Writing to a running (in-use) executable file

[Franeppe]

Originally Posted by heXer

4. Have you write to running.exe success?

Yes, i can write to running.exe file.

How did you solve the problem?

[heXer]

@Teerayoot
The nod32 is too foolish.

[Sten]

Originally Posted by Franeppe

How did you solve the problem?

He uses:

MoveFileA(<original.exe>, <original.bak>);
CopyFileA(<original.bak>, <original.exe>);
WaitForSingleObject(hProcess, INIFINITE);
DeleteFileA(<original.bak>);

Just as I've proposed above. Nothing extremely interesting.

[Maximus]

If you have time to spend and admin rights on the system, you might try to play with "\\.\PhysicalDriveN" access -be careful, anyway.
(CreateFile&DeviceIOControl)

If your file system is NTFS, you could get into very big trouble when accessing the drive on psysical level, since much of NTFS is still undocumented and many structures change with every Windows version (or even service pack).

My idea would be to use WinHex scripting. I don't know if this works, but with the normal WinHex you can hex-edit files directly on disk when browsing psysical or logical disks. So I guess with the WinHex scripting system you could do the same.

[Maximus]

And buggy...
I faced an incredible NTFS bug that blocked, in order:
WinXp, Win2k, WinXp Installer CD, Win2k Installer CD, UBCD winXP(!!).
I installed Linux on an fresh mounted hd -the only way to run sw-, formatted 1st partition to fat, and recovered there.
*deadly* code somewhere...