zoukankan      html  css  js  c++  java
  • hook技术的应用-过某平台作弊检测

    上回书说完检测方法就戛然而止了,这篇文章就来谈谈如何过检测。

    首先回顾一下平台对作弊的检测方法,检测开始前平台准备一个单位列表,在列表中,有玩家可见的单位和玩家视野外的单位。

    地图脚本会强迫玩家点击每个在列表里的单位。

    如果玩家选中了不可见的单位(视野外或者隐身单位)或者玩家没有选中可见单位 都会提高作弊的置信程度

     1 for _,__0x0150__ in ipairs(__0x7633__[__0x2073__]) do
     2 __0x0519__:__0x1929__(__0x0150__)
     3 local __0x7637__=__0x0015__.__0x0941__(__0x3247__.selection())
     4 if __0x7637__==__0x0150__ then
     5 __0x2740__.__0x7611__=__0x2740__.__0x7611__+1
     6 __0x0288__.info('!hack! __0x2740__.__0x7611__ + 1',__0x2740__.__0x7611__)
     7 if __0x7637__==__0x0196__ then
     8 __0x2740__.__0x7613__=__0x2740__.__0x7613__+1
     9 __0x0288__.info('!hack! __0x2740__.__0x7613__ + 1',__0x2740__.__0x7613__)
    10 end
    11 end

    那么如何来bypass整个检测呢,最直接的方法就是不开启视野外点击这个功能,只在大地图上显示模型。

    当然这样的方法是消极的做法。下面上我的解决方案。

    既然地图脚本使用lua来写的,肯定有个模块从外部调用了war3的内部函数来点击单位,只要找到被外部的函数地址剩下的就好办了。

    经过分析 其实是 War3Plugin.dll 调用了 位于game.dll+0x425FD0处的函数 为了方便称为'selectfunc'。

    接下来就有多种做法,其中之一是根据传给selectfunc的参数找到该单位的地址,通过判断该单位是否可见来决定跳转是否直接返回。

    当然这个方法非常复杂,且效率不高,每个单位都要判断一次。

    我采用的方法更加简单明了,首先当然是hook这个函数

    函数之间存在着一些间隙,在间隙中可以放置一些额外的代码,替换到函数入口的push指令 jmp到设计好的代码地址。

    在6F425FC6处调用bypass函数 该函数的主要作用是暂时关闭视野外点击的作弊功能,在一段时间后再开启。

    返回后是一条push指令 因为之前替换掉了selectfunc第一条指令 需要再给它补上。

    然后又是一个跳转 跳转到函数中 正常执行。

    这样的作法被叫做hook,hook的释义是钩子,这个函数一经调用 这个钩子就能捕获到这一信息。

    那么函数具体应该如何实现?该函数在玩家正常点击时也会被调用,总不能一点击就关闭作弊功能。这时候就要根据程序的堆栈来判断该函数是否从外部被调用。

    用调试器附加war3,在该函数开头处设下断点,随意选中一个单位,此时程序已经被中断。

    观察调用堆栈发现最近的返回地址在 [esp + 0x30] 处 那么以后只要判断栈中存放的地址是否指向程序内部即可。(事实上 game.dll 中多个过程调用了这个函数,需要逐一进行处理)

    即如果是从内部调用就直接return 如果不是则暂时关闭作弊功能1秒

    下面来看一看过检测的效果

    [info]: !hack! __0x2740__.__0x7612__ + 1    1
    [info]: !hack! __0x2740__.__0x7612__ + 1    2
    [info]: !hack! __0x2740__.__0x7612__ + 1    3
    [info]: !hack! __0x2740__.__0x7612__ + 1    4
    [info]: !hack! __0x2740__.__0x7612__ + 1    5
    [info]: !hack! __0x2740__.__0x7612__ + 1    6
    [info]: !hack! __0x2740__.__0x7612__ + 1    7
    [info]: !hack! __0x2740__.__0x7612__ + 1    8
    [info]: !hack! __0x2740__.__0x7612__ + 1    9
    [info]: !hack! __0x2740__.__0x7612__ + 1    10
    [info]: !hack! __0x2740__.__0x7612__ + 1    11
    [info]: !hack! __0x2740__.__0x7612__ + 1    12
    [info]: !hack! __0x2740__.__0x7612__ + 1    13
    [info]: !hack! __0x2740__.__0x7612__ + 1    14
    [info]: !hack! __0x2740__.__0x7612__ + 1    15
    [info]: !hack! __0x2740__.__0x7612__ + 1    16
    [info]: !hack! __0x2740__.__0x7612__ + 1    17
    [info]: !hack! __0x2740__.__0x7612__ + 1    18
    [info]: !hack! __0x2740__.__0x7612__ + 1    19
    [info]: !hack! __0x2740__.__0x7612__ + 1    20
    [info]: !hack! __0x2740__.__0x7612__ + 1    21
    [info]: !hack! __0x2740__.__0x7612__ + 1    22
    [info]: !hack! __0x2740__.__0x7612__ + 1    23
    [info]: !hack! __0x2740__.__0x7612__ + 1    24
    [info]: !hack! __0x2740__.__0x7612__ + 1    25
    [info]: !hack! __0x2740__.__0x7612__ + 1    26
    [info]: !hack! __0x2740__.__0x7612__ + 1    27
    [info]: !hack! __0x2740__.__0x7612__ + 1    28
    [info]: !hack! __0x2740__.__0x7612__ + 1    29
    [info]: !hack! __0x2740__.__0x7612__ + 1    30
    [info]: !hack! __0x2740__.__0x7612__ + 1    31
    [info]: !hack! __0x2740__.__0x7612__ + 1    32
    [info]: !hack! __0x2740__.__0x7612__ + 1    33
    [info]: !hack! __0x2740__.__0x7612__ + 1    34
    [info]: !hack! __0x2740__.__0x7612__ + 1    35
    [info]: !hack! __0x2740__.__0x7612__ + 1    36
    [info]: !hack! __0x2740__.__0x7612__ + 1    37
    [info]: !hack! __0x2740__.__0x7612__ + 1    38
    [info]: !hack! __0x2740__.__0x7612__ + 1    39
    [info]: !hack! __0x2740__.__0x7612__ + 1    40
    [info]: !hack! __0x2740__.__0x7612__ + 1    41
    [info]: !hack! __0x2740__.__0x7612__ + 1    42
    [info]: !hack! __0x2740__.__0x7612__ + 1    43
    [info]: !hack! __0x2740__.__0x7612__ + 1    44
    [info]: !hack! __0x2740__.__0x7612__ + 1    45
    [info]: !hack! __0x2740__.__0x7612__ + 1    46
    [info]: !hack! __0x2740__.__0x7612__ + 1    47
    [info]: !hack! __0x2740__.__0x7612__ + 1    48
    [info]: !hack! __0x2740__.__0x7612__ + 1    49
    [info]: !hack! __0x2740__.__0x7612__ + 1    50
    [info]: !hack! __0x2740__.__0x7612__ + 1    51
    [info]: !hack! __0x2740__.__0x7612__ + 1    52
    [info]: !hack! __0x2740__.__0x7612__ + 1    53
    [info]: !hack! __0x2740__.__0x7612__ + 1    54
    [info]: !hack! __0x2740__.__0x7612__ + 1    55
    [info]: !hack! __0x2740__.__0x7612__ + 1    56
    [info]: !hack! __0x2740__.__0x7612__ + 1    57
    [info]: !hack! __0x2740__.__0x7612__ + 1    58
    [info]: !hack! __0x2740__.__0x7612__ + 1    59
    [info]: !hack! __0x2740__.__0x7612__ + 1    60
    [info]: !hack! __0x2740__.__0x7612__ + 1    61
    [info]: !hack! __0x2740__.__0x7612__ + 1    62
    [info]: !hack! __0x2740__.__0x7612__ + 1    63
    [info]: !hack! __0x2740__.__0x7612__ + 1    64
    [info]: !hack! __0x2740__.__0x7612__ + 1    65
    [info]: !hack! __0x2740__.__0x7612__ + 1    66
    [info]: !hack! __0x2740__.__0x7612__ + 1    67
    [info]: !hack! __0x2740__.__0x7612__ + 1    68
    [info]: !hack! __0x2740__.__0x7612__ + 1    69
    [info]: !hack! __0x2740__.__0x7612__ + 1    70
    [info]: !hack! __0x2740__.__0x7612__ + 1    71
    [info]: !hack! __0x2740__.__0x7612__ + 1    72
    [info]: !hack! __0x2740__.__0x7612__ + 1    73
    [info]: !hack! __0x2740__.__0x7612__ + 1    74
    [info]: !hack! __0x2740__.__0x7612__ + 1    75
    [info]: !hack! __0x2740__.__0x7612__ + 1    76
    [info]: !hack! __0x2740__.__0x7612__ + 1    77
    [info]: !hack! __0x2740__.__0x7612__ + 1    78
    [info]: !hack! __0x2740__.__0x7612__ + 1    79
    [info]: !hack! __0x2740__.__0x7612__ + 1    80
    [info]: !hack! __0x2740__.__0x7612__ + 1    81
    [info]: !hack! __0x2740__.__0x7612__ + 1    82
    [info]: !hack! __0x2740__.__0x7612__ + 1    83
    [info]: !hack! __0x2740__.__0x7612__ + 1    84
    [info]: !hack! __0x2740__.__0x7612__ + 1    85
    [info]: !hack! __0x2740__.__0x7612__ + 1    86
    [info]: !hack! __0x2740__.__0x7612__ + 1    87
    [info]: !hack! __0x2740__.__0x7612__ + 1    88
    [info]: !hack! __0x2740__.__0x7612__ + 1    89
    [info]: !hack! __0x2740__.__0x7612__ + 1    90
    [info]: !hack! __0x2740__.__0x7612__ + 1    91
    [info]: !hack! __0x2740__.__0x7612__ + 1    92
    [info]: !hack! __0x2740__.__0x7612__ + 1    93
    [info]: !hack! __0x2740__.__0x7612__ + 1    94
    [info]: !hack! __0x2740__.__0x7612__ + 1    95
    [info]: !hack! __0x2740__.__0x7612__ + 1    96
    [info]: !hack! __0x2740__.__0x7612__ + 1    97
    [info]: !hack! __0x2740__.__0x7612__ + 1    98
    [info]: !hack! __0x2740__.__0x7612__ + 1    99
    [info]: !hack! __0x2740__.__0x7612__ + 1    100
    [info]: !hack! __0x2740__.__0x7612__ + 1    101
    [info]: !hack! __0x2740__.__0x7612__ + 1    102
    [info]: !hack! __0x2740__.__0x7612__ + 1    103
    [info]: !hack! __0x2740__.__0x7612__ + 1    104
    [info]: !hack! __0x2740__.__0x7612__ + 1    105
    [info]: !hack! __0x2740__.__0x7612__ + 1    106
    [info]: !hack! __0x2740__.__0x7612__ + 1    107
    [info]: !hack! __0x2740__.__0x7612__ + 1    108
    [info]: !hack! __0x2740__.__0x7612__ + 1    109
    [info]: !hack! __0x2740__.__0x7612__ + 1    110
    [info]: !hack! __0x2740__.__0x7612__ + 1    111
    [info]: !hack! __0x2740__.__0x7612__ + 1    112
    [info]: !hack! __0x2740__.__0x7612__ + 1    113
    [info]: !hack! __0x2740__.__0x7612__ + 1    114
    [info]: !hack! __0x2740__.__0x7612__ + 1    115
    [info]: !hack! __0x2740__.__0x7612__ + 1    116
    [info]: !hack! __0x2740__.__0x7612__ + 1    117
    [info]: !hack! __0x2740__.__0x7612__ + 1    118
    [info]: !hack! __0x2740__.__0x7612__ + 1    119
    [info]: !hack! __0x2740__.__0x7612__ + 1    120
    [info]: !hack! __0x2740__.__0x7612__ + 1    121
    [info]: !hack! __0x2740__.__0x7612__ + 1    122
    [info]: !hack! __0x2740__.__0x7612__ + 1    123
    [info]: !hack! __0x2740__.__0x7612__ + 1    124
    [info]: !hack! __0x2740__.__0x7612__ + 1    125
    [info]: !hack! __0x2740__.__0x7612__ + 1    126
    [info]: !hack! __0x2740__.__0x7612__ + 1    127
    [info]: !hack! __0x2740__.__0x7612__ + 1    128
    [info]: !hack! __0x2740__.__0x7612__ + 1    129
    [info]: !hack! __0x2740__.__0x7612__ + 1    130
    [info]: !hack! __0x2740__.__0x7612__ + 1    131
    [info]: !hack! __0x2740__.__0x7612__ + 1    132
    [info]: !hack! __0x2740__.__0x7612__ + 1    133
    [info]: !hack! __0x2740__.__0x7612__ + 1    134
    [info]: !hack! __0x2740__.__0x7612__ + 1    135
    [info]: !hack! __0x2740__.__0x7612__ + 1    136
    [info]: !hack! __0x2740__.__0x7612__ + 1    137
    [info]: !hack! __0x2740__.__0x7612__ + 1    138
    [info]: !hack! __0x2740__.__0x7612__ + 1    139
    [info]: !hack! __0x2740__.__0x7612__ + 1    140
    [info]: !hack! __0x2740__.__0x7612__ + 1    141
    [info]: !hack! __0x2740__.__0x7612__ + 1    142
    [info]: !hack! __0x2740__.__0x7612__ + 1    143
    [info]: !hack! __0x2740__.__0x7612__ + 1    144
    [info]: !hack! __0x2740__.__0x7612__ + 1    145
    [info]: !hack! __0x2740__.__0x7612__ + 1    146
    [info]: !hack! __0x2740__.__0x7612__ + 1    147
    [info]: !hack! __0x2740__.__0x7612__ + 1    148
    [info]: !hack! __0x2740__.__0x7612__ + 1    149
    [info]: !hack! __0x0216__.__0x7613__    0
    [info]: !hack! __0x0216__.__0x7614__    0
    [info]: !hack! __0x0216__.__0x7615__    0
    [info]: !hack! __0x0216__.__0x7612__    0
    [info]: !hack! __0x0216__.__0x7616__    0
    [info]: !hack! __0x0216__.__0x7613__    0
    [info]: !hack! __0x0216__.__0x7614__    0
    [info]: !hack! __0x0216__.__0x7615__    0
    [info]: !hack! __0x0216__.__0x7612__    118
    [info]: !hack! __0x0216__.__0x7616__    0
    [info]: !hack! __0x0216__.__0x7613__    0
    [info]: !hack! __0x0216__.__0x7614__    0
    [info]: !hack! __0x0216__.__0x7615__    0
    [info]: !hack! __0x0216__.__0x7612__    118
    [info]: !hack! __0x0216__.__0x7616__    0
    [info]: !hack! __0x0216__.__0x7613__    0
    [info]: !hack! __0x0216__.__0x7614__    0
    [info]: !hack! __0x0216__.__0x7615__    0
    [info]: !hack! __0x0216__.__0x7612__    118
    [info]: !hack! __0x0216__.__0x7616__    0
    [info]: !hack! __0x0216__.__0x7613__    0
    [info]: !hack! __0x0216__.__0x7614__    0
    [info]: !hack! __0x0216__.__0x7615__    0
    [info]: !hack! __0x0216__.__0x7612__    118
    [info]: !hack! __0x0216__.__0x7616__    0
    [info]: !hack! __0x0216__.__0x7613__    0
    [info]: !hack! __0x0216__.__0x7614__    0
    [info]: !hack! __0x0216__.__0x7615__    0
    [info]: !hack! __0x0216__.__0x7612__    118
    [info]: !hack! __0x0216__.__0x7616__    0
    [info]: !hack! __0x0216__.__0x7613__    0
    [info]: !hack! __0x0216__.__0x7614__    0
    [info]: !hack! __0x0216__.__0x7615__    0
    [info]: !hack! __0x0216__.__0x7612__    0
    [info]: !hack! __0x0216__.__0x7616__    0
    [info]: !hack! __0x0216__.__0x7613__    0
    [info]: !hack! __0x0216__.__0x7614__    0
    [info]: !hack! __0x0216__.__0x7615__    0
    [info]: !hack! __0x0216__.__0x7612__    149
    [info]: !hack! __0x0216__.__0x7616__    0
    [info]: !hack! __0x0216__.__0x7613__    0
    [info]: !hack! __0x0216__.__0x7614__    0
    [info]: !hack! __0x0216__.__0x7615__    0
    [info]: !hack! __0x0216__.__0x7612__    149
    [info]: !hack! __0x0216__.__0x7616__    0
    [info]: !hack! __0x0216__.__0x7613__    0
    [info]: !hack! __0x0216__.__0x7614__    0
    [info]: !hack! __0x0216__.__0x7615__    0
    [info]: !hack! __0x0216__.__0x7612__    149
    [info]: !hack! __0x0216__.__0x7616__    0
    [info]: !hack! __0x0216__.__0x7613__    0
    [info]: !hack! __0x0216__.__0x7614__    0
    [info]: !hack! __0x0216__.__0x7615__    0
    [info]: !hack! __0x0216__.__0x7612__    149
    [info]: !hack! __0x0216__.__0x7616__    0
    [info]: !hack! __0x0216__.__0x7613__    0
    [info]: !hack! __0x0216__.__0x7614__    0
    [info]: !hack! __0x0216__.__0x7615__    0
    [info]: !hack! __0x0216__.__0x7612__    149
    [info]: !hack! __0x0216__.__0x7616__    0

    bypass成功

  • 相关阅读:
    spring boot 缺点优点?
    hdata datax交流总结
    数据分析利器之hive优化十大原则
    curl 执行post请求
    python读写文件write和flush
    hive bucket
    scp拷贝本地文件到服务器
    hive删除表报错
    PostgreSQL逻辑复制之slony篇
    Oracle迁移至PostgreSQL工具之Ora2Pg
  • 原文地址:https://www.cnblogs.com/BD1A489/p/10087544.html
Copyright © 2011-2022 走看看