Blocking the famous tools is the easy part of protecting desktop software. Their process names and window titles are well known, and almost every blacklist already lists them. The hard part is everything else: a known tool under a new name, a private utility someone built for one product, a tool released last week. Reverse-engineering tool detection that only reads names misses all of them.
This article explains why name matching runs out, how qPAnalyzer flags renamed and custom tools by looking at what they are rather than what they are called, how it keeps false positives away from paying customers, and how to turn its findings into proportionate action.
Why name-based reverse-engineering tool detection misses renamed tools
A static blacklist compares what is running against a list: process names, window titles, window class names. That works well for tools that are public and unchanged. It has three structural blind spots.
- Renamed tools. A list keyed on names only knows names. Change the name and the match is gone.
- Private tools. Utilities written for a single target never appear on any public list.
- New tools. New releases and forks appear faster than any list can be maintained.
The opposite failure is just as serious. Treating every unfamiliar process as hostile would close your application on customers who happen to run ordinary software alongside it. Good detection has to be strict with analysis tools and relaxed with everything else, and that needs judgement, not just a longer list.
Making the list longer doesn't solve this either. Every entry has to be found, verified and maintained, and broad patterns that try to catch variants start catching legitimate software too. At some point the question has to change from "what is this called?" to "what is this, and what is it doing?"
What is qPAnalyzer?
qPAnalyzer is PapelShip's AI-assisted runtime threat detection. It runs on the end user's machine, next to your application, and flags reverse-engineering tools and suspicious activity before they reach your software. It arrived with qPapel Auth v5.5 as a dedicated analysis layer inside the existing protection flow, and it is switched on from Remote Settings like the other protections.
The model is simple: detect on the client, decide on the server, review everything in one place. qPAnalyzer does its analysis where the threat is. Your license and ban decisions stay on PapelShip's servers. Findings appear in the same dashboard you use for keys and sales.
- Computers page: each machine with its security scan results, suspicious activity and a Recently Banned panel.
- Threat Vault: every finding, filterable per product, with a one-click action for false positives.
- Suspicious screenshots: a dedicated page for the screenshots captured when activity looked wrong.
- Security insights and alerts: detections surface alongside your licenses and sales as they happen.
How qPAnalyzer flags a tool it has never seen
Instead of trusting a name, qPAnalyzer looks at characteristics that are much harder to change cosmetically. It inspects UI layout patterns, window handles and memory signatures, so a tool can be recognised regardless of what its executable is called.
- 01
Environment checks
Debugger and hypervisor signals
- 02
Process and window
Layout, handles, signatures
- 03
Screenshot analysis
The flagged window is reviewed
- 04
Threat score
A calibrated 0 to 100% score
- 05
Action
Logged, then your rule applies
Environment checks
qPAnalyzer runs anti-debug and anti-tamper checks on the end user's machine while your software is running. Examples include hypervisor signals, hardware breakpoints, process debug flags and kernel debugger presence. Each check passes or fails, and failures feed the score.
Window screenshot analysis
When a window looks suspicious, qPAnalyzer captures a screenshot of it, and the analysis engine reviews the visual interface. Analysis tools tend to look like analysis tools, with memory views, disassembly panes and register lists, whatever their process is called. Window screenshot analysis is always included in qPAnalyzer scans.
A calibrated threat score
The engine assigns a threat score from 0 to 100% and logs the evidence in your dashboard. A score is more useful than a yes-or-no verdict, because it lets you treat a weak signal differently from a strong one.
Combining signals is what makes the score trustworthy. Any single clue can have an innocent explanation: a developer may have a debugger installed for their own work, or a window may briefly resemble something it isn't. Several independent signals pointing the same way, at the same time, next to your application, are much harder to explain away.
Keeping false positives low: whitelists and "Not a threat"
A detection system that flags your customers' ordinary software is worse than none, because it trains you to ignore it and trains customers to leave. qPAnalyzer gives you three controls for keeping results clean.
| Control | What it does | When to use it |
|---|---|---|
| Product whitelist | Marks tools as safe for one product, with custom instructions | Software your customers legitimately run |
| Threat Vault | Lists findings, filterable per product | Your regular review of what was flagged |
| Not a threat | Removes a false positive in one click | A finding that turns out to be harmless |
The custom instructions on the whitelist matter more than they might seem. A tool for streamers, a hardware utility or a niche piece of industry software may be completely normal for one product's audience and unusual for another's. Telling qPAnalyzer about your audience is how you keep it strict where it should be strict.
From detection to action: scores, delays and evidence
Detection is only half of the job. What you do with a finding decides whether the system protects your revenue or just generates noise. PapelShip's risk engine combines every signal into one score with warn, restrict, close and ban thresholds that you define.
- 01
Set thresholds per product
Decide which score warns, which restricts features, which closes the application and which bans the key. A low-cost tool and a high-value product can have very different policies.
- 02
Use delayed actions
With delayed action mode, penalties trigger after a randomised delay. Someone probing your protection can't easily tell which step caused the response.
- 03
Keep the evidence
Suspicious Screenshot captures what was on screen when suspicious activity was detected. Screenshots are viewable on their own page in the dashboard.
- 04
Act on the device as well as the key
The Computers page shows each machine, its scan results and a Recently Banned panel with accurate ban ages, so repeat offenders are easy to spot.
- 05
Automate what is routine
Auto Rules let you set an action once and have it run on its own, so clear-cut cases don't wait for a person.
| What you see | A sensible response |
|---|---|
| A weak, one-off signal | Log it and review later |
| A moderate score | Warn, log and keep the evidence |
| A strong score | Close the session |
| Strong scores on the same key or device | Ban the key and the device |
How strict to be depends on what you sell. A low-priced utility with a broad audience can afford to log more and act less. A high-value product, or one where cheating harms other customers, justifies firmer thresholds. Either way, the decision is yours and can be changed from the dashboard at any time.
Because bans are decided on the server, they apply everywhere at the next check. There is no build to ship and no update to wait for. The same principle is behind keeping server-side secrets out of the binary: the client reports, the server decides.
Where qPAnalyzer fits alongside blacklists and server checks
qPAnalyzer doesn't replace the rest of your protection. It covers the gap the other layers leave. Process and window blacklists still stop well-known tools at almost no cost. qPapel Auth still decides who may run your software and on which device. qPAnalyzer watches for what neither of those can see.
Static blacklist
- Matches names, titles and classes
- Instant and very cheap
- Misses renamed and private tools
- Needs a list someone maintains
qPAnalyzer
- Looks at layout, handles, signatures
- Analyses a screenshot of the window
- Scores what it finds, 0 to 100%
- Tuned per product with a whitelist
qPAnalyzer is also most effective when the binary has little worth taking. If your valuable strings and files stay on the server and are released only to verified sessions, a flagged session can simply stop receiving them. Detection then has a direct, server-enforced consequence instead of relying on a check inside the client.
For the wider argument, read why anti-reverse-engineering has to go beyond static blacklists. For the full set of layers in order, see a software protection stack for C++ and C#.
How to roll out qPAnalyzer in your product
- 01
Update the library
qPAnalyzer needs qPapel Auth v5.5 or later. Use the latest Lib and Include files from the official Example project and the latest
qPapelAuth64.dllfrom the Downloads page. - 02
Enable it in Remote Settings
Turn qPAnalyzer on for the product. No new build is needed to change the setting later.
- 03
Start in observe mode
Log findings without closing or banning. Watch the Computers page and the Threat Vault for a few days.
- 04
Tune the whitelist
Add the legitimate tools your audience uses and write custom instructions that describe them.
- 05
Turn on actions
Set your warn, restrict, close and ban thresholds, enable delayed actions, and review flagged machines regularly.
qPAnalyzer is included in PapelShip+ at €14.99 a month, alongside 0% fees on crypto and card payments. The qPAnalyzer product page shows the dashboard views, and pricing compares the plans.
Veelgestelde vragen
See what a static list can't
Blocking known tools is the baseline. The tools that matter most are the ones that don't announce themselves: renamed, private or simply new. qPAnalyzer looks at what those tools are and how they behave, scores what it finds and leaves the final decision with you.
Enable it in observe mode, tune it to your audience, then let the score drive proportionate action. You get visibility you didn't have before, without turning your paying customers into suspects.
qPapel-securityteam
Licenties en softwarebescherming