| UID | title | description | tech.root | ms.date | keywords | ms.keywords | req.header | req.include-header | req.target-type | req.target-min-winverclnt | req.target-min-winversvr | req.kmdf-ver | req.umdf-ver | req.ddi-compliance | req.unicode-ansi | req.idl | req.max-support | req.namespace | req.assembly | req.type-library | req.lib | req.dll | req.irql | targetos | req.typenames | f1_keywords | topic_type | api_type | api_location | api_name | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
NF:ntifs.ZwQueryEaFile |
ZwQueryEaFile function (ntifs.h) |
Learn more about the ZwQueryEaFile function. |
kernel |
04/25/2024 |
|
ZwQueryEaFile, ZwQueryEaFile routine [Kernel-Mode Driver Architecture], kernel.zwqueryeafile, ntifs/ZwQueryEaFile |
ntifs.h |
FltKernel.h, Ntifs.h |
Universal |
Windows 2000 |
PowerIrpDDis, HwStorPortProhibitedDDIs |
NtosKrnl.lib |
NtosKrnl.exe |
PASSIVE_LEVEL |
Windows |
|
|
|
|
|
ZwQueryEaFile routine returns the extended attributes (EAs) associated with the specified file.
The handle for the file on which the operation is to be performed.
A pointer to an IO_STATUS_BLOCK structure that receives the final completion status and other information about the requested operation.
A pointer to a caller-supplied FILE_FULL_EA_INFORMATION-structured output buffer in which to return the file's EAs.
The length, in bytes, of the buffer that Buffer points to.
Set to TRUE if ZwQueryEaFile should return only the first entry that it finds.
A pointer to a caller-supplied FILE_GET_EA_INFORMATION-structured input buffer that specifies the EAs to be queried. This parameter is optional and can be NULL.
The length, in bytes, of the buffer that the EaList parameter points to.
The index of the entry at which scanning the file's EA list should begin. This parameter is ignored if EaList points to a nonempty list. This parameter is optional and can be NULL.
Set to TRUE if ZwQueryEaFile should begin the scan at the first entry in the file's EA list. If this parameter is set to FALSE, the routine resumes the scan from a previous call to ZwQueryEaFile.
ZwQueryEaFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:
| Return value | Description |
|---|---|
| STATUS_EAS_NOT_SUPPORTED | The file system doesn't support EAs. This is an error code. |
| STATUS_INSUFFICIENT_RESOURCES | There isn't enough memory available to complete the operation. This is an error code. |
| STATUS_EA_LIST_INCONSISTENT | The EaList parameter isn't formatted correctly. This is an error code. |
The amount of information that ZwQueryEaFile returns is based on the size of the EAs and the size of the buffer that Buffer points to. That is, either all of the requested EAs are written to the buffer, or the buffer is filled with as many complete EAs if it's not large enough to contain all the EAs. Only complete EAs are written to the buffer; no partial EAs will ever be returned.