How to prevent modules from getting attached to my application process? C#

Question

For Example: I have installed an application called "RivaTuner Statistics Server v6.6.0" which has made for gamers to show FPS mark on games, since WPF apps are using DirectX, this program attaches a module to my WPF app by mistake which makes it crash (without giving any exceptions) before my app gets loaded, and when I close that program, my app works just fine!

I've fixed this problem by setting RenderOptions.ProcessRenderMode = RenderMode.SoftwareOnly

I also have the same problem with BitDefender antivirus, my program is a VPN Connection software that uses Proxifier app to set global proxy.. When my app begins to start Proxifier process, my app crashes without any exceptions.. by the way BitDefender doesn't detect Proxifier or my app as a virus or threat, it just makes my app crash and Proxifier continues to work without any problem. (Which whitelisting my app got the problem solved).

What I want to know generally, is there any way to prevent DLL injection or stopping it after it attached?

Here is the provided information by EventViewer:

Version=1
EventType=APPCRASH
EventTime=131414331835897163
ReportType=2
Consent=1
UploadTime=131414331849773927
ReportStatus=393
ReportIdentifier=c52be1e0-6378-4555-bddc-cd49f22e98d4
IntegratorReportIdentifier=e415e187-7b4d-4689-92a7-5522957c6300
Wow64Host=34404
NsAppName=TurboVPN.exe
AppSessionGuid=000037d0-0001-0015-6d89-3176a3e0d201
TargetAppId=W:00065bd30e4a6caee77eb9ec126f39eeb11200000000!000072443a77ce17608085aa75f649187cf7129fd9a8!TurboVPN.exe
TargetAppVer=2017//06//08:20:58:47!0!TurboVPN.exe
BootId=4294967295
TargetAsId=3395
Response.BucketId=c2e6858b6015d605f3dea6f209e5a680
Response.BucketTable=4
Response.LegacyBucketId=120776215139
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=TurboVPN.exe
Sig[1].Name=Application Version
Sig[1].Value=8.0.0.0
Sig[2].Name=Application Timestamp
Sig[2].Value=5939ba87
Sig[3].Name=Fault Module Name
Sig[3].Value=d3d9.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=10.0.15063.0
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=631de416
Sig[6].Name=Exception Code
Sig[6].Value=c0000005
Sig[7].Name=Exception Offset
Sig[7].Value=000000000000fd0c
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=10.0.15063.2.0.0.256.4
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=9b4f
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=9b4f78d83ca7cfa07fe4d1531372a428
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=9991
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=99915f8f3f68939dc06e64d116ece58a
UI[2]=C:\Users\Mr\Documents\Visual Studio 2015\Projects\TurboVPN\TurboVPN\bin\Release\TurboVPN.exe
UI[3]=TurboVPN has stopped working
UI[4]=Windows can check online for a solution to the problem.
UI[5]=Check online for a solution and close the program
UI[6]=Check online for a solution later and close the program
UI[7]=Close the program
LoadedModule[0]=C:\Users\Mr\Documents\Visual Studio 2015\Projects\TurboVPN\TurboVPN\bin\Release\TurboVPN.exe
LoadedModule[1]=C:\WINDOWS\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\WINDOWS\SYSTEM32\MSCOREE.DLL
LoadedModule[3]=C:\WINDOWS\System32\KERNEL32.dll
LoadedModule[4]=C:\WINDOWS\System32\KERNELBASE.dll
LoadedModule[5]=C:\Program Files\Bitdefender\Bitdefender 2017\Active Virus Control\Avc3_00125_004\avcuf64.dll
LoadedModule[6]=C:\WINDOWS\SYSTEM32\apphelp.dll
LoadedModule[7]=C:\WINDOWS\System32\ADVAPI32.dll
LoadedModule[8]=C:\WINDOWS\System32\msvcrt.dll
LoadedModule[9]=C:\WINDOWS\System32\sechost.dll
LoadedModule[10]=C:\WINDOWS\System32\RPCRT4.dll
LoadedModule[11]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll
LoadedModule[12]=C:\WINDOWS\System32\SHLWAPI.dll
LoadedModule[13]=C:\WINDOWS\System32\combase.dll
LoadedModule[14]=C:\WINDOWS\System32\ucrtbase.dll
LoadedModule[15]=C:\WINDOWS\System32\bcryptPrimitives.dll
LoadedModule[16]=C:\WINDOWS\System32\GDI32.dll
LoadedModule[17]=C:\WINDOWS\System32\gdi32full.dll
LoadedModule[18]=C:\WINDOWS\System32\msvcp_win.dll
LoadedModule[19]=C:\WINDOWS\System32\USER32.dll
LoadedModule[20]=C:\WINDOWS\System32\win32u.dll
LoadedModule[21]=C:\WINDOWS\System32\IMM32.DLL
LoadedModule[22]=C:\WINDOWS\System32\kernel.appcore.dll
LoadedModule[23]=C:\WINDOWS\SYSTEM32\VERSION.dll
LoadedModule[24]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
LoadedModule[25]=C:\WINDOWS\SYSTEM32\MSVCR120_CLR0400.dll
LoadedModule[26]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\mscorlib\59ea37125345a946fbfb8868aa11ed27\mscorlib.ni.dll
LoadedModule[27]=C:\WINDOWS\System32\ole32.dll
LoadedModule[28]=C:\WINDOWS\system32\uxtheme.dll
LoadedModule[29]=C:\Program Files (x86)\RivaTuner Statistics Server\RTSSHooks64.dll
LoadedModule[30]=C:\WINDOWS\SYSTEM32\WINMM.dll
LoadedModule[31]=C:\WINDOWS\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9279_none_08e667efa83ba076\MSVCR90.dll
LoadedModule[32]=C:\WINDOWS\SYSTEM32\WINMMBASE.dll
LoadedModule[33]=C:\WINDOWS\System32\cfgmgr32.dll
LoadedModule[34]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\4b4b69a2aa9b596c8b8e7a32267eac35\System.ni.dll
LoadedModule[35]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\d4035216edd875be919d339859343a6c\System.Core.ni.dll
LoadedModule[36]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\WindowsBase\d6053a0b7badab04868dc6e51ab4c02e\WindowsBase.ni.dll
LoadedModule[37]=C:\WINDOWS\SYSTEM32\CRYPTSP.dll
LoadedModule[38]=C:\WINDOWS\system32\rsaenh.dll
LoadedModule[39]=C:\WINDOWS\SYSTEM32\bcrypt.dll
LoadedModule[40]=C:\WINDOWS\SYSTEM32\CRYPTBASE.dll
LoadedModule[41]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\PresentationCore\b5bfbcf78210cf783ff665fea098ebfa\PresentationCore.ni.dll
LoadedModule[42]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\73dece296df0b44862aa59e1f73825c3\PresentationFramework.ni.dll
LoadedModule[43]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Xaml\44f34f029c456762dba3d085d6b9fa9c\System.Xaml.ni.dll
LoadedModule[44]=C:\WINDOWS\SYSTEM32\dwrite.dll
LoadedModule[45]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\wpfgfx_v0400.dll
LoadedModule[46]=C:\WINDOWS\System32\OLEAUT32.dll
LoadedModule[47]=C:\WINDOWS\SYSTEM32\MSVCP120_CLR0400.dll
LoadedModule[48]=C:\WINDOWS\SYSTEM32\D3DCOMPILER_47.dll
LoadedModule[49]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationNative_v0400.dll
LoadedModule[50]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll
LoadedModule[51]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Configuration\9f298b9fdf9d3d88c051ba8d0cfcdd98\System.Configuration.ni.dll
LoadedModule[52]=C:\WINDOWS\SYSTEM32\urlmon.dll
LoadedModule[53]=C:\WINDOWS\System32\shcore.dll
LoadedModule[54]=C:\WINDOWS\System32\windows.storage.dll
LoadedModule[55]=C:\WINDOWS\System32\powrprof.dll
LoadedModule[56]=C:\WINDOWS\System32\profapi.dll
LoadedModule[57]=C:\WINDOWS\SYSTEM32\iertutil.dll
LoadedModule[58]=C:\WINDOWS\SYSTEM32\SspiCli.dll
LoadedModule[59]=C:\WINDOWS\SYSTEM32\msiso.dll
LoadedModule[60]=C:\WINDOWS\SYSTEM32\PROPSYS.dll
LoadedModule[61]=C:\WINDOWS\System32\shell32.dll
LoadedModule[62]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Xml\246b8fa70f43db970414bb4119fe629f\System.Xml.ni.dll
LoadedModule[63]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Runt73a1fc9d#\9ed83e5a61548d2d78bc4b7a667e9139\System.Runtime.Remoting.ni.dll
LoadedModule[64]=C:\WINDOWS\System32\ws2_32.dll
LoadedModule[65]=C:\WINDOWS\system32\mswsock.dll
LoadedModule[66]=C:\WINDOWS\system32\dwmapi.dll
LoadedModule[67]=C:\WINDOWS\System32\MSCTF.dll
LoadedModule[68]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Drawing\763d0ca89a77cfd983874efe156a9296\System.Drawing.ni.dll
LoadedModule[69]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\d63d7f874bb64e51ee0ef09cc99218f6\System.Windows.Forms.ni.dll
LoadedModule[70]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Security\35f9d2604274a3e8fbf814e10789dc51\System.Security.ni.dll
LoadedModule[71]=C:\WINDOWS\System32\crypt32.dll
LoadedModule[72]=C:\WINDOWS\System32\MSASN1.dll
LoadedModule[73]=C:\WINDOWS\SYSTEM32\DPAPI.dll
LoadedModule[74]=C:\WINDOWS\SYSTEM32\WindowsCodecs.dll
LoadedModule[75]=C:\WINDOWS\SYSTEM32\d3d9.dll
LoadedModule[76]=C:\WINDOWS\SYSTEM32\igdumdim64.dll
LoadedModule[77]=C:\WINDOWS\System32\SETUPAPI.dll
LoadedModule[78]=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Presentatioaec034ca#\248dd0bba3037acdc2ab60513b34c3f2\PresentationFramework.Aero2.ni.dll
LoadedModule[79]=C:\WINDOWS\SYSTEM32\WtsApi32.dll
LoadedModule[80]=C:\WINDOWS\SYSTEM32\WINSTA.dll
LoadedModule[81]=C:\WINDOWS\System32\clbcatq.dll
LoadedModule[82]=C:\WINDOWS\system32\dataexchange.dll
LoadedModule[83]=C:\WINDOWS\system32\d3d11.dll
LoadedModule[84]=C:\WINDOWS\system32\dcomp.dll
LoadedModule[85]=C:\WINDOWS\system32\dxgi.dll
LoadedModule[86]=C:\WINDOWS\system32\twinapi.appcore.dll
LoadedModule[87]=C:\WINDOWS\SYSTEM32\igdusc64.dll
State[0].Key=Transport.DoneStage1
State[0].Value=1
File[0].CabName=Report.zip
File[0].Path=Report.zip
File[0].Flags=196608
File[0].Type=11
File[0].Original.Path=\\?\C:\WINDOWS\system32\Report.zip
FriendlyEventName=Stopped working
ConsentKey=APPCRASH
AppName=TurboVPN
AppPath=C:\Users\Mr\Documents\Visual Studio 2015\Projects\TurboVPN\TurboVPN\bin\Release\TurboVPN.exe
NsPartner=windows
NsGroup=windows8
ApplicationIdentity=ED5A83A5552697FBE579A0CAAEF2FF9E
MetadataHash=1411986728

If you take a look, you can see the attached module LoadedModule[29]=C:\Program Files (x86)\RivaTuner Statistics Server\RTSSHooks64.dll

Answer 1

Preventing the DLL injection technique that this software uses completely defeats the point of using it. It has to do this, the only way it can wire itself into the DirectX render pipeline to display the statistics. That this ends up poorly and crashes your program with a completely undiagnosable AccessViolationException is quite normal. It takes just one change in an internal function that is not part of the documented API, the kind that the utility has to "hook", and the show is over.

It could be fixable, but that has to be done by the author of this utility. It is just one guy, a Russian master-hacker. Hard to get in touch with, his life can't possibly easy lately with Win10 updates arriving at a high rate these days.

You need to consider getting ahead by uninstalling it. There are other ways to accomplish the same thing, ways that are much less brittle, supported and dedicated to WPF. Use the WPF Performance Suite.

Answer 2

AFAIK, there are quite a few ways of preventing other processes to attach to your process. Basically, there are two well-known approaches to attach to external process:

1. Debugging the external process
2. Injecting a thread to that process

you can overcome the first method by implementing one of anti-debug methods(There are a lot of these methods on the internet. An example would be to debug your own process )

To prevent other processes to inject thread to your process, you can set some hooks on CreateRemoteThread or LoadLibrary and initiate a procedure before they attach to your process.