How to prevent a file being copied or cut in windows file system?

Question

I want that an exe file can't be copied or cut from the Windows file system to paste somewhere.

The exe is made in C#. which must have to be in only one PC.

I have worked with FileSystemWatcher, NSIS, Clipboard. but for all I need to detect whether that file is being copied.

I also have seen 'Prevent'(http www free-download-blog.com disable-cut-paste-copy-delete-rename-functions-using-prevent ), but I need to prevent only that particular exe from being copied or cut.

Any pointer or idea will help.

Answer 1

Well, this is a hard problem. Even if you get explorer.exe to disable cut&paste, what prevents a user from using the command window? Or writing their own exe to do it? Booting up in linux and reading it?

Still, you have a few options (there will be more, most likely) which you could try:

• Use the right permissions: Set the permissions such that the users who you don't want to cut&paste cannot read the file.

• Write a device driver which can hook onto the filesystem calls and do that for you.

• Encrypt the file.

And some hacky options like:

• Use the APPINIT_DLLS regkey to put your own dll to be loaded into each process ( I am not sure if this will work with console process though). Then on your dll load, do IAT hooking to replace the kernel32.dll file calls.

• Replace kernel32.dll with your own version. Might have to do some messing around with the PE format etc.

There are no guarantees though. If for instance, you expect them to be able to execute it, but not copy it, you are probably stuck.

Answer 2

Any local admin will be able to undo anything you do to prevent copying. I can pretty much guarantee the program on that page you mention relies on a service or background process to prevent copy-and-paste, and therefore is easily circumventable. If your users are in a closed environment where none of them are admins and they have very limited rights to their PCs, then you have a chance.

Answer 3

If you need the exe to be executable, you need to permit loading it into memory. As soon as you do, anyone can read it to memory using ReadFile and then write to an arbitrary location using WriteFile. No shell-detectable copying involved.

A good reading: Raymond's post and its comments on preventing copying.