How to delete files from program ?

Index > Windows > How to delete files from program ?

Author

Thread

shutdownall

Joined: 02 Apr 2010
Posts: 517
Location: Munich

shutdownall 16 Jan 2013, 19:11

I have some strange behaviour in my application.
I create a file successful with CreateFile.
I can overwrite this file as soon as I don't leave my application.
If I exit my application and start it again, I can no more overwrite my earlier created file.
But there is no handle to this file open (checked with handle.exe from Mark Russinovich) AND I can easily delete this file from directory manually (but not from my application).

So what's going on and how to create the file to overwrite it next time ?

I read something about security descriptors but I don't understand this stuff really.
Please can anybody explain how to open a file that way, that I can delete or overwrite it next time (when application left and restarted) ?

My code to open the file:

Code:

        invoke  CreateFile,zxfilet,GENERIC_WRITE,FILE_SHARE_READ+FILE_SHARE_DELETE,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL
        mov     [hfile],eax             
<some_code_for_write_to_file>
        invoke  CloseHandle,[hfile]

This works as soon as the application runs again and again (on keypress).
After restart I get INVALID_HANDLE_VALUE.
When I manually delete the file from explorer, everything runs okay till next start of application.
Shocked

By the way - DeleteFile fails same way.

16 Jan 2013, 19:11

Spool

Joined: 08 Jan 2013
Posts: 151

Spool 16 Jan 2013, 19:30

[ Post removed by author. ]

Last edited by Spool on 17 Mar 2013, 04:20; edited 1 time in total

16 Jan 2013, 19:30

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 16 Jan 2013, 19:31

Are you making a temporally file?You can use the FILE_DELETE_ON_CLOSE flag.

16 Jan 2013, 19:31

shutdownall

Joined: 02 Apr 2010
Posts: 517
Location: Munich

shutdownall 16 Jan 2013, 19:35

Spool wrote:

I had that issue. Your application is still executing, try check task manager.

No it is not and there is no open file handle to this file.
I checked it with this utility:
http://technet.microsoft.com/en-us/sysinternals/bb896655.aspx

And there is the question why it is possible to delete the file manually but not from my program. Delete is possible even when the program runs.

16 Jan 2013, 19:35

shutdownall

Joined: 02 Apr 2010
Posts: 517
Location: Munich

shutdownall 16 Jan 2013, 19:36

typedef wrote:

Are you making a temporally file?You can use the FILE_DELETE_ON_CLOSE flag.

Unfortunately not because I want to keep the file after close but rebuild it with this application if needed. In fact it is a special FASM application and it's the converted output in a special WAV file.

16 Jan 2013, 19:36

Spool

Joined: 08 Jan 2013
Posts: 151

Spool 16 Jan 2013, 19:45

[ Post removed by author. ]

Last edited by Spool on 17 Mar 2013, 04:19; edited 1 time in total

16 Jan 2013, 19:45

shutdownall

Joined: 02 Apr 2010
Posts: 517
Location: Munich

shutdownall 16 Jan 2013, 20:03

Spool wrote:

Maybe this, your antivirus is preventing to delete your file. I hate Comodo.

Bingo !

I didn't think at that point.

Yes, it was executed in a sandbox.
And yes, I have Comodo running.
And now it works after removing this application to "trustable applications".

The behaviour was strange but now I understand why I can delete the file in explorer but could not from application before.

Thanks for this hint. Very Happy

16 Jan 2013, 20:03

Spool

Joined: 08 Jan 2013
Posts: 151

Spool 16 Jan 2013, 20:08

[ Post removed by author. ]

Last edited by Spool on 17 Mar 2013, 04:19; edited 1 time in total

16 Jan 2013, 20:08

Spool

Joined: 08 Jan 2013
Posts: 151

Spool 16 Jan 2013, 20:12

[ Post removed by author. ]

Last edited by Spool on 17 Mar 2013, 04:19; edited 1 time in total

16 Jan 2013, 20:12

shutdownall

Joined: 02 Apr 2010
Posts: 517
Location: Munich

shutdownall 16 Jan 2013, 20:18

I found out, that Comodo executes a file in the sandbox when started from FASM (compiling a different FASM version with FASM and start with F9).
Even if I click on "dont execute in sandbox" it executes in the sandbox when started from FASM.

If I open the file directly, it does not start in the sandbox. Shocked

16 Jan 2013, 20:18

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum