文件删除，实际就是设置文件信息属性

文件删除，实际就是设置文件信息属性

即 +13 处的 SysSetInformationFile

DirectFileSystemProvider::SysSetInformationFile(
unsigned long,
void *,
struct _IO_STATUS_BLOCK *,
void *,
unsigned long,
enum _FILE_INFORMATION_CLASS,
unsigned long *)

把属性设置为 _FILE_INFORMATION_CLASS 中的 FileDispositionInformation，即 13，就实现了文件删除
比如：

CFile::MarkDeletePending(
Windows::Rtl::SystemImplementation::CFile *this, 
struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *a2, 
bool a3    // 输出结果
)
  v3 = this;
// this +8 即 DirectFileSystemProvider
  v4 = *((_DWORD *)v3 + 8);
  v10 = a3;
  v5 = *(_DWORD *)v4;
// this +5 尚不知
  v6 = *((_DWORD *)v3 + 5);
// +13 SysSetInformationFile
  v7 = (*(int (__thiscall **)(int, _DWORD, int, char *, char *, signed int, signed int, _DWORD))(v5 + 52))(
         v4,
         0,
         v6,
         &v12,
         (char *)&v10,
         1,
         13,  // FileDispositionInformation
         0);

目录的删除，基本相同：
在 CDirectory 中，DirectFileSystemProvider 在 +9 的位置。

CDirectory::Delete(
Windows::Rtl::SystemImplementation::CDirectory *this, 
struct Windows::WCP::Rtl::_RTL_TRACING_FACILITY *a2, 
unsigned __int32 a3, 
unsigned __int32 *a4
)
  v4 = this;
  v16 = this;
  v5 = *((_DWORD *)v4 + 9);
  v4 = *(Windows::Rtl::SystemImplementation::CDirectory **)v5;
// this +7 尚不知
  v7 = *((_DWORD *)v16 + 7);
  v8 = v6;
// +13 SysSetInformationFile
  v9 = (*((int (__thiscall **)(int, _DWORD, _DWORD, int *, char *, signed int, signed int, int *))v4 + 13))(
         v5,
         v8,
         v7,
         (int *)&v18,
         &v29,
         1,
         13,    // FileDispositionInformation
         &v30);