示例#1
0
        /// <summary>
        /// Populate "database" with process names/window names.
        /// Using HashSet for maximum performance
        /// </summary>
        private static void Init()
        {
            if (BadProcessNameList?.Any() == true && BadWindowTextList?.Any() == true)
            {
                return;
            }

            BadProcessNameList = new HashSet <string>
            {
                "procmon64",
                "codecracker",
                "ida",
                "idag",
                "idaw",
                "idaq",
                "idau",
                "scylla",
                "de4dot",
                "de4dotmodded",
                "protection_id",
                "ollydbg",
                "x64dbg",
                "x32dbg",
                "x96dbg",
                "x64netdumper",
                "petools",
                "dnspy",
                "windbg",
                "reshacker",
                "simpleassembly",
                "process hacker",
                "process monitor",
                "qt5core",
                "importREC",
                "immunitydebugger",
                "megadumper",
                "cheatengine-x86_64",
                "dump",
                "dbgclr",
                "wireshark",
                "hxd"
            };

            BadWindowTextList = new HashSet <string>
            {
                "ollydbg",
                "ida",
                "disassembly",
                "scylla",
                "debug",
                "[cpu",
                "immunity",
                "windbg",
                "x32dbg",
                "x64dbg",
                "x96dbg",
                "import reconstructor",
                "dumper"
            };
        }
示例#2
0
        /// <summary>
        /// Simple scanner for "bad" processes (debuggers) using .NET code only. (for now)
        /// </summary>
        private static int Scan(bool killBadProcess)
        {
            var isBadProcess = 0;

            if (BadProcessNameList.Any() != true ||
                BadWindowTextList.Any() != true)
            {
                Init();
            }

            var processList = Process.GetProcesses();

            foreach (var process in processList)
            {
                if (BadProcessNameList.Contains(process.ProcessName.ToLower()) ||
                    BadWindowTextList.Contains(process.MainWindowTitle.ToLower()))
                {
                    Debug.Write("BAD PROCESS FOUND: " + process.ProcessName);

                    isBadProcess++;

                    if (killBadProcess)
                    {
                        try
                        {
                            process.Kill();
                        }
                        catch (Exception ex)
                        {
                            Console.ForegroundColor = ConsoleColor.Red;
                            Console.Error.WriteLine(ex);
                            break;
                        }
                    }
                }
            }

            return(isBadProcess);
        }