冥界3大法王 发表于 2021-5-10 21:31

咋没强行删除文件呢?

本帖最后由 冥界3大法王 于 2021-5-10 22:43 编辑


unit Unit1;


interface


uses
Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants,
System.Classes, Vcl.Graphics, Vcl.Controls, Vcl.Forms, Vcl.Dialogs,
Vcl.StdCtrls;


const
OBJ_CASE_INSENSITIVE = $00000040;
STATUS_SUCCESS = $00000000;


type
NTSTATUS = DWORD;


PVOID = Pointer;


PUnicodeString = ^TUnicodeString;


TUnicodeString = packed record
    Length: Word;
    MaximumLength: Word;
    Buffer: PWideChar;
end;


UNICODE_STRING = TUnicodeString;


PUNICODE_STRING = ^UNICODE_STRING;


POBJECT_ATTRIBUTES = ^TOBJECT_ATTRIBUTES;


TOBJECT_ATTRIBUTES = record
    Length: Cardinal;
    RootDirectory: THANDLE;
    ObjectName: PUNICODE_STRING;
    Attributes: Dword;
    SecurityDescriptor: pointer; // Points to type SECURITY_DESCRIPTOR
    SecurityQualityOfService: pointer; // Points to type SECURITY_QUALITY_OF_SERVICE
end;


type
TForm1 = class(TForm)
    Button1: TButton;
    procedure Button1Click(Sender: TObject);
private
    { Private declarations }
public
    { Public declarations }
end;


var
Form1: TForm1;


implementation


{$R *.dfm}


procedure RtlInitUnicodeString(var Buffer: TUnicodeString; Source: PWideChar); stdcall; external 'ntdll.dll';


function ZwDeleteFile(ObjectAttributes: POBJECT_ATTRIBUTES): NTSTATUS; stdcall; external 'ntdll.dll';


procedure InitializeObjectAttributes(pAttributes: POBJECT_ATTRIBUTES; n: PUNICODE_STRING; a: Cardinal; r: THANDLE; s: pointer);
begin
pAttributes^.Length := SizeOf(TOBJECT_ATTRIBUTES);
pAttributes^.RootDirectory := r;
pAttributes^.Attributes := a;
pAttributes^.ObjectName := n;
pAttributes^.SecurityDescriptor := s;
pAttributes^.SecurityQualityOfService := nil;
end;


procedure TForm1.Button1Click(Sender: TObject);
var
at: UNICODE_STRING;
oa: TOBJECT_ATTRIBUTES;
begin
RtlInitUnicodeString(at, '\??\C:\0.txt');
InitializeObjectAttributes(@oa, @at, OBJ_CASE_INSENSITIVE, 0, 0);
ZwDeleteFile(@oa);
end;


end.


夏蓝 发表于 2021-5-11 00:29

不懂 但是第一次坐在法王的沙发
页: [1]
查看完整版本: 咋没强行删除文件呢?