Renaming A Running Process' File Image On Windows

Question

I have a Windows service application on Vista SP1 and I\'ve found that users are renaming its executable file (while it\'s running) and then rebooting, thus causing it to fa

Answer 1

As long as the file is still there, Windows can still read from it - it's the underlying file that matters, not its name.

I can happily rename running executables on my XP machine.

Answer 2

your concept is wrong ... the filename is not the center of the file-io universe ... the handle to the open file is. the file is not moved to a different section of disk when you rename it, it's still in the same place and the part of the disk the internal data structure for the open file is still pointing to the same place. bottom line is that your observations are correct. you can rename a running program without causing problems. you can create a new file with the same name as the running program once you've renamed it. this is actually useful behavior if you want to update software while the software is running.

Answer 3

You might consider having your service listen to changes to the directory that your service is installed in. If it detects a rename, then it could rename itself back to what it's supposed to be.

Answer 4

The OS keeps an open handle to the .exe file,. Renaming the file simply changes some filesystem metadata about the file, without invalidating open handles. So when the OS goes to page in more code, it just uses the file handle it already has open.

Replacing the file (writing over its contents) is another matter entirely, and I'm guessing the OS opens with the FILE_SHARE_WRITE flag unset, so no other processes can write to the .exe file.

Answer 5

There are two aspects to the notion of file here:

1. The data on the disk - that's the actual file.

2. The file-name (could be several or none) which you can give that data - called directory entries.

What you are renaming is the directory entry, which still references the same data. Windows doesn't care about your doing so, as it still can access the data when it needs to. The running process is mapped to the data, not the name.

Answer 6

Might be a stupid question but, why do users have access to rename the file if they are not suppose to rename the file? But yeah, it's allowed because, as the good answers point out, the open handle to the file isn't lost until the application exits. And there are some uses for it as well, even though I'm not convinced updating an application by renaming its file is a good practice.