阅读:2727回复:0
直接传递EA可以,但NtSetEafile设置EA不成功。
我在NtCreateFile时,直接设置EA,并NtQueryEaFile成功。
不过在用NtSetEafile设置同一FILE_FULL_EA_INFORMATION时不成功,不知道原因。 请帮忙看下。 int main() { HANDLE FileHandle; HMODULE hModule; USHORT valuePtr, valuePtr0; IO_STATUS_BLOCK StatusBlock,StatusBlock0,StatusBlock2; FILE_FULL_EA_INFORMATION FileFullEaInfomation,FileFullEaInfomation0,FileFullEaInfomation2; OBJECT_ATTRIBUTES ObjectAttribute; UNICODE_STRING FileName; CREATEFILE NtCreateFile; RTLINITUNICODESTRING RtlInitUnicodeString; NTSETEAFILE NtSetEaFile; QUERYEAFILE NtQueryEaFile; NTCLOSE NtClose; hModule = LoadLibrary(L"ntdll.dll"); if (hModule != NULL) { NtCreateFile = (CREATEFILE)GetProcAddress (hModule, "NtCreateFile"); RtlInitUnicodeString = (RTLINITUNICODESTRING)GetProcAddress (hModule, "RtlInitUnicodeString"); NtSetEaFile = (NTSETEAFILE)GetProcAddress (hModule, "NtSetEaFile"); NtQueryEaFile = (QUERYEAFILE)GetProcAddress (hModule, "NtQueryEaFile"); NtClose = (NTCLOSE)GetProcAddress (hModule, "NtClose"); (*RtlInitUnicodeString)( (PUNICODE_STRING)&FileName, L"\\??\\c:\\NtTest.txt") ; InitializeObjectAttributes( (POBJECT_ATTRIBUTES)&ObjectAttribute, (PUNICODE_STRING)&FileName, 0, 0, NULL); FileFullEaInfomation0.Flags = 1; FileFullEaInfomation0.EaNameLength = (BYTE)strlen("F"); strcpy( FileFullEaInfomation0.EaName, "F"); valuePtr0 = (USHORT)((PBYTE)FileFullEaInfomation0.EaName)+(FileFullEaInfomation0.EaValueLength) + 1; FileFullEaInfomation0.EaValueLength = (USHORT)wcslen(L"F")*sizeof(WCHAR); FileFullEaInfomation0.NextEntryOffset = 0; (*NtCreateFile)( (PHANDLE)&FileHandle, FILE_WRITE_EA | FILE_READ_EA , (POBJECT_ATTRIBUTES)&ObjectAttribute, (PIO_STATUS_BLOCK)&StatusBlock , 0 , FILE_ATTRIBUTE_NORMAL, 0, FILE_OVERWRITE_IF, 0, NULL, 0 ); (*NtSetEaFile)( FileHandle, (PIO_STATUS_BLOCK)&StatusBlock0, (PVOID)&FileFullEaInfomation0, sizeof(FILE_FULL_EA_INFORMATION) ); (*NtQueryEafile)( FileHandle, (PIO_STATUS_BLOCK)&StatusBlock2 , (PVOID)&FileFullEaInfomation2, sizeof(FILE_FULL_EA_INFORMATION), FALSE, NULL, 0, NULL, TRUE ); (*NtClose)(FileHandle); FreeLibrary(hModule); } |
|