How to delete a file from kernel-mode?

Question

I have a minifilter (kernel-mode). I want to delete a file with specific path (\Device\HarddiskVolume1\file.txt or C:\file.txt) from kernel-mode

Is there any way to do that?

UPDATE: 20150130

I try to use ZwDeleteFile routine as Harry Johnston said. These are my codes:

RtlInitUnicodeString(&gRedirectFullFilePath, "\\Device\\HarddiskVolume1\\test.txt"); // This file existed
InitializeObjectAttributes(&ObjectAttribute, &gRedirectFullFilePath, OBJ_CASE_INSENSITIVE, NULL, NULL); 
status = ZwDeleteFile(&ObjectAttribute);

But it crash my system. Is there anything wrong with my codes? => fixed (This is answer)

Thanks!

The string is missing a backslash, though I wouldn't expect that to cause a crash. Why is `pObjectAttribute` a pointer? Normally it would be a local variable. Is this a file system minifilter driver? I'm not sure whether it is legal to call ZwDeleteFile() in that context. Also check the documented requirements regarding IRQL and special kernel APCs. — Harry Johnston, Jan 30 '15 at 06:51

score 3 · Accepted Answer · answered Jan 29 '15 at 21:44

3

The ZwDeleteFile routine:

The ZwDeleteFile routine deletes the specified file.

answered Jan 29 '15 at 21:44

Harry Johnston

35,639
6
68
158

score 1 · Answer 2 · answered Jan 29 '15 at 11:07

1

By usual methods its not possible to delete the file from kernel mode i.e from device driver.

This kind of practice or idea is highly discouraged.

answered Jan 29 '15 at 11:07

Dilip Kumar

1,736
11
22

score 1 · Answer 3 · answered Jan 29 '15 at 11:09

1

Use FltSetInformationFile() function with FileDispositionInformation class.

answered Jan 29 '15 at 11:09

Rohan

52,392
12
90
87

I delete file from a specific string not in file object. – GSP Jan 29 '15 at 11:23

score 0 · Answer 4 · answered Jan 26 '18 at 19:38

There are many ways in which you can do that as illustrated in the minifilter DeleteSample from Microsoft.

FILE_DELETE_ON_CLOSE flag which you can use in you CreateFile routine of choice.
By setting the FileDispositionInformation
Also notice the newly introduced FILE_DISPOSITION_INFORMATION_EX

Everything should be more clear after you study the sample. Also notice that you could do transactioned deletes and also delete a file by its file ID.

Good luck.

How to delete a file from kernel-mode?

4 Answers4

Linked