head 1.12; access; symbols netbsd-11-0-RC4:1.12 netbsd-11-0-RC3:1.12 netbsd-11-0-RC2:1.12 netbsd-11-0-RC1:1.12 perseant-exfatfs-base-20250801:1.12 netbsd-11:1.12.0.4 netbsd-11-base:1.12 netbsd-10-1-RELEASE:1.11 perseant-exfatfs-base-20240630:1.12 perseant-exfatfs:1.12.0.2 perseant-exfatfs-base:1.12 netbsd-8-3-RELEASE:1.7 netbsd-9-4-RELEASE:1.9 netbsd-10-0-RELEASE:1.11 netbsd-10-0-RC6:1.11 netbsd-10-0-RC5:1.11 netbsd-10-0-RC4:1.11 netbsd-10-0-RC3:1.11 netbsd-10-0-RC2:1.11 netbsd-10-0-RC1:1.11 FILE5_45:1.1.1.12 netbsd-10:1.11.0.2 netbsd-10-base:1.11 FILE5_43:1.1.1.11 netbsd-9-3-RELEASE:1.9 cjep_sun2x-base1:1.10 cjep_sun2x:1.10.0.6 cjep_sun2x-base:1.10 cjep_staticlib_x-base1:1.10 netbsd-9-2-RELEASE:1.9 cjep_staticlib_x:1.10.0.4 cjep_staticlib_x-base:1.10 FILE5_40:1.1.1.10 netbsd-9-1-RELEASE:1.9 FILE5_39:1.1.1.10 phil-wifi-20200421:1.10 phil-wifi-20200411:1.10 is-mlppp:1.10.0.2 is-mlppp-base:1.10 phil-wifi-20200406:1.10 netbsd-8-2-RELEASE:1.7 netbsd-9-0-RELEASE:1.9 netbsd-9-0-RC2:1.9 FILE5_38:1.1.1.10 netbsd-9-0-RC1:1.9 phil-wifi-20191119:1.9 netbsd-9:1.9.0.2 netbsd-9-base:1.9 phil-wifi-20190609:1.9 netbsd-8-1-RELEASE:1.7 FILE5_37:1.1.1.9 netbsd-8-1-RC1:1.7 pgoyette-compat-merge-20190127:1.7.8.1 pgoyette-compat-20190127:1.8 pgoyette-compat-20190118:1.8 pgoyette-compat-1226:1.8 pgoyette-compat-1126:1.8 pgoyette-compat-1020:1.8 FILE5_35:1.1.1.8 pgoyette-compat-0930:1.8 pgoyette-compat-0906:1.8 netbsd-7-2-RELEASE:1.5 pgoyette-compat-0728:1.8 netbsd-8-0-RELEASE:1.7 phil-wifi:1.8.0.2 phil-wifi-base:1.8 pgoyette-compat-0625:1.8 netbsd-8-0-RC2:1.7 pgoyette-compat-0521:1.8 pgoyette-compat-0502:1.8 pgoyette-compat-0422:1.8 netbsd-8-0-RC1:1.7 FILE5_33:1.1.1.8 pgoyette-compat-0415:1.7 pgoyette-compat-0407:1.7 pgoyette-compat-0330:1.7 pgoyette-compat-0322:1.7 pgoyette-compat-0315:1.7 netbsd-7-1-2-RELEASE:1.5 pgoyette-compat:1.7.0.8 pgoyette-compat-base:1.7 netbsd-7-1-1-RELEASE:1.5 matt-nb8-mediatek:1.7.0.6 matt-nb8-mediatek-base:1.7 FILE5_32:1.1.1.7 perseant-stdc-iso10646:1.7.0.4 perseant-stdc-iso10646-base:1.7 netbsd-8:1.7.0.2 netbsd-8-base:1.7 FILE5_31:1.1.1.7 prg-localcount2-base3:1.6 prg-localcount2-base2:1.6 prg-localcount2-base1:1.6 prg-localcount2:1.6.0.2 prg-localcount2-base:1.6 pgoyette-localcount-20170426:1.6 bouyer-socketcan-base1:1.6 pgoyette-localcount-20170320:1.6 netbsd-7-1:1.5.0.12 netbsd-7-1-RELEASE:1.5 netbsd-7-1-RC2:1.5 FILE5_30:1.1.1.6 netbsd-7-nhusb-base-20170116:1.5 bouyer-socketcan:1.5.0.10 bouyer-socketcan-base:1.5 pgoyette-localcount-20170107:1.5 netbsd-7-1-RC1:1.5 pgoyette-localcount-20161104:1.5 netbsd-7-0-2-RELEASE:1.5 localcount-20160914:1.5 netbsd-7-nhusb:1.5.0.8 netbsd-7-nhusb-base:1.5 pgoyette-localcount-20160806:1.5 pgoyette-localcount-20160726:1.5 pgoyette-localcount:1.5.0.6 pgoyette-localcount-base:1.5 netbsd-7-0-1-RELEASE:1.5 netbsd-7-0:1.5.0.4 netbsd-7-0-RELEASE:1.5 netbsd-7-0-RC3:1.5 netbsd-7-0-RC2:1.5 netbsd-7-0-RC1:1.5 FILE5_22:1.1.1.5 FILE5_20:1.1.1.5 netbsd-6-0-6-RELEASE:1.1.1.2 netbsd-6-1-5-RELEASE:1.1.1.2 netbsd-7:1.5.0.2 netbsd-7-base:1.5 FILE5_19:1.1.1.5 yamt-pagecache-base9:1.4 yamt-pagecache-tag8:1.1.1.2.4.2 netbsd-6-1-4-RELEASE:1.1.1.2 netbsd-6-0-5-RELEASE:1.1.1.2 tls-earlyentropy:1.4.0.8 tls-earlyentropy-base:1.5 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.4 riastradh-drm2-base3:1.4 netbsd-6-1-3-RELEASE:1.1.1.2 netbsd-6-0-4-RELEASE:1.1.1.2 FILE5_16:1.1.1.4 netbsd-6-1-2-RELEASE:1.1.1.2 netbsd-6-0-3-RELEASE:1.1.1.2 netbsd-6-1-1-RELEASE:1.1.1.2 riastradh-drm2-base2:1.4 riastradh-drm2-base1:1.4 riastradh-drm2:1.4.0.6 riastradh-drm2-base:1.4 netbsd-6-1:1.1.1.2.0.12 netbsd-6-0-2-RELEASE:1.1.1.2 netbsd-6-1-RELEASE:1.1.1.2 khorben-n900:1.4.0.4 netbsd-6-1-RC4:1.1.1.2 netbsd-6-1-RC3:1.1.1.2 agc-symver:1.4.0.2 agc-symver-base:1.4 FILE5_14:1.1.1.4 netbsd-6-1-RC2:1.1.1.2 netbsd-6-1-RC1:1.1.1.2 yamt-pagecache-base8:1.3 FILE_5_12:1.1.1.3 netbsd-6-0-1-RELEASE:1.1.1.2 yamt-pagecache-base7:1.2 matt-nb6-plus-nbase:1.1.1.2 yamt-pagecache-base6:1.2 netbsd-6-0:1.1.1.2.0.10 netbsd-6-0-RELEASE:1.1.1.2 netbsd-6-0-RC2:1.1.1.2 tls-maxphys:1.2.0.2 tls-maxphys-base:1.5 matt-nb6-plus:1.1.1.2.0.8 matt-nb6-plus-base:1.1.1.2 netbsd-6-0-RC1:1.1.1.2 yamt-pagecache-base5:1.2 yamt-pagecache-base4:1.2 FILE5_11:1.1.1.2 netbsd-6:1.1.1.2.0.6 netbsd-6-base:1.1.1.2 yamt-pagecache-base3:1.1.1.2 yamt-pagecache-base2:1.1.1.2 yamt-pagecache:1.1.1.2.0.4 yamt-pagecache-base:1.1.1.2 FILE5_09:1.1.1.2 cherry-xenmp:1.1.1.2.0.2 cherry-xenmp-base:1.1.1.2 FILE5_07:1.1.1.2 bouyer-quota2-nbase:1.1.1.1 bouyer-quota2:1.1.1.1.0.4 bouyer-quota2-base:1.1.1.1 matt-mips64-premerge-20101231:1.1.1.1 matt-premerge-20091211:1.1.1.1 jym-xensuspend-base:1.1.1.1 jym-xensuspend:1.1.1.1.0.2 jym-xensuspend-nbase:1.1.1.1 FILE5_03:1.1.1.1 CHRISTOS:1.1.1; locks; strict; comment @# @; 1.12 date 2023.08.18.19.00.10; author christos; state Exp; branches; next 1.11; commitid MBLVQLzqzmQ7IiBE; 1.11 date 2022.09.24.20.21.46; author christos; state Exp; branches; next 1.10; commitid zJ5LoIcubBSIH9VD; 1.10 date 2019.12.17.02.31.05; author christos; state Exp; branches; next 1.9; commitid T4BTFY7rQ43kj0PB; 1.9 date 2019.05.22.17.26.05; author christos; state Exp; branches; next 1.8; commitid GumkPZ4rDiPTYdoB; 1.8 date 2018.04.15.19.45.32; author christos; state Exp; branches 1.8.2.1; next 1.7; commitid PISTUVsbDjqSFzyA; 1.7 date 2017.05.25.00.11.26; author christos; state Exp; branches 1.7.8.1; next 1.6; commitid FQJOXzdL3jIJCHSz; 1.6 date 2017.02.10.17.53.24; author christos; state Exp; branches; next 1.5; commitid bl2PZy94aycnQqFz; 1.5 date 2014.06.13.02.08.06; author christos; state Exp; branches 1.5.6.1 1.5.10.1; next 1.4; commitid 4S2W0uH1Gw96TiEx; 1.4 date 2013.03.23.16.15.58; author christos; state Exp; branches 1.4.8.1; next 1.3; 1.3 date 2013.01.03.23.05.37; author christos; state Exp; branches; next 1.2; 1.2 date 2012.04.07.17.30.55; author christos; state Exp; branches 1.2.2.1; next 1.1; 1.1 date 2009.05.08.16.35.07; author christos; state Exp; branches 1.1.1.1; next ; 1.8.2.1 date 2019.06.10.21.44.46; author christos; state Exp; branches; next 1.8.2.2; commitid jtc8rnCzWiEEHGqB; 1.8.2.2 date 2020.04.08.14.04.04; author martin; state Exp; branches; next ; commitid Qli2aW9E74UFuA3C; 1.7.8.1 date 2018.04.22.07.20.08; author pgoyette; state Exp; branches; next ; commitid W6xykws0Zbl4kpzA; 1.5.6.1 date 2017.03.20.06.52.19; author pgoyette; state Exp; branches; next ; commitid jjw7cAwgyKq7RfKz; 1.5.10.1 date 2017.04.21.16.51.23; author bouyer; state Exp; branches; next ; commitid dUG7nkTKALCadqOz; 1.4.8.1 date 2014.08.10.07.07.10; author tls; state Exp; branches; next ; commitid b1wUlsZGswrdGMLx; 1.2.2.1 date 2013.02.25.00.26.05; author tls; state Exp; branches; next 1.2.2.2; 1.2.2.2 date 2013.06.23.06.26.32; author tls; state Exp; branches; next 1.2.2.3; commitid OnlO1cBgtQRcIHUw; 1.2.2.3 date 2014.08.19.23.46.47; author tls; state Exp; branches; next ; commitid jTnpym9Qu0o4R1Nx; 1.1.1.1 date 2009.05.08.16.35.07; author christos; state Exp; branches 1.1.1.1.2.1; next 1.1.1.2; 1.1.1.2 date 2011.05.12.20.46.57; author christos; state Exp; branches 1.1.1.2.4.1; next 1.1.1.3; 1.1.1.3 date 2013.01.03.16.27.53; author christos; state Exp; branches; next 1.1.1.4; 1.1.1.4 date 2013.03.23.15.49.16; author christos; state Exp; branches; next 1.1.1.5; 1.1.1.5 date 2014.06.13.01.48.23; author christos; state Exp; branches; next 1.1.1.6; commitid jtTYsE5FmJU6MiEx; 1.1.1.6 date 2017.02.10.17.42.57; author christos; state Exp; branches; next 1.1.1.7; commitid HAP3kn9Hn6ovMqFz; 1.1.1.7 date 2017.05.24.23.59.57; author christos; state Exp; branches; next 1.1.1.8; commitid WbyOU2LBE5qOyHSz; 1.1.1.8 date 2018.04.15.19.32.47; author christos; state Exp; branches; next 1.1.1.9; commitid unKSwpX2g9VqBzyA; 1.1.1.9 date 2019.05.22.17.19.57; author christos; state Exp; branches; next 1.1.1.10; commitid VXeNRYYruN1MWdoB; 1.1.1.10 date 2019.12.17.02.23.53; author christos; state Exp; branches; next 1.1.1.11; commitid vqYTz60fS9PNg0PB; 1.1.1.11 date 2022.09.24.20.07.53; author christos; state Exp; branches; next 1.1.1.12; commitid Nf6F9kcpc0EPC9VD; 1.1.1.12 date 2023.08.18.18.36.50; author christos; state Exp; branches; next ; commitid IX26ghc1E2S0AiBE; 1.1.1.1.2.1 date 2009.05.08.16.35.07; author jym; state dead; branches; next 1.1.1.1.2.2; 1.1.1.1.2.2 date 2009.05.13.18.51.54; author jym; state Exp; branches; next ; 1.1.1.2.4.1 date 2012.04.17.00.03.08; author yamt; state Exp; branches; next 1.1.1.2.4.2; 1.1.1.2.4.2 date 2013.01.23.00.04.34; author yamt; state Exp; branches; next 1.1.1.2.4.3; 1.1.1.2.4.3 date 2014.05.22.15.44.59; author yamt; state Exp; branches; next ; commitid tYJXbWAuFvTh7yBx; desc @@ 1.12 log @merge conflicts between file-5.43 and file-5.45 @ text @ #------------------------------------------------------------------------------ # $File: apple,v 1.48 2023/05/01 14:20:21 christos Exp $ # apple: file(1) magic for Apple file formats # 0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 0 string \x0aGL Binary II (apple ][) data 0 string \x76\xff Squeezed (apple ][) data 0 string NuFile NuFile archive (apple ][) data 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 0 belong 0x00051600 AppleSingle encoded Macintosh file 0 belong 0x00051607 AppleDouble encoded Macintosh file # Type: Apple Emulator A2R format # From: Greg Wildman # Ref: https://applesaucefdc.com/a2r2-reference/ # Ref: https://applesaucefdc.com/a2r/ 0 string A2R >3 string \x31\xFF\x0A\x0D\x0A Applesauce A2R 1.x Disk Image >3 string \x32\xFF\x0A\x0D\x0A Applesauce A2R 2.x Disk Image >3 string \x33\xFF\x0A\x0D\x0A Applesauce A2R 3.x Disk Image >8 string INFO >>49 byte 01 \b, 5.25″ SS 40trk >>49 byte 02 \b, 3.5″ DS 80trk >>49 byte 03 \b, 5.25″ DS 80trk >>49 byte 04 \b, 5.25″ DS 40trk >>49 byte 05 \b, 3.5″ DS 80trk >>49 byte 06 \b, 8″ DS >>50 byte 01 \b, write protected >>51 byte 01 \b, cross track synchronized >>17 string/T x \b, %.32s # Type: Apple Emulator WOZ format # From: Greg Wildman # Ref: https://applesaucefdc.com/woz/reference/ # Ref: https://applesaucefdc.com/woz/reference2/ 0 string WOZ >3 string \x31\xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image >3 string \x32\xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image >12 string INFO >>21 byte 01 \b, 5.25 inch >>21 byte 02 \b, 3.5 inch >>22 byte 01 \b, write protected >>23 byte 01 \b, cross track synchronized >>25 string/T x \b, %.32s # Type: Apple Macintosh Emulator MOOF format # From: Greg Wildman # Ref: https://applesaucefdc.com/moof-reference/ 0 string MOOF >4 string \xFF\x0A\x0D\x0A Apple Macintosh MOOF Disk Image >12 string INFO >>21 byte 01 \b, SSDD GCR (400K) >>21 byte 02 \b, DSDD GCR (800K) >>21 byte 03 \b, DSHD MFM (1.44M) >>22 byte 01 \b, write protected >>23 byte 01 \b, cross track synchronized >>25 string/T x \b, %.32s # Type: Apple Emulator disk images # From: Greg Wildman # ProDOS boot loader? 0 string \x01\x38\xB0\x03\x4C Apple ProDOS Image # Detect Volume Directory block ($02) >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks # ProDOS ordered ? >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks # # Proboot HD 0 string \x01\x8A\x48\xD8\x2C\x82\xC0\x8D\x0E\xC0\x8D\x0C Apple ProDOS ProBoot Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks 0 string \x01\xA8\x8A\x20\x7B\xF8\x29\x07\x09\xC0\x99\x30 Apple ProDOS ProBoot Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks 0 string \x01\x4A\xD0\x34\xE6\x3D\x8A\x20\x7B\xF8\x09\xC0 Apple ProDOS ProBoot Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks # # ProDOS formatted 0 string \x01\xBD\x88\xC0\x20\x2F\xFB\x20\x58\xFC\x20\x40 Apple ProDOS Unbootable Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks 0 string \x01\x38\xB0\x03\x4C\x1C\x09\x78\x86\x43\xC9\x03 Apple ProDOS Unbootable Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks # # DOS3 boot loader 0 string \x01\xA5\x27\xC9\x09\xD0 >0x11001 byte 0x11 >>0x11003 ubyte x Apple DOS 3.%u Image >>0x11006 ubyte x \b, Volume #%03u >>0x11034 ubyte x \b, %u Tracks >>0x11035 ubyte x \b, %u Sectors >>0x11036 uleshort x \b, %u bytes per sector # # DOS3 uninitialized disk 0 string \x01\xA6\x2B\xBD\x88\xC0\x8A\x4A\x4A >0x11001 byte 0x11 >>0x11003 ubyte x Apple DOS 3.%u Unbootable Image >>>0x11006 ubyte x \b, Volume #%03u >>>0x11034 ubyte x \b, %u Tracks >>>0x11035 ubyte x \b, %u Sectors >>>0x11036 uleshort x \b, %u bytes per sector # # Pascal boot loader? 0 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD >0xd6 pstring SYSTEM.APPLE >>0xb00 leshort 0x0000 >>>0xb04 leshort 0x0000 Apple Pascal Image >>>>0xb06 pstring x \b, Volume %s: >>>>0xb0e leshort x \b, %u Blocks >>>>0xb10 leshort x \b, %u Files # # Diversi Dos boot loader? 0 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD >0x11001 string \x11\x0F\x03 Apple Diversi Dos Image >>0x11006 byte x \b, Volume %u >>0x11034 byte x \b, %u Tracks >>0x11035 byte x \b, %u Sectors >>0x11036 leshort x \b, %u bytes per sector # Type: Apple Emulator 2IMG format # From: Radek Vokal # Update: Greg Wildman 0 string 2IMG Apple ][ 2IMG Disk Image >4 clear x >4 string XGS! \b, XGS >4 string CTKG \b, Catakig >4 string ShIm \b, Sheppy's ImageMaker >4 string SHEP \b, Sheppy's ImageMaker >4 string WOOF \b, Sweet 16 >4 string B2TR \b, Bernie ][ the Rescue >4 string \!nfc \b, ASIMOV2 >4 string \>BD\< \b, Brutal Deluxe's Cadius >4 string CdrP \b, CiderPress >4 string Vi][ \b, Virtual ][ >4 string PRFS \b, ProFUSE >4 string FISH \b, FishWings >4 string RVLW \b, Revival for Windows >4 default x >>4 string x \b, Creator tag "%-4.4s" >0xc byte 00 \b, DOS 3.3 sector order >>0x10 byte 00 \b, Volume 254 >>0x10 byte&0x7f x \b, Volume %u >0xc byte 01 \b, ProDOS sector order # Detect Volume Directory block ($02) + 2mg header offset >>0x440 string \x00\x00\x03\x00 >>>0x444 byte &0xF0 >>>>0x445 string x \b, Volume /%s >>>>0x469 uleshort x \b, %u Blocks >0xc byte 02 \b, NIB data # Type: Peter Ferrie QBoot # From: Greg Wildman # Ref: https://github.com/peterferrie/qboot 0 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9 >8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ QBoot Image # Type: Peter Ferrie 0Boot # From: Greg Wildman # Ref: https://github.com/peterferrie/0boot 0 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9 >8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ 0Boot Image # Different proprietary boot sectors 0 string \x01\x0F\x21\x74\x00\x01\x6B\x00\x02\x30\x81\x5D Apple ][ Disk Image 0 string \x01\x20\x58\xFC\xA2\x00\x8E\x78\x04\x8E\xF4\x03 Apple ][ Disk Image 0 string \x01\x20\x58\xFC\xAD\x51\xC0\xAD\x54\xC0\xA6\x2B Apple ][ Disk Image 0 string \x01\x20\x89\xFE\x20\x93\xFE\xA6\x2B\xBD\x88\xC0 Apple ][ Disk Image 0 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x25\x08\x68\x85 Apple ][ Disk Image 0 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x2D\x08\x68\x85 Apple ][ Disk Image 0 string \x01\x38\x90\x2A\xC9\x01\xF0\x33\xA8\xC8\xC0\x10 Apple ][ Disk Image 0 string \x01\x38\xB0\x03\x4C\x32\xA1\x87\x43\xC9\x03\x08 Apple ][ Disk Image 0 string \x01\x4C\x04\x08\xA9\x2A\x8D\x02\x08\x86\x2B\xEE Apple ][ Disk Image 0 string \x01\x4C\x60\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image 0 string \x01\x4C\x92\x08\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image 0 string \x01\x4C\xB3\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image 0 string \x01\x8D\xFB\x03\x8E\xFC\x03\x8C\xFD\x03\x8A\x29 Apple ][ Disk Image 0 string \x01\xA2\xFF\x9A\xD8\x20\x20\x08\x20\x34\x08\xAD Apple ][ Disk Image 0 string \x01\xA5\x27\xBD\x88\xC0\x2C\x10\xC0\xA2\x00\xA9 Apple ][ Disk Image 0 string \x01\xA5\x2B\xAE\x51\xC0\xEA\xAA\xBD\x88\xC0\x20 Apple ][ Disk Image 0 string \x01\xA6\x27\xBD\x0B\x08\x48\xBD\x0A\x08\x48\x85 Apple ][ Disk Image 0 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x01\x85 Apple ][ Disk Image 0 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x25\x85 Apple ][ Disk Image 0 string \x01\xA8\xC0\x0F\x90\x16\xF0\x12\xA0\xFF\x18\xAD Apple ][ Disk Image 0 string \x01\xA9\x00\x85\xF0\xA9\x04\x85\xF1\xA0\x00\xA9 Apple ][ Disk Image 0 string \x01\xA9\x5C\x8D\xF2\x03\xA9\xC6\x8D\xF3\x03\x49 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\x20\x2F\xFB\x20\x58\xFC Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\x20\x49\x08\xA9\x0A\x85 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\x2C\x82\xC0\xBD\x88\xC0 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\x86\x43\x8A\x4A\x4A\x4A Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\x86\xFF\xB5\x00 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\xA9\xB2\x8D\xF2\x03\xA9 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\xA9\xFF\x8D\xF3\x03\x8D Apple ][ Disk Image 0 string \x01\xAC\x00\x08\xF0\x19\xB9\x30\x08\x85\x3D\xCE Apple ][ Disk Image 0 string \x01\xAC\x23\x08\x30\x2E\xB9\x24\x08\x85\x3D\xCE Apple ][ Disk Image 0 string \x01\xAD\x00\x08\xC9\x09\xB0\x20\x69\x02\x8D\x00 Apple ][ Disk Image 0 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\x86\x2B\x8A\x4A Apple ][ Disk Image 0 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\xA9\xF5\x8D\xF2 Apple ][ Disk Image 0 string \x01\xB0\x00\xA9\x3F\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image 0 string \x01\xB0\x00\xA9\x48\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image 0 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x09\xC0\x8D Apple ][ Disk Image 0 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x8D\x2F\x08 Apple ][ Disk Image 0 string \x01\xD8\x2C\x81\xC0\xA9\x60\x4D\x58\xFF\xD0\xFE Apple ][ Disk Image 0 string \x01\xD8\x78\xBD\x88\xC0\xA9\xFD\x85\x37\x85\x39 Apple ][ Disk Image 0 string \x01\xE0\x60\xF0\x03\x4C\x16\x09\xAD\x00\x08\xC9 Apple ][ Disk Image 0 string \x01\xE0\x60\xF0\x03\x4C\xCB\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 0 string \x01\xE0\x60\xF0\x03\x4C\xEE\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 0 string \x01\xE0\x60\xF0\x03\x4C\xEF\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 0 string \x01\xE0\x70\xB0\x04\xE0\x40\xB0\x39\xBD\x88\xC0 Apple ][ Disk Image 0 string \x01\xEA\x8D\xF4\x03\xA9\x60\x9D\x88\xC0\x8D\x51 Apple ][ Disk Image # magic for Newton PDA package formats # from Ruda Moura 0 string package0 Newton package, NOS 1.x, >12 belong &0x80000000 AutoRemove, >12 belong &0x40000000 CopyProtect, >12 belong &0x10000000 NoCompression, >12 belong &0x04000000 Relocation, >12 belong &0x02000000 UseFasterCompression, >16 belong x version %d 0 string package1 Newton package, NOS 2.x, >12 belong &0x80000000 AutoRemove, >12 belong &0x40000000 CopyProtect, >12 belong &0x10000000 NoCompression, >12 belong &0x04000000 Relocation, >12 belong &0x02000000 UseFasterCompression, >16 belong x version %d 0 string package4 Newton package, >8 byte 8 NOS 1.x, >8 byte 9 NOS 2.x, >12 belong &0x80000000 AutoRemove, >12 belong &0x40000000 CopyProtect, >12 belong &0x10000000 NoCompression, # The following entries for the Apple II are for files that have # been transferred as raw binary data from an Apple, without having # been encapsulated by any of the above archivers. # # In general, Apple II formats are hard to identify because Apple DOS # and especially Apple ProDOS have strong typing in the file system and # therefore programmers never felt much need to include type information # in the files themselves. # # Eric Fischer # AppleWorks word processor: # URL: https://en.wikipedia.org/wiki/AppleWorks # Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx # Update: Joerg Jenderek # NOTE: # The "O" is really the magic number, but that's so common that it's # necessary to check the tab stops that follow it to avoid false positives. # and/or look for unused bits of booleans bytes like zoom, paginated, mail merge # the newer AppleWorks is from claris with extension CWK 4 string O # test for unused bits of zoom- , paginated-boolean bytes >84 ubequad ^0x00Fe00000000Fe00 # look for tabstop definitions "=" no tab, "|" no tab # "<" left tab,"^" center tab,">" right tab, "." decimal tab, # unofficial "!" other , "\x8a" other # official only if SFMinVers is nonzero >>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor # AppleWorks Word Processor File (Apple II) # ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" # application/x-appleworks is mime type for claris version with cwk extension !:mime application/x-appleworks3 # http://home.earthlink.net/~hughhood/appleiiworksenvoy/ # ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') # $70 $1A $F8 $FF is this the apple type ? #:apple pdosp^Z\xf8\xff !:ext awp # minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) >>>183 ubyte 30 3.0 >>>183 ubyte !30 >>>>183 ubyte !0 %#x # usual tabstop start sequence "=====<" >>>5 string x \b, tabstop ruler "%6.6s" # tabstop ruler #>>>5 string >\0 \b, tabstops "%-79s" # zoom switch >>>85 byte&0x01 >0 \b, zoomed # whether paginated >>>90 byte&0x01 >0 \b, paginated # contains any mail-merge commands >>>92 byte&0x01 >0 \b, with mail merge # left margin in 1/10 inches ( normally 0 or 10 ) >>>91 ubyte >0 >>>>91 ubyte x \b, %d/10 inch left margin # AppleWorks database: # # This isn't really a magic number, but it's the closest thing to one # that I could find. The 1 and 2 really mean "order in which you defined # categories" and "left to right, top to bottom," respectively; the D and R # mean that the cursor should move either down or right when you press Return. #30 string \x01D AppleWorks database data #30 string \x02D AppleWorks database data #30 string \x01R AppleWorks database data #30 string \x02R AppleWorks database data # AppleWorks spreadsheet: # # Likewise, this isn't really meant as a magic number. The R or C means # row- or column-order recalculation; the A or M means automatic or manual # recalculation. #131 string RA AppleWorks spreadsheet data #131 string RM AppleWorks spreadsheet data #131 string CA AppleWorks spreadsheet data #131 string CM AppleWorks spreadsheet data # Applesoft BASIC: # # This is incredibly sloppy, but will be true if the program was # written at its usual memory location of 2048 and its first line # number is less than 256. Yuck. # update by Joerg Jenderek at Feb 2013 # GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) #0 belong&0xff00ff 0x80000 Applesoft BASIC program data 0 belong&0x00ff00ff 0x00080000 # assuming that line number must be positive >2 leshort >0 Applesoft BASIC program data, first line number %d #>2 leshort x \b, first line number %d # ORCA/EZ assembler: # # This will not identify ORCA/M source files, since those have # some sort of date code instead of the two zero bytes at 6 and 7 # XXX Conflicts with ELF #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data #>5 byte x \b, build number %d # Broderbund Fantavision # # I don't know what these values really mean, but they seem to recur. # Will they cause too many conflicts? # Probably :-) #2 belong&0xFF00FF 0x040008 Fantavision movie data # Some attempts at images. # # These are actually just bit-for-bit dumps of the frame buffer, so # there's really no reasonably way to distinguish them except for their # address (if preserved) -- 8192 or 16384 -- and their length -- 8192 # or, occasionally, 8184. # # Nevertheless this will manage to catch a lot of images that happen # to have a solid-colored line at the bottom of the screen. # GRR: Magic too weak #8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background #8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background #8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background #8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background #8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background # Beagle Bros. Apple Mechanic fonts 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font # Apple Universal Disk Image Format (UDIF) - dmg files. # From Johan Gade. # These entries are disabled for now until we fix the following issues. # # Note there might be some problems with the "VAX COFF executable" # entry. Note this entry should be placed before the mac filesystem section, # particularly the "Apple Partition data" entry. # # The intended meaning of these tests is, that the file is only of the # specified type if both of the lines are correct - i.e. if the first # line matches and the second doesn't then it is not of that type. # #0 long 0x7801730d #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) # # Note that this entry is recognized correctly by the "Apple Partition # data" entry - however since this entry is more specific - this # information seems to be more useful. #0 long 0x45520200 #>0x410 string disk\ image UDIF read/write image (UDRW) # From: Toby Peterson # From https://www.nationalarchives.gov.uk/pronom/fmt/866 0 string bplist00 >8 search/500 WebMainResource Apple Safari Webarchive !:mime application/x-webarchive !:strength +50 0 string bplist00 Apple binary property list !:mime application/x-bplist # Apple binary property list (bplist) # Assumes version bytes are hex. # Provides content hints for version 0 files. Assumes that the root # object is the first object (true for CoreFoundation implementation). # From: David Remahl 0 string bplist >6 byte x \bCoreFoundation binary property list data, version %#c >>7 byte x \b%c >6 string 00 \b >>8 byte&0xF0 0x00 \b >>>8 byte&0x0F 0x00 \b, root type: null >>>8 byte&0x0F 0x08 \b, root type: false boolean >>>8 byte&0x0F 0x09 \b, root type: true boolean >>8 byte&0xF0 0x10 \b, root type: integer >>8 byte&0xF0 0x20 \b, root type: real >>8 byte&0xF0 0x30 \b, root type: date >>8 byte&0xF0 0x40 \b, root type: data >>8 byte&0xF0 0x50 \b, root type: ascii string >>8 byte&0xF0 0x60 \b, root type: unicode string >>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) >>8 byte&0xF0 0xa0 \b, root type: array >>8 byte&0xF0 0xd0 \b, root type: dictionary # Apple/NeXT typedstream data # Serialization format used by NeXT and Apple for various # purposes in YellowStep/Cocoa, including some nib files. # From: David Remahl 2 string typedstream NeXT/Apple typedstream data, big endian >0 byte x \b, version %d >0 byte <5 \b >>13 byte 0x81 \b >>>14 ubeshort x \b, system %d 2 string streamtyped NeXT/Apple typedstream data, little endian >0 byte x \b, version %d >0 byte <5 \b >>13 byte 0x81 \b >>>14 uleshort x \b, system %d #------------------------------------------------------------------------------ # CAF: Apple CoreAudio File Format # # Container format for high-end audio purposes. # From: David Remahl # 0 string caff CoreAudio Format audio file >4 beshort <10 version %d >6 beshort x #------------------------------------------------------------------------------ # Keychain database files 0 string kych Mac OS X Keychain File #------------------------------------------------------------------------------ # Code Signing related file types 0 belong 0xfade0c00 Mac OS X Code Requirement >8 belong 1 (opExpr) >4 belong x - %d bytes 0 belong 0xfade0c01 Mac OS X Code Requirement Set >8 belong >1 containing %d items >4 belong x - %d bytes 0 belong 0xfade0c02 Mac OS X Code Directory >8 belong x version %x >12 belong >0 flags %#x >4 belong x - %d bytes 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) >4 belong x - %d bytes 0 belong 0xfade0cc1 Mac OS X Detached Code Signature >8 belong >1 (%d elements) >4 belong x - %d bytes # From: "Nelson A. de Oliveira" # .vdi 4 string innotek\ VirtualBox\ Disk\ Image %s # Apple disk partition stuff # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map # Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h # Update: Joerg Jenderek # "ER" is APPLE_DRVR_MAP_MAGIC signature 0 beshort 0x4552 # display Apple Driver Map (strength=50) after Syslinux bootloader (71) #!:strength +0 # strengthen the magic by looking for used blocksizes 512 2048 >2 ubeshort&0xf1FF 0 Apple Driver Map # last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid #>>504 ubequad&0x0000FFffFFff0000 0 !:mime application/x-apple-diskimage !:apple ????devr # https://en.wikipedia.org/wiki/Apple_Disk_Image !:ext dmg/iso # sbBlkSize for driver descriptor map 512 2048 >>2 beshort x \b, blocksize %d # sbBlkCount sometimes garbish like # 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg # 0xf2720100 for bunziped Firefox 48.0-2.dmg # 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso # 0x00009090 by syslinux-6.03/utils/isohybrid.c >>4 ubelong x \b, blockcount %u # following device/driver information not very useful # device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>8 ubeshort x \b, devtype %u # device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>10 ubeshort x \b, devid %u # driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>12 ubelong >0 >>>12 ubelong x \b, driver data %u # number of driver descriptors sbDrvrCount <= 61 # (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>16 ubeshort x \b, driver count %u # 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map # >>18 use apple-driver-map # >>26 use apple-driver-map # # ... # >>500 use apple-driver-map # number of partitions is always same in every partition (map block count) #>>0x0204 ubelong x \b, %u partitions >>0x0204 ubelong >0 \b, contains[@@0x200]: >>>0x0200 use apple-apm >>0x0204 ubelong >1 \b, contains[@@0x400]: >>>0x0400 use apple-apm >>0x0204 ubelong >2 \b, contains[@@0x600]: >>>0x0600 use apple-apm >>0x0204 ubelong >3 \b, contains[@@0x800]: >>>0x0800 use apple-apm >>0x0204 ubelong >4 \b, contains[@@0xA00]: >>>0x0A00 use apple-apm >>0x0204 ubelong >5 \b, contains[@@0xC00]: >>>0x0C00 use apple-apm >>0x0204 ubelong >6 \b, contains[@@0xE00]: >>>0x0E00 use apple-apm >>0x0204 ubelong >7 \b, contains[@@0x1000]: >>>0x1000 use apple-apm # display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 0 name apple-driver-map >0 ubequad !0 # descBlock first block of driver >>0 ubelong x \b, driver start block %u # descSize driver size in blocks >>4 ubeshort x \b, size %u # descType driver system type 1 701h F8FFh FFFFh >>6 ubeshort x \b, type %#x # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map # Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h # Update: Joerg Jenderek # Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the # magic stronger. # for apple partition map stored as a single file 0 belong 0x504d0000 # to display Apple Partition Map (strength=70) after Syslinux bootloader (71) #!:strength +0 >0 use apple-apm # magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type # file: could not find any valid magic files! #!:ext bin # display apple partition map. Normally called after Apple driver map 0 name apple-apm >0 belong 0x504d0000 Apple Partition Map # number of partitions >>4 ubelong x \b, map block count %u # logical block (512 bytes) start of partition >>8 ubelong x \b, start block %u >>12 ubelong x \b, block count %u >>16 string >0 \b, name %s >>48 string >0 \b, type %s # processor type dpme_process_id[16] e.g. "68000" "68020" >>120 string >0 \b, processor %s # A/UX boot arguments BootArgs[128] >>136 string >0 \b, boot arguments %s # status of partition dpme_flags >>88 belong & 1 \b, valid >>88 belong & 2 \b, allocated >>88 belong & 4 \b, in use >>88 belong & 8 \b, has boot info >>88 belong & 16 \b, readable >>88 belong & 32 \b, writable >>88 belong & 64 \b, pic boot code >>88 belong & 128 \b, chain compatible driver >>88 belong & 256 \b, real driver >>88 belong & 512 \b, chain driver # mount automatically at startup APPLE_PS_AUTO_MOUNT >>88 ubelong &0x40000000 \b, mount at startup # is the startup partition APPLE_PS_STARTUP >>88 ubelong &0x80000000 \b, is the startup partition #https://wiki.mozilla.org/DS_Store_File_Format #https://en.wikipedia.org/wiki/.DS_Store 0 string \0\0\0\1Bud1\0 Apple Desktop Services Store # HFS/HFS+ Resource fork files (andrew.roazen@@nau.edu Apr 13 2015) # Usually not in separate files, but have either filename rsrc with # no extension, or a filename corresponding to another file, with # extensions rsr/rsrc # URL: http://fileformats.archiveteam.org/wiki/Macintosh_resource_file # https://en.wikipedia.org/wiki/Resource_fork # Reference: https://github.com/kreativekorp/ksfl/wiki/Macintosh-Resource-File-Format # http://developer.apple.com/legacy/mac/library/documentation/mac/pdf/MoreMacintoshToolbox.pdf # https://formats.kaitai.io/resource_fork/ # Update: Joerg Jenderek # Note: verified often by command like `deark -m macrsrc Icon_.rsrc` # offset of resource data; usually starts at offset 0x0100 0 string \000\000\001\000 # skip NPETraceSession.etl with invalid "low" map offset 0 >4 ubelong >0xFF # skip few Atari DEGAS Elite bitmap (eil2.pi1 nastro.pi1) with ivalid "high" 0x6550766 0x7510763 map length >>12 ubelong <0x8001 # most examples with zeroed system reserved field >>>16 lelong =0 >>>>0 use apple-rsr # few samples with not zeroed system reserved field like: Empty.rsrc.rsr OpenSans-CondBold.dfont >>>16 lelong !0 # resource fork variant with not zeroed system reserved field and copy of header >>>>(4.L) ubelong 0x100 # GRR: the line above only works if in ../../src/file.h FILE_BYTES_MAX is raised from 1 MiB above 0x6ab0f4 (HelveticaNeue.dfont) >>>>>0 use apple-rsr # data fork variant with not zeroed system reserved field and no copy of header >>>>(4.L) ubelong 0 >>>>>0 use apple-rsr # Note: moved and merged from ./macintosh # From: Adam Buchbinder # URL: https://en.wikipedia.org/wiki/Datafork_TrueType # Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is # TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I # don't know what they mean. # display information about Mac OSX datafork font DFONT 0 name apple-dfont >(4.L+30) ubelong x Mac OSX datafork font, # https://en.wikipedia.org/wiki/Datafork_TrueType !:mime application/x-dfont !:ext dfont # https://exiftool.org/TagNames/RSRC.html >(4.L+30) ubelong 0x73666e74 TrueType >(4.L+30) ubelong 0x464f4e54 'FONT' >(4.L+30) ubelong 0x4e464e54 'NFNT' >(4.L+30) ubelong 0x504f5354 PostScript >(4.L+30) ubelong 0x464f4e44 'FOND' >(4.L+30) ubelong 0x76657273 'vers' # display information about Macintosh resource 0 name apple-rsr >(4.L+30) ubelong 0x73666e74 >>0 use apple-dfont >(4.L+30) ubelong 0x464f4e54 >>0 use apple-dfont >(4.L+30) ubelong 0x4e464e54 >>0 use apple-dfont >(4.L+30) ubelong 0x504f5354 >>0 use apple-dfont >(4.L+30) ubelong 0x464f4e44 >>0 use apple-dfont >(4.L+30) ubelong 0x76657273 >>0 use apple-dfont >(4.L+30) default x Apple HFS/HFS+ resource fork #!:mime application/octet-stream !:mime application/x-apple-rsr !:ext rsrc/rsr # offset to resource data; usually starts at offset 0x0100 >0 ubelong !0x100 \b, data offset %#x # offset to resource map; positive but not nil like in NPETraceSession.etl >4 ubelong x \b, map offset %#x # length of resource map; positive with 32K limitation but not # nil like in NPETraceSession.etl or high like 0x7510763 in nastro.pi1 >12 ubelong x \b, map length %#x # length of resource data; positive but not nil like in NPETraceSession.etl >8 ubelong x \b, data length %#x # reserved 112 bytes for system use; apparently often nil, but 8fd20000h in Empty.rsrc.rsr and 0x00768c2b in OpenSans-CondBold.dfont >16 ubelong !0 \b, at 16 %#8.8x # https://fontforge.org/docs/techref/macformats.html # jump to resource map # a copy of resource header or 16 bytes of zeros for data fork #>(4.L) ubelong x \b, DATA offset %#x #>(4.L+4) ubelong x \b, MAP offset %#x #>(4.L+8) ubelong x \b, DATA length %#x #>(4.L+12) ubelong x \b, MAP length %#x # nextResourceMap; handle to next resource map; used by the Resource Manager for internal bookkeeping; should be zero >(4.L+16) ubelong !0 \b, nextResourceMap %#x # fileRef; file reference number; used by the Resource Manager for internal bookkeeping; should be zero >(4.L+20) ubeshort !0 \b, fileRef %#x # attributes; Resource fork attributes (80h~read-only 40h~compression needed 20h~changed); other bits are reserved and should be zero >(4.L+22) ubeshort !0 \b, attributes %#x # typeListOffset; offset from resource map to start of type list like: 1Ch >(4.L+24) ubeshort x \b, list offset %#x # nameListOffset; offset from esource map to start of name list like: 32h 46h 56h (XLISP.RSR XLISPTIN.RSR) 13Eh (HelveticaNeue.dfont) >(4.L+26) ubeshort x \b, name offset %#x # typeCount; number of types in the map minus 1; If there are no resources, this is 0xFFFF >(4.L+28) beshort+1 >0 \b, %u type # plural s >>(4.L+28) beshort+1 >1 \bs # resource type list array; 1st resource type like: ALRT CODE FOND MPSR icns scsz >>(4.L+30) ubelong x \b, %#x >>(4.L+30) string x '%-.4s' # resourceCount; number of this type resources minus one. If there is one resource of this type, this is 0x0000 >>(4.L+34) beshort+1 x * %d # resourceListOffset; offset from type list to resource list like: Ah 12h DAh >(4.L+36) ubeshort x resource offset %#x #https://en.wikipedia.org/wiki/AppleScript 0 string FasdUAS AppleScript compiled # AppleWorks/ClarisWorks # https://github.com/joshenders/appleworks_format # http://fileformats.archiveteam.org/wiki/AppleWorks 0 name appleworks >0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document >0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document >0 default x >>0 belong x AppleWorks/ClarisWorks CWK Document >0 byte x \b, version %d >30 beshort x \b, %d >32 beshort x \bx%d !:ext cwk 4 string BOBO >0 byte >4 >>12 belong 0 >>>26 belong 0 >>>>0 use appleworks >0 belong 0x0481ad00 >>0 use appleworks # magic for Apple File System (APFS) # from Alex Myczko 32 string NXSB Apple File System (APFS) >36 ulelong x \b, blocksize %u # iTunes cover art (versions 1 and 2) 4 string itch >24 string artw >>0x1e8 string data iTunes cover art >>>0x1ed string PNG (PNG) >>>0x1ec beshort 0xffd8 (JPEG) # MacPaint image 65 string PNTGMPNT MacPaint image data #0 belong 2 MacPaint image data @ 1.11 log @merge changes between 5.40 and 5.43 @ text @d3 1 a3 1 # $File: apple,v 1.45 2021/04/26 15:56:00 christos Exp $ d14 19 d37 3 a39 5 # # Note: The following test are mostly identical. I would rather not # use a regex to identify the WOZ format number. 0 string WOZ1 >4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image d46 6 a51 2 0 string WOZ2 >4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image d53 3 a55 2 >>21 byte 01 \b, 5.25 inch >>21 byte 02 \b, 3.5 inch d68 1 a68 1 >>>0x429 leshort x \b, %u Blocks d73 30 a102 1 >>>0xb29 leshort x \b, %u Blocks d104 37 a140 16 # DOS3.3 boot loader? 0 string \x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B >0x11001 string \x11\x0F\x03 Apple DOS 3.3 Image >>0x11006 byte x \b, Volume %u >>0x11034 byte x \b, %u Tracks >>0x11035 byte x \b, %u Sectors >>0x11036 leshort x \b, %u bytes per sector # DOS3.2 ? >0x11001 string \x11\x0C\x02 Apple DOS 3.2 Image >>0x11006 byte x \b, Volume %u >>0x11034 byte x \b, %u Tracks >>0x11035 byte x \b, %u Sectors >>0x11036 leshort x \b, %u bytes per sector # DOS3.1 ? >0x11001 string \x11\x0C\x01 >>0x11c00 string \x00\x11\x0B Apple DOS 3.1 Image d187 1 a187 1 >>>>0x469 leshort x \b, %u Blocks d190 61 d427 5 d433 1 d633 8 d642 92 a733 2 >4 leshort 0 >>16 lelong 0 Apple HFS/HFS+ resource fork @ 1.10 log @merge conflicts @ text @d3 1 a3 1 # $File: apple,v 1.44 2019/10/18 15:21:02 christos Exp $ d183 1 a183 1 >>>>183 ubyte !0 0x%x d302 1 a302 1 >6 byte x \bCoreFoundation binary property list data, version 0x%c d361 1 a361 1 >12 belong >0 flags 0x%x d441 1 a441 1 >>6 ubeshort x \b, type 0x%x @ 1.9 log @merge conflicts @ text @d3 1 a3 1 # $File: apple,v 1.43 2019/04/19 00:42:27 christos Exp $ d78 8 d90 27 a116 23 0 string 2IMG Apple ][ 2IMG Disk Image >4 clear x >4 string XGS! \b, XGS >4 string CTKG \b, Catakig >4 string ShIm \b, Sheppy's ImageMaker >4 string SHEP \b, Sheppy's ImageMaker >4 string WOOF \b, Sweet 16 >4 string B2TR \b, Bernie ][ the Rescue >4 string \!nfc \b, ASIMOV2 >4 string \>BD\< \b, Brutal Deluxe's Cadius >4 string CdrP \b, CiderPress >4 string Vi][ \b, Virtual ][ >4 string PRFS \b, ProFUSE >4 string FISH \b, FishWings >4 string RVLW \b, Revival for Windows >4 default x >>4 string x \b, Creator tag "%-4.4s" >0xc byte 00 \b, DOS 3.3 sector order >>0x10 byte 00 \b, Volume 254 >>0x10 byte&0x7f x \b, Volume %u >0xc byte 01 \b, ProDOS sector order >>0x14 short x \b, %u Blocks >0xc byte 02 \b, NIB data @ 1.8 log @merge conflicts for file-5.33 @ text @d3 1 a3 1 # $File: apple,v 1.39 2018/03/02 15:26:39 christos Exp $ d14 65 d81 24 a104 14 0 string 2IMG Apple ][ 2IMG Disk Image >4 string XGS! \b, XGS >4 string CTKG \b, Catakig >4 string ShIm \b, Sheppy's ImageMaker >4 string WOOF \b, Sweet 16 >4 string B2TR \b, Bernie ][ the Rescue >4 string !nfc \b, ASIMOV2 >4 string x \b, Unknown Format >0xc byte 00 \b, DOS 3.3 sector order >>0x10 byte 00 \b, Volume 254 >>0x10 byte&0x7f x \b, Volume %u >0xc byte 01 \b, ProDOS sector order >>0x14 short x \b, %u Blocks >0xc byte 02 \b, NIB data d166 1 a166 1 #:apple pdospøÿ d432 1 a432 1 # Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h d474 2 a475 2 #http://wiki.mozilla.org/DS_Store_File_Format #http://en.wikipedia.org/wiki/.DS_Store @ 1.8.2.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: apple,v 1.43 2019/04/19 00:42:27 christos Exp $ a13 65 # Type: Apple Emulator WOZ format # From: Greg Wildman # Ref: https://applesaucefdc.com/woz/reference/ # Ref: https://applesaucefdc.com/woz/reference2/ # # Note: The following test are mostly identical. I would rather not # use a regex to identify the WOZ format number. 0 string WOZ1 >4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image >12 string INFO >>21 byte 01 \b, 5.25 inch >>21 byte 02 \b, 3.5 inch >>22 byte 01 \b, write protected >>23 byte 01 \b, cross track synchronized >>25 string/T x \b, %.32s 0 string WOZ2 >4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image >12 string INFO >>21 byte 01 \b, 5.25 inch >>21 byte 02 \b, 3.5 inch >>22 byte 01 \b, write protected >>23 byte 01 \b, cross track synchronized >>25 string/T x \b, %.32s # Type: Apple Emulator disk images # From: Greg Wildman # ProDOS boot loader? 0 string \x01\x38\xB0\x03\x4C Apple ProDOS Image # Detect Volume Directory block ($02) >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 leshort x \b, %u Blocks # ProDOS ordered ? >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 leshort x \b, %u Blocks # # DOS3.3 boot loader? 0 string \x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B >0x11001 string \x11\x0F\x03 Apple DOS 3.3 Image >>0x11006 byte x \b, Volume %u >>0x11034 byte x \b, %u Tracks >>0x11035 byte x \b, %u Sectors >>0x11036 leshort x \b, %u bytes per sector # DOS3.2 ? >0x11001 string \x11\x0C\x02 Apple DOS 3.2 Image >>0x11006 byte x \b, Volume %u >>0x11034 byte x \b, %u Tracks >>0x11035 byte x \b, %u Sectors >>0x11036 leshort x \b, %u bytes per sector # DOS3.1 ? >0x11001 string \x11\x0C\x01 >>0x11c00 string \x00\x11\x0B Apple DOS 3.1 Image # # Pascal boot loader? 0 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD >0xd6 pstring SYSTEM.APPLE >>0xb00 leshort 0x0000 >>>0xb04 leshort 0x0000 Apple Pascal Image >>>>0xb06 pstring x \b, Volume %s: >>>>0xb0e leshort x \b, %u Blocks >>>>0xb10 leshort x \b, %u Files d16 14 a29 24 # Update: Greg Wildman 0 string 2IMG Apple ][ 2IMG Disk Image >4 clear x >4 string XGS! \b, XGS >4 string CTKG \b, Catakig >4 string ShIm \b, Sheppy's ImageMaker >4 string SHEP \b, Sheppy's ImageMaker >4 string WOOF \b, Sweet 16 >4 string B2TR \b, Bernie ][ the Rescue >4 string \!nfc \b, ASIMOV2 >4 string \>BD\< \b, Brutal Deluxe's Cadius >4 string CdrP \b, CiderPress >4 string Vi][ \b, Virtual ][ >4 string PRFS \b, ProFUSE >4 string FISH \b, FishWings >4 string RVLW \b, Revival for Windows >4 default x >>4 string x \b, Creator tag "%-4.4s" >0xc byte 00 \b, DOS 3.3 sector order >>0x10 byte 00 \b, Volume 254 >>0x10 byte&0x7f x \b, Volume %u >0xc byte 01 \b, ProDOS sector order >>0x14 short x \b, %u Blocks >0xc byte 02 \b, NIB data d91 1 a91 1 #:apple pdosp^Z\xf8\xff d357 1 a357 1 # Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h d399 2 a400 2 #https://wiki.mozilla.org/DS_Store_File_Format #https://en.wikipedia.org/wiki/.DS_Store @ 1.8.2.2 log @Merge changes from current as of 20200406 @ text @d3 1 a3 1 # $File: apple,v 1.44 2019/10/18 15:21:02 christos Exp $ a77 8 # # Diversi Dos boot loader? 0 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD >0x11001 string \x11\x0F\x03 Apple Diversi Dos Image >>0x11006 byte x \b, Volume %u >>0x11034 byte x \b, %u Tracks >>0x11035 byte x \b, %u Sectors >>0x11036 leshort x \b, %u bytes per sector d82 23 a104 27 0 string 2IMG Apple ][ 2IMG Disk Image >4 clear x >4 string XGS! \b, XGS >4 string CTKG \b, Catakig >4 string ShIm \b, Sheppy's ImageMaker >4 string SHEP \b, Sheppy's ImageMaker >4 string WOOF \b, Sweet 16 >4 string B2TR \b, Bernie ][ the Rescue >4 string \!nfc \b, ASIMOV2 >4 string \>BD\< \b, Brutal Deluxe's Cadius >4 string CdrP \b, CiderPress >4 string Vi][ \b, Virtual ][ >4 string PRFS \b, ProFUSE >4 string FISH \b, FishWings >4 string RVLW \b, Revival for Windows >4 default x >>4 string x \b, Creator tag "%-4.4s" >0xc byte 00 \b, DOS 3.3 sector order >>0x10 byte 00 \b, Volume 254 >>0x10 byte&0x7f x \b, Volume %u >0xc byte 01 \b, ProDOS sector order # Detect Volume Directory block ($02) + 2mg header offset >>0x440 string \x00\x00\x03\x00 >>>0x444 byte &0xF0 >>>>0x445 string x \b, Volume /%s >>>>0x469 leshort x \b, %u Blocks >0xc byte 02 \b, NIB data @ 1.7 log @merge 5.31 @ text @d3 1 a3 1 # $File: apple,v 1.36 2017/03/17 21:35:28 christos Exp $ d434 16 @ 1.7.8.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: apple,v 1.39 2018/03/02 15:26:39 christos Exp $ a433 16 # magic for Apple File System (APFS) # from Alex Myczko 32 string NXSB Apple File System (APFS) >36 ulelong x \b, blocksize %u # iTunes cover art (versions 1 and 2) 4 string itch >24 string artw >>0x1e8 string data iTunes cover art >>>0x1ed string PNG (PNG) >>>0x1ec beshort 0xffd8 (JPEG) # MacPaint image 65 string PNTGMPNT MacPaint image data #0 belong 2 MacPaint image data @ 1.6 log @merge conflicts @ text @d3 1 a3 1 # $File: apple,v 1.35 2016/08/17 09:45:13 christos Exp $ d70 1 a70 1 # Update: Joerg Jenderek d76 1 a76 1 4 string O d78 1 a78 1 >84 ubequad ^0x00Fe00000000Fe00 d95 1 a95 1 >>>183 ubyte !30 d97 1 a97 1 # usual tabstop start sequence "=====<" d108 1 a108 1 >>>91 ubyte >0 d143 1 a143 1 0 belong&0x00ff00ff 0x00080000 d149 1 a149 1 # d189 2 a190 2 # Note there might be some problems with the "VAX COFF executable" # entry. Note this entry should be placed before the mac filesystem section, d193 1 a193 1 # The intended meaning of these tests is, that the file is only of the d200 1 a200 1 # Note that this entry is recognized correctly by the "Apple Partition d291 1 a291 1 # Update: Joerg Jenderek d318 1 a318 1 >>12 ubelong >0 d330 1 a330 1 >>0x0204 ubelong >0 \b, contains[@@0x200]: d332 1 a332 1 >>0x0204 ubelong >1 \b, contains[@@0x400]: d334 1 a334 1 >>0x0204 ubelong >2 \b, contains[@@0x600]: d336 1 a336 1 >>0x0204 ubelong >3 \b, contains[@@0x800]: d338 1 a338 1 >>0x0204 ubelong >4 \b, contains[@@0xA00]: d340 1 a340 1 >>0x0204 ubelong >5 \b, contains[@@0xC00]: d342 1 a342 1 >>0x0204 ubelong >6 \b, contains[@@0xE00]: d344 1 a344 1 >>0x0204 ubelong >7 \b, contains[@@0x1000]: d348 2 a349 2 >0 ubequad !0 # descBlock first block of driver d358 1 a358 1 # Update: Joerg Jenderek d362 1 a362 1 0 belong 0x504d0000 d420 1 a420 1 >0 default x @ 1.5 log @merge conflicts @ text @d3 1 a3 1 # $File: apple,v 1.29 2014/04/30 21:41:02 christos Exp $ d68 4 a71 4 # # This matches the standard tab stops for an AppleWorks file, but if # a file has a tab stop set in the first four columns this will fail. # d74 36 a109 6 4 string O==== AppleWorks word processor data >85 byte&0x01 >0 \b, zoomed >90 byte&0x01 >0 \b, paginated >92 byte&0x01 >0 \b, with mail merge #>91 byte x \b, left margin %d d288 5 a292 1 # Apple disk partition stuff, strengthen the magic using byte 4 d294 11 a304 1 >4 byte 0 Apple Driver Map d306 54 a359 16 >>4 belong x \b, blockcount %d >>10 beshort x \b, devtype %d >>12 beshort x \b, devid %d >>20 beshort x \b, descriptors %d # Assume 8 partitions each at a multiple of the sector size. # We could glean this from the partition descriptors, but they are empty!?!? >>(2.S*1) indirect \b, contains[@@0x%x]: >>(2.S*2) indirect \b, contains[@@0x%x]: >>(2.S*3) indirect \b, contains[@@0x%x]: >>(2.S*4) indirect \b, contains[@@0x%x]: >>(2.S*5) indirect \b, contains[@@0x%x]: >>(2.S*6) indirect \b, contains[@@0x%x]: >>(2.S*7) indirect \b, contains[@@0x%x]: >>(2.S*8) indirect \b, contains[@@0x%x]: # Yes, the 3rd and 4th bytes are reserved, but we use them to make the d361 37 a397 20 0 belong 0x504d0000 Apple Partition Map >4 belong x \b, map block count %d >8 belong x \b, start block %d >12 belong x \b, block count %d >16 string >0 \b, name %s >48 string >0 \b, type %s >124 string >0 \b, processor %s >140 string >0 \b, boot arguments %s >92 belong & 1 \b, valid >92 belong & 2 \b, allocated >92 belong & 4 \b, in use >92 belong & 8 \b, has boot info >92 belong & 16 \b, readable >92 belong & 32 \b, writable >92 belong & 64 \b, pic boot code >92 belong & 128 \b, chain compatible driver >92 belong & 256 \b, real driver >92 belong & 512 \b, chain driver >92 belong & 1024 \b, mount at startup >92 belong & 2048 \b, is the startup partition d399 1 a399 1 #http://wiki.mozilla.org/DS_Store_File_Format` d402 32 @ 1.5.10.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: apple,v 1.35 2016/08/17 09:45:13 christos Exp $ d68 4 a71 4 # URL: https://en.wikipedia.org/wiki/AppleWorks # Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx # Update: Joerg Jenderek # NOTE: d74 6 a79 36 # and/or look for unused bits of booleans bytes like zoom, paginated, mail merge # the newer AppleWorks is from claris with extension CWK 4 string O # test for unused bits of zoom- , paginated-boolean bytes >84 ubequad ^0x00Fe00000000Fe00 # look for tabstop definitions "=" no tab, "|" no tab # "<" left tab,"^" center tab,">" right tab, "." decimal tab, # unofficial "!" other , "\x8a" other # official only if SFMinVers is nonzero >>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor # AppleWorks Word Processor File (Apple II) # ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" # application/x-appleworks is mime type for claris version with cwk extension !:mime application/x-appleworks3 # http://home.earthlink.net/~hughhood/appleiiworksenvoy/ # ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') # $70 $1A $F8 $FF is this the apple type ? #:apple pdospøÿ !:ext awp # minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) >>>183 ubyte 30 3.0 >>>183 ubyte !30 >>>>183 ubyte !0 0x%x # usual tabstop start sequence "=====<" >>>5 string x \b, tabstop ruler "%6.6s" # tabstop ruler #>>>5 string >\0 \b, tabstops "%-79s" # zoom switch >>>85 byte&0x01 >0 \b, zoomed # whether paginated >>>90 byte&0x01 >0 \b, paginated # contains any mail-merge commands >>>92 byte&0x01 >0 \b, with mail merge # left margin in 1/10 inches ( normally 0 or 10 ) >>>91 ubyte >0 >>>>91 ubyte x \b, %d/10 inch left margin d258 1 a258 5 # Apple disk partition stuff # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map # Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h # Update: Joerg Jenderek # "ER" is APPLE_DRVR_MAP_MAGIC signature d260 1 a260 11 # display Apple Driver Map (strength=50) after Syslinux bootloader (71) #!:strength +0 # strengthen the magic by looking for used blocksizes 512 2048 >2 ubeshort&0xf1FF 0 Apple Driver Map # last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid #>>504 ubequad&0x0000FFffFFff0000 0 !:mime application/x-apple-diskimage !:apple ????devr # https://en.wikipedia.org/wiki/Apple_Disk_Image !:ext dmg/iso # sbBlkSize for driver descriptor map 512 2048 d262 16 a277 54 # sbBlkCount sometimes garbish like # 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg # 0xf2720100 for bunziped Firefox 48.0-2.dmg # 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso # 0x00009090 by syslinux-6.03/utils/isohybrid.c >>4 ubelong x \b, blockcount %u # following device/driver information not very useful # device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>8 ubeshort x \b, devtype %u # device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>10 ubeshort x \b, devid %u # driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>12 ubelong >0 >>>12 ubelong x \b, driver data %u # number of driver descriptors sbDrvrCount <= 61 # (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>16 ubeshort x \b, driver count %u # 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map # >>18 use apple-driver-map # >>26 use apple-driver-map # # ... # >>500 use apple-driver-map # number of partitions is always same in every partition (map block count) #>>0x0204 ubelong x \b, %u partitions >>0x0204 ubelong >0 \b, contains[@@0x200]: >>>0x0200 use apple-apm >>0x0204 ubelong >1 \b, contains[@@0x400]: >>>0x0400 use apple-apm >>0x0204 ubelong >2 \b, contains[@@0x600]: >>>0x0600 use apple-apm >>0x0204 ubelong >3 \b, contains[@@0x800]: >>>0x0800 use apple-apm >>0x0204 ubelong >4 \b, contains[@@0xA00]: >>>0x0A00 use apple-apm >>0x0204 ubelong >5 \b, contains[@@0xC00]: >>>0x0C00 use apple-apm >>0x0204 ubelong >6 \b, contains[@@0xE00]: >>>0x0E00 use apple-apm >>0x0204 ubelong >7 \b, contains[@@0x1000]: >>>0x1000 use apple-apm # display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 0 name apple-driver-map >0 ubequad !0 # descBlock first block of driver >>0 ubelong x \b, driver start block %u # descSize driver size in blocks >>4 ubeshort x \b, size %u # descType driver system type 1 701h F8FFh FFFFh >>6 ubeshort x \b, type 0x%x # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map # Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h # Update: Joerg Jenderek # Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the d279 20 a298 37 # for apple partition map stored as a single file 0 belong 0x504d0000 # to display Apple Partition Map (strength=70) after Syslinux bootloader (71) #!:strength +0 >0 use apple-apm # magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type # file: could not find any valid magic files! #!:ext bin # display apple partition map. Normally called after Apple driver map 0 name apple-apm >0 belong 0x504d0000 Apple Partition Map # number of partitions >>4 ubelong x \b, map block count %u # logical block (512 bytes) start of partition >>8 ubelong x \b, start block %u >>12 ubelong x \b, block count %u >>16 string >0 \b, name %s >>48 string >0 \b, type %s # processor type dpme_process_id[16] e.g. "68000" "68020" >>120 string >0 \b, processor %s # A/UX boot arguments BootArgs[128] >>136 string >0 \b, boot arguments %s # status of partition dpme_flags >>88 belong & 1 \b, valid >>88 belong & 2 \b, allocated >>88 belong & 4 \b, in use >>88 belong & 8 \b, has boot info >>88 belong & 16 \b, readable >>88 belong & 32 \b, writable >>88 belong & 64 \b, pic boot code >>88 belong & 128 \b, chain compatible driver >>88 belong & 256 \b, real driver >>88 belong & 512 \b, chain driver # mount automatically at startup APPLE_PS_AUTO_MOUNT >>88 ubelong &0x40000000 \b, mount at startup # is the startup partition APPLE_PS_STARTUP >>88 ubelong &0x80000000 \b, is the startup partition d300 1 a300 1 #http://wiki.mozilla.org/DS_Store_File_Format a302 32 # HFS/HFS+ Resource fork files (andrew.roazen@@nau.edu Apr 13 2015) # Usually not in separate files, but have either filename rsrc with # no extension, or a filename corresponding to another file, with # extensions rsr/rsrc 0 string \000\000\001\000 >4 leshort 0 >>16 lelong 0 Apple HFS/HFS+ resource fork #https://en.wikipedia.org/wiki/AppleScript 0 string FasdUAS AppleScript compiled # AppleWorks/ClarisWorks # https://github.com/joshenders/appleworks_format # http://fileformats.archiveteam.org/wiki/AppleWorks 0 name appleworks >0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document >0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document >0 default x >>0 belong x AppleWorks/ClarisWorks CWK Document >0 byte x \b, version %d >30 beshort x \b, %d >32 beshort x \bx%d !:ext cwk 4 string BOBO >0 byte >4 >>12 belong 0 >>>26 belong 0 >>>>0 use appleworks >0 belong 0x0481ad00 >>0 use appleworks @ 1.5.6.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: apple,v 1.35 2016/08/17 09:45:13 christos Exp $ d68 4 a71 4 # URL: https://en.wikipedia.org/wiki/AppleWorks # Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx # Update: Joerg Jenderek # NOTE: d74 6 a79 36 # and/or look for unused bits of booleans bytes like zoom, paginated, mail merge # the newer AppleWorks is from claris with extension CWK 4 string O # test for unused bits of zoom- , paginated-boolean bytes >84 ubequad ^0x00Fe00000000Fe00 # look for tabstop definitions "=" no tab, "|" no tab # "<" left tab,"^" center tab,">" right tab, "." decimal tab, # unofficial "!" other , "\x8a" other # official only if SFMinVers is nonzero >>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor # AppleWorks Word Processor File (Apple II) # ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" # application/x-appleworks is mime type for claris version with cwk extension !:mime application/x-appleworks3 # http://home.earthlink.net/~hughhood/appleiiworksenvoy/ # ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') # $70 $1A $F8 $FF is this the apple type ? #:apple pdospøÿ !:ext awp # minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) >>>183 ubyte 30 3.0 >>>183 ubyte !30 >>>>183 ubyte !0 0x%x # usual tabstop start sequence "=====<" >>>5 string x \b, tabstop ruler "%6.6s" # tabstop ruler #>>>5 string >\0 \b, tabstops "%-79s" # zoom switch >>>85 byte&0x01 >0 \b, zoomed # whether paginated >>>90 byte&0x01 >0 \b, paginated # contains any mail-merge commands >>>92 byte&0x01 >0 \b, with mail merge # left margin in 1/10 inches ( normally 0 or 10 ) >>>91 ubyte >0 >>>>91 ubyte x \b, %d/10 inch left margin d258 1 a258 5 # Apple disk partition stuff # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map # Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h # Update: Joerg Jenderek # "ER" is APPLE_DRVR_MAP_MAGIC signature d260 1 a260 11 # display Apple Driver Map (strength=50) after Syslinux bootloader (71) #!:strength +0 # strengthen the magic by looking for used blocksizes 512 2048 >2 ubeshort&0xf1FF 0 Apple Driver Map # last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid #>>504 ubequad&0x0000FFffFFff0000 0 !:mime application/x-apple-diskimage !:apple ????devr # https://en.wikipedia.org/wiki/Apple_Disk_Image !:ext dmg/iso # sbBlkSize for driver descriptor map 512 2048 d262 16 a277 54 # sbBlkCount sometimes garbish like # 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg # 0xf2720100 for bunziped Firefox 48.0-2.dmg # 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso # 0x00009090 by syslinux-6.03/utils/isohybrid.c >>4 ubelong x \b, blockcount %u # following device/driver information not very useful # device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>8 ubeshort x \b, devtype %u # device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>10 ubeshort x \b, devid %u # driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>12 ubelong >0 >>>12 ubelong x \b, driver data %u # number of driver descriptors sbDrvrCount <= 61 # (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>16 ubeshort x \b, driver count %u # 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map # >>18 use apple-driver-map # >>26 use apple-driver-map # # ... # >>500 use apple-driver-map # number of partitions is always same in every partition (map block count) #>>0x0204 ubelong x \b, %u partitions >>0x0204 ubelong >0 \b, contains[@@0x200]: >>>0x0200 use apple-apm >>0x0204 ubelong >1 \b, contains[@@0x400]: >>>0x0400 use apple-apm >>0x0204 ubelong >2 \b, contains[@@0x600]: >>>0x0600 use apple-apm >>0x0204 ubelong >3 \b, contains[@@0x800]: >>>0x0800 use apple-apm >>0x0204 ubelong >4 \b, contains[@@0xA00]: >>>0x0A00 use apple-apm >>0x0204 ubelong >5 \b, contains[@@0xC00]: >>>0x0C00 use apple-apm >>0x0204 ubelong >6 \b, contains[@@0xE00]: >>>0x0E00 use apple-apm >>0x0204 ubelong >7 \b, contains[@@0x1000]: >>>0x1000 use apple-apm # display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 0 name apple-driver-map >0 ubequad !0 # descBlock first block of driver >>0 ubelong x \b, driver start block %u # descSize driver size in blocks >>4 ubeshort x \b, size %u # descType driver system type 1 701h F8FFh FFFFh >>6 ubeshort x \b, type 0x%x # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map # Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h # Update: Joerg Jenderek # Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the d279 20 a298 37 # for apple partition map stored as a single file 0 belong 0x504d0000 # to display Apple Partition Map (strength=70) after Syslinux bootloader (71) #!:strength +0 >0 use apple-apm # magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type # file: could not find any valid magic files! #!:ext bin # display apple partition map. Normally called after Apple driver map 0 name apple-apm >0 belong 0x504d0000 Apple Partition Map # number of partitions >>4 ubelong x \b, map block count %u # logical block (512 bytes) start of partition >>8 ubelong x \b, start block %u >>12 ubelong x \b, block count %u >>16 string >0 \b, name %s >>48 string >0 \b, type %s # processor type dpme_process_id[16] e.g. "68000" "68020" >>120 string >0 \b, processor %s # A/UX boot arguments BootArgs[128] >>136 string >0 \b, boot arguments %s # status of partition dpme_flags >>88 belong & 1 \b, valid >>88 belong & 2 \b, allocated >>88 belong & 4 \b, in use >>88 belong & 8 \b, has boot info >>88 belong & 16 \b, readable >>88 belong & 32 \b, writable >>88 belong & 64 \b, pic boot code >>88 belong & 128 \b, chain compatible driver >>88 belong & 256 \b, real driver >>88 belong & 512 \b, chain driver # mount automatically at startup APPLE_PS_AUTO_MOUNT >>88 ubelong &0x40000000 \b, mount at startup # is the startup partition APPLE_PS_STARTUP >>88 ubelong &0x80000000 \b, is the startup partition d300 1 a300 1 #http://wiki.mozilla.org/DS_Store_File_Format a302 32 # HFS/HFS+ Resource fork files (andrew.roazen@@nau.edu Apr 13 2015) # Usually not in separate files, but have either filename rsrc with # no extension, or a filename corresponding to another file, with # extensions rsr/rsrc 0 string \000\000\001\000 >4 leshort 0 >>16 lelong 0 Apple HFS/HFS+ resource fork #https://en.wikipedia.org/wiki/AppleScript 0 string FasdUAS AppleScript compiled # AppleWorks/ClarisWorks # https://github.com/joshenders/appleworks_format # http://fileformats.archiveteam.org/wiki/AppleWorks 0 name appleworks >0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document >0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document >0 default x >>0 belong x AppleWorks/ClarisWorks CWK Document >0 byte x \b, version %d >30 beshort x \b, %d >32 beshort x \bx%d !:ext cwk 4 string BOBO >0 byte >4 >>12 belong 0 >>>26 belong 0 >>>>0 use appleworks >0 belong 0x0481ad00 >>0 use appleworks @ 1.4 log @merge new file @ text @d3 1 a3 1 # $File: apple,v 1.27 2013/03/09 22:36:00 christos Exp $ d207 1 a207 1 >0 byte x \b, version %hhd d210 1 a210 1 >>>14 ubeshort x \b, system %hd d212 1 a212 1 >0 byte x \b, version %hhd d215 1 a215 1 >>>14 uleshort x \b, system %hd @ 1.4.8.1 log @Rebase. @ text @d3 1 a3 1 # $File: apple,v 1.29 2014/04/30 21:41:02 christos Exp $ d207 1 a207 1 >0 byte x \b, version %d d210 1 a210 1 >>>14 ubeshort x \b, system %d d212 1 a212 1 >0 byte x \b, version %d d215 1 a215 1 >>>14 uleshort x \b, system %d @ 1.3 log @merge changes @ text @d3 1 a3 1 # $File: apple,v 1.26 2012/12/27 15:43:23 christos Exp $ d109 1 d111 5 a115 1 0 belong&0xff00ff 0x80000 Applesoft BASIC program data @ 1.2 log @bring in changes from head. @ text @d3 1 a3 1 # $File: apple,v 1.25 2012/04/06 21:18:09 christos Exp $ d294 4 @ 1.2.2.1 log @resync with head @ text @d3 1 a3 1 # $File: apple,v 1.26 2012/12/27 15:43:23 christos Exp $ a293 4 #http://wiki.mozilla.org/DS_Store_File_Format` #http://en.wikipedia.org/wiki/.DS_Store 0 string \0\0\0\1Bud1\0 Apple Desktop Services Store @ 1.2.2.2 log @resync from head @ text @d3 1 a3 1 # $File: apple,v 1.27 2013/03/09 22:36:00 christos Exp $ a108 1 # update by Joerg Jenderek at Feb 2013 d110 1 a110 5 # GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) #0 belong&0xff00ff 0x80000 Applesoft BASIC program data 0 belong&0x00ff00ff 0x00080000 # assuming that line number must be positive >2 leshort >0 Applesoft BASIC program data, first line number %d @ 1.2.2.3 log @Rebase to HEAD as of a few days ago. @ text @d3 1 a3 1 # $File: apple,v 1.29 2014/04/30 21:41:02 christos Exp $ d207 1 a207 1 >0 byte x \b, version %d d210 1 a210 1 >>>14 ubeshort x \b, system %d d212 1 a212 1 >0 byte x \b, version %d d215 1 a215 1 >>>14 uleshort x \b, system %d @ 1.1 log @Initial revision @ text @d1 1 d3 1 d6 1 a6 1 0 search/1 FiLeStArTfIlEsTaRt binscii (apple ][) text d252 42 @ 1.1.1.1 log @from ftp.astron.com @ text @@ 1.1.1.2 log @from ftp.astron.com. - many security related fixes - no MAXPATHLEN limits - fixed missing text specification on ascii magic - new ``pascal'' style string formats - whitespace comparison fix - more magic @ text @a0 1 a1 1 # $File: apple,v 1.24 2010/11/25 15:00:12 christos Exp $ d4 1 a4 1 0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text @ 1.1.1.3 log @from ftp.astron.com @ text @d3 1 a3 1 # $File: apple,v 1.26 2012/12/27 15:43:23 christos Exp $ a251 46 # Apple disk partition stuff, strengthen the magic using byte 4 0 beshort 0x4552 >4 byte 0 Apple Driver Map >>2 beshort x \b, blocksize %d >>4 belong x \b, blockcount %d >>10 beshort x \b, devtype %d >>12 beshort x \b, devid %d >>20 beshort x \b, descriptors %d # Assume 8 partitions each at a multiple of the sector size. # We could glean this from the partition descriptors, but they are empty!?!? >>(2.S*1) indirect \b, contains[@@0x%x]: >>(2.S*2) indirect \b, contains[@@0x%x]: >>(2.S*3) indirect \b, contains[@@0x%x]: >>(2.S*4) indirect \b, contains[@@0x%x]: >>(2.S*5) indirect \b, contains[@@0x%x]: >>(2.S*6) indirect \b, contains[@@0x%x]: >>(2.S*7) indirect \b, contains[@@0x%x]: >>(2.S*8) indirect \b, contains[@@0x%x]: # Yes, the 3rd and 4th bytes are reserved, but we use them to make the # magic stronger. 0 belong 0x504d0000 Apple Partition Map >4 belong x \b, map block count %d >8 belong x \b, start block %d >12 belong x \b, block count %d >16 string >0 \b, name %s >48 string >0 \b, type %s >124 string >0 \b, processor %s >140 string >0 \b, boot arguments %s >92 belong & 1 \b, valid >92 belong & 2 \b, allocated >92 belong & 4 \b, in use >92 belong & 8 \b, has boot info >92 belong & 16 \b, readable >92 belong & 32 \b, writable >92 belong & 64 \b, pic boot code >92 belong & 128 \b, chain compatible driver >92 belong & 256 \b, real driver >92 belong & 512 \b, chain driver >92 belong & 1024 \b, mount at startup >92 belong & 2048 \b, is the startup partition #http://wiki.mozilla.org/DS_Store_File_Format` #http://en.wikipedia.org/wiki/.DS_Store 0 string \0\0\0\1Bud1\0 Apple Desktop Services Store @ 1.1.1.4 log @import file-5.14 changes are "name" + "use" keyword features, bug fixes @ text @d3 1 a3 1 # $File: apple,v 1.27 2013/03/09 22:36:00 christos Exp $ a108 1 # update by Joerg Jenderek at Feb 2013 d110 1 a110 5 # GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) #0 belong&0xff00ff 0x80000 Applesoft BASIC program data 0 belong&0x00ff00ff 0x00080000 # assuming that line number must be positive >2 leshort >0 Applesoft BASIC program data, first line number %d @ 1.1.1.5 log @import file-5.19 2014-06-09 9:04 Christos Zoulas * Misc buffer overruns and missing buffer size tests in cdf parsing (Francisco Alonso, Jan Kaluza) 2014-06-02 14:50 Christos Zoulas * Enforce limit of 8K on regex searches that have no limits * Allow the l modifier for regex to mean line count. Default to byte count. If line count is specified, assume a max of 80 characters per line to limit the byte count. * Don't allow conversions to be used for dates, allowing the mask field to be used as an offset. 2014-05-30 12:51 Christos Zoulas * Make the range operator limit the length of the regex search. 2014-05-14 19:23 Christos Zoulas * PR/347: Windows fixes * PR/352: Hangul word processor recognition * PR/354: Encoding irregularities in text files 2014-05-06 6:12 Christos Zoulas * Fix uninitialized title in CDF files (Jan Kaluza) 2014-05-04 14:55 Christos Zoulas * PR/351: Fix compilation of empty files 2014-04-30 17:39 Christos Zoulas * Fix integer formats: We don't specify 'l' or 'h' and 'hh' specifiers anymore, only 'll' for quads and nothing for the rest. This is so that magic writing is simpler. 2014-04-01 15:25 Christos Zoulas * PR/341: Jan Kaluza, fix memory leak * PR/342: Jan Kaluza, fix out of bounds read 2014-03-28 15:25 Christos Zoulas * Fix issue with long formats not matching fmtcheck @ text @d3 1 a3 1 # $File: apple,v 1.29 2014/04/30 21:41:02 christos Exp $ d207 1 a207 1 >0 byte x \b, version %d d210 1 a210 1 >>>14 ubeshort x \b, system %d d212 1 a212 1 >0 byte x \b, version %d d215 1 a215 1 >>>14 uleshort x \b, system %d @ 1.1.1.6 log @2017-02-10 12:24 Christos Zoulas * release 5.30 2017-02-07 23:27 Christos Zoulas * If we exceeded the offset in a search return no match (Christoph Biedl) * Be more lenient on corrupt CDF files (Christoph Biedl) 2017-02-04 16:46 Christos Zoulas * pacify ubsan sign extension (oss-fuzz/524) 2017-02-01 12:42 Christos Zoulas * off by one in cdf parsing (PR/593) * report debugging sections in elf (PR/591) 2016-11-06 10:52 Christos Zoulas * Allow @@@@@@ in extensions * Add missing overflow check in der magic (Jonas Wagner) 2016-10-25 10:40 Christos Zoulas * release 5.29 2016-10-24 11:20 Christos Zoulas * der getlength overflow (Jonas Wagner) * multiple magic file load failure (Christoph Biedl) 2016-10-17 11:26 Christos Zoulas * CDF parsing improvements (Guy Helmer) 2016-07-20 7:26 Christos Zoulas * Add support for signed indirect offsets 2016-07-18 7:41 Christos Zoulas * cat /dev/null | file - should print empty (Christoph Biedl) 2016-07-05 15:20 Christos Zoulas * Bump string size from 64 to 96. 2016-06-13 20:20 Christos Zoulas * PR/556: Fix separators on annotations. 2016-06-13 19:40 Christos Zoulas * release 5.28 * fix leak on allocation failure 2016-06-01 1:20 Christos Zoulas * PR/555: Avoid overflow for offset > nbytes * PR/550: Segv on DER parsing: - use the correct variable for length - set offset to 0 on failure. 2016-05-13 12:00 Christos Zoulas * release 5.27 2016-04-18 9:35 Christos Zoulas * Errors comparing DER entries or computing offsets are just indications of malformed non-DER files. Don't print them. * Offset comparison was off-by-one. * Fix compression code (Werner Fink) * Put new bytes constant in the right file (not the generated one) 2016-04-16 18:34 Christos Zoulas * release 5.26 2016-03-31 13:50 Christos Zoulas * make the number of bytes read from files configurable. 2016-03-21 13:40 Christos Zoulas * Add bounds checks for DER code (discovered by Thomas Jarosch) * Change indirect recursion limit to indirect use count and bump from 15 to 50 to prevent abuse. 2016-03-13 20:39 Christos Zoulas * Add -00 which prints filename\0description\0 2016-03-01 13:28 Christos Zoulas * Fix ID3 indirect parsing 2016-01-19 10:18 Christos Zoulas * add DER parsing capability 2015-11-13 10:35 Christos Zoulas * provide dprintf(3) for the OS's that don't have it. 2015-11-11 16:25 Christos Zoulas * redo the compression code report decompression errors 2015-11-10 23:25 Christos Zoulas * REG_STARTEND code is not working as expected, delete it. 2015-11-09 16:05 Christos Zoulas * Add zlib support if we have it. 2015-11-05 11:22 Christos Zoulas * PR/492: compression forking was broken with magic_buffer. 2015-09-16 9:50 Christos Zoulas * release 5.25 2015-09-11 13:25 Christos Zoulas * add a limit to the length of regex searches 2015-09-08 9:50 Christos Zoulas * fix problems with --parameter (Christoph Biedl) 2015-07-11 10:35 Christos Zoulas * Windows fixes PR/466 (Jason Hood) 2015-07-09 10:35 Christos Zoulas * release 5.24 2015-06-11 8:52 Christos Zoulas * redo long option encoding to fix off-by-one in 5.23 2015-06-10 13:50 Christos Zoulas * release 5.23 2015-06-09 16:10 Christos Zoulas * Fix issue with regex range for magic with offset * Always return true from mget with USE (success to mget not match indication). Fixes mime evaluation after USE magic * PR/459: Don't insert magic entries to the list if there are parsing errors for them. 2015-06-03 16:00 Christos Zoulas * PR/455: Add utf-7 encoding 2015-06-03 14:30 Christos Zoulas * PR/455: Implement -Z, look inside, but don't report on compression * PR/454: Fix allocation error on bad magic. 2015-05-29 10:30 Christos Zoulas * handle MAGIC_CONTINUE everywhere, not just in softmagic 2015-05-21 14:30 Christos Zoulas * don't print descriptions for NAME types when mime. 2015-04-09 15:59 Christos Zoulas * Add --extension to list the known extensions for this file type Idea by Andrew J Roazen 2015-02-14 12:23 Christos Zoulas * Bump file search buffer size to 1M. 2015-01-09 14:35 Christos Zoulas * Fix multiple issues with date formats reported by Christoph Biedl: - T_LOCAL meaning was reversed - Arithmetic did not work Also stop adjusting daylight savings for gmt printing. 2015-01-05 13:00 Christos Zoulas * PR/411: Fix memory corruption from corrupt cdf file. @ text @d3 1 a3 1 # $File: apple,v 1.35 2016/08/17 09:45:13 christos Exp $ d68 4 a71 4 # URL: https://en.wikipedia.org/wiki/AppleWorks # Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx # Update: Joerg Jenderek # NOTE: d74 6 a79 36 # and/or look for unused bits of booleans bytes like zoom, paginated, mail merge # the newer AppleWorks is from claris with extension CWK 4 string O # test for unused bits of zoom- , paginated-boolean bytes >84 ubequad ^0x00Fe00000000Fe00 # look for tabstop definitions "=" no tab, "|" no tab # "<" left tab,"^" center tab,">" right tab, "." decimal tab, # unofficial "!" other , "\x8a" other # official only if SFMinVers is nonzero >>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor # AppleWorks Word Processor File (Apple II) # ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" # application/x-appleworks is mime type for claris version with cwk extension !:mime application/x-appleworks3 # http://home.earthlink.net/~hughhood/appleiiworksenvoy/ # ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') # $70 $1A $F8 $FF is this the apple type ? #:apple pdospøÿ !:ext awp # minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) >>>183 ubyte 30 3.0 >>>183 ubyte !30 >>>>183 ubyte !0 0x%x # usual tabstop start sequence "=====<" >>>5 string x \b, tabstop ruler "%6.6s" # tabstop ruler #>>>5 string >\0 \b, tabstops "%-79s" # zoom switch >>>85 byte&0x01 >0 \b, zoomed # whether paginated >>>90 byte&0x01 >0 \b, paginated # contains any mail-merge commands >>>92 byte&0x01 >0 \b, with mail merge # left margin in 1/10 inches ( normally 0 or 10 ) >>>91 ubyte >0 >>>>91 ubyte x \b, %d/10 inch left margin d258 1 a258 5 # Apple disk partition stuff # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map # Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h # Update: Joerg Jenderek # "ER" is APPLE_DRVR_MAP_MAGIC signature d260 1 a260 11 # display Apple Driver Map (strength=50) after Syslinux bootloader (71) #!:strength +0 # strengthen the magic by looking for used blocksizes 512 2048 >2 ubeshort&0xf1FF 0 Apple Driver Map # last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid #>>504 ubequad&0x0000FFffFFff0000 0 !:mime application/x-apple-diskimage !:apple ????devr # https://en.wikipedia.org/wiki/Apple_Disk_Image !:ext dmg/iso # sbBlkSize for driver descriptor map 512 2048 d262 16 a277 54 # sbBlkCount sometimes garbish like # 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg # 0xf2720100 for bunziped Firefox 48.0-2.dmg # 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso # 0x00009090 by syslinux-6.03/utils/isohybrid.c >>4 ubelong x \b, blockcount %u # following device/driver information not very useful # device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>8 ubeshort x \b, devtype %u # device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>10 ubeshort x \b, devid %u # driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>12 ubelong >0 >>>12 ubelong x \b, driver data %u # number of driver descriptors sbDrvrCount <= 61 # (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>16 ubeshort x \b, driver count %u # 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map # >>18 use apple-driver-map # >>26 use apple-driver-map # # ... # >>500 use apple-driver-map # number of partitions is always same in every partition (map block count) #>>0x0204 ubelong x \b, %u partitions >>0x0204 ubelong >0 \b, contains[@@0x200]: >>>0x0200 use apple-apm >>0x0204 ubelong >1 \b, contains[@@0x400]: >>>0x0400 use apple-apm >>0x0204 ubelong >2 \b, contains[@@0x600]: >>>0x0600 use apple-apm >>0x0204 ubelong >3 \b, contains[@@0x800]: >>>0x0800 use apple-apm >>0x0204 ubelong >4 \b, contains[@@0xA00]: >>>0x0A00 use apple-apm >>0x0204 ubelong >5 \b, contains[@@0xC00]: >>>0x0C00 use apple-apm >>0x0204 ubelong >6 \b, contains[@@0xE00]: >>>0x0E00 use apple-apm >>0x0204 ubelong >7 \b, contains[@@0x1000]: >>>0x1000 use apple-apm # display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 0 name apple-driver-map >0 ubequad !0 # descBlock first block of driver >>0 ubelong x \b, driver start block %u # descSize driver size in blocks >>4 ubeshort x \b, size %u # descType driver system type 1 701h F8FFh FFFFh >>6 ubeshort x \b, type 0x%x # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map # Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h # Update: Joerg Jenderek # Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the d279 20 a298 37 # for apple partition map stored as a single file 0 belong 0x504d0000 # to display Apple Partition Map (strength=70) after Syslinux bootloader (71) #!:strength +0 >0 use apple-apm # magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type # file: could not find any valid magic files! #!:ext bin # display apple partition map. Normally called after Apple driver map 0 name apple-apm >0 belong 0x504d0000 Apple Partition Map # number of partitions >>4 ubelong x \b, map block count %u # logical block (512 bytes) start of partition >>8 ubelong x \b, start block %u >>12 ubelong x \b, block count %u >>16 string >0 \b, name %s >>48 string >0 \b, type %s # processor type dpme_process_id[16] e.g. "68000" "68020" >>120 string >0 \b, processor %s # A/UX boot arguments BootArgs[128] >>136 string >0 \b, boot arguments %s # status of partition dpme_flags >>88 belong & 1 \b, valid >>88 belong & 2 \b, allocated >>88 belong & 4 \b, in use >>88 belong & 8 \b, has boot info >>88 belong & 16 \b, readable >>88 belong & 32 \b, writable >>88 belong & 64 \b, pic boot code >>88 belong & 128 \b, chain compatible driver >>88 belong & 256 \b, real driver >>88 belong & 512 \b, chain driver # mount automatically at startup APPLE_PS_AUTO_MOUNT >>88 ubelong &0x40000000 \b, mount at startup # is the startup partition APPLE_PS_STARTUP >>88 ubelong &0x80000000 \b, is the startup partition d300 1 a300 1 #http://wiki.mozilla.org/DS_Store_File_Format a302 32 # HFS/HFS+ Resource fork files (andrew.roazen@@nau.edu Apr 13 2015) # Usually not in separate files, but have either filename rsrc with # no extension, or a filename corresponding to another file, with # extensions rsr/rsrc 0 string \000\000\001\000 >4 leshort 0 >>16 lelong 0 Apple HFS/HFS+ resource fork #https://en.wikipedia.org/wiki/AppleScript 0 string FasdUAS AppleScript compiled # AppleWorks/ClarisWorks # https://github.com/joshenders/appleworks_format # http://fileformats.archiveteam.org/wiki/AppleWorks 0 name appleworks >0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document >0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document >0 default x >>0 belong x AppleWorks/ClarisWorks CWK Document >0 byte x \b, version %d >30 beshort x \b, %d >32 beshort x \bx%d !:ext cwk 4 string BOBO >0 byte >4 >>12 belong 0 >>>26 belong 0 >>>>0 use appleworks >0 belong 0x0481ad00 >>0 use appleworks @ 1.1.1.7 log @Import file-5.31; mostly oss-fuzz found bugs. @ text @d3 1 a3 1 # $File: apple,v 1.36 2017/03/17 21:35:28 christos Exp $ d70 1 a70 1 # Update: Joerg Jenderek d76 1 a76 1 4 string O d78 1 a78 1 >84 ubequad ^0x00Fe00000000Fe00 d95 1 a95 1 >>>183 ubyte !30 d97 1 a97 1 # usual tabstop start sequence "=====<" d108 1 a108 1 >>>91 ubyte >0 d143 1 a143 1 0 belong&0x00ff00ff 0x00080000 d149 1 a149 1 # d189 2 a190 2 # Note there might be some problems with the "VAX COFF executable" # entry. Note this entry should be placed before the mac filesystem section, d193 1 a193 1 # The intended meaning of these tests is, that the file is only of the d200 1 a200 1 # Note that this entry is recognized correctly by the "Apple Partition d291 1 a291 1 # Update: Joerg Jenderek d318 1 a318 1 >>12 ubelong >0 d330 1 a330 1 >>0x0204 ubelong >0 \b, contains[@@0x200]: d332 1 a332 1 >>0x0204 ubelong >1 \b, contains[@@0x400]: d334 1 a334 1 >>0x0204 ubelong >2 \b, contains[@@0x600]: d336 1 a336 1 >>0x0204 ubelong >3 \b, contains[@@0x800]: d338 1 a338 1 >>0x0204 ubelong >4 \b, contains[@@0xA00]: d340 1 a340 1 >>0x0204 ubelong >5 \b, contains[@@0xC00]: d342 1 a342 1 >>0x0204 ubelong >6 \b, contains[@@0xE00]: d344 1 a344 1 >>0x0204 ubelong >7 \b, contains[@@0x1000]: d348 2 a349 2 >0 ubequad !0 # descBlock first block of driver d358 1 a358 1 # Update: Joerg Jenderek d362 1 a362 1 0 belong 0x504d0000 d420 1 a420 1 >0 default x @ 1.1.1.8 log @2018-04-15 14:52 Christos Zoulas * release 5.33 2018-02-24 14:50 Christos Zoulas * extend the support for ${x?:} expansions for magic descriptions 2018-02-21 16:25 Christos Zoulas * add support for ${x?:} in mime types to handle pie binaries. 2017-11-03 9:23 Christos Zoulas * add support for negative offsets (offsets from the end of file) 2017-09-26 8:22 Christos Zoulas * close the file on error when writing magic (Steve Grubb) 2017-09-24 12:02 Christos Zoulas * seccomp support (Paul Moore) 2017-09-02 11:53 Christos Zoulas * release 5.32 2017-08-28 16:37 Christos Zoulas * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski) 2017-08-27 03:55 Christos Zoulas * Fix always true condition (Thomas Jarosch) 2017-05-24 17:30 Christos Zoulas * pickier parsing of numeric values in magic files. 2017-05-23 17:55 Christos Zoulas * PR/615 add magic_getflags() @ text @d3 1 a3 1 # $File: apple,v 1.39 2018/03/02 15:26:39 christos Exp $ a433 16 # magic for Apple File System (APFS) # from Alex Myczko 32 string NXSB Apple File System (APFS) >36 ulelong x \b, blocksize %u # iTunes cover art (versions 1 and 2) 4 string itch >24 string artw >>0x1e8 string data iTunes cover art >>>0x1ed string PNG (PNG) >>>0x1ec beshort 0xffd8 (JPEG) # MacPaint image 65 string PNTGMPNT MacPaint image data #0 belong 2 MacPaint image data @ 1.1.1.9 log @2019-05-14 22:26 Christos Zoulas * release 5.37 2019-05-09 22:27 Christos Zoulas * Make sure that continuation separators are printed with -k within softmagic 2019-05-06 22:27 Christos Zoulas * Change SIGPIPE saving and restoring during compression to use sigaction(2) instead of signal(3) and cache it. (Denys Vlasenko) * Cache stat(2) calls more to reduce number of calls (Denys Vlasenko) 2019-05-06 17:25 Christos Zoulas * PR/77: Handle --mime-type and -k correctly. 2019-05-03 15:26 Christos Zoulas * Switch decompression code to use vfork() because tools like rpmdiff and rpmbuild call libmagic with large process footprints (Denys Vlasenko) 2019-04-07 14:05 Christos Zoulas * PR/75: --enable-zlib, did not work. 2019-02-27 11:54 Christos Zoulas * Improve regex efficiency (Michael Schroeder) by: 1. Prefixing regex searches with regular search for keywords where possible 2. Using memmem(3) where available @ text @d3 1 a3 1 # $File: apple,v 1.43 2019/04/19 00:42:27 christos Exp $ a13 65 # Type: Apple Emulator WOZ format # From: Greg Wildman # Ref: https://applesaucefdc.com/woz/reference/ # Ref: https://applesaucefdc.com/woz/reference2/ # # Note: The following test are mostly identical. I would rather not # use a regex to identify the WOZ format number. 0 string WOZ1 >4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image >12 string INFO >>21 byte 01 \b, 5.25 inch >>21 byte 02 \b, 3.5 inch >>22 byte 01 \b, write protected >>23 byte 01 \b, cross track synchronized >>25 string/T x \b, %.32s 0 string WOZ2 >4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image >12 string INFO >>21 byte 01 \b, 5.25 inch >>21 byte 02 \b, 3.5 inch >>22 byte 01 \b, write protected >>23 byte 01 \b, cross track synchronized >>25 string/T x \b, %.32s # Type: Apple Emulator disk images # From: Greg Wildman # ProDOS boot loader? 0 string \x01\x38\xB0\x03\x4C Apple ProDOS Image # Detect Volume Directory block ($02) >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 leshort x \b, %u Blocks # ProDOS ordered ? >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 leshort x \b, %u Blocks # # DOS3.3 boot loader? 0 string \x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B >0x11001 string \x11\x0F\x03 Apple DOS 3.3 Image >>0x11006 byte x \b, Volume %u >>0x11034 byte x \b, %u Tracks >>0x11035 byte x \b, %u Sectors >>0x11036 leshort x \b, %u bytes per sector # DOS3.2 ? >0x11001 string \x11\x0C\x02 Apple DOS 3.2 Image >>0x11006 byte x \b, Volume %u >>0x11034 byte x \b, %u Tracks >>0x11035 byte x \b, %u Sectors >>0x11036 leshort x \b, %u bytes per sector # DOS3.1 ? >0x11001 string \x11\x0C\x01 >>0x11c00 string \x00\x11\x0B Apple DOS 3.1 Image # # Pascal boot loader? 0 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD >0xd6 pstring SYSTEM.APPLE >>0xb00 leshort 0x0000 >>>0xb04 leshort 0x0000 Apple Pascal Image >>>>0xb06 pstring x \b, Volume %s: >>>>0xb0e leshort x \b, %u Blocks >>>>0xb10 leshort x \b, %u Files d16 14 a29 24 # Update: Greg Wildman 0 string 2IMG Apple ][ 2IMG Disk Image >4 clear x >4 string XGS! \b, XGS >4 string CTKG \b, Catakig >4 string ShIm \b, Sheppy's ImageMaker >4 string SHEP \b, Sheppy's ImageMaker >4 string WOOF \b, Sweet 16 >4 string B2TR \b, Bernie ][ the Rescue >4 string \!nfc \b, ASIMOV2 >4 string \>BD\< \b, Brutal Deluxe's Cadius >4 string CdrP \b, CiderPress >4 string Vi][ \b, Virtual ][ >4 string PRFS \b, ProFUSE >4 string FISH \b, FishWings >4 string RVLW \b, Revival for Windows >4 default x >>4 string x \b, Creator tag "%-4.4s" >0xc byte 00 \b, DOS 3.3 sector order >>0x10 byte 00 \b, Volume 254 >>0x10 byte&0x7f x \b, Volume %u >0xc byte 01 \b, ProDOS sector order >>0x14 short x \b, %u Blocks >0xc byte 02 \b, NIB data d91 1 a91 1 #:apple pdosp^Z\xf8\xff d357 1 a357 1 # Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h d399 2 a400 2 #https://wiki.mozilla.org/DS_Store_File_Format #https://en.wikipedia.org/wiki/.DS_Store @ 1.1.1.10 log @Import 5.38: - Always accept -S (no sandbox) even if we don't support sandboxing - More syscalls elided for sandboxiing - For ELF dynamic means having an interpreter not just PT_DYNAMIC - Check for large ELF session header offset - When saving and restoring a locale, keep the locale name in our own storage. - Add a flag to disable CSV file detection. - Don't pass NULL/0 to memset to appease sanitizers. - Avoid spurious prints when looks for extensions or apple strings in fsmagic. - Add builtin decompressors for xz and and bzip. - Add a limit for the number of CDF elements. - More checks for overflow in CDF. @ text @d3 1 a3 1 # $File: apple,v 1.44 2019/10/18 15:21:02 christos Exp $ a77 8 # # Diversi Dos boot loader? 0 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD >0x11001 string \x11\x0F\x03 Apple Diversi Dos Image >>0x11006 byte x \b, Volume %u >>0x11034 byte x \b, %u Tracks >>0x11035 byte x \b, %u Sectors >>0x11036 leshort x \b, %u bytes per sector d82 23 a104 27 0 string 2IMG Apple ][ 2IMG Disk Image >4 clear x >4 string XGS! \b, XGS >4 string CTKG \b, Catakig >4 string ShIm \b, Sheppy's ImageMaker >4 string SHEP \b, Sheppy's ImageMaker >4 string WOOF \b, Sweet 16 >4 string B2TR \b, Bernie ][ the Rescue >4 string \!nfc \b, ASIMOV2 >4 string \>BD\< \b, Brutal Deluxe's Cadius >4 string CdrP \b, CiderPress >4 string Vi][ \b, Virtual ][ >4 string PRFS \b, ProFUSE >4 string FISH \b, FishWings >4 string RVLW \b, Revival for Windows >4 default x >>4 string x \b, Creator tag "%-4.4s" >0xc byte 00 \b, DOS 3.3 sector order >>0x10 byte 00 \b, Volume 254 >>0x10 byte&0x7f x \b, Volume %u >0xc byte 01 \b, ProDOS sector order # Detect Volume Directory block ($02) + 2mg header offset >>0x440 string \x00\x00\x03\x00 >>>0x444 byte &0xF0 >>>>0x445 string x \b, Volume /%s >>>>0x469 leshort x \b, %u Blocks >0xc byte 02 \b, NIB data @ 1.1.1.11 log @Import file-5.43+; last was file-5.40 2022-09-20 17:12 Christos Zoulas * fixed various clustefuzz issues 2022-09-19 15:54 Christos Zoulas * Fix error detection for decompression code (Vincent Mihalkovic) 2022-09-15 13:50 Christos Zoulas * Add MAGIC_NO_COMPRESS_FORK and use it to produce a more meaningful error message if we are sandboxing. 2022-09-15 10:45 Christos Zoulas * Add built-in lzip decompression support (Michal Gorny) 2022-09-14 10:35 Christos Zoulas * Add built-in zstd decompression support (Martin Rodriguez Reboredo) 2022-09-13 14:55 Christos Zoulas * release 5.43 2022-09-10 9:17 Christos Zoulas * Add octal indirect magic (Michal Gorny) 2022-08-17 11:43 Christos Zoulas * PR/374: avoid infinite loop in non-wide code (piru) * PR/373: Obey MAGIC_CONTINUE with multiple magic files (vismarli) 2022-07-26 11:10 Christos Zoulas * Fix bug with large flist (Florian Weimer) 2022-07-07 13:21 Christos Zoulas * PR/364: Detect non-nul-terminated core filenames from QEMU (mam-ableton) 2022-07-04 15:45 Christos Zoulas * PR/359: Add support for http://ndjson.org/ (darose) * PR/362: Fix wide printing (ro-ee) * PR/358: Fix width for -f - (jpalus) * PR/356: Fix JSON constant parsing (davewhite) 2022-06-10 9:40 Christos Zoulas * release 5.42 2022-05-31 14:50 Christos Zoulas * PR/348: add missing cases to prevent file from aborting on random magic files. 2022-05-27 21:05 Christos Zoulas * PR/351: octalify filenames when not raw before printing. 2022-04-18 17:51 Christos Zoulas * fix regex cacheing bug (Dirk Mueller) * merge file_regcomp and file_regerror() to simplify the code and reduce memory requirements for storing regexes (Dirk Mueller) 2022-03-19 12:56 Christos Zoulas * cache regex (Dirk Mueller) * detect filesystem full by flushing output (Dirk Mueller) 2021-11-19 12:36 Christos Zoulas * implement running decompressor programs using posix_spawnp(2) instead of vfork(2) 2021-10-24 11:51 Christos Zoulas * Add support for msdos dates and times 2021-10-20 9:55 Christos Zoulas * use the system byte swapping functions if available (Werner Fink) 2021-10-18 11:57 Christos Zoulas * release 5.41 2021-09-23 03:51 Christos Zoulas * Avinash Sonawane: Fix tzname detection 2021-09-03 09:17 Christos Zoulas * Fix relationship tests with "search" magic, don't short circuit logic 2021-07-13 01:06 Christos Zoulas * Fix memory leak in compile mode 2021-07-01 03:51 Christos Zoulas * PR/272: kiefermat: Only set returnval = 1 when we printed something (in all cases print or !print). This simplifies the logic and fixes the issue in the PR with -k and --mime-type there was no continuation printed before the default case. 2021-06-30 13:07 Christos Zoulas * PR/270: Don't translate unprintable characters in %s magic formats when -r * PR/269: Avoid undefined behavior with clang (adding offset to NULL) 2021-05-09 18:38 Christos Zoulas * Add a new flag (f) that requires that the match is a full word, not a partial word match. * Add varint types (unused) 2021-04-19 17:17 Christos Zoulas * PR/256: mutableVoid: If the file is less than 3 bytes, use the file length to determine type * PR/259: aleksandr.v.novichkov: mime printing through indirect magic is not taken into account, use match directly so that it does. 2021-04-04 17:02 Christos Zoulas * count the total bytes found not the total byte positions in order to determine encoding (Anatol Belski) @ text @d3 1 a3 1 # $File: apple,v 1.45 2021/04/26 15:56:00 christos Exp $ d183 1 a183 1 >>>>183 ubyte !0 %#x d302 1 a302 1 >6 byte x \bCoreFoundation binary property list data, version %#c d361 1 a361 1 >12 belong >0 flags %#x d441 1 a441 1 >>6 ubeshort x \b, type %#x @ 1.1.1.12 log @Update to file-5.45 (Last was file-5.44) 2023-07-27 15:45 Christos Zoulas * release 5.45 2023-07-17 11:53 Christos Zoulas * PR/465: psrok1: Avoid muslc asctime_r crash 2023-05-21 13:05 Christos Zoulas * add SIMH tape format support 2023-02-09 12:50 Christos Zoulas * bump the max size of the elf section notes to be read to 128K and make it configurable 2023-01-08 1:08 Christos Zoulas * PR/415: Fix decompression with program returning empty 2022-12-26 1:47 Christos Zoulas * PR/408: fix -p with seccomp * PR/412: fix MinGW compilation @ text @d3 1 a3 1 # $File: apple,v 1.48 2023/05/01 14:20:21 christos Exp $ a13 19 # Type: Apple Emulator A2R format # From: Greg Wildman # Ref: https://applesaucefdc.com/a2r2-reference/ # Ref: https://applesaucefdc.com/a2r/ 0 string A2R >3 string \x31\xFF\x0A\x0D\x0A Applesauce A2R 1.x Disk Image >3 string \x32\xFF\x0A\x0D\x0A Applesauce A2R 2.x Disk Image >3 string \x33\xFF\x0A\x0D\x0A Applesauce A2R 3.x Disk Image >8 string INFO >>49 byte 01 \b, 5.25″ SS 40trk >>49 byte 02 \b, 3.5″ DS 80trk >>49 byte 03 \b, 5.25″ DS 80trk >>49 byte 04 \b, 5.25″ DS 40trk >>49 byte 05 \b, 3.5″ DS 80trk >>49 byte 06 \b, 8″ DS >>50 byte 01 \b, write protected >>51 byte 01 \b, cross track synchronized >>17 string/T x \b, %.32s d18 5 a22 3 0 string WOZ >3 string \x31\xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image >3 string \x32\xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image d29 2 a30 6 # Type: Apple Macintosh Emulator MOOF format # From: Greg Wildman # Ref: https://applesaucefdc.com/moof-reference/ 0 string MOOF >4 string \xFF\x0A\x0D\x0A Apple Macintosh MOOF Disk Image d32 2 a33 3 >>21 byte 01 \b, SSDD GCR (400K) >>21 byte 02 \b, DSDD GCR (800K) >>21 byte 03 \b, DSHD MFM (1.44M) d46 1 a46 1 >>>0x429 uleshort x \b, %u Blocks d51 1 a51 1 >>>0xb29 uleshort x \b, %u Blocks d53 16 a68 66 # Proboot HD 0 string \x01\x8A\x48\xD8\x2C\x82\xC0\x8D\x0E\xC0\x8D\x0C Apple ProDOS ProBoot Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks 0 string \x01\xA8\x8A\x20\x7B\xF8\x29\x07\x09\xC0\x99\x30 Apple ProDOS ProBoot Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks 0 string \x01\x4A\xD0\x34\xE6\x3D\x8A\x20\x7B\xF8\x09\xC0 Apple ProDOS ProBoot Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks # # ProDOS formatted 0 string \x01\xBD\x88\xC0\x20\x2F\xFB\x20\x58\xFC\x20\x40 Apple ProDOS Unbootable Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks 0 string \x01\x38\xB0\x03\x4C\x1C\x09\x78\x86\x43\xC9\x03 Apple ProDOS Unbootable Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks # # DOS3 boot loader 0 string \x01\xA5\x27\xC9\x09\xD0 >0x11001 byte 0x11 >>0x11003 ubyte x Apple DOS 3.%u Image >>0x11006 ubyte x \b, Volume #%03u >>0x11034 ubyte x \b, %u Tracks >>0x11035 ubyte x \b, %u Sectors >>0x11036 uleshort x \b, %u bytes per sector # # DOS3 uninitialized disk 0 string \x01\xA6\x2B\xBD\x88\xC0\x8A\x4A\x4A >0x11001 byte 0x11 >>0x11003 ubyte x Apple DOS 3.%u Unbootable Image >>>0x11006 ubyte x \b, Volume #%03u >>>0x11034 ubyte x \b, %u Tracks >>>0x11035 ubyte x \b, %u Sectors >>>0x11036 uleshort x \b, %u bytes per sector d115 1 a115 1 >>>>0x469 uleshort x \b, %u Blocks a117 61 # Type: Peter Ferrie QBoot # From: Greg Wildman # Ref: https://github.com/peterferrie/qboot 0 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9 >8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ QBoot Image # Type: Peter Ferrie 0Boot # From: Greg Wildman # Ref: https://github.com/peterferrie/0boot 0 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9 >8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ 0Boot Image # Different proprietary boot sectors 0 string \x01\x0F\x21\x74\x00\x01\x6B\x00\x02\x30\x81\x5D Apple ][ Disk Image 0 string \x01\x20\x58\xFC\xA2\x00\x8E\x78\x04\x8E\xF4\x03 Apple ][ Disk Image 0 string \x01\x20\x58\xFC\xAD\x51\xC0\xAD\x54\xC0\xA6\x2B Apple ][ Disk Image 0 string \x01\x20\x89\xFE\x20\x93\xFE\xA6\x2B\xBD\x88\xC0 Apple ][ Disk Image 0 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x25\x08\x68\x85 Apple ][ Disk Image 0 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x2D\x08\x68\x85 Apple ][ Disk Image 0 string \x01\x38\x90\x2A\xC9\x01\xF0\x33\xA8\xC8\xC0\x10 Apple ][ Disk Image 0 string \x01\x38\xB0\x03\x4C\x32\xA1\x87\x43\xC9\x03\x08 Apple ][ Disk Image 0 string \x01\x4C\x04\x08\xA9\x2A\x8D\x02\x08\x86\x2B\xEE Apple ][ Disk Image 0 string \x01\x4C\x60\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image 0 string \x01\x4C\x92\x08\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image 0 string \x01\x4C\xB3\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image 0 string \x01\x8D\xFB\x03\x8E\xFC\x03\x8C\xFD\x03\x8A\x29 Apple ][ Disk Image 0 string \x01\xA2\xFF\x9A\xD8\x20\x20\x08\x20\x34\x08\xAD Apple ][ Disk Image 0 string \x01\xA5\x27\xBD\x88\xC0\x2C\x10\xC0\xA2\x00\xA9 Apple ][ Disk Image 0 string \x01\xA5\x2B\xAE\x51\xC0\xEA\xAA\xBD\x88\xC0\x20 Apple ][ Disk Image 0 string \x01\xA6\x27\xBD\x0B\x08\x48\xBD\x0A\x08\x48\x85 Apple ][ Disk Image 0 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x01\x85 Apple ][ Disk Image 0 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x25\x85 Apple ][ Disk Image 0 string \x01\xA8\xC0\x0F\x90\x16\xF0\x12\xA0\xFF\x18\xAD Apple ][ Disk Image 0 string \x01\xA9\x00\x85\xF0\xA9\x04\x85\xF1\xA0\x00\xA9 Apple ][ Disk Image 0 string \x01\xA9\x5C\x8D\xF2\x03\xA9\xC6\x8D\xF3\x03\x49 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\x20\x2F\xFB\x20\x58\xFC Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\x20\x49\x08\xA9\x0A\x85 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\x2C\x82\xC0\xBD\x88\xC0 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\x86\x43\x8A\x4A\x4A\x4A Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\x86\xFF\xB5\x00 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\xA9\xB2\x8D\xF2\x03\xA9 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\xA9\xFF\x8D\xF3\x03\x8D Apple ][ Disk Image 0 string \x01\xAC\x00\x08\xF0\x19\xB9\x30\x08\x85\x3D\xCE Apple ][ Disk Image 0 string \x01\xAC\x23\x08\x30\x2E\xB9\x24\x08\x85\x3D\xCE Apple ][ Disk Image 0 string \x01\xAD\x00\x08\xC9\x09\xB0\x20\x69\x02\x8D\x00 Apple ][ Disk Image 0 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\x86\x2B\x8A\x4A Apple ][ Disk Image 0 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\xA9\xF5\x8D\xF2 Apple ][ Disk Image 0 string \x01\xB0\x00\xA9\x3F\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image 0 string \x01\xB0\x00\xA9\x48\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image 0 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x09\xC0\x8D Apple ][ Disk Image 0 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x8D\x2F\x08 Apple ][ Disk Image 0 string \x01\xD8\x2C\x81\xC0\xA9\x60\x4D\x58\xFF\xD0\xFE Apple ][ Disk Image 0 string \x01\xD8\x78\xBD\x88\xC0\xA9\xFD\x85\x37\x85\x39 Apple ][ Disk Image 0 string \x01\xE0\x60\xF0\x03\x4C\x16\x09\xAD\x00\x08\xC9 Apple ][ Disk Image 0 string \x01\xE0\x60\xF0\x03\x4C\xCB\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 0 string \x01\xE0\x60\xF0\x03\x4C\xEE\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 0 string \x01\xE0\x60\xF0\x03\x4C\xEF\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 0 string \x01\xE0\x70\xB0\x04\xE0\x40\xB0\x39\xBD\x88\xC0 Apple ][ Disk Image 0 string \x01\xEA\x8D\xF4\x03\xA9\x60\x9D\x88\xC0\x8D\x51 Apple ][ Disk Image a293 5 # From https://www.nationalarchives.gov.uk/pronom/fmt/866 0 string bplist00 >8 search/500 WebMainResource Apple Safari Webarchive !:mime application/x-webarchive !:strength +50 a294 1 !:mime application/x-bplist a493 8 # URL: http://fileformats.archiveteam.org/wiki/Macintosh_resource_file # https://en.wikipedia.org/wiki/Resource_fork # Reference: https://github.com/kreativekorp/ksfl/wiki/Macintosh-Resource-File-Format # http://developer.apple.com/legacy/mac/library/documentation/mac/pdf/MoreMacintoshToolbox.pdf # https://formats.kaitai.io/resource_fork/ # Update: Joerg Jenderek # Note: verified often by command like `deark -m macrsrc Icon_.rsrc` # offset of resource data; usually starts at offset 0x0100 d495 2 a496 92 # skip NPETraceSession.etl with invalid "low" map offset 0 >4 ubelong >0xFF # skip few Atari DEGAS Elite bitmap (eil2.pi1 nastro.pi1) with ivalid "high" 0x6550766 0x7510763 map length >>12 ubelong <0x8001 # most examples with zeroed system reserved field >>>16 lelong =0 >>>>0 use apple-rsr # few samples with not zeroed system reserved field like: Empty.rsrc.rsr OpenSans-CondBold.dfont >>>16 lelong !0 # resource fork variant with not zeroed system reserved field and copy of header >>>>(4.L) ubelong 0x100 # GRR: the line above only works if in ../../src/file.h FILE_BYTES_MAX is raised from 1 MiB above 0x6ab0f4 (HelveticaNeue.dfont) >>>>>0 use apple-rsr # data fork variant with not zeroed system reserved field and no copy of header >>>>(4.L) ubelong 0 >>>>>0 use apple-rsr # Note: moved and merged from ./macintosh # From: Adam Buchbinder # URL: https://en.wikipedia.org/wiki/Datafork_TrueType # Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is # TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I # don't know what they mean. # display information about Mac OSX datafork font DFONT 0 name apple-dfont >(4.L+30) ubelong x Mac OSX datafork font, # https://en.wikipedia.org/wiki/Datafork_TrueType !:mime application/x-dfont !:ext dfont # https://exiftool.org/TagNames/RSRC.html >(4.L+30) ubelong 0x73666e74 TrueType >(4.L+30) ubelong 0x464f4e54 'FONT' >(4.L+30) ubelong 0x4e464e54 'NFNT' >(4.L+30) ubelong 0x504f5354 PostScript >(4.L+30) ubelong 0x464f4e44 'FOND' >(4.L+30) ubelong 0x76657273 'vers' # display information about Macintosh resource 0 name apple-rsr >(4.L+30) ubelong 0x73666e74 >>0 use apple-dfont >(4.L+30) ubelong 0x464f4e54 >>0 use apple-dfont >(4.L+30) ubelong 0x4e464e54 >>0 use apple-dfont >(4.L+30) ubelong 0x504f5354 >>0 use apple-dfont >(4.L+30) ubelong 0x464f4e44 >>0 use apple-dfont >(4.L+30) ubelong 0x76657273 >>0 use apple-dfont >(4.L+30) default x Apple HFS/HFS+ resource fork #!:mime application/octet-stream !:mime application/x-apple-rsr !:ext rsrc/rsr # offset to resource data; usually starts at offset 0x0100 >0 ubelong !0x100 \b, data offset %#x # offset to resource map; positive but not nil like in NPETraceSession.etl >4 ubelong x \b, map offset %#x # length of resource map; positive with 32K limitation but not # nil like in NPETraceSession.etl or high like 0x7510763 in nastro.pi1 >12 ubelong x \b, map length %#x # length of resource data; positive but not nil like in NPETraceSession.etl >8 ubelong x \b, data length %#x # reserved 112 bytes for system use; apparently often nil, but 8fd20000h in Empty.rsrc.rsr and 0x00768c2b in OpenSans-CondBold.dfont >16 ubelong !0 \b, at 16 %#8.8x # https://fontforge.org/docs/techref/macformats.html # jump to resource map # a copy of resource header or 16 bytes of zeros for data fork #>(4.L) ubelong x \b, DATA offset %#x #>(4.L+4) ubelong x \b, MAP offset %#x #>(4.L+8) ubelong x \b, DATA length %#x #>(4.L+12) ubelong x \b, MAP length %#x # nextResourceMap; handle to next resource map; used by the Resource Manager for internal bookkeeping; should be zero >(4.L+16) ubelong !0 \b, nextResourceMap %#x # fileRef; file reference number; used by the Resource Manager for internal bookkeeping; should be zero >(4.L+20) ubeshort !0 \b, fileRef %#x # attributes; Resource fork attributes (80h~read-only 40h~compression needed 20h~changed); other bits are reserved and should be zero >(4.L+22) ubeshort !0 \b, attributes %#x # typeListOffset; offset from resource map to start of type list like: 1Ch >(4.L+24) ubeshort x \b, list offset %#x # nameListOffset; offset from esource map to start of name list like: 32h 46h 56h (XLISP.RSR XLISPTIN.RSR) 13Eh (HelveticaNeue.dfont) >(4.L+26) ubeshort x \b, name offset %#x # typeCount; number of types in the map minus 1; If there are no resources, this is 0xFFFF >(4.L+28) beshort+1 >0 \b, %u type # plural s >>(4.L+28) beshort+1 >1 \bs # resource type list array; 1st resource type like: ALRT CODE FOND MPSR icns scsz >>(4.L+30) ubelong x \b, %#x >>(4.L+30) string x '%-.4s' # resourceCount; number of this type resources minus one. If there is one resource of this type, this is 0x0000 >>(4.L+34) beshort+1 x * %d # resourceListOffset; offset from type list to resource list like: Ah 12h DAh >(4.L+36) ubeshort x resource offset %#x @ 1.1.1.2.4.1 log @sync with head @ text @d3 1 a3 1 # $File: apple,v 1.25 2012/04/06 21:18:09 christos Exp $ a251 42 # Apple disk partition stuff, strengthen the magic using byte 4 0 beshort 0x4552 >4 byte 0 Apple Driver Map >>2 beshort x \b, blocksize %d >>4 belong x \b, blockcount %d >>10 beshort x \b, devtype %d >>12 beshort x \b, devid %d >>20 beshort x \b, descriptors %d # Assume 8 partitions each at a multiple of the sector size. # We could glean this from the partition descriptors, but they are empty!?!? >>(2.S*1) indirect \b, contains[@@0x%x]: >>(2.S*2) indirect \b, contains[@@0x%x]: >>(2.S*3) indirect \b, contains[@@0x%x]: >>(2.S*4) indirect \b, contains[@@0x%x]: >>(2.S*5) indirect \b, contains[@@0x%x]: >>(2.S*6) indirect \b, contains[@@0x%x]: >>(2.S*7) indirect \b, contains[@@0x%x]: >>(2.S*8) indirect \b, contains[@@0x%x]: # Yes, the 3rd and 4th bytes are reserved, but we use them to make the # magic stronger. 0 belong 0x504d0000 Apple Partition Map >4 belong x \b, map block count %d >8 belong x \b, start block %d >12 belong x \b, block count %d >16 string >0 \b, name %s >48 string >0 \b, type %s >124 string >0 \b, processor %s >140 string >0 \b, boot arguments %s >92 belong & 1 \b, valid >92 belong & 2 \b, allocated >92 belong & 4 \b, in use >92 belong & 8 \b, has boot info >92 belong & 16 \b, readable >92 belong & 32 \b, writable >92 belong & 64 \b, pic boot code >92 belong & 128 \b, chain compatible driver >92 belong & 256 \b, real driver >92 belong & 512 \b, chain driver >92 belong & 1024 \b, mount at startup >92 belong & 2048 \b, is the startup partition @ 1.1.1.2.4.2 log @sync with head @ text @d3 1 a3 1 # $File: apple,v 1.26 2012/12/27 15:43:23 christos Exp $ a293 4 #http://wiki.mozilla.org/DS_Store_File_Format` #http://en.wikipedia.org/wiki/.DS_Store 0 string \0\0\0\1Bud1\0 Apple Desktop Services Store @ 1.1.1.2.4.3 log @sync with head. for a reference, the tree before this commit was tagged as yamt-pagecache-tag8. this commit was splitted into small chunks to avoid a limitation of cvs. ("Protocol error: too many arguments") @ text @d3 1 a3 1 # $File: apple,v 1.27 2013/03/09 22:36:00 christos Exp $ a108 1 # update by Joerg Jenderek at Feb 2013 d110 1 a110 5 # GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) #0 belong&0xff00ff 0x80000 Applesoft BASIC program data 0 belong&0x00ff00ff 0x00080000 # assuming that line number must be positive >2 leshort >0 Applesoft BASIC program data, first line number %d @ 1.1.1.1.2.1 log @file apple was added on branch jym-xensuspend on 2009-05-13 18:51:54 +0000 @ text @d1 249 @ 1.1.1.1.2.2 log @Sync with HEAD. Second commit. See http://mail-index.netbsd.org/source-changes/2009/05/13/msg221222.html @ text @a0 249 #------------------------------------------------------------------------------ # apple: file(1) magic for Apple file formats # 0 search/1 FiLeStArTfIlEsTaRt binscii (apple ][) text 0 string \x0aGL Binary II (apple ][) data 0 string \x76\xff Squeezed (apple ][) data 0 string NuFile NuFile archive (apple ][) data 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 0 belong 0x00051600 AppleSingle encoded Macintosh file 0 belong 0x00051607 AppleDouble encoded Macintosh file # Type: Apple Emulator 2IMG format # From: Radek Vokal 0 string 2IMG Apple ][ 2IMG Disk Image >4 string XGS! \b, XGS >4 string CTKG \b, Catakig >4 string ShIm \b, Sheppy's ImageMaker >4 string WOOF \b, Sweet 16 >4 string B2TR \b, Bernie ][ the Rescue >4 string !nfc \b, ASIMOV2 >4 string x \b, Unknown Format >0xc byte 00 \b, DOS 3.3 sector order >>0x10 byte 00 \b, Volume 254 >>0x10 byte&0x7f x \b, Volume %u >0xc byte 01 \b, ProDOS sector order >>0x14 short x \b, %u Blocks >0xc byte 02 \b, NIB data # magic for Newton PDA package formats # from Ruda Moura 0 string package0 Newton package, NOS 1.x, >12 belong &0x80000000 AutoRemove, >12 belong &0x40000000 CopyProtect, >12 belong &0x10000000 NoCompression, >12 belong &0x04000000 Relocation, >12 belong &0x02000000 UseFasterCompression, >16 belong x version %d 0 string package1 Newton package, NOS 2.x, >12 belong &0x80000000 AutoRemove, >12 belong &0x40000000 CopyProtect, >12 belong &0x10000000 NoCompression, >12 belong &0x04000000 Relocation, >12 belong &0x02000000 UseFasterCompression, >16 belong x version %d 0 string package4 Newton package, >8 byte 8 NOS 1.x, >8 byte 9 NOS 2.x, >12 belong &0x80000000 AutoRemove, >12 belong &0x40000000 CopyProtect, >12 belong &0x10000000 NoCompression, # The following entries for the Apple II are for files that have # been transferred as raw binary data from an Apple, without having # been encapsulated by any of the above archivers. # # In general, Apple II formats are hard to identify because Apple DOS # and especially Apple ProDOS have strong typing in the file system and # therefore programmers never felt much need to include type information # in the files themselves. # # Eric Fischer # AppleWorks word processor: # # This matches the standard tab stops for an AppleWorks file, but if # a file has a tab stop set in the first four columns this will fail. # # The "O" is really the magic number, but that's so common that it's # necessary to check the tab stops that follow it to avoid false positives. 4 string O==== AppleWorks word processor data >85 byte&0x01 >0 \b, zoomed >90 byte&0x01 >0 \b, paginated >92 byte&0x01 >0 \b, with mail merge #>91 byte x \b, left margin %d # AppleWorks database: # # This isn't really a magic number, but it's the closest thing to one # that I could find. The 1 and 2 really mean "order in which you defined # categories" and "left to right, top to bottom," respectively; the D and R # mean that the cursor should move either down or right when you press Return. #30 string \x01D AppleWorks database data #30 string \x02D AppleWorks database data #30 string \x01R AppleWorks database data #30 string \x02R AppleWorks database data # AppleWorks spreadsheet: # # Likewise, this isn't really meant as a magic number. The R or C means # row- or column-order recalculation; the A or M means automatic or manual # recalculation. #131 string RA AppleWorks spreadsheet data #131 string RM AppleWorks spreadsheet data #131 string CA AppleWorks spreadsheet data #131 string CM AppleWorks spreadsheet data # Applesoft BASIC: # # This is incredibly sloppy, but will be true if the program was # written at its usual memory location of 2048 and its first line # number is less than 256. Yuck. 0 belong&0xff00ff 0x80000 Applesoft BASIC program data #>2 leshort x \b, first line number %d # ORCA/EZ assembler: # # This will not identify ORCA/M source files, since those have # some sort of date code instead of the two zero bytes at 6 and 7 # XXX Conflicts with ELF #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data #>5 byte x \b, build number %d # Broderbund Fantavision # # I don't know what these values really mean, but they seem to recur. # Will they cause too many conflicts? # Probably :-) #2 belong&0xFF00FF 0x040008 Fantavision movie data # Some attempts at images. # # These are actually just bit-for-bit dumps of the frame buffer, so # there's really no reasonably way to distinguish them except for their # address (if preserved) -- 8192 or 16384 -- and their length -- 8192 # or, occasionally, 8184. # # Nevertheless this will manage to catch a lot of images that happen # to have a solid-colored line at the bottom of the screen. # GRR: Magic too weak #8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background #8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background #8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background #8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background #8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background # Beagle Bros. Apple Mechanic fonts 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font # Apple Universal Disk Image Format (UDIF) - dmg files. # From Johan Gade. # These entries are disabled for now until we fix the following issues. # # Note there might be some problems with the "VAX COFF executable" # entry. Note this entry should be placed before the mac filesystem section, # particularly the "Apple Partition data" entry. # # The intended meaning of these tests is, that the file is only of the # specified type if both of the lines are correct - i.e. if the first # line matches and the second doesn't then it is not of that type. # #0 long 0x7801730d #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) # # Note that this entry is recognized correctly by the "Apple Partition # data" entry - however since this entry is more specific - this # information seems to be more useful. #0 long 0x45520200 #>0x410 string disk\ image UDIF read/write image (UDRW) # From: Toby Peterson 0 string bplist00 Apple binary property list # Apple binary property list (bplist) # Assumes version bytes are hex. # Provides content hints for version 0 files. Assumes that the root # object is the first object (true for CoreFoundation implementation). # From: David Remahl 0 string bplist >6 byte x \bCoreFoundation binary property list data, version 0x%c >>7 byte x \b%c >6 string 00 \b >>8 byte&0xF0 0x00 \b >>>8 byte&0x0F 0x00 \b, root type: null >>>8 byte&0x0F 0x08 \b, root type: false boolean >>>8 byte&0x0F 0x09 \b, root type: true boolean >>8 byte&0xF0 0x10 \b, root type: integer >>8 byte&0xF0 0x20 \b, root type: real >>8 byte&0xF0 0x30 \b, root type: date >>8 byte&0xF0 0x40 \b, root type: data >>8 byte&0xF0 0x50 \b, root type: ascii string >>8 byte&0xF0 0x60 \b, root type: unicode string >>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) >>8 byte&0xF0 0xa0 \b, root type: array >>8 byte&0xF0 0xd0 \b, root type: dictionary # Apple/NeXT typedstream data # Serialization format used by NeXT and Apple for various # purposes in YellowStep/Cocoa, including some nib files. # From: David Remahl 2 string typedstream NeXT/Apple typedstream data, big endian >0 byte x \b, version %hhd >0 byte <5 \b >>13 byte 0x81 \b >>>14 ubeshort x \b, system %hd 2 string streamtyped NeXT/Apple typedstream data, little endian >0 byte x \b, version %hhd >0 byte <5 \b >>13 byte 0x81 \b >>>14 uleshort x \b, system %hd #------------------------------------------------------------------------------ # CAF: Apple CoreAudio File Format # # Container format for high-end audio purposes. # From: David Remahl # 0 string caff CoreAudio Format audio file >4 beshort <10 version %d >6 beshort x #------------------------------------------------------------------------------ # Keychain database files 0 string kych Mac OS X Keychain File #------------------------------------------------------------------------------ # Code Signing related file types 0 belong 0xfade0c00 Mac OS X Code Requirement >8 belong 1 (opExpr) >4 belong x - %d bytes 0 belong 0xfade0c01 Mac OS X Code Requirement Set >8 belong >1 containing %d items >4 belong x - %d bytes 0 belong 0xfade0c02 Mac OS X Code Directory >8 belong x version %x >12 belong >0 flags 0x%x >4 belong x - %d bytes 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) >4 belong x - %d bytes 0 belong 0xfade0cc1 Mac OS X Detached Code Signature >8 belong >1 (%d elements) >4 belong x - %d bytes # From: "Nelson A. de Oliveira" # .vdi 4 string innotek\ VirtualBox\ Disk\ Image %s @