在 Windows 上重命名正在运行的进程的文件映像
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/799656/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Renaming A Running Process' File Image On Windows
提问by D.J.
I have a Windows service application on Vista SP1 and I've found that users are renaming its executable file (while it's running) and then rebooting, thus causing it to fail to start on next bootup because the service manager can no longer find the exe file since it's been renamed.
我在 Vista SP1 上有一个 Windows 服务应用程序，我发现用户正在重命名其可执行文件（在它运行时）然后重新启动，从而导致它在下次启动时无法启动，因为服务管理器无法再找到该 exe文件，因为它已被重命名。
I seem to recall that with older versions of Windows you couldn't do this because the OS placed a lock on the file. Even with Vista SP1 I still cannot copy over the existing file when it's running - Windows reports that the file is in use - makes sense. So why should I be allowed to rename it? What happens if Windows needs to page in a new code page from the exe but the file has been renamed since it was started? I ran Process Monitor while renaming the exe file, etc, but Process Mon didn't report anything strange and just logged changing the filename like any other file.
我似乎记得在旧版本的 Windows 中你不能这样做，因为操作系统锁定了文件。即使使用 Vista SP1，我仍然无法在运行时复制现有文件 - Windows 报告该文件正在使用 - 是有道理的。那么为什么要允许我重命名它呢？如果 Windows 需要从 exe 调入新的代码页，但该文件自启动后已被重命名，会发生什么情况？我在重命名 exe 文件等时运行了 Process Monitor，但 Process Mon 没有报告任何奇怪的事情，只是像任何其他文件一样记录更改文件名。
Does anyone know what's going on here behind the scenes? It's seem counter intuitive that Windows would allow a running process' filename (or its dependent DLLs) to be changed. What am I missing here?
有谁知道幕后发生了什么？Windows 允许更改正在运行的进程的文件名（或其依赖的 DLL），这似乎违反直觉。我在这里错过了什么？
回答by Don Dickinson
your concept is wrong ... the filename is not the center of the file-io universe ... the handle to the open file is. the file is not moved to a different section of disk when you rename it, it's still in the same place and the part of the disk the internal data structure for the open file is still pointing to the same place. bottom line is that your observations are correct. you can rename a running program without causing problems. you can create a new file with the same name as the running program once you've renamed it. this is actually useful behavior if you want to update software while the software is running.
你的概念是错误的......文件名不是文件io宇宙的中心......打开文件的句柄是。当您重命名文件时，该文件不会移动到磁盘的不同部分，它仍然在同一个地方，并且磁盘的一部分，打开文件的内部数据结构仍然指向同一个地方。底线是你的观察是正确的。您可以重命名正在运行的程序而不会引起问题。重命名后，您可以创建一个与正在运行的程序同名的新文件。如果您想在软件运行时更新软件，这实际上是有用的行为。
回答by RichieHindle
As long as the file is still there, Windows can still read from it - it's the underlying file that matters, not its name.
只要文件仍然存在，Windows 仍然可以从中读取——重要的是底层文件，而不是它的名称。
I can happily rename running executables on my XP machine.
我可以愉快地重命名在我的 XP 机器上运行的可执行文件。
回答by Ben Straub
The OS keeps an open handle to the .exefile,. Renaming the file simply changes some filesystem metadata about the file, without invalidating open handles. So when the OS goes to page in more code, it just uses the file handle it already has open.
操作系统保持.exe文件的打开句柄，。重命名文件只会更改有关文件的一些文件系统元数据，而不会使打开的句柄无效。因此，当操作系统进入更多代码页面时，它只使用它已经打开的文件句柄。
Replacing the file (writing over its contents) is another matter entirely, and I'm guessing the OS opens with the FILE_SHARE_WRITEflag unset, so no other processes can write to the .exefile.
替换文件（覆盖其内容）完全是另一回事，我猜操作系统打开时FILE_SHARE_WRITE标志未设置，因此没有其他进程可以写入.exe文件。
回答by Oskar Duveborn
Might be a stupid question but, why do users have access to rename the file if they are not suppose to rename the file? But yeah, it's allowed because, as the good answers point out, the open handle to the file isn't lost until the application exits. And there are some uses for it as well, even though I'm not convinced updating an application by renaming its file is a good practice.
可能是一个愚蠢的问题，但是，如果用户不打算重命名文件，为什么他们有权重命名文件？但是，是的，这是允许的，因为正如好的答案所指出的那样，在应用程序退出之前，文件的打开句柄不会丢失。它也有一些用途，尽管我不相信通过重命名文件来更新应用程序是一个好习惯。
回答by NotMe
You might consider having your service listen to changes to the directory that your service is installed in. If it detects a rename, then it could rename itself back to what it's supposed to be.
您可能会考虑让您的服务侦听您的服务安装目录的更改。如果它检测到重命名，那么它可以将自己重命名回它应该是的样子。
回答by Assaf Levy
There are two aspects to the notion of filehere:
这里文件的概念有两个方面：
The dataon the disk - that's the actual file.
The file-name(could be several or none) which you can give that data - called directory entries.
该数据在磁盘上-这是实际的文件。
您可以提供该数据的文件名（可以是多个或没有） - 称为目录条目。
What you are renaming is the directory entry, which still references the same data. Windows doesn't care about your doing so, as it still can access the data when it needs to. The running process is mapped to the data, not the name.
您要重命名的是目录条目，它仍然引用相同的数据。Windows 不在乎您这样做，因为它仍然可以在需要时访问数据。正在运行的进程映射到数据，而不是名称。
