5
Is there any way to detect from the driver that this process is protected ?
Disclaimer: This following procedure depends on undocmented data structure which is extracted from PDB symbol of combase.dll file. As usual this may not work in future Windows OS version.
This is the sample C code to detect protected process. The program accepts a valid process ID ...
1
This is normally not possible. The icon is part of the resource section (.rsrc) which is covered by the signature so any modification will invalidate it and the binary needs to be re-signed.
There may be some parts of the executable you can change without invalidating the signature, but the resource section is not one of them.
Only top voted, non community-wiki answers of a minimum length are eligible
