ReadProcessMemory and software protection

[startup]

i have tried to call kernel32.ReadProcessMemory with no hope

this function can help me to detect some bad programs presence

like
debuggers
file and registry monitors

detect them by window name or window title is not a good idea
cause they can be changed
even can hidden from windows

i have memoryex plugin
i can get addresses and baseaddresses and handles and i have some bad strings list

can i call the function ReadProcessMemory from kernel32 to catch those bad strings ??
and how ??

[Shrek]

I dont mind having a go at this, what program are you trying to get the hProcess handle from so we are on the same page or testing?

[startup]

I dont mind having a go at this, what program are you trying to get the hProcess handle from so we are on the same page or testing?

thanks shrek for replay
i wil explane

the debugger name wil be taken from a table with a loop
i can got hProcess and handle

let us say that the address is 00485a3d
and this is a static address
and that address holds a string like "debugger x"

if i can read that string from this location (address)
i can do things like
exit program
or make registry values .... etc
or do any trik

[webultra]

I wouldn't spend too much time on it, as you should be reading all the processes on startup and while your app is been executed (maybe in another thread). But, there are also apps that can stop/freeze any process and then open a debugger to search for any string, etc. Maybe you can use protection apps like themida or armadillo, but they only worth if your app is not free. But, any app can be *****ed (ask to microsoft lol)

[startup]

Iany app can be *****ed

yes
but it is not about it will be *****ed or not
it is about how difficult and how times it takes to be
i found other ways better than R.P.Mem method
so thanks
and sorry for so late replay