Friday, Mar 6th, 2015
Gist to get NTFS Extended Attributes in C#
by Angelo Plus+


[StructLayout(LayoutKind.Sequential, Pack = 0)]
public struct IO_STATUS_BLOCK
{
public uint status;
public IntPtr information;
}
[DllImport("ntdll.dll", ExactSpelling = true)]
public static extern uint NtQueryEaFile(
SafeFileHandle handle,
out IO_STATUS_BLOCK ioStatus,
IntPtr buffer,
uint length,
bool retSingleEntry,
IntPtr eaList,
uint eaListLength,
IntPtr eaIndex,
bool restartScan
);
void GetEa()
{
SafeFileHandle sfh = CreateFile("C:\\Toolz\\temp.txt", 8, FileShare.ReadWrite, IntPtr.Zero, FileMode.Open, 0x02000000, IntPtr.Zero);
IntPtr peaGet = Marshal.AllocHGlobal(1024*1024);
//Marshal.Copy(testArr, 0, peaGet, testArr.Length);
uint status = Ntfs.NtQueryEaFile(sfh, out ioStatusBlock, peaGet, 1024 * 1024, false, IntPtr.Zero, 0, IntPtr.Zero, true);
status = (uint)Marshal.GetLastWin32Error();
if (status != NT_SUCCESS)
{
ExitWithError(0);
}
}

view raw

gistfile1.cs

hosted with ❤ by GitHub