There are three ways using Nt API.
-
Nt(Zw)DeleteFile - the simplest one
-
Nt(Zw)CreateFile with
- DesiredAccess = DELETE
- CreateOption = FILE_DELETE_ON_CLOSE
Nt(Zw)Close - this really deletes the file
- Nt(Zw)CreateFile with
- DesiredAccess = DELETE
Nt(Zw)SetInformationFile with
- FileInformationClass = FileDispositionInformation
and FILE_DISPOSITION_INFORMATION.DeleteFile = TRUE
Nt(Zw)Close - this really deletes the file
Paul
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Sun, Guoqing
Sent: Tuesday, January 09, 2001 4:40 PM
To: NT Developers Interest List
Subject: [ntdev] What’s the easiest way to delete files from kernel
drivers
What’s the easiest way for drivers to delete files from the kernel mode?
I hope it is not to construct your own delete IRP.
Guoqing
You are currently subscribed to ntdev as: xxxxx@compelson.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com