BetterDiscordAddons icon indicating copy to clipboard operation
BetterDiscordAddons copied to clipboard
verified publisher icon rauenzi

[Bug] Discord still monitors your running applications.

Open AJolly opened this issue 1 year ago • 4 comments

Which plugin/theme is this about? Do Not Track

Describe the Bug Discord still queries and tracks running processes. THis is even if you turn off Game Overlay.

To Reproduce

https://github.com/luctalpe/WMIMon/blob/master/Downloads/WMIMon_Binaries.zip WMIMon.exe -filter=.*Discord.*

IWbemServices::Connect ***** 17:35:05.359 Grp=10310 Op=10311 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 3780 ***** 17:35:05.524 Stop Op=10311 0x0 ***** 17:35:05.524 Grp=10310 Op=10313 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5088 ***** 17:35:05.668 Stop Op=10313 0x0 ***** 17:35:05.668 Grp=10310 Op=10315 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5628 ***** 17:35:05.804 Stop Op=10315 0x0 ***** 17:35:05.804 Grp=10310 Op=10317 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7248 ***** 17:35:05.939 Stop Op=10317 0x0 ***** 17:35:05.939 Grp=10310 Op=10319 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8676 ***** 17:35:06.069 Stop Op=10319 0x0 ***** 17:35:06.069 Grp=10310 Op=10321 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9128 ***** 17:35:06.188 Stop Op=10321 0x0 ***** 17:35:06.188 Grp=10310 Op=10325 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 10804 ***** 17:35:06.321 Stop Op=10325 0x0 ***** 17:35:06.321 Grp=10310 Op=10327 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 11716 ***** 17:35:06.444 Stop Op=10327 0x0 ***** 17:35:06.444 Grp=10310 Op=10329 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 13732 ***** 17:35:06.557 Stop Op=10329 0x0 ***** 17:35:06.557 Grp=10310 Op=10331 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 18756 ***** 17:35:06.687 Stop Op=10331 0x0 ***** 17:35:06.687 Grp=10310 Op=10333 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 19728 ***** 17:35:06.793 Stop Op=10333 0x0 ***** 17:35:06.793 Grp=10310 Op=10335 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 20792 ***** 17:35:06.906 Stop Op=10335 0x0 ***** 17:35:06.906 Grp=10310 Op=10337 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 23112 ***** 17:35:07.024 Stop Op=10337 0x0 ***** 17:35:07.024 Grp=10310 Op=10339 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 24580 ***** 17:35:07.141 Stop Op=10339 0x0 ***** 17:35:07.141 Grp=10310 Op=10341 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 24612 ***** 17:35:07.259 Stop Op=10341 0x0 ***** 17:35:07.260 Grp=10310 Op=10343 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 24884 ***** 17:35:07.376 Stop Op=10343 0x0 ***** 17:35:07.376 Grp=10310 Op=10347 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 27784 ***** 17:35:07.514 Stop Op=10347 0x0 ***** 17:35:07.514 Grp=10310 Op=10349 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 28524 ***** 17:35:07.640 Stop Op=10349 0x0 ***** 17:35:07.640 Grp=10310 Op=10351 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 31160 ***** 17:35:07.765 Stop Op=10351 0x0 ***** 17:35:07.765 Grp=10310 Op=10353 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 31344 ***** 17:35:07.887 Stop Op=10353 0x0 ***** 17:35:07.887 Grp=10310 Op=10355 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 31724 ***** 17:35:08.018 Stop Op=10355 0x0 ***** 17:35:08.018 Grp=10310 Op=10357 _ClientProcessId=13300 [DiscordPTB.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 33168 ***** 17:35:08.153 Stop Op=10357 0x0 ***** 17:35:08.153 Stop Op=10309 0x0 ***** 17:35:16.676 Grp=10397 _ClientProcessId=31184 [Discord.exe] SKYLAKEX SKYLAKEX\jolly IWbemServices::Connect ***** 17:35:16.678 Grp=10398 Op=10399 _ClientProcessId=31184 [Discord.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 15588 ***** 17:35:16.811 Stop Op=10399 0x0

Expected BehaviorNo tracking, WMI queries blocked

Discord Version Stable

Additional Context

AJolly avatar Oct 25 '24 22:10 AJolly

Please try with the latest version

zerebos avatar Dec 15 '24 20:12 zerebos

It'll still connect to WMI but its much better.

wmimon -filter=.*discord.*   | tee wmilogdiscord.log
Parsing:        filtering on .*discord.*
***** *** Successfully Created ETW Session WMITrace_{86915382-63FF-485C-A4D0-E9940BFAE0A3}

***** *** Successfully Added Provider to  ETW Session

***** 03:08:03.238 Grp=29227 _ClientProcessId=1956 [Discord.exe] SKYLAKEX SKYLAKEX\jolly
        IWbemServices::Connect
***** 03:08:08.240 Stop Op=29227 0x0
***** 03:24:12.973 Grp=29238 _ClientProcessId=1956 [Discord.exe] SKYLAKEX SKYLAKEX\jolly
        IWbemServices::Connect
***** 03:24:17.980 Stop Op=29238 0x0
***** 03:24:45.787 Grp=29239 _ClientProcessId=32428 [Discord.exe] SKYLAKEX SKYLAKEX\jolly
        IWbemServices::Connect
***** 03:24:50.799 Stop Op=29239 0x0

AJolly avatar Dec 22 '24 09:12 AJolly

That might be the limit with the APIs available to me, I'm not sure--far from an expert on this.

zerebos avatar Dec 23 '24 04:12 zerebos

Actually, I realized Discord is still making queries. (I had limited WMI permissions previously, thats why our last test did not show anything). WHen I return to stock windows settings:

C:\ccdc\PortableApps\WMIMon_Binaries>wmimon -filter=.discord. | tee wmilogdiscord.log Parsing: filtering on .discord. ***** *** Successfully Created ETW Session WMITrace_{FB4070DB-BE0E-4F64-9BE1-948FE2D8D241}

***** *** Successfully Added Provider to ETW Session

***** 19:02:20.507 Grp=608 _ClientProcessId=27160 [Discord.exe] SKYLAKEX SKYLAKEX\jolly IWbemServices::Connect ***** 19:02:20.508 Grp=609 Op=610 _ClientProcessId=27160 [Discord.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 22148 ***** 19:02:20.544 Stop Op=610 0x0 ***** 19:02:20.544 Stop Op=608 0x0 ***** 19:44:30.218 Grp=2309 _ClientProcessId=27160 [Discord.exe] SKYLAKEX SKYLAKEX\jolly IWbemServices::Connect ***** 19:44:30.220 Grp=2310 Op=2311 _ClientProcessId=27160 [Discord.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6880 ***** 19:44:30.261 Stop Op=2311 0x0 ***** 19:44:30.261 Stop Op=2309 0x0 ***** 19:50:15.892 Grp=2320 _ClientProcessId=27160 [Discord.exe] SKYLAKEX SKYLAKEX\jolly IWbemServices::Connect ***** 19:50:15.893 Grp=2321 Op=2322 _ClientProcessId=27160 [Discord.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 20256 ***** 19:50:15.960 Stop Op=2322 0x0 ***** 19:50:15.960 Stop Op=2320 0x0 ***** 20:32:46.241 Grp=2459 _ClientProcessId=27160 [Discord.exe] SKYLAKEX SKYLAKEX\jolly IWbemServices::Connect ***** 20:32:46.242 Grp=2460 Op=2461 _ClientProcessId=27160 [Discord.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 2564 ***** 20:32:46.302 Stop Op=2461 0x0 ***** 20:32:46.302 Stop Op=2459 0x0 ***** 20:41:31.818 Grp=2486 _ClientProcessId=27160 [Discord.exe] SKYLAKEX SKYLAKEX\jolly IWbemServices::Connect ***** 20:41:31.819 Grp=2487 Op=2488 _ClientProcessId=27160 [Discord.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 10592 ***** 20:41:31.907 Stop Op=2488 0x0 ***** 20:41:31.907 Stop Op=2486 0x0 ***** 20:41:36.825 Grp=2497 _ClientProcessId=27160 [Discord.exe] SKYLAKEX SKYLAKEX\jolly IWbemServices::Connect ***** 20:41:36.827 Grp=2498 Op=2499 _ClientProcessId=27160 [Discord.exe] SKYLAKEX SKYLAKEX\jolly Start IWbemServices::ExecQuery - root\cimv2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 33100 ***** 20:41:36.953 Stop Op=2499 0x0

AJolly avatar Dec 30 '24 05:12 AJolly