The Graham Utilities for OS/2 - Version 2

EADump - Dump Extended Attributes of a file

Summary

EADump will perform a hexadecimal dump of all extended attributes attached to a file.

Icon

Command Line Format

Usage: EADump {Switches} <File Spec> Drive Spec(s)

Switches

-a: All disks.
-h: Hard disks only.
-l: List the extended attribute names only.
-nName: Dump extended attributes of a given name.
-o: Only list files with extended attributes.
-r: Dump EAT_MVMT and EAT_MVST data as raw hex.
-s: Include subdirectories in the search.

Description

EADump will perform a hexadecimal dump of all extended attributes attached to a particular file. The extended attribute name, type and flag value are listed followed by the hexadecimal dump of the extended data itself.

A simple example of output is:

Searching Drive E:
Dumping: E:\os2utils\be.ico
EA Name: .TYPE
EA Type: Length preceded ASCII
EA Flag: 00
000000  fd ff 04 00 49 63 6f 6e              ı...Icon
8 bytes dumped

Extended Attribute Data Format

The data which is displayed consists of more than just the extended attribute data itself. It also includes the extended attribute name and type of each extended attribute.

The first word (2 bytes) of the extended attribute data represents the extended attribute data type. The second word of the data is the length of the data itself, not including the first four bytes.

Intel Byte Ordering

Intel processors use a low byte-high byte byte order to represent whole numbers in word (2 byte) format. This means if you wish to extract a word value when you read the data as a series of bytes, then you must reverse the two bytes. Therefore: 0123 in hexadecimal (or 291 decimal) would be read as 23 01 as a series of bytes.

EAT_ Values

The standard extended attribute values are defined as:

EA Type       Value   Description
EAT_BINARY    0xFFFE  length preceded binary
EAT_ASCII     0xFFFD  length preceded ASCII
EAT_BITMAP    0xFFFB  length preceded bitmap
EAT_METAFILE  0xFFFA  length preceded metafile
EAT_ICON      0xFFF9  length preceded Icon
EAT_EA        0xFFEE  length preceded ASCII name of associated data
EAT_MVMT      0xFFDF  multi-valued, multi-typed field
EAT_MVST      0xFFDE  multi-valued, single-typed field
EAT_ASN1      0xFFDD  ASN.1 field

Values 0xFFFE through 0x8000 are reserved for use by OS/2.

Values 0x0000 through 0x7FFF are user definable.

Value 0xFFFC is not used.

Therefore, in the above example the FD FF is read as a word of FFFD, hence the type of EAT_ASCII. The length 04 00 reads as 0004 or 4 bytes of actual data.

EA Flag Values

The EA flag value specifies one or more flags. In OS/2 version 1.2 (and above), the only flag available is FEA_NEEDEA, indicating an extended-attribute bit is needed. FEA_NEEDEA is defined as 80 hex. The EA flag can be either zero or FEA_NEEDEA.

-a All disks

EADump will scan all logical disk drives defined by the system, starting at drive A:. The drives are scanned in order, starting at A:, then B: and so on.

-h Hard disks only

EADump will scan all logical disk drives defined by the system, starting at drive C:. The drives are scanned in order, starting at C:, then D: and so on.

-l List the extended attribute names only

EADump will not perform a hexdump of the extended attribute data. It will only display the extended attribute name, type and flag values. It will display the file name (even if the file does not have any extended attribute data attached to it) unless the -o switch was also specified.

-n Dump extended attributes of a given name.

By default, EADump will dump the data of every extended attribute attached to a file. Using this switch you may specify one particular extended attribute name. Only the extended attribute data of files which have an extended attribute of the same name will be dumped. The case of the name is not important.

-o Only list files with extended attributes

EADump will only display the details of files which have extended attributes attached to them. It will perform a hexdump of the data - unless the -l switch was also specified.

-r Dump EAT_MVMT and EAT_MVST data as raw hex

EADump's default behaviour is to attempt to dump EAT_MVMT and EAT_MVST data types in their component form. This switch forces EADump to dump the EA's of these types as plain raw data. No type interpretation is attempted.

-s Subdirectories

EADump will include subdirectories as part of its search of the specified disk drives. If a subdirectory name is included as part of the file specification, then the search will include that subdirectory and all subdirectories below it. If no subdirectory is given as part of the file specification, then the current directory and all below it are included in the search.

Examples

EADUMP *.exe

EADump will dump the extended attributes of any .exe files which it finds in the current directory.

EADUMP C:\OS2\*.* -ols

EADump will list the file names, extended attribute names, types and flag values of all files in C:\OS2 and its subdirectories.

EADUMP C:\STARTUP.CMD

EADump will dump the extended attributes of C:\STARTUP.CMD only.

EADUMP

EADump will dump the extended attributes for all of the files in the current directory.

EADUMP -hol

EADump will list the file name, extended attribute name, type and flag values of all files with extended attributes across all hard disks.

EADUMP -n.Type *.Ico

EADump will dump the extended attributes of all .ICO files in the current directory that have an extended attribute named ".TYPE".

The OS/2 System Editor (E.EXE) attaches a EAT_MVMT EA to files that it edits.

EADUMP LMAX.CMD

EADump will produce output similar to this:

EA Name: .TYPE
EA Flag: 00
EA Type: Multi-valued, multi-typed field
0000  df ff 00 00 01 00                          ß.....
6 bytes dumped

EA Type: Length preceded ASCII
0000  fd ff 0a 00 50 6c 61 69 6e 20 54 65 78 74  ı...Plain
Text
14 bytes dumped

EADUMP -r LMAX.CMD

EADump will produce output similar to this:

EA Name: .TYPE
EA Flag: 00
EA Type: Multi-valued, multi-typed field
0000  df ff 00 00 01 00 fd ff 0a 00 50 6c 61 69 6e 20  ...ı...Plain
0010  54 65 78 74 00                                   Text.
21 bytes dumped