文件删除,实际就是设置文件信息属性
即 +13 处的 SysSetInformationFile
DirectFileSystemProvider::SysSetInformationFile(
unsigned long,
void *,
struct _IO_STATUS_BLOCK *,
void *,
unsigned long,
enum _FILE_INFORMATION_CLASS,
unsigned long *)
把属性设置为 _FILE_INFORMATION_CLASS 中的 FileDispositionInformation,即 13,就实现了文件删除
比如:
CFile::MarkDeletePending(
Windows::Rtl::SystemImplementation::CFile *this,
struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *a2,
bool a3 // 输出结果
)
v3 = this;
// this +8 即 DirectFileSystemProvider
v4 = *((_DWORD *)v3 + 8);
v10 = a3;
v5 = *(_DWORD *)v4;
// this +5 尚不知
v6 = *((_DWORD *)v3 + 5);
// +13 SysSetInformationFile
v7 = (*(int (__thiscall **)(int, _DWORD, int, char *, char *, signed int, signed int, _DWORD))(v5 + 52))(
v4,
0,
v6,
&v12,
(char *)&v10,
1,
13, // FileDispositionInformation
0);
目录的删除,基本相同:
在 CDirectory 中,DirectFileSystemProvider 在 +9 的位置。
CDirectory::Delete(
Windows::Rtl::SystemImplementation::CDirectory *this,
struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *a2,
unsigned __int32 a3,
unsigned __int32 *a4
)
v4 = this;
v16 = this;
v5 = *((_DWORD *)v4 + 9);
v4 = *(Windows::Rtl::SystemImplementation::CDirectory **)v5;
// this +7 尚不知
v7 = *((_DWORD *)v16 + 7);
v8 = v6;
// +13 SysSetInformationFile
v9 = (*((int (__thiscall **)(int, _DWORD, _DWORD, int *, char *, signed int, signed int, int *))v4 + 13))(
v5,
v8,
v7,
(int *)&v18,
&v29,
1,
13, // FileDispositionInformation
&v30);