Net Game Cheat Detection Based On Code Mutation

With the popularity of the network, as a pillar of the Internet, the network gameindustry has developed rapidly. As a way of entertainment, network game influencespeople’s daily life and form a culture of game. While it is growing fast, it also confrontsthe problems cheating tools bring. Cheating tools not only break the balance of game,but also accelerate the loss of game players. As a result, game producers lost their profit,which will impact the whole industry. Cheating tools are easily made but hard detected.So how to detect cheating tools has been a focus of game security research.Contraposing the problem above, this thesis analyses how to detect cheating toolsand proposes a network game cheat-detected technique based on code mutation, aimingat achieving an automatic, exact and safe detecting method. Automatic refers to that itcan work with less human involvement. Exact refers to that when cheating tools arerunning, they are exactly detected according to their running feature. Safe refers to thatdetecting is well protected with code mutation and can hardly be analyzed. Therefore,the main work of this thesis is as below:1. We analyze and research existing cheating technique deeply and introduce thedevelopment of cheating tools. In the same time, we divide cheating tools into threekinds, that is, mouse-keyboard-simulated, memory-processed and packet-processed.And we analyze deeply how each kind works in order to get the way of detecting them.2. We research existing cheat detecting method, including GM patrol, player report,packet encryption, client abnormal data checking, server abnormal data checking andverification code, summarize their drawbacks and come up with our code-separateddetecting technique based on them.3. We enumerate current code protection techniques, including software packer,anti-debug, virtual-machined protection, code obfuscation and code polymorphism. Weuse the code mutation technique of virus to protect detection code according to theoperation circumstance. Under the protection of code mutation, detection will not besubject to the running environment. Besides, it will be hardly understood via mutation.4. We design a cheat detection engine--CheatMutector based on mutation which is deployed on client and server. The detection code is separated and not directly stored inclient. It is created by server and sent to client after mutation. Client loads and runs itwhen it has been received. In the process of executing, client is waiting for commandfrom server. When a command is received, client performs corresponding action andsends feedbacks back to the server. Server gets and disposes the feedbacks which willbe used as proof of game upgrade and cheat punishment.