Multi-threaded detection of a game software debugger

• US 8,286,138 B2
• Filed: 01/30/2007
• Issued: 10/09/2012
• Est. Priority Date: 01/30/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Sabella, Vito, Khoo, Aaron, Henry, Johnathon Christopher, Gu, Chao, Thompson, Ray
• Primary Examiner(s): MITCHELL, JASON D
• Application Number:
  US11/669,095
• Publication Number:
  US 20080184239A1
• Time in Patent Office: 2,079 Days
• Field of Search: None
• US Class Current: 717/127
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation

Abstract

An anti-debugging mechanism is implemented into a game application, such that the anti-debugging mechanism is difficult to detect, difficult to bypass, and difficult to remove. The anti-debugging mechanism is implemented in a simulated thread pool. The anti-debugging mechanism executes on a different thread than the thread on which the game application executes and is randomly activated. When a debugger is detected, the performance of the debugger is hindered by halting the game application on a different thread than the game thread. Further, a period of time is allowed to elapse before the game application is halted.

Claims

1. A method comprising:

executing a game application on a first game thread of a system;

implementing a debugger detector on a second thread of the system, wherein the second thread differs from the first game thread and is separated from the first game thread by a thread boundary;

determining if a debugger is attached to the game application;

if it is determined that a debugger is attached to the game application;

hindering performance of the detected debugger, the hindering comprising halting a third thread that is randomly selected from a simulated thread pool of the system.

2. A method in accordance with claim 1, further comprising allowing an amount of time to elapse between determining a debugger is attached to the game application and hindering performance of the debugger.

3. A method in accordance with claim 2, wherein the amount of time is randomly determined.

4. A method in accordance with claim 2, wherein the amount of time comprises a predetermined amount of time.

5. A method in accordance with claim 2, wherein the amount of time is determined in accordance with an event occurring in the system.

6. A method in accordance with claim 1, wherein the second thread is selected from a simulated thread pool.

7. A method in accordance with claim 1, wherein the step of determining if a debugger is attached to the game application is performed at random times.

8. A method in accordance with claim 1, wherein the step of determining if a debugger is attached to the game application is performed in accordance with resource availability of the system.

9. A device comprising:

memory comprising executable instructions;

a game application implemented on a first thread of the device,

a debugger detector implemented on a second thread of the device, the second thread separated from the first thread by a thread boundary; and

a processor coupled to the memory, the processor configured to execute the executable instructions to;

determine if a debugger is attached to the game application; and

if it is determined that a debugger is attached to the game application, obfuscate execution of the game application by shutting down a third thread that is randomly selected from a simulated thread pool of the system.

10. A device in accordance with claim 9, the device further configured to allow an amount of time to elapse between determining a debugger is attached to the game application and performing one of halting the game application or obfuscating the execution of the game application.

11. A device in accordance with claim 10, wherein the amount of time is randomly determined.

12. A device in accordance with claim 10, wherein the amount of time comprises a predetermined amount of time.

13. A device in accordance with claim 10, wherein the amount of time is determined in accordance with an event occurring in the device.

14. A device in accordance with claim 9, wherein the device is configured to determine, at random times, if a debugger is attached to the game application.

15. A device in accordance with claim 9, wherein the device is configured to periodically determine if a debugger is attached to the game application.

16. A device in accordance with claim 9, wherein the device is configured to determine if a debugger is attached to the game application in accordance with resource availability of the device.

17. A computer-readable storage medium that is not a signal, the computer-readable storage medium having stored thereon computer-executable instructions for performing the steps of:

utilizing a debugger detector to determine if a debugger is attached to a game application executed on a first thread of a system, the debugger detector implemented on a simulated thread that differs from the first thread; and

if it is determined that a debugger is attached to the game application;

hindering performance of the detected debugger, the hindering comprising halting a third thread that is randomly selected from a simulated thread pool of the system.

18. A computer-readable storage medium in accordance with claim 17, the computer-executable instructions further for allowing an amount of time to elapse between determining a debugger is attached to the game application and hindering performance of the detected debugger.