Based in this reference, i'm testing IrpDeleteFileForce()
with symbolic link files but status is always 0xC000000D (STATUS_INVALID_PARAMETER) to pFileObject
. I only added FILE_OPEN_REPARSE_POINT
to CreateOptions parameter (of IoCreateFile()
function) in GetDriveObject()
routine and IrpCreateFile()
routine returns STATUS_SUCCESS, i not understood why IrpDeleteFileForce()
failed :-(
Some solution to this?
NTSTATUS GetDriveObject(PUNICODE_STRING pDriveName, PDEVICE_OBJECT* DeviceObject, PDEVICE_OBJECT* ReadDevice)
{
NTSTATUS status;
OBJECT_ATTRIBUTES objectAttributes;
HANDLE DeviceHandle = NULL;
IO_STATUS_BLOCK ioStatus;
PFILE_OBJECT pFileObject;
if (pDriveName == NULL || DeviceObject == NULL || ReadDevice == NULL)
return STATUS_INVALID_PARAMETER;
InitializeObjectAttributes(&objectAttributes, pDriveName, OBJ_CASE_INSENSITIVE, NULL, NULL);
status = IoCreateFile(&DeviceHandle, SYNCHRONIZE | FILE_ANY_ACCESS, &objectAttributes, &ioStatus, NULL, 0, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT | FILE_DIRECTORY_FILE | FILE_OPEN_REPARSE_POINT, NULL, 0, CreateFileTypeNone, NULL, IO_NO_PARAMETER_CHECKING);
if (!NT_SUCCESS(status))
return status;
status = ObReferenceObjectByHandle(DeviceHandle, FILE_READ_DATA, *IoFileObjectType, KernelMode, &pFileObject, NULL);
if (!NT_SUCCESS(status))
{
ZwClose(DeviceHandle);
return status;
}
if (pFileObject->Vpb == 0 || pFileObject->Vpb->RealDevice == NULL)
{
ObDereferenceObject(pFileObject);
ZwClose(DeviceHandle);
return STATUS_UNSUCCESSFUL;
}
*DeviceObject = pFileObject->Vpb->DeviceObject;
*ReadDevice = pFileObject->Vpb->RealDevice;
ObDereferenceObject(pFileObject);
ZwClose(DeviceHandle);
return STATUS_SUCCESS;
}
Solved!
GetDriveObject()
IrpCreateFile()