Background Heartbeat Thread Monitoring: Detecting Memory Tampering & Real-Time Key Revocation

1. Why One-Time Authentication Isn't Enough#

If an application performs a single license check at startup, a reverse engineer can suspend the process or revoke the license while the binary continues running. With qPapel Heartbeat Thread Monitoring, a background worker thread sends periodic encrypted pings to PapelShip servers.

2. Security Watchdog Thread#

After connecting, you can spawn a watchdog thread to detect debuggers and report tampering events:

void SecurityWatchdog(QPCTX ctx) {
    while (true) {
        // Check for attached debuggers (x64dbg, IDA, etc.)
        if (qpapel::CheckDebugger(ctx) != 0) {
            qpapel::ReportEvent(ctx, "dbgdthigh", "ban", "{\"screenshot\":true}");
            std::this_thread::sleep_for(std::chrono::seconds(2));
            std::exit(-1);
        }
        qpapel::OptimizeClock(ctx);
        std::this_thread::sleep_for(std::chrono::seconds(5));
    }
}

> VMProtect Warning: If you use VMProtect or Themida, do not call qpapel::CheckIntegrity(ctx) in watchdog loops — commercial packers virtualize and mutate the .text segment, which changes the binary hash and triggers false anti-tamper bans.

3. Web Panel Configuration#

All debugger and integrity scan actions are configured from your PapelShip Dashboard:

1. Integrity Tab: Upload your compiled release binary to compute reference hash.

2. Blacklist Tab: Add banned process names (e.g. x64dbg.exe, cheatengine.exe).

3. Action Config: Choose what happens on detection (Kill Process / BSOD).

Learn more about Heartbeat Monitoring.