Could you use Process Monitor to move a program to a different computer?

2

Let's suppose you had two computers, both with the same instruction set and Windows version.

Is it possible (okay, anything might be possible, but is it feasible) to use procmon to monitor every file and registry key that the application reads/writes, and DLL that it loads, and just move these to a different computer? Then, move the entire program's directory to that computer, and have it just work?

If it's reasonable to do, how difficult would it be to actaully do?

user465551

Posted 2015-08-19T18:59:47.767

Reputation:

With the caveat that anything is possible, no it is not. For an extremely simple stand alone app sure. But not for anything with any complexity at all. – EBGreen – 2015-08-19T19:25:17.350

1

Its possible but is it worth the time?, you would need several programs and a lot of time, here is one program needed

– Moab – 2015-08-19T21:07:58.213

Answers

0

Yes. Microsoft User Experience Virtualization (UE-V) and Application Virtualization (App-V) are two tools that monitor and capture registry and file writes on one computer and carefully replicate them on other computers. The result is that an application can be run on the target computer without installing it. This is how a very large number of applications are deployed in large enterprises.

It's definitely feasible but rather complicated to pull off successfully. So complicated that Microsoft acquired the predecessor to App-V rather than re-implement it themselves.

alx9r

Posted 2015-08-19T18:59:47.767

Reputation: 326

1Hmm... interesting. Both answers were correct it seems. For the record, I wasn't actually looking to do this myself. I was just wondering if it would be possible, because the act of "installing" software vs. having standalone software was a bit mysterious to me. I was wondering what the main differences were between installed vs standalone programs "under the hood", and it seems that the only differences are changes to the registry and changes to files/folders elsewhere on the system (since if you can mimic these, you can mimic the entire program's environment). – None – 2015-08-24T16:18:11.907

1

It is unlikely. Although procmon does monitor everything the application does, you actually have to perform all actions in order to fully get the entire scope for that application. Not performing a certain task may not expose a certain registry key or file that you miss.

Then again, procmon does not tell you which dll's it registers. One dll may actually load another dll and if you filter solely on the application, that action is not shown.

You would want to start with installing that application to the other computer, then copy the entire folder over, and by monitoring you may see some additional settings which is a much better approach, but even still you may not have everything. But given that it includes an install, it does not conform with your question: move the program.

But if you want to move programs from computer to computer, the easiest way is to start using portable versions of programs or find alternatives that have a portable version. They don't write necessary files to the registry and keep all files in the same folder (or subfolder of) of the program. There are even sites dedicated to portable apps, such as www.portablefreeware.com

LPChip

Posted 2015-08-19T18:59:47.767

Reputation: 42 190