MULTI-THREADED DETECTION OF A GAME SOFTWARE DEBUGGER

• US 20080184239A1
• Filed: 01/30/2007
• Published: 07/31/2008
• Est. Priority Date: 01/30/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Thompson, Ray, Henry, Johnathon Christopher, Khoo, Aaron, Sabella, Vito, Gu, Chao
• Granted Patent: US 8,286,138 B2
• Time in Patent Office: Days
• US Class Current: 718/102
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation

Abstract

An anti-debugging mechanism is implemented into a game application, such that the anti-debugging mechanism is difficult to detect, difficult to bypass, and difficult to remove. The anti-debugging mechanism is implemented in a simulated thread pool. The anti-debugging mechanism executes on a different thread than the thread on which the game application executes and is randomly activated. When a debugger is detected, the performance of the debugger is hindered by halting the game application on a different thread than the game thread. Further, a period of time is allowed to elapse before the game application is halted.

Claims

1. A method for detecting a debugger attached to a game application, wherein the game application executes on a first thread of a system, the method comprising:

implementing a debugger detector on a second thread of the system, wherein the first thread differs from the second thread;

determining if a debugger is attached to the game application;

if it is determined that a debugger is attached to the game application;

hindering performance of the detected debugger via a third thread of the system, wherein the third thread differs from the first thread.

2. A method in accordance with claim 1, further comprising allowing an amount of time to elapse between determining a debugger is attached to the game application and hindering performance of the debugger.

3. A method in accordance with claim 2, wherein the amount of time is randomly determined.

4. A method in accordance with claim 2, wherein the amount of time comprises a predetermined amount of time.

5. A method in accordance with claim 2, wherein the amount of time is determined in accordance with an event occurring in the system.

6. A method in accordance with claim 1, wherein the third thread is randomly selected from a simulated thread pool of the system.

7. A method in accordance with claim 1, wherein the step of determining if a debugger is attached to the game application is performed periodically.

8. A method in accordance with claim 1, wherein the step of determining if a debugger is attached to the game application is performed randomly.

9. A method in accordance with claim 1, wherein the step of determining if a debugger is attached to the game application is performed in accordance with resource availability of the system.

10. A device for detecting a debugger attached to a game application, the device comprising:

the game application implemented on a first thread of the device,

a debugger detector implemented on a second thread of the device, wherein the first thread differs from the second thread, the device configured to;

determine if a debugger is attached to the game application; and

if it is determined that a debugger is attached to the game application;

perform on a third thread of the device, at least one of;

halt the game application; and

obfuscate execution of the game application, wherein the third thread differs from the first thread.

11. A device in accordance with claim 10, the device further configured to allow an amount of time to elapse between determining a debugger is attached to the game application and performing one of halting the game application and obfuscating the execution of the game application.

12. A device in accordance with claim 11, wherein the amount of time is randomly determined.

13. A device in accordance with claim 11, wherein the amount of time comprises a predetermined amount of time.

14. A device in accordance with claim 11, wherein the amount of time is determined in accordance with an event occurring in the device.

15. A device in accordance with claim 10, wherein the third thread is randomly selected from a simulated thread pool of the device.

16. A device in accordance with claim 10, wherein the device is configured to randomly determine if a debugger is attached to the game application.

17. A device in accordance with claim 10, wherein the device is configured to periodically determine if a debugger is attached to the game application.

18. A device in accordance with claim 10, wherein the device is configured to determine if a debugger is attached to the game application in accordance with resource availability of the device.

19. A computer-readable medium having stored thereon computer-executable instructions for detecting a debugger attached to a game application executing on a first thread of a system, by performing the steps of:

determining if a debugger is attached to the game application utilizing a debugger detector implemented on a second thread of the system, wherein the first thread differs from the second thread; and

if it is determined that a debugger is attached to the game application;

hindering performance of the detected debugger via a third thread of the system, wherein the third thread differs from the first thread.

20. A computer-readable medium in accordance with claim 19, the computer-executable instructions further for allowing an amount of time to elapse between determining a debugger is attached to the game application and hindering performance of the debugger.