NtQueryEaFile - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTIOAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryEaFile(
    _In_ HANDLE FileHandle,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _Out_writes_bytes_(Length) PVOID Buffer,
    _In_ ULONG Length,
    _In_ BOOLEAN ReturnSingleEntry,
    _In_reads_bytes_opt_(EaListLength) PVOID EaList,
    _In_ ULONG EaListLength,
    _In_opt_ PULONG EaIndex,
    _In_ BOOLEAN RestartScan
    );

#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryEaFile(
    _In_ HANDLE FileHandle,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _Out_writes_bytes_(Length) PVOID Buffer,
    _In_ ULONG Length,
    _In_ BOOLEAN ReturnSingleEntry,
    _In_reads_bytes_opt_(EaListLength) PVOID EaList,
    _In_ ULONG EaListLength,
    _In_opt_ PULONG EaIndex,
    _In_ BOOLEAN RestartScan
    );

#endif

View code on GitHub
// ntifs.h

NTSTATUS ZwQueryEaFile(
  [in]           HANDLE           FileHandle,
  [out]          PIO_STATUS_BLOCK IoStatusBlock,
  [out]          PVOID            Buffer,
  [in]           ULONG            Length,
  [in]           BOOLEAN          ReturnSingleEntry,
  [in, optional] PVOID            EaList,
  [in]           ULONG            EaListLength,
  [in, optional] PULONG           EaIndex,
  [in]           BOOLEAN          RestartScan
);
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-ntifs-zwqueryeafile)

ZwQueryEaFile function

Description

ZwQueryEaFile routine returns the extended attributes (EAs) associated with the specified file.

Parameters

FileHandle [in]

The handle for the file on which the operation is to be performed.

IoStatusBlock [out]

A pointer to an IO_STATUS_BLOCK structure that receives the final completion status and other information about the requested operation.

Buffer [out]

A pointer to a caller-supplied FILE_FULL_EA_INFORMATION-structured output buffer in which to return the file's EAs.

Length [in]

The length, in bytes, of the buffer that Buffer points to.

ReturnSingleEntry [in]

Set to TRUE if ZwQueryEaFile should return only the first entry that it finds.

EaList [in, optional]

A pointer to a caller-supplied FILE_GET_EA_INFORMATION-structured input buffer that specifies the EAs to be queried. This parameter is optional and can be NULL.

EaListLength [in]

The length, in bytes, of the buffer that the EaList parameter points to.

EaIndex [in, optional]

The index of the entry at which scanning the file's EA list should begin. This parameter is ignored if EaList points to a nonempty list. This parameter is optional and can be NULL.

RestartScan [in]

Set to TRUE if ZwQueryEaFile should begin the scan at the first entry in the file's EA list. If this parameter is set to FALSE, the routine resumes the scan from a previous call to ZwQueryEaFile.

Return value

ZwQueryEaFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:

Return value Description
STATUS_EAS_NOT_SUPPORTED The file system doesn't support EAs. This is an error code.
STATUS_INSUFFICIENT_RESOURCES There isn't enough memory available to complete the operation. This is an error code.
STATUS_EA_LIST_INCONSISTENT The EaList parameter isn't formatted correctly. This is an error code.

Remarks

The amount of information that ZwQueryEaFile returns is based on the size of the EAs and the size of the buffer that Buffer points to. That is, either all of the requested EAs are written to the buffer, or the buffer is filled with as many complete EAs if it's not large enough to contain all the EAs. Only complete EAs are written to the buffer; no partial EAs will ever be returned.

See also

FILE_FULL_EA_INFORMATION

FILE_GET_EA_INFORMATION

ZwSetEaFile

View the official Windows Driver Kit DDI reference

Edit description on GitHub

NTinternals.net (undocumented.ntinternals.net)

This function is documented in Windows Driver Kit.

NtQueryEaFile is used to read EA from NTFS file. For more information about EA see FILE_FULL_EA_INFORMATION.

FileHandle

HANDLE to File Object opened with FILE_READ_EA access.

IoStatusBlock

IO result of call.

Buffer

Caller's allocated buffer for output data. See FILE_FULL_EA_INFORMATION for detailed description of fields available in buffer.

Length

Length of buffer, in bytes.

ReturnSingleEntry

If set, only one entry is returned.

EaList

Optional list of FILE_GET_EA_INFORMATION structures containing names of EA.

EaListLength

Length of EaList, in bytes.

EaIndex

Pointer to ULONG value contains 1-based index of queried attribute.

RestartScan

If set, result is the first queried EA.

Documented by

See also

Edit description on GitHub