-1

I'm looking for solution to delete or (preferably directly) overwrite source of an exe file while it is running.

To explain further before you get it all wrong, I'll give an example:

I have an exe file on drive D:\ which I run (with previously posted question's answer, giving params to "Start in" folder on C:\Program Files\MyProgram\" so it finds its dlls. Now after the file is running, I'd like to rewrite the file's byte stream (just like opening it in hex editor...), or at least delete it so I can copy over new exe file directly using same name.

So far the solution I'm using is that I trigger format D: command for the whole drive D:\ (which, in my case is ramdisk and thumb-drive, as I only have this exe on it, I copy it there as necessary), since that removes the file and let's me copy new file there.

Trying to use del myProgram.exe even with -force flag triggers error that access to the file is denied. Same goes if I try to overwrite the contents of the file.

Is there any alternative to do that without using the format command, as that requires to have partition drive only for the purpose?

Update: Note: MoveFileEx and similar techniques that require termination of the process or system restart/reboot are not qualified as a solution. This should be done while the process is running without further actions that can compromise the process's run state.

On a side note, when formatting the drive using the Powershell's format command, the file is gone, although if viewing the partition using Hex viewer tool, there is full binary (hex) content of the exe visible there and an be restored using just as simple as copy-paste technique. This is one of the points as to where overwriting the file contents would be preferable than deleting the file directly.

Please note: This is a knowledge and skills based question, and would therefore appreciate sparing the moral and security-concerning comments about such actions and behaviour.

Ansgar Wiechers
  • 193,178
  • 25
  • 254
  • 328
That Marc
  • 1,134
  • 3
  • 19
  • 42
  • 1
    Possible duplicate of [How can a program delete its own executable](http://stackoverflow.com/questions/1606140/how-can-a-program-delete-its-own-executable) – TessellatingHeckler Mar 14 '17 at 22:21
  • Not really. The topic you mention has answers with killing the process and/or deletion on scheduled restart. I, on the other hand specifically pointed out that it can be deleted without terminating process or restarting. Perhaps I should add to the post that this is also a requirement as well, though. – That Marc Mar 14 '17 at 22:24
  • It's not surprising that you can still see the file's content with a disk editor. Deleting a file or (quick)formatting a volume does not wipe the content from the disk. – Ansgar Wiechers Mar 14 '17 at 22:37
  • I am aware of that. Hence the point of preferring overwriting file's raw content over the deletion - overwriting does not allow for file recovery anymore. Regular (zeroing) format is slow procedure to use as alternative. – That Marc Mar 14 '17 at 22:40

2 Answers2

0

For deleting/replacing/overwriting a file at least two conditions must be met:

  • The user performing the operation must have the required permissions to do so. This can be verified for instance via Get-Acl or icacls.
  • Windows must not have an open handle to the file. This can be checked for instance with tools like Process Explorer or handle. These tools can also be used to forcibly close open handles, although that's not recommended as it may cause data loss and/or damage to the files in question. I'm not sure, though, if it's actually possible to close handles to an executable without terminating the process.

Note that antivirus software is likely to interfere with this kind of operation.

Ansgar Wiechers
  • 193,178
  • 25
  • 254
  • 328
  • But since it is allowed to format the drive with files in use, even executables (regular open files would be lost unless stored elsewhere prior closing, while exe can't even be stored (not taking into account fancy memory block reading actions)), there is a way to do deleting action on a filesystem, even without special permissions or unlocking the handles at all. Which, in my opinion at least, means that it can be done in some way...? – That Marc Mar 14 '17 at 22:35
0

The basic problem here is that Windows loads from the .EXE upon demand, it's not all read in at once.

If you destroy the original file what happens when it tries to load in a page that no longer exists?

If I had to write something of this sort I would copy the .exe to a temporary location (beware that running code from the temp directory may be prohibited), run the new .exe, terminate the old one and then do what I want to it.

Loren Pechtel
  • 8,945
  • 3
  • 33
  • 45
  • Exactly the reason! The program runs and loads only what is needed at the time, and should get ghosted after successfully existing in run-time and in run-time only. By that, there is no chance of getting the source file as a whole piece. It's taken into account while writing the app that it can not load anything after the phase of deletion. – That Marc Mar 14 '17 at 22:52
  • @ThatMarc The problem is that Windows doesn't know the file is gone--if you do manage to get rid of it your program might just go boom. – Loren Pechtel Mar 14 '17 at 22:56