Hey, looking at the FastFat source it seems like the CreateFile -> FILE_DELETE_ON_CLOSE_FLAG is a CBB flag , promoted to FCB_STATE_DELETE_ON_CLOSE on cleanup.
We can modify FCB_STATE_DELETE_ON_CLOSE through a set info with file disposition information deleteFile=true , as mentioned in the archives .
I was thinking it wouldn’t be possible to clear the delete on close flag (specified at create) , but now, looking at the file disposition information ex structure I’m not so sure - FILE_DISPOSITION_ON_CLOSE allows that?
Reviewing the delete sample I can see it can indeed be unset, but another question regarding the sample : they set / unset the delete on close flag in the stream context based on set info requests they see, wouldn’t then the StreamContext->DeleteOnClose flag reflect the true delete on close state of the file? I’m aware of racing deletes , but they will check on post cleanup if the file was deleted regardless if there were racing deletes or not and I’m not sure why
TBH it has been a while since I walked the delete path in FAT and the whole "undo delete on close" thing has been added since. But I do know to be wary of the ways of oplocks for they are subtle and quick to anger