Delete File during shutdown processing

How can I delete a file when my filter driver receives a
SystemPowerState -> PowerSystemShutdown (System State). I tried to
erase a file and nothing is happen. The file is always present in the
hard disk.

Here is the code

RtlInitUnicodeString( &m_FileName, filename );
InitializeObjectAttributes( &m_objectAttributes,
&m_FileName,
OBJ_CASE_INSENSITIVE,
NULL,
NULL );
status =
ZwCreateFile
(
&m_FileHandle,
DELETE,
&m_objectAttributes,
&ioStatusBlock,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,
FILE_DELETE_ON_CLOSE ,
NULL,
0
);

if (!NT_SUCCESS(status))
{
KdPrint ((“ERROR to OPEN File\n”));
}
else
{
KdPrint ((“SUCCESS to OPEN File\n”));
Disposition.DeleteFile = TRUE;
status =
ZwSetInformationFile(m_FileHandle,&ioStatusBlock,
(void*)&Disposition, sizeof(Disposition),
FileDispositionInformation);
if (!NT_SUCCESS(status))
{
KdPrint ((“ERROR Delete %d\n”,status));
}

status = ZwClose(m_FileHandle);
if (!NT_SUCCESS(status))
{
KdPrint ((“Cannot Close %d\n”,status));
}
else
{
KdPrint ((“CloseOK”));
}

}

Also, the file is properly deleted when I use these instructions within
an IRP_MN_REMOVE_DEVICE.

Any idea to fix it?

Regards

Christian

That’s odd, I would assume that if those calls succeed the filesystem is
going to guarantee it’s still going to be able to flush the changes. Is
it Fat or NTFS?

Generally, I don’t think what you’re going makes sense. Why do you want
to delete this file? Can’t you delete it at system startup? If it’s a
security issue, then what if the user simply pulls the power cord?

Christian Grenier wrote:

How can I delete a file when my filter driver receives a
SystemPowerState -> PowerSystemShutdown (System State). I tried to
erase a file and nothing is happen. The file is always present in the
hard disk.

Here is the code

RtlInitUnicodeString( &m_FileName, filename );
InitializeObjectAttributes( &m_objectAttributes,
&m_FileName,
OBJ_CASE_INSENSITIVE,
NULL,
NULL );
status =
ZwCreateFile
(
&m_FileHandle,
DELETE,
&m_objectAttributes,
&ioStatusBlock,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,
FILE_DELETE_ON_CLOSE ,
NULL,
0
);

if (!NT_SUCCESS(status))
{
KdPrint ((“ERROR to OPEN File\n”));
}
else
{
KdPrint ((“SUCCESS to OPEN File\n”));
Disposition.DeleteFile = TRUE;
status =
ZwSetInformationFile(m_FileHandle,&ioStatusBlock,
(void*)&Disposition, sizeof(Disposition),
FileDispositionInformation);
if (!NT_SUCCESS(status))
{
KdPrint ((“ERROR Delete %d\n”,status));
}

status = ZwClose(m_FileHandle);
if (!NT_SUCCESS(status))
{
KdPrint ((“Cannot Close %d\n”,status));
}
else
{
KdPrint ((“CloseOK”));
}

}

Also, the file is properly deleted when I use these instructions within
an IRP_MN_REMOVE_DEVICE.

Any idea to fix it?

Regards

Christian


Nick Ryan (MVP for DDK)

Hello,

I just want to clean up the file before to write in. I write the device
resources (I/O Address, IRQ and InstanceId) within this file while the
filter driver receives IRP_MN_START_DEVICE.

I update the file whether I remove manually the device. In fact, I remove
the right InstanceId, IRQ, I/O from the file when a IRP_MN_REMOVE_DEVICE is
sent.

But when a system reset is occured, no IRP_MN_REMOVE_DEVICE is sent by the
Pnp Manager. So, its why im using the PowerState in order to erase the
whole file, but it doesn’t work.

This file is only a report to present all PCI cards available on the system.
A software has to read these informations.

My second issue is what you said, when the user removes the power cord… I
really don’t know how to manage it.

Regards

Christian
----- Original Message -----
From: “Nick Ryan”
Newsgroups: ntdev
To: “Windows System Software Devs Interest List”
Sent: Thursday, September 25, 2003 5:19 PM
Subject: [ntdev] Re: Delete File during shutdown processing

> That’s odd, I would assume that if those calls succeed the filesystem is
> going to guarantee it’s still going to be able to flush the changes. Is
> it Fat or NTFS?
>
> Generally, I don’t think what you’re going makes sense. Why do you want
> to delete this file? Can’t you delete it at system startup? If it’s a
> security issue, then what if the user simply pulls the power cord?
>
> Christian Grenier wrote:
>
> >
> > How can I delete a file when my filter driver receives a
> > SystemPowerState -> PowerSystemShutdown (System State). I tried to
> > erase a file and nothing is happen. The file is always present in the
> > hard disk.
> >
> > Here is the code
> >
> > RtlInitUnicodeString( &m_FileName, filename );
> > InitializeObjectAttributes( &m_objectAttributes,
> > &m_FileName,
> > OBJ_CASE_INSENSITIVE,
> > NULL,
> > NULL );
> > status =
> > ZwCreateFile
> > (
> > &m_FileHandle,
> > DELETE,
> > &m_objectAttributes,
> > &ioStatusBlock,
> > NULL,
> > FILE_ATTRIBUTE_NORMAL,
> > 0,
> > FILE_OPEN,
> > FILE_DELETE_ON_CLOSE ,
> > NULL,
> > 0
> > );
> >
> > if (!NT_SUCCESS(status))
> > {
> > KdPrint ((“ERROR to OPEN File\n”));
> > }
> > else
> > {
> > KdPrint ((“SUCCESS to OPEN File\n”));
> > Disposition.DeleteFile = TRUE;
> > status =
> > ZwSetInformationFile(m_FileHandle,&ioStatusBlock,
> > (void*)&Disposition, sizeof(Disposition),
> > FileDispositionInformation);
> > if (!NT_SUCCESS(status))
> > {
> > KdPrint ((“ERROR Delete %d\n”,status));
> > }
> >
> > status = ZwClose(m_FileHandle);
> > if (!NT_SUCCESS(status))
> > {
> > KdPrint ((“Cannot Close %d\n”,status));
> > }
> > else
> > {
> > KdPrint ((“CloseOK”));
> > }
> >
> > }
> >
> >
> > Also, the file is properly deleted when I use these instructions within
> > an IRP_MN_REMOVE_DEVICE.
> >
> > Any idea to fix it?
> >
> > Regards
> >
> > Christian
> >
> >
> >
>
> –
> Nick Ryan (MVP for DDK)
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@mcdi.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

If I understand, it’s better to erase a file at boot time. How could i
delete it before the installation of the PCI device. In fact, the filter
driver of these PCI devices have to write within this file. But, the file
has to be clean up.

Regards

I found a solution I delete the file from DriverEntry function. This
function is called once the driver is copied in the RAM memory.

Thanks

Christian

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@mcdi.com
Sent: Friday, September 26, 2003 8:22 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Re: Delete File during shutdown processing

If I understand, it’s better to erase a file at boot time. How could i
delete it before the installation of the PCI device. In fact, the
filter
driver of these PCI devices have to write within this file. But, the
file
has to be clean up.

Regards


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@mcdi.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

xxxxx@mcdi.com wrote:

If I understand, it’s better to erase a file at boot time. How could i
delete it before the installation of the PCI device. In fact, the filter
driver of these PCI devices have to write within this file. But, the file
has to be clean up.

Assuming your driver only writes to the file and doesn’t read from it, I
would open it, fseek to the beginning, write my data and truncate the
file. Then the only data contained is that which you just wrote.