按delete键时windows删除文件调用的API时什么？

Question

最近做程序来hook系统（WIN10）的文件删除操作，本以为就是简单的DeleteFile接口，试了下发现并不是，也用API monitor等工具跟踪了也无果，求大神帮忙。

Answer 1

Let's start your job with the NtSetFileInformation (undocumented) function. It's the function called by anything else when a file need to be deleted (with the FileDispositionInformation structure).

Hook这个API试试NtSetFileInformation