Overview of mobile game safety

Overview of mobile game security

A mobile game usually contains: code, resources and data configuration.

Code is the core part of the game logic;

Resources are responsible for presenting the game to the player (usually including: pictures, sounds, animations, 3D models and renderings, etc.);

The data configuration stores various attribute value information in the game (data configuration includes: equipment attribute, combat attribute, character attribute, product attribute, monster attribute and other numerical configuration information)

Risks faced by common games

1. Statically modify files
2. Dynamically modify game logic
3. Tampering agreement
4. Game hacking
5. Malicious speech
6. studio

 

Statically modify files

Game files are statically modified and repackaged and signed

1. Modify game resources

 By influencing the game logic, the chain of the game calling the resource processing logic is invalidated, causing the game to appear abnormal

 Generally, you can try to replace or delete resource files, such as pictures and animations, in the resource directory of the game, modify the resources to affect the logic of the game or illegally promote false advertisements in the game.

2. Modify the code

 Generally, the read-only data segment and code segment are mostly modified. The read-only data segment may store some important data for the game. The code segment contains the execution logic of the entire game.

3. Modify the configuration

Modifying the configuration is similar to modifying the resource file. For example, copying n copies of the bin file of the simple level configuration and rename the bin file of the difficult level configuration can reduce the difficulty of the game.

 

Dynamic tampering logic

In general, conventional dynamic tampering logic is accompanied by injection operations. Injection usually uses technical means to load the dynamic link library in the operating system into the target process, and implement certain functions by executing the code in the dynamic link library. Injecting input security/malware often used means. The injection methods of Android and ios are different. In addition, dynamic modification logic is commonly used to hook operations in order to intercept game logic.

1. Modify the code

If certain functions are calculated on the local client, certain operations in the game can be intercepted by the plug-in program, and then the processing logic can be modified to achieve the purpose of modifying the game content.

2. Modify the data

It is similar to static modification, but dynamically modifies game data while the program is running.

 

Game Agreement

The communication format between the client and the server is determined by the game protocol. If the fields and data contained in it are cracked, it will have a serious impact on the entire game and even the server. Usually the modification of the protocol can be achieved through tampering and retransmission.

1. Tamper with the game protocol

It is usually games where client logic is very important that tampering with the game protocol can have a significant impact. When the protocol is intercepted and its fields are modified and then sent to the server, if the server does not verify it, it may have very bad effects. If there is a role id in the agreement for purchasing items, you can modify the role id field in the agreement to obtain items that should be profit from others.

2. Reissue the game agreement

Multiple retransmissions of the protocol can cause some server judgment problems. For example, when the plug-in cannot modify the damage of the character to achieve the goal of killing the enemy in a flash, it can achieve the effect of causing multiple judgments of damage through a concurrent multiple damage protocol, thereby also realizing the function of killing the enemy in a flash.