One last technique worth mentioning is that processes can detect whether they were created by a debugger by checking the parent process's name. Windows OS sets the process ID and the parent process ID in the process information. Using the parent process ID, you can check whether it was created normally (for example, by using Explorer.exe or iexplore.exe) or whether it has been created by a debugger (for example, by detecting the presence of the dbg substring in its name).
There are two common techniques for malware to get the parent process ID, listed as follows:
- Looping through the list of running processes using CreateToolhelp32Snapshot, Process32First and Process32Next (as we saw in Chapter 4, Inspecting Process Injection and API Hooking, with process injection). These APIs not only return the process name and ID, but also more information, such as the parent process ID that the malware is looking for.
- Using the undocumented NtQueryInformationProcess...