With the advent of digital technologies, digital content piracy has become a growing concern. Unauthorized music and movie copying are eating a big bite of the profit of the record industry and the movie studios. Software piracy has also cost software industry billions of dollars each year. The success of the content protection technologies in a large part depends on the capability of protecting software code against tampering and reverse-engineering. The problem is difficult because the software runs on a hacker’s machine which has full control over its execution. In this paper, we focus on the detection of software tampering. We shall present a proactive way to detect the on-going tampering process during software executions before the hacking completely succeeds. We thus can prevent the potential damage from occurring. The integrity check failures triggered during software execution are logged in a way that cannot go undetected later. This clearly provides strong tamper evidence to do both pre and post-compromise forensics analysis. In particular, we consider real world scenarios where the software users have a long term business interest with the software distributor, and where a detection of tampering can bar a hacker from further business. We believe the proactive detection of tampering is of great importance and value in this type of scenario.