A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #31542  by nullpointer
 Thu May 03, 2018 8:24 am
EP_X0FF wrote: Sun Apr 29, 2018 4:05 am Starting from Windows 10 you cannot delete file of loaded driver as it locked on disk.
If you want similar functionality from your screenshot you need to send IRP to filesystem device driver. Search for KSBinSword for "code". However conseqences of this is unknown for Windows 10.
it work for me can release disk lock by use exploit. though not something to share with rootkit person.