Undocumented functions of NTDLL

2OOO, 29 December


NtDeleteFile
NtDeleteFile

NTSYSAPI 
NTSTATUS
NTAPI

NtDeleteFile(
IN POBJECT_ATTRIBUTES ObjectAttributes );



It's very interesting NT System Call... Normally, file deletion is realised as FileDispositionInformation class in a call to NtSetInformationFile. When you use NtDeleteFile, file will be deleted immediatly after call (system isn't waiting for close last HANDLE to file).


ObjectAttributes
You can manipulate ObjectName and RootDirectory members. 
Example: 
  If you have only file name as Unicode string, use it as ObjectName.
  If you have only a HANDLE to file, set it as RootDirectory. Set ObjectName as empty string.




Documented by:
Tomasz Nowak



Requirements:
Library: ntdll.lib


See also:
NtCreateFile
NtOpenFile
NtSetInformationFile