文件、目录的调用顺序

文件、目录的操作最终交给系统完成。

CDirectory_IRtlDirectoryTearoff::OpenExistingDirectoryCDirectory::OpenExistingDirectoryDirectFileSystemProvider::SysCreateFileWindows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(unsigned long,class Windows::Rtl::SystemImplementation::CSilHandle *,unsigned long,struct _OBJECT_ATTRIBUTES &,struct _IO_STATUS_BLOCK *,union _LARGE_INTEGER *,unsigned long,unsigned long,unsigned long,unsigned long,void *,unsigned long,void *,unsigned long *)这个就是许多函数出现的：  __guard_check_icall_fptr(*(_DWORD *)(*v12 + 36));  v14 = (*(int (__thiscall **)(int *, signed int, int *, int, int *, char *, _DWORD, _DWORD, int, signed int, int, _DWORD, _DWORD, int, int *))(v18 + 36))(          v12,          v19,          &v49,          a4,          &v23,          &v46,          0,          0,          a6,          1,          a7,          0,          0,          v17,          &v48);

即 DirectFileSystemProvider 虚函数对象的 +9 位置上函数。