Starting executables in alternate data streams

Question

I've read an article on this topic, and I know running executables from Alternate Data Streams (ADS) is disabled in Windows 7. Is there any alternate way to achieve it?

score 2 · Answer 1 · answered Jul 25 '14 at 05:03

Yes, actually there is a way.

Creating a symbolic link to an executable held in an ADS will allow you to call the link and run the file. For example, if I had an executable called some_exe.exe in a ADS of some_file.txt I could create a link like so:

mklink some_name.exe some_file:some_exe.exe

I can then call some_name.exe to run the executable contained in some_file.txt.

score -1 · Answer 2 · edited Jul 25 '21 at 19:04

-1

Symbolic links don't work for exe's created from ADS, what works is:

expand some_file:some_exe.exe some_name.exe

Script files will run inside ADS directly.

edited Jul 25 '21 at 19:04

zx485

2,337

answered Jul 25 '21 at 12:34

Cody

1

Starting executables in alternate data streams

2 Answers2