how to edit procmon.exe's driver filename without breaking procmon.exe file

0

I have a program that detects that I am running procmon.exe and after searching a lot I found this solution:

The Device Name of PM is 'PROCMON10' You can see it if you run the Device Manager from the console (cmd.exe) like this set devmgr_show_nonpresent_devices=1 devmgmt.msc Enable in the View option 'show all devices' and then open the non-plug&play node. There you can see PROCMON10. However you can't do much with it. Deleting it does not unload it and will not preserve you from rebooting.

As a workaround it just renaming it to 'BROCMON10'. So now Winlicense/Themida will not complain about it anymore. How to Rename PROCMON10 to BROCMON10? Open Procmon.exe in a Hexeditor(I used winhex) and open the String Search&Replace dialog. Search for: "PROCMON" Replace with: "BROCMON" Options: Care about Case, Search&Replace Unicode String. Save and Done.

Hmm changing the title line of "Process Monitor" to "Brocess Monitor"will completely circumvent the the detection algorithm of Themida and allow to monitor it with PM. However I don't recommand to do this since it might be illegal. Ouch

https://forum.sysinternals.com/process-monitor-themida-tweakvi-clash_topic15130.html

I am trying to rename the driver name from PROCMON23 to BROCMON23. In the new version of procmon it is PROCMON23 instead of PROCMON10, and after doing a search and replace using a hex editor, the exe file no longer runs and gives me this error:

---------------------------
Procmon.exe - Application Error
---------------------------
The application was unable to start correctly (0xc0000005). Click OK to close the application. 
---------------------------
OK   
---------------------------

How can I solve the issue?

hex-editor
procmon
debugger
asked on Super User Apr 8, 2018 by acman123 • edited Apr 8, 2018 by acman123

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0