#ifndef _NTIOAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteFile(
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
View code on GitHub#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwDeleteFile(
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
View code on GitHubThis function is documented in Windows Driver Kit.
It's very interesting NT System Call... Normally, file deletion is realised as FileDispositionInformation class in a call to NtSetInformationFile. When you use NtDeleteFile, file will be deleted immediately after call (system isn't waiting for close last HANDLE to file).
You can manipulate ObjectName and RootDirectory members.
Example:
If you have only file name as Unicode string, use it as ObjectName.
If you have only a HANDLE to file, set it as RootDirectory. Set ObjectName as empty string.