MEMORY HACKING DETECTING METHOD AND SYSTEM THEREFOR
A memory hacking detecting method and a system therefor are provided. The memory hacking detecting method for accurately detecting a level of a hacker (or a cheating user) and action of memory hacking by detecting the memory hacking on a stage-by-stage basis and assigning attributes to each of variables of a program executed on a memory and detecting memory hacking in different ways based on the assigned attributes.
1 . A memory hacking detecting method to detect memory hacking of a value of a variable associated with a program executed on a memory, the method comprising:
assigning attributes to the variable included in the program using a guard library, the guard library including variable attributes information;
redefining, via the guide library, a type of a first variable to which first attributes are assigned and an operator to generate a redefined type and a redefined operator, respectively;
first detecting the memory hacking of the first variable based on whether a value of the first variable is inconsistent with the redefined operator or the first variable deviates from a range of the redefined type;
periodically monitoring a change of a value of a second variable to which second attributes are assigned; and
second detecting the memory hacking of the second variable based on whether the change of the value of the second variable deviates from a change limitation set by the second attributes.
2 . The method of claim 1 , wherein the second attributes indicate that the second variable is fixed, and the second detecting comprises:
storing the value of the second variable in a data file, the data file containing stored values of read-only attributes; and
detecting the memory hacking of the second variable, if the value of the second variable is different from a respective one of the stored values.
3 . The method of claim 1 , wherein the second attributes indicate that the value of the second variable is expected to sequentially vary, and the second detecting comprises:
detecting the memory hacking of the second variable, if the periodic monitoring does not detect that the value of the second variable sequentially varies compared to a previous value thereof.
4 . The method of claim 1 , further comprising:
assigning an identifier parameter to the variable included in the program using the guard library; and
generating a message including information indicating that the memory hacking is detected and an identifier parameter of the variable corresponding to the memory hacking, if the memory hacking of the first variable or the memory hacking of the second variable is detected.
5 . The method of claim 1 , further comprising:
generating a message including information indicating that the memory hacking is detected and information about attributes of the variable corresponding to the memory hacking, if the first detecting or the second detecting detects the memory hacking of the first variable or the second variable, respectively.
6 . The method of claim 1 , further comprising:
storing a value of the variable in a storage position sequentially selected among a plurality of storage positions, if the value of the variable of the program changes; and
managing indication information about each of the plurality of storage positions in which the changed value of the variable is stored.
7 . The method of claim 6 , further comprising:
third detecting the memory hacking by monitoring whether the indication information is fabricated.
8 . The method of claim 1 , further comprising:
changing a fishing value stored in a fishing storage position, if the value of the variable is changed; and
detecting the memory hacking, if the value stored in the fishing storage position is falsified.
9 . The method of claim 1 , further comprising:
duplicating and storing a value of a variable in a plurality of storage positions, if the value of the variable of the program is changed; and
detecting the memory hacking by comparing the values duplicated and stored in the plurality of storage positions.
10 . The method of claim 1 , further comprising:
distributing a file to install the program such that the file is distributed with the guard library.
11 . A non-transitory computer-readable recording medium storing a program to execute the method of claim 1 .
12 . A memory hacking detecting device to detect memory hacking of a value of a variable of a program executed on a memory, the device comprising:
at least one processor configured to,
assign attributes to the variable included in the program using a guard library, the guard library including variable attributes information,
redefine, via the guide library, a type of a first variable to which first attributes are assigned and an operator to generate a redefined type and a redefined operator, respectively,
detect the memory hacking of the first variable based on whether a value of the first variable is inconsistent with the redefined operator or whether the first variable deviates from a range of the redefined type,
periodically monitor a change of a value of a second variable to which second attributes are assigned, and
detect the memory hacking of the second variable based on whether the change of the value of the second variable deviates from a change limitation set by the second attributes.
13 . The device of claim 12 , wherein the second attributes indicate that the second variable is fixed, and the at least one processor is further configured to,
store the value of the second variable in a data file, the data file containing stored values of read-only attributes, and
detect the memory hacking of the second variable, if the value of the second variable is different from a respective one of the stored values.
14 . The device of claim 12 , wherein the second attributes indicate that the value of the second variable is expected to sequentially vary, and
the at least one processor is configured to detect the memory hacking of the second variable, if the value of the second variable does not sequentially vary compared to a previous value thereof.
15 . The device of claim 12 , wherein the at least one processor is further configured to,
assign an identifier parameter to the variable included in the program using the guard library; and
generate a message including information indicating that the memory hacking is detected and an identifier parameter of the variable corresponding to the memory hacking, if the at least one processor detects the memory hacking.
16 . The device of claim 12 , wherein the at least one processor is further configured to generate a message including information indicating that the memory hacking is detected and information about attributes of the variable corresponding to the memory hacking, if the at least one processor detects the memory hacking.
17 . The device of claim 12 , wherein the at least one processor is further configured to,
store a value of the variable in a storage position sequentially selected among a plurality of storage positions, if the value of the variable is changed, and
manage indication information about each of the plurality of storage positions in which the changed value of the variable is stored.
18 . The device of claim 17 , wherein the at least one processor is further configured to,
detect the memory hacking by monitoring whether the indication information is fabricated.
19 . The device of claim 12 , wherein the at least one processor is further configured to,
change a fishing value stored in a fishing storage position, if the value of the variable is changed, and
detect the memory hacking, if the value stored in the fishing storage position is falsified.
20 . The device of claim 12 , wherein the at least one processor is further configured to,
duplicate and store a value of a variable in a plurality of storage positions, if the value of the variable of the program is changed, and
detect the memory hacking by comparing the values duplicated and stored in the plurality of storage positions.