Undocumented functions of NTDLL

2OOO, 29 December

NTSYSAPI 
NTSTATUS
NTAPI


NtDeleteFile(



  IN POBJECT_ATTRIBUTES   ObjectAttributes );

It's very interesting NT System Call... Normally, file deletion is realised as FileDispositionInformation class in a call to NtSetInformationFile. When you use NtDeleteFile, file will be deleted immediatly after call (system isn't waiting for close last HANDLE to file).

ObjectAttributes

You can manipulate ObjectName and RootDirectory members. 
Example: 
  If you have only file name as Unicode string, use it as ObjectName.
  If you have only a HANDLE to file, set it as RootDirectory. Set ObjectName as empty string.

Documented by:

Tomasz Nowak

Library: ntdll.lib

NtCreateFile

NtOpenFile

NtSetInformationFile