-
-
[求助]文件关闭时,无法将文件删除,为什么?
-
发表于: 2010-7-20 10:21 3354
-
文件关闭时,无法将文件删除,为什么?
HANDLE openLogfile()
{
UNICODE_STRING uniName;
OBJECT_ATTRIBUTES objAttr;
HANDLE handle;
NTSTATUS ntstatus;
FILE_DISPOSITION_INFORMATION Dispose;
IO_STATUS_BLOCK IoStatus;
RtlInitUnicodeString(&uniName, LOG_FILE); // or L"\\SystemRoot\\example.txt"
InitializeObjectAttributes(&objAttr, &uniName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL, NULL);
// Do not try to perform any file operations at higher IRQL levels.
// Instead, you may use a work item or a system worker thread to perform file operations.
if(KeGetCurrentIrql() != PASSIVE_LEVEL)
return NULL;
ntstatus = ZwCreateFile(&handle,
FILE_APPEND_DATA,
&objAttr, &log_file_ioStatusBlock, NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE,
FILE_OPEN_IF,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL, 0);
if(NT_SUCCESS(ntstatus)) {
Dispose.DeleteFile = TRUE;
ntstatus = ZwSetInformationFile(handle,&IoStatus,&Dispose,sizeof(FILE_DISPOSITION_INFORMATION),
FileDispositionInformation);
if( NT_SUCCESS(ntstatus) )
return handle;
}
return NULL;
}
但是调用ZwClose关闭文件后,文件没有删除?不知道为什么,是哪里设置不正确?谢谢
HANDLE openLogfile()
{
UNICODE_STRING uniName;
OBJECT_ATTRIBUTES objAttr;
HANDLE handle;
NTSTATUS ntstatus;
FILE_DISPOSITION_INFORMATION Dispose;
IO_STATUS_BLOCK IoStatus;
RtlInitUnicodeString(&uniName, LOG_FILE); // or L"\\SystemRoot\\example.txt"
InitializeObjectAttributes(&objAttr, &uniName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL, NULL);
// Do not try to perform any file operations at higher IRQL levels.
// Instead, you may use a work item or a system worker thread to perform file operations.
if(KeGetCurrentIrql() != PASSIVE_LEVEL)
return NULL;
ntstatus = ZwCreateFile(&handle,
FILE_APPEND_DATA,
&objAttr, &log_file_ioStatusBlock, NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE,
FILE_OPEN_IF,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL, 0);
if(NT_SUCCESS(ntstatus)) {
Dispose.DeleteFile = TRUE;
ntstatus = ZwSetInformationFile(handle,&IoStatus,&Dispose,sizeof(FILE_DISPOSITION_INFORMATION),
FileDispositionInformation);
if( NT_SUCCESS(ntstatus) )
return handle;
}
return NULL;
}
但是调用ZwClose关闭文件后,文件没有删除?不知道为什么,是哪里设置不正确?谢谢
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!
赞赏
他的文章
- 2748
- [求助]下面的汇编,如何翻译为c++ 2808
- [求助]帮忙看看,这段字符是什么加密的? 4209
- [求助]这段汇编代码是啥意思? 4367
- [求助]Od脚本的问题 3241
看原图
赞赏
雪币:
留言: