on the process running information in the preset frame capture monitoring directory, various types of frame capture behaviors can be identified, and the game application is terminated in time to realize
  • the defense of game frame capture raises the threshold for cracking game resources and game programs, reduces the possibility of game resources being maliciously stolen, and improves game security.
  • step 102 may include:
  • Step 102-1 in the preset frame capture monitoring directory, check whether there is a frame capture file of a preset type by detecting the file name at the end of the line, and determine that the frame capture process exists when detecting the frame capture file .
  • the frame capture software will inject itself into the game process, so you can see a so library file in the game process after injection, for example, RenderDoc will inject a file named libVkLayer_GLES_RenderDoc.so, and Qualcomm profiler A file called libq3dtools_esx.so is injected.
  • What are the so libraries in the current process which can be obtained by reading /proc/self/maps. Read the maps line by line, and check the file name at the end of the line to determine whether the specified so file exists.
  • the frame capture file search function can be called regularly, and the frame capture file search function can be used to search for a specific type of frame capture file in the preset frame capture monitoring directory, such as calling FindHatedLib(), from /proc Search for the so files listed in hated_libs in /self/maps line by line, and exit through SIGKILL if found.
  • step 102 may include:
  • Step 102-2 create an anti-debugging detection process, read the anti-debugging value corresponding to the preset anti-debugging field under the preset frame capture monitoring directory through the anti-debugging process, and when the anti-debugging value is not the preset When the security value is set, it is determined that the frame capture process exists.
  • the solution of step 102-1 is more effective for frame grabbers who can only use official tools, and for those who can modify the RenderDoc source code, they can avoid this detection by modifying the file name of the so library.
  • the debugger debugs an Android process
  • the current process can view the anti-debugging value TracerPid of the debug process by accessing the TracerPid line in /proc/self/status. If no debugger is connected, the TracerPid is 0, so you can check whether TracerPid is Set to 0 to get whether the current process is being debugged.
  • the present invention create the anti-debugging detection process, and read the anti-debugging value TracerPid of the preset anti-debugging field that is the TracerPid row under the default frame capture monitoring directory through the anti-debugging detection process, and in this value
  • it is not a preset safe value (usually 0)
  • step 102-2 may include: creating an anti-debugging detection process, and dividing the anti-debugging detection process into a parent process and a child process through a fork function, wherein the parent process and the child process Mutual heartbeat detection; read the anti-debugging value corresponding to the preset anti-debugging field under the preset frame capture monitoring directory through the parent process and the child process respectively, and read the When the anti-debugging value is not the preset security value, the process is terminated; when it is detected that the heartbeat of any process stops, it is determined that the frame capture process exists.
  • the anti-debugging detection process such as FindTracer() can be divided into two (almost) identical parent processes and child processes through the fork function Fork, and mutual monitoring of TracerPid Value, when the parent process or child process detects that the TracerPid value is not 0, that is, when the debugger is being debugged, the parent process or child process is terminated, and the parent process and the child process have heartbeats with each other. If there is no heartbeat, it means that they are being debugged. Pass SIGKILL exits the game.
  • step 102 when the frame grabbing process detection program includes the anti-hook injection detection program, step 102 may include:
  • Step 102-3 obtain the original address corresponding to the opening function of the preset dynamic link library file, so as to write the original address into the process linkage table; obtain the process linkage table in the memory image under the preset frame capture monitoring directory , and query the table entry where the preset dynamic link library file opening function in the process link table is located, and determine the first address of the preset dynamic link library file opening function in the memory; if the first address is the same as the If the original address is inconsistent, it is determined that the frame capture process exists.
  • the frame capture software can hook the debugging game through PLT hook or intercept-lib to achieve frame capture. Whether it is PLT hook or intercept-lib, use the PLT hook hook for dlopen at the beginning. Therefore, the frame grabbing process can be detected by detecting PLThook.
  • the address (i.e. the first address) and the actual address (i.e. the original address) of the function are opened by analyzing the preset dynamic link library file of the PLT table in the memory. ) comparison to determine whether the default dynamic link library file opening function is applied with PLT hook.
  • the dlopen function opens a specified dynamic link library file in a specified mode, and returns a handle to the calling process.
  • the function prototype of dlsym is void*dlsym(void*handle, const char*symbol). This function is in the ⁇ dlfcn.h> file.
  • Handle is the pointer returned by dlopen after opening the dynamic link library. Symbol is the name of the function to be obtained. , the return value of the function is void*, pointing to the address of the function.
  • dlclose is used to close the dynamic link library of the specified handle. Then the first address of the current so in memory obtained by analyzing /proc/self/maps. Query the PLT table in the memory image of libdefender.so, find the table entry where dlopen is located, and compare the address in the table with the original address. If they are inconsistent, it means that the PLT entry has been modified. At this time, exit through SIGKILL.
  • the anti-function hook injection detection program is difficult to crack unless the RenderDoc is modified so that it no longer uses the PLT hook, but this modification is more difficult.
  • the anti-function hook injection detection program has a high recognition rate for the frame capture process. This method has a significant effect against RenderDoc Effect.
  • step 102 may include:
  • Step 102-4 obtain a preset format file under the preset frame capture monitoring directory, and inquire whether there is a preset frame capture injection function in the preset format file, and if so, determine that the frame capture process exists .
  • GLES Layer is a new feature introduced after Android 10. By registering your own so library, you can get the callback of each function address of GLES when GLES is initialized, and you can insert your own functions into it to play a similar role. Effect on function hooks.
  • RenderDoc can more conveniently obtain various method calls of OpenGL ES without adding hooks by itself.
  • Frame capture software can realize frame capture by injecting GLES Layer, specifically injecting AndroidGLESLayer_Initialize function and AndroidGLESLayer_GetProcAddress function into the injected so library.
  • a preset format file such as a so library file under the default frame capture monitoring directory
  • querying whether there is a preset frame capture injection function in the file for example, by regularly calling FindGLESLayerLib( ), find the so file from /proc/self/maps, use dlsym to check whether it contains the AndroidGLESLayer_Initialize function, AndroidGLESLayer_GetProcAddress function, and exit through SIGKILL if it exists.
  • GLES Layer injection also needs to set enable_gpu_debug_layers to 1 in the settings global. Therefore, you can also identify GLES Layer injection by querying the value of enable_gpu_debug_layers to achieve GLES Layer defense.
  • step 102-4 may include: if the preset frame capture injection function does not exist in any file of the preset format, marking the file of any preset format as already Query files; correspondingly, in step 102-4, "acquiring preset format files under the preset frame capture monitoring directory" may include: obtaining unqueried preset format files under the preset frame capture monitoring directory .
  • so file corresponding to the so file that has been queried, in order to avoid the performance consumption of re-query, if the so file does not contain the above two functions, it will be marked as the queried so file; correspondingly, in /proc/ When obtaining so files in the self/maps directory, skip the so files with the query mark, and only need to find the unchecked so files.
  • the method may include the following steps 201 ⁇ Step 207:
  • step 201 the game application is run in response to a start signal of the game application.
  • step 202 the running device system version of the game application is obtained; if the running device system version is higher than the preset version, then execute step 203, step 204 and step 206, otherwise execute step 203, step 204 and step 205 .
  • step 203 in the preset frame capture monitoring directory, find out whether there is a frame capture file of a preset type by detecting the file name at the end of the line, and determine that the frame capture process exists when detecting the frame capture file .
  • step 204 create an anti-debugging detection process, read the anti-debugging value corresponding to the preset anti-debugging field under the preset frame capture monitoring directory through the anti-debugging process, and when the anti-debugging value is not the preset When the security value is set, it is determined that the frame capture process exists.
  • step 205 obtain the original address corresponding to the opening function of the preset dynamic link library file, so as to write the original address in the process linkage table; obtain the process linkage table in the memory image under the preset frame capture monitoring directory , and query the table entry where the preset dynamic link library file opening function in the process link table is located, and determine the first address of the preset dynamic link library file opening function in the memory; if the first address is the same as the If the original address is inconsistent, it is determined that the frame capture process exists.
  • step 206 obtain a preset format file under the preset frame capture monitoring directory, and inquire whether there is a preset capture frame injection function in the preset format file, and if so, determine that the frame capture process exists .
  • step 207 when it is recognized that the frame grabbing process exists, an end signal is sent to the game process to terminate the running of the game application.
  • the frame capture process detection program can be selectively started according to the system version of the running device of the game application.
  • the system version is Android 10 and above, that is, when the system supports the GLES Layer debugging layer
  • step 203, step 204 and step 206 are executed, and the frame capture software injection detection program, debugger detection program
  • the inverse function injection detection program starts at the same time
  • the system version is below Android 10
  • steps 203, 204, and 205 execute steps 203, 204, and 205
  • the frame capture software injection detection program and debugger detection The program and the anti-hook injection detection program are started simultaneously.
  • step 203, step 204, step 205, and step 206 refer to the corresponding descriptions of steps 102-1 to 102-4 above, and details are not repeated here.
  • an embodiment of the present invention provides a frame capture defense device for game applications, as shown in Figure 3, the device may include:
  • a game starting module configured to run the game application in response to a start signal of the game application
  • the frame capture detection module is used to start the frame capture process detection program, and identify whether there is a frame capture process for the game application based on the process running information under the preset frame capture monitoring directory, wherein the frame capture process detection program includes capture At least one of a frame software injection detection program, a debugger detection program, an anti-hook injection detection program, and an anti-function injection detection program;
  • the frame grabbing defense module is configured to terminate the running of the game application when it is recognized that the frame grabbing process exists.
  • the frame capture detection module can be used to:
  • the preset frame capture monitoring directory check whether there is a frame capture file of a preset type by detecting the file name at the end of the line, and determine that the frame capture process exists when detecting the frame capture file.
  • the frame capture detection module can be used for:
  • the frame capture detection module can also be used for:
  • the frame grabbing detection module can be used to:
  • the frame capture detection module can be used At:
  • the frame capture detection module can also be used for:
  • the preset frame capture injection function does not exist in any of the files in the preset format, mark the file in any preset format as a queried file; and,
  • the frame grabbing defense module may be configured to: send an end signal to the game process to terminate the running of the game application when it is recognized that the frame grabbing process exists.
  • the frame grabbing defense device of the game application may further include:
  • the version obtaining module is used to obtain the running device system version of the game application before the frame capture process detection program is started;
  • the frame capture detection module can be used to: if the operating device system version is higher than the preset version, start the frame capture software injection detection program, the debugger detection program, and the inverse function injection detection program At least one; otherwise, start at least one of the frame capture software injection detection program, the debugger detection program, and the anti-hook injection detection program.
  • the various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof.
  • a microprocessor or a digital signal processor (DSP) can be used in practice to implement some or all functions of some or all of the components in the frame grab defense device for game applications according to embodiments of the present invention .
  • DSP digital signal processor
  • the present invention can also be implemented as programs/instructions (eg, computer programs/instructions and computer program products) of devices or means for performing part or all of the methods described herein.
  • Such programs/instructions for implementing the present invention may be stored on a computer-readable medium, or may exist in the form of one or more signals, such signals may be downloaded from an Internet website, or provided on a carrier signal, or in any form Available in other formats.
  • an embodiment of the present invention also provides a computer-readable medium on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned processes as shown in Figures 1 to 2 are realized.
  • the frame grabbing defense method of the game application shown in FIG. 2 shown in FIG. 2 .
  • Computer-readable media including both permanent and non-permanent, removable and non-removable media, can be implemented by any method or technology for storage of information.
  • Information may be computer readable instructions, data structures, modules of a program, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by computing devices.
  • PRAM phase change memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • RAM random access memory
  • ROM read only memory
  • EEPROM Electrically Er
  • FIG. 4 schematically shows a computer device that can implement the frame grabbing defense method for game applications according to the present invention.
  • the computer device includes a processor 410 and a computer-readable medium in the form of a memory 420 .
  • the memory 420 is one example of a computer readable medium having a storage space 430 for storing a computer program 431 .
  • the computer program/instruction 431 is executed by the processor 410, various steps in the above-described frame grabbing defense method for game applications can be realized.
  • Fig. 5 schematically shows a block diagram of a computer program product implementing the method according to the invention.
  • the computer program product includes a computer program 510.
  • the computer program 510 is executed by a processor such as the processor 410 shown in FIG. various steps.
  • the present invention can be implemented by means of software plus a necessary general-purpose hardware platform, and can also be implemented by hardware after the game application is started and running, and the frame capture process can be started at the same time
  • the detection program through the frame capture process detection program, analyzes the process running information in the preset frame capture monitoring directory to identify whether there is frame capture software injection, anti-debugging of the debugger, specific types of hooks, function injection, etc.
  • the frame capture process and when it is recognized that the frame capture process exists, terminate the running of the game application, so as to prevent the frame capture process from continuously capturing frames for the game application.
  • the embodiment of the present invention starts the frame capture process detection program while the game application is running, based on the process running information in the preset frame capture monitoring directory, various types of frame capture behaviors can be identified, and the game application is terminated in time to realize
  • the defense of game frame capture raises the threshold for cracking game resources and game programs, reduces the possibility of game resources being maliciously stolen, and improves game security.

Landscapes

  • Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Theoretical Computer Science (AREA)
  • Quality & Reliability (AREA)
  • General Business, Economics & Management (AREA)
  • Computer Hardware Design (AREA)
  • Business, Economics & Management (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Debugging And Monitoring (AREA)
  • Stored Programmes (AREA)

Abstract

本发明公开了一种游戏应用的抓帧防御方法及装置、存储介质、计算机设备，该方法包括：响应于所述游戏应用的启动信号，运行所述游戏应用；启动抓帧进程检测程序，基于预设抓帧监控目录下的进程运行信息识别是否存在对所述游戏应用的抓帧进程，其中，所述抓帧进程检测程序包括抓帧软件注入检测程序、调试器检测程序、反钩子注入检测程序、反函数注入检测程序中至少一种；在识别出存在所述抓帧进程时，终止所述游戏应用运行。本发明有助于实现对游戏抓帧的防御，提高了破解游戏资源以及游戏程序的门槛，降低了游戏资源被恶意窃取的可能性，提高了游戏的安全性。

Description

游戏应用的抓帧防御方法及装置、存储介质、计算机设备
交叉引用
本申请要求于2021年5月14日提交、申请号为202110527687.4，发明名称为“游戏应用的抓帧防御方法及装置、存储介质、计算机设备”的中国专利申请的优先权，其全部内容通过引用合并于本申请中。
技术领域
本发明涉及计算机技术领域，尤其是涉及到一种游戏应用的抓帧防御方法及装置、存储介质、计算机设备。
背景技术
玩家在体验游戏时，能够看到游戏中的动态画面，动态画面其实也是由一张一张的静态的画面组成的，一张一张的静态的画面连续播放时看起来就是运动的了，这就是视频，每一张静态的画面在视频里就叫一帧，抓帧的意思就是抓取视频中某一帧画面绘制时用到的所有数据资源并保存下来。
目前，很多不良游戏开发商通过抓帧工具对一些热门游戏进行抓帧，从而对游戏资源、游戏程序、渲染流程等进行破解，利用抓取的图片对游戏场景模型、游戏角色模型等进行模仿、抄袭，以实现仿制其他厂商游戏、恶意制作游戏漫画等不良目的。若能够检测出对游戏应用的抓帧行为，从而阻止对游戏的抓帧行为，将有助于游戏开发商保护其游戏不被抄袭、仿制，提高游戏破解门槛。
发明内容
有鉴于此，本发明提供了一种游戏应用的抓帧防御方法及装置、存储介质、计算机设备，有助于对游戏应用的抓帧行为进行识别以及阻止，从而达到保护游戏的目的。
根据本发明实施例的一个方面，提供了一种游戏应用的抓帧防御方法，包括：响应于所述游戏应用的启动信号，运行所述游戏应用；启动抓帧进程检测程序，基于预设抓帧监控目录下的进程运行信息识别是否存在对所述游戏应用的抓帧进程，其中，所述抓帧进程检测程序包括抓帧软件注入检测程序、调试器检测程序、反钩子注入检测程序、反函数注入检测程序中至少一种；在识别出存在所述抓帧进程时，终止所述游戏应用运行。
根据本发明实施例的另一个方面，提供了一种游戏应用的抓帧防御装置，包括：游戏启动模块，用于响应于所述游戏应用的启动信号，运行所述游戏应用；抓帧检测模块，用于启动抓帧进程检测程序，基于预设抓帧监控目录下的进程运行信息识别是否存在对所述游戏应用的抓帧进程，其中，所述抓帧进程检测程序包括抓帧软件注入检测程序、调试器检测程序、反钩子注入检测程序、反函数注入检测程序中至少一种；抓帧防御模块，用于在识别出存在所述抓帧进程时，终止所述游戏应用运行。
依据本发明实施例的又一个方面，提供了一种存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现上述游戏应用的抓帧防御方法的步骤。。
依据本发明实施例的再一个方面，提供了一种计算机设备，包括存储介质、处理器及存储在存储器上的计算机程序，所述处理器执行所述计算机程序时实现上述游戏应用的抓帧防御方法的步骤
依据本发明实施例的再一个方面，提供了一种计算机程序产品，包括计算机程序，所述计算机程序被处理器执行时实现上述游戏应用的抓帧防御方法的步骤。
本发明的有益效果为：根据本发明一些实施例的一种游戏应用的抓帧防御方法及装置、存储介质、计算机设备，游戏应用启动运行后，同时启动抓帧进程检测程序，通过抓帧进程检测程序对预设抓帧监控目录下的进程运行信息进行分析，以识别是否存在抓帧软件注入、对调试器的反调试、特定类型的钩子、函数注入等方式的抓帧进程，并在识别出存在抓帧进程时，终止游戏应用运行，避免抓帧进程持续对游戏应用进行抓帧。本发明实施例在游戏应用运行的同时启动抓帧进程检测程序，基于预设抓帧监控目录下的进程运行信息可以对多种类型的抓帧行为进行识别，并及时终止游戏应用运行，实现对游戏抓帧的防御，提高了破解游戏资源以及游戏程序的门槛，降低了游戏资源被恶意窃取的可能性，提高了游戏的安全性。
附图说明
通过阅读下文优选实施方式的详细描述，本发明的上述及各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。在附图中：
图1示意性地示出了根据本发明实施例的一种游戏应用的抓帧防御方法的流程示意图；
图2示意性地示出了根据本发明实施例的另一种游戏应用的抓帧防御方法的流程示意图；
图3示意性地示出了根据本发明实施例的一种游戏应用的抓帧防御装置的结构示意图；
图4示意性地示出了可以实现根据本发明的游戏应用的抓帧防御方法的计算机设备；
图5示意性地示出了实现根据本发明的方法的计算机程序产品的框图。
具体实施方式
下面结合附图和具体的实施方式对本发明作进一步的描述。以下描述仅为说明本发明的基本原理而并非对其进行限制。
根据本发明的实施例的一种游戏应用的抓帧防御方法，如图1所示，该方法可包括：
步骤101，响应于所述游戏应用的启动信号，运行所述游戏应用；
步骤102，启动抓帧进程检测程序，基于预设抓帧监控目录下的进程运行信息识别是否存在对所述游戏应用的抓帧进程，其中，所述抓帧进程检测程序包括抓帧软件注入检测程序、调试器检测程序、反钩子注入检测程序、反函数注入检测程序中至少一种；
步骤103，在识别出存在所述抓帧进程时，终止所述游戏应用运行。
本发明实施例主要应用于运行游戏应用的客户端设备中，客户端可以为智能手机、平板电脑等智能电子设备，以智能手机为例，玩家在手机中启动游戏应用，游戏应用开始运行之后，同时启动预先编译好的抓帧进程检测程序通过对预设抓帧监控目录下的进程运行信息进行分析。在一些实施方式中，预设抓帧监控目录可以包括/proc/self/maps目录，识别是否存在抓帧进程与游戏应用同时运行，并在识别出抓帧进程时终止游戏进程，以防止抓帧进程进行游戏抓帧，增强对抓帧的防御。在具体应用场景中，抓帧进程检测程序可以包括抓帧软件注入检测程序、调试器检测程序、反钩子注入检测程序、反函数注入检测程序等，各抓帧进程检测程序可实现对不同抓帧手段的检测。在一些实施方式中，一些抓帧软件是通过将自身注入到游戏进程中实现对游戏的抓帧，这类抓帧软件是将一个so库文件(so库是指linux的动态链接库)注入到游戏进程中，因此可以通过抓帧软件注入检测程序检测一些特定的so库文件是否存在注入，例如RenderDoc(RenderDoc是可用于执行单帧采集并 进行检查的standalone开源图形调试器)会注入一个名为libVkLayer_GLES_RenderDoc.so的文件，而Snapdragon profiler(Snapdragon Profiler是一款可在Windows，Mac和Linux平台上运行的分析软件，它通过USB连接Android设备，SnapdragonProfiler可用于直接通过硬件层面抓取游戏资源，即便是加了密的游戏资源也可以通过该软件抓取出来)会注入一个名为libq3dtools_esx.so的文件，还有一些抓帧软件是通过对调试器的编译实现抓帧，可以通过调试器检测程序检测调试器是否存在被反调试的情况，另外还可以通过反钩子注入检测程序检测是否存在通过PLT hook(过程链接表钩子PLT，Procedure Linkage Table，过程链接表)或者intercept-lib(lib拦截器)对调试游戏加钩子，以及通过反函数注入检测程序检测是否存在特定的函数注入。通过上述抓帧进程检测程序可以实现对不同抓帧方式的识别，从而在识别到游戏应用存在抓帧风险时，及时终止游戏运行，以免抓帧软件持续对游戏应用进行抓帧，破解游戏资源、游戏程序、渲染流程等游戏内容，有助于对游戏的保护。
在本发明一些实施方式中，步骤103可以为：在识别出存在所述抓帧进程时，向游戏进程发送结束信号，以终止所述游戏应用运行。在一些实施方式中，结束信号具体可以为SIGKILL，SIGKILL是发送给一个进程来导致它立即终止的信号，当通过抓帧进程检测程序识别出存在抓帧进程时，向游戏进程发送SIGKILL信号，以使游戏应用进程终止。
通过应用本实施例的技术方案，游戏应用启动运行后，同时启动抓帧进程检测程序，通过抓帧进程检测程序对预设抓帧监控目录下的进程运行信息进行分析，以识别是否存在抓帧软件注入、对调试器的反调试、特定类型的钩子、函数注入等方式的抓帧进程，并在识别出存在抓帧进程时，终止游戏应用运行，避免抓帧进程持续对游戏应用进行抓帧。本发明实施例在游戏应用运行的同时启动抓帧进程检测程序，基于预设抓帧监控目录下的进程运行信息可以对多种类型的抓帧行为进行识别，并及时终止游戏应用运行，实现对游戏抓帧的防御，提高了破解游戏资源以及游戏程序的门槛，降低了游戏资源被恶意窃取的可能性，提高了游戏的安全性。
在本发明一些实施方式中，在所述抓帧进程检测程序包括所述抓帧软件注入检测程序的情况下，步骤102可以包括：
步骤102-1，在所述预设抓帧监控目录下通过检测行尾文件名的方式查找是否存在预设类型的抓帧文件，并在检测所述抓帧文件时确定存在所述抓帧 进程。
在上述实施方式中，抓帧软件要将自身注入到游戏进程中，因此可以在注入后看到一个so库文件在游戏进程中，例如RenderDoc会注入一个名为libVkLayer_GLES_RenderDoc.so的文件，而Snapdragon profiler会注入一个名为libq3dtools_esx.so的文件。当前进程中的so库有哪些，可以通过读取/proc/self/maps获取。按行读取maps，检测行尾的文件名就可以判定指定的so文件是否存在。因此，本发明实施例具体可以通过定时调用抓帧文件查找函数的方式，通过抓帧文件查找函数在预设抓帧监控目录下查找特定类型的抓帧文件，例如调用FindHatedLib()，从/proc/self/maps中按行查找hated_libs中列出的so文件，找到则通过SIGKILL退出。
在本发明一些实施方式中，在所述抓帧进程检测程序包括调试器检测程序的情况下，步骤102可以包括：
步骤102-2，创建反调试检测进程，通过所述反调试进程在所述预设抓帧监控目录下读取预设反调试字段对应的反调试值，并在所述反调试值不为预设安全值时确定存在所述抓帧进程。
在上述实施方式中，步骤102-1这个方案对于仅能使用官方工具的抓帧者比较有效，对于可以修改RenderDoc源码者则可以通过修改so库文件名来规避这个检测。当调试器调试一个安卓进程时，当前进程可通过访问/proc/self/status中的TracerPid行查看调试进程的反调试值TracerPid，如果没有调试器连接，则TracerPid为0，故可以通过查询TracerPid是否为0来获取当前进程是否被调试。因此，在本发明的一些实施方式中，创建反调试检测进程，并通过反调试检测进程读取预设抓帧监控目录下预设反调试字段即TracerPid行的反调试值TracerPid，并在该值不为预设安全值(一般为0)时确定调试器已被调试，例如通过定时调用上述FindTracer()，从/proc/self/maps中查找TracerPid所在行，并比较其值是否为0，如果不为0则通过SIGKILL退出。对于抓帧工具来说，如果没有调试器的加持，虽然也可以通过改RenderDoc的源码慢慢分析游戏的行为，但是会大大降低分析效率，通过分析TracerPid值进行抓帧防御的性价比很高。
在本发明一些实施方式中，步骤102-2可以包括：创建反调试检测进程，并通过分叉函数将所述反调试检测进程分成父进程和子进程，其中，所述父进程和所述子进程互相进行心跳检测；分别通过所述父进程和所述子进程在所述预设抓帧监控目录下读取所述预设反调试字段对应的反调试值，并在任 一进程读取的所述反调试值不为所述预设安全值时结束该进程；当检测到所述任一进程心跳停止时，确定存在所述抓帧进程。
在上述实施方式中，为提高抓帧进程识别效率和可靠性，可以通过分叉函数Fork将反调试检测进程例如FindTracer()分为2个(几乎)完全一样的父进程和子进程，互相监视TracerPid值，父进程或子进程检测到TracerPid值不为0时，即调试器被调试时，结束该父进程或子进程，并且父进程和子进程相互有心跳，如果心跳没有了则表示被调试，通过SIGKILL退出游戏。
在本发明一些实施方式中，在所述抓帧进程检测程序包括所述反钩子注入检测程序的情况下，步骤102可以包括：
步骤102-3，获取预设动态链接库文件打开函数对应的原始地址，以将所述原始地址写入过程链接表中；在所述预设抓帧监控目录下获取内存映像中的过程链接表，并查询所述过程链接表中的所述预设动态链接库文件打开函数所在的表项，确定所述预设动态链接库文件打开函数在内存中的首地址；若所述首地址与所述原始地址不一致，则确定存在所述抓帧进程。
在上述实施方式中，对于不支持GLES Layer的设备，抓帧软件可以通过PLT hook或者intercept-lib对调试游戏加钩子以实现抓帧。无论是PLT hook还是intercept-lib，一开始都要对dlopen使用PLT hook钩子。因此可以通过检测PLThook的方式检测抓帧进程，在本发明的一些实施方式中，通过分析内存中PLT表的预设动态链接库文件打开函数的地址(即首地址)和实际地址(即原始地址)对比来判定预设动态链接库文件打开函数是否被施加了PLT hook。例如，首先通过dlopen/dlsym/dlclose获取dlopen的原始地址，同时也就把dlopen加入到当前so(libdefender.so)的PLT中。在一些实施方式中，dlopen函数以指定模式打开指定的动态连接库文件，并返回一个句柄给调用进程。dlsym的函数原型是void*dlsym(void*handle,const char*symbol)该函数在<dlfcn.h>文件中，handle是由dlopen打开动态链接库后返回的指针，symbol就是要求获取的函数的名称，函数返回值是void*，指向函数的地址。dlclose用于关闭指定句柄的动态链接库。然后通过分析/proc/self/maps获得的当前so在内存中的首地址。在libdefender.so的内存映像中查询PLT表，查找dlopen所在的表项，查看表中的地址和原始地址进行比较，如果不一致，则说明PLT项被修改，此时通过SIGKILL退出。该反函数钩子注入检测程序难于破解，除非修改RenderDoc使其不再使用PLT hook，但是这样改动难度较大，反函数钩子注入检测程序对于抓帧进程的识别率较高，该方法对抗RenderDoc具 有显著效果。
在本发明一些实施方式中，在所述抓帧进程检测程序包括所述反函数注入检测程序，且所述游戏应用的运行设备系统版本高于预设版本的情况下，步骤102可以包括：
步骤102-4，在所述预设抓帧监控目录下获取预设格式文件，并查询所述预设格式文件中是否存在包含预设抓帧注入函数，若存在则确定存在所述抓帧进程。
在上述实施方式中，GLES Layer是安卓10之后引入的新特性，可以通过注册自己的so库，在GLES初始化的时候获得GLES各个函数地址的回调，并可以把自己的函数插入其中，起到类似于函数钩子的效果。对于支持GLES Layer调试层的设备来说，由于设备提供了GLES Layer调试层的支持，使得RenderDoc能够更加方便的获取OpenGL ES的各个方法调用，而不用自行加钩子。抓帧软件可以通过对GLES Layer的注入实现抓帧，具体在注入的so库中注入AndroidGLESLayer_Initialize函数和AndroidGLESLayer_GetProcAddress函数。因此，在本发明的一些实施方式中，通过在预设抓帧监控目录下获取预设格式文件如so库文件，并在文件中查询是否存在预设抓帧注入函数，例如通过定时调用FindGLESLayerLib()，从/proc/self/maps中查找so文件，用dlsym检查是否包含AndroidGLESLayer_Initialize函数、AndroidGLESLayer_GetProcAddress函数，如果存在则通过SIGKILL退出。
另外，使用GLES Layer注入还需要在settings global中设置enable_gpu_debug_layers为1。因此，也可以通过查询enable_gpu_debug_layers值的方式识别GLES Layer注入，实现GLES Layer的防御。
在一些实施方式中，步骤102-4可以包括：若所述任一所述预设格式的文件中不存在所述预设抓帧注入函数，则将所述任一预设格式文件标记为已查询文件；相应地，步骤102-4中“在所述预设抓帧监控目录下获取预设格式文件”可以包括：在所述预设抓帧监控目录下获取未查询过的预设格式文件。
在上述实施方式中，对应已经查询过的so文件，为避免再次查询的性能消耗，如果so文件中不包含上述两种函数，则将其标记为已查询so文件；相应的，在/proc/self/maps目录下获取so文件时，跳过具有已查询标记的so文件，只需查找未检查过的so文件即可。
作为上述实施例具体实施方式的细化和扩展，为了完整说明本实施例 的具体实施过程，提供了另一种游戏应用的抓帧防御方法，如图2所示，该方法可包括如下步骤201～步骤207：
在步骤201中，响应于所述游戏应用的启动信号，运行所述游戏应用。
在步骤202中，获取所述游戏应用的运行设备系统版本；若所述运行设备系统版本高于预设版本，则执行步骤203、步骤204以及步骤206，否则执行步骤203、步骤204以及步骤205。
在步骤203中，在所述预设抓帧监控目录下通过检测行尾文件名的方式查找是否存在预设类型的抓帧文件，并在检测所述抓帧文件时确定存在所述抓帧进程。
在步骤204中，创建反调试检测进程，通过所述反调试进程在所述预设抓帧监控目录下读取预设反调试字段对应的反调试值，并在所述反调试值不为预设安全值时确定存在所述抓帧进程。
在步骤205中，获取预设动态链接库文件打开函数对应的原始地址，以将所述原始地址写入过程链接表中；在所述预设抓帧监控目录下获取内存映像中的过程链接表，并查询所述过程链接表中的所述预设动态链接库文件打开函数所在的表项，确定所述预设动态链接库文件打开函数在内存中的首地址；若所述首地址与所述原始地址不一致，则确定存在所述抓帧进程。
在步骤206中，在所述预设抓帧监控目录下获取预设格式文件，并查询所述预设格式文件中是否存在包含预设抓帧注入函数，若存在则确定存在所述抓帧进程。
在步骤207中，在识别出存在所述抓帧进程时，向游戏进程发送结束信号，以终止所述游戏应用运行。
在上述实施例中，可以根据游戏应用的运行设备系统版本的不同，选择性的启动抓帧进程检测程序。如图2所示，当系统版本为安卓10及以上版本时，即系统支持GLES Layer调试层的情况下，执行步骤203、步骤204以及步骤206，抓帧软件注入检测程序、调试器检测程序、反函数注入检测程序同时启动，而当系统版本为安卓10以下时，即系统不支持GLES Layer调试层的情况下，执行步骤203、步骤204以及步骤205，抓帧软件注入检测程序、调试器检测程序、反钩子注入检测程序同时启动。另外，步骤203、步骤204、步骤205以及步骤206的具体执行方式可参见上文中步骤102-1～步骤102-4的对应描述，在此不再赘述。
通过应用本实施例的技术方案，针对不同系统版本，制定适应于特定 版本的抓帧进程检测方式，有助于提高抓帧进程的识别准确率，防御游戏抓帧行为，提高游戏破解门槛，保护游戏安全性。
作为图1方法的具体实现，本发明实施例提供了一种游戏应用的抓帧防御装置，如图3所示，该装置可包括：
游戏启动模块，用于响应于所述游戏应用的启动信号，运行所述游戏应用；
抓帧检测模块，用于启动抓帧进程检测程序，基于预设抓帧监控目录下的进程运行信息识别是否存在对所述游戏应用的抓帧进程，其中，所述抓帧进程检测程序包括抓帧软件注入检测程序、调试器检测程序、反钩子注入检测程序、反函数注入检测程序中至少一种；
抓帧防御模块，用于在识别出存在所述抓帧进程时，终止所述游戏应用运行。
在一些实施方式中，在所述抓帧进程检测程序包括所述抓帧软件注入检测程序的情况下，所述抓帧检测模块可用于：
在所述预设抓帧监控目录下通过检测行尾文件名的方式查找是否存在预设类型的抓帧文件，并在检测所述抓帧文件时确定存在所述抓帧进程。
在一些实施方式中，在所述抓帧进程检测程序包括调试器检测程序的情况下，所述抓帧检测模块可用于：
创建反调试检测进程，通过所述反调试进程在所述预设抓帧监控目录下读取预设反调试字段对应的反调试值，并在所述反调试值不为预设安全值时确定存在所述抓帧进程。
在一些实施方式中，所述抓帧检测模块还可用于：
创建反调试检测进程，并通过分叉函数将所述反调试检测进程分成父进程和子进程，其中，所述父进程和所述子进程互相进行心跳检测；分别通过所述父进程和所述子进程在所述预设抓帧监控目录下读取所述预设反调试字段对应的反调试值，并在任一进程读取的所述反调试值不为所述预设安全值时结束该进程；当检测到所述任一进程心跳停止时，确定存在所述抓帧进程。
在一些实施方式中，在所述抓帧进程检测程序包括所述反钩子注入检测程序的情况下，所述抓帧检测模块可用于：
获取预设动态链接库文件打开函数对应的原始地址，以将所述原始地址写入过程链接表中；在所述预设抓帧监控目录下获取内存映像中的过程链接表，并查询所述过程链接表中的所述预设动态链接库文件打开函数所在的表 项，确定所述预设动态链接库文件打开函数在内存中的首地址；若所述首地址与所述原始地址不一致，则确定存在所述抓帧进程。
在一些实施方式中，在所述抓帧进程检测程序包括所述反函数注入检测程序，且所述游戏应用的运行设备设备系统版本高于预设版本的情况下，所述抓帧检测模块可用于：
在所述预设抓帧监控目录下获取预设格式文件，并查询所述预设格式文件中是否存在包含预设抓帧注入函数，若存在则确定存在所述抓帧进程。
在一些实施方式中，所述抓帧检测模块还可用于：
若所述任一所述预设格式的文件中不存在所述预设抓帧注入函数，则将所述任一预设格式文件标记为已查询文件；以及，
在所述预设抓帧监控目录下获取未查询过的预设格式文件。
在一些实施方式中，所述抓帧防御模块可用于：在识别出存在所述抓帧进程时，向游戏进程发送结束信号，以终止所述游戏应用运行。
在一些实施方式中，所述游戏应用的抓帧防御装置还可包括：
版本获取模块，用于所述启动抓帧进程检测程序之前，获取所述游戏应用的运行设备系统版本；
所述抓帧检测模块，可用于：若所述运行设备系统版本高于预设版本，则启动所述抓帧软件注入检测程序、所述调试器检测程序、以及所述反函数注入检测程序中至少一个；否则，启动所述抓帧软件注入检测程序、所述调试器检测程序、以及所述反钩子注入检测程序中至少一个。
需要说明的是，根据本发明实施例的一种游戏应用的抓帧防御装置所涉及各功能单元的其他相应描述，可以参考图1至图2方法中的对应描述，在此不再赘述。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的游戏应用的抓帧防御装置中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置的程序/指令(例如，计算机程序/指令和计算机程序产品)。这样的实现本发明的程序/指令可以存储在计算机可读介质上，或者可以一个或者多个信号的形式存在，这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
基于上述如图1至图2所示方法，相应的，本发明实施例还提供了一种计算机可读介质，其上存储有计算机程序，该计算机程序被处理器执行时实现上述如图1至图2所示的游戏应用的抓帧防御方法。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带、磁盘存储、量子存储器、基于石墨烯的存储介质或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。
图4示意性地示出了可以实现根据本发明的游戏应用的抓帧防御方法的计算机设备，该计算机设备包括处理器410和以存储器420形式的计算机可读介质。存储器420是计算机可读介质的一个示例，其具有用于存储计算机程序431的存储空间430。当所述计算机程序/指令431由处理器410执行时，可实现上文所描述的游戏应用的抓帧防御方法中的各个步骤。
图5示意性地示出了实现根据本发明的方法的计算机程序产品的框图。所述计算机程序产品包括计算机程序510，当所述计算机程序510被诸如图4所示的处理器410之类的处理器执行时，可实现上文所描述的游戏应用的抓帧防御方法中的各个步骤。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到本发明可以借助软件加必要的通用硬件平台的方式来实现，也可以通过硬件实现游戏应用启动运行后，同时启动抓帧进程检测程序，通过抓帧进程检测程序对预设抓帧监控目录下的进程运行信息进行分析，以识别是否存在抓帧软件注入、对调试器的反调试、特定类型的钩子、函数注入等方式的抓帧进程，并在识别出存在抓帧进程时，终止游戏应用运行，避免抓帧进程持续对游戏应用进行抓帧。本发明实施例在游戏应用运行的同时启动抓帧进程检测程序，基于预设抓帧监控目录下的进程运行信息可以对多种类型的抓帧行为进行识别，并及时终止游戏应用运行，实现对游戏抓帧的防御，提高了破解游戏资源以及游戏程序的门槛，降低了游戏资源被恶意窃取的可能性，提高了游戏的安全性。
上文对本说明书特定实施例进行了描述，其与其它实施例一并涵盖于所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定遵循示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可行的或者有利的。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
应可理解，以上所述实施例仅为举例说明本发明之目的而并非对本发明进行限制。在不脱离本发明基本精神及特性的前提下，本领域技术人员还可以通过其他方式来实施本发明。本发明的范围当以后附的权利要求为准，凡在本说明书一个或多个实施例的精神和原则之内所做的任何修改、等同替换、改进等，皆应涵盖其中。

Claims (13)

  1. 一种游戏应用的抓帧防御方法，包括：
    响应于所述游戏应用的启动信号，运行所述游戏应用；
    启动抓帧进程检测程序，基于预设抓帧监控目录下的进程运行信息识别是否存在对所述游戏应用的抓帧进程，所述抓帧进程检测程序包括抓帧软件注入检测程序、调试器检测程序、反钩子注入检测程序、反函数注入检测程序中至少一种；
    在识别出存在所述抓帧进程时，终止所述游戏应用运行。
  2. 根据权利要求1所述的方法，其中，在所述抓帧进程检测程序包括所述抓帧软件注入检测程序的情况下，所述启动抓帧进程检测程序，基于预设抓帧监控目录下的进程运行信息识别是否存在对所述游戏应用的抓帧进程，具体包括：
    在所述预设抓帧监控目录下通过检测行尾文件名的方式查找是否存在预设类型的抓帧文件，并在检测所述抓帧文件时确定存在所述抓帧进程。
  3. 根据权利要求1所述的方法，其中，在所述抓帧进程检测程序包括调试器检测程序的情况下，所述启动抓帧进程检测程序，基于预设抓帧监控目录下的进程运行信息识别是否存在对所述游戏应用的抓帧进程，具体包括：
    创建反调试检测进程，通过所述反调试进程在所述预设抓帧监控目录下读取预设反调试字段对应的反调试值，并在所述反调试值不为预设安全值时确定存在所述抓帧进程。
  4. 根据权利要求3所述的方法，其中，所述创建反调试检测进程，通过所述反调试进程在所述预设抓帧监控目录下读取预设反调试字段对应的反调试值，并在所述反调试值不为预设安全值时确定存在所述抓帧进程，具体包括：
    创建反调试检测进程，并通过分叉函数将所述反调试检测进程分成父进程和子进程，所述父进程和所述子进程互相进行心跳检测；
    分别通过所述父进程和所述子进程在所述预设抓帧监控目录下读取所述预设反调试字段对应的反调试值，并在任一进程读取的所述反调试值不为所述预设安全值时结束该进程；
    当检测到所述任一进程心跳停止时，确定存在所述抓帧进程。
  5. 根据权利要求1所述的方法，其中，在所述抓帧进程检测程序包括所述反钩子注入检测程序的情况下，所述启动抓帧进程检测程序，基于预设抓帧监控目录下的进程运行信息识别是否存在对所述游戏应用的抓帧进程，具体包括：
    获取预设动态链接库文件打开函数对应的原始地址，以将所述原始地址写入过程链接表中；
    在所述预设抓帧监控目录下获取内存映像中的过程链接表，并查询所述过程链接表中的所述预设动态链接库文件打开函数所在的表项，确定所述预设动态链接库文件打开函数在内存中的首地址；
    若所述首地址与所述原始地址不一致，则确定存在所述抓帧进程。
  6. 根据权利要求1所述的方法，其中，在所述抓帧进程检测程序包括所述反函数注入检测程序，且所述游戏应用的运行设备系统版本高于预设版本的情况下，所述启动抓帧进程检测程序，基于所述预设抓帧监控目录下的进程运行信息识别是否存在对所述游戏应用的抓帧进程，具体包括：
    在所述预设抓帧监控目录下获取预设格式文件，并查询所述预设格式文件中是否存在包含预设抓帧注入函数，若存在则确定存在所述抓帧进程。
  7. 根据权利要求6所述的方法，其中，所述查询所述预设格式文件中是否存在包含预设抓帧注入函数之后，所述方法还包括：
    若所述任一所述预设格式的文件中不存在所述预设抓帧注入函数，则将所述任一预设格式文件标记为已查询文件；
    相应地，所述在所述预设抓帧监控目录下获取预设格式文件，具体包括：
    在所述预设抓帧监控目录下获取未查询过的预设格式文件。
  8. 根据权利要求1所述的方法，其中，所述在识别出存在所述抓帧进程时，终止所述游戏应用运行，具体包括：
    在识别出存在所述抓帧进程时，向游戏进程发送结束信号，以终止所述游戏应用运行。
  9. 根据权利要求1所述的方法，其中，所述启动抓帧进程检测程序之前，所述方法还包括：
    获取所述游戏应用的运行设备系统版本；
    相应地，所述启动抓帧进程检测程序，具体包括：
    若所述运行设备系统版本高于预设版本，则启动所述抓帧软件注入检测程序、所述调试器检测程序、以及所述反函数注入检测程序中至少一个；
    否则，启动所述抓帧软件注入检测程序、所述调试器检测程序、以及所述反钩子注入检测程序中至少一个。
  10. 一种游戏应用的抓帧防御装置，包括：
    游戏启动模块，用于响应于所述游戏应用的启动信号，运行所述游戏应用；
    抓帧检测模块，用于启动抓帧进程检测程序，基于预设抓帧监控目录下的进程运行信息识别是否存在对所述游戏应用的抓帧进程，所述抓帧进程检测程序包括抓帧软件注入检测程序、调试器检测程序、反钩子注入检测程序、反函数注入检测程序中至少一种；
    抓帧防御模块，用于在识别出存在所述抓帧进程时，终止所述游戏应用运行。
  11. 一种存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现根据权利要求1至9中任一项所述的游戏应用的抓帧防御方法的步骤。
  12. 一种计算机设备，包括存储介质、处理器及存储在存储器上的计算机程序，所述处理器执行所述计算机程序时实现根据权利要求1-9中任一项所述的游戏应用的抓帧防御方法的步骤。
  13. 一种计算机程序产品，包括计算机程序，所述计算机程序被处理器执行时实现根据权利要求1-9中任一项所述的游戏应用的抓帧防御方法的步骤。
PCT/CN2021/132545 2021-05-14 2021-11-23 游戏应用的抓帧防御方法及装置、存储介质、计算机设备 WO2022237120A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110527687.4A CN113209630B (zh) 2021-05-14 2021-05-14 游戏应用的抓帧防御方法及装置、存储介质、计算机设备
CN202110527687.4 2021-05-14

Publications (1)

Publication Number Publication Date
WO2022237120A1 true WO2022237120A1 (zh) 2022-11-17

Family

ID=77091925

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/132545 WO2022237120A1 (zh) 2021-05-14 2021-11-23 游戏应用的抓帧防御方法及装置、存储介质、计算机设备

Country Status (2)

Country Link
CN (1) CN113209630B (zh)
WO (1) WO2022237120A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113209630B (zh) * 2021-05-14 2022-09-30 上海完美时空软件有限公司 游戏应用的抓帧防御方法及装置、存储介质、计算机设备
CN114595020B (zh) * 2022-02-25 2023-12-19 深圳盛显科技有限公司 基于钩子技术的分屏显示方法、装置、系统及存储介质

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080004107A1 (en) * 2006-07-03 2008-01-03 Igt Detecting and preventing bots and cheating in online gaming
CN106778104A (zh) * 2017-01-20 2017-05-31 武汉斗鱼网络科技有限公司 一种应用程序的反调试方法和系统
CN107742077A (zh) * 2017-10-09 2018-02-27 武汉斗鱼网络科技有限公司 一种在游戏直播中防止信息泄露的方法及装置
US20180264342A1 (en) * 2012-02-23 2018-09-20 Playsight Interactive Ltd. Smart-court system and method for providing real-time debriefing and training services of sport games
CN110321703A (zh) * 2019-07-02 2019-10-11 北京智游网安科技有限公司 一种检测应用程序非法入侵的方法、存储介质及终端设备
US20200114265A1 (en) * 2018-10-16 2020-04-16 Kakao Games Corp. Method for detecting abnormal game play
CN113209630A (zh) * 2021-05-14 2021-08-06 上海完美时空软件有限公司 游戏应用的抓帧防御方法及装置、存储介质、计算机设备

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100347960B1 (ko) * 1999-09-14 2002-08-09 김운용 비디오 게임장치 및 그 제어방법
US10388053B1 (en) * 2015-03-27 2019-08-20 Electronic Arts Inc. System for seamless animation transition
CN105561580A (zh) * 2015-12-24 2016-05-11 北京奇虎科技有限公司 一种基于游戏平台的网络防护方法及装置
CN106096391B (zh) * 2016-06-02 2019-05-03 珠海豹趣科技有限公司 一种进程控制方法及用户终端
CN106126423B (zh) * 2016-06-27 2018-10-19 华为技术有限公司 游戏应用程序的测试方法、装置及系统
CN106294166B (zh) * 2016-08-16 2018-07-06 腾讯科技（深圳）有限公司 一种游戏数据监控方法和装置
CN107133503A (zh) * 2017-04-26 2017-09-05 北京洋浦伟业科技发展有限公司 一种基于进程状态检测的反调试方法和装置
CN107169324A (zh) * 2017-05-12 2017-09-15 北京理工大学 一种基于动态加解密的Android应用加固方法
CN109582463B (zh) * 2018-11-30 2021-04-06 Oppo广东移动通信有限公司 资源配置方法、装置、终端及存储介质
CN109862433A (zh) * 2019-03-27 2019-06-07 努比亚技术有限公司 游戏视频的生成方法、装置、终端及计算机可读存储介质
CN112199642B (zh) * 2019-07-08 2024-09-13 北京智游网安科技有限公司 一种安卓系统反调试的检测方法、移动终端及存储介质
CN112241529B (zh) * 2019-07-16 2024-03-29 腾讯科技（深圳）有限公司 恶意代码检测方法、装置、存储介质和计算机设备

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080004107A1 (en) * 2006-07-03 2008-01-03 Igt Detecting and preventing bots and cheating in online gaming
US20180264342A1 (en) * 2012-02-23 2018-09-20 Playsight Interactive Ltd. Smart-court system and method for providing real-time debriefing and training services of sport games
CN106778104A (zh) * 2017-01-20 2017-05-31 武汉斗鱼网络科技有限公司 一种应用程序的反调试方法和系统
CN107742077A (zh) * 2017-10-09 2018-02-27 武汉斗鱼网络科技有限公司 一种在游戏直播中防止信息泄露的方法及装置
US20200114265A1 (en) * 2018-10-16 2020-04-16 Kakao Games Corp. Method for detecting abnormal game play
CN110321703A (zh) * 2019-07-02 2019-10-11 北京智游网安科技有限公司 一种检测应用程序非法入侵的方法、存储介质及终端设备
CN113209630A (zh) * 2021-05-14 2021-08-06 上海完美时空软件有限公司 游戏应用的抓帧防御方法及装置、存储介质、计算机设备

Also Published As

Publication number Publication date
CN113209630A (zh) 2021-08-06
CN113209630B (zh) 2022-09-30

Similar Documents

Publication Publication Date Title
WO2022237120A1 (zh) 游戏应用的抓帧防御方法及装置、存储介质、计算机设备
Ligh et al. The art of memory forensics: detecting malware and threats in windows, linux, and Mac memory
US9727436B2 (en) Adding a profiling agent to a virtual machine to permit performance and memory consumption analysis within unit tests
CN109388538B (zh) 一种基于内核的文件操作行为监控方法及装置
US10387627B2 (en) Systems and methods for analyzing software
US8776029B2 (en) System and method of software execution path identification
CN108229148B (zh) 一种基于Android虚拟机的沙箱脱壳方法及系统
CN101458754B (zh) 一种监控应用程序行为的方法及装置
CN110490773B (zh) 一种基于区块链的录屏取证方法、装置及电子设备
Karami et al. Behavioral analysis of android applications using automated instrumentation
CN103632088A (zh) 一种木马检测方法及装置
CN105574416A (zh) 一种浏览器漏洞检测方法及装置
CN110287696A (zh) 一种反弹shell进程的检测方法、装置和设备
CN105117644A (zh) 采集Android外挂程序方法及系统
US10129275B2 (en) Information processing system and information processing method
CN115688106A (zh) 一种Java agent无文件注入内存马的检测方法及装置
US10275595B2 (en) System and method for characterizing malware
US20160092313A1 (en) Application Copy Counting Using Snapshot Backups For Licensing
Vömel et al. Visualizing indicators of Rootkit infections in memory forensics
CN112231198A (zh) 一种恶意进程调试方法、装置、电子设备及介质
Hu et al. Fuzzy and cross-app replay for smartphone apps
CN109472135A (zh) 一种检测进程注入的方法、装置及存储介质
WO2017092355A1 (zh) 一种数据服务系统
CN109426702B (zh) iOS平台文件读取保护方法、存储介质、电子设备及系统
CN110765456A (zh) 一种检测隐藏进程的方法、装置及存储设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21941684

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21941684

Country of ref document: EP

Kind code of ref document: A1