I am running an application that just after starting, it creates a service (process hacker tool notifies me that driver_app.sys has been created). Indeed, it says that the location of driver_app.sys is:


My problem is that I would like to reverse such driver, but I do not manage to find a way to get the .sys file (I cannot find it anywhere while the app is running, and when it is closed the service stops and the .sys file disappears from the list displayed by process hacker). I am just asking how to do this since I have seen some people on the Internet analyzing this kind of files.

Thanks in advance.

  • Did you try showing hidden system files? – tmr232 Sep 24 '16 at 22:47

There are some possible reasons for that behavior.

  1. As @tmr232 wrote you probably do not see an existing file because it is hidden. In this case enable "show hidden files" option in your file explorer.
  2. The file is created before the use and deleted after it. In this case I'd suggest to use one of 2 options: either try to run a script that always tries to copy this file if it exists, or try to trace the program file accesses with Process Monitor utility from sysinternals package - this will probably show you what exactly happens with the file.
| improve this answer | |
  • OP specifically said he cannot find when the application is running, so I imagine #2 is not particularly helpful. – NirIzr Sep 27 '16 at 13:08
  • @NirIzr He says "I cannot find it anywhere while the app is running". As far as I understand he knows when it happens. – w s Sep 28 '16 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.