Description:FIELD OF THE INVENTION
[0001] The present invention relates to methods and systems for detection of emulators. More particularly, the present invention relates to a computer-implemented method and system for the detection of the emulator in an operating device.
[0002] The operating device herein refers to personal computers (PC) or mobile devices.
BACKGROUND OF THE INVENTION
[0003] Nowadays, it is possible to run a software application on a variety of emulators of the Android operating system without any problems.
[0004] Attackers use various emulators to commit fraudulent activities.
[0005] The emulator means a device or a program for realizing a function of hardware or software by imitating a function of hardware or software with a different type of hardware or software.
[0006] Further, there are a number of known techniques such as AppGuard, that are used to distinguish the emulator execution environment from the real device.
[0007] These types of techniques detect the emulators by just looking up various names inside the execution environment. The names could be the Central processing unit (CPU) name, device driver name, file names, apps installed, etc.
[0008] Further, the Android emulators provide several pipes and devices to the operating device which are specific to the emulation environment for optimization. The existence of these artifacts would easily indicate an emulated environment.
[0009] Another technique by which the emulation environment may be detected, is by searching for the hardware capabilities of the device that would be missing in the emulation environment.
[0010] Many emulation environments do not completely emulate the entire sensor suit that may be found in the device, and for the sensors that the emulation environment attempts to emulate, the emulation environment may produce strange behaviors that may not be found if the device was the real operating device.
[0011] An invention for the detection of the emulator is disclosed in Korean Patent no. 101530533.
[0012] The said patent 533’ discloses a system for detecting whether a mobile application is running in an emulator execution environment. The system includes an application execution determination unit, a storage unit for storing a state value change characteristic, an essential device existence judging unit, and an emulator determination unit for determining whether the current execution environment is an emulator execution environment from the result of the essential device existence determination unit or the monitored device monitoring unit.
[0013] Another invention for the detection of the emulator is disclosed in United States patent no. 8307429.
[0014] The said patent 429’ discloses a method of determining that a software is running in a virtualized environment. The method includes obtaining a set of baseline measurements of system call timings in native operating system environments. Statistical thresholds are established.
[0015] Further, the method provides analysis of a protected software, and instructions are incorporated which are used to estimate the parameter values that are to be compared with the established statistical thresholds. Repeated comparisons are executed to determine whether the software is running in the emulated environment.
[0016] However, these known techniques have become common in the market and are relatively easy to bypass by modern emulators such as BlueStack.
[0017] Further, the modern emulators may also be used in personal computers (PC) despite having different hardware, processors, etc., from mobile devices.
[0018] Therefore, there is a need for a computer-implemented method and a system that may be capable of detecting old types of emulators as well as modern emulators.
[0019] Therefore, there is a need for a computer-implemented method and a system that may be capable of detecting old types of emulators as well as modern emulators.
[0020] Also, there is a need for a computer-implemented method and a system that may be capable of detecting emulators in PC.
[0021] Further, there is a need for a computer-implemented method and a system that may be capable of detecting the emulator without executing multiple instruction sets.
[0022] Furthermore, there is a need for a computer-implemented method and a system that may be capable of detecting the emulator without executing multiple instruction sets.
[0023] Additionally, there is a need for a computer-implemented method and a system that may be capable of executing the instruction set in such a manner as to prevent an emulator detection application from crashing.
[0024] Moreover, a computer-implemented method and a system are required which may be capable of detecting the emulator in an accurate and less time.
[0025] In a nutshell, a computer-implemented method and system are required which may overcome the drawbacks discussed above and provides an easy and efficient way to detect the emulator in the operating device.
SUMMARY OF THE INVENTION
[0026] In an aspect of a present invention, a computer-implemented method for the detection of an emulator in an operating device is disclosed.
[0027] In one embodiment of the present invention, the method includes generating an instruction set that includes an emulator detection code capable to be run on the one or more processors of the operating device.
[0028] In the embodiment of the present invention, the said operating device is one of a computer or a mobile device.
[0029] In one embodiment of the present invention, the method includes mapping the instruction set, with a plurality of flags to allocate a memory page.
[0030] In an exemplary embodiment of the present invention, the said instruction set is being mapped using the plurality of flags including anonymous mapping and private mapping.
[0031] Further, the method includes storing the said instruction set as an instruction cache based on an architecture of the one or more processors, in the said memory page.
[0032] In another embodiment of the present invention, the instruction set is mapped and stored as a data cache (D-cache).
[0033] In one embodiment of the present invention, the method includes executing the said mapped instruction set, by the one or more processors, for detection of the emulator in the operating device.
[0034] In the embodiment of the present invention, the said instruction set is being generated in such a way that the one or more processors perform operate only after executing the said mapped instruction set.
[0035] In the embodiment of the present invention, the execution of the said mapped instruction includes running the emulator detection code in a predetermined manner, thereby confirming the detection of the emulator in the operating device.
[0036] In one embodiment of the present invention, wherein the execution of the mapped instruction set does not result in a return value, thereby confirming the detection of a real operating device.
[0037] In another aspect of the present invention, the execution of the said mapped instruction set includes performing misaligned memory access operation in a loop which results in the prevention of fault signal, thereby confirming the detection of the emulator in the operating device.
[0038] In another embodiment of the present invention, the execution of the said mapped instruction set includes performing misaligned memory access operation in a loop which results in the generation of fault signals, thereby confirming the detection of the real operating device.
[0039] In yet another aspect of the present invention, a system is disclosed for the detection of the emulator in the operating device.
[0040] The system includes an application that is installed in the said operating device.
[0041] In the embodiment of the present invention, the said application has a generated instruction set that includes the emulator detection code.
[0042] In the embodiment of the present invention, the said instruction set is mapped, and stored as an instruction cache in the said memory page.
[0043] In one embodiment of the present invention, the said one or more processors of the operating device, are adapted to run the application for executing the said mapped instruction set.
[0044] In the embodiment of the present invention, the said instruction set is being generated in such a way that the one or more processors perform the operation only after executing the said mapped instruction set.
[0045] In one embodiment of the present invention, execution of the said mapped instruction comprises running the emulator detection code in a predetermined manner, thereby confirming the detection of the emulator in the operating device.
[0046] This together with the other aspects of the present invention along with the various features of novelty that characterize the present disclosure is pointed out with particularity in claims annexed hereto and forms a part of the present invention.
[0047] For a better understanding of the present disclosure, its operating advantages, and the specified objective attained by its uses, reference should be made to the accompanying descriptive matter in which there are illustrated exemplary embodiments of the present invention.
DESCRIPTION OF THE DRAWINGS
[0048] The advantages and features of the present invention will become better understood with reference to the following detailed description taken in conjunction with the accompanying drawings, in which:
[0049] Fig. 1 illustrates a flowchart representing a computer-implemented method for the detection of an emulator in an operating device, according to various embodiments of the present invention;
[0050] Fig. 2A illustrates a flow diagram showing the detection of the emulator determined by a translation block cache-based detection and misaligned vectorized-based detection, according to various embodiments of the present invention;
[0051] Fig. 2B illustrates a flow diagram showing the detection of a real operating device determined by a translation block cache-based detection and misaligned vectorized-based detection, according to various embodiments of the present invention; and
[0052] Fig. 3 illustrates a block diagram representing a system for carrying out the detection of the emulator in the operating device, according to various embodiments of the present invention.
[0053] Like numerals denote like elements throughout the figures.
DESCRIPTION OF THE INVENTION
[0054] The exemplary embodiments described herein detail for illustrative purposes are subjected to many variations. It should be emphasized, however, that the present invention is not limited to as disclosed.
[0055] It is understood that various omissions and substitutions of equivalents are contemplated as circumstances may suggest or render expedient, but these are intended to cover the application or implementation without departing from the spirit or scope of the present invention.
[0056] Specifically, the following terms have the meanings indicated below.
[0057] The terms “a” and “an” herein do not denote a limitation of quantity, but rather denote the presence of at least one of the referenced items.
[0058] The terms “having”, “comprising”, “including”, and variations thereof signify the presence of a component.
[0059] The present invention discloses a computer-implemented method for a detection of an emulator in an operating device.
[0060] The inventive aspects of the invention along with various components and logic involved will now be explained with reference to Figs. 1-3 herein.
[0061] Referring to Fig. 1, a flowchart is shown which represents the method (100) for detection of the emulator in the operating device (50), by translation block cache-based detection, and is explained in detail in the description below.
[0062] The operating device herein refers to personal computers (PC) or mobile devices.
[0063] More specifically, the computer-implemented method of the present invention is adapted for the detection of modern emulators.
[0064] The “emulator” herein refers to a device or a program for realizing a function of hardware or software by imitating a function of hardware or software with a different type of hardware or software.
[0065] The modern emulators are provided with an ARM translation layer such as “Libhoudini” for instruction translations and provide dynamic Translation Cache Block (TCB) and Tiny Code Generator (TCG) components.
[0066] Translation Cache Block (TCB) and Tiny Code Generator (TCG) are core components of any emulator.
[0067] The emulators (such as QEMU) in general adopt the concept of translation caching a so-called Translation Block Cache (TB- cache) that significantly enhances the emulation performance.
[0068] Each time when emulator translates a particular basic block of the guest program, the translated basic block (TB) is cached to avoid repeating the same translation process.
[0069] Further, if the execution flow of the program inside QEMU encounters the same guest basic block, the translation process may be omitted, and instead, the translated code from the TB cache may be executed. This caching mechanism significantly improves the performance of QEMU.
[0070] Referring to Fig. 1, at step (10), the method (100) involves generating an instruction set that includes an emulator detection code capable to be run on one or more processors (52) of the operating device (50).
[0071] In an embodiment of the present invention, the said instruction set is generated by an instruction-generating module (54a) of an emulator detection application (54) capable of being installed in the operating device (50).
[0072] In an embodiment of the present invention, the one or more processors (52) include 32-bit, 64-bit Advanced RISC Machine (ARM) processors, or x86 processors.
[0073] In an exemplary embodiment of the present invention, the said instruction set is generated for each 32-bit and 64-bit Advanced RISC Machine (ARM) processor.
[0074] At step (12), the method (100) further involves mapping the instruction set, with a plurality of flags, to allocate a memory page (refer Figs. 1 & 2A).
[0075] In the embodiment of the present invention, the plurality of flags includes anonymous mapping and private mapping.
[0076] Further, at step (14), the method (100) involves storing the said instruction set as an instruction cache (I-cache) based on an architecture of the one or more processors (52), in the said memory page (refer Figs. 1 & 2A).
[0077] In another embodiment of the present invention, the said instruction set is stored as an instruction cache.
[0078] Again, referring to Fig. 1, at step (16), the method (100) involves executing the said mapped instruction set, by the one or more processors (52), for the detection of the emulator in the operating device (50).
[0079] In the embodiment of the present invention, the said at least one instruction is being generated in such a way that the one or more processors (52) operate only after executing the said mapped instruction set.
[0080] In the embodiment of the present invention, the execution of the said mapped instruction set allows only those threads to operate which have mapped through a specific range of the memory page.
[0081] In the embodiment of the present invention, the execution of the said mapped instruction set includes running the emulator detection code in a predetermined manner, thereby confirming the detection of the emulator in the operating device (50) (refer Figs. 1 & 2A).
[0082] In one aspect of the present invention, the predetermined manner for running the said emulator detection code includes translation block cache-based detection (refer Figs. 1 & 2A).
[0083] In the embodiment of the present invention, the execution of the said mapped instruction set includes translating the emulator detection code compatible with the x86 processor or x86 processor, which results in a return value, thereby confirming the detection of the emulator in the operating device (50) as shown in step (16a).
[0084] In an exemplary embodiment of the present invention, during the execution of the instruction set in the x86 processor, if the return “ret” value is 1, this means that the operating device (50) is running in the emulator (refer Fig. 1).
[0085] More specifically, the instruction set is converted to the instruction compatible with the x86 processor or x64 processor, and modifies and executes the instruction cache segment of the instruction set thus it gives a “ret” value of 1.
[0086] In another embodiment of the present invention, the execution of the said mapped instruction while translating the emulation detection code does not return a value, thereby confirming the detection of the real operating device (50) i.e., a real Android device.
[0087] In the exemplary embodiment of the present invention, the instruction set is mapped and stored as a data cache, thereby automatically allowing the execution of the data cache segment of the instruction set, which does not return “ret” the value as 1, thereby confirming the detection of the real operating device (50) i.e., a real Android device (refer Fig. 2B).
[0088] In another aspect of the present invention, the predetermined manner for running the said emulator detection code includes translation block cache-based detection.
[0089] In the embodiment of the present invention, the execution of the said mapped instruction set includes performing misaligned memory access operation in a loop, which results in the prevention of fault signal, thereby confirming the detection of the emulator in the operating device (50) as shown in step 16b (refer Figs. 1 & 2A).
[0090] In another embodiment of the present invention, the execution of the said mapped instruction set includes performing the misaligned memory access operation in a loop, which generates one or more fault signals, thereby confirming the detection of the real operating device (50) refer Fig. 2B).
[0091] More specifically, for the misaligned vectorization-based detection, the emulator detection code is C++ code which has unsigned integers of different bits as data types for variables.
[0092] In an exemplary embodiment of the present invention, the unsigned integer of 16-bit is used, and when the ARM processor runs the said code, the processor judges the data type as 2-bit aligned and tries to fill the data according to the alignment, which results in segmentation (SIGSEGV) fault, thereby confirming the real operating device.
[0093] In one embodiment of the present invention, a customized fault signal handler is provided which captures and redirects the fault signals raised during the execution of the said instruction set.
[0094] In the embodiment of the present invention, the fault signal handler may not let the fault signal reach every thread of the application (54), thereby preventing application crashes.
[0095] In various embodiments of the present invention, the said instruction set is generated in such a way that said one or more processors (52) automatically consider the instruction set as the instruction cache (I-cache) or the data cache (D-cache), and thereby the said processors (52) automatically run the emulator detection code based on the architecture of the said processors (52).
[0096] In one embodiment of the present invention, a system (1000) is disclosed for executing the computer-implemented method described in the above paragraphs (refer Fig. 3).
[0097] More specifically, the system (1000) for the detection of the emulator in the operating device (50) is disclosed (refer Fig. 3).
[0098] In one embodiment of the present invention, the system (1000) includes an application (54) that is installed in the said operative device (50).
[0099] In the embodiment of the present invention, the said application (54) includes the instruction-generating module (54a) for generating an instruction set that includes the emulator detection code (refer Fig. 3).
[00100] In the embodiment of the present invention, the said instruction set is mapped, with a plurality of flags to allocate a memory page, and stored as an instruction cache in the said memory page.
[00101] In one embodiment of the present invention, the said one or more processors (52) of the operating device (50), are adapted to run the application (54) for executing the said mapped instruction set.
[00102] In the embodiment of the present invention, the said instruction set is being generated in such a way that the one or more processors (52) operate only after executing the said mapped instruction set.
[00103] In one embodiment of the present invention, execution of the said mapped instruction comprises running the emulator detection code in a predetermined manner, thereby confirming the detection of the emulator in the operating device (50).
[00104] In one embodiment of the present invention, the said predetermined manner includes the translation block cache-based detection as described in the above paragraphs.
[00105] In another embodiment of the present invention, the said predetermined manner includes the misaligned vectorization-based detection as described in the above paragraphs.
Advantageous Effects of the Invention
[00106] The computer-implemented method of the present invention is capable of detecting old types of emulators as well as modern emulators which use virtual box technology.
[00107] Further, the method of the present invention involves the execution of single instruction set only once for accurately detecting the emulator.
[00108] Further, the mapping of the instruction set as private || anonymous allows no restoration of the instruction set, thereby solving one of the biggest problems that no other address may be touched, and applications may never crash in any case.
[00109] Moreover, a computer-implemented method and a system are required which may be capable of detecting the emulator in an accurate and less time.
[00110] Moreover, the method of the present invention allows a creation of the memory page for the instruction set, and thereafter mapping the said instruction set in such a way that the processor of the operating device automatically considers the instruction set as cache, which reduces execution time without worrying of any vulnerability in other components of the application.
[00111] In addition, the method of the present invention allows the operating system of the computer to provide a required resource instead of manual operation, thereby never affecting the detection accuracy in case of context-switching.
[00112] In a nutshell, the computer-implemented method and system of the present invention, overcome the drawbacks discussed above and provide an easy and efficient way to detection of the emulator in the operating device.
[00113] The method, as described in the disclosed teachings or any of its components, may be embodied in the form of a computer-implemented method.
[00114] Typical examples of a computer included in the computer-implemented method include a general-purpose computer, a PDA, a cell phone, a programmed microprocessor, a microcontroller, a peripheral integrated circuit element, and other devices or arrangements of devices that are capable of implementing the steps that constitute the method of the disclosed teachings.
[00115] In a computer-implemented method using a general-purpose computer, such a general-purpose computer can include an input device such as a keyboard, a mouse, a trackball, a touchpad, a microphone, or a camera. The computer can include a display unit, such as a projector, a monitor, or a touch screen. A touch screen can also be used as an input device. Specifically, the computer of the computer-implemented method can comprise a hardware microprocessor, where the microprocessor is connected to a communication bus.
[00116] The computer-implemented method can also include memory; the memory can include Random Access Memory (RAM) and Read Only Memory (ROM).
[00117] The computer of the computer-implemented method can further comprise a non-transitory computer-readable medium such as a storage device, which can be a hard disk drive or a removable storage drive such as a flash drive, optical disk drive, and the like. The storage device can also comprise other similar means for loading computer programs or other instructions into the computer of the computer-implemented method.
[00118] The computer of the computer-implemented method may comprise a communication device to communicate with a remote computer through a network. The communication device can include a wireless communication port, a data cable connecting the computer of the computer-implemented method with the network, or the like. The network can be a Local Area Network (LAN) or a Wide Area Network (WAN) such as the internet and the like.
[00119] The remote computer that is connected to the network can be a general-purpose computer, a server, a PDA, and the like. Further, the computer of the computer-implemented method can access information from the remote computer through the network.
[00120] The sets of instructions stored on the computer-readable medium include various commands that instruct the computer of the computer-implemented method to perform specific tasks such as the steps that comprise the methods of the disclosed teachings.
[00121] The sets of instructions may be embodied in the form of a transitory medium, such as a software program.
[00122] The software may be in various forms such as method software or application software. Further, the software might be in the form of a collection of separate programs, a program module with a larger program, or a portion of a program module. The software might also include modular programming in the form of object-oriented programming.
[00123] The software program or programs may be provided as a computer program product, such as in the form of a computer-readable medium with the program or programs containing the set of instructions embodied therein. The processing of input data by the computer of the computer-implemented method may be in response to user commands or in response to the results of previous processing or in response to a request made by another computer.
[00124] The foregoing descriptions of specific embodiments of the present invention have been presented for purposes of description. They are not intended to be exhaustive or to limit the present invention to the precise forms disclosed, and obviously, many modifications and variations are possible in light of the above teaching.
[00125] Further, the embodiments were chosen and described in order to best explain the principles of the present invention and its practical application, and thereby enable others skilled in the art to best utilize the present invention and various embodiments with various modifications as are suited to the particular use contemplated.
[00126] It is understood that various omissions and substitutions of equivalents are contemplated as circumstances may suggest or render expedient, but such omissions and substitutions are intended to cover the application or implementation without departing from the spirit or scope of the present invention. , C , C , C , C , C , C , C , C , C , C , C , Claims:1. A computer-implemented method (100) for a detection of an emulator in an operating device (50), the method comprising:
generating an instruction set comprising an emulator detection code capable to be run on the one or more processors (52) of the operating device (50);
mapping the instruction set, with a plurality of flags to allocate a memory page;
storing the said instruction set as an instruction cache based on an architecture of the one or more processors (52), in the said memory page; and
executing the said mapped instruction set, by the one or more processors (52), for detection of the emulator in the operating device (50),
wherein the said instruction set is being generated in such a way that the one or more processors (52) operate only after executing the said mapped instruction set, and
wherein the execution of the said mapped instruction comprises running the emulator detection code in a predetermined manner, thereby confirming the detection of the emulator in the operating device (50).
2. The method as claimed in claim 1, wherein the said operating device (50) is one of a computer or a mobile device.
3. The method as claimed in claim 1, wherein the said instruction set is generated by an instruction-generating module (54a) of an application (54) capable of being installed in the operating device (50).
4. The method as claimed in claim 1, wherein the one or more processors comprises at least one of 32-bit, 64-bit Advanced RISC Machine (ARM) processor, x86 or x64 processor.
5. The method as claimed in claim 1, wherein the execution of the instruction set comprises translating the emulator detection code compatible for at least one of x86 processor or x64 processor, which results in a return value, thereby confirming the detection of the emulator in the operating device.
6. The method as claimed in claim 1 comprising mapping and storing the said instruction set as a data cache.
7. The method as claimed in claims 1 and 6, wherein the said at least one instruction set is being mapped using the plurality of flags comprising anonymous mapping and private mapping.
8. The method as claimed in claims 1 and 6, wherein the execution of the mapped instruction set does not return a value, thereby confirming the detection of a real operating device (50).
9. The method as claimed in claim 1, wherein the execution of the said mapped instruction set comprises performing misaligned memory access operation in a loop which results in prevention of fault signal, thereby confirming the detection of the emulator in the operating device (50).
10. The method as claimed in claims 1 and 8, wherein the execution of the said mapped instruction set comprises performing misaligned memory access operation in the loop which results in generation of one or more fault signals, thereby confirming the detection of the real operating device.
11. The method as claimed in claim 9 comprising installing a customized fault signal handler for capturing and redirecting the fault signals raised during the execution of the said mapped instruction set, thereby preventing crash of the application (54).
12. The method as claimed in claim 1, wherein the emulator is adapted with a proprietary ARM translation layer.
13. A system (1000) for detection of an emulator in an operating device (50), the system (1000) comprising:
an application (54) installed in the said operating device (50), the said application (54) comprising an instruction-generating module (54a) for generating an instruction set that includes an emulator detection code, wherein the said instruction set is mapped, with a plurality of flags to allocate a memory page, and stored as instruction cache in the said memory page;
one or more processors (52) of the operating device (50), adapted to run the application (54) for executing the said mapped instruction set,
wherein the said instruction set is being generated in such a way that the one or more processors (52) operate only after executing the said mapped instruction set, and
wherein the execution of the said mapped instruction comprises running the emulator detection code in a predetermined manner, thereby confirming the detection of the emulator in the operating device (50).
14. The system (1000) as claimed in claim 13, wherein the one or more processors (52) comprises at least one of 32-bit, 64-bit Advanced RISC Machine (ARM) processor, x86 or x64 processor.
15. The system (1000) as claimed in claim 13, wherein the execution of the instruction set comprises translating the emulator detection code compatible for at least one of x86 processor or x64 processor, which results in a return value, thereby confirming the detection of the emulator in the operating device.
16. The system (1000) as claimed in claim 13, wherein the instruction set is mapped and stored as a data cache.
17. The system (1000) as claimed in claims 13 and 16, wherein the execution of the mapped instruction set does not return a value, thereby confirming the detection of a real operating device (50).
18. The system (1000) as claimed in claim 13, wherein the execution of the said mapped instruction set comprises performing misaligned memory access operation in a loop which results in prevention of fault signal, thereby confirming the detection of the emulator in the operating device (50).
19. The system (1000) as claimed in claims 13 and`16, wherein the execution of the said mapped instruction set comprises performing misaligned memory access operation in the loop which results in generation of one or more fault signals, thereby confirming the detection of the real operating device.
20. The system (1000) as claimed in claim 13, wherein the emulator is adapted with a proprietary ARM translation layer.