Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I have a program that checks a lot of local files. When the program runs I want it to use the local files as normal, but during the loading of the program I'd like it to check for details of files from another locations (I've edited the files to which has made them longer, I'd like it to do the checks on the original but the execution of the modified files.
Is there any way to spoof a program into thinking it's accessing the file system, but actually point it to another location?
I think the best approach would be to redirect the relevant function calls to a dummy functions that "spoof" a file system. You'd probably be interested in modifying the executable's import table.
user578368's answer is correct, but to be more specific: (assuming that you are using Windows) you need to capture/detour the CreateFileA and CreateFileW function pair. They are the ones that programs use to request a file from windows, so you can change the filename before Windows get it.
You can use the link that user578368 gave to modify the import table, or use a hooking library to do it on the fly. A table summerizing these libraries: Comparison of function hooking libraries
At work we use MSDetours for exactly the same purpose.
