当用户启动另一个 exe 文件/程序时，在 c# winforms 程序中检测

Question

I am developing an antiheat c# program that communicates with my game server. The program when started needs to check started programs and scan for bad ones. Also it needs to scan the started programs continuously, because users can run exe applications to cheat in game.

The problem is that programs can be rewritten (aimbot.exe to something.exe) so the detection can't be done by name. How could I detect active running programs? Also would it be viable to find exe files from open programs, then get the MD5 hash from those exe files and compare them to a list of known cheat programs? Is it possible, or there is a better solution?

EDIT: The main problem is AimBot - it is an application designed to automatically aim at a player, you just need to press left mouse button to shoot, and every hit is 100% accurate. My program is for a mod Gta San Andreas Multiplayer, so is there a way maybe to detect if some application attaches to the game?

Answer 1

You could get a list of the currently running processes using the Process.GetProcesses() method:

try
{           
    var processes = Process.GetProcesses();
    foreach (var process in processes)
    {
        Console.WriteLine(String.Format("{0} - {1}", process.Id, process.ProcessName));
        Console.WriteLine(process.MainModule.FileName);
    }
}
catch (Exception exception)
{
    Console.WriteLine(exception.Message);
}

Using the Process object, you could retrieve information like full file name, type, start time, and so on, in order to calculate the check sum from the file size for example.

You can calculate the MD5 hash for example for the process name using the MD5 ComputeHash() method like this:

try
{           
    var md5 = MD5.Create();
    var processes = Process.GetProcesses();
    foreach (var process in processes)
    {
        var md5Hash = md5.ComputeHash(Encoding.ASCII.GetBytes(process.ProcessName));
        var md5HashAsBase64 = Convert.ToBase64String(md5Hash);
        Console.WriteLine(String.Format("{0} - {1} - {2}", process.Id, process.ProcessName, md5HashAsBase64));
    }
}
catch (Exception exception)
{
    Console.WriteLine(exception.Message);
}

You can pull the list of the running processes constantly with the above code, or you could intercept the creation/start of new processes using windows hook. The problem is, that the second option is not an easy matter. You could find more info about hooks: here - Hooks in Visual Studio with C# , Windows hooks and here Windows Hooks with .NET Framework .