NtSetEaFile

Prototype

NTSTATUS NtSetEaFile(
  HANDLE                  FileHandle,
  PIO_STATUS_BLOCK        IoStatusBlock,
  PFILE_FULL_EA_INFORMATION Buffer,
  ULONG                   Length
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 A0 01 00 00      mov eax, 0x1A0     ; Win11 24H2 SSN
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NTFS Extended Attributes are an OS/2-era HPFS leftover preserved in NTFS: a list of `name=value` blobs (max ~64KB total) bolted onto any file, *separate from* both the main data stream and named Alternate Data Streams. They are addressable via `FileFullEaInformation` in `SetFileInformationByHandle`, but `NtSetEaFile` is the direct path. Each record is a `FILE_FULL_EA_INFORMATION` (NextEntryOffset, Flags, EaNameLength, EaValueLength, EaName[], value). EAs survive copies between NTFS volumes but are silently stripped by FAT32/exFAT, most archivers, and almost every cloud sync agent — which is precisely why they are interesting to attackers.

Common malware usage

Stealth storage. Implants drop config, encrypted payload chunks, or staged shellcode into the EA of an innocuous file (often a system DLL or a benign data file in `%ProgramData%`) where `dir`, Explorer, and most AV file scanners never look. BlackEnergy v2/v3 stored its driver payload in EAs; the early Stuxnet variant abused EAs for component hiding. The win32k EA parsing path was also the bug class behind several LPE families (CVE-2022-21882 and the broader xxxClientAllocCacheableObject family). On the offensive side EAs are also a TOCTOU-friendly side channel for IPC between two malicious processes.

Detection opportunities

EAs are invisible in default tooling. Look for them explicitly: `fsutil file queryEA <path>`, Sysinternals `Streams` (ADS only — does NOT cover EAs), `EAExtractor`, or NTFS forensics tools that parse `$EA` and `$EA_INFORMATION` MFT attributes. ETW Microsoft-Windows-Kernel-File provides FileSetEa events. Suspicious indicators: EA records on `.exe`/`.dll` files in `system32`, EA blobs larger than a few hundred bytes, EA names that don't match Cygwin/WSL or HPFS legacy patterns. EDRs that hook only the Win32 layer (SetFileInformationByHandle) will miss direct `NtSetEaFile` calls.

Direct syscall examples

// Write a 'config.bin' EA onto an existing file. Visible only via fsutil queryEA.
HANDLE h = CreateFileW(L"C:\\ProgramData\\update.dat", FILE_WRITE_EA, 0, NULL,
                       OPEN_EXISTING, 0, NULL);

const char* eaName  = "CONFIG.BIN"; // ASCII, will be uppercased by NTFS
UCHAR eaNameLen     = (UCHAR)strlen(eaName);
USHORT eaValueLen   = (USHORT)payloadLen; // <= 0xFFFF per record

ULONG bufSize = sizeof(FILE_FULL_EA_INFORMATION) + eaNameLen + 1 + eaValueLen;
bufSize = (bufSize + 3) & ~3u;            // 4-byte alignment
PFILE_FULL_EA_INFORMATION ea = calloc(1, bufSize);
ea->NextEntryOffset = 0;
ea->Flags           = 0;
ea->EaNameLength    = eaNameLen;
ea->EaValueLength   = eaValueLen;
memcpy(ea->EaName, eaName, eaNameLen + 1);
memcpy(ea->EaName + eaNameLen + 1, payload, eaValueLen);

IO_STATUS_BLOCK iosb;
NTSTATUS st = NtSetEaFile(h, &iosb, ea, bufSize);

; NtSetEaFile direct syscall (Win11 24H2 SSN 0x1A0)
NtSetEaFile PROC
    mov  r10, rcx
    mov  eax, 1A0h
    syscall
    ret
NtSetEaFile ENDP

// Cargo: windows-sys = "0.59" (Win32_Foundation, Win32_System_LibraryLoader)
use std::ffi::CString;
use windows_sys::Win32::Foundation::*;
use windows_sys::Win32::System::LibraryLoader::*;

type NtSetEaFileFn = unsafe extern "system" fn(
    HANDLE, *mut u8 /* IoStatusBlock */, *const u8 /* Buffer */, u32 /* Length */,
) -> i32;

unsafe fn write_ea(handle: HANDLE, name: &str, value: &[u8]) -> i32 {
    let name_c = CString::new(name).unwrap();
    let n_len = name_c.as_bytes().len() as u8;
    let v_len = value.len() as u16;
    let mut size = 8usize + 1 + n_len as usize + 1 + v_len as usize;
    size = (size + 3) & !3;
    let mut buf = vec![0u8; size];
    buf[4] = 0;            // Flags
    buf[5] = n_len;        // EaNameLength
    buf[6..8].copy_from_slice(&v_len.to_le_bytes());
    let off_name = 8;
    buf[off_name..off_name + n_len as usize].copy_from_slice(name_c.as_bytes());
    let off_val = off_name + n_len as usize + 1;
    buf[off_val..off_val + value.len()].copy_from_slice(value);

    let nt = GetModuleHandleA(b"ntdll.dll\0".as_ptr());
    let f: NtSetEaFileFn = std::mem::transmute(
        GetProcAddress(nt, b"NtSetEaFile\0".as_ptr()).unwrap()
    );
    let mut iosb = [0u8; 16];
    f(handle, iosb.as_mut_ptr(), buf.as_ptr(), size as u32)
}

MITRE ATT&CK mappings

• T1564.004Hide Artifacts: NTFS File Attributesmitre ↗
• T1564Hide Artifactsmitre ↗
• T1106Native APImitre ↗