Deleting a file forcefully even though it is being used by the other process

Question

I am developing a application which requires to delete a file no matter it is being used by other process

Consider the following snippet of code.

using System;
using System.IO;

namespace DotNet_Concepts.File_Operation
{
    class Deleting_File_Which_Is_In_Use
    {
        static void Main(string[] args)
        {
            StreamReader lclFileStream = null;
            string lclFileName=string.Empty;
            try
            {
                lclFileName=@"E:\Visual Studio 2008 Projects\DotNet Concepts\DotNet Concepts\Local Files\Garbage.txt";
                if (File.Exists(lclFileName))
                {
                    lclFileStream = new StreamReader(lclFileName);
                    if (lclFileStream != null)
                    {
                        //Doing some operation
                    }
                    //Deleting the file before closing the stream
                    File.Delete(lclFileName);
                }
            }
            catch (Exception ex)
            {

                System.Diagnostics.Debug.WriteLine(ex.StackTrace);
            }
            Console.ReadLine();
        }
    }
}

I am deleting the file which is used by the same process. Is it possible to delete the file

Thanks, Amit Shah

Answer 1

Yes, this is a known Windows security concern, known as a "handle recycle attack". It is technically possible to walk the undocumented kernel handle table, inject code in the process that owns the handle and call CloseHandle() to close the file handle. Very hard to exploit, you need admin rights to do this. Much better ways to screw up a process if you have that right.

What results is more of a Denial Of Service attack, one that randomly fecks up the machine with no way to find out how it happened. The process is not aware that the file handle was closed, it didn't close it, and just keeps writing to the handle. The written data falls into the bit bucket. Ignoring the return value of WriteFile() is pretty standard in most unmanaged programs.

Until the process opens another handle to write to, say, a database. Handles are recycled, it can get the same handle value back. Now the process is writing the normal database data, intermixed with the data that was supposed to go in the now-closed file.

Hilarity ensues when anybody tries to read the data back from that database. Or whatever other resource got destroyed, it's random. You are kinda covered though, nobody will be able to figure out that it was your program that destroyed the machine.

Answer 2

using System.Collections;
using System.Diagnostics;
using System.Management;

if (File.Exists(@"D:\New folder\Test0001.wav"))
{
    GC.Collect();
    GC.WaitForPendingFinalizers();
    FileInfo f = new FileInfo(@"D:\New folder\Test0001.wav");
    f.Delete();
}