#ifndef _NTIOAPI_H

typedef struct _FILE_GET_EA_INFORMATION
{
    ULONG NextEntryOffset;
    UCHAR EaNameLength;
    _Field_size_bytes_(EaNameLength) CHAR EaName[1];
} FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;

#endif
View code on GitHub

// ntifs.h

typedef struct _FILE_GET_EA_INFORMATION {
  ULONG NextEntryOffset;
  UCHAR EaNameLength;
  CHAR  EaName[1];
} FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (ns-ntifs-_file_get_ea_information)

_FILE_GET_EA_INFORMATION structure

Description

The FILE_GET_EA_INFORMATION structure is used to query for extended-attribute (EA) information.

Members

`NextEntryOffset`

Offset, in bytes, of the next FILE_GET_EA_INFORMATION-typed entry. This member is zero if no other entries follow this one.

`EaNameLength`

Length, in bytes, of the EaName array. This value does not include a NULL terminator.

`EaName`

Specifies the first character of the name of the extended attribute to be queried. This is followed in memory by the remainder of the string.

Remarks

The FILE_GET_EA_INFORMATION structure is used to query for extended-attribute (EA) information. The EA information is returned in a FILE_FULL_EA_INFORMATION-structured buffer.

This structure must be aligned on a LONG (4-byte) boundary.

NTinternals.net (undocumented.ntinternals.net)

This structure is documented in Windows Driver Kit.

Structure FILE_GET_EA_INFORMATION is used in a call to NtQueryEaFile function. See FILE_FULL_EA_INFORMATION for detailed information about EA.

NextEntryOffset

Relative offset for next FILE_GET_EA_INFORMATION structure in buffer.

EaNameLength

Length of EA name, in bytes (without leading zero).

EaName[1]

ASCIIZ name of EA, case insensitive.

Documented by

Tomasz Nowak
Bo Branten

FILE_GET_EA_INFORMATION - NtDoc