Hardening Windows Processes with an explorer.exe Watchdog

A userland process protector with a watchdog living inside explorer.exe

Developer Carlos has released a C++ library for Windows x64 designed to shield processes from external analysis. The system functions by injecting a thread into explorer.exe to monitor and resume threads even if the primary process is frozen by an attacker.

Why This Matters

While standard security models assume process isolation, user-level tools like debuggers and memory editors frequently bypass these boundaries. By leveraging explorer.exe as a persistent host, this library implements a practical defense-in-depth strategy that addresses the reality of local system compromise where tools like ScyllaHide are used for reverse engineering. This approach recognizes that internal process self-checks are insufficient if the process itself is suspended, requiring an external monitor to maintain integrity.

Key Insights

• The library uses NtQuerySystemInformation to enumerate and revoke handles from external processes, cutting off tools that rely on OpenProcess.
• Hook detection is performed by checking the first bytes of functions in ntdll.dll and kernel32.dll for 0xE9 or 0xFF signatures, identifying tools like ScyllaHide.
• The exceptionThrow technique detects debuggers by calling CloseHandle with an invalid handle, triggering a STATUS_INVALID_HANDLE exception only when a debugger is attached.
• Process termination is handled via __fastfail, which bypasses standard exception handlers and leaves minimal data for post-mortem analysis.

Working Examples

The structure used to pass thread handles and function pointers to the injected watchdog thread in explorer.exe.

struct watchdogStruct {
HANDLE mainThreadHandle;
HANDLE protectThreadHandle;
pDuplicateHandle dup;
pNtResumeThread resume;
};

Practical Applications

• Use case: Protecting proprietary software from being reverse-engineered by tools like ScyllaHide during runtime. Pitfall: Over-reliance on userland protection; determined attackers can still bypass these checks if they have kernel-level access.
• Use case: Implementing a stealthy watchdog in explorer.exe to maintain process uptime against freezing attempts. Pitfall: Injecting into system processes like explorer.exe may trigger heuristic detections from antivirus software (AV/EDR).

References:

• https://github.com/000nico/watchdog-process-protection
• https://dev.to/000carloscar/a-userland-process-protector-with-a-watchdog-living-inside-explorerexe-2c1l