验证指令执行顺序的算法
我想编写一些简单的代码来帮助确定某些指令是否已按客户端的预期顺序执行。这对于任何希望通过编辑字节代码来改变行为的人来说都是困难的。例如，使用 JMP，因此某些指令永远不会执行。不过我的想法有点缺乏。
要检查最后两条指令是否已按正确的顺序运行，可以使用类似这样的简单内容（伪代码）：
// Variables initialized by server
int lastInt;
// Monitored at regular intervals
// Saves using callback which could be tampered with
boolean bSomethingFishyHere;
int array[20]
...
execute( array[5], doStuff1() )
execute( array[6], doStuff2() )
...
// This could be tested remotely with all combinations of values possible
execute( int i, boolean b ){
if( lastInt >= i ){
bSomethingFishyHere = true;
}
lastInt = i;
}
我不知道可以使用什么方法来验证是否全部但指令已按正确的顺序运行。也许我可以添加一个数组，并由服务器用一些随机升序的数字填充它，或者使用某种排序校验和。您有什么建议？
I'd like to write some simple code that helps to determine if some instructions have been executed in the intended order client-side. This is to make things difficult for anyone wishing to alter behaviour by editing byte code. For example, using a JMP so some instructions are never executed. I'm a bit short on ideas though.
To check if the last two instructions have been run in the correct order something simple like this could be used (pseudo code):
// Variables initialized by server
int lastInt;
// Monitored at regular intervals
// Saves using callback which could be tampered with
boolean bSomethingFishyHere;
int array[20]
...
execute( array[5], doStuff1() )
execute( array[6], doStuff2() )
...
// This could be tested remotely with all combinations of values possible
execute( int i, boolean b ){
if( lastInt >= i ){
bSomethingFishyHere = true;
}
lastInt = i;
}
I'm at a loss at to what approach could be used to verify if all instructions have been run in the correct order though. Maybe I could add an array and have it populated by the server with some randomly ascending numbers or use some sort checksum. What are your suggestions?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
问题是，无论您进行哪种记账，恶意用户总是可以进行相同的记账，但跳过实际执行的操作。如果你能做到，他们也能。您可以依靠外部机制，例如代码签名来确保您的可执行文件未被篡改，以及 CPU 保护来防止内存中代码的动态修改。但在这种情况下，您的安全性取决于您所运行的平台。
我假设这是某种复制保护方案。 （如果没有，请随时纠正我，你可能会得到一些更好、更适用的建议）。没有一种万无一失的方法可以阻止某人运行您的软件，但是您可以许可供应商已经投入足够精力的现有方案，因此在大多数情况下，攻击者不值得打扰。
一种几乎万无一失的方法是您可以控制代码。在服务器上运行代码的真正内容，并提供某种前端远程客户端。
The problem is, that no matter what kind of book-keeping you do, a malicious user can always do the same book-keeping, but skip over the actual doing stuff. If you can do it, so can they. You can rely on external mechanisms, like code-signing to ensure that your executable hasn't been tampered with and CPU protections to prevent on-the-fly modification of the code in memory. But in that case you're only as secure as the platform you're running on.
I'm assuming this is some sort of copy-protection scheme. (If not, feel free to correct me, and you might get some better, more applicable advice). There isn't a fool-proof way to prevent someone from running your software, but you can license an existing scheme where the vendor has already put enough effort into it, that it's not worth it for an attacker to bother, for the most part.
The one way that is pretty much fool-proof, is if you control the code. Run the real meat of the code on your servers, and provide some sort of front end remote client.
如果您确实需要短期补丁，则一种更实用的方法（比您正在查看的方法）是将加密的字节码发送到客户端并使用特殊的类加载器动态解密它们。但请注意，对于黑客来说，对类加载器进行逆向工程、获取客户端字节码并修改它们以安装作弊程序并不困难。
所以我的建议是，任何阻止用户篡改字节码的客户端“补丁”都永远不会防黑客。跳过这个想法，直接转向重新架构游戏的长期解决方案，这样就不必相信客户端代码会遵守规则。
If you do want a short-term patch, a more practical approach (than the one you are looking at) would to send encrypted bytecodes to the client and using a special classloader to decrypt them on the fly. Beware however that it wouldn't be that difficult for a hacker to reverse engineer the classloader, get hold of the client-side bytecodes, and modify them to install the cheats.
So my advice is that any client-side "patch" to stop users tampering with the bytecodes is never going to be hack-proof. Skip that idea, and go straight to your long term solution of rearchitecting the game so that it is not necessary to trust that the client-side code plays by the rules.