MoveFileEx 의 MOVEFILE_DELAY_UNTIL_REBOOT

MoveFileEx 함수를 사용해서 플래그를 MOVEFILE_DELAY_UNTIL_REBOOT를 주게되면 컴퓨터 리붓 시 파일 이름 변경 및 파일 삭제가 가능한 것을 알 수 있습니다. 이러한 파일 리네임 기능을 윈도우 자체적으로 제공을 해주지요.

그리고 위 함수로 인해 등록을 시키면 아래와 같은 레지스트리 경로에 해당 파일 경로가 등록되게 됩니다.

"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\PendingFileRenameOperations"

그러면 윈도우는 저 레지스트리 값을 언제 읽고 내부에 있는 언제 파일 리네임 처리를 언제 할까요??

간단하게 콜스택만 보면 알 수 있습니다.

해당 파일을 삭제하기 위해서는 NtOpenFile의 두 번째 인자로 DELETE 라는 플래그를 함께 주어야합니다.

그러면 그 때 BP를 걸어 콜스택을 확인해보죠

(Windows 7 x86 에서 진행되었습니다.)

1: kd> kn

 # ChildEBP RetAddr  

00 8dfa3c14 830521ea nt!NtOpenFile

01 8dfa3c14 770870b4 nt!KiFastCallEntry+0x12a

02 002bf4c8 77085ce4 ntdll!KiFastSystemCallRet

03 002bf4cc 48506a7f ntdll!NtOpenFile+0xc

04 002bf500 48509af5 smss!SmpOpenTargetFile+0x24

05 002bf598 4850a2c7 smss!SmpProcessFileRenames+0xbb

06 002bf808 4850a607 smss!SmpLoadDataFromRegistry+0x427

07 002bf978 4850c290 smss!SmpInit+0x1e4

08 002bfa18 4850e946 smss!wmain+0x1f5

09 002bfa5c 77045e7a smss!NtProcessStartupW_AfterSecurityCookieInitialized+0x21f

0a 002bfa9c 770a37c8 ntdll!__RtlUserThreadStart+0x28

0b 002bfab4 00000000 ntdll!_RtlUserThreadStart+0x1b

1: kd> dt _OBJECT_ATTRIBUTES 002bf548

ntdll!_OBJECT_ATTRIBUTES

   +0x000 Length           : 0x18

   +0x004 RootDirectory    : (null) 

   +0x008 ObjectName       : 0x001575d8 _UNICODE_STRING "\??\C:\Users\Administrator\Desktop\1.txt"

   +0x00c Attributes       : 0x40

   +0x010 SecurityDescriptor : (null) 

   +0x014 SecurityQualityOfService : (null) 

1.txt는 삭제하라고 MoveFileEx에서 등록을 해두었습니다. 호출된 콜스택을 보면

Session Manager 프로세스의 초기화 루틴에서 진행되고 있는 것을 알 수 있습니다.

그 과정을 진행하는 함수는 smss.exe의 SmpProcessFileRenames 함수가 되겠네요.

그리고 SmpProcessFileRenames 함수는 내부적으로 보면 smss!SmpFileRenameList 전역변수를 사용해서 리스트를 얻네요.

하지만 이 때는 레지스트리에 등록된 BOOT START 드라이버들이 이미 로드된 상황이라서 드라이버보단 우선순위가 낮다고 볼 수 있습니다.

아래는 관련 코드들입니다.

Windows 7 x86 에서 SmpProcessFileRenames 함수 내용

smss!SmpProcessFileRenames:

48509a3a 8bff            mov     edi,edi

48509a3c 55              push    ebp

48509a3d 8bec            mov     ebp,esp

48509a3f 83ec78          sub     esp,78h

48509a42 8365e000        and     dword ptr [ebp-20h],0

48509a46 803daa04514800  cmp     byte ptr [smss!SmpAllowProtectedRenames (485104aa)],0

48509a4d c645ff00        mov     byte ptr [ebp-1],0

48509a51 c645e400        mov     byte ptr [ebp-1Ch],0

48509a55 7418            je      smss!SmpProcessFileRenames+0x35 (48509a6f)

smss!SmpProcessFileRenames+0x1d:

48509a57 8d45ff          lea     eax,[ebp-1]

48509a5a 50              push    eax

48509a5b 6a00            push    0

48509a5d 6a01            push    1

48509a5f 6a12            push    12h

48509a61 ff1574115048    call    dword ptr [smss!_imp__RtlAdjustPrivilege (48501174)]

48509a67 85c0            test    eax,eax

48509a69 7d04            jge     smss!SmpProcessFileRenames+0x35 (48509a6f)

smss!SmpProcessFileRenames+0x31:

48509a6b c645ff01        mov     byte ptr [ebp-1],1

smss!SmpProcessFileRenames+0x35:

48509a6f 56              push    esi

48509a70 6830135048      push    offset smss!SmssEvt_ProcessFileRenames_Start (48501330)

48509a75 e829e8ffff      call    smss!SmpEventWrite (485082a3)

48509a7a 8b35d0085148    mov     esi,dword ptr [smss!SmpFileRenameList (485108d0)]

48509a80 8975f4          mov     dword ptr [ebp-0Ch],esi

48509a83 81fed0085148    cmp     esi,offset smss!SmpFileRenameList (485108d0)

48509a89 0f8436020000    je      smss!SmpProcessFileRenames+0x28b (48509cc5)

smss!SmpProcessFileRenames+0x55:

48509a8f 53              push    ebx

48509a90 57              push    edi

48509a91 eb03            jmp     smss!SmpProcessFileRenames+0x5c (48509a96)

smss!SmpProcessFileRenames+0x59:

48509a93 8b75f4          mov     esi,dword ptr [ebp-0Ch]

smss!SmpProcessFileRenames+0x5c:

48509a96 8d7e10          lea     edi,[esi+10h]

48509a99 57              push    edi

48509a9a 8d5e08          lea     ebx,[esi+8]

48509a9d 53              push    ebx

48509a9e 6850135048      push    offset smss!SmssEvt_FileRename_Info (48501350)

48509aa3 8975d8          mov     dword ptr [ebp-28h],esi

48509aa6 e83ae9ffff      call    smss!SmpEventWriteString2 (485083e5)

48509aab 33c9            xor     ecx,ecx

48509aad 66390f          cmp     word ptr [edi],cx

48509ab0 7517            jne     smss!SmpProcessFileRenames+0x8f (48509ac9)

smss!SmpProcessFileRenames+0x78:

48509ab2 8b460c          mov     eax,dword ptr [esi+0Ch]

48509ab5 66833840        cmp     word ptr [eax],40h

48509ab9 750e            jne     smss!SmpProcessFileRenames+0x8f (48509ac9)

smss!SmpProcessFileRenames+0x81:

48509abb 83c002          add     eax,2

48509abe 89460c          mov     dword ptr [esi+0Ch],eax

48509ac1 b8feff0000      mov     eax,0FFFEh

48509ac6 660103          add     word ptr [ebx],ax

smss!SmpProcessFileRenames+0x8f:

48509ac9 8d45b0          lea     eax,[ebp-50h]

48509acc 50              push    eax

48509acd 6800001100      push    110000h

48509ad2 8d45e8          lea     eax,[ebp-18h]

48509ad5 50              push    eax

48509ad6 c745b018000000  mov     dword ptr [ebp-50h],18h

48509add 894db4          mov     dword ptr [ebp-4Ch],ecx

48509ae0 c745bc40000000  mov     dword ptr [ebp-44h],40h

48509ae7 895db8          mov     dword ptr [ebp-48h],ebx

48509aea 894dc0          mov     dword ptr [ebp-40h],ecx

48509aed 894dc4          mov     dword ptr [ebp-3Ch],ecx

48509af0 e866cfffff      call    smss!SmpOpenTargetFile (48506a5b)

48509af5 8945f8          mov     dword ptr [ebp-8],eax

48509af8 85c0            test    eax,eax

48509afa 0f8c97010000    jl      smss!SmpProcessFileRenames+0x25d (48509c97)

smss!SmpProcessFileRenames+0xc6:

48509b00 0fb707          movzx   eax,word ptr [edi]

48509b03 6685c0          test    ax,ax

48509b06 7517            jne     smss!SmpProcessFileRenames+0xe5 (48509b1f)

smss!SmpProcessFileRenames+0xce:

48509b08 33db            xor     ebx,ebx

48509b0a 43              inc     ebx

48509b0b 33ff            xor     edi,edi

48509b0d c745f00d000000  mov     dword ptr [ebp-10h],0Dh

48509b14 8d75fe          lea     esi,[ebp-2]

48509b17 885dfe          mov     byte ptr [ebp-2],bl

48509b1a 897dec          mov     dword ptr [ebp-14h],edi

48509b1d eb77            jmp     smss!SmpProcessFileRenames+0x15c (48509b96)

smss!SmpProcessFileRenames+0xe5:

48509b1f 8b7e14          mov     edi,dword ptr [esi+14h]

48509b22 0fb7d8          movzx   ebx,ax

48509b25 0fb707          movzx   eax,word ptr [edi]

48509b28 83c310          add     ebx,10h

48509b2b c745f00a000000  mov     dword ptr [ebp-10h],0Ah

48509b32 6683f821        cmp     ax,21h

48509b36 7406            je      smss!SmpProcessFileRenames+0x104 (48509b3e)

smss!SmpProcessFileRenames+0xfe:

48509b38 6683f840        cmp     ax,40h

48509b3c 7504            jne     smss!SmpProcessFileRenames+0x108 (48509b42)

smss!SmpProcessFileRenames+0x104:

48509b3e 47              inc     edi

48509b3f 47              inc     edi

48509b40 4b              dec     ebx

48509b41 4b              dec     ebx

smss!SmpProcessFileRenames+0x108:

48509b42 64a118000000    mov     eax,dword ptr fs:[00000018h]

48509b48 8b4030          mov     eax,dword ptr [eax+30h]

48509b4b 53              push    ebx

48509b4c ff35080c5148    push    dword ptr [smss!SmBaseTag (48510c08)]

48509b52 ff7018          push    dword ptr [eax+18h]

48509b55 ff1528105048    call    dword ptr [smss!_imp__RtlAllocateHeap (48501028)]

48509b5b 8bf0            mov     esi,eax

48509b5d 85f6            test    esi,esi

48509b5f 7428            je      smss!SmpProcessFileRenames+0x14f (48509b89)

smss!SmpProcessFileRenames+0x127:

48509b61 8b45f4          mov     eax,dword ptr [ebp-0Ch]

48509b64 3b7814          cmp     edi,dword ptr [eax+14h]

48509b67 8975ec          mov     dword ptr [ebp-14h],esi

48509b6a 0f95c0          setne   al

48509b6d 83660400        and     dword ptr [esi+4],0

48509b71 8806            mov     byte ptr [esi],al

48509b73 8d43f0          lea     eax,[ebx-10h]

48509b76 50              push    eax

48509b77 894608          mov     dword ptr [esi+8],eax

48509b7a 8d460c          lea     eax,[esi+0Ch]

48509b7d 57              push    edi

48509b7e 50              push    eax

48509b7f e89c460000      call    smss!memcpy (4850e220)

48509b84 83c40c          add     esp,0Ch

48509b87 eb0d            jmp     smss!SmpProcessFileRenames+0x15c (48509b96)

smss!SmpProcessFileRenames+0x14f:

48509b89 8365ec00        and     dword ptr [ebp-14h],0

48509b8d 33ff            xor     edi,edi

48509b8f c745f8170000c0  mov     dword ptr [ebp-8],0C0000017h

smss!SmpProcessFileRenames+0x15c:

48509b96 837df800        cmp     dword ptr [ebp-8],0

48509b9a 0f8ce0000000    jl      smss!SmpProcessFileRenames+0x246 (48509c80)

smss!SmpProcessFileRenames+0x166:

48509ba0 ff75f0          push    dword ptr [ebp-10h]

48509ba3 8d45c8          lea     eax,[ebp-38h]

48509ba6 53              push    ebx

48509ba7 56              push    esi

48509ba8 50              push    eax

48509ba9 ff75e8          push    dword ptr [ebp-18h]

48509bac ff1514105048    call    dword ptr [smss!_imp__NtSetInformationFile (48501014)]

48509bb2 8945f8          mov     dword ptr [ebp-8],eax

48509bb5 85c0            test    eax,eax

48509bb7 0f8dc3000000    jge     smss!SmpProcessFileRenames+0x246 (48509c80)

smss!SmpProcessFileRenames+0x183:

48509bbd 837df00a        cmp     dword ptr [ebp-10h],0Ah

48509bc1 0f85b9000000    jne     smss!SmpProcessFileRenames+0x246 (48509c80)

smss!SmpProcessFileRenames+0x18d:

48509bc7 3d350000c0      cmp     eax,0C0000035h

48509bcc 0f85ae000000    jne     smss!SmpProcessFileRenames+0x246 (48509c80)

smss!SmpProcessFileRenames+0x198:

48509bd2 8b45ec          mov     eax,dword ptr [ebp-14h]

48509bd5 803800          cmp     byte ptr [eax],0

48509bd8 0f84a2000000    je      smss!SmpProcessFileRenames+0x246 (48509c80)

smss!SmpProcessFileRenames+0x1a4:

48509bde 8b45f4          mov     eax,dword ptr [ebp-0Ch]

48509be1 83c010          add     eax,10h

48509be4 668b00          mov     ax,word ptr [eax]

48509be7 6683e802        sub     ax,2

48509beb 668945d0        mov     word ptr [ebp-30h],ax

48509bef 8b45f4          mov     eax,dword ptr [ebp-0Ch]

48509bf2 668b4012        mov     ax,word ptr [eax+12h]

48509bf6 6683e802        sub     ax,2

48509bfa 668945d2        mov     word ptr [ebp-2Eh],ax

48509bfe 33c0            xor     eax,eax

48509c00 8945b4          mov     dword ptr [ebp-4Ch],eax

48509c03 8945c0          mov     dword ptr [ebp-40h],eax

48509c06 8945c4          mov     dword ptr [ebp-3Ch],eax

48509c09 8d45b0          lea     eax,[ebp-50h]

48509c0c 50              push    eax

48509c0d 6800011000      push    100100h

48509c12 8d45dc          lea     eax,[ebp-24h]

48509c15 8d4dd0          lea     ecx,[ebp-30h]

48509c18 50              push    eax

48509c19 897dd4          mov     dword ptr [ebp-2Ch],edi

48509c1c c745b018000000  mov     dword ptr [ebp-50h],18h

48509c23 c745bc40000000  mov     dword ptr [ebp-44h],40h

48509c2a 894db8          mov     dword ptr [ebp-48h],ecx

48509c2d e829ceffff      call    smss!SmpOpenTargetFile (48506a5b)

48509c32 85c0            test    eax,eax

48509c34 7c4a            jl      smss!SmpProcessFileRenames+0x246 (48509c80)

smss!SmpProcessFileRenames+0x1fc:

48509c36 6a0a            push    0Ah

48509c38 59              pop     ecx

48509c39 33c0            xor     eax,eax

48509c3b 6a04            push    4

48509c3d 8d7d88          lea     edi,[ebp-78h]

48509c40 f3ab            rep stos dword ptr es:[edi]

48509c42 8b3d14105048    mov     edi,dword ptr [smss!_imp__NtSetInformationFile (48501014)]

48509c48 6a28            push    28h

48509c4a 8d4588          lea     eax,[ebp-78h]

48509c4d 50              push    eax

48509c4e 8d45c8          lea     eax,[ebp-38h]

48509c51 50              push    eax

48509c52 ff75dc          push    dword ptr [ebp-24h]

48509c55 c745a880000000  mov     dword ptr [ebp-58h],80h

48509c5c ffd7            call    edi

48509c5e ff75dc          push    dword ptr [ebp-24h]

48509c61 8945ec          mov     dword ptr [ebp-14h],eax

48509c64 ff1510105048    call    dword ptr [smss!_imp__NtClose (48501010)]

48509c6a 837dec00        cmp     dword ptr [ebp-14h],0

48509c6e 7c10            jl      smss!SmpProcessFileRenames+0x246 (48509c80)

smss!SmpProcessFileRenames+0x236:

48509c70 6a0a            push    0Ah

48509c72 53              push    ebx

48509c73 56              push    esi

48509c74 8d45c8          lea     eax,[ebp-38h]

48509c77 50              push    eax

48509c78 ff75e8          push    dword ptr [ebp-18h]

48509c7b ffd7            call    edi

48509c7d 8945f8          mov     dword ptr [ebp-8],eax

smss!SmpProcessFileRenames+0x246:

48509c80 ff75e8          push    dword ptr [ebp-18h]

48509c83 ff1510105048    call    dword ptr [smss!_imp__NtClose (48501010)]

48509c89 837df800        cmp     dword ptr [ebp-8],0

48509c8d 8b75f4          mov     esi,dword ptr [ebp-0Ch]

48509c90 7c05            jl      smss!SmpProcessFileRenames+0x25d (48509c97)

smss!SmpProcessFileRenames+0x258:

48509c92 ff45e0          inc     dword ptr [ebp-20h]

48509c95 eb13            jmp     smss!SmpProcessFileRenames+0x270 (48509caa)

smss!SmpProcessFileRenames+0x25d:

48509c97 ff75f8          push    dword ptr [ebp-8]

48509c9a 8d4610          lea     eax,[esi+10h]

48509c9d 50              push    eax

48509c9e 8d4608          lea     eax,[esi+8]

48509ca1 50              push    eax

48509ca2 e8c4f6ffff      call    smss!SmpLogPFROError (4850936b)

48509ca7 0845e4          or      byte ptr [ebp-1Ch],al

smss!SmpProcessFileRenames+0x270:

48509caa 8b36            mov     esi,dword ptr [esi]

48509cac ff75d8          push    dword ptr [ebp-28h]

48509caf 8975f4          mov     dword ptr [ebp-0Ch],esi

48509cb2 e818300000      call    smss!SmpFreeSavedRegistryEntry (4850cccf)

48509cb7 81fed0085148    cmp     esi,offset smss!SmpFileRenameList (485108d0)

48509cbd 0f85d0fdffff    jne     smss!SmpProcessFileRenames+0x59 (48509a93)

smss!SmpProcessFileRenames+0x289:

48509cc3 5f              pop     edi

48509cc4 5b              pop     ebx

smss!SmpProcessFileRenames+0x28b:

48509cc5 807dff00        cmp     byte ptr [ebp-1],0

48509cc9 5e              pop     esi

48509cca 7510            jne     smss!SmpProcessFileRenames+0x2a2 (48509cdc)

smss!SmpProcessFileRenames+0x292:

48509ccc 8d45ff          lea     eax,[ebp-1]

48509ccf 50              push    eax

48509cd0 6a00            push    0

48509cd2 6a00            push    0

48509cd4 6a12            push    12h

48509cd6 ff1574115048    call    dword ptr [smss!_imp__RtlAdjustPrivilege (48501174)]

smss!SmpProcessFileRenames+0x2a2:

48509cdc ff75e4          push    dword ptr [ebp-1Ch]

48509cdf ff75e0          push    dword ptr [ebp-20h]

48509ce2 e844f8ffff      call    smss!SmpFinishPFROLogging (4850952b)

48509ce7 6840135048      push    offset smss!SmssEvt_ProcessFileRenames_Stop (48501340)

48509cec e8b2e5ffff      call    smss!SmpEventWrite (485082a3)

48509cf1 c9              leave

48509cf2 c3              ret

ReactOS 의 SmpProcessFileRenames

NTSTATUS NTAPI SmpProcessFileRenames

(

VOID

)

Definition at line 1969 of file sminit.c.

Referenced by SmpLoadDataFromRegistry().

{
    BOOLEAN OldState, HavePrivilege = FALSE;
    NTSTATUS Status;
    HANDLE FileHandle, OtherFileHandle;
    FILE_INFORMATION_CLASS InformationClass;
    OBJECT_ATTRIBUTES ObjectAttributes;
    IO_STATUS_BLOCK IoStatusBlock;
    UNICODE_STRING FileString;
    FILE_BASIC_INFORMATION BasicInfo;
    FILE_DISPOSITION_INFORMATION DeleteInformation;
    PFILE_RENAME_INFORMATION Buffer;
    PLIST_ENTRY Head, NextEntry;
    PSMP_REGISTRY_VALUE RegEntry;
    PWCHAR FileName;
    ULONG ValueLength, Length;

    /* Give us access to restore any files we want */
    Status = RtlAdjustPrivilege(SE_RESTORE_PRIVILEGE, TRUE, FALSE, &OldState);
    if (NT_SUCCESS(Status)) HavePrivilege = TRUE;

    /* Process pending files to rename */
    Head = &SmpFileRenameList;
    while (!IsListEmpty(Head))
    {
        /* Get this entry */
        NextEntry = RemoveHeadList(Head);
        RegEntry = CONTAINING_RECORD(NextEntry, SMP_REGISTRY_VALUE, Entry);
        DPRINT1("Processing PFRO: %wZ/%wZ\n", &RegEntry->Value, &RegEntry->Name);

        /* Skip past the '@' marker */
        if (!(RegEntry->Value.Length) && (*RegEntry->Name.Buffer == L'@'))
        {
            RegEntry->Name.Length -= sizeof(UNICODE_NULL);
            RegEntry->Name.Buffer++;
        }

        /* Open the file for delete access */
        InitializeObjectAttributes(&ObjectAttributes,
                                   &RegEntry->Name,
                                   OBJ_CASE_INSENSITIVE,
                                   NULL,
                                   NULL);
        Status = NtOpenFile(&OtherFileHandle,
                            DELETE | SYNCHRONIZE,
                            &ObjectAttributes,
                            &IoStatusBlock,
                            FILE_SHARE_READ | FILE_SHARE_WRITE,
                            FILE_SYNCHRONOUS_IO_NONALERT);
        if (!NT_SUCCESS(Status)) goto Quickie;

        /* Check if it's a rename or just a delete */
        ValueLength = RegEntry->Value.Length;
        if (!ValueLength)
        {
            /* Just a delete, set up the class, length and buffer */
            InformationClass = FileDispositionInformation;
            Length = sizeof(DeleteInformation);
            Buffer = (PFILE_RENAME_INFORMATION)&DeleteInformation;

            /* Set the delete disposition */
            DeleteInformation.DeleteFile = TRUE;
        }
        else
        {
            /* This is a rename, setup the class and length */
            InformationClass = FileRenameInformation;
            Length = ValueLength + sizeof(FILE_RENAME_INFORMATION);

            /* Skip past the special markers */
            FileName = RegEntry->Value.Buffer;
            if ((*FileName == L'!') || (*FileName == L'@'))
            {
                FileName++;
                Length -= sizeof(UNICODE_NULL);
            }

            /* Now allocate the buffer for the rename information */
            Buffer = RtlAllocateHeap(RtlGetProcessHeap(), SmBaseTag, Length);
            if (Buffer)
            {
                /* Setup the buffer to point to the filename, and copy it */
                Buffer->RootDirectory = NULL;
                Buffer->FileNameLength = Length - sizeof(FILE_RENAME_INFORMATION);
                Buffer->ReplaceIfExists = FileName != RegEntry->Value.Buffer;
                RtlCopyMemory(Buffer->FileName, FileName, Buffer->FileNameLength);
            }
            else
            {
                /* Fail */
                Status = STATUS_NO_MEMORY;
            }
        }

        /* Check if everything is okay till here */
        if (NT_SUCCESS(Status))
        {
            /* Now either rename or delete the file as requested */
            Status = NtSetInformationFile(OtherFileHandle,
                                          &IoStatusBlock,
                                          Buffer,
                                          Length,
                                          InformationClass);

            /* Check if we seem to have failed because the file was readonly */
            if ((NT_SUCCESS(Status) &&
                (InformationClass == FileRenameInformation) &&
                (Status == STATUS_OBJECT_NAME_COLLISION) &&
                (Buffer->ReplaceIfExists)))
            {
                /* Open the file for write attribute access this time... */
                DPRINT1("\nSMSS: %wZ => %wZ failed - Status == %x, Possible readonly target\n",
                        &RegEntry->Name,
                        &RegEntry->Value,
                        STATUS_OBJECT_NAME_COLLISION);
                FileString.Length = RegEntry->Value.Length - sizeof(WCHAR);
                FileString.MaximumLength = RegEntry->Value.MaximumLength - sizeof(WCHAR);
                FileString.Buffer = FileName;
                InitializeObjectAttributes(&ObjectAttributes,
                                           &FileString,
                                           OBJ_CASE_INSENSITIVE,
                                           NULL,
                                           NULL);
                Status = NtOpenFile(&FileHandle,
                                    FILE_WRITE_ATTRIBUTES | SYNCHRONIZE,
                                    &ObjectAttributes,
                                    &IoStatusBlock,
                                    FILE_SHARE_READ | FILE_SHARE_WRITE,
                                    FILE_SYNCHRONOUS_IO_NONALERT);
                if (!NT_SUCCESS(Status))
                {
                    /* That didn't work, so bail out */
                    DPRINT1("     SMSS: Open Existing file Failed - Status == %x\n",
                            Status);
                }
                else
                {
                    /* Now remove the read-only attribute from the file */
                    DPRINT1("     SMSS: Open Existing Success\n");
                    RtlZeroMemory(&BasicInfo, sizeof(BasicInfo));
                    BasicInfo.FileAttributes = FILE_ATTRIBUTE_NORMAL;
                    Status = NtSetInformationFile(FileHandle,
                                                  &IoStatusBlock,
                                                  &BasicInfo,
                                                  sizeof(BasicInfo),
                                                  FileBasicInformation);
                    NtClose(FileHandle);
                    if (!NT_SUCCESS(Status))
                    {
                        /* That didn't work, bail out */
                        DPRINT1("     SMSS: Set To NORMAL Failed - Status == %x\n",
                                Status);
                    }
                    else
                    {
                        /* Now that the file is no longer read-only, delete! */
                        DPRINT1("     SMSS: Set To NORMAL OK\n");
                        Status = NtSetInformationFile(OtherFileHandle,
                                                      &IoStatusBlock,
                                                      Buffer,
                                                      Length,
                                                      FileRenameInformation);
                        if (!NT_SUCCESS(Status))
                        {
                            /* That failed too! */
                            DPRINT1("     SMSS: Re-Rename Failed - Status == %x\n",
                                    Status);
                        }
                        else
                        {
                            /* Everything ok */
                            DPRINT1("     SMSS: Re-Rename Worked OK\n");
                        }
                    }
                }
            }
        }

        /* Close the file handle and check the operation result */
        NtClose(OtherFileHandle);
Quickie:
        if (!NT_SUCCESS(Status))
        {
            /* We totally failed */
            DPRINT1("SMSS: %wZ => %wZ failed - Status == %x\n",
                    &RegEntry->Name, &RegEntry->Value, Status);
        }
        else if (RegEntry->Value.Length)
        {
            /* We succeed with a rename */
            DPRINT1("SMSS: %wZ (renamed to) %wZ\n", &RegEntry->Name, &RegEntry->Value);
        }
        else
        {
            /* We suceeded with a delete */
            DPRINT1("SMSS: %wZ (deleted)\n", &RegEntry->Name);
        }

        /* Now free this entry and keep going */
        if (RegEntry->AnsiValue) RtlFreeHeap(RtlGetProcessHeap(), 0, RegEntry->AnsiValue);
        if (RegEntry->Value.Buffer) RtlFreeHeap(RtlGetProcessHeap(), 0, RegEntry->Value.Buffer);
        RtlFreeHeap(RtlGetProcessHeap(), 0, RegEntry);
    }

    /* Put back the restore privilege if we had requested it, and return */
    if (HavePrivilege) RtlAdjustPrivilege(SE_RESTORE_PRIVILEGE, FALSE, FALSE, &OldState);
    return Status; 

}