Another trick would be not to search for the tool's process name, but instead to search for its window name (the window's title). By searching for a program window name, malware can bypass any renaming that could be performed on the process name, which gives it an opportunity to detect new tools as well (mostly, window names are more descriptive than process names).
This trick can be done in the following two ways:
- Using FindWindow: Malware can use either the full window title, such as Microsoft network monitor, or the window class name. The window class name is a name that was given to this window when it was created, and it's different from the title that appears on the window. For example, the OllyDbg window class name is OLLYDBG, while the full title could change based on the process name of the malware under analysis. An example of this is as follows:
push NULL
push .szWindowClassOllyDbg
call FindWindowA
test eax,eax
jnz <debugger_found...
