I have a file that is locked for writing and delete access (most likely another process is using it) from the windows api. Is there any way for a kernel mode driver to use a Zw* function or something to delete or overwrite such a file?

Did you consider that it is locked for a good reason?

I imagine it would just be easier to kill the offending task, delete the file and then restart the task. Pulling a file out from under the task will likely cause it to crash anyway. So you are unlikely to save any effort by forcibly deleting the file without notifying the locking task.

the best way to do it on my opinion is, if u know the process thats using this file, u can list all handles used by this process using (NtQuerySystemInformation) and use (NtQueryInformationFile) to convert that handle to its file name, check if its the same as the one ur looking for, and if it is simply use (CreateRemoteThread) and (CloseHandle) to close the handle as safely as possible.
i know it seems alot of work, but that depends on how bad u need that code.
i did it before in delphi, if ur intersted in my delphi code just drop me a message.

mario29,

I ran into this with a notebook that crashed violently, and upon recovery there was a corrupted file which I could not delete. What finally worked for me was TakeOwn:

technet.microsoft.com/en-us/library/cc753024(WS.10).aspx

After using this as--administrator--I was able to delete the file.

hth,

farrier

Thanks but I need to delete the file and I don't know the name of the process using the file. I don't mind if the process using the file crashes, I need to delete/overwrite the file. Is there a way of determining the process id of a process accessing a file, or even better is there a way of deleting/overwriting a locked file from kernel mode?

u can use a driver to do all this like "Unlocker" does (google it), but still, if u dont know the process using ur handles, u can use the same way to look for it in all processes and unlock it when its found. and no it isnt slow.