Search code examples
cwindowsdriverminifilterkernel-mode

How to delete a file from kernel-mode?

I have a minifilter (kernel-mode). I want to delete a file with specific path (\Device\HarddiskVolume1\file.txt or C:\file.txt) from kernel-mode

Is there any way to do that?

UPDATE: 20150130

I try to use ZwDeleteFile routine as Harry Johnston said. These are my codes:

RtlInitUnicodeString(&gRedirectFullFilePath, "\\Device\\HarddiskVolume1\\test.txt"); // This file existed
InitializeObjectAttributes(&ObjectAttribute, &gRedirectFullFilePath, OBJ_CASE_INSENSITIVE, NULL, NULL); 
status = ZwDeleteFile(&ObjectAttribute);

But it crash my system. Is there anything wrong with my codes? => fixed (This is answer)

Thanks!

Solution

  • The ZwDeleteFile routine:

    The ZwDeleteFile routine deletes the specified file.