Renaming A Running Process' File Image On Windows

Question

I have a Windows service application on Vista SP1 and I\'ve found that users are renaming its executable file (while it\'s running) and then rebooting, thus causing it to fa

Answer 1

The OS keeps an open handle to the .exe file,. Renaming the file simply changes some filesystem metadata about the file, without invalidating open handles. So when the OS goes to page in more code, it just uses the file handle it already has open.

Replacing the file (writing over its contents) is another matter entirely, and I'm guessing the OS opens with the FILE_SHARE_WRITE flag unset, so no other processes can write to the .exe file.