RE: What's the easiest way to delete files from kernel dr- ivers

There are three ways using Nt API.

  1. Nt(Zw)DeleteFile - the simplest one

  2. Nt(Zw)CreateFile with

  • DesiredAccess = DELETE
  • CreateOption = FILE_DELETE_ON_CLOSE

Nt(Zw)Close - this really deletes the file

  1. Nt(Zw)CreateFile with
  • DesiredAccess = DELETE

Nt(Zw)SetInformationFile with

  • FileInformationClass = FileDispositionInformation
    and FILE_DISPOSITION_INFORMATION.DeleteFile = TRUE

Nt(Zw)Close - this really deletes the file

Paul

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Sun, Guoqing
Sent: Tuesday, January 09, 2001 4:40 PM
To: NT Developers Interest List
Subject: [ntdev] What’s the easiest way to delete files from kernel
drivers

What’s the easiest way for drivers to delete files from the kernel mode?
I hope it is not to construct your own delete IRP.

Guoqing


You are currently subscribed to ntdev as: xxxxx@compelson.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com