32

We are using an application control solution which denies access for some exes according to their original filename. Is it possible to change original filename with hex editor or another method?

enter image description here

Improve this question
6
  • 11
    Basing a security solution on the immutability of a property and then asking if that property can be changed trivially seems to be in scope indeed. OP asks "Is it possible?" not "How can I do it?"
    – user163495
    May 27, 2019 at 8:13
  • 10
    To the OP: If you want a solution that is more difficult to defeat, you may want to use some kind of code signing.
    – Kevin
    May 27, 2019 at 15:43
  • 10
    Have you noticed the "Remove Properties and Personal Information" in your screenshot? Try clicking on it and select "Original Filename".
    – Damon
    May 27, 2019 at 19:14
  • 13
    I'm uncertain if frkntn is trying to create a security system or bypass one.
    – Mooing Duck
    May 28, 2019 at 4:38
  • 6
    If I want to run something you don't want me to run, I'l be rather annoyed but recompile it from source with a different name. Good luck matching that.
    – Joshua
    May 28, 2019 at 15:18

1 Answer 1

Reset to default
59

Yes. There is a tool on GitHub here that can change that information. It supports both 64-bit and 32-bit.

The syntax I used: rcedit-x64.exe cmx.exe --set-version-string OriginalFilename "cmdx.exe" --set-version-string FileDescription "details are irrelevant"

enter image description here

Therefore, your solution may be efficient against beginners, but not against people with IT knowledge.

Improve this answer
4
  • 26
    If people are allowed to download and run arbitrary applications from the Internet, there's little point in preventing them from running specific apps on the local machine. "The other side of the airtight hatchway"...
    – IMil
    May 28, 2019 at 1:03
  • 12
    Does this invalidate code signing?
    – Sevron
    May 28, 2019 at 10:11
  • 4
    Yes, it should invalidate it because the cryptographic hash is also used to validate integrity and file CRC changes after such alteration.
    – Overmind
    May 28, 2019 at 12:16
  • @IMil you can also make the change with notepad (though not practical if you want to change it to something longer). It's just a lot easier with this dedicated tool.
    – OrangeDog
    May 28, 2019 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .