Hi all ,
Mitja, you are correct, ZwQueryEaFile/ZwSetEaFile works fine. I am calling these functions in Create Operation.
But ZwQueryEaFile/ZwSetEaFile need FileHandle as input, that means open the file using FltCreateFile() to get filehandle which is very expensive operation leading towards performance degradation.
Also, Using FltCreateFile() and ZwSetEaFile(), i tried setting EA for a file, and then call ZwQueryEaFile() to check whether EAs are set properly or not.
Here is the Pseudo Code:
PreCreate()
{
PFILE_FULL_EA_INFORMATION eaBuffer = NULL;
LONG eaLength;
char header[10] = “testEA”;
PFILE_FULL_EA_INFORMATION pGetEA;
char Buffer[sizeof(FILE_FULL_EA_INFORMATION) + 20];
eaLength = FIELD_OFFSET(FILE_FULL_EA_INFORMATION, EaName[0]) + sizeof(header) + 1;
eaBuffer = (PFILE_FULL_EA_INFORMATION)
ExAllocatePoolWithTag(NonPagedPool,eaLength,‘1EBA’);
if(NULL == eaBuffer)
{
return;
}
RtlZeroMemory(eaBuffer, eaLength);
eaBuffer->NextEntryOffset = 0;
eaBuffer->Flags = 0;
eaBuffer->EaNameLength = (UCHAR)strlen(header);
eaBuffer->EaValueLength = (USHORT)strlen(header);
RtlCopyMemory(&eaBuffer->EaName[0],header,strlen(header)+1);
status = ZwSetEaFile(hFileHandle, … handle obtained using FltCreateFile()
&ioStatus,
eaBuffer,
eaLength);
if(!NT_SUCCESS(status))
{
return;
}
status = ZwQueryEaFile(hFileHandle,
&ioStatus,
(PFILE_FULL_EA_INFORMATION)Buffer,
sizeof(Buffer),
TRUE,
NULL,
0,
NULL,
TRUE);
if(!NT_SUCCESS(status))
{
return;
}
pGetEA = (PFILE_FULL_EA_INFORMATION)Buffer;
DbgPrint(“PreCreate – EA is %.*S\n”,pGetEA->EaValueLength/sizeof(CHAR),pGetEA->EaName[0]);
}
OutPut Shown is:
PreCreate – EA is ??
As the above code shows wrong output, it seems to have some problem either while setting EA or while Querying the EAs.
Kindly help me out to solve this issue, why i am not getting the expected output (i.e PreCreate – EA is testEA) ?
Also, Is there any other way to get FileHandle in Create operation except FltCreateFile() ?
Any inputs are appreciated
Thanks
Mahesh
