PapelShip
Get started
Get startedSign in

qPAnalyzer/AI runtime threat detection

Catch the reverse-engineering tools a blacklist can’t see.

qPAnalyzer runs next to your application on the end user’s machine. It recognizes debuggers and cracking tools by how they look and behave, renamed and custom ones included, and scores every scan out of 100.

Get PapelShip+Watch the walkthrough
app.papelship.com · qPAnalyzer

Runs on

The end user's machine

Detects

Renamed and custom tools

Requires

qPapel Auth v5.5 or later

Included with

PapelShip+

qPAnalyzer trial

Try qPAnalyzer first.

Apply in your dashboard and get approved quickly. Upgrade to PapelShip+ afterwards at a discounted price, with up to 3,500 extra scan credits.

Apply for a trialSee the offer

Walkthrough

See qPAnalyzer at work. Scans, flagged windows and the results in the dashboard, in one short tour.

  • Detect on the client

    The analysis runs next to your application, where reverse engineering actually happens.

  • Decide on the server

    License and ban decisions stay on PapelShip and apply at the next check.

  • Review in one place

    Scans, evidence and flagged binaries sit in the same dashboard as your keys and sales.

Beyond blacklists

A new name is all it takes to get past a blacklist.

Lists match process names, window titles and class names. That stops public tools at almost no cost, and misses anything renamed, private or new. qPAnalyzer looks at what a tool is instead of what it is called.

Why static blacklists aren't enough

Process on DESKTOP-23X9F

PID 4812
Image namex64dbg.exenotes_helper.exerenamed, nothing else changed

Process blacklist

Matches names, titles and classes

Match · blocked

qPAnalyzer

Looks at what the tool is

Debugger recognized · 92 / 100
UI layoutWindow handlesMemory signaturesWindow screenshot

  • Renamed tools

    A list keyed on names only knows names. Change the name and the match is gone.

  • Private tools

    Utilities written for a single target never appear on any public list.

  • New tools

    New releases and forks appear faster than any list can be maintained.

How it works

Recognized by what it is, not what it is called. Environment checks, window analysis and a screenshot review add up to one score out of 100.

How qPAnalyzer detects renamed and custom tools

Scan · DESKTOP-23X9F

DemoApp · periodic check

Scanning
  1. 01Environment checksDebug flags, hardware breakpoints, hypervisor, kernel debugger1 signal
  2. 02Processes and windows214 processes, 19 windows1 window stands out
  3. 03UI layout patternCompared with known analysis toolsMatches a debugger
  4. 04Window screenshotCaptured and reviewedAnalysis tool

Risk score

– / 100

04070100

Evidence

Attached to the report when the window is captured

Window

notes_helper.exe

Desktop

Full capture

Decided at
AI visual check
Tools found
1
Then
Logged with its evidence, and your rule for this score applies.
  1. 01

    Environment checks

    Anti-debug and anti-tamper checks such as hypervisor signals, hardware breakpoints, process debug flags and kernel debugger presence.

  2. 02

    Processes and windows

    UI layout patterns, window handles and memory signatures, so a tool is recognized whatever its file is called.

  3. 03

    Screenshot analysis

    A suspicious window is captured and its interface reviewed. Memory views, disassembly panes and register lists give a tool away.

  4. 04

    Risk score

    The signals combine into a calibrated score out of 100, so a faint resemblance is treated differently from a clear match.

  5. 05

    Your rules

    The finding is logged with its evidence, then the action you set applies, from a warning to a ban.

Scan reports

Every verdict comes with its evidence.

Each scan becomes a report: the result, a risk score out of 100, the stage that decided it, the tools found and a written assessment, with the captured screenshots attached.

  • Step through every scan in a session, from the first check to the latest rescan.
  • See what changed since the previous scan, down to the number of processes and windows.
  • Open the detailed analysis, or read the report in the language you choose.
  • Keep the evidence, so every ban can be reviewed and explained.

Scan report · #1040

DESKTOP-23X9F

jdoe · DemoApp · Periodic check · October 17 at 2:20:41 PM

Scan 7 of 9 in this sessionReport language: English

Result

Clean

Risk score

0 / 100

Decided at

AI visual check

3,904 ms

Tools found

0

Assessment

All visible windows are ordinary applications: a web browser, a chat client, a music player and File Explorer. No reverse-engineering tools or suspicious activity were found.

What changed: Periodic routine scan (198 processes, 14 windows)

Detailed analysis

Evidence

Desktop

Full capture

Close

Setup

Switch it on from Remote Settings. qPAnalyzer is one step of qPapel Auth Remote Settings, so changing it never needs a new build.

DemoApp

Remote settings · Step 7 of 8

QP Analyzer

Inspects each session with AI and responds to reverse engineering attempts.

Analysis

What the analyzer collects and how often it runs.

AI threat analysis

Reviews live session telemetry and decides how to respond.

Window screenshotsRecommended

Captures suspicious tool windows for visual inspection.

Desktop screenshot

Adds a full desktop capture to the analysis when a threat is found.

Background rescans

Repeats the analysis while the session stays open.

Rescan every

60sec
CancelNext

Session · DESKTOP-23X9F

DemoApp · rescan every 60 sec

Session open
0:001:002:003:004:005:00
  • 0:00PeriodicClean

Background rescans repeat the analysis while the session stays open, so a tool opened halfway through a session is still caught.

Response

Score what it finds. Decide what happens.

Every signal feeds one score out of 100. The console flags scores from 40 to 69 and blocks 70 and above; your rules decide whether the session is warned, restricted, closed or banned.

  • Warn, restrict, close and ban thresholds in the risk engine, set per product.
  • Delayed action mode triggers a penalty after a randomized delay, so the response doesn't point at the check.
  • Bans are decided on PapelShip's servers and apply at the next check, with no build to ship.
  • Auto Rules run your chosen action whenever a condition is met.

Example policy · DemoApp

risk engine

Scan 7

0Clean

Scan 8

48Flagged

Scan 9

92Blocked

04070100
  • Score 40 to 69log_only
  • Score 70 or moreclose_app
  • Repeat blocks on one keyban
Delayed actionIdle

Machines

Your whole fleet, one square per machine. Squares light up the moment a scan lands, and every machine keeps its state, risk and scan history.

app.papelship.com · qPAnalyzer · Machines

  • Filter by state

    All, active now, flagged, banned or trusted, with a count on every filter.

  • Find any machine

    Search by machine name, user, HWID or IP, and sort by recent activity, risk or name.

  • Read the row

    Product, state, last scan, 24-hour risk, scan count and when the machine opened your app.

Threat Vault

Every flagged binary, sorted into families. When a scan flags a tool, the client uploads it to your vault with its hashes, imports, build path and the AI verdict.

app.papelship.com · qPAnalyzer · Threat vault

Signature knowledge base

Process and window signatures the engine has learned across PapelShip, each marked as a threat or clean. Verified threats are blocked instantly at Rules stage 05.

  • Samples grouped by category, family and variant.
  • Filter by risk, from all samples to critical only.
  • Not a threat removes a false positive in one click.

Signature knowledge base

Process and window signatures the engine has learned across PapelShip. Verified threats are blocked instantly at Rules stage 05.

Process, window or tool
SignatureVerdict
Disassembly, register and memory panesThreat
notes_helper.exeThreat
updater_x64.exeThreat
obs64.exeClean
Value search and memory listThreat

False positives

Strict with analysis tools, relaxed with everything else. Tune qPAnalyzer to each product's audience, so paying customers are never treated as suspects.

Per-product whitelist

Mark the tools your customers legitimately run as safe for one product, with custom instructions that tell the analyzer about your audience.

Not a threat

A finding that turns out to be harmless is removed from the Threat Vault in one click.

Trusted devices

Machines you vouch for, such as your own test PCs, stay marked as trusted across the console.

Review before you tighten

Run qPAnalyzer with logging-only rules for the first days. Review the Threat Vault, whitelist what your customers legitimately use, and only then turn on automatic closes and bans.

Part of qPapel Auth

One layer of a protection stack.

Blacklists still stop well-known tools at almost no cost, and qPapel Auth still decides who may run your software and on which device. qPAnalyzer watches for what neither of them can see.

Explore qPapel Auth
  1. 01Static blacklistsKnown process names, window titles and classesx64dbg.exeBlocked by name
  2. 02Behavioural checksDebuggers, virtual machines and modified codePatched buildIntegrity check failed
  3. 03qPAnalyzerRenamed, private and new tools, scorednotes_helper.exeDebugger UI · 92 / 100
  4. 04Server-side decisionsBans apply everywhere at the next checkPAPEL-N1XY-55JQKey and device banned

Rollout

Live in five steps. Start by watching, then let the score drive what happens.

  1. 01

    Update the library

    Use qPapel Auth v5.5 or later: the latest Lib and Include files from the Example project and qPapelAuth64.dll from Downloads.

  2. 02

    Enable it

    Turn on the QP Analyzer step in Remote Settings for the product. Changing it later needs no new build.

  3. 03

    Observe first

    Log findings without closing or banning, and watch Machines and the Threat Vault for a few days.

  4. 04

    Tune the whitelist

    Add the legitimate tools your audience uses, with custom instructions that describe them.

  5. 05

    Turn on actions

    Set your thresholds, enable delayed actions and review flagged machines regularly.

Pricing

Included with PapelShip+.

qPAnalyzer comes with the PapelShip+ plan. Scans are billed at their real cost from your AI balance, and every scan includes window screenshot analysis.

PapelShip+

€14.99/ month

High limits and qPAnalyzer.

  • qPAnalyzer included
  • 95,000 keys per product
  • 750 staff and 250 resellers
  • 0% crypto and card fees

AI balance History

$14.87

About 29,742 scans left

Add funds
  • Billed at the real cost of each scan
  • Window screenshot analysis in every scan

Guides

Go deeper. How the detection works, and where it fits next to blacklists and server checks.

GuideHow qPAnalyzer detects renamed and custom reverse-engineering toolsHow qPAnalyzer's AI-assisted reverse-engineering tool detection flags renamed and custom tools, keeps false positives low and gives you evidence to act on.Read the guide
GuideAnti-reverse-engineering software: why static blacklists aren't enoughWhy process and window blacklists only catch known tools, and what behavioural checks and AI-assisted detection add to anti-reverse-engineering software.Read the guide
Help centerqPAnalyzer and protectionRuntime detection, false positives and leaked builds.Visit the help center

Questions, answered

More about runtime detection and false positives in the help center.

Visit the help center

AI-assisted runtime threat detection from PapelShip. It runs on the end user's machine, next to your application, and flags debuggers and cracking tools, including renamed and custom ones that a blacklist would miss. It is included with PapelShip+.

It doesn't rely on the executable's name. It inspects UI layout patterns, window handles and memory signatures, and analyses a screenshot of the flagged window. Read how qPAnalyzer detects renamed and custom tools.

It is tuned to avoid that. Whitelist tools per product with custom instructions for the analyzer, mark any finding as Not a threat in the Threat Vault, and keep machines you vouch for as trusted devices.

Only if you tell it to. Every signal feeds one score, and you choose what happens at each threshold, from a warning to a ban. With delayed action mode, the penalty follows after a randomized delay.

Yes. Each scan report shows the result, the risk score, the stage that decided it, the tools found and a written assessment, with the captured screenshots as evidence. Flagged binaries are kept in the Threat Vault.

Security signals about the environment your application runs in, screenshots of flagged windows, a desktop capture if you turn it on in Remote Settings, and the binaries a scan flags. Everything is shown in your dashboard.

qPapel Auth v5.5 or later, with the latest Lib, Include and qPapelAuth64.dll. Then enable the QP Analyzer step in Remote Settings; you can change it at any time without shipping a build.

It is included with PapelShip+ at €14.99 a month. Scans are billed at their real cost from your AI balance, and every scan includes window screenshot analysis. See pricing for the full plan comparison.