Interesting Technique (Lock a file)

[mary]

My question is about technique used by Panda-USB-Vaccine to lock files ( as for autorun.inf in this tools)

the file remain locked (impossible to read, write or delete without formatting !!)

So, do you know how we can lock file for ever (and not just lock by a resident process) ?

[tmax]

My question is about technique used by Panda-USB-Vaccine to lock files ( as for autorun.inf in this tools)

the file remain locked (impossible to read, write or delete without formatting !!)

So, do you know how we can lock file for ever (and not just lock by a resident process) ?

Hi,

There is another way to lock your 'autorun.inf' file.

I used winhex tools to edit the USB sector as shown on 'autorun.gif' file.

as you can notice that the actual attribute of 'autorun.inf' is '20' of hex value,

After you alter from '20' to 'E5' and saved, the 'autorun.inf' file cannot be deleted,

or contents of file cannot be view by others and cannot be autorun also, it just act as

a dummy autorun file.

You can reset back from 'E5' to '20' by winhex.

I used this method to protect my USB drive from autorun virus.

[torels]

My question is about technique used by Panda-USB-Vaccine to lock files ( as for autorun.inf in this tools)

the file remain locked (impossible to read, write or delete without formatting !!)

So, do you know how we can lock file for ever (and not just lock by a resident process) ?

what's the use in that ?

btw... Fileopen() "locks" the file

[mary]

Ok, so the technique is to modify disk sector with an hex editor.

but how you know what byte to modify to lock a given file (not necessarly autorun.inf) ? and is it possible with autoit ?

Edited April 29, 2009 by mary

[tmax]

Ok, so the technique is to modify disk sector with an hex editor.

but how you know what byte to modify to lock a given file (not necessarly autorun.inf) ? and is it possible with autoit ?

I just download and install 'Panda-USB-Vaccine', found that it uses same method

to lock file 'autorun.inf' alter attribute from '20' to '40' and rename the original to 'autorun_.inf'.

---- refer to 'auto_panda.gif' file

From hex editor, search for the filename that need protect,

e.g 'mydoc.txt',search for 8 char ,"MYDOC TXT".

At the end of filename '20' of hex value is the attribute of file. Change to '40' to locked it.

---- refer to 'lock.gif' file

I not sure with autoit file disc handling, but will try to solve it.

[ken82m]

Is their a way to do this in the MBR? To write protect the entire FS.

-Kenny

[ulzzang]

They're different level, then I think it's No.

Protect/lock the certain file with Winhex is the method go down to sector level and raw editing the content in disk. When user try to touch that file in regular level (via file explorer/os shell), the action would fail 'coz in lower level the file system has modified/altered. But when you talk about MBR, itself exist in lowest digital level of disk content, so you can go deeper down and protect/lock it with a trick. Unless some physical read-only setup but it's another story, of course.

[ulzzang]

..., so you can go deeper down and protect/lock it with a trick...

Sorry, mistyped... I mean can't