Jonas L

I still think my go to method for that works... when windows error reporting service runs as system it tries to load a not existing phoneinfo.dll from system 32. If not then every fucking gui process still desperately try to load the not existing edgegdi.dll .....

The rename operation do not change the files destination though... How can we redirect the file move to another folder when we cannot transform the folder the existing file is in as it is not empty?

Well... we dont have to! if we intially make the folder point to c:\temp\ the service will try to move c:\temp\file.exe to c:\recovery\file_s.exe

if we then make an oplock on the file it open first- we can time it so that when we get the oplock callback, we know its now to change the junction folder so it now points to system32.

But this is all a crazy fantasy because in realitity it is impossible to create those symlinks or those oplocks- cuz they dont survive a reboot and we are not logged in yet.....

or maybe use a driver bug for this... if you open a csc path using ipv6 localhost and add an unneeded backslash it will calculate the size of the buffer it redirect to wrong. So 1 byte pool memory will become part of the file name...