flat assembler
Message board for the users of flat assembler.

Index > Windows > How to delete files from program ?

Author
Thread Post new topic Reply to topic
shutdownall



Joined: 02 Apr 2010
Posts: 518
Location: Munich
shutdownall
I have some strange behaviour in my application.
I create a file successful with CreateFile.
I can overwrite this file as soon as I don't leave my application.
If I exit my application and start it again, I can no more overwrite my earlier created file.
But there is no handle to this file open (checked with handle.exe from Mark Russinovich) AND I can easily delete this file from directory manually (but not from my application).

So what's going on and how to create the file to overwrite it next time ?

I read something about security descriptors but I don't understand this stuff really.
Please can anybody explain how to open a file that way, that I can delete or overwrite it next time (when application left and restarted) ?

My code to open the file:

Code:
        invoke  CreateFile,zxfilet,GENERIC_WRITE,FILE_SHARE_READ+FILE_SHARE_DELETE,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL
        mov     [hfile],eax             
<some_code_for_write_to_file>
        invoke  CloseHandle,[hfile]
    


This works as soon as the application runs again and again (on keypress).
After restart I get INVALID_HANDLE_VALUE.
When I manually delete the file from explorer, everything runs okay till next start of application.
Shocked

By the way - DeleteFile fails same way.
Post 16 Jan 2013, 19:11
View user's profile Send private message Send e-mail Reply with quote
Spool



Joined: 08 Jan 2013
Posts: 154
Spool
[ Post removed by author. ]


Last edited by Spool on 17 Mar 2013, 04:20; edited 1 time in total
Post 16 Jan 2013, 19:30
View user's profile Send private message Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
Are you making a temporally file?You can use the FILE_DELETE_ON_CLOSE flag.
Post 16 Jan 2013, 19:31
View user's profile Send private message Reply with quote
shutdownall



Joined: 02 Apr 2010
Posts: 518
Location: Munich
shutdownall
Spool wrote:
I had that issue. Your application is still executing, try check task manager.


No it is not and there is no open file handle to this file.
I checked it with this utility:
http://technet.microsoft.com/en-us/sysinternals/bb896655.aspx

And there is the question why it is possible to delete the file manually but not from my program. Delete is possible even when the program runs.
Post 16 Jan 2013, 19:35
View user's profile Send private message Send e-mail Reply with quote
shutdownall



Joined: 02 Apr 2010
Posts: 518
Location: Munich
shutdownall
typedef wrote:
Are you making a temporally file?You can use the FILE_DELETE_ON_CLOSE flag.


Unfortunately not because I want to keep the file after close but rebuild it with this application if needed. In fact it is a special FASM application and it's the converted output in a special WAV file.
Post 16 Jan 2013, 19:36
View user's profile Send private message Send e-mail Reply with quote
Spool



Joined: 08 Jan 2013
Posts: 154
Spool
[ Post removed by author. ]


Last edited by Spool on 17 Mar 2013, 04:19; edited 1 time in total
Post 16 Jan 2013, 19:45
View user's profile Send private message Reply with quote
shutdownall



Joined: 02 Apr 2010
Posts: 518
Location: Munich
shutdownall
Spool wrote:
Maybe this, your antivirus is preventing to delete your file. I hate Comodo.


Bingo ! Shocked
I didn't think at that point.

Yes, it was executed in a sandbox.
And yes, I have Comodo running.
And now it works after removing this application to "trustable applications".

The behaviour was strange but now I understand why I can delete the file in explorer but could not from application before.

Thanks for this hint. Very Happy
Post 16 Jan 2013, 20:03
View user's profile Send private message Send e-mail Reply with quote
Spool



Joined: 08 Jan 2013
Posts: 154
Spool
[ Post removed by author. ]


Last edited by Spool on 17 Mar 2013, 04:19; edited 1 time in total
Post 16 Jan 2013, 20:08
View user's profile Send private message Reply with quote
Spool



Joined: 08 Jan 2013
Posts: 154
Spool
[ Post removed by author. ]


Last edited by Spool on 17 Mar 2013, 04:19; edited 1 time in total
Post 16 Jan 2013, 20:12
View user's profile Send private message Reply with quote
shutdownall



Joined: 02 Apr 2010
Posts: 518
Location: Munich
shutdownall
I found out, that Comodo executes a file in the sandbox when started from FASM (compiling a different FASM version with FASM and start with F9).
Even if I click on "dont execute in sandbox" it executes in the sandbox when started from FASM.

If I open the file directly, it does not start in the sandbox. Shocked
Post 16 Jan 2013, 20:18
View user's profile Send private message Send e-mail Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar.

Powered by rwasa.