1

I have a program that checks a lot of local files. When the program runs I want it to use the local files as normal, but during the loading of the program I'd like it to check for details of files from another locations (I've edited the files to which has made them longer, I'd like it to do the checks on the original but the execution of the modified files.

Is there any way to spoof a program into thinking it's accessing the file system, but actually point it to another location?

2 Answers 2

3

I think the best approach would be to redirect the relevant function calls to a dummy functions that "spoof" a file system. You'd probably be interested in modifying the executable's import table.

1

user578368's answer is correct, but to be more specific: (assuming that you are using Windows) you need to capture/detour the CreateFileA and CreateFileW function pair. They are the ones that programs use to request a file from windows, so you can change the filename before Windows get it.

You can use the link that user578368 gave to modify the import table, or use a hooking library to do it on the fly. A table summerizing these libraries: Comparison of function hooking libraries

At work we use MSDetours for exactly the same purpose.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.