Multi-threaded detection of a game software debugger
View Patent ↗An anti-debugging mechanism is implemented into a game application, such that the anti-debugging mechanism is difficult to detect, difficult to bypass, and difficult to remove. The anti-debugging mechanism is implemented in a simulated thread pool. The anti-debugging mechanism executes on a different thread than the thread on which the game application executes and is randomly activated. When a debugger is detected, the performance of the debugger is hindered by halting the game application on a different thread than the game thread. Further, a period of time is allowed to elapse before the game application is halted.
1. A method comprising:
executing a game application on a first game thread of a system;
implementing a debugger detector on a second thread of the system, wherein the second thread differs from the first game thread and is separated from the first game thread by a thread boundary;
determining if a debugger is attached to the game application;
if it is determined that a debugger is attached to the game application; hindering performance of the detected debugger, the hindering comprising halting a third thread that is randomly selected from a simulated thread pool of the system.
2. A method in accordance with claim 1 , further comprising allowing an amount of time to elapse between determining a debugger is attached to the game application and hindering performance of the debugger.
3. A method in accordance with claim 2 , wherein the amount of time is randomly determined.
4. A method in accordance with claim 2 , wherein the amount of time comprises a predetermined amount of time.
5. A method in accordance with claim 2 , wherein the amount of time is determined in accordance with an event occurring in the system.
6. A method in accordance with claim 1 , wherein the second thread is selected from a simulated thread pool.
7. A method in accordance with claim 1 , wherein the step of determining if a debugger is attached to the game application is performed at random times.
8. A method in accordance with claim 1 , wherein the step of determining if a debugger is attached to the game application is performed in accordance with resource availability of the system.
9. A device comprising:
memory comprising executable instructions;
a game application implemented on a first thread of the device,
a debugger detector implemented on a second thread of the device, the second thread separated from the first thread by a thread boundary; and
a processor coupled to the memory, the processor configured to execute the executable instructions to:
determine if a debugger is attached to the game application; and
if it is determined that a debugger is attached to the game application, obfuscate execution of the game application by shutting down a third thread that is randomly selected from a simulated thread pool of the system.
10. A device in accordance with claim 9 , the device further configured to allow an amount of time to elapse between determining a debugger is attached to the game application and performing one of halting the game application or obfuscating the execution of the game application.
11. A device in accordance with claim 10 , wherein the amount of time is randomly determined.
12. A device in accordance with claim 10 , wherein the amount of time comprises a predetermined amount of time.
13. A device in accordance with claim 10 , wherein the amount of time is determined in accordance with an event occurring in the device.
14. A device in accordance with claim 9 , wherein the device is configured to determine, at random times, if a debugger is attached to the game application.
15. A device in accordance with claim 9 , wherein the device is configured to periodically determine if a debugger is attached to the game application.
16. A device in accordance with claim 9 , wherein the device is configured to determine if a debugger is attached to the game application in accordance with resource availability of the device.
17. A computer-readable storage medium that is not a signal, the computer-readable storage medium having stored thereon computer-executable instructions for performing the steps of:
utilizing a debugger detector to determine if a debugger is attached to a game application executed on a first thread of a system, the debugger detector implemented on a simulated thread that differs from the first thread; and
if it is determined that a debugger is attached to the game application; hindering performance of the detected debugger, the hindering comprising halting a third thread that is randomly selected from a simulated thread pool of the system.
18. A computer-readable storage medium in accordance with claim 17 , the computer-executable instructions further for allowing an amount of time to elapse between determining a debugger is attached to the game application and hindering performance of the detected debugger.