delete-self-poc

delete-self-poc copied to clipboard

Two issues in the code

1

1. ```c LPWSTR lpwStream = (LPWSTR)DS_STREAM_RENAME; fRename.FileNameLength = sizeof(lpwStream); ``` sizeof(lpwStream) is always 8 bytes on 64-bit OS 2. ```c FILE_RENAME_INFO fRename; RtlCopyMemory(fRename.FileName, lpwStream, sizeof(lpwStream)); ``` The FILE_RENAME_INFO.FileName buffer need...

EddieIvan01

Doesn't work in win11 24H2

1

Tested in my latest win11 24H2, this technique can remove the content of the file, but the file itself still exists.

zeze-zeze