I am trying to classify the file so that even the file is sent out to another PC, the DLP still can track the file if DLP software is installed on the target PC as well. So to classify the file I am querying and setting the extended Attribute of the file. But getting an error, I don’t know whether missing something or what.
Successfully opened the file but getting errors on ZwSetEaFile and ZwQueryEaFile
Following errors once I run the code:
On querying the Extended Attribute(EA): System error 1392 has occurred. The file or directory is corrupted and unreadable.
On setting the Extended Attribute(EA): System error 255 has occurred. The extended attributes are inconsistent.
Really Need some helping hand. I will be very thankful to you.
Note: My code is in DriverEntry
Attached code:
NTSTATUS status;
WCHAR filepathtoread[] = L"\\??\\\\E:\\test.txt";
char header[10] = "EAdemo";
LONG eaLength;
PFILE_FULL_EA_INFORMATION eaBuffer = NULL; // to set
PFILE_FULL_EA_INFORMATION pGetEA; // to get
char Buffer[sizeof(FILE_FULL_EA_INFORMATION) + 20];
IO_STATUS_BLOCK IoStatus;
UNICODE_STRING str;
OBJECT_ATTRIBUTES obj;
HANDLE FileHandle;
RtlInitUnicodeString(&str, filepathtoread);
InitializeObjectAttributes(&obj, &str,OBJ_CASE_INSENSITIVE, NULL, NULL); // object attributes from file path
status = NtOpenFile(&FileHandle,
GENERIC_READ | FILE_READ_EA | FILE_WRITE_EA | SYNCHRONIZE,
&obj,
&IoStatus,
0,
FILE_SYNCHRONOUS_IO_NONALERT);
if (!NT_SUCCESS(status)) {
DbgPrint("EA:Error in open file: "); // Don't Close handle here because of invalid file handle
return status;
}
DbgPrint("EA:Success in open file: ");
eaLength = FIELD_OFFSET(FILE_FULL_EA_INFORMATION, EaName[0]) + sizeof(header) + 1;
eaBuffer = (PFILE_FULL_EA_INFORMATION)ExAllocatePoolWithTag(NonPagedPool, eaLength, '1EBA');
if (NULL == eaBuffer) {
DbgPrint("EA:Error in ExAllocatePoolWithTag ");
NtClose(FileHandle);
return status;
}
RtlZeroMemory(eaBuffer, eaLength);
eaBuffer->NextEntryOffset = 0;
eaBuffer->Flags = 0;
eaBuffer->EaNameLength = (UCHAR)strlen(header);
eaBuffer->EaValueLength = (USHORT)strlen(header);
RtlCopyMemory(&eaBuffer->EaName[0], header, strlen(header) + 1);
status = ZwSetEaFile(FileHandle,
&IoStatus,
eaBuffer,
eaLength);
if (!NT_SUCCESS(status)) {
DbgPrint("EA:Error in ZwSetEaFile ");
NtClose(FileHandle);
return status;
}
DbgPrint("EA: EA set success.. Now Reading.. ");
status = ZwQueryEaFile(FileHandle,
&IoStatus,
(PFILE_FULL_EA_INFORMATION)Buffer,
sizeof(Buffer),
TRUE,
NULL,
0,
NULL,
TRUE);
if (!NT_SUCCESS(status)) {
DbgPrint("EA:Error in ZwQueryEaFile ");
NtClose(FileHandle);
return status;
}
pGetEA = (PFILE_FULL_EA_INFORMATION)Buffer;
DbgPrint("EA:EA is %S\n", pGetEA->EaName[0]);
NtClose(FileHandle);