#ifndef _NTIOAPI_H

// NtQueryEaFile/NtSetEaFile types

typedef struct _FILE_FULL_EA_INFORMATION
{
    ULONG NextEntryOffset;
    UCHAR Flags;
    UCHAR EaNameLength;
    USHORT EaValueLength;
    _Field_size_bytes_(EaNameLength) CHAR EaName[1];
    // ...
    // UCHAR EaValue[1]
} FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;

#endif
View code on GitHub

This structure is documented in Windows Driver Kit.

Structure FILE_FULL_EA_INFORMATION is used for get or store Extended Attributes for NTFS files and directories.
Extended Attributes (EA) is a list of pair Name-Value. Name is capitalised ASCII string up to 256 characters long. Value is any data and can be up to 65536 bytes long.

Structure can be used in a call to NtCreateFile and NtSetEaFile, or as a result of call NtQueryEaFile.

NextEntryOffset

Offset for next FILE_FULL_EA_INFORMATION structure in buffer, relative to currently used structure. If current structure is last one in buffer, this field has value 0.

Flags

???

EaNameLength

Length of EA name, in bytes (without leading zero).

EaValueLength

Length of EA value, in bytes (without leading zero).

EaName[1]

User's allocated buffer contains ASCIIZ name and value. ASCII value must be finished by zero.

Structure FILE_FULL_EA_INFORMATION is also defined in Win2000 DDK.

Documented by

Tomasz Nowak
Bo Branten