How to Set/Query EA (Extended Attributes) in user mode?

NTFSD
1

Dear all,

In kernel mode, one can call FltSetEaFile/FltQueryEaFile to Set/Query EA info. However, I cannot find corresponding APIs in user mode.

How should I do?

Thanks in advance.

2

Well NtCreateFile is supported in user space (can’t remember the include
file that it is in at the moment), so you can call that.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@gmail.com” wrote in message news:xxxxx@ntfsd:

> Dear all,
>
> In kernel mode, one can call FltSetEaFile/FltQueryEaFile to Set/Query EA info. However, I cannot find corresponding APIs in user mode.
>
> How should I do?
>
> Thanks in advance.

3

Thanks Don for your quick response.

Even if I can set EA data by calling NtCreateFile in user mode, how should I QUERY EA data in user mode?

4

> In kernel mode, one can call FltSetEaFile/FltQueryEaFile to

Set/Query EA info. However, I cannot find corresponding APIs in user mode.

NtSetEaFile
NtQueryEaFile.

L.

5

Thanks Ladislav for your exciting answer.

Yet another question: Are there documented Windows APIs in user mode?

6

> Yet another question: Are there documented Windows APIs in user mode?

http://msdn.microsoft.com/en-us/library/windows/hardware/ff961908(v=vs.85).aspx
(and so forth)

7

These should work in user space, but are in the gray area. Microsoft
documents winternl.h which contains many NtXXX calls, but the EaFile
calls are not part of it.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“Ladislav Zezula” wrote in message news:xxxxx@ntfsd:

> > In kernel mode, one can call FltSetEaFile/FltQueryEaFile to
> > Set/Query EA info. However, I cannot find corresponding APIs in user mode.
>
> NtSetEaFile
> NtQueryEaFile.
>
> L.