Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 10-30-2006, 21:31
Barry Barry is offline
Friend
 
Join Date: Dec 2003
Posts: 84
Rept. Given: 10
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Barry Reputation: 2
How to remove Filemon driver from mem?

I know filemon keeps filem701.sys (I think) resident after exiting, but some Securom protected games detect it and will not run until I reboot, which is a pain.

How do I safely remove Filemons driver from mem so I can run Securom games without a reboot?

Using Filemon 7.03 on WinXP Pro.
Reply With Quote
  #2  
Old 11-01-2006, 02:42
Mkz Mkz is offline
Friend
 
Join Date: Jan 2002
Posts: 98
Rept. Given: 0
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 5
Thanks Rcvd at 25 Times in 17 Posts
Mkz Reputation: 2
Check the sysinternals forums. There is (at least) a thread regarding this issue, and the quick answer is "You can't".
There is no 100% safe way of unloading a kernel driver, that's why the author didn't implement this.
Your options seem to be:
- reboot to unload the driver
- patch the app+driver to avoid detection whenever you load it
- code your own almost-safe way to unload the driver (?)
Reply With Quote
  #3  
Old 11-01-2006, 08:13
Barry Barry is offline
Friend
 
Join Date: Dec 2003
Posts: 84
Rept. Given: 10
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Barry Reputation: 2
Thanks Mkz, I suspected it wasn't going to be easy!

Patching seems the best solution, except I don't know what to patch nor how, unless it's a case of a bit of hexediting.
Reply With Quote
  #4  
Old 11-01-2006, 09:08
giga
 
Posts: n/a
Quote:
Originally Posted by Barry
Thanks Mkz, I suspected it wasn't going to be easy!

Patching seems the best solution, except I don't know what to patch nor how, unless it's a case of a bit of hexediting.
well first you need to know in wich way your game detect filemon
and even then you can patch.
Reply With Quote
  #5  
Old 11-01-2006, 11:11
trickyboy trickyboy is offline
Friend
 
Join Date: Dec 2005
Posts: 43
Rept. Given: 11
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 14
Thanks Rcvd at 3 Times in 3 Posts
trickyboy Reputation: 0
Red face

Quote:
Originally Posted by Barry
Thanks Mkz, I suspected it wasn't going to be easy!

Patching seems the best solution, except I don't know what to patch nor how, unless it's a case of a bit of hexediting.
As giga said :
Quote:
Originally Posted by giga
well first you need to know in wich way your game detect filemon
and even then you can patch.
But you can try change Title Window of filemon and its name file. Some programs detect that by view list process which running in memory.

Good luck.
Reply With Quote
  #6  
Old 11-01-2006, 17:28
Mkz Mkz is offline
Friend
 
Join Date: Jan 2002
Posts: 98
Rept. Given: 0
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 5
Thanks Rcvd at 25 Times in 17 Posts
Mkz Reputation: 2
Quote:
Originally Posted by trickyboy
But you can try change Title Window of filemon and its name file. Some programs detect that by view list process which running in memory.
Not in this case. What is being detected is the driver, not the FileMon app. The driver remains even after the app is terminated, and the target still won't start.

You need at least to change the driver's name, that's the most straightforward way of detection. Rename the driver file - I believe it's a binary resource inside the app's exe. Also, the name of the device it creates should be changed, both in the .sys file, and in the app when it connects to the driver.

I don't know if they (still) work, but check the patches in this thread: http://forum.exetools.com/showthread.php?t=6645
Reply With Quote
  #7  
Old 11-02-2006, 00:06
Barry Barry is offline
Friend
 
Join Date: Dec 2003
Posts: 84
Rept. Given: 10
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Barry Reputation: 2
MKz, those patches just patch the window name, not the driver.

The driver itself is digitally signed too, so tampering with it causes an 'invalid driver' message!! The driver is located in the filemon.exe between 0x19F90 and 0x2C3CF (v7.03 of filemon.exe).

Changing the name of the driver file 'filem701.sys' does not work either. There is reference to FILEMON701 in the file so this must be the connection between filemon and the driver, but seeing as you can't tamper with the driver it seems this is going to be impossible?
Reply With Quote
  #8  
Old 11-10-2006, 22:28
Barry Barry is offline
Friend
 
Join Date: Dec 2003
Posts: 84
Rept. Given: 10
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Barry Reputation: 2
Seems my prayers have been answered, by Mr Gates no less!!

Apparently M$ acquired the Sysinternals website in July 2006 and their utilities are now available from M$:

Code:
http://www.microsoft.com/technet/sysinternals/default.mspx
One utility that caught my eye was ProcessMonitor:

Code:
http://download.sysinternals.com/Files/ProcessMonitor.zip
This has an integrated FileMon and Regmon and does not interfere with Securom as I ran it while running a known Securom game that detects FileMon and it happily loaded while having it's activity logged by Proccess Monitor.

So for now I can monitor without 'certain' copy protections complaining!
Reply With Quote
  #9  
Old 11-22-2006, 20:49
evlncrn8 evlncrn8 is offline
VIP
 
Join Date: Sep 2005
Posts: 179
Rept. Given: 36
Rept. Rcvd 54 Times in 24 Posts
Thanks Given: 49
Thanks Rcvd at 117 Times in 69 Posts
evlncrn8 Reputation: 54
heh and guess what securom will probably blacklist next...
but yeh, as mentioned by the others filemon and regmon do not kill the driver
(which they really should... its just bad coding not to do so)
so the only way to do it is reboot...

hmm actually, there is another way, but it'd be requiring hooks etc and faking
the driver wasn't running..
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Filemon and Regmon on 64 bit windows omidgl General Discussion 2 10-24-2010 00:32


All times are GMT +8. The time now is 17:49.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )