NtSetEaFile - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTIOAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetEaFile(
    _In_ HANDLE FileHandle,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _In_reads_bytes_(Length) PVOID Buffer,
    _In_ ULONG Length
    );

#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwSetEaFile(
    _In_ HANDLE FileHandle,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _In_reads_bytes_(Length) PVOID Buffer,
    _In_ ULONG Length
    );

#endif

View code on GitHub
// ntifs.h

NTSTATUS ZwSetEaFile(
  [in]  HANDLE           FileHandle,
  [out] PIO_STATUS_BLOCK IoStatusBlock,
  [in]  PVOID            Buffer,
  [in]  ULONG            Length
);
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-ntifs-zwseteafile)

ZwSetEaFile function

Description

ZwSetEaFile replaces the extended attributes (EAs) associated with a file with the specified EAs.

Parameters

FileHandle [in]

The handle for the file on which the operation is to be performed.

IoStatusBlock [out]

A pointer to an IO_STATUS_BLOCK structure that receives the final completion status and other information about the requested operation.

Buffer [in]

A pointer to a caller-supplied FILE_FULL_EA_INFORMATION-structured input buffer that contains the new EAs that will replace the EAs currently associated with the file.

Length [in]

Length, in bytes, of the buffer that the Buffer parameter points to.

Return value

ZwSetEaFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:

Return value Description
STATUS_EA_LIST_INCONSISTENT The EA list that Buffer points to isn't formatted correctly. This is an error code.
STATUS_INSUFFICIENT_RESOURCES There isn't enough memory available to complete the operation. This is an error code.

Remarks

ZwSetEaFile replaces the EAs associated with FileHandle with the EAs in the buffer that Buffer points to. The EAs in the buffer must be formatted as a sequence of FILE_FULL_EA_INFORMATION structures. ZwSetEaFile first checks that the buffer of EA values is valid before replacing the existing EAs.

See also

FILE_FULL_EA_INFORMATION

IoCheckEaBufferValidity

ZwQueryEaFile

View the official Windows Driver Kit DDI reference

Edit description on GitHub

NTinternals.net (undocumented.ntinternals.net)

This function is documented in Windows Driver Kit.

See NtQueryEaFile for information about EA.

FileHandle

HANDLE to File Object opened with FILE_SET_EA access.

IoStatusBlock

IO result of call.

EaBuffer

User's allocated input buffer containing one or more FILE_FULL_EA_INFORMATION structures.

EaBufferSize

Size of EaBuffer, in bytes.

Documented by

See also

Edit description on GitHub