• Journal of Convergence Society for SMB
• /
• v.3 no.1
• /
• pp.43-48
• /
• 2013

With the development of computer technology, and have diversified technical system attacks evolve more. Computer hardware and software has evolved more and more, performance is improved, but the basic principle of operation does not change much, it is a problem. In general, the application is placed in a running state, the program data is placed in memory. Remains in memory for efficiency of operation of the operating system, we analyze memory and memory hacking, these data will have access to data. Since a large damage occurs key, such as certificates personal information, encrypted flows out, measures should be provided by it. In this content, I want to discuss the issues and work around memory hacking.

• ETRI Journal
• /
• v.43 no.1
• /
• pp.141-151
• /
• 2021

Several methods exist for detecting hacking programs operating within online games. However, a significant amount of computational power is required to detect the illegal access of a hacking program in game clients. In this study, we propose a novel detection method that analyzes the protected memory area and the hacking program's process in real time. Our proposed method is composed of a three-step process: the collection of information from each PC, separation of the collected information according to OS and version, and analysis of the separated memory information. As a result, we successfully detect malicious injected dynamic link libraries in the normal memory space.

• Convergence Security Journal
• /
• v.5 no.3
• /
• pp.75-86
• /
• 2005

Recently, illegal manipulation and forgery threats on computer softwares are increasing due to the advances in reverse engineering techniques. Furthermore someone who has concerns about these area can crack the software by using the open-to-public simple tools on the internet. The software companies are struggling to defend their own softwares against threats, while the crackers are continuing to crack the softwares. In this paper, we first establish the generic software threat model and, analyze and experiment on the software cracks, before suggest a memory hacking prevention system in Microsoft Windows environment.

• Journal of Internet Computing and Services
• /
• v.15 no.5
• /
• pp.133-139
• /
• 2014

Recently the Microsoft Windows OS(operating system) is widely used for the internet banking, games etc. The kernel functions provided by the Windows OS can perform memory accesses, keyboard input/output inspection, and graphics output of any processes. Thus, many hacking programs utilizes those for memory hacking, keyboard hacking, and making illegal automation tools for game programs. Existing protection mechanisms make decisions for existence of hacking programs by inspecting some kernel data structures and the initial parts of kernel functions. In this paper, we point out drawbacks of existing methods and propose a new solution. Our method can remedy those by modifying the system service dispatcher code. If the dispatcher code is utilized by a hacking program, existing protection methods cannot detect illegal operations. Thus, we suggest that protection methods should investigate the modification of the dispatcher code as well as kernel data structures and the initial parts of kernel functions.

• Convergence Security Journal
• /
• v.6 no.3
• /
• pp.59-67
• /
• 2006

Recently the Personal Computer hacking and game hacking for the purpose of gaining an economic profit is increased in Windows system. Malicious code often uses methods which inject dll or code into memory in target process for using covert channel for communicating among them, bypassing secure products like personal firewalls and obtaining sensitive information in system. This paper analyzes the technique for injecting and executing code into memory area in target process. In addition, this analyzes the PE format and IMPORT table for extracting injected dll in running process in affected system and describes a method for extracting and analyzing explicitly loaded dll files related with running process. This technique is useful for finding and analyzing infected processes in affected system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.3
• /
• pp.477-486
• /
• 2022

This study aims to present a method using event sourcing patterns and blockchain as a way to cope with vulnerabilities in memory manipulation at the client level. To verify the plan, the method of running the memory operation application was analyzed, and the performance was compared and analyzed when the memory operation prevention plan was applied by fabricating a test application. As a result of the analysis, the usage of memory increased compared to the method of XOR operation by storing major data in one memory, but it was possible to prevent the operation of the memory operation program without significantly affecting the performance of the game.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.36 no.8B
• /
• pp.939-946
• /
• 2011

The Internet banking service provides convenience than the traditional offline services. However, it still causes a number of security problems including hacking. In order to strengthen security, the financial institutions have provided such authentication methods as the official authentication certificate, the security token, the security card and OTP. However, the incidents related to hacking have continuously occurred. Especially, various weak points have been suggested for the authentication methods in regard to such types of hacking as the memory hacking or the MITM attack. So I needed was a new authentication method. In this study, the two-channel authentication method which provide two-way authentication on the user's PC and mobile device when executing the electronic financial transactions in the Internet banking environment is suggested. Also, by analyzing it in comparison with other existing methods, it is possible to check that the prospects of safety and credibility are strengthened.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2004.05b
• /
• pp.772-775
• /
• 2004

After Morris' Internet Worm in 1988, the stack buffer overflow hacking became generally known to hackers and it has been used to attack systems and servers very frequently. Recently, many researches tried to prevent it, and several solutions were developed such as Libsafe and StackGuard; however, these solutions have a few problems. In this paper we present a new stack buffer overflow attack prevention technique that uses the system call monitoring mechanism and memory address where the system call is made.

• Journal of IKEEE
• /
• v.26 no.4
• /
• pp.614-621
• /
• 2022

This paper proposes RIDS (Random Forest-Based Intrusion Detection), which is an intrusion detection system to detect hacking attack based on random forest. RIDS detects three typical attacks i.e. DoS (Denial of service) attack, fuzzing attack, and spoofing attack. It detects hacking attack based on four parameters, i.e. time interval between data frames, its deviation, Hamming distance between payloads, and its diviation. RIDS was designed in memory-centric architecture and node information is stored in memories. It was designed in scalable architecture where DoS attack, fuzzing attack, and spoofing attack can be all detected by adjusting number and depth of trees. Simulation results show that RIDS has 0.9835 accuracy and 0.9545 F1 score and it can detect three attack types effectively.

• Journal of Korea Game Society
• /
• v.19 no.6
• /
• pp.71-82
• /
• 2019

This paper analyzes performance difference between Unreal Engine's built-in network solution and IOCP server. To do this, we developed IOCP server and 3D game with Unreal Engine 4. Also we considered the game variable obfuscation program to prevent the modification of the memory of the code-modulated game hacking program. This paper used SCUE4 Anti-Cheat Solution, which is Unreal Engine's solution, to study preventing memory modification and to analyze performance trade-offs.