What should I do to take cheat measures? Security Solution Development Company DNP Hypertech Inspires Cheat Actual Condition and Properties (Part 2)

DNP Hypertech, develops and sells antichto crack security tools "CrackProof", the post-interview interview that listens to the cheat. In the first part, I taught about the case and nature of the cheat. The second part tells me how to take the cheat.

-can you tell me more about cheat measures?

• • Mr. Sayama: ** We are considered to divide the analysis into two types. Static analysis to analyze files without doing anything. And it is divided into dynamic analysis to analyze while moving the program. It is not our segmentation, but it is a word that is not used very much.

Encrypt the entire file as a static analysis measure. If you do so, no valid code will come out. This encryption is very strong because it takes several layers. As a measure of dynamic analysis, it is blocking of execution on the emulator, the attachment of the debugger, and the memory access from the external process. Depending on the cheat tool, there is a way to rewrite the memory while moving the program. Such things are basically there is a matter basically that you can protect the memory.

In the case of great deals, it will be the concept that you can protect the program by taking measures. Of course, there is a detailed story that this alone is not enough or not at the driver level, but as a basic idea, "file is encrypted" and "protecting from outside" will not be parsed, memory that is not parsed It is an idea that it can not be changed.

Mr. Tsuruhisa: After that, the necessary measures will change depending on the platform, so we follow that point. If Windows doesn't have to do something with a driver.

- Is there a pillar idea, and other fine points are the form of individual support individually?

Mr. Tsuruhisa: That's right, there is a part that you think about the measures of the emulator will be what will happen in the future. Virtualization technology has been developed and there is a place where you can continue to be such stance when virtualization technology penetrates on the client side.

• • Mr. Sayama: ** The emulator is no longer for attacks that operate on the emulator, ie, the inside of the emulator, but the emulator is unprotected against the Windows OS side or the out-of-emulator. In that sense, I think that emulator is not good from security perspective, but if there is a place to forgive you, it is possible that there is no way to forgive you. If it is a Windows game, it is unrelated to the emulator, but the smartphone game is a major issue to what to think about the behavior of the emulator.

-The idea of ​​the basic protection is the service provided by DNP Hypertech, and doesn't even change with smartphones or smartphones.

• • Mr. Sayama: ** I agree. However, iOS is a bit special. Excluding iOS "CrackProof" is a mechanism that directly converts the compilation with the end of the compilation. However, only iOS is a source built-in type. For example, IOS is likely to have sandbox constraints because the restrictions on App Store's examination standard are very severe. The scope of protection is slightly narrow compared to other "CrackProof" due to the effect. However, it is not so because it is dangerous, but Apple has been firmly complemented with such points as it is not JAILBREAK as I said earlier. Totally there is a similar function to other protects. By the way, iOS has a simulator, but there is no emulator (laughs).

- As a PC user, the load to the client is anxious. What is the load applied by introducing "CrackProof"?

• • Mr. Sayama: ** Some loads apply at startup. It's up to the program, so it can not be said in average, but is it about 10% on average? Several percentage is said by customers. In other words, it means that it costs about several% to 10% at startup. Since it is originally encrypted, the task of decoding it will be decoded, and it takes some load. However, the load being executed is almost zero.

Mr. Tsuruhisa: If there is almost no loading load, you can use it with confidence even in a game that is required for high response like FPS. From the customers who changed, they are said to be lighter in the industry.

- Please tell us about the introduction part of "CrackProof". I think there are various packages, but can you tell me the procedure for incorporating in a common mobile game?

Mr. Tsuruhisa: Even if it is Android, it is a form that converts the binary directly for Windows, so the work of your customers only needs to upload your executable file to our cloud server. After that, security is automatically added.

• • Mr. Sayama: ** For Android Files, upload and convert APK files and download. For Windows, you can download EXE and DLL. There are many financial work, but basically this is such a flow. However, iOS requires an incorporation of an activation process that enables error notification functions and security features to Xcode projects. By the way, in the activation process, other CARCKPROOF is like upload and downloaded the app to the cloud server. I think that it is not a day if you get used to it. Is it about 10 minutes to 15 minutes for a long time?

- Whether the process changes even in Unity?

• • Mr. Sayama: ** Basically it does not change. However, the Unity's IOS app is output as an Xcode project, so you have to incorporate an error notification function and activation process each time each build. This makes time and effort when using Jenkins, so it is considered to fully automate from the embedded to build from the Crackproof for ios to build.

- Can the embedded procedure even after updating the app etc.?

Mr. Tsuruhisa: There is no problem if you upload the version upgrade app. If you build a project and automatically process the project, a company that is automatically built the mechanism of processing with "CrackProof" is also good.

- How much is the time required for that work?

• • Mr. Sayama: ** Because it is based on the Internet environment, it can not be said in general. Communication with the server is the sum of uploading and downloading and translation processing time. Recently, there was a person who uploaded an 800 MB app made for testing, but it was really time. Is it about 30 minutes to one hour in round trip? However, since the size that can be uploaded to Google Play is a definition of 100 MB, is it about 2 to 3 minutes if about 100 MB.

- If you feel that you heard the story, the introduced image is an image from the launch of the title, is it possible to introduce the existing title?

• • Mr. Sayama: ** can. However, there may be no effect. As I said earlier, there is no function to directly protect the data. The work that has already been encrypted in the past is the same form, as it is the same form for encryption as well as "CrackProof", so it does not change. Please change the cryptographic form with the introduction and set of "CrackProof".

- If you introduce "CrackProof", you can respond to the trouble that occurred before such introduction.

• • Mr. Sayama: ** Rather, it is a service including support. I think it is not a sold out package product, not a service that is served with customers.

Mr. Tsuruhisa: It is not an end to sell. It will be a selling-stalk-like story, but it can be supported directly by the manufacturer and our company is a company in Japan, so it is a major selling that rapid support can be provided without time difference for Japanese customers think.

• • Mr. Sayama: ** Since it was a company's product, I did not want to say much negative things, but I have a sacrificing aspect that I would like to strengthen security as I would like to express. In the case of mobile games, the device that does not move by introducing comes out with some probability. For example, we have focused on lead terminals such as domestic career terminals, especially Xperia and Galaxy, and lead terminals such as Nexus and Pixel, but foreign terminals such as Xiaomi and Nokia are not checked and do not work there is. Other There are also reports that were in the root state at the factory point and did not work.

If it was Windows, the PC may have been infected with a virus and did not move. There is a point that there is something that will not move in a few ways to introduce security in this way. However, the part is often important for customers, so it will be supported if you can not move.

-As an example of introduction, is it more than in the case of pre-prevention and what is already happening?

Mr. Tsuruhisa: There are both. In preventive purposes, marketing investments are often conducted and often considered in titles that are expecting earnings. In this case I believe that it is introduced for insurer reasons. On the other hand, if there is actual damage, it is introduced as a drug. The user has hits and the user is growing, but a little fraud is noticeable, and the review column has also been rough, and it has been exactly exerted by using the exactly medicine in the situation.

Mr. Kobayashi: If you have any damage, you may also consider introducing them in later titles. Recently, the cycle of the app is shorter and there are several years of the year, so it starts with a consultation of one title, and there is a flow of taking measures from the next.

- Can you firmly support both cases?

Mr. Tsuruhisa: of course. If the damage is actually damaged, you also need to change the cryptographic method, so your needs will also occur. It is supported including that point. Consulting elements come in.

• • Mr. Sayama: ** Basically, as much support can be done, but there may be cases where there is no reproducibility. The case that only 1000 times will occur once, but it may not be refused, but if you can check the reproducibility here, you will definitely support it.

-Do you have a good title or a good title for the introduction of "CrackProof" and thinking about the past results?

• • Mr. Sayama: ** I think there are many things that are troubled. If you can change the parameters, it may not match a company that is troubled. Although it is a special case, there are also things that do not want to know the algorithm. I think that I would like to match the company that wants to implement an algorithm with a high machine density. If you are a company that is expecting FREE to Play as a revenue, you will feel what kind of company can feel.

Mr. Tsuruhisa: It will also be a sale top, but I think that Windows, Android and IOS also protect IOS. Multi-deviceization will be further standard, and it will be service used for smartphones and thinking of Windows as the next deployment, and it is satisfied because it can be a total of security for such customers. I think I can.

- Are Windows and Android, iOS, and Packages separately for sale?

Mr. Tsuruhisa: It will be different. If you have a volume, you are withdrawn. Going forward, it is also necessary to make a plan to fit the multi-device strategy.

-Tell me the benefits other than Anti-cheat by introducing other "CrackProof". I heard that the support of the pirated control crack is also served.

Mr. Tsuruhisa: I agree. The cracks also protect the same in direct and indirect ways. However, it may not be effective only by applying measures. First of all, I feel that I would like to know what customers want to protect.

• • Mr. Sayama: ** Tool A is strong but the tool B is not strong. It is based on general purpose to protect memory. We adopt how to protect from all tools and illegal activities.

Mr. Tsuruhisa: It can also take measures to the fact that the game will be imitated as it is. Because it is the same in that reverse engineering is prevented.

- If you have any announcement, please do notify you.

Mr. Tsuruhisa: I think that this article is already over, but I will exhibit at Game Developer Conference 2018. The console is also increasing the FREE to Play title, so we plan to release "CrackProof" corresponding to the console within the future.

• • Mr. Sayama: ** Since it is also possible to provide security in the game industry in the future, we will also consider console deployment as a roadmap, as it is also likely to provide security in the game industry. I hope you can consult us. thank you.

--thank you very much.

This interval is not directly related, but in fact, DNP Hypertech provided some cheat tools and analyzed their contents. The first tool is distributed free of charge on the Internet as a Cheat Tool of "H1Z1 Tool". This was found in .NET Framework and it was found to be a result fraudulent scam software that was disassembled. When started, it is a mechanism that flies to a specific site, showing a registration query to the user, and displays a password for inputting it to the tool. In fact, this password is fixed in "PASS 26" and if it is entered into the tool, "Unlock" "Connecting" does not occur. That is, it is dummy software intended to register as a member.

Next, I was analyzed for "PUBG Free Tool" distributed on a specific site, but it was also a fraudulent software. When you look at the file configuration, there is a file Hook.dll, and such files are generally used in the use of misconvention of DirectX, but if Mr. Sayama is analyzed, it is like an image file rather than an executable file. It is said that the evidence was seen. If you change the extension, it seems that this DLL file is a file that only to display "image" in the JPG file.

As a function, a screen to request the license key is displayed first when the application "PUBG FREE TOOL" is started, and a specific site is displayed when it is accepted. The tool prompts you to register the user at the site, but in the first place such member registration responds only when a specific string is entered, regardless of the license key. If you enter a license key, you repeat the movement of displaying a screen that is in load by 0.8 seconds, and the screen is displayed only that the license server has been blocked by the firewall. " After all, it was a fraudulent software for the purpose of making a member registration.

Using the cheat tool is, of course, not recommended as well, and it can be confirmed that there is a risk that the vendor will be made into a vendor if you use a free cheat tool. Such analysis is also referred to, and I want to keep a clean way to realize a cheat online game.