Click here to Skip to main content
15,913,467 members
Please Sign up or sign in to vote.
1.00/5 (2 votes)
See more:
Hi, everybody
I know exe file is copied into memory and is executed, if I run exe file.
But why can't I delete an exe file?

Can anyone please explain me?
Posted
Updated 26-Oct-19 10:50am
Comments
ZurdoDev 10-Dec-15 10:07am    
Because it is in use. That's how windows works.
Sergey Alexandrovich Kryukov 10-Dec-15 10:10am    
Why?
—SA
Philippe Mori 10-Dec-15 12:38pm    
The application is not necessarily completly in memory if swapping occurs for example. Have you ever noticed that if you open a lot of application for long time and return to an application already opened but not used since a while, it take some time for it to be usable again? This is an indication that some code has been swapped out. If the file would have been deleted, then how that code could be reloaded?

1 solution

It is impossible to delete any file loaded in memory for execution. The only way to delete it is to kill the process which uses the file, say, with TerminateProcess:
https://msdn.microsoft.com/en-us/library/windows/desktop/ms686714%28v=vs.85%29.aspx[^].

But beware: if you have a need to delete such file, it's a pretty certain indication of some kind of misuse. If you really have a need to delete a file which is an executable module used by some application and cannot do it, it means that the application has some bugs which you have to fix. Or the application is not designed to be terminated at that moment, so you should not delete any file it uses. And so on…

[EDIT]

By the way, your understanding of how EXE works is wrong: "exe file is copied into memory and is executed". If you did it, you could not start the process based on the application code. Application is loaded by an important part of software, the loader, which does a number of sophisticated things. One important part of it is: on systems based on x86 architecture in protected mode, you cannot execute any piece of code loaded in memory in the application mode at all, due to hardware-based execution prevention; preparation of the piece of code memory is one of the kernel-mode operations not allowed in the outer ring.

—SA
 
Share this answer
 
v4
Comments
BillWoodruff 10-Dec-15 12:22pm    
+5 very clear explanation.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900