32

We are using an application control solution which denies access for some exes according to their original filename. Is it possible to change original filename with hex editor or another method?

enter image description here

  • 11
    Basing a security solution on the immutability of a property and then asking if that property can be changed trivially seems to be in scope indeed. OP asks "Is it possible?" not "How can I do it?" – MechMK1 May 27 at 8:13
  • 10
    To the OP: If you want a solution that is more difficult to defeat, you may want to use some kind of code signing. – Kevin May 27 at 15:43
  • 10
    Have you noticed the "Remove Properties and Personal Information" in your screenshot? Try clicking on it and select "Original Filename". – Damon May 27 at 19:14
  • 13
    I'm uncertain if frkntn is trying to create a security system or bypass one. – Mooing Duck May 28 at 4:38
  • 6
    If I want to run something you don't want me to run, I'l be rather annoyed but recompile it from source with a different name. Good luck matching that. – Joshua May 28 at 15:18
58

Yes. There is a tool on GitHub here that can change that information. It supports both 64-bit and 32-bit.

The syntax I used: rcedit-x64.exe cmx.exe --set-version-string OriginalFilename "cmdx.exe" --set-version-string FileDescription "details are irrelevant"

enter image description here

Therefore, your solution may be efficient against beginners, but not against people with IT knowledge.

  • 26
    If people are allowed to download and run arbitrary applications from the Internet, there's little point in preventing them from running specific apps on the local machine. "The other side of the airtight hatchway"... – IMil May 28 at 1:03
  • 11
    Does this invalidate code signing? – Sevron May 28 at 10:11
  • 3
    Yes, it should invalidate it because the cryptographic hash is also used to validate integrity and file CRC changes after such alteration. – Overmind May 28 at 12:16
  • @IMil you can also make the change with notepad (though not practical if you want to change it to something longer). It's just a lot easier with this dedicated tool. – OrangeDog May 28 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.