NtQueryEaFile

Prototype

NTSTATUS NtQueryEaFile(
  HANDLE           FileHandle,
  PIO_STATUS_BLOCK IoStatusBlock,
  PVOID            Buffer,
  ULONG            Length,
  BOOLEAN          ReturnSingleEntry,
  PVOID            EaList,
  ULONG            EaListLength,
  PULONG           EaIndex,
  BOOLEAN          RestartScan
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 50 01 00 00      mov eax, 0x150     ; Win11 24H2 SSN
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Counterpart to `NtSetEaFile`. With 9 arguments, two of them stack-passed on x64, this is one of the chunkier file syscalls — call sites usually wrap it in a small helper that just hands in `NULL/0/NULL/FALSE` for the optional filter/index/restart trio when the caller wants "give me everything". The kernel returns `STATUS_NO_EAS_ON_FILE` for files without an EA stream and `STATUS_NONEXISTENT_EA_ENTRY` for a missing named lookup — both of which are useful negative oracles when probing.

Common malware usage

The read side of the EA-stealth pattern: an implant that previously hid configuration or staged shellcode via `NtSetEaFile` later loads it with `NtQueryEaFile`. Naming the EA explicitly via the `EaList` parameter is preferred over a full enumeration because it leaves a smaller telemetry footprint and avoids triggering scanners that walk every EA on the file. Some loaders also use the EA path as an integrity-check side channel — payload presence and exact length act as a tamper detector before decryption.

Detection opportunities

`NtQueryEaFile` on its own is benign — the OS itself calls it on roaming profile shares and any time WSL/Cygwin permission EAs are read. The signal is the *pattern*: a process opening a non-WSL file with FILE_READ_EA and then immediately decrypting/jumping into the returned blob. ETW Microsoft-Windows-Kernel-File `FileQueryEa` event, paired with a subsequent VirtualProtect→RX on a region freshly written from that buffer, is the high-fidelity correlation. Standalone EA queries from `svchost.exe`, `lsass.exe` or any signed Microsoft binary against a user-writable file are worth surfacing.

Direct syscall examples

// Fetch only the 'CONFIG.BIN' EA — avoids a noisy full enumeration.
HANDLE h = CreateFileW(L"C:\\ProgramData\\update.dat", FILE_READ_EA, FILE_SHARE_READ,
                       NULL, OPEN_EXISTING, 0, NULL);

struct {
    ULONG  NextEntryOffset;
    UCHAR  EaNameLength;
    CHAR   EaName[12];   // "CONFIG.BIN\0" + padding
} eaList = { 0, 10, "CONFIG.BIN\0" };

BYTE out[4096];
IO_STATUS_BLOCK iosb;
NTSTATUS st = NtQueryEaFile(h, &iosb, out, sizeof(out),
                            TRUE,                  // single entry
                            &eaList, sizeof(eaList),
                            NULL,                  // no index
                            TRUE);                 // restart scan
if (NT_SUCCESS(st)) {
    PFILE_FULL_EA_INFORMATION ea = (PFILE_FULL_EA_INFORMATION)out;
    decrypt_and_run(ea->EaName + ea->EaNameLength + 1, ea->EaValueLength);
}

; NtQueryEaFile direct syscall (Win11 24H2 SSN 0x150)
NtQueryEaFile PROC
    mov  r10, rcx
    mov  eax, 150h
    syscall
    ret
NtQueryEaFile ENDP

// Cargo: windows-sys = "0.59"
use windows_sys::Win32::Foundation::HANDLE;
use windows_sys::Win32::System::LibraryLoader::*;

type NtQueryEaFileFn = unsafe extern "system" fn(
    HANDLE, *mut u8, *mut u8, u32, u8, *const u8, u32, *mut u32, u8,
) -> i32;

unsafe fn dump_eas(h: HANDLE) -> Vec<(String, Vec<u8>)> {
    let nt = GetModuleHandleA(b"ntdll.dll\0".as_ptr());
    let f: NtQueryEaFileFn = std::mem::transmute(
        GetProcAddress(nt, b"NtQueryEaFile\0".as_ptr()).unwrap()
    );
    let mut buf = vec![0u8; 0x10000];
    let mut iosb = [0u8; 16];
    let st = f(h, iosb.as_mut_ptr(), buf.as_mut_ptr(), buf.len() as u32,
               0, std::ptr::null(), 0, std::ptr::null_mut(), 1);
    if st < 0 { return vec![]; }
    // Walk NextEntryOffset chain ... (omitted for brevity)
    Vec::new()
}

MITRE ATT&CK mappings

• T1564.004Hide Artifacts: NTFS File Attributesmitre ↗
• T1564Hide Artifactsmitre ↗
• T1106Native APImitre ↗