lwbkm wrote: ↑Thu May 03, 2018 2:19 am
Li Yong wrote: ↑Wed May 02, 2018 12:18 pm
If success, could provide a code example please? i also need of this functionality force delete.
I still do not understand, maybe close the kernel handle can be deleted, you can try.
Only closing opened handles not will solve to files locked by a FSD (File System Driver) or Minifilter, i already tested
I think that suggestion of EP_X0FF
gave here, can solve my last question and this your question here.
Even least for me, now the question is: - Someone could share a code snippet about how send IRP's directly to ntifs.sys requesting remotion of a file/folder please?
Eg: i never tested this ARK of image above, but already that you have, probably will can see a option of Force Delete on File
Choise a folder that you know that have a FSD protecting these files and try use normal exclusion, obviously not will work, already with option Force Delete (probably present in WIN64AST) the file can be deleted with success
. So i have almost by
sure, that great part of these chinese ARK's, use (or he already used) something based on suggestion of EP_X0FF
(or the same approach).
Then by all this, i belive that we can solve our questions with this approach, but i not have a idea about how must be in source code