sub query_users {
    my ( $self, $filename ) = @_;

    my $func = import_api( 'advapi32', 'QueryUsersOnEncryptedFile', 'P
+P', 'N' );        
    die "Could not import API QueryUsersOnEncryptedFile: $!"
      unless defined $func;
      
    $filename = make_unicode( File::Spec->canonpath($filename) );     
+          
    my $ptr = " " x 4; # 4 == sizeof(void*)
    my $result = $func->Call( "$filename", $ptr );
    print "result: $result\n";
    return undef if $result;
    
    my $address = unpack( "L*", $ptr );
    printf("0x%08x\n", $address);            
}
[download]

In theory, this should work...but it doesn't.

#! perl -slw
use strict;
use Encode;
use Devel::Peek;
use Win32::API::Prototype;

ApiLink( 'advapi32', q[
    DWORD QueryUsersOnEncryptedFile(
        LPCWSTR lpFileName,
        ULONG pUsers
    )
]) or die $^E;

my $buffer = chr(0) x 4;
print Dump( $buffer );
my $pointer = unpack 'L!', pack 'P', $buffer;

printf "%08x\n", $pointer;

my $uFile = encode( 'UTF-16LE', $_ = $ARGV[ 0 ], 1 );
print $uFile;

QueryUsersOnEncryptedFile(
    $uFile,
    $pointer
) or die "$! : $^E";

print Dump( \$buffer );
print unpack 'C*',$buffer;
[download]

---

Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.

Lingua non convalesco, consenesco et abolesco. -- Rule 1 has a caveat! -- Who broke the cabal?

"Science is about questioning the status quo. Questioning authority".

In the absence of evidence, opinion is indistinguishable from prejudice.