Question

For A.EXE PE file, if the program runs as test mode, I would like to change the process name to “A_TEST.exe”.
And if the program runs as safe mode, I want to change to “A_SAFE.exe”

The file name must be same(A.EXE).

Is it possible?

Answer 1

If “process name” is a name which shows Task Manager – you can change it only from ring0.

From ring3 you can only change a default window title.

#include <intrin.h>

PEB* peb = (PEB*)__readfsdword(0x30);

wchar_t newTitle[] = L"NewTitle";
UNICODE_STRING newTitleUStr = {sizeof(newTitle), sizeof(newTitle), newTitle};
peb->ProcessParameters->WindowTitle = newTitleUStr;