How to detect an external program that controls your process?

Question

Is it possible in .net to determine if another program controls your process?

I mean, I have exe running, and if someone runs procmon.exe or some other application that is trying to read some information about my exe, I want my exe to log this.

Answer 1

This is a vast and complex topic, and I am only familiar with its existence, and not with an expert. So, all I can offer is a search query:

• anti debugging

It covers the detection of monitoring tools, countermeasures to prevent verification and obfuscation, to make monitoring information completely useless.

Keep in mind that between the reversers there is an arms race that wants to debug any code running on their system, and DRM ¹ designers who want to protect their secrets from prying minds. If you are not ready to devote your life to becoming an expert, you are probably stuck in buying solutions from someone who is. Or simply deciding that it is not worth it.

¹ Even if you believe that content owners have a moral right ² to prohibit reverse engineering, note that no one uses protective obscurity, as well as malware authors.

² In addition, it is completely different to maintain a neutral expression. But I tried.

Answer 2

The monitoring process can either receive information about your process directly from the operating system (for example, TaskManager, perfmon, etc.). In this case, your process knows nothing about it.

In another case, the monitoring process could attach and debug your process. When the debugger joins your process, the last one stops and the debugger can get information about its execution. Thus, your process cannot “ detach the debugger by itself ” without any additional security measures.