Added process job anti-debug check.

[gsuberland]

Debugging applications commonly place debugees into a job object for various reasons, e.g. so that the child processes are closed if the parent crashes. We can exploit this to identify cases where the al-khaser process is part of a job, excluding some edge cases (e.g. console hosting). This new check identifies if the current process is part of a job and, if so, enumerates the job objects to see if any of them are outside a whitelist.

You can test this check by running the al-khaser process from within Visual Studio via Debug -> Start Without Debugging.

[ayoubfaouzi]

Hey gsuberland ! Thanks a lot for your contribution. I checked the trick, neat one.

If the application have more than one process, like a parent spawning a child, this will also trigger. This remember me like that IsParentExplorer() trick which check if the parent process is not explorer and if so it will show that it is being debugged. For a malware author, this trick could be reliable as he knows which process and how much should be in their and he can make a whitelist if needed. I will merge it and will added you in the contribitors list,