Child Process Question

[puff_m_d]

Hello,

 

If I launch a shielded app, is the protection passed on the the child processes? For example, I use a VPN service. I use their client which manages my connection to the VPN (logon, logoff, available servers, connections, etc.). The client basically acts as a wrapper for OpenVPN which is launched as the connection is established to the VPN. I know from testing that the mbae.dll is not injected into the child process. I can add OpenVPN to the shielded apps and the mbae.dll is injected. However, the child process never shows in the logs. This is observed for all shielded apps that launch as a child process of another shielded app. This got me to thinking whether or not all child processes of a shielded app were already protected and if it is necessary to shield apps that are launched as child processes?

[pbust]

If I launch a shielded app, is the protection passed on the the child processes?

 

Not unless the child process uses the same filename as the parent process.

 

If you do add a child process and it doesn't show up in the logs it might be due to another reason, like for example if the child process doesn't have an active open UI. This is a small bug related to Known Issue #5 but it does not affect the protection.

[puff_m_d]

Hello Pedro,

 

Thanks for the explanation!