head 1.1; branch 1.1.1; access; symbols FILE5_48:1.1.1.13 netbsd-11-0-RC4:1.1.1.13 netbsd-11-0-RC3:1.1.1.13 netbsd-11-0-RC2:1.1.1.13 netbsd-11-0-RC1:1.1.1.13 perseant-exfatfs-base-20250801:1.1.1.13 netbsd-11:1.1.1.13.0.4 netbsd-11-base:1.1.1.13 netbsd-10-1-RELEASE:1.1.1.12 perseant-exfatfs-base-20240630:1.1.1.13 perseant-exfatfs:1.1.1.13.0.2 perseant-exfatfs-base:1.1.1.13 netbsd-8-3-RELEASE:1.1.1.7 netbsd-9-4-RELEASE:1.1.1.9 netbsd-10-0-RELEASE:1.1.1.12 netbsd-10-0-RC6:1.1.1.12 netbsd-10-0-RC5:1.1.1.12 netbsd-10-0-RC4:1.1.1.12 netbsd-10-0-RC3:1.1.1.12 netbsd-10-0-RC2:1.1.1.12 netbsd-10-0-RC1:1.1.1.12 FILE5_45:1.1.1.13 netbsd-10:1.1.1.12.0.2 netbsd-10-base:1.1.1.12 FILE5_43:1.1.1.12 netbsd-9-3-RELEASE:1.1.1.9 cjep_sun2x-base1:1.1.1.11 cjep_sun2x:1.1.1.11.0.4 cjep_sun2x-base:1.1.1.11 cjep_staticlib_x-base1:1.1.1.11 netbsd-9-2-RELEASE:1.1.1.9 cjep_staticlib_x:1.1.1.11.0.2 cjep_staticlib_x-base:1.1.1.11 FILE5_40:1.1.1.11 netbsd-9-1-RELEASE:1.1.1.9 FILE5_39:1.1.1.10 phil-wifi-20200421:1.1.1.10 phil-wifi-20200411:1.1.1.10 is-mlppp:1.1.1.10.0.2 is-mlppp-base:1.1.1.10 phil-wifi-20200406:1.1.1.10 netbsd-8-2-RELEASE:1.1.1.7 netbsd-9-0-RELEASE:1.1.1.9 netbsd-9-0-RC2:1.1.1.9 FILE5_38:1.1.1.10 netbsd-9-0-RC1:1.1.1.9 phil-wifi-20191119:1.1.1.9 netbsd-9:1.1.1.9.0.2 netbsd-9-base:1.1.1.9 phil-wifi-20190609:1.1.1.9 netbsd-8-1-RELEASE:1.1.1.7 FILE5_37:1.1.1.9 netbsd-8-1-RC1:1.1.1.7 pgoyette-compat-merge-20190127:1.1.1.7.8.1 pgoyette-compat-20190127:1.1.1.8 pgoyette-compat-20190118:1.1.1.8 pgoyette-compat-1226:1.1.1.8 pgoyette-compat-1126:1.1.1.8 pgoyette-compat-1020:1.1.1.8 FILE5_35:1.1.1.8 pgoyette-compat-0930:1.1.1.8 pgoyette-compat-0906:1.1.1.8 netbsd-7-2-RELEASE:1.1.1.4 pgoyette-compat-0728:1.1.1.8 netbsd-8-0-RELEASE:1.1.1.7 phil-wifi:1.1.1.8.0.2 phil-wifi-base:1.1.1.8 pgoyette-compat-0625:1.1.1.8 netbsd-8-0-RC2:1.1.1.7 pgoyette-compat-0521:1.1.1.8 pgoyette-compat-0502:1.1.1.8 pgoyette-compat-0422:1.1.1.8 netbsd-8-0-RC1:1.1.1.7 FILE5_33:1.1.1.8 pgoyette-compat-0415:1.1.1.7 pgoyette-compat-0407:1.1.1.7 pgoyette-compat-0330:1.1.1.7 pgoyette-compat-0322:1.1.1.7 pgoyette-compat-0315:1.1.1.7 netbsd-7-1-2-RELEASE:1.1.1.4 pgoyette-compat:1.1.1.7.0.8 pgoyette-compat-base:1.1.1.7 netbsd-7-1-1-RELEASE:1.1.1.4 matt-nb8-mediatek:1.1.1.7.0.6 matt-nb8-mediatek-base:1.1.1.7 FILE5_32:1.1.1.7 perseant-stdc-iso10646:1.1.1.7.0.4 perseant-stdc-iso10646-base:1.1.1.7 netbsd-8:1.1.1.7.0.2 netbsd-8-base:1.1.1.7 FILE5_31:1.1.1.7 prg-localcount2-base3:1.1.1.6 prg-localcount2-base2:1.1.1.6 prg-localcount2-base1:1.1.1.6 prg-localcount2:1.1.1.6.0.2 prg-localcount2-base:1.1.1.6 pgoyette-localcount-20170426:1.1.1.6 bouyer-socketcan-base1:1.1.1.6 pgoyette-localcount-20170320:1.1.1.6 netbsd-7-1:1.1.1.4.0.10 netbsd-7-1-RELEASE:1.1.1.4 netbsd-7-1-RC2:1.1.1.4 FILE5_30:1.1.1.6 netbsd-7-nhusb-base-20170116:1.1.1.4 bouyer-socketcan:1.1.1.5.0.4 bouyer-socketcan-base:1.1.1.5 pgoyette-localcount-20170107:1.1.1.5 netbsd-7-1-RC1:1.1.1.4 pgoyette-localcount-20161104:1.1.1.5 netbsd-7-0-2-RELEASE:1.1.1.4 localcount-20160914:1.1.1.5 netbsd-7-nhusb:1.1.1.4.0.8 netbsd-7-nhusb-base:1.1.1.4 pgoyette-localcount-20160806:1.1.1.5 pgoyette-localcount-20160726:1.1.1.5 pgoyette-localcount:1.1.1.5.0.2 pgoyette-localcount-base:1.1.1.5 netbsd-7-0-1-RELEASE:1.1.1.4 netbsd-7-0:1.1.1.4.0.6 netbsd-7-0-RELEASE:1.1.1.4 netbsd-7-0-RC3:1.1.1.4 netbsd-7-0-RC2:1.1.1.4 netbsd-7-0-RC1:1.1.1.4 FILE5_22:1.1.1.5 FILE5_20:1.1.1.5 netbsd-6-0-6-RELEASE:1.1.1.3 netbsd-6-1-5-RELEASE:1.1.1.3 netbsd-7:1.1.1.4.0.4 netbsd-7-base:1.1.1.4 FILE5_19:1.1.1.4 yamt-pagecache-base9:1.1.1.4 yamt-pagecache-tag8:1.1.1.3 netbsd-6-1-4-RELEASE:1.1.1.3 netbsd-6-0-5-RELEASE:1.1.1.3 tls-earlyentropy:1.1.1.4.0.2 tls-earlyentropy-base:1.1.1.4 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.4 riastradh-drm2-base3:1.1.1.4 netbsd-6-1-3-RELEASE:1.1.1.3 netbsd-6-0-4-RELEASE:1.1.1.3 FILE5_16:1.1.1.4 netbsd-6-1-2-RELEASE:1.1.1.3 netbsd-6-0-3-RELEASE:1.1.1.3 netbsd-6-1-1-RELEASE:1.1.1.3 riastradh-drm2-base2:1.1.1.3 riastradh-drm2-base1:1.1.1.3 riastradh-drm2:1.1.1.3.0.12 riastradh-drm2-base:1.1.1.3 netbsd-6-1:1.1.1.3.0.18 netbsd-6-0-2-RELEASE:1.1.1.3 netbsd-6-1-RELEASE:1.1.1.3 khorben-n900:1.1.1.3.0.16 netbsd-6-1-RC4:1.1.1.3 netbsd-6-1-RC3:1.1.1.3 agc-symver:1.1.1.3.0.14 agc-symver-base:1.1.1.3 FILE5_14:1.1.1.3 netbsd-6-1-RC2:1.1.1.3 netbsd-6-1-RC1:1.1.1.3 yamt-pagecache-base8:1.1.1.3 FILE_5_12:1.1.1.3 netbsd-6-0-1-RELEASE:1.1.1.3 yamt-pagecache-base7:1.1.1.3 matt-nb6-plus-nbase:1.1.1.3 yamt-pagecache-base6:1.1.1.3 netbsd-6-0:1.1.1.3.0.10 netbsd-6-0-RELEASE:1.1.1.3 netbsd-6-0-RC2:1.1.1.3 tls-maxphys:1.1.1.3.0.8 tls-maxphys-base:1.1.1.4 matt-nb6-plus:1.1.1.3.0.6 matt-nb6-plus-base:1.1.1.3 netbsd-6-0-RC1:1.1.1.3 yamt-pagecache-base5:1.1.1.3 yamt-pagecache-base4:1.1.1.3 FILE5_11:1.1.1.3 netbsd-6:1.1.1.3.0.4 netbsd-6-base:1.1.1.3 yamt-pagecache-base3:1.1.1.3 yamt-pagecache-base2:1.1.1.3 yamt-pagecache:1.1.1.3.0.2 yamt-pagecache-base:1.1.1.3 FILE5_09:1.1.1.3 cherry-xenmp:1.1.1.2.0.2 cherry-xenmp-base:1.1.1.2 FILE5_07:1.1.1.2 bouyer-quota2-nbase:1.1.1.1 bouyer-quota2:1.1.1.1.0.4 bouyer-quota2-base:1.1.1.1 matt-mips64-premerge-20101231:1.1.1.1 matt-premerge-20091211:1.1.1.1 jym-xensuspend-base:1.1.1.1 jym-xensuspend:1.1.1.1.0.2 jym-xensuspend-nbase:1.1.1.1 FILE5_03:1.1.1.1 CHRISTOS:1.1.1; locks; strict; comment @# @; 1.1 date 2009.05.08.16.35.09; author christos; state Exp; branches 1.1.1.1; next ; 1.1.1.1 date 2009.05.08.16.35.09; author christos; state Exp; branches 1.1.1.1.2.1; next 1.1.1.2; 1.1.1.2 date 2011.05.12.20.47.03; author christos; state Exp; branches; next 1.1.1.3; 1.1.1.3 date 2011.09.16.20.37.47; author christos; state Exp; branches 1.1.1.3.2.1 1.1.1.3.8.1; next 1.1.1.4; 1.1.1.4 date 2013.12.01.19.28.19; author christos; state Exp; branches; next 1.1.1.5; commitid RVQIxe3FpM3lSsfx; 1.1.1.5 date 2014.10.10.20.08.22; author christos; state Exp; branches 1.1.1.5.2.1 1.1.1.5.4.1; next 1.1.1.6; commitid pfOzhE33qnut2HTx; 1.1.1.6 date 2017.02.10.17.42.58; author christos; state Exp; branches; next 1.1.1.7; commitid HAP3kn9Hn6ovMqFz; 1.1.1.7 date 2017.05.24.23.59.57; author christos; state Exp; branches 1.1.1.7.8.1; next 1.1.1.8; commitid WbyOU2LBE5qOyHSz; 1.1.1.8 date 2018.04.15.19.32.47; author christos; state Exp; branches 1.1.1.8.2.1; next 1.1.1.9; commitid unKSwpX2g9VqBzyA; 1.1.1.9 date 2019.05.22.17.19.57; author christos; state Exp; branches; next 1.1.1.10; commitid VXeNRYYruN1MWdoB; 1.1.1.10 date 2019.12.17.02.23.53; author christos; state Exp; branches; next 1.1.1.11; commitid vqYTz60fS9PNg0PB; 1.1.1.11 date 2021.04.09.18.58.02; author christos; state Exp; branches; next 1.1.1.12; commitid W9ddLLbSkHHinEOC; 1.1.1.12 date 2022.09.24.20.07.54; author christos; state Exp; branches; next 1.1.1.13; commitid Nf6F9kcpc0EPC9VD; 1.1.1.13 date 2023.08.18.18.36.50; author christos; state Exp; branches; next ; commitid IX26ghc1E2S0AiBE; 1.1.1.1.2.1 date 2009.05.08.16.35.09; author jym; state dead; branches; next 1.1.1.1.2.2; 1.1.1.1.2.2 date 2009.05.13.18.51.57; author jym; state Exp; branches; next ; 1.1.1.3.2.1 date 2014.05.22.15.44.59; author yamt; state Exp; branches; next ; commitid tYJXbWAuFvTh7yBx; 1.1.1.3.8.1 date 2014.08.19.23.46.47; author tls; state Exp; branches; next ; commitid jTnpym9Qu0o4R1Nx; 1.1.1.5.2.1 date 2017.03.20.06.52.19; author pgoyette; state Exp; branches; next ; commitid jjw7cAwgyKq7RfKz; 1.1.1.5.4.1 date 2017.04.21.16.51.24; author bouyer; state Exp; branches; next ; commitid dUG7nkTKALCadqOz; 1.1.1.7.8.1 date 2018.04.22.07.20.08; author pgoyette; state Exp; branches; next ; commitid W6xykws0Zbl4kpzA; 1.1.1.8.2.1 date 2019.06.10.21.44.46; author christos; state Exp; branches; next 1.1.1.8.2.2; commitid jtc8rnCzWiEEHGqB; 1.1.1.8.2.2 date 2020.04.08.14.04.04; author martin; state Exp; branches; next ; commitid Qli2aW9E74UFuA3C; desc @@ 1.1 log @Initial revision @ text @ #------------------------------------------------------------------------------ # macintosh description # # BinHex is the Macintosh ASCII-encoded file format (see also "apple") # Daniel Quinlan, quinlan@@yggdrasil.com 11 string must\ be\ converted\ with\ BinHex BinHex binary text !:mime application/mac-binhex40 >41 string x \b, version %.3s # Stuffit archives are the de facto standard of compression for Macintosh # files obtained from most archives. (franklsm@@tuns.ca) 0 string SIT! StuffIt Archive (data) !:mime application/x-stuffit !:apple SIT!SIT! >2 string x : %s 0 string SITD StuffIt Deluxe (data) >2 string x : %s 0 string Seg StuffIt Deluxe Segment (data) >2 string x : %s # Newer StuffIt archives (grant@@netbsd.org) 0 string StuffIt StuffIt Archive !:mime application/x-stuffit !:apple SIT!SIT! #>162 string >0 : %s # Macintosh Applications and Installation binaries (franklsm@@tuns.ca) # GRR: Too weak #0 string APPL Macintosh Application (data) #>2 string x \b: %s # Macintosh System files (franklsm@@tuns.ca) # GRR: Too weak #0 string zsys Macintosh System File (data) #0 string FNDR Macintosh Finder (data) #0 string libr Macintosh Library (data) #>2 string x : %s #0 string shlb Macintosh Shared Library (data) #>2 string x : %s #0 string cdev Macintosh Control Panel (data) #>2 string x : %s #0 string INIT Macintosh Extension (data) #>2 string x : %s #0 string FFIL Macintosh Truetype Font (data) #>2 string x : %s #0 string LWFN Macintosh Postscript Font (data) #>2 string x : %s # Additional Macintosh Files (franklsm@@tuns.ca) # GRR: Too weak #0 string PACT Macintosh Compact Pro Archive (data) #>2 string x : %s #0 string ttro Macintosh TeachText File (data) #>2 string x : %s #0 string TEXT Macintosh TeachText File (data) #>2 string x : %s #0 string PDF Macintosh PDF File (data) #>2 string x : %s # MacBinary format (Eric Fischer, enf@@pobox.com) # # Unfortunately MacBinary doesn't really have a magic number prior # to the MacBinary III format. The checksum is really the way to # do it, but the magic file format isn't up to the challenge. # # 0 byte 0 # 1 byte # filename length # 2 string # filename # 65 string # file type # 69 string # file creator # 73 byte # Finder flags # 74 byte 0 # 75 beshort # vertical posn in window # 77 beshort # horiz posn in window # 79 beshort # window or folder ID # 81 byte # protected? # 82 byte 0 # 83 belong # length of data segment # 87 belong # length of resource segment # 91 belong # file creation date # 95 belong # file modification date # 99 beshort # length of comment after resource # 101 byte # new Finder flags # 102 string mBIN # (only in MacBinary III) # 106 byte # char. code of file name # 107 byte # still more Finder flags # 116 belong # total file length # 120 beshort # length of add'l header # 122 byte 129 # for MacBinary II # 122 byte 130 # for MacBinary III # 123 byte 129 # minimum version that can read fmt # 124 beshort # checksum # # This attempts to use the version numbers as a magic number, requiring # that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second # be 0x81. This works for the files I have, but maybe not for everyone's. # Unfortunately, this magic is quite weak - MPi #122 beshort&0xFCFF 0x8081 Macintosh MacBinary data # MacBinary I doesn't have the version number field at all, but MacBinary II # has been in use since 1987 so I hope there aren't many really old files # floating around that this will miss. The original spec calls for using # the nulls in 0, 74, and 82 as the magic number. # # Another possibility, that would also work for MacBinary I, is to use # the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will # have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, # and that 74 will be 0. So something like # # 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data # # >73 byte&0x01 0x01 \b, inited # >73 byte&0x02 0x02 \b, changed # >73 byte&0x04 0x04 \b, busy # >73 byte&0x08 0x08 \b, bozo # >73 byte&0x10 0x10 \b, system # >73 byte&0x10 0x20 \b, bundle # >73 byte&0x10 0x40 \b, invisible # >73 byte&0x10 0x80 \b, locked #>65 string x \b, type "%4.4s" #>65 string 8BIM (PhotoShop) #>65 string ALB3 (PageMaker 3) #>65 string ALB4 (PageMaker 4) #>65 string ALT3 (PageMaker 3) #>65 string APPL (application) #>65 string AWWP (AppleWorks word processor) #>65 string CIRC (simulated circuit) #>65 string DRWG (MacDraw) #>65 string EPSF (Encapsulated PostScript) #>65 string FFIL (font suitcase) #>65 string FKEY (function key) #>65 string FNDR (Macintosh Finder) #>65 string GIFf (GIF image) #>65 string Gzip (GNU gzip) #>65 string INIT (system extension) #>65 string LIB\ (library) #>65 string LWFN (PostScript font) #>65 string MSBC (Microsoft BASIC) #>65 string PACT (Compact Pro archive) #>65 string PDF\ (Portable Document Format) #>65 string PICT (picture) #>65 string PNTG (MacPaint picture) #>65 string PREF (preferences) #>65 string PROJ (Think C project) #>65 string QPRJ (Think Pascal project) #>65 string SCFL (Defender scores) #>65 string SCRN (startup screen) #>65 string SITD (StuffIt Deluxe) #>65 string SPn3 (SuperPaint) #>65 string STAK (HyperCard stack) #>65 string Seg\ (StuffIt segment) #>65 string TARF (Unix tar archive) #>65 string TEXT (ASCII) #>65 string TIFF (TIFF image) #>65 string TOVF (Eudora table of contents) #>65 string WDBN (Microsoft Word word processor) #>65 string WORD (MacWrite word processor) #>65 string XLS\ (Microsoft Excel) #>65 string ZIVM (compress (.Z)) #>65 string ZSYS (Pre-System 7 system file) #>65 string acf3 (Aldus FreeHand) #>65 string cdev (control panel) #>65 string dfil (Desk Acessory suitcase) #>65 string libr (library) #>65 string nX^d (WriteNow word processor) #>65 string nX^w (WriteNow dictionary) #>65 string rsrc (resource) #>65 string scbk (Scrapbook) #>65 string shlb (shared library) #>65 string ttro (SimpleText read-only) #>65 string zsys (system file) #>69 string x \b, creator "%4.4s" # Somewhere, Apple has a repository of registered Creator IDs. These are # just the ones that I happened to have files from and was able to identify. #>69 string 8BIM (Adobe Photoshop) #>69 string ALD3 (PageMaker 3) #>69 string ALD4 (PageMaker 4) #>69 string ALFA (Alpha editor) #>69 string APLS (Apple Scanner) #>69 string APSC (Apple Scanner) #>69 string BRKL (Brickles) #>69 string BTFT (BitFont) #>69 string CCL2 (Common Lisp 2) #>69 string CCL\ (Common Lisp) #>69 string CDmo (The Talking Moose) #>69 string CPCT (Compact Pro) #>69 string CSOm (Eudora) #>69 string DMOV (Font/DA Mover) #>69 string DSIM (DigSim) #>69 string EDIT (Macintosh Edit) #>69 string ERIK (Macintosh Finder) #>69 string EXTR (self-extracting archive) #>69 string Gzip (GNU gzip) #>69 string KAHL (Think C) #>69 string LWFU (LaserWriter Utility) #>69 string LZIV (compress) #>69 string MACA (MacWrite) #>69 string MACS (Macintosh operating system) #>69 string MAcK (MacKnowledge terminal emulator) #>69 string MLND (Defender) #>69 string MPNT (MacPaint) #>69 string MSBB (Microsoft BASIC (binary)) #>69 string MSWD (Microsoft Word) #>69 string NCSA (NCSA Telnet) #>69 string PJMM (Think Pascal) #>69 string PSAL (Hunt the Wumpus) #>69 string PSI2 (Apple File Exchange) #>69 string R*ch (BBEdit) #>69 string RMKR (Resource Maker) #>69 string RSED (Resource Editor) #>69 string Rich (BBEdit) #>69 string SIT! (StuffIt) #>69 string SPNT (SuperPaint) #>69 string Unix (NeXT Mac filesystem) #>69 string VIM! (Vim editor) #>69 string WILD (HyperCard) #>69 string XCEL (Microsoft Excel) #>69 string aCa2 (Fontographer) #>69 string aca3 (Aldus FreeHand) #>69 string dosa (Macintosh MS-DOS file system) #>69 string movr (Font/DA Mover) #>69 string nX^n (WriteNow) #>69 string pdos (Apple ProDOS file system) #>69 string scbk (Scrapbook) #>69 string ttxt (SimpleText) #>69 string ufox (Foreign File Access) # Just in case... 102 string mBIN MacBinary III data with surprising version number # sas magic from Bruce Foster (bef@@nwu.edu) # #0 string SAS SAS #>8 string x %s 0 string SAS SAS >24 string DATA data file >24 string CATALOG catalog >24 string INDEX data file index >24 string VIEW data view # sas 7+ magic from Reinhold Koch (reinhold.koch@@roche.com) # 0x54 string SAS SAS 7+ >0x9C string DATA data file >0x9C string CATALOG catalog >0x9C string INDEX data file index >0x9C string VIEW data view # spss magic for SPSS system and portable files, # from Bruce Foster (bef@@nwu.edu). 0 long 0xc1e2c3c9 SPSS Portable File >40 string x %s 0 string $FL2 SPSS System File >24 string x %s # Macintosh filesystem data # From "Tom N Harris" # Fixed HFS+ and Partition map magic: Ethan Benson # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these # entries depend on the data arithmetic added after v.35 # There's also some Pascal strings in here, ditto... # The boot block signature, according to IM:Files, is # "for HFS volumes, this field always contains the value 0x4C4B." # But if this is true for MFS or HFS+ volumes, I don't know. # Alternatively, the boot block is supposed to be zeroed if it's # unused, so a simply >0 should suffice. 0x400 beshort 0xD2D7 Macintosh MFS data >0 beshort 0x4C4B (bootable) >0x40a beshort &0x8000 (locked) >0x402 beldate-0x7C25B080 x created: %s, >0x406 beldate-0x7C25B080 >0 last backup: %s, >0x414 belong x block size: %d, >0x412 beshort x number of blocks: %d, >0x424 pstring x volume name: %s # "BD" is has many false positives #0x400 beshort 0x4244 Macintosh HFS data #>0 beshort 0x4C4B (bootable) #>0x40a beshort &0x8000 (locked) #>0x40a beshort ^0x0100 (mounted) #>0x40a beshort &0x0200 (spared blocks) #>0x40a beshort &0x0800 (unclean) #>0x47C beshort 0x482B (Embedded HFS+ Volume) #>0x402 beldate-0x7C25B080 x created: %s, #>0x406 beldate-0x7C25B080 x last modified: %s, #>0x440 beldate-0x7C25B080 >0 last backup: %s, #>0x414 belong x block size: %d, #>0x412 beshort x number of blocks: %d, #>0x424 pstring x volume name: %s 0x400 beshort 0x482B Macintosh HFS Extended >&0 beshort x version %d data >0 beshort 0x4C4B (bootable) >0x404 belong ^0x00000100 (mounted) >&2 belong &0x00000200 (spared blocks) >&2 belong &0x00000800 (unclean) >&2 belong &0x00008000 (locked) >&6 string x last mounted by: '%.4s', # really, that should be treated as a belong and we print a string # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" >&14 beldate-0x7C25B080 x created: %s, # only the creation date is local time, all other timestamps in HFS+ are UTC. >&18 bedate-0x7C25B080 x last modified: %s, >&22 bedate-0x7C25B080 >0 last backup: %s, >&26 bedate-0x7C25B080 >0 last checked: %s, >&38 belong x block size: %d, >&42 belong x number of blocks: %d, >&46 belong x free blocks: %d # I don't think this is really necessary since it doesn't do much and # anything with a valid driver descriptor will also have a valid # partition map #0 beshort 0x4552 Apple Device Driver data #>&24 beshort =1 \b, MacOS # Is that the partition type a cstring or a pstring? Well, IM says "strings # shorter than 32 bytes must be terminated with NULL" so I'll treat it as a # cstring. Of course, partitions can contain more than four entries, but # what're you gonna do? # GRR: This magic is too weak, it is just "PM" #0x200 beshort 0x504D Apple Partition data #>0x2 beshort x (block size: %d): #>0x230 string x first type: %s, #>0x210 string x name: %s, #>0x254 belong x number of blocks: %d, #>0x400 beshort 0x504D #>>0x430 string x second type: %s, #>>0x410 string x name: %s, #>>0x454 belong x number of blocks: %d, #>>0x600 beshort 0x504D #>>>0x630 string x third type: %s, #>>>0x610 string x name: %s, #>>>0x654 belong x number of blocks: %d, #>>0x800 beshort 0x504D #>>>0x830 string x fourth type: %s, #>>>0x810 string x name: %s, #>>>0x854 belong x number of blocks: %d, #>>>0xa00 beshort 0x504D #>>>>0xa30 string x fifth type: %s, #>>>>0xa10 string x name: %s, #>>>>0xa54 belong x number of blocks: %d #>>>0xc00 beshort 0x504D #>>>>0xc30 string x sixth type: %s, #>>>>0xc10 string x name: %s, #>>>>0xc54 belong x number of blocks: %d ## AFAIK, only the signature is different #0x200 beshort 0x5453 Apple Old Partition data #>0x2 beshort x block size: %d, #>0x230 string x first type: %s, #>0x210 string x name: %s, #>0x254 belong x number of blocks: %d, #>0x400 beshort 0x504D #>>0x430 string x second type: %s, #>>0x410 string x name: %s, #>>0x454 belong x number of blocks: %d, #>>0x800 beshort 0x504D #>>>0x830 string x third type: %s, #>>>0x810 string x name: %s, #>>>0x854 belong x number of blocks: %d, #>>>0xa00 beshort 0x504D #>>>>0xa30 string x fourth type: %s, #>>>>0xa10 string x name: %s, #>>>>0xa54 belong x number of blocks: %d # From: Remi Mommsen 0 string BOMStore Mac OS X bill of materials (BOM) file @ 1.1.1.1 log @from ftp.astron.com @ text @@ 1.1.1.2 log @from ftp.astron.com. - many security related fixes - no MAXPATHLEN limits - fixed missing text specification on ascii magic - new ``pascal'' style string formats - whitespace comparison fix - more magic @ text @a2 1 # $File: macintosh,v 1.21 2010/09/20 19:19:17 rrt Exp $ a377 12 # From: Adam Buchbinder # URL: http://en.wikipedia.org/wiki/Datafork_TrueType # Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is # TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I # don't know what they mean. 0 belong 0x100 >(0x4.L+24) beshort x >>&4 belong 0x73666e74 Mac OSX datafork font, TrueType >>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' >>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' >>&4 belong 0x504f5354 Mac OSX datafork font, PostScript @ 1.1.1.3 log @from ftp.astron.com: - elf seeking fixes - improvements in cdf parsing - waitpid only for our child - magic fixes and additions @ text @d3 1 a3 1 # $File: macintosh,v 1.22 2011/05/17 17:40:31 rrt Exp $ d288 1 a288 1 # "BD" gives many false positives @ 1.1.1.3.8.1 log @Rebase to HEAD as of a few days ago. @ text @d3 1 a3 1 # $File: macintosh,v 1.23 2013/11/19 18:47:58 christos Exp $ a265 3 0 string $FL3 SPSS System File >24 string x %s @ 1.1.1.3.2.1 log @sync with head. for a reference, the tree before this commit was tagged as yamt-pagecache-tag8. this commit was splitted into small chunks to avoid a limitation of cvs. ("Protocol error: too many arguments") @ text @d3 1 a3 1 # $File: macintosh,v 1.23 2013/11/19 18:47:58 christos Exp $ a265 3 0 string $FL3 SPSS System File >24 string x %s @ 1.1.1.4 log @from ftp.astron.com, this is a bug fix release: * always leave magic file loaded, don't unload for magic_check, etc. * fix default encoding to binary instead of unknown which broke recently * handle empty and one byte files, less specially so that --mime-encoding does not break completely. * fix erroneous non-zero exit code from non-existant file and message * add CDF MSI file detection (Guy Helmer) @ text @d3 1 a3 1 # $File: macintosh,v 1.23 2013/11/19 18:47:58 christos Exp $ a265 3 0 string $FL3 SPSS System File >24 string x %s @ 1.1.1.5 log @import file-5.20; bug fixes and better image magic descriptions. @ text @d3 1 a3 1 # $File: macintosh,v 1.25 2014/09/03 13:34:16 christos Exp $ d168 1 a168 1 #>65 string dfil (Desk Accessory suitcase) a290 2 # *.hfs updated by Joerg Jenderek # http://en.wikipedia.org/wiki/Hierarchical_File_System d292 13 a304 29 0x400 beshort 0x4244 # ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h # first block of volume bit map (always 3) >0x40e ubeshort 0x0003 # maximal length of volume name is 27 >>0x424 ubyte <28 Macintosh HFS data #!:mime application/octet-stream # these mime and apple types are not sure !:mime application/x-apple-diskimage #!:apple hfsdINIT #!:apple MACSdisk >>>0 beshort 0x4C4B (bootable) #>>>0 beshort 0x0000 (not bootable) >>>0x40a beshort &0x8000 (locked) >>>0x40a beshort ^0x0100 (mounted) >>>0x40a beshort &0x0200 (spared blocks) >>>0x40a beshort &0x0800 (unclean) >>>0x47C beshort 0x482B (Embedded HFS+ Volume) # http://www.epochconverter.com/ # 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 # 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 # construct not working #>>>0x402 beldate-0x7C25B080 x created: %s, #>>>0x406 beldate-0x7C25B080 x last modified: %s, #>>>0x440 beldate-0x7C25B080 >0 last backup: %s, # found block sizes 200h,1200h,2800h >>>0x414 belong x block size: %d, >>>0x412 beshort x number of blocks: %d, >>>0x424 pstring x volume name: %s d325 36 a361 2 # same as Apple Partition Map # GRR: This magic is too weak, it is just "TS" @ 1.1.1.5.4.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: macintosh,v 1.26 2015/11/25 00:36:02 christos Exp $ d300 2 a304 5 # http://www.macdisk.com/macsigen.php #!:apple ddskdevi !:apple ????devi # https://en.wikipedia.org/wiki/Apple_Disk_Image !:ext hfs/dmg @ 1.1.1.5.2.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: macintosh,v 1.26 2015/11/25 00:36:02 christos Exp $ d300 2 a304 5 # http://www.macdisk.com/macsigen.php #!:apple ddskdevi !:apple ????devi # https://en.wikipedia.org/wiki/Apple_Disk_Image !:ext hfs/dmg @ 1.1.1.6 log @2017-02-10 12:24 Christos Zoulas * release 5.30 2017-02-07 23:27 Christos Zoulas * If we exceeded the offset in a search return no match (Christoph Biedl) * Be more lenient on corrupt CDF files (Christoph Biedl) 2017-02-04 16:46 Christos Zoulas * pacify ubsan sign extension (oss-fuzz/524) 2017-02-01 12:42 Christos Zoulas * off by one in cdf parsing (PR/593) * report debugging sections in elf (PR/591) 2016-11-06 10:52 Christos Zoulas * Allow @@@@@@ in extensions * Add missing overflow check in der magic (Jonas Wagner) 2016-10-25 10:40 Christos Zoulas * release 5.29 2016-10-24 11:20 Christos Zoulas * der getlength overflow (Jonas Wagner) * multiple magic file load failure (Christoph Biedl) 2016-10-17 11:26 Christos Zoulas * CDF parsing improvements (Guy Helmer) 2016-07-20 7:26 Christos Zoulas * Add support for signed indirect offsets 2016-07-18 7:41 Christos Zoulas * cat /dev/null | file - should print empty (Christoph Biedl) 2016-07-05 15:20 Christos Zoulas * Bump string size from 64 to 96. 2016-06-13 20:20 Christos Zoulas * PR/556: Fix separators on annotations. 2016-06-13 19:40 Christos Zoulas * release 5.28 * fix leak on allocation failure 2016-06-01 1:20 Christos Zoulas * PR/555: Avoid overflow for offset > nbytes * PR/550: Segv on DER parsing: - use the correct variable for length - set offset to 0 on failure. 2016-05-13 12:00 Christos Zoulas * release 5.27 2016-04-18 9:35 Christos Zoulas * Errors comparing DER entries or computing offsets are just indications of malformed non-DER files. Don't print them. * Offset comparison was off-by-one. * Fix compression code (Werner Fink) * Put new bytes constant in the right file (not the generated one) 2016-04-16 18:34 Christos Zoulas * release 5.26 2016-03-31 13:50 Christos Zoulas * make the number of bytes read from files configurable. 2016-03-21 13:40 Christos Zoulas * Add bounds checks for DER code (discovered by Thomas Jarosch) * Change indirect recursion limit to indirect use count and bump from 15 to 50 to prevent abuse. 2016-03-13 20:39 Christos Zoulas * Add -00 which prints filename\0description\0 2016-03-01 13:28 Christos Zoulas * Fix ID3 indirect parsing 2016-01-19 10:18 Christos Zoulas * add DER parsing capability 2015-11-13 10:35 Christos Zoulas * provide dprintf(3) for the OS's that don't have it. 2015-11-11 16:25 Christos Zoulas * redo the compression code report decompression errors 2015-11-10 23:25 Christos Zoulas * REG_STARTEND code is not working as expected, delete it. 2015-11-09 16:05 Christos Zoulas * Add zlib support if we have it. 2015-11-05 11:22 Christos Zoulas * PR/492: compression forking was broken with magic_buffer. 2015-09-16 9:50 Christos Zoulas * release 5.25 2015-09-11 13:25 Christos Zoulas * add a limit to the length of regex searches 2015-09-08 9:50 Christos Zoulas * fix problems with --parameter (Christoph Biedl) 2015-07-11 10:35 Christos Zoulas * Windows fixes PR/466 (Jason Hood) 2015-07-09 10:35 Christos Zoulas * release 5.24 2015-06-11 8:52 Christos Zoulas * redo long option encoding to fix off-by-one in 5.23 2015-06-10 13:50 Christos Zoulas * release 5.23 2015-06-09 16:10 Christos Zoulas * Fix issue with regex range for magic with offset * Always return true from mget with USE (success to mget not match indication). Fixes mime evaluation after USE magic * PR/459: Don't insert magic entries to the list if there are parsing errors for them. 2015-06-03 16:00 Christos Zoulas * PR/455: Add utf-7 encoding 2015-06-03 14:30 Christos Zoulas * PR/455: Implement -Z, look inside, but don't report on compression * PR/454: Fix allocation error on bad magic. 2015-05-29 10:30 Christos Zoulas * handle MAGIC_CONTINUE everywhere, not just in softmagic 2015-05-21 14:30 Christos Zoulas * don't print descriptions for NAME types when mime. 2015-04-09 15:59 Christos Zoulas * Add --extension to list the known extensions for this file type Idea by Andrew J Roazen 2015-02-14 12:23 Christos Zoulas * Bump file search buffer size to 1M. 2015-01-09 14:35 Christos Zoulas * Fix multiple issues with date formats reported by Christoph Biedl: - T_LOCAL meaning was reversed - Arithmetic did not work Also stop adjusting daylight savings for gmt printing. 2015-01-05 13:00 Christos Zoulas * PR/411: Fix memory corruption from corrupt cdf file. @ text @d3 1 a3 1 # $File: macintosh,v 1.26 2015/11/25 00:36:02 christos Exp $ d300 2 a304 5 # http://www.macdisk.com/macsigen.php #!:apple ddskdevi !:apple ????devi # https://en.wikipedia.org/wiki/Apple_Disk_Image !:ext hfs/dmg @ 1.1.1.7 log @Import file-5.31; mostly oss-fuzz found bugs. @ text @d3 1 a3 1 # $File: macintosh,v 1.27 2017/03/17 21:35:28 christos Exp $ d112 1 a112 1 # d114 1 a114 1 # d257 1 a257 1 # spss magic for SPSS system and portable files, d276 1 a276 1 # The boot block signature, according to IM:Files, is d294 1 a294 1 0x400 beshort 0x4244 d297 1 a297 1 >0x40e ubeshort 0x0003 d354 1 a354 1 #>0x400 beshort 0x504D d358 1 a358 1 #>>0x800 beshort 0x504D d362 1 a362 1 #>>>0xa00 beshort 0x504D @ 1.1.1.7.8.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: macintosh,v 1.28 2017/12/05 02:17:48 christos Exp $ a62 3 # Update: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/MacBinary # Reference: http://files.stairways.com/other/macbinaryii-standard-info.txt d65 2 a66 1 # to the MacBinary III format. d68 7 a74 59 # old version number, must be kept at zero for compatibility 0 byte 0 # length of filename (must be in the range 1-63) >1 ubyte >0 # skip T.PIC.LZ INSTRUMENT.7T INVENTORY >>1 ubyte <64 # skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)" # by looking for printable characters at beginning of file name >>>2 ubelong >0x1F000000 # zero fill, must be zero for compatibility >>>>74 byte 0 # zero fill, must be zero for compatibility >>>>>82 byte 0 # MacBinary I test for valid version numbers >>>>>>122 ubeshort 0 # additional check for creation date after 1 Jan 1970 ~ 7C25B080h #>>>>>>>91 ubelong >0x7c25b07F # additional check for undefined header fields in MacBinary I #>>>>>>>101 ulong 0 >>>>>>>0 use mac-bin # MacBinary II the newer versions begins at 129 >>>>>>122 ubeshort 0x8181 >>>>>>>0 use mac-bin # MacBinary III with MacBinary II to read >>>>>122 ubeshort 0x8281 >>>>>>0 use mac-bin # display information of MacBinary file 0 name mac-bin >122 ubyte x MacBinary # versions for MacBinary II/III >122 ubyte 129 II >122 ubyte 130 III # only in MacBinary III >>102 string !mBIN with surprising version !:mime application/x-macbinary !:apple PSPTBINA !:ext bin/macbin # THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary #>1 ubyte >63 \b, name length %u too BIG! #>122 ubeshort x \b, version 0x%x # Finder flags if not 0 # >73 byte !0 \b, flags 0x # >73 byte =0 # >>101 byte !0 \b, flags 0x # # original Finder flags (Bits 8-15) # >73 byte !0 \b%x # # finder flags, bits 0-7 # >101 byte !0 \b%x >73 byte &0x01 \b, inited >73 byte &0x02 \b, changed >73 byte &0x04 \b, busy >73 byte &0x08 \b, bozo >73 byte &0x10 \b, system >73 byte &0x20 \b, bundle >73 byte &0x40 \b, invisible >73 byte &0x80 \b, locked a75 1 #>75 beshort !0 \b, v.pos %u a76 1 #>77 beshort !0 \b, h.pos %u d78 12 a89 11 >79 ubeshort !0 \b, ID 0x%x # protected flag >81 byte !0 \b, protected 0x%x # length of comment after resource >99 ubeshort !0 \b, comment length %u # char. code of file name >106 ubyte !0 \b, char. code 0x%x # still more Finder flags >107 ubyte !0 \b, more flags 0x%x # length of total files when unpacked only used when pack and unpack on the fly >116 ubelong !0 \b, total length %u d91 3 a93 1 >120 ubeshort !0 \b, 2nd header length %u d95 28 a122 39 #>124 ubeshort !0 \b, CRC 0x%x # creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080 >91 beldate-0x7C25B080 x \b, %s # THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow >91 ubelong <0x7c25b080 INVALID date #>91 belong-0x7C25B080 x \b, DEBUG DATE %d # last modified date >95 beldate-0x7C25B080 x \b, modified %s # Apple creator+typ if not null # file creator (normally expressed as four characters) >69 ulong !0 \b, creator # instead 4 character code display full creator name >>69 use apple-creator # file type (normally expressed as four characters) >65 ulong !0 \b, type >>65 use apple-type # length of data segment >83 ubelong !0 \b, %u bytes # filename (in the range 1-63) >1 pstring x "%s" # print 1 space and then at offset 128 inspect data fork content if it has one >83 ubelong !0 \b >>128 indirect x # Afterwards resource fork if length of resource segment not zero >87 ubelong !0 # calculate resource fork offset >>83 ubelong+128 x \b, at 0x%x # length of resource segment >>87 ubelong !0 %u bytes >>(83.S+128) ubequad x resource # further resource fork content inspection >>>&-8 indirect x # Apple Type/Creator Database # URL: https://en.wikipedia.org/wiki/Type_code # Reference: http://www.lacikam.co.il/tcdb/ # http://www.macdisk.com/macsigen.php # Note: classic Mac OS files have two 4 character codes for type and creator. # Thereby the Finder attach documents types to applications. d126 51 a176 62 # display information about apple type 0 name apple-type >0 string 8BIM PhotoShop >0 string ALB3 PageMaker 3 >0 string ALB4 PageMaker 4 >0 string ALT3 PageMaker 3 >0 string APPL application >0 string AWWP AppleWorks word processor >0 string CIRC simulated circuit >0 string DRWG MacDraw >0 string EPSF Encapsulated PostScript >0 string FFIL font suitcase >0 string FKEY function key >0 string FNDR Macintosh Finder >0 string GIFf GIF image >0 string Gzip GNU gzip >0 string INIT system extension >0 string LIB\ library >0 string LWFN PostScript font >0 string MSBC Microsoft BASIC >0 string PACT Compact Pro archive >0 string PDF\ Portable Document Format >0 string PICT picture >0 string PNTG MacPaint picture >0 string PREF preferences >0 string PROJ Think C project >0 string QPRJ Think Pascal project >0 string SCFL Defender scores >0 string SCRN startup screen >0 string SITD StuffIt Deluxe >0 string SPn3 SuperPaint >0 string STAK HyperCard stack >0 string Seg\ StuffIt segment >0 string TARF Unix tar archive >0 string TEXT ASCII >0 string TIFF TIFF image >0 string TOVF Eudora table of contents >0 string WDBN Microsoft Word word processor >0 string WORD MacWrite word processor >0 string XLS\ Microsoft Excel >0 string ZIVM compress (.Z) >0 string ZSYS Pre-System 7 system file >0 string acf3 Aldus FreeHand >0 string cdev control panel >0 string dfil Desk Accessory suitcase >0 string libr library >0 string nX^d WriteNow word processor >0 string nX^w WriteNow dictionary >0 string rsrc resource >0 string scbk Scrapbook >0 string shlb shared library >0 string ttro SimpleText read-only >0 string zsys system file # additional types added in Dec 2017 >0 string BINA binary file >0 string BMPp BMP image >0 string JPEG JPEG image #>0 string W4BN Microsoft Word x.y word processor? # if type name is not known display 4 character identifier >0 default x >>0 string x '%4.4s' d180 1 a180 1 # Now Apple has no repository of registered Creator IDs any more. These are d183 56 a238 71 # display information about apple creator 0 name apple-creator >0 string 8BIM Adobe Photoshop >0 string ALD3 PageMaker 3 >0 string ALD4 PageMaker 4 >0 string ALFA Alpha editor >0 string APLS Apple Scanner >0 string APSC Apple Scanner >0 string BRKL Brickles >0 string BTFT BitFont >0 string CCL2 Common Lisp 2 >0 string CCL\ Common Lisp >0 string CDmo The Talking Moose >0 string CPCT Compact Pro >0 string CSOm Eudora >0 string DMOV Font/DA Mover >0 string DSIM DigSim >0 string EDIT Macintosh Edit >0 string ERIK Macintosh Finder >0 string EXTR self-extracting archive >0 string Gzip GNU gzip >0 string KAHL Think C >0 string LWFU LaserWriter Utility >0 string LZIV compress >0 string MACA MacWrite >0 string MACS Macintosh operating system >0 string MAcK MacKnowledge terminal emulator >0 string MLND Defender >0 string MPNT MacPaint >0 string MSBB Microsoft BASIC (binary) >0 string MSWD Microsoft Word >0 string NCSA NCSA Telnet >0 string PJMM Think Pascal >0 string PSAL Hunt the Wumpus #>0 string PSI2 Apple File Exchange >0 string R*ch BBEdit >0 string RMKR Resource Maker >0 string RSED Resource Editor >0 string Rich BBEdit >0 string SIT! StuffIt >0 string SPNT SuperPaint >0 string Unix NeXT Mac filesystem >0 string VIM! Vim editor >0 string WILD HyperCard >0 string XCEL Microsoft Excel >0 string aCa2 Fontographer >0 string aca3 Aldus FreeHand >0 string dosa Macintosh MS-DOS file system >0 string movr Font/DA Mover >0 string nX^n WriteNow >0 string pdos Apple ProDOS file system >0 string scbk Scrapbook >0 string ttxt SimpleText >0 string ufox Foreign File Access # additional creators added in Dec 2017 # Claris/Apple Works >0 string BOBO Apple Works # CU-SeeMe_0.87b3_(68K).bin #>0 string CUce bar >0 string PSPT Apple File Exchange # Disk_Copy_4.2.sea.bin #>0 string NCse foo # probably StuffIt/Aladdin by Smith Micro Software, Inc. >0 string STi0 stuffit # MacGzip-1.1.3.sea.bin #>0 string aust bar # D-Disk_Copy_6.3.3.smi.bin >0 string oneb Disk Copy Self Mounting # if creator name is not known display 4 character identifier >0 default x >>0 string x '%4.4s' @ 1.1.1.8 log @2018-04-15 14:52 Christos Zoulas * release 5.33 2018-02-24 14:50 Christos Zoulas * extend the support for ${x?:} expansions for magic descriptions 2018-02-21 16:25 Christos Zoulas * add support for ${x?:} in mime types to handle pie binaries. 2017-11-03 9:23 Christos Zoulas * add support for negative offsets (offsets from the end of file) 2017-09-26 8:22 Christos Zoulas * close the file on error when writing magic (Steve Grubb) 2017-09-24 12:02 Christos Zoulas * seccomp support (Paul Moore) 2017-09-02 11:53 Christos Zoulas * release 5.32 2017-08-28 16:37 Christos Zoulas * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski) 2017-08-27 03:55 Christos Zoulas * Fix always true condition (Thomas Jarosch) 2017-05-24 17:30 Christos Zoulas * pickier parsing of numeric values in magic files. 2017-05-23 17:55 Christos Zoulas * PR/615 add magic_getflags() @ text @d3 1 a3 1 # $File: macintosh,v 1.28 2017/12/05 02:17:48 christos Exp $ a62 3 # Update: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/MacBinary # Reference: http://files.stairways.com/other/macbinaryii-standard-info.txt d65 2 a66 1 # to the MacBinary III format. d68 7 a74 59 # old version number, must be kept at zero for compatibility 0 byte 0 # length of filename (must be in the range 1-63) >1 ubyte >0 # skip T.PIC.LZ INSTRUMENT.7T INVENTORY >>1 ubyte <64 # skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)" # by looking for printable characters at beginning of file name >>>2 ubelong >0x1F000000 # zero fill, must be zero for compatibility >>>>74 byte 0 # zero fill, must be zero for compatibility >>>>>82 byte 0 # MacBinary I test for valid version numbers >>>>>>122 ubeshort 0 # additional check for creation date after 1 Jan 1970 ~ 7C25B080h #>>>>>>>91 ubelong >0x7c25b07F # additional check for undefined header fields in MacBinary I #>>>>>>>101 ulong 0 >>>>>>>0 use mac-bin # MacBinary II the newer versions begins at 129 >>>>>>122 ubeshort 0x8181 >>>>>>>0 use mac-bin # MacBinary III with MacBinary II to read >>>>>122 ubeshort 0x8281 >>>>>>0 use mac-bin # display information of MacBinary file 0 name mac-bin >122 ubyte x MacBinary # versions for MacBinary II/III >122 ubyte 129 II >122 ubyte 130 III # only in MacBinary III >>102 string !mBIN with surprising version !:mime application/x-macbinary !:apple PSPTBINA !:ext bin/macbin # THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary #>1 ubyte >63 \b, name length %u too BIG! #>122 ubeshort x \b, version 0x%x # Finder flags if not 0 # >73 byte !0 \b, flags 0x # >73 byte =0 # >>101 byte !0 \b, flags 0x # # original Finder flags (Bits 8-15) # >73 byte !0 \b%x # # finder flags, bits 0-7 # >101 byte !0 \b%x >73 byte &0x01 \b, inited >73 byte &0x02 \b, changed >73 byte &0x04 \b, busy >73 byte &0x08 \b, bozo >73 byte &0x10 \b, system >73 byte &0x20 \b, bundle >73 byte &0x40 \b, invisible >73 byte &0x80 \b, locked a75 1 #>75 beshort !0 \b, v.pos %u a76 1 #>77 beshort !0 \b, h.pos %u d78 12 a89 11 >79 ubeshort !0 \b, ID 0x%x # protected flag >81 byte !0 \b, protected 0x%x # length of comment after resource >99 ubeshort !0 \b, comment length %u # char. code of file name >106 ubyte !0 \b, char. code 0x%x # still more Finder flags >107 ubyte !0 \b, more flags 0x%x # length of total files when unpacked only used when pack and unpack on the fly >116 ubelong !0 \b, total length %u d91 3 a93 1 >120 ubeshort !0 \b, 2nd header length %u d95 28 a122 39 #>124 ubeshort !0 \b, CRC 0x%x # creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080 >91 beldate-0x7C25B080 x \b, %s # THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow >91 ubelong <0x7c25b080 INVALID date #>91 belong-0x7C25B080 x \b, DEBUG DATE %d # last modified date >95 beldate-0x7C25B080 x \b, modified %s # Apple creator+typ if not null # file creator (normally expressed as four characters) >69 ulong !0 \b, creator # instead 4 character code display full creator name >>69 use apple-creator # file type (normally expressed as four characters) >65 ulong !0 \b, type >>65 use apple-type # length of data segment >83 ubelong !0 \b, %u bytes # filename (in the range 1-63) >1 pstring x "%s" # print 1 space and then at offset 128 inspect data fork content if it has one >83 ubelong !0 \b >>128 indirect x # Afterwards resource fork if length of resource segment not zero >87 ubelong !0 # calculate resource fork offset >>83 ubelong+128 x \b, at 0x%x # length of resource segment >>87 ubelong !0 %u bytes >>(83.S+128) ubequad x resource # further resource fork content inspection >>>&-8 indirect x # Apple Type/Creator Database # URL: https://en.wikipedia.org/wiki/Type_code # Reference: http://www.lacikam.co.il/tcdb/ # http://www.macdisk.com/macsigen.php # Note: classic Mac OS files have two 4 character codes for type and creator. # Thereby the Finder attach documents types to applications. d126 51 a176 62 # display information about apple type 0 name apple-type >0 string 8BIM PhotoShop >0 string ALB3 PageMaker 3 >0 string ALB4 PageMaker 4 >0 string ALT3 PageMaker 3 >0 string APPL application >0 string AWWP AppleWorks word processor >0 string CIRC simulated circuit >0 string DRWG MacDraw >0 string EPSF Encapsulated PostScript >0 string FFIL font suitcase >0 string FKEY function key >0 string FNDR Macintosh Finder >0 string GIFf GIF image >0 string Gzip GNU gzip >0 string INIT system extension >0 string LIB\ library >0 string LWFN PostScript font >0 string MSBC Microsoft BASIC >0 string PACT Compact Pro archive >0 string PDF\ Portable Document Format >0 string PICT picture >0 string PNTG MacPaint picture >0 string PREF preferences >0 string PROJ Think C project >0 string QPRJ Think Pascal project >0 string SCFL Defender scores >0 string SCRN startup screen >0 string SITD StuffIt Deluxe >0 string SPn3 SuperPaint >0 string STAK HyperCard stack >0 string Seg\ StuffIt segment >0 string TARF Unix tar archive >0 string TEXT ASCII >0 string TIFF TIFF image >0 string TOVF Eudora table of contents >0 string WDBN Microsoft Word word processor >0 string WORD MacWrite word processor >0 string XLS\ Microsoft Excel >0 string ZIVM compress (.Z) >0 string ZSYS Pre-System 7 system file >0 string acf3 Aldus FreeHand >0 string cdev control panel >0 string dfil Desk Accessory suitcase >0 string libr library >0 string nX^d WriteNow word processor >0 string nX^w WriteNow dictionary >0 string rsrc resource >0 string scbk Scrapbook >0 string shlb shared library >0 string ttro SimpleText read-only >0 string zsys system file # additional types added in Dec 2017 >0 string BINA binary file >0 string BMPp BMP image >0 string JPEG JPEG image #>0 string W4BN Microsoft Word x.y word processor? # if type name is not known display 4 character identifier >0 default x >>0 string x '%4.4s' d180 1 a180 1 # Now Apple has no repository of registered Creator IDs any more. These are d183 56 a238 71 # display information about apple creator 0 name apple-creator >0 string 8BIM Adobe Photoshop >0 string ALD3 PageMaker 3 >0 string ALD4 PageMaker 4 >0 string ALFA Alpha editor >0 string APLS Apple Scanner >0 string APSC Apple Scanner >0 string BRKL Brickles >0 string BTFT BitFont >0 string CCL2 Common Lisp 2 >0 string CCL\ Common Lisp >0 string CDmo The Talking Moose >0 string CPCT Compact Pro >0 string CSOm Eudora >0 string DMOV Font/DA Mover >0 string DSIM DigSim >0 string EDIT Macintosh Edit >0 string ERIK Macintosh Finder >0 string EXTR self-extracting archive >0 string Gzip GNU gzip >0 string KAHL Think C >0 string LWFU LaserWriter Utility >0 string LZIV compress >0 string MACA MacWrite >0 string MACS Macintosh operating system >0 string MAcK MacKnowledge terminal emulator >0 string MLND Defender >0 string MPNT MacPaint >0 string MSBB Microsoft BASIC (binary) >0 string MSWD Microsoft Word >0 string NCSA NCSA Telnet >0 string PJMM Think Pascal >0 string PSAL Hunt the Wumpus #>0 string PSI2 Apple File Exchange >0 string R*ch BBEdit >0 string RMKR Resource Maker >0 string RSED Resource Editor >0 string Rich BBEdit >0 string SIT! StuffIt >0 string SPNT SuperPaint >0 string Unix NeXT Mac filesystem >0 string VIM! Vim editor >0 string WILD HyperCard >0 string XCEL Microsoft Excel >0 string aCa2 Fontographer >0 string aca3 Aldus FreeHand >0 string dosa Macintosh MS-DOS file system >0 string movr Font/DA Mover >0 string nX^n WriteNow >0 string pdos Apple ProDOS file system >0 string scbk Scrapbook >0 string ttxt SimpleText >0 string ufox Foreign File Access # additional creators added in Dec 2017 # Claris/Apple Works >0 string BOBO Apple Works # CU-SeeMe_0.87b3_(68K).bin #>0 string CUce bar >0 string PSPT Apple File Exchange # Disk_Copy_4.2.sea.bin #>0 string NCse foo # probably StuffIt/Aladdin by Smith Micro Software, Inc. >0 string STi0 stuffit # MacGzip-1.1.3.sea.bin #>0 string aust bar # D-Disk_Copy_6.3.3.smi.bin >0 string oneb Disk Copy Self Mounting # if creator name is not known display 4 character identifier >0 default x >>0 string x '%4.4s' @ 1.1.1.8.2.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: macintosh,v 1.29 2019/04/19 00:42:27 christos Exp $ d65 1 a65 1 # Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt d183 2 a184 2 # Reference: https://www.lacikam.co.il/tcdb/ # https://www.macdisk.com/macsigen.php d382 1 a382 1 # https://en.wikipedia.org/wiki/Hierarchical_File_System d393 1 a393 1 # https://www.macdisk.com/macsigen.php d405 1 a405 1 # https://www.epochconverter.com/ d461 1 a461 1 # URL: https://en.wikipedia.org/wiki/Datafork_TrueType @ 1.1.1.8.2.2 log @Merge changes from current as of 20200406 @ text @d3 1 a3 1 # $File: macintosh,v 1.30 2019/12/14 20:40:26 christos Exp $ d8 1 a8 25 # Update: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/BinHex # Reference: http://fileformats.archiveteam.org/wiki/BinHex # Note: only tested with version 4.0 and hqx extension # Any text/binary before the characteristic comment sentence is to be ignored like in # http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx 0 search/1602 (This\ file\ >&0 use binhex # http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx 0 search/2652/b (This\ file\ >&0 use binhex 0 name binhex # keep splitted search string format similar like in version 5.37 >0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version # http://www.macdisk.com/binhexen.php3 !:apple BNHQTEXT # http://www.faqs.org/faqs/macintosh/comm-faq/part1/ >>&0 string 1.0 1.0 !:mime application/mac-binhex !:ext hex >>&0 string 2.0 2.0 !:mime application/mac-binhex !:ext hcx # BinHex 3.0 never existed >>&0 string 4.0 4.0 d10 1 a10 10 !:ext hqx # BinHex 5.0 also MacBinary I >>&0 string 5.0 5.0 !:mime application/mac-binhex40 !:ext hqx # this should never happen >>&0 default x >>>&0 string x %.3s !:mime application/mac-binhex !:ext hqx @ 1.1.1.9 log @2019-05-14 22:26 Christos Zoulas * release 5.37 2019-05-09 22:27 Christos Zoulas * Make sure that continuation separators are printed with -k within softmagic 2019-05-06 22:27 Christos Zoulas * Change SIGPIPE saving and restoring during compression to use sigaction(2) instead of signal(3) and cache it. (Denys Vlasenko) * Cache stat(2) calls more to reduce number of calls (Denys Vlasenko) 2019-05-06 17:25 Christos Zoulas * PR/77: Handle --mime-type and -k correctly. 2019-05-03 15:26 Christos Zoulas * Switch decompression code to use vfork() because tools like rpmdiff and rpmbuild call libmagic with large process footprints (Denys Vlasenko) 2019-04-07 14:05 Christos Zoulas * PR/75: --enable-zlib, did not work. 2019-02-27 11:54 Christos Zoulas * Improve regex efficiency (Michael Schroeder) by: 1. Prefixing regex searches with regular search for keywords where possible 2. Using memmem(3) where available @ text @d3 1 a3 1 # $File: macintosh,v 1.29 2019/04/19 00:42:27 christos Exp $ d65 1 a65 1 # Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt d183 2 a184 2 # Reference: https://www.lacikam.co.il/tcdb/ # https://www.macdisk.com/macsigen.php d382 1 a382 1 # https://en.wikipedia.org/wiki/Hierarchical_File_System d393 1 a393 1 # https://www.macdisk.com/macsigen.php d405 1 a405 1 # https://www.epochconverter.com/ d461 1 a461 1 # URL: https://en.wikipedia.org/wiki/Datafork_TrueType @ 1.1.1.10 log @Import 5.38: - Always accept -S (no sandbox) even if we don't support sandboxing - More syscalls elided for sandboxiing - For ELF dynamic means having an interpreter not just PT_DYNAMIC - Check for large ELF session header offset - When saving and restoring a locale, keep the locale name in our own storage. - Add a flag to disable CSV file detection. - Don't pass NULL/0 to memset to appease sanitizers. - Avoid spurious prints when looks for extensions or apple strings in fsmagic. - Add builtin decompressors for xz and and bzip. - Add a limit for the number of CDF elements. - More checks for overflow in CDF. @ text @d3 1 a3 1 # $File: macintosh,v 1.30 2019/12/14 20:40:26 christos Exp $ d8 1 a8 25 # Update: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/BinHex # Reference: http://fileformats.archiveteam.org/wiki/BinHex # Note: only tested with version 4.0 and hqx extension # Any text/binary before the characteristic comment sentence is to be ignored like in # http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx 0 search/1602 (This\ file\ >&0 use binhex # http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx 0 search/2652/b (This\ file\ >&0 use binhex 0 name binhex # keep splitted search string format similar like in version 5.37 >0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version # http://www.macdisk.com/binhexen.php3 !:apple BNHQTEXT # http://www.faqs.org/faqs/macintosh/comm-faq/part1/ >>&0 string 1.0 1.0 !:mime application/mac-binhex !:ext hex >>&0 string 2.0 2.0 !:mime application/mac-binhex !:ext hcx # BinHex 3.0 never existed >>&0 string 4.0 4.0 d10 1 a10 10 !:ext hqx # BinHex 5.0 also MacBinary I >>&0 string 5.0 5.0 !:mime application/mac-binhex40 !:ext hqx # this should never happen >>&0 default x >>>&0 string x %.3s !:mime application/mac-binhex !:ext hqx @ 1.1.1.11 log @2021-03-30 20:21 Christos Zoulas * release 5.40 2021-02-05 16:31 Christos Zoulas * PR/234: Add limit to the number of bytes to scan for encoding * PR/230: Fix /T (trim flag) for regex 2021-02-01 12:31 Christos Zoulas * PR/77: Trim trailing separator. 2020-12-17 15:44 Christos Zoulas * PR/211: Convert system read errors from corrupt ELF files into human readable error messages 2020-12-08 16:24 Christos Zoulas * fix multithreaded decompression file descriptor issue by using close-on-exec (Denys Vlasenko) 2020-06-27 11:58 Christos Zoulas * Exclude surrogate pairs from utf-8 detection (Michael Liu) 2020-06-25 12:53 Christos Zoulas * Include # to the list of ignored format chars (Werner Fink) @ text @d3 1 a3 1 # $File: macintosh,v 1.31 2020/12/12 20:01:47 christos Exp $ d20 1 a20 1 # keep split search string format similar like in version 5.37 @ 1.1.1.12 log @Import file-5.43+; last was file-5.40 2022-09-20 17:12 Christos Zoulas * fixed various clustefuzz issues 2022-09-19 15:54 Christos Zoulas * Fix error detection for decompression code (Vincent Mihalkovic) 2022-09-15 13:50 Christos Zoulas * Add MAGIC_NO_COMPRESS_FORK and use it to produce a more meaningful error message if we are sandboxing. 2022-09-15 10:45 Christos Zoulas * Add built-in lzip decompression support (Michal Gorny) 2022-09-14 10:35 Christos Zoulas * Add built-in zstd decompression support (Martin Rodriguez Reboredo) 2022-09-13 14:55 Christos Zoulas * release 5.43 2022-09-10 9:17 Christos Zoulas * Add octal indirect magic (Michal Gorny) 2022-08-17 11:43 Christos Zoulas * PR/374: avoid infinite loop in non-wide code (piru) * PR/373: Obey MAGIC_CONTINUE with multiple magic files (vismarli) 2022-07-26 11:10 Christos Zoulas * Fix bug with large flist (Florian Weimer) 2022-07-07 13:21 Christos Zoulas * PR/364: Detect non-nul-terminated core filenames from QEMU (mam-ableton) 2022-07-04 15:45 Christos Zoulas * PR/359: Add support for http://ndjson.org/ (darose) * PR/362: Fix wide printing (ro-ee) * PR/358: Fix width for -f - (jpalus) * PR/356: Fix JSON constant parsing (davewhite) 2022-06-10 9:40 Christos Zoulas * release 5.42 2022-05-31 14:50 Christos Zoulas * PR/348: add missing cases to prevent file from aborting on random magic files. 2022-05-27 21:05 Christos Zoulas * PR/351: octalify filenames when not raw before printing. 2022-04-18 17:51 Christos Zoulas * fix regex cacheing bug (Dirk Mueller) * merge file_regcomp and file_regerror() to simplify the code and reduce memory requirements for storing regexes (Dirk Mueller) 2022-03-19 12:56 Christos Zoulas * cache regex (Dirk Mueller) * detect filesystem full by flushing output (Dirk Mueller) 2021-11-19 12:36 Christos Zoulas * implement running decompressor programs using posix_spawnp(2) instead of vfork(2) 2021-10-24 11:51 Christos Zoulas * Add support for msdos dates and times 2021-10-20 9:55 Christos Zoulas * use the system byte swapping functions if available (Werner Fink) 2021-10-18 11:57 Christos Zoulas * release 5.41 2021-09-23 03:51 Christos Zoulas * Avinash Sonawane: Fix tzname detection 2021-09-03 09:17 Christos Zoulas * Fix relationship tests with "search" magic, don't short circuit logic 2021-07-13 01:06 Christos Zoulas * Fix memory leak in compile mode 2021-07-01 03:51 Christos Zoulas * PR/272: kiefermat: Only set returnval = 1 when we printed something (in all cases print or !print). This simplifies the logic and fixes the issue in the PR with -k and --mime-type there was no continuation printed before the default case. 2021-06-30 13:07 Christos Zoulas * PR/270: Don't translate unprintable characters in %s magic formats when -r * PR/269: Avoid undefined behavior with clang (adding offset to NULL) 2021-05-09 18:38 Christos Zoulas * Add a new flag (f) that requires that the match is a full word, not a partial word match. * Add varint types (unused) 2021-04-19 17:17 Christos Zoulas * PR/256: mutableVoid: If the file is less than 3 bytes, use the file length to determine type * PR/259: aleksandr.v.novichkov: mime printing through indirect magic is not taken into account, use match directly so that it does. 2021-04-04 17:02 Christos Zoulas * count the total bytes found not the total byte positions in order to determine encoding (Anatol Belski) @ text @d3 1 a3 1 # $File: macintosh,v 1.32 2021/04/26 15:56:00 christos Exp $ d144 1 a144 1 #>122 ubeshort x \b, version %#x d167 1 a167 1 >79 ubeshort !0 \b, ID %#x d169 1 a169 1 >81 byte !0 \b, protected %#x d173 1 a173 1 >106 ubyte !0 \b, char. code %#x d175 1 a175 1 >107 ubyte !0 \b, more flags %#x d181 1 a181 1 #>124 ubeshort !0 \b, CRC %#x d207 1 a207 1 >>83 ubelong+128 x \b, at %#x @ 1.1.1.13 log @Update to file-5.45 (Last was file-5.44) 2023-07-27 15:45 Christos Zoulas * release 5.45 2023-07-17 11:53 Christos Zoulas * PR/465: psrok1: Avoid muslc asctime_r crash 2023-05-21 13:05 Christos Zoulas * add SIMH tape format support 2023-02-09 12:50 Christos Zoulas * bump the max size of the elf section notes to be read to 128K and make it configurable 2023-01-08 1:08 Christos Zoulas * PR/415: Fix decompression with program returning empty 2022-12-26 1:47 Christos Zoulas * PR/408: fix -p with seccomp * PR/412: fix MinGW compilation @ text @d3 1 a3 1 # $File: macintosh,v 1.36 2022/12/06 18:45:20 christos Exp $ a97 1 # http://fileformats.archiveteam.org/wiki/MacBinary a98 2 # Note: verified by macutils `macunpack -i -v BBEdit4.0.sit.bin` and # `deark -l -d -m macbinary G3FirmwareUpdate1.1.smi.bin` a116 2 # skip few DEGAS mid-res uncompressed bitmap (GEMINI03.PI2 CODE_RAM.PI2) with "too high" file names ffffff88 ffff4f00 >>>>>>2 ubelong <0xffff0000 d118 3 a120 1 >>>>>>>122 ubeshort 0 d122 2 a123 2 #>>>>>>>>101 ulong 0 >>>>>>>>0 use mac-bin d125 2 a126 2 >>>>>>>122 ubeshort 0x8181 >>>>>>>>0 use mac-bin d128 2 a129 2 >>>>>>122 ubeshort 0x8281 >>>>>>>0 use mac-bin d142 1 a142 1 # THIS SHOULD NEVER HAPPEN! Maybe another file type is misidentified as MacBinary d183 2 a184 4 # few (31/1247) examples (hinkC4.0.sitx.bin InternetExplorer5.1.smi.bin G3FirmwareUpdate1.1.smi.bin Firewire2.3.3.smi.bin LR2image.bin) contain zeroed date fields >91 long !0 >>91 beldate-0x7C25B080 x \b, %s # THIS SHOULD NEVER HAPPEN! Maybe another file type is misidentified or time overflow d186 1 a186 2 # reported date seconds by deark #>91 ubelong x deark-DATE=%u d188 1 a188 2 >95 long !0 >>95 beldate-0x7C25B080 x \b, modified %s a199 1 # like "BBEdit4.0.sit" "Archive.sitx" "MacPGP 2.2 (.sea)" d450 1 a450 1 0 name hfsplus a468 5 0x400 beshort 0x482B Apple HFS Plus >&0 use hfsplus 0x400 beshort 0x4858 Apple HFS Plus Extended >&0 use hfsplus d493 11 @ 1.1.1.1.2.1 log @file macintosh was added on branch jym-xensuspend on 2009-05-13 18:51:57 +0000 @ text @d1 377 @ 1.1.1.1.2.2 log @Sync with HEAD. Second commit. See http://mail-index.netbsd.org/source-changes/2009/05/13/msg221222.html @ text @a0 377 #------------------------------------------------------------------------------ # macintosh description # # BinHex is the Macintosh ASCII-encoded file format (see also "apple") # Daniel Quinlan, quinlan@@yggdrasil.com 11 string must\ be\ converted\ with\ BinHex BinHex binary text !:mime application/mac-binhex40 >41 string x \b, version %.3s # Stuffit archives are the de facto standard of compression for Macintosh # files obtained from most archives. (franklsm@@tuns.ca) 0 string SIT! StuffIt Archive (data) !:mime application/x-stuffit !:apple SIT!SIT! >2 string x : %s 0 string SITD StuffIt Deluxe (data) >2 string x : %s 0 string Seg StuffIt Deluxe Segment (data) >2 string x : %s # Newer StuffIt archives (grant@@netbsd.org) 0 string StuffIt StuffIt Archive !:mime application/x-stuffit !:apple SIT!SIT! #>162 string >0 : %s # Macintosh Applications and Installation binaries (franklsm@@tuns.ca) # GRR: Too weak #0 string APPL Macintosh Application (data) #>2 string x \b: %s # Macintosh System files (franklsm@@tuns.ca) # GRR: Too weak #0 string zsys Macintosh System File (data) #0 string FNDR Macintosh Finder (data) #0 string libr Macintosh Library (data) #>2 string x : %s #0 string shlb Macintosh Shared Library (data) #>2 string x : %s #0 string cdev Macintosh Control Panel (data) #>2 string x : %s #0 string INIT Macintosh Extension (data) #>2 string x : %s #0 string FFIL Macintosh Truetype Font (data) #>2 string x : %s #0 string LWFN Macintosh Postscript Font (data) #>2 string x : %s # Additional Macintosh Files (franklsm@@tuns.ca) # GRR: Too weak #0 string PACT Macintosh Compact Pro Archive (data) #>2 string x : %s #0 string ttro Macintosh TeachText File (data) #>2 string x : %s #0 string TEXT Macintosh TeachText File (data) #>2 string x : %s #0 string PDF Macintosh PDF File (data) #>2 string x : %s # MacBinary format (Eric Fischer, enf@@pobox.com) # # Unfortunately MacBinary doesn't really have a magic number prior # to the MacBinary III format. The checksum is really the way to # do it, but the magic file format isn't up to the challenge. # # 0 byte 0 # 1 byte # filename length # 2 string # filename # 65 string # file type # 69 string # file creator # 73 byte # Finder flags # 74 byte 0 # 75 beshort # vertical posn in window # 77 beshort # horiz posn in window # 79 beshort # window or folder ID # 81 byte # protected? # 82 byte 0 # 83 belong # length of data segment # 87 belong # length of resource segment # 91 belong # file creation date # 95 belong # file modification date # 99 beshort # length of comment after resource # 101 byte # new Finder flags # 102 string mBIN # (only in MacBinary III) # 106 byte # char. code of file name # 107 byte # still more Finder flags # 116 belong # total file length # 120 beshort # length of add'l header # 122 byte 129 # for MacBinary II # 122 byte 130 # for MacBinary III # 123 byte 129 # minimum version that can read fmt # 124 beshort # checksum # # This attempts to use the version numbers as a magic number, requiring # that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second # be 0x81. This works for the files I have, but maybe not for everyone's. # Unfortunately, this magic is quite weak - MPi #122 beshort&0xFCFF 0x8081 Macintosh MacBinary data # MacBinary I doesn't have the version number field at all, but MacBinary II # has been in use since 1987 so I hope there aren't many really old files # floating around that this will miss. The original spec calls for using # the nulls in 0, 74, and 82 as the magic number. # # Another possibility, that would also work for MacBinary I, is to use # the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will # have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, # and that 74 will be 0. So something like # # 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data # # >73 byte&0x01 0x01 \b, inited # >73 byte&0x02 0x02 \b, changed # >73 byte&0x04 0x04 \b, busy # >73 byte&0x08 0x08 \b, bozo # >73 byte&0x10 0x10 \b, system # >73 byte&0x10 0x20 \b, bundle # >73 byte&0x10 0x40 \b, invisible # >73 byte&0x10 0x80 \b, locked #>65 string x \b, type "%4.4s" #>65 string 8BIM (PhotoShop) #>65 string ALB3 (PageMaker 3) #>65 string ALB4 (PageMaker 4) #>65 string ALT3 (PageMaker 3) #>65 string APPL (application) #>65 string AWWP (AppleWorks word processor) #>65 string CIRC (simulated circuit) #>65 string DRWG (MacDraw) #>65 string EPSF (Encapsulated PostScript) #>65 string FFIL (font suitcase) #>65 string FKEY (function key) #>65 string FNDR (Macintosh Finder) #>65 string GIFf (GIF image) #>65 string Gzip (GNU gzip) #>65 string INIT (system extension) #>65 string LIB\ (library) #>65 string LWFN (PostScript font) #>65 string MSBC (Microsoft BASIC) #>65 string PACT (Compact Pro archive) #>65 string PDF\ (Portable Document Format) #>65 string PICT (picture) #>65 string PNTG (MacPaint picture) #>65 string PREF (preferences) #>65 string PROJ (Think C project) #>65 string QPRJ (Think Pascal project) #>65 string SCFL (Defender scores) #>65 string SCRN (startup screen) #>65 string SITD (StuffIt Deluxe) #>65 string SPn3 (SuperPaint) #>65 string STAK (HyperCard stack) #>65 string Seg\ (StuffIt segment) #>65 string TARF (Unix tar archive) #>65 string TEXT (ASCII) #>65 string TIFF (TIFF image) #>65 string TOVF (Eudora table of contents) #>65 string WDBN (Microsoft Word word processor) #>65 string WORD (MacWrite word processor) #>65 string XLS\ (Microsoft Excel) #>65 string ZIVM (compress (.Z)) #>65 string ZSYS (Pre-System 7 system file) #>65 string acf3 (Aldus FreeHand) #>65 string cdev (control panel) #>65 string dfil (Desk Acessory suitcase) #>65 string libr (library) #>65 string nX^d (WriteNow word processor) #>65 string nX^w (WriteNow dictionary) #>65 string rsrc (resource) #>65 string scbk (Scrapbook) #>65 string shlb (shared library) #>65 string ttro (SimpleText read-only) #>65 string zsys (system file) #>69 string x \b, creator "%4.4s" # Somewhere, Apple has a repository of registered Creator IDs. These are # just the ones that I happened to have files from and was able to identify. #>69 string 8BIM (Adobe Photoshop) #>69 string ALD3 (PageMaker 3) #>69 string ALD4 (PageMaker 4) #>69 string ALFA (Alpha editor) #>69 string APLS (Apple Scanner) #>69 string APSC (Apple Scanner) #>69 string BRKL (Brickles) #>69 string BTFT (BitFont) #>69 string CCL2 (Common Lisp 2) #>69 string CCL\ (Common Lisp) #>69 string CDmo (The Talking Moose) #>69 string CPCT (Compact Pro) #>69 string CSOm (Eudora) #>69 string DMOV (Font/DA Mover) #>69 string DSIM (DigSim) #>69 string EDIT (Macintosh Edit) #>69 string ERIK (Macintosh Finder) #>69 string EXTR (self-extracting archive) #>69 string Gzip (GNU gzip) #>69 string KAHL (Think C) #>69 string LWFU (LaserWriter Utility) #>69 string LZIV (compress) #>69 string MACA (MacWrite) #>69 string MACS (Macintosh operating system) #>69 string MAcK (MacKnowledge terminal emulator) #>69 string MLND (Defender) #>69 string MPNT (MacPaint) #>69 string MSBB (Microsoft BASIC (binary)) #>69 string MSWD (Microsoft Word) #>69 string NCSA (NCSA Telnet) #>69 string PJMM (Think Pascal) #>69 string PSAL (Hunt the Wumpus) #>69 string PSI2 (Apple File Exchange) #>69 string R*ch (BBEdit) #>69 string RMKR (Resource Maker) #>69 string RSED (Resource Editor) #>69 string Rich (BBEdit) #>69 string SIT! (StuffIt) #>69 string SPNT (SuperPaint) #>69 string Unix (NeXT Mac filesystem) #>69 string VIM! (Vim editor) #>69 string WILD (HyperCard) #>69 string XCEL (Microsoft Excel) #>69 string aCa2 (Fontographer) #>69 string aca3 (Aldus FreeHand) #>69 string dosa (Macintosh MS-DOS file system) #>69 string movr (Font/DA Mover) #>69 string nX^n (WriteNow) #>69 string pdos (Apple ProDOS file system) #>69 string scbk (Scrapbook) #>69 string ttxt (SimpleText) #>69 string ufox (Foreign File Access) # Just in case... 102 string mBIN MacBinary III data with surprising version number # sas magic from Bruce Foster (bef@@nwu.edu) # #0 string SAS SAS #>8 string x %s 0 string SAS SAS >24 string DATA data file >24 string CATALOG catalog >24 string INDEX data file index >24 string VIEW data view # sas 7+ magic from Reinhold Koch (reinhold.koch@@roche.com) # 0x54 string SAS SAS 7+ >0x9C string DATA data file >0x9C string CATALOG catalog >0x9C string INDEX data file index >0x9C string VIEW data view # spss magic for SPSS system and portable files, # from Bruce Foster (bef@@nwu.edu). 0 long 0xc1e2c3c9 SPSS Portable File >40 string x %s 0 string $FL2 SPSS System File >24 string x %s # Macintosh filesystem data # From "Tom N Harris" # Fixed HFS+ and Partition map magic: Ethan Benson # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these # entries depend on the data arithmetic added after v.35 # There's also some Pascal strings in here, ditto... # The boot block signature, according to IM:Files, is # "for HFS volumes, this field always contains the value 0x4C4B." # But if this is true for MFS or HFS+ volumes, I don't know. # Alternatively, the boot block is supposed to be zeroed if it's # unused, so a simply >0 should suffice. 0x400 beshort 0xD2D7 Macintosh MFS data >0 beshort 0x4C4B (bootable) >0x40a beshort &0x8000 (locked) >0x402 beldate-0x7C25B080 x created: %s, >0x406 beldate-0x7C25B080 >0 last backup: %s, >0x414 belong x block size: %d, >0x412 beshort x number of blocks: %d, >0x424 pstring x volume name: %s # "BD" is has many false positives #0x400 beshort 0x4244 Macintosh HFS data #>0 beshort 0x4C4B (bootable) #>0x40a beshort &0x8000 (locked) #>0x40a beshort ^0x0100 (mounted) #>0x40a beshort &0x0200 (spared blocks) #>0x40a beshort &0x0800 (unclean) #>0x47C beshort 0x482B (Embedded HFS+ Volume) #>0x402 beldate-0x7C25B080 x created: %s, #>0x406 beldate-0x7C25B080 x last modified: %s, #>0x440 beldate-0x7C25B080 >0 last backup: %s, #>0x414 belong x block size: %d, #>0x412 beshort x number of blocks: %d, #>0x424 pstring x volume name: %s 0x400 beshort 0x482B Macintosh HFS Extended >&0 beshort x version %d data >0 beshort 0x4C4B (bootable) >0x404 belong ^0x00000100 (mounted) >&2 belong &0x00000200 (spared blocks) >&2 belong &0x00000800 (unclean) >&2 belong &0x00008000 (locked) >&6 string x last mounted by: '%.4s', # really, that should be treated as a belong and we print a string # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" >&14 beldate-0x7C25B080 x created: %s, # only the creation date is local time, all other timestamps in HFS+ are UTC. >&18 bedate-0x7C25B080 x last modified: %s, >&22 bedate-0x7C25B080 >0 last backup: %s, >&26 bedate-0x7C25B080 >0 last checked: %s, >&38 belong x block size: %d, >&42 belong x number of blocks: %d, >&46 belong x free blocks: %d # I don't think this is really necessary since it doesn't do much and # anything with a valid driver descriptor will also have a valid # partition map #0 beshort 0x4552 Apple Device Driver data #>&24 beshort =1 \b, MacOS # Is that the partition type a cstring or a pstring? Well, IM says "strings # shorter than 32 bytes must be terminated with NULL" so I'll treat it as a # cstring. Of course, partitions can contain more than four entries, but # what're you gonna do? # GRR: This magic is too weak, it is just "PM" #0x200 beshort 0x504D Apple Partition data #>0x2 beshort x (block size: %d): #>0x230 string x first type: %s, #>0x210 string x name: %s, #>0x254 belong x number of blocks: %d, #>0x400 beshort 0x504D #>>0x430 string x second type: %s, #>>0x410 string x name: %s, #>>0x454 belong x number of blocks: %d, #>>0x600 beshort 0x504D #>>>0x630 string x third type: %s, #>>>0x610 string x name: %s, #>>>0x654 belong x number of blocks: %d, #>>0x800 beshort 0x504D #>>>0x830 string x fourth type: %s, #>>>0x810 string x name: %s, #>>>0x854 belong x number of blocks: %d, #>>>0xa00 beshort 0x504D #>>>>0xa30 string x fifth type: %s, #>>>>0xa10 string x name: %s, #>>>>0xa54 belong x number of blocks: %d #>>>0xc00 beshort 0x504D #>>>>0xc30 string x sixth type: %s, #>>>>0xc10 string x name: %s, #>>>>0xc54 belong x number of blocks: %d ## AFAIK, only the signature is different #0x200 beshort 0x5453 Apple Old Partition data #>0x2 beshort x block size: %d, #>0x230 string x first type: %s, #>0x210 string x name: %s, #>0x254 belong x number of blocks: %d, #>0x400 beshort 0x504D #>>0x430 string x second type: %s, #>>0x410 string x name: %s, #>>0x454 belong x number of blocks: %d, #>>0x800 beshort 0x504D #>>>0x830 string x third type: %s, #>>>0x810 string x name: %s, #>>>0x854 belong x number of blocks: %d, #>>>0xa00 beshort 0x504D #>>>>0xa30 string x fourth type: %s, #>>>>0xa10 string x name: %s, #>>>>0xa54 belong x number of blocks: %d # From: Remi Mommsen 0 string BOMStore Mac OS X bill of materials (BOM) file @