{"id":27450186,"url":"https://github.com/andregleichner/xattr-win","last_synced_at":"2026-05-16T22:03:21.941Z","repository":{"id":287036284,"uuid":"961312816","full_name":"AndreGleichner/xattr-win","owner":"AndreGleichner","description":"Extended attributes for Windows — like xattr on Linux and macOS.","archived":false,"fork":false,"pushed_at":"2025-04-10T15:16:27.000Z","size":56,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-15T09:13:57.881Z","etag":null,"topics":["ea","extended-attributes","filesystem-tool","windows"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/AndreGleichner.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-04-06T08:42:26.000Z","updated_at":"2025-04-10T15:16:31.000Z","dependencies_parsed_at":"2025-04-09T17:21:51.380Z","dependency_job_id":"75f92cc1-d239-47d2-b8fd-c9298f148ce7","html_url":"https://github.com/AndreGleichner/xattr-win","commit_stats":null,"previous_names":["andregleichner/xattr-win"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AndreGleichner%2Fxattr-win","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AndreGleichner%2Fxattr-win/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AndreGleichner%2Fxattr-win/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AndreGleichner%2Fxattr-win/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/AndreGleichner","download_url":"https://codeload.github.com/AndreGleichner/xattr-win/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249040141,"owners_count":21202826,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ea","extended-attributes","filesystem-tool","windows"],"created_at":"2025-04-15T09:14:12.632Z","updated_at":"2026-05-16T22:03:21.929Z","avatar_url":"https://github.com/AndreGleichner.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"Overview\r\n--------\r\nExtended attributes for Windows — like xattr on Linux and macOS.\r\n\r\nOn Windows there's no default commandline tool to write or delete EAs.\r\nTo read EAs you may use: `fsutil file queryEA \u003cpath\u003e`\r\n\r\nName requirements\r\n-----------------\r\nUnlike in Linux, where EA names require a specific name prefix like \"user.\" or \"system.\" in Windows names have the following restrictions:\r\nIt MUST be less than 255 8-bit ASCII characters and MUST NOT contain any of the following characters:\r\n`ASCII values 0x00 - 0x1F, \\ / : * ? \" \u003c \u003e | , + = [ ] ;`\r\nBeside that, in Windows user mode you'll NOT be able to create an EA name starting with `$KERNEL.`.\r\nFurthermore, EAs starting with `$KERNEL.PURGE.` are automatically deleted by the system on every file modification. \r\nSee https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/kernel-extended-attributes for details.\r\nNames of EAs in Windows will be converted to all-uppercase upon creation automatically.\r\n\r\nValue requirements\r\n------------------\r\nThe EA value may just be a string, but may be any byte sequence up to a total length of 65535 bytes.\r\n\r\nWSL2 Linux:\r\n-----------\r\nEAs are NOT propagated to the other side, neither from WSL2-Linux to Windows, nor the other way around.\r\n\r\nUsage\r\n-----\r\nSimilar to the commands of the Linux xattr, the following arguments may be supplied:\r\n\r\nList only the names of all EAs on the given file(s):\r\n```\r\nxattr [-eklrvx] file [ file ... ]\r\n```\r\nPrint only the value of EA ea_name on the given file(s):\r\n```\r\nxattr -p [-eklrvx] ea_name file [ file ... ]\r\n```\r\nWrite the value of the EA ea_name to ea_value:\r\n```\r\nxattr -w [-fkrux] ea_name ea_value file [ file ... ]\r\n    (No output on success, error messages on stderr.)\r\n```\r\nDelete the EA ea_name from file(s):\r\n```\r\nxattr -d [-kr] ea_name file [ file ... ]\r\n    (No output on success, error messages on stderr.)\r\n```\r\nClear all EA from the given file(s):\r\n```\r\nxattr -c [-kr] file [ file ... ]\r\n    (No output on success, error messages on stderr.)\r\n```\r\nOptions:\r\n\r\n    -c  Clear all Attributes.\r\n\r\n    -d  Delete the given attribute.\r\n\r\n    -e  Expand / extract / examine well known EAs.\r\n\r\n    -f  Write content of a given file as EA value. Max size is 65535 bytes.\r\n        Use with -w option. This option can not be combined with -x or -u.\r\n\r\n    -h  Help.\r\n\r\n    -k  Keep-going. Ignore errors and continue processing the next file. \r\n        This is useful when you want to process a list of files and ignore errors on some of them.\r\n\r\n    -l  By default, the first two command forms either display just the attribute names or\r\n        values, respectively. The -l option causes both the attribute names and corresponding\r\n        values to be displayed. For hex display of values, the output is preceded with the hex\r\n        offset values and followed by ASCII display, enclosed by '|'.\r\n\r\n    -m  Max-depth for recursive processing. Default is 1. \r\n        0 =\u003e only the given directory, \r\n        1 =\u003e only the files in the given directory, \r\n        2 =\u003e files in the given directory and their subdirectories, etc.\r\n        This option is only valid with -r option.\r\n\r\n    -p  Print the value associated with the given attribute.\r\n\r\n    -r  If a file argument is a directory, act as if the entire contents of the directory\r\n        recursively were also specified (so that every file in the directory tree is acted upon).\r\n\r\n    -u  Write value as unicode string (UTF-16LE). The Default is UTF-8. \r\n        This option can not be combined with -x.\r\n\r\n    -v  View the file name, even for a single file.\r\n\r\n    -w  Write a given attribute name with a value.\r\n\r\n    -x  Force the attribute value to be displayed in the hexadecimal representation.\r\n        This option can not be combined with -u.\r\n\r\n    --debug  Print debug information to stdout.\r\n\r\nOne or more files or directories may be specified on the command line.\r\n\r\nFor the first two forms of the command, if there is more than one file, \r\nthe file name is displayed along with the actual results. \r\nWhen only one file is specified, the display of the file name is suppressed unless the -v option, is also specified.\r\n\r\nAttribute values are usually displayed as strings. However, if unprintable data are detected, the value is displayed in a hexadecimal representation.\r\n\r\nThe -w option normally assumes the input attribute value is a string. \r\nSpecifying the -x option causes xattr to expect the input in hexadecimal (whitespace is ignored). \r\nThe hex bytes must be enclosed in \"\".\r\n\r\nxattr exits with 0 on success.\r\nOn error it exits with a non-zero value and prints an error message on stderr.\r\n\r\nMisc\r\n----\r\nAlthough documented differently EAs are also supported on ReFS (Checked on Win11 24H2):\r\nhttps://learn.microsoft.com/en-us/windows-server/storage/refs/refs-overview\r\n\r\nRun \"fsutil fsinfo volumeinfo D:\" to see whether EAs are supported on your volume.\r\n\r\nSome EA names Windows uses:\r\n- $CI.CATALOGHINT\r\n- $KERNEL.CFDONOTCONVERT\r\n- $KERNEL.PURGE.ESBCACHE\r\n- $KERNEL.PURGE.APPXFICACHE\r\n- $KERNEL.PURGE.TRUSTCLAIM\r\n- $KERNEL.PURGE.SEC.FILESENSITIVITY\r\n- $KERNEL.PURGE.SEC.FILEHASH\r\n\r\nSome background on various EA usages:\r\n- https://posts.specterops.io/host-based-threat-modeling-indicator-design-a9dbbb53d5ea\r\n- https://superuser.com/questions/396692/what-are-these-extended-attributes-eas-in-the-files-in-windows-8\r\n- https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Smart_App_Control/Studie_Smart_App_Control.pdf?__blob=publicationFile\u0026v=2\r\n- https://posts.specterops.io/documenting-and-attacking-a-windows-defender-application-control-feature-the-hard-way-a-case-73dd1e11be3a\r\n- https://github.com/gabriellandau/ExtendedAttributeIpecac\r\n- https://superuser.com/questions/396692/what-are-these-extended-attributes-eas-in-the-files-in-windows-8\r\n\r\n\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandregleichner%2Fxattr-win","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fandregleichner%2Fxattr-win","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandregleichner%2Fxattr-win/lists"}