CN110516447A - A kind of method and apparatus of identification terminal simulator - Google Patents

A kind of method and apparatus of identification terminal simulator Download PDF

Info

Publication number
CN110516447A
CN110516447A CN201910774713.6A CN201910774713A CN110516447A CN 110516447 A CN110516447 A CN 110516447A CN 201910774713 A CN201910774713 A CN 201910774713A CN 110516447 A CN110516447 A CN 110516447A
Authority
CN
China
Prior art keywords
instruction
virtualization
user equipment
behavioural information
machine
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201910774713.6A
Other languages
Chinese (zh)
Other versions
CN110516447B (en
Inventor
郑伟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shanghai Lianshang Network Technology Co Ltd
Original Assignee
Shanghai Lianshang Network Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shanghai Lianshang Network Technology Co Ltd filed Critical Shanghai Lianshang Network Technology Co Ltd
Priority to CN201910774713.6A priority Critical patent/CN110516447B/en
Publication of CN110516447A publication Critical patent/CN110516447A/en
Application granted granted Critical
Publication of CN110516447B publication Critical patent/CN110516447B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44Arrangements for executing specific programs
    • G06F9/455Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533Hypervisors; Virtual machine monitors
    • G06F9/45558Hypervisor-specific management and integration aspects
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44Arrangements for executing specific programs
    • G06F9/455Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533Hypervisors; Virtual machine monitors
    • G06F9/45558Hypervisor-specific management and integration aspects
    • G06F2009/45591Monitoring or debugging support
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034Test or assess a computer or a system

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Stored Programmes (AREA)
  • Debugging And Monitoring (AREA)

Abstract

The purpose of the application is to provide a kind of method and apparatus of identification terminal simulator, this method comprises: executing one or more virtualization instructions by the virtual machine parsing in the user equipment, wherein, every virtualization instructions correspond to a machine instruction and as executing obtained by virtualization process to the machine instruction;First instruction behavioural information of the virtualization instructions in resolved implementation procedure is resolved the second instruction behavioural information when executing with the virtualization instructions to match in reference device;The device type information of the reference device is obtained, if the device type information indicates that the reference device is terminal emulator, and the first instruction behavioural information matches with the second instruction behavioural information, identifies that the user equipment is terminal emulator.The application can increase the accuracy of identification terminal simulator, can achieve the effect that hacker can not bypass.

Description

A kind of method and apparatus of identification terminal simulator
Technical field
This application involves the communications fields, more particularly to a kind of technology of terminal emulator for identification.
Background technique
With the development of the times, occur more and more terminal emulators on the market, terminal emulator can simulate reality The behavior of border terminal device, terminal emulator are easy to be made some behaviors for destroying normal order by hacker's utilization (for example, brush It is single), how accurate identification terminal simulator becomes a major issue.In the prior art, critical file is generallyd use Carry out identification terminal simulator with the scheme of determinant attribute scanning, hacker is easy to by modifying these critical files or determinant attribute To bypass such scheme.
Summary of the invention
The purpose of the application is to provide a kind of method and apparatus of identification terminal simulator.
According to the one aspect of the application, a kind of method of identification terminal simulator is provided, this method comprises:
One or more virtualization instructions are executed by the virtual machine parsing in the user equipment, wherein every virtual Change instruction and corresponds to a machine instruction and as executing obtained by virtualization process to the machine instruction;
By the virtualization instructions in the first instruction behavioural information being resolved in implementation procedure and the virtualization instructions The second instruction behavioural information when executing is resolved in reference device to be matched;
The device type information of the reference device is obtained, if the device type information indicates that the reference device is eventually Simulator is held, and the first instruction behavioural information matches with the second instruction behavioural information, identifies the user equipment For terminal emulator.
According to the one aspect of the application, a kind of equipment of identification terminal simulator is provided, which includes:
Module one by one, for executing one or more virtualization instructions by the virtual machine parsing in the user equipment, Wherein, every virtualization instructions correspond to a machine instruction and as executing obtained by virtualization process to the machine instruction;
One or two modules, for the virtualization instructions to be instructed behavioural information and institute in first be resolved in implementation procedure The second instruction behavioural information that virtualization instructions are resolved when executing in reference device is stated to be matched;
One or three modules, for obtaining the device type information of the reference device, if the device type information indicates institute Stating reference device is terminal emulator, and the first instruction behavioural information matches with the second instruction behavioural information, knows The not described user equipment is terminal emulator.
According to the one aspect of the application, a kind of equipment of identification terminal simulator is provided, wherein the equipment includes:
One or more virtualization instructions are executed by the virtual machine parsing in the user equipment, wherein every virtual Change instruction and corresponds to a machine instruction and as executing obtained by virtualization process to the machine instruction;
By the virtualization instructions in the first instruction behavioural information being resolved in implementation procedure and the virtualization instructions The second instruction behavioural information when executing is resolved in reference device to be matched;
The device type information of the reference device is obtained, if the device type information indicates that the reference device is eventually Simulator is held, and the first instruction behavioural information matches with the second instruction behavioural information, identifies the user equipment For terminal emulator.
According to the one aspect of the application, a kind of computer-readable medium of store instruction is provided, described instruction is in quilt When execution system is proceeded as follows:
One or more virtualization instructions are executed by the virtual machine parsing in the user equipment, wherein every virtual Change instruction and corresponds to a machine instruction and as executing obtained by virtualization process to the machine instruction;
By the virtualization instructions in the first instruction behavioural information being resolved in implementation procedure and the virtualization instructions The second instruction behavioural information when executing is resolved in reference device to be matched;
The device type information of the reference device is obtained, if the device type information indicates that the reference device is eventually Simulator is held, and the first instruction behavioural information matches with the second instruction behavioural information, identifies the user equipment For terminal emulator.
Compared with prior art, the application is by obtaining virtualization instructions for machine instruction progress virtualization process, and It is explained in the virtual machine of user equipment and executes virtualization instructions, by instruction behavior of the virtualization instructions in resolved implementation procedure The corresponding reference instruction behavioural information in reference device is compared information with virtualization instructions, detection user equipment whether be Terminal emulator can achieve the effect that hacker can not bypass so as to increase the accuracy of identification terminal simulator.
Detailed description of the invention
By reading a detailed description of non-restrictive embodiments in the light of the attached drawings below, the application's is other Feature, objects and advantages will become more apparent upon:
Fig. 1 shows a kind of method flow diagram of identification terminal simulator according to some embodiments of the application;
Fig. 2 shows the equipment structure charts according to a kind of identification terminal simulators of some embodiments of the application;
Fig. 3 shows the exemplary system that can be used for implementing each embodiment described herein.
The same or similar appended drawing reference represents the same or similar component in attached drawing.
Specific embodiment
The application is described in further detail with reference to the accompanying drawing.
In a typical configuration of this application, terminal, the equipment of service network and trusted party include one or more Processor (CPU), input/output interface, network interface and memory.
Memory may include the non-volatile memory in computer-readable medium, random access memory (RAM) and/or The forms such as Nonvolatile memory, such as read-only memory (ROM) or flash memory (flash RAM).Memory is computer-readable medium Example.
Computer-readable medium includes permanent and non-permanent, removable and non-removable media can be by any method Or technology come realize information store.Information can be computer readable instructions, data structure, the module of program or other data. The example of the storage medium of computer includes, but are not limited to phase change memory (PRAM), static random access memory (SRAM), moves State random access memory (DRAM), other kinds of random access memory (RAM), read-only memory (ROM), electric erasable Programmable read only memory (EEPROM), flash memory or other memory techniques, read-only disc read only memory (CD-ROM) (CD-ROM), Digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or Any other non-transmission medium, can be used for storage can be accessed by a computing device information.
The application meaning equipment includes but is not limited to that user equipment, the network equipment or user equipment and the network equipment pass through Network is integrated constituted equipment.The user equipment includes but is not limited to that any one can carry out human-computer interaction with user The mobile electronic product, such as smart phone, tablet computer etc. of (such as human-computer interaction is carried out by touch tablet), the mobile electricity Sub- product can use any operating system, such as android operating system, iOS operating system.Wherein, the network equipment The electronic equipment of numerical value calculating and information processing can be carried out automatically according to the instruction for being previously set or storing including a kind of, Hardware includes but is not limited to microprocessor, specific integrated circuit (ASIC), programmable logic device (PLD), field programmable gate Array (FPGA), digital signal processor (DSP), embedded device etc..The network equipment includes but is not limited to computer, net The cloud that network host, single network server, multiple network server collection or multiple servers are constituted;Here, cloud is by based on cloud The a large number of computers or network servers for calculating (Cloud Computing) is constituted, wherein cloud computing is the one of distributed computing Kind, a virtual supercomputer consisting of a loosely coupled set of computers.The network includes but is not limited to interconnect Net, wide area network, Metropolitan Area Network (MAN), local area network, VPN network, wireless self-organization network (Ad Hoc network) etc..Preferably, the equipment Can also be run on the user equipment, the network equipment or user equipment and the network equipment, the network equipment, touch terminal or The network equipment and touch terminal are integrated the program in constituted equipment by network.
Certainly, those skilled in the art will be understood that above equipment is only for example, other are existing or are likely to occur from now on Equipment be such as applicable to the application, should also be included within the application protection scope, and be incorporated herein by reference.
In the description of the present application, the meaning of " plurality " is two or more, unless otherwise specifically defined.
Fig. 1 shows a kind of method flow diagram of identification terminal simulator according to the application one embodiment, this method Including step S11, step S12 and step S13.In step s 11, user equipment passes through the virtual machine solution in the user equipment Analysis executes one or more virtualization instructions, wherein every virtualization instructions correspond to a machine instruction and by the machine Obtained by device instruction execution virtualization process;In step s 12, user equipment is by the virtualization instructions in resolved implementation procedure In first instruction behavioural information and the virtualization instructions in reference device be resolved execute when second instruction behavior letter Breath is matched;In step s 13, user equipment obtains the device type information of the reference device, if the device type Information indicates that the reference device is terminal emulator, and the first instruction behavioural information and described second instructs behavioural information Match, identifies that the user equipment is terminal emulator.
In step s 11, user equipment executes one or more virtually by the virtual machine parsing in the user equipment Change instruction, wherein every virtualization instructions correspond to a machine instruction and by executing virtualization process to the machine instruction Gained.In some embodiments, virtual machine be it is by software and simulation with complete hardware system function, operate in one Holonomic system in completely isolated environment can be used for explaining and running the words such as bytecode, including processor, register, stack, heap The necessary environment for saving code operation, can be using virtual machine as a standalone module in target application, as target application is pacified On a user device, virtualization instructions are as executing obtained by virtualization process to machine instruction dress, wherein machine instruction includes But the instruction being not limited in the instruction set such as arm, thumb, thumb32, arm64, such as MOV, XOR, CMP, RET etc. instruct, empty Quasi-ization processing includes but is not limited to replace machine instruction using the virtualization instructions of a set of customized bytecode form, than Such as, machine instruction MOV is replaced using customized bytecode " 0xa0 ", virtualization instructions explain execution in virtual machine, should It explains to execute operation and include at least and virtualization instructions is executed into inverse virtualization process, the corresponding machine of virtualization instructions is obtained and refers to It enables, execute machine instruction.
In step s 12, first instruction behavior of the user equipment by the virtualization instructions in resolved implementation procedure Information is resolved the second instruction behavioural information when executing with the virtualization instructions in reference device and is matched.Some In embodiment, instruction behavior information include but be not limited to the operation result of instruction, the intermediate variable generated in execution of instructions, The situation of change of the instruction such as register, stack, heap running environment, reference device can be terminal emulator in execution of instructions, It is also possible to physical end equipment, the first instruction behavioural information when executing by explaining virtualization instructions on a user device Explaining that the second instruction behavioural information when executing is matched on reference device with virtualization instructions, by comparing the first instruction Behavioural information and second instruction behavioural information between similarity whether be greater than or equal to scheduled similarity threshold (for example, 90%) determine whether the first instruction behavioural information and the second instruction behavioural information match, wherein virtualization instructions are with reference to setting Standby upper the second instruction behavioural information explained when executing be it is known, can be stored in advance on a user device, can also be real-time The request from corresponding server.
In step s 13, user equipment obtains the device type information of the reference device, if the device type information Indicate that the reference device is terminal emulator, and the first instruction behavioural information and described second instructs behavioural information phase Match, identifies that the user equipment is terminal emulator.In some embodiments, the device type information of reference device is used to indicate Used type of architecture is (for example, arm frame when whether reference device is terminal emulator and reference device is terminal emulator Structure, x86 framework etc.), if device type information instruction reference device is terminal emulator, and first instructs behavioural information and second It instructs the similarity between behavioural information to be greater than or equal to scheduled similarity threshold (for example, 90%), can determine the first finger Behavioural information is enabled to instruct behavioural information to match with second, to identify that the user equipment is terminal emulator.
In some embodiments, the method also includes following at least any one: if the device type information indicates institute Stating reference device is physical end equipment, and the first instruction behavioural information and described second instructs behavior information mismatch, knows The not described user equipment is terminal emulator;If the device type information indicates that the reference device is terminal emulator, and The first instruction behavioural information and the second instruction behavior information mismatch, identify that the user equipment sets for physical end It is standby;If it is physical end equipment that the device type information, which indicates the reference device, and the first instruction behavioural information with The second instruction behavioural information matches, and identifies that the user equipment is physical end equipment.For example, scheduled similarity threshold Value is 90, if device type information instruction reference device is physical end equipment, and the first instruction behavioural information is instructed with second Similarity between behavioural information is 80%, is less than scheduled similarity threshold, the first instruction behavioural information and the second dos command line DOS For information mismatch, it can identify that user equipment is terminal emulator;If device type information indicates that reference device is terminal mould Quasi- device, and the similarity between the first instruction behavioural information and the second instruction behavioural information is 70%, is less than scheduled similarity Threshold value, the first instruction behavioural information are mismatched with the second instruction behavioural information, can identify that user equipment is physical end equipment; If device type information indicates that reference device is physical end equipment, and the first instruction behavioural information instructs behavioural information with second Between similarity be 95%, be greater than scheduled similarity threshold, first instruction behavioural information with second instruct behavioural information phase Matching can identify that user equipment is physical end equipment.
In some embodiments, the method also includes step S14 (not shown), in step S14, user equipment according to The device type information of the reference device determines the device type information of the terminal emulator.For example, if having identified User equipment is terminal emulator, if the framework of device type information instruction reference device is the terminal emulator of arm framework, The framework of terminal emulator also arm framework can be determined, alternatively, if the framework of device type information instruction reference device It is the terminal emulator of x86 framework, then can determines the framework of terminal emulator also x86 framework.
In some embodiments, the step S13 includes: the device type information for obtaining the reference device, if described Device type information indicates that the reference device is the terminal emulator based on intel framework, and the first instruction behavior is believed Breath matches with the second instruction behavioural information, identifies that the user equipment is the terminal emulator based on intel framework.In In some embodiments, the terminal emulator based on intel framework is main flow terminal simulator at present on the market, including HAXM (the hardware-accelerated execution manager of intel), HAXM are to have used the hardware of VT (intel virtualization technology) that virtualization is assisted to draw It holds up, can significantly promote the performance and the speed of service of terminal emulator, since HAXM can be to the machine instruction on virtual machine Implementation procedure has an impact, so that first instruction of the identical machine instruction in the terminal emulator based on intel framework Behavioural information can instruct behavioural information difference with second in physical end equipment, with this when reference device is to be based on When the terminal emulator of intel framework, by the first instruction behavioural information on user equipment and the second instruction on reference device Behavioural information is matched, if the first instruction behavioural information matches with the second instruction behavioural information, identifies that user equipment is Terminal emulator based on intel framework.
In some embodiments, the method also includes step S15 (not shown), in step S15, if the user sets Standby is terminal emulator, will test result and is sent to the network equipment, so that the network equipment marks the user equipment corresponding One or more equipment behaviors.In some embodiments, it when testing result shows that user equipment is terminal emulator, will examine It surveys result and is sent to corresponding server, wherein testing result includes but is not limited to the mark letter of energy unique identification user equipment It ceases (such as the address mac), after server receives the testing result, will be stored in database, file or server buffer and this The corresponding equipment behavior of identification information is marked, and labeled equipment behavior is due to being terminal emulator behavior rather than reality Terminal device behavior, therefore there may be some potential safety problemss, these equipment behaviors are marked so that server is subsequent right These equipment behaviors carry out safety analysis, wherein equipment behavior includes but is not limited to voting behavior, brush single act and increment Service relevant behavior etc..
In some embodiments, if the virtual machine is located in the target application on the user equipment;Wherein, the side Method further includes step S16 (not shown), in step s 16, if the user equipment is terminal emulator, disables the target and answers One or more functions in.In some embodiments, if virtual machine is mounted in the target application on user equipment Some module, plug-in unit or boarding program forbid user to use one in target application when user equipment is terminal emulator Or multiple functions, the one or more functions include but is not limited to function relevant to value-added service and Internetbank or ideal money Relevant function enhances the safety of target application with this.
In some embodiments, the step S11 includes: that user equipment passes through the virtual machine parsing in the user equipment Execute one or more virtualization instructions, wherein every virtualization instructions correspond to a machine instruction and by the machine Obtained by instruction execution virtualization process, the quantity of the virtualization instructions meets scheduled amount threshold.In some embodiments, Only when virtual machine explains that the virtualization instructions item number executed more than scheduled amount threshold (for example, 5), can just obtain opposite Correct testing result, by by multiple virtualization instructions in resolved implementation procedure corresponding first instruction behavioural information with Multiple virtualization instructions are resolved the second instruction behavioural information when executing in reference device and are matched (for example, with second The virtualization instructions item number that instruction behavioural information matches, which accounts for, explains that the ratio of the virtualization instructions total number executed is more than 90%, Could accurately identify that user equipment is terminal emulator), it just can ensure that the correctness of recognition result, reduce the machine of error to the greatest extent Rate.
In some embodiments, if the virtual machine is located in the target application on the user equipment;Wherein, the step Rapid S11 includes: that user device responsive in the target application is installed event, passes through the virtual machine in the user equipment Parsing executes one or more virtualization instructions, wherein every virtualization instructions correspond to a machine instruction and by this Machine instruction executes obtained by virtualization process.In some embodiments, when target application installs for the first time on a user device At when, can by the virtual machine in target application explain execute one or more virtualization instructions, to detect user equipment It whether is terminal emulator.
In some embodiments, if the virtual machine is located in target application;Wherein, the step S11 includes: that user sets Event is completed in the standby update in response to the target application, executes one or more by the virtual machine parsing in the user equipment Virtualization instructions, wherein every virtualization instructions correspond to a machine instruction and virtual by executing to the machine instruction Change processing gained.In some embodiments, when target application on a user device complete each time by version updating, can lead to The virtual machine crossed in target application, which is explained, executes one or more virtualization instructions, to detect whether user equipment is terminal simulation Device.
In some embodiments, the virtual machine parsing by the user equipment executes one or more virtualization Instruction, comprising: inverse virtualization process, solution are executed to one or more virtualization instructions by the virtual machine in the user equipment It releases to obtain one or more machine instruction corresponding with the virtualization instructions;The machine is executed by the virtual machine to refer to It enables;Wherein, the step S12 includes: that user equipment believes first instruction behavior of machine instruction during being performed The second instruction behavioural information being resolved in reference device with the virtualization instructions when executing is ceased to be matched.For example, empty Quasi-ization instruction is " Oxa0 ", and virtual machine first executes inverse virtualization process to the virtualization instructions, obtains corresponding machine instruction Then MOV executes machine instruction MOV in virtual machine, by first dos command line DOS of machine instruction MOV during being performed For information, the corresponding second instruction behavioural information in reference device is matched with machine instruction MOV, by comparing first Whether the similarity between instruction behavioural information and the second instruction behavioural information is greater than or equal to scheduled similarity threshold (ratio Such as, 90%), come determine the first instruction behavioural information and second instruction behavioural information whether match
The equipment that Fig. 2 has gone out a kind of identification terminal simulator according to the application one embodiment, the equipment include one by one Module 11, one or two modules of module 12 and one or three 13.Module 11 one by one, for being held by the virtual machine parsing in the user equipment One or more virtualization instructions of row, wherein every virtualization instructions correspond to a machine instruction and by referring to the machine It enables and executing obtained by virtualization process;One or two modules 12, for by the virtualization instructions in resolved implementation procedure first Instruction behavioural information and the virtualization instructions are resolved the second instruction behavioural information progress when executing in reference device Match;One or three modules 13, for obtaining the device type information of the reference device, if the device type information indicates the ginseng Examining equipment is terminal emulator, and the first instruction behavioural information matches with the second instruction behavioural information, identifies institute Stating user equipment is terminal emulator.
Module 11 one by one refer to for executing one or more virtualization by the virtual machine parsing in the user equipment It enables, wherein every virtualization instructions correspond to a machine instruction and as executing obtained by virtualization process to the machine instruction. In some embodiments, virtual machine be it is by software and simulation with complete hardware system function, operate in one completely Holonomic system in isolation environment can be used for explaining and running the bytecodes such as bytecode, including processor, register, stack, heap The necessary environment of operation, can be using virtual machine as a standalone module in target application, as target application is installed in On user equipment, virtualization instructions are as executing obtained by virtualization process to machine instruction, wherein machine instruction includes but not The instruction such as the instruction being limited in the instruction set such as arm, thumb, thumb32, arm64, such as MOV, XOR, CMP, RET, virtualization Processing including but not limited to replaces machine instruction using the virtualization instructions of a set of customized bytecode form, for example, Machine instruction MOV is replaced using customized bytecode " 0xa0 ", virtualization instructions explain execution, the explanation in virtual machine It executes operation and includes at least and virtualization instructions are executed into inverse virtualization process, the corresponding machine instruction of virtualization instructions is obtained, holds Row machine instruction.
One or two modules 12, for by first instruction behavioural information of the virtualization instructions in resolved implementation procedure with The virtualization instructions are resolved the second instruction behavioural information when executing in reference device and are matched.In some embodiments In, instruction behavior information includes but is not limited to the operation result of instruction, the intermediate variable generated in execution of instructions, instruction fortune The situation of change of the instruction such as register, stack, heap running environment during row, reference device can be terminal emulator, can also be with It is physical end equipment, the first instruction behavioural information when being executed by explaining virtualization instructions on a user device and virtual Change instruction and explaining that the second instruction behavioural information when executing is matched on reference device, by comparing the first instruction behavior letter Whether the similarity between breath and the second instruction behavioural information, which is greater than or equal to scheduled similarity threshold (for example, 90%), is come really Whether fixed first instruction behavioural information and the second instruction behavioural information match, wherein virtualization instructions are explained on reference device When execution second instruction behavioural information be it is known, can be stored in advance on a user device, can also be in real time from corresponding Request in server.
One or three modules 13, for obtaining the device type information of the reference device, if the device type information indicates The reference device is terminal emulator, and the first instruction behavioural information matches with the second instruction behavioural information, Identify that the user equipment is terminal emulator.In some embodiments, the device type information of reference device is used to indicate ginseng Whether be terminal emulator and reference device when being terminal emulator if examining equipment used type of architecture is (for example, arm frame Structure, x86 framework etc.), if device type information instruction reference device is terminal emulator, and first instructs behavioural information and second It instructs the similarity between behavioural information to be greater than or equal to scheduled similarity threshold (for example, 90%), can determine the first finger Behavioural information is enabled to instruct behavioural information to match with second, to identify that the user equipment is terminal emulator.
In some embodiments, the equipment is also used to following at least any one: if the device type information indicates institute Stating reference device is physical end equipment, and the first instruction behavioural information and described second instructs behavior information mismatch, knows The not described user equipment is terminal emulator;If the device type information indicates that the reference device is terminal emulator, and The first instruction behavioural information and the second instruction behavior information mismatch, identify that the user equipment sets for physical end It is standby;If it is physical end equipment that the device type information, which indicates the reference device, and the first instruction behavioural information with The second instruction behavioural information matches, and identifies that the user equipment is physical end equipment.Here, relevant operation and Fig. 1 Illustrated embodiment is same or similar, and so it will not be repeated, is incorporated herein by reference.
In some embodiments, the equipment further includes one or four module, 14 (not shown), and one or four modules 14 are used for described in The device type information of reference device determines the device type information of the terminal emulator.Here, one or four modules 14 is specific Implementation is same or similar with the embodiment in relation to step S14 in Fig. 1, and so it will not be repeated, is contained in by reference herein This.
In some embodiments, one or three module 13 is used for: the device type information of the reference device is obtained, if institute It states device type information and indicates that the reference device is the terminal emulator based on intel framework, and described first instructs behavior Information matches with the second instruction behavioural information, identifies that the user equipment is the terminal emulator based on intel framework. Here, relevant operation is same or similar with embodiment illustrated in fig. 1, so it will not be repeated, is incorporated herein by reference.
In some embodiments, the equipment further includes one or four module, 14 (not shown), if one or four modules 14 are for described User equipment is terminal emulator, will test result and is sent to the network equipment, so that the network equipment marks the user to set Standby corresponding one or more equipment behaviors.Here, related step S14 in the specific implementation and Fig. 1 of one or four modules 14 Embodiment is same or similar, and so it will not be repeated, is incorporated herein by reference.
In some embodiments, if the virtual machine is located in the target application on the user equipment;Wherein, described to set Standby further includes 15 (not shown) of First Five-Year Plan module, if First Five-Year Plan module 15 is used for the user equipment for terminal emulator, described in disabling One or more functions in target application.Here, related step S15 in the specific implementation and Fig. 1 of First Five-Year Plan module 15 Embodiment is same or similar, and so it will not be repeated, is incorporated herein by reference.
In some embodiments, the module one by one 11 is used for: being parsed and is executed by the virtual machine in the user equipment One or more virtualization instructions, wherein every virtualization instructions correspond to a machine instruction and by the machine instruction It executes obtained by virtualization process, the quantity of the virtualization instructions meets scheduled amount threshold.Here, relevant operation and Fig. 1 Illustrated embodiment is same or similar, and so it will not be repeated, is incorporated herein by reference.
In some embodiments, if the virtual machine is located in the target application on the user equipment;Wherein, described one One module 11 is used for: being installed event in response to the target application, is parsed by the virtual machine in the user equipment Execute one or more virtualization instructions, wherein every virtualization instructions correspond to a machine instruction and by the machine Obtained by instruction execution virtualization process.Here, relevant operation is same or similar with embodiment illustrated in fig. 1, so it will not be repeated, herein It is incorporated herein by reference.
In some embodiments, if the virtual machine is located in target application;Wherein, the module one by one 11 is used for: being rung Event is completed in the update of target application described in Ying Yu, and it is empty to execute one or more by the virtual machine parsing in the user equipment Quasi-ization instruction, wherein every virtualization instructions correspond to a machine instruction and by executing at virtualization to the machine instruction Reason gained.Here, relevant operation is same or similar with embodiment illustrated in fig. 1, so it will not be repeated, is contained in by reference herein This.
In some embodiments, the virtual machine parsing by the user equipment executes one or more virtualization Instruction, comprising: inverse virtualization process, solution are executed to one or more virtualization instructions by the virtual machine in the user equipment It releases to obtain one or more machine instruction corresponding with the virtualization instructions;The machine is executed by the virtual machine to refer to It enables;Wherein, one or two module 12 is used for: by first instruction behavioural information and institute of machine instruction during being performed The second instruction behavioural information that virtualization instructions are resolved when executing in reference device is stated to be matched.Here, relevant operation Same or similar with embodiment illustrated in fig. 1, so it will not be repeated, is incorporated herein by reference.
Fig. 3 has gone out the exemplary system that can be used for implementing each embodiment described herein.
If Fig. 3 shows in some embodiments, system 300 can be as any one equipment in each embodiment.In In some embodiments, system 300 may include one or more computer-readable mediums with instruction (for example, system storage Or NVM/ stores equipment 320) and coupled with the one or more computer-readable medium and be configured as executing instruction with reality Now module is thereby executing the one or more processors of movement described herein (for example, (one or more) processor 305)。
For one embodiment, system control module 310 may include any suitable interface controller, with to (one or It is multiple) at least one of processor 305 and/or any suitable equipment or component that communicate with system control module 310 mentions For any suitable interface.
System control module 310 may include Memory Controller module 330, to provide interface to system storage 315.It deposits Memory controller module 330 can be hardware module, software module and/or firmware module.
System storage 315 can be used for for example, load of system 300 and storing data and/or instruction.For a reality Example is applied, system storage 315 may include any suitable volatile memory, for example, DRAM appropriate.In some embodiments In, system storage 315 may include four Synchronous Dynamic Random Access Memory of Double Data Rate type (DDR4SDRAM).
For one embodiment, system control module 310 may include one or more input/output (I/O) controller, with Equipment 320 is stored to NVM/ and (one or more) communication interface 325 provides interface.
For example, NVM/ storage equipment 320 can be used for storing data and/or instruction.NVM/ storage equipment 320 may include appointing It anticipates nonvolatile memory appropriate (for example, flash memory) and/or to may include that any suitable (one or more) is non-volatile deposit Equipment is stored up (for example, one or more hard disk drives (HDD), one or more CD (CD) drivers and/or one or more Digital versatile disc (DVD) driver).
NVM/ storage equipment 320 may include a part for the equipment being physically mounted on as system 300 Storage resource or its can by the equipment access without a part as the equipment.For example, NVM/ storage equipment 320 can It is accessed by network via (one or more) communication interface 325.
(one or more) communication interface 325 can be provided for system 300 interface with by one or more networks and/or with Other any equipment communications appropriate.System 300 can be according to any mark in one or more wireless network standards and/or agreement Quasi- and/or agreement is carried out wireless communication with the one or more components of wireless network.
For one embodiment, at least one of (one or more) processor 305 can be with system control module 310 The logic of one or more controllers (for example, Memory Controller module 330) is packaged together.For one embodiment, (one It is a or multiple) at least one of processor 305 can encapsulate with the logic of one or more controllers of system control module 310 Together to form system in package (SiP).For one embodiment, at least one of (one or more) processor 305 It can be integrated on same mold with the logic of one or more controllers of system control module 310.For one embodiment, At least one of (one or more) processor 305 can be with the logic of one or more controllers of system control module 310 It is integrated on same mold to form system on chip (SoC).
In various embodiments, system 300 can be, but not limited to be: server, work station, desk-top calculating equipment or movement Calculate equipment (for example, lap-top computing devices, hold calculate equipment, tablet computer, net book etc.).In various embodiments, System 300 can have more or fewer components and/or different frameworks.For example, in some embodiments, system 300 includes One or more video cameras, keyboard, liquid crystal display (LCD) screen (including touch screen displays), nonvolatile memory port, Mutiple antennas, graphic chips, specific integrated circuit (ASIC) and loudspeaker.
Present invention also provides a kind of computer readable storage medium, the computer-readable recording medium storage has calculating Machine code, when the computer code is performed, such as preceding described in any item methods are performed.
Present invention also provides a kind of computer program products, when the computer program product is executed by computer equipment When, such as preceding described in any item methods are performed.
Present invention also provides a kind of computer equipment, the computer equipment includes:
One or more processors;
Memory, for storing one or more computer programs;
When one or more of computer programs are executed by one or more of processors so that it is one or Multiple processors realize such as preceding described in any item methods.
It should be noted that the application can be carried out in the assembly of software and/or software and hardware, for example, can adopt With specific integrated circuit (ASIC), general purpose computer or any other realized similar to hardware device.In one embodiment In, the software program of the application can be executed to implement the above steps or functions by processor.Similarly, the application Software program (including relevant data structure) can be stored in computer readable recording medium, for example, RAM memory, Magnetic or optical driver or floppy disc and similar devices.In addition, hardware can be used to realize in some steps or function of the application, example Such as, as the circuit cooperated with processor thereby executing each step or function.
In addition, a part of the application can be applied to computer program product, such as computer program instructions, when its quilt When computer executes, by the operation of the computer, it can call or provide according to the present processes and/or technical solution. Those skilled in the art will be understood that the existence form of computer program instructions in computer-readable medium includes but is not limited to Source file, executable file, installation package file etc., correspondingly, the mode that computer program instructions are computer-executed include but Be not limited to: the computer directly execute the instruction or the computer compile the instruction after execute program after corresponding compiling again, Perhaps the computer reads and executes the instruction or after the computer reads and install and execute corresponding installation again after the instruction Program.Here, computer-readable medium can be for computer access any available computer readable storage medium or Communication media.
Communication media includes whereby including, for example, computer readable instructions, data structure, program module or other data Signal of communication is transmitted to the medium of another system from a system.Communication media may include having the transmission medium led (such as electric Cable and line (for example, optical fiber, coaxial etc.)) and can propagate wireless (not having the transmission the led) medium of energy wave, such as sound, electricity Magnetic, RF, microwave and infrared.Computer readable instructions, data structure, program module or other data can be embodied as example wireless Medium (such as carrier wave or be such as embodied as spread spectrum technique a part similar mechanism) in modulated message signal. Term " modulated message signal " refers to that one or more feature is modified or is set in a manner of encoded information in the signal Fixed signal.Modulation can be simulation, digital or Hybrid Modulation Technology.
As an example, not a limit, computer readable storage medium may include such as computer-readable finger for storage Enable, the volatile and non-volatile that any method or technique of the information of data structure, program module or other data is realized, can Mobile and immovable medium.For example, computer readable storage medium includes, but are not limited to volatile memory, such as with Machine memory (RAM, DRAM, SRAM);And nonvolatile memory, such as flash memory, various read-only memory (ROM, PROM, EPROM, EEPROM), magnetic and ferromagnetic/ferroelectric memory (MRAM, FeRAM);And magnetic and optical storage apparatus (hard disk, Tape, CD, DVD);Or other currently known media or Future Development can store the computer used for computer system Readable information/data.
Here, including a device according to one embodiment of the application, which includes for storing computer program The memory of instruction and processor for executing program instructions, wherein when the computer program instructions are executed by the processor When, trigger method and/or technology scheme of the device operation based on aforementioned multiple embodiments according to the application.
It is obvious to a person skilled in the art that the application is not limited to the details of above-mentioned exemplary embodiment, Er Qie In the case where without departing substantially from spirit herein or essential characteristic, the application can be realized in other specific forms.Therefore, no matter From the point of view of which point, the present embodiments are to be considered as illustrative and not restrictive, and scope of the present application is by appended power Benefit requires rather than above description limits, it is intended that all by what is fallen within the meaning and scope of the equivalent elements of the claims Variation is included in the application.Any reference signs in the claims should not be construed as limiting the involved claims.This Outside, it is clear that one word of " comprising " does not exclude other units or steps, and odd number is not excluded for plural number.That states in device claim is multiple Unit or device can also be implemented through software or hardware by a unit or device.The first, the second equal words are used to table Show title, and does not indicate any particular order.

Claims (12)

1. a kind of method of identification terminal simulator is applied to user equipment, wherein the described method includes:
One or more virtualization instructions are executed by the virtual machine parsing in the user equipment, wherein every virtualization refers to It enables and corresponds to a machine instruction and as executing obtained by virtualization process to the machine instruction;
First instruction behavioural information of the virtualization instructions in resolved implementation procedure is being joined with the virtualization instructions The second instruction behavioural information when being resolved execution in equipment is examined to be matched;
The device type information of the reference device is obtained, if the device type information indicates that the reference device is terminal mould Quasi- device, and the first instruction behavioural information matches with the second instruction behavioural information, identifies the user equipment for eventually Hold simulator.
2. according to the method described in claim 1, wherein, the method also includes following at least any one:
If it is physical end equipment that the device type information, which indicates the reference device, and the first instruction behavioural information with The second instruction behavior information mismatch identifies that the user equipment is terminal emulator;
If the device type information indicates that the reference device is terminal emulator, and described first instructs behavioural information and institute The second instruction behavior information mismatch is stated, identifies that the user equipment is physical end equipment;
If it is physical end equipment that the device type information, which indicates the reference device, and the first instruction behavioural information with The second instruction behavioural information matches, and identifies that the user equipment is physical end equipment.
3. according to the method described in claim 1, wherein, the method also includes:
According to the device type information of the reference device, the device type information of the terminal emulator is determined.
4. according to the method described in claim 1, wherein, the device type information for obtaining the reference device, if described Device type information indicates that the reference device is terminal emulator, and the first instruction behavioural information and described second instructs Behavioural information matches, and identifies that the user equipment is terminal emulator, comprising:
Obtain the device type information of the reference device, if the device type information indicate the reference device be based on The terminal emulator of intel framework, and the first instruction behavioural information matches with the second instruction behavioural information, identifies The user equipment is the terminal emulator based on intel framework.
5. according to the method described in claim 1, wherein, the method also includes:
If the user equipment is terminal emulator, it will test result and be sent to the network equipment, for network equipment label The corresponding one or more equipment behaviors of the user equipment.
6. according to the method described in claim 1, wherein, if the virtual machine is located at the target application on the user equipment In;
Wherein, the method also includes:
If the user equipment is terminal emulator, one or more functions in the target application are disabled.
7. according to the method described in claim 1, wherein, the virtual machine parsing by the user equipment executes one Or a plurality of virtualization instructions, wherein every virtualization instructions correspond to a machine instruction and by executing to the machine instruction Obtained by virtualization process, comprising:
One or more virtualization instructions are executed by the virtual machine parsing in the user equipment, wherein every virtualization refers to Order corresponds to a machine instruction and as executing obtained by virtualization process to the machine instruction, the quantity of the virtualization instructions Meet scheduled amount threshold.
8. according to the method described in claim 1, wherein, if the virtual machine is located at the target application on the user equipment In;
Wherein, the virtual machine parsing by the user equipment executes one or more virtualization instructions, wherein every Virtualization instructions correspond to a machine instruction and as executing obtained by virtualization process to the machine instruction, comprising:
Be installed event in response to the target application, by the parsing of virtual machine in the user equipment execute one or A plurality of virtualization instructions, wherein every virtualization instructions correspond to a machine instruction and by executing void to the machine instruction Quasi-ization processing gained.
9. according to the method described in claim 1, wherein, if the virtual machine is located in target application;
Wherein, the virtual machine parsing by the user equipment executes one or more virtualization instructions, wherein every Virtualization instructions correspond to a machine instruction and as executing obtained by virtualization process to the machine instruction, comprising:
Event is completed in update in response to the target application, by the parsing of virtual machine in the user equipment execute one or A plurality of virtualization instructions, wherein every virtualization instructions correspond to a machine instruction and by executing void to the machine instruction Quasi-ization processing gained.
10. according to the method for claim 8 or 9, wherein the virtual machine parsing by the user equipment executes one Or a plurality of virtualization instructions, comprising:
Inverse virtualization process is executed to one or more virtualization instructions by the virtual machine in the user equipment, explanation obtains One or more machine instruction corresponding with the virtualization instructions;
The machine instruction is executed by the virtual machine;
Wherein, the first instruction behavioural information and the virtualization by the virtualization instructions in resolved implementation procedure Instruction is resolved the second instruction behavioural information when executing in reference device and is matched, comprising:
By first instruction behavioural information of machine instruction during being performed with the virtualization instructions in reference device In be resolved execute when second instruction behavioural information matched.
11. a kind of equipment of identification terminal simulator, wherein the equipment includes:
Processor;And
It is arranged to the memory of storage computer executable instructions, the executable instruction makes the processor when executed Execute the operation such as any one of claims 1 to 10 the method.
12. a kind of computer-readable medium of store instruction, described instruction makes system carry out such as claim 1 when executed To the operation of any one of 10 the methods.
CN201910774713.6A 2019-08-21 2019-08-21 Method and equipment for identifying terminal simulator Active CN110516447B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201910774713.6A CN110516447B (en) 2019-08-21 2019-08-21 Method and equipment for identifying terminal simulator

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201910774713.6A CN110516447B (en) 2019-08-21 2019-08-21 Method and equipment for identifying terminal simulator

Publications (2)

Publication Number Publication Date
CN110516447A true CN110516447A (en) 2019-11-29
CN110516447B CN110516447B (en) 2022-02-11

Family

ID=68627085

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201910774713.6A Active CN110516447B (en) 2019-08-21 2019-08-21 Method and equipment for identifying terminal simulator

Country Status (1)

Country Link
CN (1) CN110516447B (en)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112379967A (en) * 2020-11-12 2021-02-19 北京字节跳动网络技术有限公司 Simulator detection method, device, equipment and medium
CN112559328A (en) * 2020-12-04 2021-03-26 北京字节跳动网络技术有限公司 Method, device, equipment and medium for judging instruction simulation engine
CN113282304A (en) * 2021-05-14 2021-08-20 杭州云深科技有限公司 System for identifying virtual machine based on app installation list
CN114706630A (en) * 2022-04-14 2022-07-05 上海上讯信息技术股份有限公司 Method and system for identifying simulator based on file format

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102254120A (en) * 2011-08-09 2011-11-23 成都市华为赛门铁克科技有限公司 Method, system and relevant device for detecting malicious codes
CN103902910A (en) * 2013-12-30 2014-07-02 北京奇虎科技有限公司 Method and device for detecting malicious codes in intelligent terminal
CN107704760A (en) * 2017-09-30 2018-02-16 北京梆梆安全科技有限公司 A kind of simulator detection method, device and equipment based on bottom instruction
CN107908952A (en) * 2017-10-25 2018-04-13 广州优视网络科技有限公司 Identify the method, apparatus and terminal of prototype and simulator
US20190088099A1 (en) * 2017-09-18 2019-03-21 Comcast Cable Communications, Llc Automatic Presence Simulator For Security Systems
CN109948308A (en) * 2019-03-13 2019-06-28 智者四海(北京)技术有限公司 Code security guard method, device, electronic equipment and computer readable storage medium

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102254120A (en) * 2011-08-09 2011-11-23 成都市华为赛门铁克科技有限公司 Method, system and relevant device for detecting malicious codes
CN103902910A (en) * 2013-12-30 2014-07-02 北京奇虎科技有限公司 Method and device for detecting malicious codes in intelligent terminal
US20190088099A1 (en) * 2017-09-18 2019-03-21 Comcast Cable Communications, Llc Automatic Presence Simulator For Security Systems
CN107704760A (en) * 2017-09-30 2018-02-16 北京梆梆安全科技有限公司 A kind of simulator detection method, device and equipment based on bottom instruction
CN107908952A (en) * 2017-10-25 2018-04-13 广州优视网络科技有限公司 Identify the method, apparatus and terminal of prototype and simulator
CN109948308A (en) * 2019-03-13 2019-06-28 智者四海(北京)技术有限公司 Code security guard method, device, electronic equipment and computer readable storage medium

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112379967A (en) * 2020-11-12 2021-02-19 北京字节跳动网络技术有限公司 Simulator detection method, device, equipment and medium
CN112379967B (en) * 2020-11-12 2023-11-03 抖音视界有限公司 Simulator detection method, device, equipment and medium
CN112559328A (en) * 2020-12-04 2021-03-26 北京字节跳动网络技术有限公司 Method, device, equipment and medium for judging instruction simulation engine
CN113282304A (en) * 2021-05-14 2021-08-20 杭州云深科技有限公司 System for identifying virtual machine based on app installation list
CN113282304B (en) * 2021-05-14 2022-04-29 杭州云深科技有限公司 System for identifying virtual machine based on app installation list
CN114706630A (en) * 2022-04-14 2022-07-05 上海上讯信息技术股份有限公司 Method and system for identifying simulator based on file format

Also Published As

Publication number Publication date
CN110516447B (en) 2022-02-11

Similar Documents

Publication Publication Date Title
CN110516447A (en) A kind of method and apparatus of identification terminal simulator
Deitel Java how to program
CN101976202B (en) Method and device for use of multiple virtual machine monitors to handleprivileged events
US10360322B2 (en) Simulation of virtual processors
US10255086B2 (en) Determining optimal methods for creating virtual machines
CN109597677A (en) Method and apparatus for handling information
CN105893234A (en) Method for software testing and computing device
CN113127050B (en) Application resource packaging process monitoring method, device, equipment and medium
US20230236959A1 (en) Controlled input/output in progress state during testcase processing
CN105453033A (en) Program testing service
US10565000B2 (en) Method and apparatus for online upgrade of kernel-based virtual machine module
CN110597597B (en) Method, system, device and storage medium for virtualization of hardware
CN109460187A (en) A kind of qcow2 file data consistency verification method and verifying terminal
US20160092313A1 (en) Application Copy Counting Using Snapshot Backups For Licensing
CN111367799B (en) Method, device, medium and electronic equipment for locating source code breakdown position
US11205092B2 (en) Clustering simulation failures for triage and debugging
CN111385661B (en) Method, device, terminal and storage medium for voice control of full screen playing
CN116540929A (en) Virtualized reading method and device of disk array, electronic equipment and storage medium
US10445218B2 (en) Execution of graphic workloads on a simulated hardware environment
CN115374017A (en) Method for capturing site during simulation running of executable file and computing equipment
CN107861795A (en) Method, system, device and the readable storage medium storing program for executing of analog physical TCM chips
CN115185638A (en) Method for acquiring call stack during simulation running of application program and computing equipment
US11501046B2 (en) Pre-silicon chip model of extracted workload inner loop instruction traces
US9274791B2 (en) Verification of a vector execution unit design
CN108255570A (en) Virtual machine migration method, device and system between isomery virtual machine monitor platform

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant