3 ms·
Took me a couple of days to figure this out, so I thought I'd share. I also looked at the option of launching the program in a way that doesn't lock the .exe.
by latitude 14y ago
Took me a couple of days to figure this out, so I thought I'd share.
I also looked at the option of launching the program in a way that doesn't lock the .exe. For one, it's complicated. It requires creating a process in a Suspended state using a different executable, then basically gutting the memory of that process and replacing it with your own process copy, which needs to be fully preped with all imports and relocations taken care of, etc. In other words, it's pretty complicated.
But what's more important, the only type of software that employs this sort of process launching is the malware. In fact, the above method is derived straight from one of the viruses that made rounds a couple of years ago [1], and it was used by the virus to masquerade as a legit Windows process. So, in other words, you employ this sort of hackery in your program - you will quickly end up talking to anti-virus vendors about taking your software off their blacklists. It's a cool stuff, too bad it's off limits.
[1] http://blogs.avg.com/news-threats/puppet-process http://blogs.avg.com/news-threats/puppet-process