Process / File locking by WoW executable?

[dragonbane24]

I've been tweaking a bot program a little and I've noticed something new happening that started with the launch of 8.0 Live.
I usually have WoW up and running and I'll go and kill my app, rebuild, copy it over and relaunch to test a new feature or fix something I broke.
When I rebuild the application and copy it from the build directory to the destination directory I get the message along the lines of..
"Can't copy file, destination is currently locked or in use."

I killed the application before rebuilding and I check Task Manager / Process Hacker, etc. It isn't running.
I check the Open Handles from Resource Monitor and such, but still, not seeing anything there.
I see no handles from any application holding the file open.
But once I close the WoW executable, the lock always goes away and I can copy over.

I thought that maybe my application process hadn't exited cleanly and went into Zombie state with some thread sitting out there just holding onto the WoW handle, but everything I've tried shows that it has exited cleanly.
And I haven't had this problem in WoW version 6 or 7, only with BFA.

Now when I run my application it is run at elevated privileges. WoW does not.
So there should be no way for WoW to get a ReadProcessMemory or other Handle into my application.
It doesn't show up with the Debug privileges when I look at its ACLs. So maybe it is still doing getting a Handle (OpenProcess) somehow but it shouldn't be able to actually do anything with my application without also having elevated permissions.


I'm mainly curious to see if others have experienced anything like this. I only started noticing this when doing development and trying to copy over the existing file.
Anyone experienced this sort of behavior from the WoW executable? Or is this Warden doing something more aggressive?

Thanks.

[charles420]

I personally haven’t had any problems was playing with a few programs earlier today

[maclone]

Just started recently, so I thought I would add to this thread.
It's a tool that only reads memory, running as Admin, while Wow does not.
Running on Windows 10.0.17134.165.

It's not possible to delete the file, however it can be renamed.
OpenedFilesView shows no open handle.
Closing Wow.exe resolves the conflict.

[dragonbane24]

Thanks Maclone. That's the exact message I get as well.

And the app I'm using is also completely passive. Just opens the handle for reading and uses ReadProcessMemory.
No code injection, hooks or writes.

Evidently WoW is now looking for other processes that have requested the handle?
I've read some forum posts about things like this related to Overwatch-style anti-cheat, but not sure how they work around it yet.

Thanks,
-db

Edit: Note, that this doesn't happen every time. Sometimes the file gets locked and sometimes it does not. Might take minutes, or hours.

[air999]

You can use Process Hacker to see which file sections handles opened by WoW. In fact they keep open handles for any running process in system. I think they have some handles leakage bug now.
File sections is used to map .exe file content into memory.

[dragonbane24]

You can use Process Hacker to see which file sections handles opened by WoW. In fact they keep open handles for any running process in system. I think they have some handles leakage bug now.
File sections is used to map .exe file content into memory.

Thanks Air. I checked ProcessHacker a few times when it came up but didn't see the Handle referencing my process.
But it must be there somewhere if it's locking it open. More likely that I was misinterpreting what I was reading.
I'll check it again when it happens again.

It is just the first time I have seen it lock the file from being updated.

Thanks,
-db

[WiNiFiX]

Also started seeing this, and 100% passive (pixels only)
Not seen it occur in c++ only in c# apps.

[maclone]

I've now had Wow.exe locking an executable that had absolutely nothing to do with it.
It's just a normal desktop WinForms program that I was writing it in Visual Studio, until I got the usual copy error that could be solved by killing Wow.exe.

This is definitely annoying.

[ejt]

I've noticed the same thing, started happen yesterday. Taking a look with Process Hacker shows that Wow.exe opens section handles to pretty much all running process executable files on your computer.

Its annoying as hell, not just because it makes rebuilding more tedious until I can implement some hiding technique but because I can't uninstall any software on the computer while Wow.exe is running.

I would assume that the easiest solution is to hide your executable so that they can't find it and open a handle to it.

[WiNiFiX]

So time to make our bots in VB6 and see if Wow knows it exists :P

[NaNraptor]

Has anyone figured out how to hide their executable yet? I am also trying to add some functionality to a C# bot, but if wow is running the exe usually gets locked

[ejt]

Has anyone figured out how to hide their executable yet? I am also trying to add some functionality to a C# bot, but if wow is running the exe usually gets locked

NtQuerySystemInformation function | Microsoft Docs

A good place to start.

[Hazzbazzy]

I can confirm this has started happening to me this week also, this particular process does not touch WoW's memory:

[NaNraptor]

@ejt First place I should have checked , thanks