Detecting Daemon Tools

[Crudd[RET]]

There are alot of ways to detect if a program is running. Im not sure about daemon tools, but alot of the times programs are checked by window name or class name (using FindWindow), or by checking all of the running processes, looking for a certain one. hxxp://pe-lib.sourceforge.net/pumqara/html/code_protection/Detecting%20OllyDbg/DetectOllyDbg+Pum.htm
will be of some help. Its ollydbg related, but the same tricks apply to most .exes
Crudd [RET]

[dyn!o]

I would suggest to leave the idea of window/class names.

In my humble opinion the best way is to detect Daemon Tools by its MINI-PORT driver and BUS driver. If you will use window/class names then it takes fer seconds to change them and you will fail. If you will use generic like methods (drivers scanning) then you always are able to detect it. Of course do not try to detect them (drivers) by name but properties.

Look at StarForce, it detects fake CD/DVD mediums by scanning low level system drive types (SCSI, etc.). Professional developers (Alcohol, CloneCD, Daemon Tools) have serious problems with this kind of check and cannot defeat it without cosmic tricks like unplugging IDE cables (what a silly idea).

Learn from the best (not me (hehe) but them).

Good luck.

Originally Posted by dyn!o

In my humble opinion the best way is to detect Daemon Tools by its MINI-PORT driver and BUS driver. If you will use window/class names then it takes fer seconds to change them and you will fail. If you will use generic like methods (drivers scanning) then you always are able to detect it. Of course do not try to detect them (drivers) by name but properties.

Correct but then you have only detected dtools not disabled the
emulation, it would be better to scan the system to find the position
of the dtools dll or exe file and disable all usefull stuff...
the question what else can you do to search for those files if changing
the registry entries failed?

[dyn!o]

A complete miss. Listen to my words, not only read

Obtaining location of exe/dll gives you nothing. Read my previous post once again. You should understand what role a driver plays in the system - notice it operates on kernel level.... You can kill/disable DaemonTools in a proper (professional) way.

"what else can you do to search for those files if changing the registry entries failed?"
Forget this idea - it is too simple and not effective.

Scanning files/directories/registry is not the way. What if I will change file name? What if I will change registry key location? What if I will change registry data?

Think about it.

Good luck.