head 1.22; access; symbols netbsd-11-0-RC4:1.22 netbsd-11-0-RC3:1.22 netbsd-11-0-RC2:1.22 netbsd-11-0-RC1:1.22 perseant-exfatfs-base-20250801:1.22 netbsd-11:1.22.0.4 netbsd-11-base:1.22 netbsd-10-1-RELEASE:1.21 perseant-exfatfs-base-20240630:1.22 perseant-exfatfs:1.22.0.2 perseant-exfatfs-base:1.22 netbsd-8-3-RELEASE:1.12 netbsd-9-4-RELEASE:1.15 netbsd-10-0-RELEASE:1.21 netbsd-10-0-RC6:1.21 netbsd-10-0-RC5:1.21 netbsd-10-0-RC4:1.21 netbsd-10-0-RC3:1.21 netbsd-10-0-RC2:1.21 netbsd-10-0-RC1:1.21 FILE5_45:1.1.1.18 netbsd-10:1.21.0.2 netbsd-10-base:1.21 FILE5_43:1.1.1.17 netbsd-9-3-RELEASE:1.15 cjep_sun2x-base1:1.18 cjep_sun2x:1.18.0.4 cjep_sun2x-base:1.18 cjep_staticlib_x-base1:1.18 netbsd-9-2-RELEASE:1.15 cjep_staticlib_x:1.18.0.2 cjep_staticlib_x-base:1.18 FILE5_40:1.1.1.16 netbsd-9-1-RELEASE:1.15 FILE5_39:1.1.1.15 phil-wifi-20200421:1.16 phil-wifi-20200411:1.16 is-mlppp:1.16.0.2 is-mlppp-base:1.16 phil-wifi-20200406:1.16 netbsd-8-2-RELEASE:1.12 netbsd-9-0-RELEASE:1.15 netbsd-9-0-RC2:1.15 FILE5_38:1.1.1.14 netbsd-9-0-RC1:1.15 phil-wifi-20191119:1.15 netbsd-9:1.15.0.2 netbsd-9-base:1.15 phil-wifi-20190609:1.15 netbsd-8-1-RELEASE:1.12 FILE5_37:1.1.1.13 netbsd-8-1-RC1:1.12 pgoyette-compat-merge-20190127:1.13.2.1 pgoyette-compat-20190127:1.14 pgoyette-compat-20190118:1.14 pgoyette-compat-1226:1.14 pgoyette-compat-1126:1.14 pgoyette-compat-1020:1.14 FILE5_35:1.1.1.12 pgoyette-compat-0930:1.14 pgoyette-compat-0906:1.14 netbsd-7-2-RELEASE:1.8 pgoyette-compat-0728:1.14 netbsd-8-0-RELEASE:1.12 phil-wifi:1.14.0.2 phil-wifi-base:1.14 pgoyette-compat-0625:1.14 netbsd-8-0-RC2:1.12 pgoyette-compat-0521:1.14 pgoyette-compat-0502:1.14 pgoyette-compat-0422:1.14 netbsd-8-0-RC1:1.12 FILE5_33:1.1.1.12 pgoyette-compat-0415:1.13 pgoyette-compat-0407:1.13 pgoyette-compat-0330:1.13 pgoyette-compat-0322:1.13 pgoyette-compat-0315:1.13 netbsd-7-1-2-RELEASE:1.8 pgoyette-compat:1.13.0.2 pgoyette-compat-base:1.13 netbsd-7-1-1-RELEASE:1.8 matt-nb8-mediatek:1.12.0.6 matt-nb8-mediatek-base:1.12 FILE5_32:1.1.1.11 perseant-stdc-iso10646:1.12.0.4 perseant-stdc-iso10646-base:1.12 netbsd-8:1.12.0.2 netbsd-8-base:1.12 FILE5_31:1.1.1.10 prg-localcount2-base3:1.11 prg-localcount2-base2:1.11 prg-localcount2-base1:1.11 prg-localcount2:1.11.0.2 prg-localcount2-base:1.11 pgoyette-localcount-20170426:1.11 bouyer-socketcan-base1:1.11 pgoyette-localcount-20170320:1.11 netbsd-7-1:1.8.0.8 netbsd-7-1-RELEASE:1.8 netbsd-7-1-RC2:1.8 FILE5_30:1.1.1.9 netbsd-7-nhusb-base-20170116:1.8 bouyer-socketcan:1.10.0.4 bouyer-socketcan-base:1.10 pgoyette-localcount-20170107:1.10 netbsd-7-1-RC1:1.8 pgoyette-localcount-20161104:1.10 netbsd-7-0-2-RELEASE:1.8 localcount-20160914:1.10 netbsd-7-nhusb:1.8.0.6 netbsd-7-nhusb-base:1.8 pgoyette-localcount-20160806:1.10 pgoyette-localcount-20160726:1.10 pgoyette-localcount:1.10.0.2 pgoyette-localcount-base:1.10 netbsd-7-0-1-RELEASE:1.8 netbsd-7-0:1.8.0.4 netbsd-7-0-RELEASE:1.8 netbsd-7-0-RC3:1.8 netbsd-7-0-RC2:1.8 netbsd-7-0-RC1:1.8 FILE5_22:1.1.1.8 FILE5_20:1.1.1.7 netbsd-6-0-6-RELEASE:1.4 netbsd-6-1-5-RELEASE:1.4 netbsd-7:1.8.0.2 netbsd-7-base:1.8 FILE5_19:1.1.1.6 yamt-pagecache-base9:1.7 yamt-pagecache-tag8:1.4.4.1 netbsd-6-1-4-RELEASE:1.4 netbsd-6-0-5-RELEASE:1.4 tls-earlyentropy:1.7.0.2 tls-earlyentropy-base:1.8 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.7 riastradh-drm2-base3:1.7 netbsd-6-1-3-RELEASE:1.4 netbsd-6-0-4-RELEASE:1.4 FILE5_16:1.1.1.5 netbsd-6-1-2-RELEASE:1.4 netbsd-6-0-3-RELEASE:1.4 netbsd-6-1-1-RELEASE:1.4 riastradh-drm2-base2:1.6 riastradh-drm2-base1:1.6 riastradh-drm2:1.6.0.6 riastradh-drm2-base:1.6 netbsd-6-1:1.4.0.14 netbsd-6-0-2-RELEASE:1.4 netbsd-6-1-RELEASE:1.4 khorben-n900:1.6.0.4 netbsd-6-1-RC4:1.4 netbsd-6-1-RC3:1.4 agc-symver:1.6.0.2 agc-symver-base:1.6 FILE5_14:1.1.1.4 netbsd-6-1-RC2:1.4 netbsd-6-1-RC1:1.4 yamt-pagecache-base8:1.5 FILE_5_12:1.1.1.3 netbsd-6-0-1-RELEASE:1.4 yamt-pagecache-base7:1.4 matt-nb6-plus-nbase:1.4 yamt-pagecache-base6:1.4 netbsd-6-0:1.4.0.12 netbsd-6-0-RELEASE:1.4 netbsd-6-0-RC2:1.4 tls-maxphys:1.4.0.10 tls-maxphys-base:1.8 matt-nb6-plus:1.4.0.8 matt-nb6-plus-base:1.4 netbsd-6-0-RC1:1.4 yamt-pagecache-base5:1.4 yamt-pagecache-base4:1.4 FILE5_11:1.1.1.2 netbsd-6:1.4.0.6 netbsd-6-base:1.4 yamt-pagecache-base3:1.4 yamt-pagecache-base2:1.4 yamt-pagecache:1.4.0.4 yamt-pagecache-base:1.4 FILE5_09:1.1.1.2 cherry-xenmp:1.4.0.2 cherry-xenmp-base:1.4 FILE5_07:1.1.1.2 bouyer-quota2-nbase:1.3 bouyer-quota2:1.3.0.2 bouyer-quota2-base:1.3 matt-mips64-premerge-20101231:1.3 matt-premerge-20091211:1.2 jym-xensuspend-base:1.2 jym-xensuspend:1.2.0.2 jym-xensuspend-nbase:1.2 FILE5_03:1.1.1.1 CHRISTOS:1.1.1; locks; strict; comment @# @; 1.22 date 2023.08.18.19.00.10; author christos; state Exp; branches; next 1.21; commitid MBLVQLzqzmQ7IiBE; 1.21 date 2022.12.10.20.57.10; author christos; state Exp; branches; next 1.20; commitid 4aBT8e8KUlfyq35E; 1.20 date 2022.12.10.16.22.21; author jakllsch; state Exp; branches; next 1.19; commitid ldtBdxHVIY48U15E; 1.19 date 2022.09.24.20.21.46; author christos; state Exp; branches; next 1.18; commitid zJ5LoIcubBSIH9VD; 1.18 date 2021.04.09.19.11.41; author christos; state Exp; branches; next 1.17; commitid hKe2GL3vw8SVrEOC; 1.17 date 2020.06.15.00.37.24; author christos; state Exp; branches; next 1.16; commitid OSLCnHKb0ryCRfcC; 1.16 date 2019.12.17.02.31.05; author christos; state Exp; branches; next 1.15; commitid T4BTFY7rQ43kj0PB; 1.15 date 2019.05.22.17.26.05; author christos; state Exp; branches; next 1.14; commitid GumkPZ4rDiPTYdoB; 1.14 date 2018.04.15.19.45.32; author christos; state Exp; branches 1.14.2.1; next 1.13; commitid PISTUVsbDjqSFzyA; 1.13 date 2017.09.08.13.40.25; author christos; state Exp; branches 1.13.2.1; next 1.12; commitid EDhU8t9rVXB4Ho6A; 1.12 date 2017.05.25.00.11.26; author christos; state Exp; branches; next 1.11; commitid FQJOXzdL3jIJCHSz; 1.11 date 2017.02.10.17.53.24; author christos; state Exp; branches; next 1.10; commitid bl2PZy94aycnQqFz; 1.10 date 2015.01.02.21.15.32; author christos; state Exp; branches 1.10.2.1 1.10.4.1; next 1.9; commitid plHyuBVC8BZdIu4y; 1.9 date 2014.10.10.20.15.01; author christos; state Exp; branches; next 1.8; commitid DPDduhHSBYgR4HTx; 1.8 date 2014.06.13.02.08.06; author christos; state Exp; branches; next 1.7; commitid 4S2W0uH1Gw96TiEx; 1.7 date 2013.12.01.19.32.14; author christos; state Exp; branches 1.7.2.1; next 1.6; commitid gZ22t2PQqTQYTsfx; 1.6 date 2013.03.23.16.15.58; author christos; state Exp; branches; next 1.5; 1.5 date 2013.01.03.23.05.37; author christos; state Exp; branches; next 1.4; 1.4 date 2011.05.13.01.52.13; author christos; state Exp; branches 1.4.4.1 1.4.10.1; next 1.3; 1.3 date 2009.12.23.09.17.40; author mbalmer; state Exp; branches; next 1.2; 1.2 date 2009.05.08.17.34.35; author christos; state Exp; branches 1.2.2.1; next 1.1; 1.1 date 2009.05.08.16.35.08; author christos; state Exp; branches 1.1.1.1; next ; 1.14.2.1 date 2019.06.10.21.44.46; author christos; state Exp; branches; next 1.14.2.2; commitid jtc8rnCzWiEEHGqB; 1.14.2.2 date 2020.04.08.14.04.04; author martin; state Exp; branches; next ; commitid Qli2aW9E74UFuA3C; 1.13.2.1 date 2018.04.22.07.20.08; author pgoyette; state Exp; branches; next ; commitid W6xykws0Zbl4kpzA; 1.10.2.1 date 2017.03.20.06.52.19; author pgoyette; state Exp; branches; next ; commitid jjw7cAwgyKq7RfKz; 1.10.4.1 date 2017.04.21.16.51.24; author bouyer; state Exp; branches; next ; commitid dUG7nkTKALCadqOz; 1.7.2.1 date 2014.08.10.07.07.10; author tls; state Exp; branches; next ; commitid b1wUlsZGswrdGMLx; 1.4.4.1 date 2013.01.23.00.04.35; author yamt; state Exp; branches; next 1.4.4.2; 1.4.4.2 date 2014.05.22.15.44.59; author yamt; state Exp; branches; next ; commitid tYJXbWAuFvTh7yBx; 1.4.10.1 date 2013.02.25.00.26.06; author tls; state Exp; branches; next 1.4.10.2; 1.4.10.2 date 2013.06.23.06.26.32; author tls; state Exp; branches; next 1.4.10.3; commitid OnlO1cBgtQRcIHUw; 1.4.10.3 date 2014.08.19.23.46.47; author tls; state Exp; branches; next ; commitid jTnpym9Qu0o4R1Nx; 1.2.2.1 date 2009.05.08.17.34.35; author jym; state dead; branches; next 1.2.2.2; 1.2.2.2 date 2009.05.13.18.51.55; author jym; state Exp; branches; next ; 1.1.1.1 date 2009.05.08.16.35.08; author christos; state Exp; branches; next 1.1.1.2; 1.1.1.2 date 2011.05.12.20.47.00; author christos; state Exp; branches; next 1.1.1.3; 1.1.1.3 date 2013.01.03.16.27.53; author christos; state Exp; branches; next 1.1.1.4; 1.1.1.4 date 2013.03.23.15.49.17; author christos; state Exp; branches; next 1.1.1.5; 1.1.1.5 date 2013.12.01.19.28.18; author christos; state Exp; branches; next 1.1.1.6; commitid RVQIxe3FpM3lSsfx; 1.1.1.6 date 2014.06.13.01.48.24; author christos; state Exp; branches; next 1.1.1.7; commitid jtTYsE5FmJU6MiEx; 1.1.1.7 date 2014.10.10.20.08.21; author christos; state Exp; branches; next 1.1.1.8; commitid pfOzhE33qnut2HTx; 1.1.1.8 date 2015.01.02.20.34.28; author christos; state Exp; branches; next 1.1.1.9; commitid VjK78yRsQNs8uu4y; 1.1.1.9 date 2017.02.10.17.42.57; author christos; state Exp; branches; next 1.1.1.10; commitid HAP3kn9Hn6ovMqFz; 1.1.1.10 date 2017.05.24.23.59.57; author christos; state Exp; branches; next 1.1.1.11; commitid WbyOU2LBE5qOyHSz; 1.1.1.11 date 2017.09.08.13.22.43; author christos; state Exp; branches; next 1.1.1.12; commitid Hp7DmePhD4aVAo6A; 1.1.1.12 date 2018.04.15.19.32.48; author christos; state Exp; branches; next 1.1.1.13; commitid unKSwpX2g9VqBzyA; 1.1.1.13 date 2019.05.22.17.19.57; author christos; state Exp; branches; next 1.1.1.14; commitid VXeNRYYruN1MWdoB; 1.1.1.14 date 2019.12.17.02.23.53; author christos; state Exp; branches; next 1.1.1.15; commitid vqYTz60fS9PNg0PB; 1.1.1.15 date 2020.06.15.00.18.48; author christos; state Exp; branches; next 1.1.1.16; commitid HMbuXSjPojU5LfcC; 1.1.1.16 date 2021.04.09.18.58.02; author christos; state Exp; branches; next 1.1.1.17; commitid W9ddLLbSkHHinEOC; 1.1.1.17 date 2022.09.24.20.07.54; author christos; state Exp; branches; next 1.1.1.18; commitid Nf6F9kcpc0EPC9VD; 1.1.1.18 date 2023.08.18.18.36.50; author christos; state Exp; branches; next ; commitid IX26ghc1E2S0AiBE; desc @@ 1.22 log @merge conflicts between file-5.43 and file-5.45 @ text @#------------------------------------------------------------------------------ # $File: filesystems,v 1.158 2023/05/21 17:19:08 christos Exp $ # filesystems: file(1) magic for different filesystems # 0 name partid >0 ubyte 0x00 Unused >0 ubyte 0x01 12-bit FAT >0 ubyte 0x02 XENIX / >0 ubyte 0x03 XENIX /usr >0 ubyte 0x04 16-bit FAT, less than 32M >0 ubyte 0x05 extended partition >0 ubyte 0x06 16-bit FAT, more than 32M >0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX >0 ubyte 0x08 AIX or os, or etc. >0 ubyte 0x09 AIX boot partition or Coherent >0 ubyte 0x0a O/2 boot manager or Coherent swap >0 ubyte 0x0b 32-bit FAT >0 ubyte 0x0c 32-bit FAT, LBA-mapped >0 ubyte 0x0d 7XXX, LBA-mapped >0 ubyte 0x0e 16-bit FAT, LBA-mapped >0 ubyte 0x0f extended partition, LBA-mapped >0 ubyte 0x10 OPUS >0 ubyte 0x11 OS/2 DOS 12-bit FAT >0 ubyte 0x12 Compaq diagnostics >0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M >0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M >0 ubyte 0x17 OS/2 hidden IFS >0 ubyte 0x18 AST Windows swapfile >0 ubyte 0x19 Willowtech Photon coS >0 ubyte 0x1b hidden win95 fat 32 >0 ubyte 0x1c hidden win95 fat 32 lba >0 ubyte 0x1d hidden win95 fat 16 lba >0 ubyte 0x20 Willowsoft OFS1 >0 ubyte 0x21 reserved >0 ubyte 0x23 reserved >0 ubyte 0x24 NEC DOS >0 ubyte 0x26 reserved >0 ubyte 0x31 reserved >0 ubyte 0x32 Alien Internet Services NOS >0 ubyte 0x33 reserved >0 ubyte 0x34 reserved >0 ubyte 0x35 JFS on OS2 >0 ubyte 0x36 reserved >0 ubyte 0x38 Theos >0 ubyte 0x39 Plan 9, or Theos spanned >0 ubyte 0x3a Theos ver 4 4gb partition >0 ubyte 0x3b Theos ve 4 extended partition >0 ubyte 0x3c PartitionMagic recovery >0 ubyte 0x3d Hidden Netware >0 ubyte 0x40 VENIX 286 or LynxOS >0 ubyte 0x41 PReP >0 ubyte 0x42 linux swap sharing DRDOS disk >0 ubyte 0x43 linux sharing DRDOS disk >0 ubyte 0x44 GoBack change utility >0 ubyte 0x45 Boot US Boot manager >0 ubyte 0x46 EUMEL/Elan or Ergos 3 >0 ubyte 0x47 EUMEL/Elan or Ergos 3 >0 ubyte 0x48 EUMEL/Elan or Ergos 3 >0 ubyte 0x4a ALFX/THIN filesystem for DOS >0 ubyte 0x4c Oberon partition >0 ubyte 0x4d QNX4.x >0 ubyte 0x4e QNX4.x 2nd part >0 ubyte 0x4f QNX4.x 3rd part >0 ubyte 0x50 DM (disk manager) >0 ubyte 0x51 DM6 Aux1 (or Novell) >0 ubyte 0x52 CP/M or Microport SysV/AT >0 ubyte 0x53 DM6 Aux3 >0 ubyte 0x54 DM6 DDO >0 ubyte 0x55 EZ-Drive (disk manager) >0 ubyte 0x56 Golden Bow (disk manager) >0 ubyte 0x57 Drive PRO >0 ubyte 0x5c Priam Edisk (disk manager) >0 ubyte 0x61 SpeedStor >0 ubyte 0x63 GNU HURD or Mach or Sys V/386 >0 ubyte 0x64 Novell Netware 2.xx or Speedstore >0 ubyte 0x65 Novell Netware 3.xx >0 ubyte 0x66 Novell 386 Netware >0 ubyte 0x67 Novell >0 ubyte 0x68 Novell >0 ubyte 0x69 Novell >0 ubyte 0x70 DiskSecure Multi-Boot >0 ubyte 0x71 reserved >0 ubyte 0x73 reserved >0 ubyte 0x74 reserved >0 ubyte 0x75 PC/IX >0 ubyte 0x76 reserved >0 ubyte 0x77 M2FS/M2CS partition >0 ubyte 0x78 XOSL boot loader filesystem >0 ubyte 0x80 MINIX until 1.4a >0 ubyte 0x81 MINIX since 1.4b >0 ubyte 0x82 Linux swap or Solaris >0 ubyte 0x83 Linux native >0 ubyte 0x84 OS/2 hidden C: drive >0 ubyte 0x85 Linux extended partition >0 ubyte 0x86 NT FAT volume set >0 ubyte 0x87 NTFS volume set or HPFS mirrored >0 ubyte 0x8a Linux Kernel AiR-BOOT partition >0 ubyte 0x8b Legacy Fault tolerant FAT32 >0 ubyte 0x8c Legacy Fault tolerant FAT32 ext >0 ubyte 0x8d Hidden free FDISK FAT12 >0 ubyte 0x8e Linux Logical Volume Manager >0 ubyte 0x90 Hidden free FDISK FAT16 >0 ubyte 0x91 Hidden free FDISK DOS EXT >0 ubyte 0x92 Hidden free FDISK FAT16 Big >0 ubyte 0x93 Amoeba filesystem >0 ubyte 0x94 Amoeba bad block table >0 ubyte 0x95 MIT EXOPC native partitions >0 ubyte 0x97 Hidden free FDISK FAT32 >0 ubyte 0x98 Datalight ROM-DOS Super-Boot >0 ubyte 0x99 Mylex EISA SCSI >0 ubyte 0x9a Hidden free FDISK FAT16 LBA >0 ubyte 0x9b Hidden free FDISK EXT LBA >0 ubyte 0x9f BSDI? >0 ubyte 0xa0 IBM Thinkpad hibernation >0 ubyte 0xa1 HP Volume expansion (SpeedStor) >0 ubyte 0xa3 HP Volume expansion (SpeedStor) >0 ubyte 0xa4 HP Volume expansion (SpeedStor) >0 ubyte 0xa5 386BSD partition type >0 ubyte 0xa6 OpenBSD partition type >0 ubyte 0xa7 NeXTSTEP 486 >0 ubyte 0xa8 Apple UFS >0 ubyte 0xa9 NetBSD partition type >0 ubyte 0xaa Olivetty Fat12 1.44MB Service part >0 ubyte 0xab Apple Boot >0 ubyte 0xae SHAG OS filesystem >0 ubyte 0xaf Apple HFS >0 ubyte 0xb0 BootStar Dummy >0 ubyte 0xb1 reserved >0 ubyte 0xb3 reserved >0 ubyte 0xb4 reserved >0 ubyte 0xb6 reserved >0 ubyte 0xb7 BSDI BSD/386 filesystem >0 ubyte 0xb8 BSDI BSD/386 swap >0 ubyte 0xbb Boot Wizard Hidden >0 ubyte 0xbe Solaris 8 partition type >0 ubyte 0xbf Solaris partition type >0 ubyte 0xc0 CTOS >0 ubyte 0xc1 DRDOS/sec (FAT-12) >0 ubyte 0xc2 Hidden Linux >0 ubyte 0xc3 Hidden Linux swap >0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) >0 ubyte 0xc5 DRDOS/sec (EXT) >0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) >0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled >0 ubyte 0xc8 Reserved for DR-DOS 8.0+ >0 ubyte 0xc9 Reserved for DR-DOS 8.0+ >0 ubyte 0xca Reserved for DR-DOS 8.0+ >0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS >0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA >0 ubyte 0xcd CTOS Memdump >0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA >0 ubyte 0xcf DR-DOS 7.04+ EXT LBA >0 ubyte 0xd0 REAL/32 secure big partition >0 ubyte 0xd1 Old Multiuser DOS FAT12 >0 ubyte 0xd4 Old Multiuser DOS FAT16 Small >0 ubyte 0xd5 Old Multiuser DOS Extended >0 ubyte 0xd6 Old Multiuser DOS FAT16 Big >0 ubyte 0xd8 CP/M 86 >0 ubyte 0xdb CP/M or Concurrent CP/M >0 ubyte 0xdd Hidden CTOS Memdump >0 ubyte 0xde Dell PowerEdge Server utilities >0 ubyte 0xdf DG/UX virtual disk manager >0 ubyte 0xe0 STMicroelectronics ST AVFS >0 ubyte 0xe1 DOS access or SpeedStor 12-bit >0 ubyte 0xe3 DOS R/O or Storage Dimensions >0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. >0 ubyte 0xe5 reserved >0 ubyte 0xe6 reserved >0 ubyte 0xeb BeOS >0 ubyte 0xee GPT Protective MBR >0 ubyte 0xef EFI system partition >0 ubyte 0xf0 Linux PA-RISC boot loader >0 ubyte 0xf1 SpeedStor or Storage Dimensions >0 ubyte 0xf2 DOS 3.3+ Secondary >0 ubyte 0xf3 reserved >0 ubyte 0xf4 SpeedStor large partition >0 ubyte 0xf5 Prologue multi-volumen partition >0 ubyte 0xf6 reserved >0 ubyte 0xf9 pCache: ext2/ext3 persistent cache >0 ubyte 0xfa Bochs x86 emulator >0 ubyte 0xfb VMware File System >0 ubyte 0xfc VMware Swap >0 ubyte 0xfd Linux RAID partition persistent sb >0 ubyte 0xfe LANstep or IBM PS/2 IML >0 ubyte 0xff Xenix Bad Block Table 0 string \366\366\366\366 PC formatted floppy with no filesystem # Sun disk labels # From /usr/include/sun/dklabel.h: 0774 beshort 0xdabe # modified by Joerg Jenderek, because original test # succeeds for Cabinet archive dao360.dl_ with negative blocks >0770 long >0 Sun disk label >>0 string x '%s >>>31 string >\0 \b%s >>>>63 string >\0 \b%s >>>>>95 string >\0 \b%s >>0 string x \b' >>0734 short >0 %d rpm, >>0736 short >0 %d phys cys, >>0740 short >0 %d alts/cyl, >>0746 short >0 %d interleave, >>0750 short >0 %d data cyls, >>0752 short >0 %d alt cyls, >>0754 short >0 %d heads/partition, >>0756 short >0 %d sectors/track, >>0764 long >0 start cyl %d, >>0770 long x %d blocks # Is there a boot block written 1 sector in? >512 belong&077777777 0600407 \b, boot block present # Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk # (http://btmgr.sourceforge.net/docs/user-guide-3.html) 0 string SBMBAKUP_ Smart Boot Manager backup file >9 string x \b, version %-5.5s >>14 string =_ >>>15 string x %-.1s >>>>16 string =_ \b. >>>>>17 string x \b%-.1s >>>>>>18 string =_ \b. >>>>>>>19 string x \b%-.1s >>>22 ubyte 0 >>>>21 ubyte x \b, from drive %#x >>>22 ubyte >0 >>>>21 string x \b, from drive %s >>>535 search/17 \x55\xAA >>>>&-512 indirect x \b; contains # updated by Joerg Jenderek at Nov 2012 # DOS Emulator image is 128 byte, null right padded header + harddisc image 0 string DOSEMU\0 >0x27E leshort 0xAA55 #offset is 128 >>19 ubyte 128 >>>(19.b-1) ubyte 0x0 DOS Emulator image >>>>7 ulelong >0 \b, %u heads >>>>11 ulelong >0 \b, %d sectors/track >>>>15 ulelong >0 \b, %d cylinders >>>>128 indirect x \b; contains # added by Joerg Jenderek at Nov 2012 # http://www.thenakedpc.com/articles/v04/08/0408-05.html # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 0 string PNCIHISK\0 Norton Utilities disc image data # real x86 boot sector with jump instruction >509 search/1026 \x55\xAA\xeb >>&-1 indirect x \b; contains # http://file-extension.net/seeker/file_extension_dat 0 string PNCIUNDO Norton Disk Doctor UnDo file # # DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013 # for any allowed sector sizes 30 search/481 \x55\xAA # to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) # DOS BPB information (70) and after DOS floppy (120) like in previous file version !:strength +65 # for sector sizes < 512 Bytes >11 uleshort <512 >>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector # for sector sizes with 512 or more Bytes >0x1FE leshort 0xAA55 DOS/MBR boot sector # ExFAT 3 string/w =EXFAT >0x1FE leshort 0xAA55 >>0x6E ubyte 1 >>>0x6F ubyte 0x80 >>>0 ubyte 0xEB DOS/MBR boot sector, >>>0x69 ubyte x ExFAT Filesystem version %d. >>>0x68 ubyte x \b%d >>>0x6d ubyte x \b, (1<<%d) sectors per cluster >>>0x48 ulequad x \b, sectors %lld >>>0x64 ulelong x \b, serial number %#x # keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying # only for sector sizes with 512 or more Bytes 0x1FE leshort 0xAA55 DOS/MBR boot sector # # to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version !:strength +65 >2 string OSBS OS/BS MBR # added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/ # and https://en.wikipedia.org/wiki/Master_Boot_Record # test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by # characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 >0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR # Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) # assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld >>8 ubequad 0x8bf45007501ffbfc # https://thestarman.pcministry.com/asm/mbr/200MBR.htm >>>0x16 ubyte 0xF3 \b,DOS 2 >>>>219 regex Author\ -\ Author: # found "David Litton" , "A Pehrsson " >>>>>&0 string x "%s" >>>0x16 ubyte 0xF2 # NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm # assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz >>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 # version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) >>>>0x22 default x \b,D0S version 3.3-7.0 # error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) # where nn is string offset varying for different languages # "Invalid partition table" nn=0x8b for english version >>>>>(0x49.b) string Invalid\ partition\ table english >>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german >>>>>(0x49.b) string Table\ de\ partition\ invalide french >>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese >>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish >>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian >>>>>0x49 ubyte >0 at offset %#x >>>>>>(0x49.b) string >\0 "%s" # "Error loading operating system" nn=0xa3 for english version # "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version # "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version # "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version # "Error al cargar sistema operativo" nn=0xa8 for spanish version # "Errore durante il caricamento del sistema operativo" nn=0xae for italian version >>>>>0x74 ubyte >0 at offset %#x >>>>>>(0x74.b) string >\0 "%s" # "Missing operating system" nn=0xc2 for english version # "Betriebssystem fehlt" nn=0xcd for german version # "Syst\212me d'exploitation absent" nn=0xd2 for french version # "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version # "Falta sistema operativo" nn=0xca for spanish version # "Sistema operativo mancante" nn=0xe2 for italian version >>>>>0x79 ubyte >0 at offset %#x >>>>>>(0x79.b) string >\0 "%s" # Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) # assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b >>8 ubequad 0x5007501ffcbe1b7c # assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 >>>24 ubequad 0xf3a4cbbebe07b104 9M # "Invalid partition table" nn=0x10F for english version # "Ung\201ltige Partitionstabelle" nn=0x10F for german version # "Table de partition erron\202e" nn=0x10F for french version # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version >>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english >>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german >>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french >>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian >>>>0x3C ubyte x at offset %#x+0xFF >>>>(0x3C.b+0x0FF) string >\0 "%s" # "Error loading operating system" nn=0x127 for english version # "Fehler beim Laden des Betriebssystems" nn=0x12b for german version # "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version # "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version >>>>0xBD ubyte x at offset 0x1%x >>>>(0xBD.b+0x100) string >\0 "%s" # "Missing operating system" nn=0x146 for english version # "Betriebssystem fehlt" nn=0x151 for german version # "Syst\212me d'exploitation manquant" nn=0x15e for french version # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version >>>>0xA9 ubyte x at offset 0x1%x >>>>(0xA9.b+0x100) string >\0 "%s" # https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm # assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 >>>24 ubequad 0xf3a4cbbdbe07b104 XP # where xxyyzz are lower bits from offsets of error messages varying for different languages >>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english >>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german # "Invalid partition table" xx=0x12C for english version # "Ung\201ltige Partitionstabelle" xx=0x12C for german version >>>>0x1b5 ubyte >0 at offset 0x1%x >>>>(0x1b5.b+0x100) string >\0 "%s" # "Error loading operating system" yy=0x144 for english version # "Fehler beim Laden des Betriebssystems" yy=0x148 for german version >>>>0x1b6 ubyte >0 at offset 0x1%x >>>>(0x1b6.b+0x100) string >\0 "%s" # "Missing operating system" zz=0x163 for english version # "Betriebssystem nicht vorhanden" zz=0x16e for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" # Microsoft Windows Vista or 7 # assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 >>8 ubequad 0xc08ed8be007cbf00 # Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) # assembler instructions: jnz 0729;cmp ebx,"TCPA" >>>0xEC ubequad 0x753b6681fb544350 Vista # where xxyyzz are lower bits from offsets of error messages varying for different languages >>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english #>>>>0x1B4 ubelong&0x00FFFFFF ? german # "Invalid partition table" xx=0x162 for english version # "Ung\201ltige Partitionstabelle" xx=0x1?? for german version >>>>0x1b5 ubyte >0 at offset 0x1%x >>>>(0x1b5.b+0x100) string >\0 "%s" # "Error loading operating system" yy=0x17a for english version # "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version >>>>0x1b6 ubyte >0 at offset 0x1%x >>>>(0x1b6.b+0x100) string >\0 "%s" # "Missing operating system" zz=0x199 for english version # "Betriebssystem nicht vorhanden" zz=0x1?? for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" # Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm) # assembler instructions: cmp ebx,"TCPA";cmp >>>0xEC ubequad 0x6681fb5443504175 Windows 7 # where xxyyzz are lower bits from offsets of error messages varying for different languages >>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english #>>>>0x1B4 ubelong&0x00FFFFFF ? german # "Invalid partition table" xx=0x163 for english version # "Ung\201ltige Partitionstabelle" xx=0x1?? for german version >>>>0x1b5 ubyte >0 at offset 0x1%x >>>>(0x1b5.b+0x100) string >\0 "%s" # "Error loading operating system" yy=0x17b for english version # "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version >>>>0x1b6 ubyte >0 at offset 0x1%x >>>>(0x1b6.b+0x100) string >\0 "%s" # "Missing operating system" zz=0x19a for english version # "Betriebssystem nicht vorhanden" zz=0x1?? for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" # https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs # https://en.wikipedia.org/wiki/MBR_disk_signature#ID >>0x1b8 ulelong >0 \b, disk signature %#-.4x # driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm >>0xDA uleshort 0 >>>0xDC ulelong >0 \b, created # physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive >>>>0xDC ubyte x with driveID %#x # hours, minutes and seconds >>>>0xDf ubyte x at %x >>>>0xDe ubyte x \b:%x >>>>0xDd ubyte x \b:%x # special case for Microsoft MS-DOS 3.21 spanish # assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov >0 ubequad 0xfab830008ed0bc00 # assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov >>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish # Microsoft MBR IPL end # dr-dos with some upper-, lowercase variants >0x9D string Invalid\ partition\ table$ >>181 string No\ Operating\ System$ >>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 >0x9D string Invalid\ partition\ table$ >>181 string No\ operating\ system$ >>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 >342 string Invalid\ partition\ table$ >>366 string No\ operating\ system$ >>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 >295 string NEWLDR\0 >>302 string Bad\ PT\ $ >>>310 string No\ OS\ $ >>>>317 string OS\ load\ err$ >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ >>>>>>>387 string Copyright\ (c)\ 1984,1998 >>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) # # tests for different MS-DOS Master Boot Records (MBR) moved and merged # #>0x145 string Default:\ F \b, FREE-DOS MBR #>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR >0x145 search/7 Default:\ F \b, FREE-DOS MBR #>>313 string F0\ .\ .\ . #>>>322 string disk\ 1 #>>>>382 string FAT3 >64 string no\ active\ partition\ found >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR # Ranish Partition Manager http://www.ranish.com/part/ >387 search/4 \0\ Error!\r >>378 search/7 Virus! >>>397 search/4 Booting\040 >>>>408 search/4 HD1/\0 \b, Ranish MBR ( >>>>>416 string Writing\ changes... \b2.37 >>>>>>438 ubyte x \b,%#x dots >>>>>>440 ubyte >0 \b,virus check >>>>>>441 ubyte >0 \b,partition %c #2.38,2.42,2.44 >>>>>416 string !Writing\ changes... \b >>>>>>418 ubyte 1 \bvirus check, >>>>>>419 ubyte x \b%#x seconds >>>>>>420 ubyte&0x0F >0 \b,partition >>>>>>>420 ubyte&0x0F <5 \b %x >>>>>>>420 ubyte&0x0F 0Xf \b ask >>>>>420 ubyte x \b) # # SYSLINUX MBR moved # https://www.acronis.de/ >362 string MBR\ Error\ \0\r >>376 string ress\ any\ key\ to\040 >>>392 string boot\ from\ floppy...\0 \b, Acronis MBR # added by Joerg Jenderek # https://www.visopsys.org/ # https://partitionlogic.org.uk/ >309 string No\ bootable\ partition\ found\r >>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR >349 string No\ bootable\ partition\ found\r >>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR # bootloader, bootmanager >0x40 string SBML # label with 11 characters of FAT 12 bit filesystem >>43 string SMART\ BTMGR >>>430 string SBMK\ Bad!\r \b, Smart Boot Manager # OEM-ID not always "SBM" #>>>>3 strings SBM >>>>6 string >\0 \b, version %s >382 string XOSLLOADXCF \b, eXtended Operating System Loader >6 string LILO \b, LInux i386 boot LOader >>120 string LILO \b, version 22.3.4 SuSe >>172 string LILO \b, version 22.5.8 Debian # updated by Joerg Jenderek at Oct 2008 # variables according to grub-0.97/stage1/stage1.S or # https://www.gnu.org/software/grub/manual/grub.html#Embedded-data # usual values are marked with comments to get only information of strange GRUB loaders >342 search/60 \0Geom\0 #>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 >>0x41 ubyte <2 >>>0x3E ubyte >2 \b; GRand Unified Bootloader # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 >>>>0x3E ubyte x \b, stage1 version %#x #If it is 0xFF, use a drive passed by BIOS >>>>0x40 ubyte <0xFF \b, boot drive %#x # in most case 0,1,0x2e for GRUB 0.5.95 >>>>0x41 ubyte >0 \b, LBA flag %#x >>>>0x42 uleshort <0x8000 \b, stage2 address %#x #>>>>0x42 uleshort =0x8000 \b, stage2 address %#x (usual) >>>>0x42 uleshort >0x8000 \b, stage2 address %#x #>>>>0x44 ulelong =1 \b, 1st sector stage2 %#x (default) >>>>0x44 ulelong >1 \b, 1st sector stage2 %#x >>>>0x48 uleshort <0x800 \b, stage2 segment %#x #>>>>0x48 uleshort =0x800 \b, stage2 segment %#x (usual) >>>>0x48 uleshort >0x800 \b, stage2 segment %#x >>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>>>>394 string stage1 \b, GRUB version 0.5.95 >>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 >>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>>>>377 string GRUB\ \0 \b, GRUB version 0.94 >>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 >>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>>>>385 string GRUB\ \0 \b, GRUB version 0.97 # unknown version >>>343 string Geom\0Read\0\ Error\0 >>>>321 string Loading\ stage1.5 \b, GRUB version x.y >>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>>>374 string GRUB\ \0 \b, GRUB version n.m # SYSLINUX bootloader moved >395 string chksum\0\ ERROR!\0 \b, Gujin bootloader # http://www.bcdwb.de/bcdw/index_e.htm >3 string BCDL >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) # mbr partition table entries updated by Joerg Jenderek at Sep 2013 # skip Norton Utilities disc image data >3 string !IHISK # skip Linux style boot sector starting with assembler instructions mov 0x7c0,ax; >>0 belong !0xb8c0078e # not Linux kernel >>>514 string !HdrS # not BeOS >>>>422 string !Be\ Boot\ Loader # jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr >>>>>0 ubelong&0xFD000000 =0xE9000000 # AdvanceMAME mbr >>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e >>>>>>>446 use partition-table # mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader >>>>>0 ubelong&0xFD000000 !0xE9000000 # skip FSInfosector >>>>>>0 string !RRaA # skip 3rd sector of MS x86 bootloader with assembler instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, # https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm >>>>>>>0 ubequad !0xfa660fb64610668b # skip 13rd sector of MS x86 bootloader >>>>>>>>0 ubequad !0x660fb64610668b4e # skip sector starting with DOS new line >>>>>>>>>0 string !\r\n # allowed active flag 0,80h-FFh >>>>>>>>>>446 ubyte 0 >>>>>>>>>>>446 use partition-table >>>>>>>>>>446 ubyte >0x7F >>>>>>>>>>>446 use partition-table # TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries # mbr partition table entries end # https://www.acronis.de/ #FAT label=ACRONIS\ SZ #OEM-ID=BOOTWIZ0 >442 string Non-system\ disk,\040 >>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader # updated by Joerg Jenderek at Nov 2012, Sep 2013 # DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes # display 1 space >>>447 ubyte x \b >>>477 use DOS-filename # >185 string FDBOOT\ Version\040 >>204 string \rNo\ Systemdisk.\040 >>>220 string Booting\ from\ harddisk.\n\r >>>245 string Cannot\ load\ from\ harddisk.\n\r >>>>273 string Insert\ Systemdisk\040 >>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader >>>>>>200 string >\0 \b, version %-3s >242 string Bootsector\ from\ C.H.\ Hochst\204 # http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c # updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string # skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut >242 search/127 Bootsector\ from\ C.H.\ Hochst >>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk # followed by variants with point,CR-NL or NL-CR >>>208 search/261 Cannot\ load\ from\ harddisk. # followed by variants CR-NL or NL-CR >>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. # followed by variants with point,CR-NL or NL-CR >>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader # followed by string like "6.50 (c) 1993-2004 Gilles Vollant" >>>>>>&0 string x \b, version %-4.4s >(1.b+2) ubyte 0xe >>(1.b+3) ubyte 0x1f >>>(1.b+4) ubyte 0xbe # message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others >>>>(1.b+5) ubyte&0xd3 0x53 >>>>>(1.b+6) ubyte 0x7c # assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, >>>>>>(1.b+7) ubyte 0xac >>>>>>>(1.b+8) ubyte 0x22 >>>>>>>>(1.b+9) ubyte 0xc0 >>>>>>>>>(1.b+10) ubyte 0x74 >>>>>>>>>>(1.b+11) ubyte 0x0b >>>>>>>>>>>(1.b+12) ubyte 0x56 >>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display # FAT1X version >>>>>>>>>>>>>(1.b+5) ubyte 0x5b >>>>>>>>>>>>>>0x5b string >\0 "%-s" # FAT32 version >>>>>>>>>>>>>(1.b+5) ubyte 0x77 >>>>>>>>>>>>>>0x77 string >\0 "%-s" >214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display #>>244 string from\ dosemu-freedos-*-bin.tgz\r #>>>170 string Sorry,\ could\ not\ load\ an\040 #>>>>195 string operating\ system.\r\n # >103 string This\ is\ not\ a\ bootable\ disk.\040 >>132 string Please\ insert\ a\ bootable\040 >>>157 string floppy\ and\r\n >>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display # >66 string Solaris\ Boot\ Sector >>99 string Incomplete\ MDBoot\ load. >>>89 string Version \b, Sun Solaris Bootloader >>>>97 byte x version %c # >408 string OS/2\ !!\ SYS01475\r\0 >>429 string OS/2\ !!\ SYS02025\r\0 >>>450 string OS/2\ !!\ SYS02027\r\0 >>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader # >409 string OS/2\ !!\ SYS01475\r\0 >>430 string OS/2\ !!\ SYS02025\r\0 >>>451 string OS/2\ !!\ SYS02027\r\0 >>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader >112 string This\ disk\ is\ not\ bootable\r >>142 string If\ you\ wish\ to\ make\ it\ bootable >>>176 string run\ the\ DOS\ program\ SYS\040 >>>200 string after\ the\r >>>>216 string system\ has\ been\ loaded\r\n >>>>>242 string Please\ insert\ a\ DOS\ diskette\040 >>>>>271 string into\r\n\ the\ drive\ and\040 >>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display # XP >430 string NTLDR\ is\ missing\xFF\r\n >>449 string Disk\ error\xFF\r\n >>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes >>>>417 ubyte&0xDF >0 >>>>>417 string x %-.5s >>>>>>422 ubyte&0xDF >0 >>>>>>>422 string x \b%-.3s >>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s # >>>>371 ubyte >0x20 >>>>>368 ubyte&0xDF >0 >>>>>>368 string x %-.5s >>>>>>>373 ubyte&0xDF >0 >>>>>>>>373 string x \b%-.3s >>>>>>376 ubyte&0xDF >0 >>>>>>>376 string x \b.%-.3s # >430 string NTLDR\ nicht\ gefunden\xFF\r\n >>453 string Datentr\204gerfehler\xFF\r\n >>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) >>>>417 ubyte&0xDF >0 >>>>>417 string x %-.5s >>>>>>422 ubyte&0xDF >0 >>>>>>>422 string x \b%-.3s >>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s # offset variant >>>>379 string \0 >>>>>368 ubyte&0xDF >0 >>>>>>368 string x %-.5s >>>>>>>373 ubyte&0xDF >0 >>>>>>>>373 string x \b%-.3s # >430 string NTLDR\ fehlt\xFF\r\n >>444 string Datentr\204gerfehler\xFF\r\n >>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) >>>>417 ubyte&0xDF >0 >>>>>417 string x %-.5s >>>>>>422 ubyte&0xDF >0 >>>>>>>422 string x \b%-.3s >>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s # variant >>>>371 ubyte >0x20 >>>>>368 ubyte&0xDF >0 >>>>>>368 string x %-.5s >>>>>>>373 ubyte&0xDF >0 >>>>>>>>373 string x \b%-.3s >>>>>>376 ubyte&0xDF >0 >>>>>>>376 string x \b.%-.3s # >430 string NTLDR\ fehlt\xFF\r\n >>444 string Medienfehler\xFF\r\n >>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) >>>>371 ubyte >0x20 >>>>>368 ubyte&0xDF >0 >>>>>>368 string x %-.5s >>>>>>>373 ubyte&0xDF >0 >>>>>>>>373 string x \b%-.3s >>>>>>376 ubyte&0xDF >0 >>>>>>>376 string x \b.%-.3s # variant >>>>417 ubyte&0xDF >0 >>>>>417 string x %-.5s >>>>>>422 ubyte&0xDF >0 >>>>>>>422 string x \b%-.3s >>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s # >430 string Datentr\204ger\ entfernen\xFF\r\n >>454 string Medienfehler\xFF\r\n >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) >>>>379 string \0 >>>>>368 ubyte&0xDF >0 >>>>>>368 string x %-.5s >>>>>>>373 ubyte&0xDF >0 >>>>>>>>373 string x \b%-.3s >>>>>>376 ubyte&0xDF >0 >>>>>>>376 string x \b.%-.3s # variant >>>>417 ubyte&0xDF >0 >>>>>417 string x %-.5s >>>>>>422 ubyte&0xDF >0 >>>>>>>422 string x \b%-.3s >>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s # #>3 string NTFS\ \ \ \040 >389 string Fehler\ beim\ Lesen\040 >>407 string des\ Datentr\204gers >>>426 string NTLDR\ fehlt >>>>440 string NTLDR\ ist\ komprimiert >>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) #>3 string NTFS\ \ \ \040 >313 string A\ disk\ read\ error\ occurred.\r >>345 string A\ kernel\ file\ is\ missing\040 >>>370 string from\ the\ disk.\r >>>>484 string NTLDR\ is\ compressed >>>>>429 string Insert\ a\ system\ diskette\040 >>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS # DOS loader variants different languages,offsets >472 ubyte&0xDF >0 >>389 string Invalid\ system\ disk\xFF\r\n >>>411 string Disk\ I/O\ error >>>>428 string Replace\ the\ disk,\ and\040 >>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader #IO.SYS >>>>>>472 ubyte&0xDF >0 >>>>>>>472 string x \b %-.2s >>>>>>>>474 ubyte&0xDF >0 >>>>>>>>>474 string x \b%-.5s >>>>>>>>>>479 ubyte&0xDF >0 >>>>>>>>>>>479 string x \b%-.1s >>>>>>>480 ubyte&0xDF >0 >>>>>>>>480 string x \b.%-.3s #MSDOS.SYS >>>>>>>483 ubyte&0xDF >0 \b+ >>>>>>>>483 string x \b%-.5s >>>>>>>>>488 ubyte&0xDF >0 >>>>>>>>>>488 string x \b%-.3s >>>>>>>>491 ubyte&0xDF >0 >>>>>>>>>491 string x \b.%-.3s # >>390 string Invalid\ system\ disk\xFF\r\n >>>412 string Disk\ I/O\ error\xFF\r\n >>>>429 string Replace\ the\ disk,\ and\040 >>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader >>388 string Ungueltiges\ System\ \xFF\r\n >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>427 string Datentraeger\ wechseln\ und\040 >>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) #WINBOOT.SYS only not spaces (0xDF) >>>>>>497 ubyte&0xDF >0 >>>>>>>497 string x %-.5s >>>>>>>>502 ubyte&0xDF >0 >>>>>>>>>502 string x \b%-.1s >>>>>>>>>>503 ubyte&0xDF >0 >>>>>>>>>>>503 string x \b%-.1s >>>>>>>>>>>>504 ubyte&0xDF >0 >>>>>>>>>>>>>504 string x \b%-.1s >>>>>>505 ubyte&0xDF >0 >>>>>>>505 string x \b.%-.3s #IO.SYS >>>>>>472 ubyte&0xDF >0 or >>>>>>>472 string x \b %-.2s >>>>>>>>474 ubyte&0xDF >0 >>>>>>>>>474 string x \b%-.5s >>>>>>>>>>479 ubyte&0xDF >0 >>>>>>>>>>>479 string x \b%-.1s >>>>>>>480 ubyte&0xDF >0 >>>>>>>>480 string x \b.%-.3s #MSDOS.SYS >>>>>>>483 ubyte&0xDF >0 \b+ >>>>>>>>483 string x \b%-.5s >>>>>>>>>488 ubyte&0xDF >0 >>>>>>>>>>488 string x \b%-.3s >>>>>>>>491 ubyte&0xDF >0 >>>>>>>>>491 string x \b.%-.3s # >>390 string Ungueltiges\ System\ \xFF\r\n >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>429 string Datentraeger\ wechseln\ und\040 >>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) #WINBOOT.SYS only not spaces (0xDF) >>>>>>497 ubyte&0xDF >0 >>>>>>>497 string x %-.7s >>>>>>>>504 ubyte&0xDF >0 >>>>>>>>>504 string x \b%-.1s >>>>>>505 ubyte&0xDF >0 >>>>>>>505 string x \b.%-.3s #IO.SYS >>>>>>472 ubyte&0xDF >0 or >>>>>>>472 string x \b %-.2s >>>>>>>>474 ubyte&0xDF >0 >>>>>>>>>474 string x \b%-.6s >>>>>>>480 ubyte&0xDF >0 >>>>>>>>480 string x \b.%-.3s #MSDOS.SYS >>>>>>>483 ubyte&0xDF >0 \b+ >>>>>>>>483 string x \b%-.5s >>>>>>>>>488 ubyte&0xDF >0 >>>>>>>>>>488 string x \b%-.3s >>>>>>>>491 ubyte&0xDF >0 >>>>>>>>>491 string x \b.%-.3s # >>389 string Ungueltiges\ System\ \xFF\r\n >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>428 string Datentraeger\ wechseln\ und\040 >>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) # DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes >>>>>>472 string x %-.2s >>>>>>>474 ubyte&0xDF >0 >>>>>>>>474 string x \b%-.5s >>>>>>>>479 ubyte&0xDF >0 >>>>>>>>>479 string x \b%-.1s >>>>>>480 ubyte&0xDF >0 >>>>>>>480 string x \b.%-.3s >>>>>>483 ubyte&0xDF >0 \b+ >>>>>>>483 string x \b%-.5s >>>>>>>488 ubyte&0xDF >0 >>>>>>>>488 string x \b%-.2s >>>>>>>>490 ubyte&0xDF >0 >>>>>>>>>490 string x \b%-.1s >>>>>>>491 ubyte&0xDF >0 >>>>>>>>491 string x \b.%-.3s >479 ubyte&0xDF >0 >>416 string Kein\ System\ oder\040 >>>433 string Laufwerksfehler >>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) #IO.SYS >>>>>479 string x \b %-.2s >>>>>>481 ubyte&0xDF >0 >>>>>>>481 string x \b%-.6s >>>>>487 ubyte&0xDF >0 >>>>>>487 string x \b.%-.3s #MSDOS.SYS >>>>>>490 ubyte&0xDF >0 \b+ >>>>>>>490 string x \b%-.5s >>>>>>>>495 ubyte&0xDF >0 >>>>>>>>>495 string x \b%-.3s >>>>>>>498 ubyte&0xDF >0 >>>>>>>>498 string x \b.%-.3s # >376 search/41 Non-System\ disk\ or\040 >>395 search/41 disk\ error\r >>>407 search/41 Replace\ and\040 >>>>419 search/41 press\ \b, >>>>419 search/41 strike\ \b, old >>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader #449 Disk\ Boot\ failure\r MS 3.21 #466 Boot\ Failure\r MS 3.30 >>>>>468 search/18 \0 #IO.SYS,IBMBIO.COM >>>>>>&0 string x \b %-.2s >>>>>>>&-20 ubyte&0xDF >0 >>>>>>>>&-1 string x \b%-.4s >>>>>>>>>&-16 ubyte&0xDF >0 >>>>>>>>>>&-1 string x \b%-.2s >>>>>>&8 ubyte&0xDF >0 \b. >>>>>>>&-1 string x \b%-.3s #MSDOS.SYS,IBMDOS.COM >>>>>>&11 ubyte&0xDF >0 \b+ >>>>>>>&-1 string x \b%-.5s >>>>>>>>&-6 ubyte&0xDF >0 >>>>>>>>>&-1 string x \b%-.1s >>>>>>>>>>&-5 ubyte&0xDF >0 >>>>>>>>>>>&-1 string x \b%-.2s >>>>>>>&7 ubyte&0xDF >0 \b. >>>>>>>>&-1 string x \b%-.3s >441 string Cannot\ load\ from\ harddisk.\n\r >>469 string Insert\ Systemdisk\040 >>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader #>43 string \224R-LOADER\ \ SYS =label >54 string SYS >>324 string VASKK >>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) # >98 string Press\ a\ key\ to\ retry\0\r >>120 string Cannot\ find\ file\ \0\r >>>139 string Disk\ read\ error\0\r >>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader #DRBIOS.SYS >>>>>44 ubyte&0xDF >0 >>>>>>44 string x \b %-.6s >>>>>>>50 ubyte&0xDF >0 >>>>>>>>50 string x \b%-.2s >>>>>>52 ubyte&0xDF >0 >>>>>>>52 string x \b.%-.3s # >70 string IBMBIO\ \ COM >>472 string Cannot\ load\ DOS!\040 >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader >>471 string Cannot\ load\ DOS\040 >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader #?? >444 string KERNEL\ \ SYS >>314 string BOOT\ error! \b, FREE-DOS Bootloader >499 string KERNEL\ \ SYS >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader >449 string KERNEL\ \ SYS >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader # >449 string Loading\ FreeDOS >>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader >>>497 ubyte&0xDF >0 >>>>497 string x \b %-.6s >>>>>503 ubyte&0xDF >0 >>>>>>503 string x \b%-.1s >>>>>>>504 ubyte&0xDF >0 >>>>>>>>504 string x \b%-.1s >>>>505 ubyte&0xDF >0 >>>>>505 string x \b.%-.3s # >331 string Error!.0 \b, FREE-DOS 1.0 bootloader # >125 string Loading\ FreeDOS...\r >>311 string BOOT\ error!\r \b, FREE-DOS bootloader >>>441 ubyte&0xDF >0 >>>>441 string x \b %-.6s >>>>>447 ubyte&0xDF >0 >>>>>>447 string x \b%-.1s >>>>>>>448 ubyte&0xDF >0 >>>>>>>>448 string x \b%-.1s >>>>449 ubyte&0xDF >0 >>>>>449 string x \b.%-.3s >124 string FreeDOS\0 >>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes >>>497 ubyte&0xDF >0 >>>>497 string x \b %-.6s >>>>>503 ubyte&0xDF >0 >>>>>>503 string x \b%-.1s >>>>>>>504 ubyte&0xDF >0 >>>>>>>>504 string x \b%-.1s >>>>505 ubyte&0xDF >0 >>>>>505 string x \b.%-.3s >>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader >>>497 ubyte&0xDF >0 >>>>497 string x \b %-.6s >>>>>503 ubyte&0xDF >0 >>>>>>503 string x \b%-.1s >>>>>>>504 ubyte&0xDF >0 >>>>>>>>504 string x \b%-.1s >>>>505 ubyte&0xDF >0 >>>>>505 string x \b.%-.3s >>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader >>>497 ubyte&0xDF >0 >>>>497 string x \b %-.6s >>>>>503 ubyte&0xDF >0 >>>>>>503 string x \b%-.1s >>>>>>>504 ubyte&0xDF >0 >>>>>>>>504 string x \b%-.1s >>>>505 ubyte&0xDF >0 >>>>>505 string x \b.%-.3s >336 string Error!\040 >>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader >>>497 ubyte&0xDF >0 >>>>497 string x \b %-.6s >>>>>503 ubyte&0xDF >0 >>>>>>503 string x \b%-.1s >>>>>>>504 ubyte&0xDF >0 >>>>>>>>504 string x \b%-.1s >>>>505 ubyte&0xDF >0 >>>>>505 string x \b.%-.3s # added by Joerg Jenderek # https://www.visopsys.org/ # https://partitionlogic.org.uk/ # OEM-ID=Visopsys >478 ulelong 0 >>(1.b+326) string I/O\ Error\ reading\040 >>>(1.b+344) string Visopsys\ loader\r >>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader # http://alexfru.chat.ru/epm.html#bootprog >494 ubyte >0x4D >>495 string >E >>>495 string >>>3 string BootProg # It just looks for a program file name at the root directory # and loads corresponding file with following execution. # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader >>>>>499 use DOS-filename #If the boot sector fails to read any other sector, #it prints a very short message ("RE") to the screen and hangs the computer. #If the boot sector fails to find needed program in the root directory, #it also hangs with another message ("NF"). >>>>>492 string RENF \b, FAT (12 bit) >>>>>495 string RENF \b, FAT (16 bit) #If the boot sector fails to read any other sector, #it prints a very short message ("RE") to the screen and hangs the computer. # x86 bootloader end # added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO # and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector >0 string RRaA >>0x1E4 string rrAa \b, FSInfosector #>>0x1FC uleshort =0 SHOULD BE ZERO >>>0x1E8 ulelong <0xffffffff \b, %u free clusters >>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u # updated by Joerg Jenderek at Sep 2007 >3 ubyte 0 #no active flag >>446 ubyte 0 # partition 1 not empty >>>450 ubyte >0 # partitions 3,4 empty >>>>482 ubyte 0 >>>>>498 ubyte 0 # partition 2 ID=0,5,15 >>>>>>466 ubyte <0x10 >>>>>>>466 ubyte 0x05 \b, extended partition table >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) >>>>>>>466 ubyte 0x0 \b, extended partition table (last) # DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 >0x200 lelong 0x82564557 \b, BSD disklabel # by Joerg Jenderek at Apr 2013 # Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension # like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 0 name DOS-filename # space=0x20 (00100000b) means empty >0 ubyte&0xDF >0 >>0 ubyte x \b%c >>>1 ubyte&0xDF >0 >>>>1 ubyte x \b%c >>>>>2 ubyte&0xDF >0 >>>>>>2 ubyte x \b%c >>>>>>>3 ubyte&0xDF >0 >>>>>>>>3 ubyte x \b%c >>>>>>>>>4 ubyte&0xDF >0 >>>>>>>>>>4 ubyte x \b%c >>>>>>>>>>>5 ubyte&0xDF >0 >>>>>>>>>>>>5 ubyte x \b%c >>>>>>>>>>>>>6 ubyte&0xDF >0 >>>>>>>>>>>>>>6 ubyte x \b%c >>>>>>>>>>>>>>>7 ubyte&0xDF >0 >>>>>>>>>>>>>>>>7 ubyte x \b%c # DOS filename extension >>8 ubyte&0xDF >0 \b. >>>8 ubyte x \b%c >>>>9 ubyte&0xDF >0 >>>>>9 ubyte x \b%c >>>>>>10 ubyte&0xDF >0 >>>>>>>10 ubyte x \b%c # Print 2 following DOS filenames from directory entry form # like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 0 name 2xDOS-filename # display 1 space >0 ubyte x \b >0 use DOS-filename >11 ubyte x \b+ >11 use DOS-filename # https://en.wikipedia.org/wiki/Master_boot_record#PTE # display standard partition table 0 name partition-table #>0 ubyte x PARTITION-TABLE # test and display 1st til 4th partition table entry >0 use partition-entry-test >16 use partition-entry-test >32 use partition-entry-test >48 use partition-entry-test # test for entry of partition table 0 name partition-entry-test # partition type ID > 0 >4 ubyte >0 # active flag 0 >>0 ubyte 0 >>>0 use partition-entry # active flag 0x80, 0x81, ... >>0 ubyte >0x7F >>>0 use partition-entry # Print entry of partition table 0 name partition-entry # partition type ID > 0 >4 ubyte >0 \b; partition >>64 leshort 0xAA55 1 >>48 leshort 0xAA55 2 >>32 leshort 0xAA55 3 >>16 leshort 0xAA55 4 >>4 ubyte x : ID=%#x >>0 ubyte&0x80 0x80 \b, active >>0 ubyte >0x80 %#x >>1 ubyte x \b, start-CHS ( >>1 use partition-chs >>5 ubyte x \b), end-CHS ( >>5 use partition-chs >>8 ulelong x \b), startsector %u >>12 ulelong x \b, %u sectors # Print cylinder,head,sector (CHS) of partition entry 0 name partition-chs # cylinder >1 ubyte x \b0x >1 ubyte&0xC0 0x40 \b1 >1 ubyte&0xC0 0x80 \b2 >1 ubyte&0xC0 0xC0 \b3 >2 ubyte x \b%x # head >0 ubyte x \b,%u # sector >1 ubyte&0x3F x \b,%u # FATX 0 string FATX FATX filesystem data # romfs filesystems - Juan Cespedes 0 string -rom1fs- romfs filesystem, version 1 >8 belong x %d bytes, >16 string x named %s. # netboot image - Juan Cespedes 0 lelong 0x1b031336L Netboot image, >4 lelong&0xFFFFFF00 0 >>4 lelong&0x100 0x000 mode 2 >>4 lelong&0x100 0x100 mode 3 >4 lelong&0xFFFFFF00 !0 unknown mode 0x18b string OS/2 OS/2 Boot Manager # updated by Joerg Jenderek at Oct 2008 and Sep 2012 # https://syslinux.zytor.com/iso.php # tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 # assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 0 ulequad&0x909000007cc0eafa 0x909000007c40eafa >631 search/689 ISOLINUX\ isolinux Loader >>&0 string x (version %-4.4s) # https://syslinux.zytor.com/pxe.php # assembler instructions: jmp 7C05 0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) # assembler instructions: pushfd;pushad 0 ulelong 0x60669c66 pxelinux loader # assembler instructions: jmp 05 0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) # https://syslinux.zytor.com/wiki/index.php/SYSLINUX 0 string LDLINUX\ SYS\ SYSLINUX loader >12 string x (older version %-4.4s) 0 string \r\nSYSLINUX\ SYSLINUX loader >11 string x (version %-4.4s) # syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 # assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 0 ulelong&0x80909bEB 0x009018EB # OEM-ID not always "SYSLINUX" >434 search/47 Boot\ failed # followed by \r\n\0 or :\ >>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) >>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) >459 search/30 Boot\ error\r\n\0 >>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) # SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 # assembler instructions: mov di,0600h;mov cx,0100h 16 search/4 \xbf\x00\x06\xb9\x00\x01 # to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) !:strength +36 >94 search/249 Missing\ operating\ system # followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other # skip Ranish MBR >>408 search/4 HD1/\0 >>408 default x >>>250 search/118 \0Operating\ system\ load SYSLINUX MBR # followed by "ing " or space >>>>292 search/98 error >>>>>&0 string \r (version 3.35 or older) >>>>>&0 string .\r (version 3.52 or newer) >>>>>&0 default x (version 3.36-3.51 ) >368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR >>156 search/10 \0Boot\ partition\ not\ found\r\n >>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) >>174 search/10 \0Missing\ OS\r\n >>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) # SYSLINUX END # NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 # assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 0 ubequad 0x31c08ed0bc007c8e # mbr_bootsel magic before partition table not reliable with small ipl fragments #>444 uleshort 0xb5e1 >0004 uleshort x # ERRorTeXT >>181 search/166 Error\ \0\r\n NetBSD mbr # NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS >>>0x1B8 ubelong >0 \b,Serial %#-.8x # BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx >>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector # BOOT_EXTENDED definitions contains assembler instructions: # xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 >>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended # COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al >>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO # not TERSE_ERROR >>>196 search/106 No\ active\ partition\0 >>>>&0 string Disk\ read\ error\0 >>>>>&0 string No\ operating\ system\0 \b,verbose # not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 >>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS # not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 >>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check # assembler instructions: movw nametab,bx >>>0x26 search/21 \xBB\x94\x07 # not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf >>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 >>>>>181 search/166 Error\ \0 # "a: disk" , "Fn: diskn" or "NetBSD MBR boot" >>>>>>&3 string x \b,"%s" >>>446 use partition-table # Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html # added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 # assembler instructions: jmp short 0x58;nop;ASCII 0 ubequad&0xeb58908000000000 0xeb58900000000000 # assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, >(1.b+2) ubequad 0xfa31c08ed88ec08e # Error messages at end of code >>376 string No\ operating\ system\r\n\0 >>>398 string Disk\ error\r\n\0FDD\0HDD\0 >>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr # Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/ # added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 # for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, # or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC # pointer to the data starting with Neil Turton signature string >(0x1BC.s) string NDTmbr >>&-14 string 1234F\0 Turton mbr ( # parameters also viewed by install-mbr --list >>>(0x1BC.s+7) ubyte x \b%u<= >>>(0x1BC.s+9) ubyte x \bVersion<=%u #>>>(0x1BC.s+8) ubyte x asm_flag_%x >>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix # variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode >>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk #0x1~1,..,0x8~4,0x10~F,0x80~A enabled #>>>(0x1BC.s+10) ubyte x \b,flags %#x #0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot #>>>(0x1BC.s+11) ubyte x \b,cfg_def %#x # for older versions >>>(0x1BC.s+9) ubyte <2 #>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds >>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds # floppy A: or B: >>>>(0x1BC.s+13) ubyte <2 \b,floppy %#x >>>>(0x1BC.s+13) ubyte >1 # 1st hard disc #>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive %#x # not 1st hard disc >>>>>(0x1BC.s+13) ubyte !0x80 \b,drive %#x # for version >= 2 maximal timeout can be 65534 >>>(0x1BC.s+9) ubyte >1 #>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds >>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds # floppy A: or B: >>>>(0x1BC.s+14) ubyte <2 \b,floppy %#x >>>>(0x1BC.s+14) ubyte >1 # 1st hard disc #>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive %#x # not 1st hard disc >>>>>(0x1BC.s+14) ubyte !0x80 \b,drive %#x >>>0 ubyte x \b) # added by Joerg Jenderek # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or # grub-1.94/kern/i386/pc/startup.S # https://www.gnu.org/software/grub/manual/grub.html#Embedded-data # usual values are marked with comments to get only information of strange GRUB loaders 0x200 uleshort 0x70EA # found only version 3.{1,2} >0x206 ubeshort >0x0300 # GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" >>0x212 ubyte >0x29 >>>0x213 ubyte >0x29 # not iso9660_stage1_5 #>>>0 ulelong&0x00BE5652 0x00BE5652 >>>>0x213 ubyte >0x29 GRand Unified Bootloader # config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" >>>>0x217 ubyte 0xFF stage1_5 >>>>0x217 ubyte <0xFF stage2 >>>>0x206 ubyte x \b version %u >>>>0x207 ubyte x \b.%u # module_size for 1.94 >>>>0x208 ulelong <0xffffff \b, installed partition %u #>>>>0x208 ulelong =0xffffff \b, %lu (default) >>>>0x208 ulelong >0xffffff \b, installed partition %u # GRUB 0.5.95 unofficial >>>>0x20C ulelong&0x2E300000 0x2E300000 # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs >>>>>0x20C ubyte x \b, identifier %#x #>>>>>0x20D ubyte =0 \b, LBA flag %#x (default) >>>>>0x20D ubyte >0 \b, LBA flag %#x # GRUB version as string >>>>>0x20E string >\0 \b, GRUB version %-s # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default >>>>>>0x215 ulong 0xffffffff >>>>>>>0x219 string >\0 \b, configuration file %-s >>>>>>0x215 ulong !0xffffffff >>>>>>>0x215 string >\0 \b, configuration file %-s # newer GRUB versions >>>>0x20C ulelong&0x2E300000 !0x2E300000 ##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) >>>>>0x20C ulelong >0 \b, saved entry %d # for 1.94 contains kernel image size # for 0.93,0.94,0.96,0.97 # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 >>>>>0x210 ubyte x \b, identifier %#x # The flag for LBA forcing is in most cases 0 #>>>>>0x211 ubyte =0 \b, LBA flag %#x (default) >>>>>0x211 ubyte >0 \b, LBA flag %#x # GRUB version as string >>>>>0x212 string >\0 \b, GRUB version %-s # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default >>>>>0x217 ulong 0xffffffff >>>>>>0x21b string >\0 \b, configuration file %-s >>>>>0x217 ulong !0xffffffff >>>>>>0x217 string >\0 \b, configuration file %-s # DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 # over BIOS parameter block (BPB) # https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD # older drives may use Near JuMP instruction E9 xx xx # minimal short forward jump found 0x29 for bootloaders or 0x0 # maximal short forward jump is 0x7f # OEM-ID is empty or contain readable bytes 0 ulelong&0x804000E9 0x000000E9 !:strength +60 # mtools-3.9.8/msdos.h # usual values are marked with comments to get only information of strange FAT systems # valid sectorsize must be a power of 2 from 32 to 32768 >11 uleshort&0x001f 0 >>11 uleshort <32769 >>>11 uleshort >31 >>>>21 ubyte&0xf0 0xF0 >>>>>0 ubyte 0xEB DOS/MBR boot sector >>>>>>1 ubyte x \b, code offset %#x+2 >>>>>0 ubyte 0xE9 >>>>>>1 uleshort x \b, code offset %#x+3 >>>>>3 string >\0 \b, OEM-ID "%-.8s" #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC >>>>>>8 string IHC \b cached by Windows 9M >>>>>11 uleshort >512 \b, Bytes/sector %u #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) >>>>>11 uleshort <512 \b, Bytes/sector %u >>>>>13 ubyte >1 \b, sectors/cluster %u #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) # for lazy FAT32 implementation like Transcend digital photo frame PF830 >>>>>82 string/c fat32 >>>>>>14 uleshort !32 \b, reserved sectors %u #>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) >>>>>82 string/c !fat32 >>>>>>14 uleshort >1 \b, reserved sectors %u #>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) #>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) >>>>>16 ubyte >2 \b, FATs %u #>>>>>16 ubyte =2 \b, FATs %u (usual) >>>>>16 ubyte =1 \b, FAT %u >>>>>16 ubyte >0 >>>>>17 uleshort >0 \b, root entries %u #>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) #>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) >>>>>21 ubyte >0xF0 \b, Media descriptor %#x #>>>>>21 ubyte =0xF0 \b, Media descriptor %#x (usual floppy) >>>>>21 ubyte <0xF0 \b, Media descriptor %#x >>>>>22 uleshort >0 \b, sectors/FAT %u #>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) >>>>>24 uleshort x \b, sectors/track %u >>>>>26 ubyte >2 \b, heads %u #>>>>>26 ubyte =2 \b, heads %u (usual floppy) >>>>>26 ubyte =1 \b, heads %u # valid only for sector sizes with more then 32 Bytes >>>>>11 uleshort >32 # https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block # skip for values 2,2Ah,70h,73h,DFh # and continue for extended boot signature values 0,28h,29h,80h >>>>>>38 ubyte&0x56 =0 >>>>>>>28 ulelong >0 \b, hidden sectors %u #>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) #>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) # FAT<32 bit specific >>>>>>>82 string/c !fat32 #>>>>>>>>36 ubyte 0x80 \b, physical drive %#x=0x80 (usual harddisk) #>>>>>>>>36 ubyte 0 \b, physical drive %#x=0 (usual floppy) >>>>>>>>36 ubyte !0x80 >>>>>>>>>36 ubyte !0 \b, physical drive %#x # VGA-copy CRC or # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too >>>>>>>>37 ubyte >0 \b, reserved %#x #>>>>>>>>37 ubyte =0 \b, reserved %#x # extended boot signature value is 0x80 for NTFS, 0x28 or 0x29 for others >>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (%#x) >>>>>>>>38 ubyte&0xFE =0x28 >>>>>>>>>39 ulelong x \b, serial number %#x >>>>>>>>38 ubyte =0x29 >>>>>>>>>43 string >>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" >>>>>>>>>43 string =NO\ NAME \b, unlabeled # there exist some old floppies without word FAT at offset 54 # a word like "FATnm " is only a hint for a FAT size on nm-bits # Normally the number of clusters is calculated by the values of BPP. # if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, # otherwise FAT is 16 bit. # http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html >>>>>82 string/c !fat32 >>>>>>54 string FAT12 \b, FAT (12 bit) >>>>>>54 string FAT16 \b, FAT (16 bit) >>>>>>54 default x # determinate FAT bit size by media descriptor # small floppies implies FAT12 >>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor) # with media descriptor F0h floppy or maybe superfloppy with FAT16 >>>>>>>21 ubyte =0xF0 # superfloppy (many sectors) implies FAT16 >>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors) # no superfloppy with media descriptor F0h implies FAT12 >>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors) # with media descriptor F8h floppy or hard disc with FAT12 or FAT16 >>>>>>>21 ubyte =0xF8 # 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12 >>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry) # hard disc with FAT12 or FAT16 >>>>>>>>19 default x \b, FAT (1Y bit by descriptor) # with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc >>>>>>>21 ubyte =0xFA # 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12 >>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry) # RAM disc with FAT12 or FAT16 or Tandy hard disc >>>>>>>>19 default x \b, FAT (1Y bit by descriptor) # others are floppy >>>>>>>21 default x \b, FAT (12 bit by descriptor) # FAT32 bit specific >>>>>82 string/c fat32 \b, FAT (32 bit) >>>>>>36 ulelong x \b, sectors/FAT %u # https://technet.microsoft.com/en-us/library/cc977221.aspx >>>>>>40 uleshort >0 \b, extension flags %#x #>>>>>>40 uleshort =0 \b, extension flags %hu >>>>>>42 uleshort >0 \b, fsVersion %u #>>>>>>42 uleshort =0 \b, fsVersion %u (usual) >>>>>>44 ulelong >2 \b, rootdir cluster %u #>>>>>>44 ulelong =2 \b, rootdir cluster %u #>>>>>>44 ulelong =1 \b, rootdir cluster %u >>>>>>48 uleshort >1 \b, infoSector %u #>>>>>>48 uleshort =1 \b, infoSector %u (usual) >>>>>>48 uleshort <1 \b, infoSector %u # 0 or 0xFFFF instead of usual 6 means no backup sector >>>>>>50 uleshort =0xFFFF \b, no Backup boot sector >>>>>>50 uleshort =0 \b, no Backup boot sector #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) >>>>>>50 default x >>>>>>>50 uleshort x \b, Backup boot sector %u # corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO >>>>>>52 ulelong >0 \b, reserved1 %#x >>>>>>56 ulelong >0 \b, reserved2 %#x >>>>>>60 ulelong >0 \b, reserved3 %#x # same structure as FAT1X #>>>>>>64 ubyte =0x80 \b, physical drive %#x=80 (usual harddisk) #>>>>>>64 ubyte =0 \b, physical drive %#x=0 (usual floppy) >>>>>>64 ubyte !0x80 >>>>>>>64 ubyte >0 \b, physical drive %#x # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too >>>>>>65 ubyte >0 \b, reserved %#x >>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (%#x) >>>>>>66 ubyte =0x29 >>>>>>>67 ulelong x \b, serial number %#x >>>>>>>71 string >>>>>>71 string >NO\ NAME \b, label: "%11.11s" >>>>>>>71 string =NO\ NAME \b, unlabeled # additional tests for floppy image added by Joerg Jenderek # no fixed disk >>>>>21 ubyte !0xF8 # floppy media with 12 bit FAT >>>>>>54 string !FAT16 # test for FAT after bootsector >>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT # floppy image !:mime application/x-ima # NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm # and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html # 0 FATs >>>>>16 ubyte =0 # 0 root entries >>>>>>17 uleshort =0 # 0 DOS sectors >>>>>>>19 uleshort =0 # 0 sectors/FAT # dos < 4.0 BootSector value found is 0x80 #38 ubyte =0x80 \b, dos < 4.0 BootSector (%#x) >>>>>>>>22 uleshort =0 \b; NTFS >>>>>>>>>24 uleshort >0 \b, sectors/track %u >>>>>>>>>36 ulelong !0x800080 \b, physical drive %#x >>>>>>>>>40 ulequad >0 \b, sectors %lld >>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld >>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld # Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. # Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. >>>>>>>>>64 lelong <256 >>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) # Values 0 to 127 represent index block sizes of 0 to 127 clusters. # Values 128 to 255 represent index block sizes of 2^(256-N) byte >>>>>>>>>68 ulelong <256 >>>>>>>>>>68 ulelong <128 \b, clusters/index block %d #>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) >>>>>>>>>72 ulequad x \b, serial number 0%llx >>>>>>>>>80 ulelong >0 \b, checksum %#x #>>>>>>>>>80 ulelong =0 \b, checksum %#x=0 (usual) # unicode loadername size jump >>>>>>>>>(0x200.s*2) ubyte x # in next sector loadername terminated by unicode CTRL-D and $ >>>>>>>>>>&0x1FF ulequad&0x0000FFffFFffFF00 0x0000002400040000 \b; contains # if 2nd NTFS sectors is found then assume whole filesystem #!:mime application/x-raw-disk-image !:ext img/bin/ntfs >>>>>>>>>>>0x200 use ntfs-sector2 # For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019 # https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm # unused assembler instructions short JMP y2;NOP;NOP 0x056 ulelong&0xFFFF0FFF 0x909002EB NTFS #!:mime application/octet-stream !:ext bin >0 use ntfs-sector2 # https://memory.dataram.com/products-and-services/software/ramdisk # assembler instructions JMP C000;NOP 0x056 ulelong 0x9000c0e9 NTFS #!:mime application/octet-stream !:ext bin >0 use ntfs-sector2 # check for characteristics of second NTFS sector and then display loader name 0 name ntfs-sector2 # number of utf16 characters of loadername >0 uleshort <8 # unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP >>0x056 ulelong&0xFF0000FD 0x900000E9 # loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR >>>0x002 lestring16 x bootstrap %-5.5s # check for 7 character length of loader name like BOOTMGR >>>0 uleshort 7 >>>>0x0c lestring16 x \b%-2.2s ### DOS,NTFS boot sectors end # ntfsclone-image is a special save format for NTFS volumes, # created and restored by the ntfsclone program 0 string \0ntfsclone-image ntfsclone image, >0x10 byte x version %d. >0x11 byte x \b%d, >0x12 lelong x cluster size %d, >0x16 lequad x device size %lld, >0x1e lequad x %lld total clusters, >0x26 lequad x %lld clusters in use 0 name ffsv1 >8404 string x last mounted on %s, #>9504 ledate x last checked at %s, >8224 ledate x last written at %s, >8401 byte x clean flag %d, >8228 lelong x number of blocks %d, >8232 lelong x number of data blocks %d, >8236 lelong x number of cylinder groups %d, >8240 lelong x block size %d, >8244 lelong x fragment size %d, >8252 lelong x minimum percentage of free blocks %d, >8256 lelong x rotational delay %dms, >8260 lelong x disk rotational speed %drps, >8320 lelong 0 TIME optimization >8320 lelong 1 SPACE optimization 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), >0 use ffsv1 9564 belong 0x00011954 Unix Fast File system [v1] (big-endian), >7168 belong 0x4c41424c Apple UFS Volume >>7186 string x named %s, >>7176 belong x volume label version %d, >>7180 bedate x created on %s, >0 use \^ffsv1 0 name ffsv2 >212 string x last mounted on %s, >680 string >\0 volume name %s, >1072 leqldate x last written at %s, >209 byte x clean flag %d, >210 byte x readonly flag %d, >1080 lequad x number of blocks %lld, >1088 lequad x number of data blocks %lld, >44 lelong x number of cylinder groups %d, >48 lelong x block size %d, >52 lelong x fragment size %d, >1196 lelong x average file size %d, >1200 lelong x average number of files in dir %d, >1104 lequad x pending blocks to free %lld, >1112 lelong x pending inodes to free %d, >712 lequad x system-wide uuid %0llx, >60 lelong x minimum percentage of free blocks %d, >128 lelong 0 TIME optimization >128 lelong 1 SPACE optimization 42332 lelong 0x19012038 Unix Fast File system [v2ea] (little-endian) >40960 use ffsv2 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) >40960 use ffsv2 42332 belong 0x19012038 Unix Fast File system [v2ea] (little-endian) >40960 use \^ffsv2 42332 belong 0x19540119 Unix Fast File system [v2] (big-endian) >40960 use \^ffsv2 66908 lelong 0x19012038 Unix Fast File system [v2ea] (little-endian) >65536 use ffsv2 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) >65536 use ffsv2 66908 belong 0x19012038 Unix Fast File system [v2ea] (little-endian) >65536 use \^ffsv2 66908 belong 0x19540119 Unix Fast File system [v2] (big-endian) >65536 use \^ffsv2 0 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian), >0x90 lelong+1 x volume %d >0x94 lelong x (of %d), >0x50 string x name %s, >0x98 ulelong x version %u, >0xa0 ulelong x flags %#x 0 ulequad 0x48414d3205172011 HAMMER2 filesystem (little-endian), >0x3b byte x volume %d, >0x28 ulequad/1073741824 x size %lluGB, >0x30 ulelong x version %u, >0x34 ulelong x flags %#x # ext2/ext3 filesystems - Andreas Dilger # ext4 filesystem - Eric Sandeen # volume label and UUID Russell Coker # https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 0x438 leshort 0xEF53 Linux >0x44c lelong x rev %d >0x43e leshort x \b.%d # No journal? ext2 >0x45c lelong ^0x0000004 ext2 filesystem data >>0x43a leshort ^0x0000001 (mounted or unclean) # Has a journal? ext3 or ext4 >0x45c lelong &0x0000004 # and small INCOMPAT? >>0x460 lelong <0x0000040 # and small RO_COMPAT? >>>0x464 lelong <0x0000008 ext3 filesystem data # else large RO_COMPAT? >>>0x464 lelong >0x0000007 ext4 filesystem data # else large INCOMPAT? >>0x460 lelong >0x000003f ext4 filesystem data >0x468 ubelong x \b, UUID=%08x >0x46c ubeshort x \b-%04x >0x46e ubeshort x \b-%04x >0x470 ubeshort x \b-%04x >0x472 ubelong x \b-%08x >0x476 ubeshort x \b%04x >0x478 string >0 \b, volume name "%s" # General flags for any ext* fs >0x460 lelong &0x0000004 (needs journal recovery) >0x43a leshort &0x0000002 (errors) # INCOMPAT flags >0x460 lelong &0x0000001 (compressed) #>0x460 lelong &0x0000002 (filetype) #>0x460 lelong &0x0000010 (meta bg) >0x460 lelong &0x0000040 (extents) >0x460 lelong &0x0000080 (64bit) #>0x460 lelong &0x0000100 (mmp) #>0x460 lelong &0x0000200 (flex bg) # RO_INCOMPAT flags #>0x464 lelong &0x0000001 (sparse super) >0x464 lelong &0x0000002 (large files) >0x464 lelong &0x0000008 (huge files) #>0x464 lelong &0x0000010 (gdt checksum) #>0x464 lelong &0x0000020 (many subdirs) #>0x463 lelong &0x0000040 (extra isize) # f2fs filesystem - Tuomas Tynkkynen 0x400 lelong 0xF2F52010 F2FS filesystem >0x46c ubelong x \b, UUID=%08x >0x470 ubeshort x \b-%04x >0x472 ubeshort x \b-%04x >0x474 ubeshort x \b-%04x >0x476 ubelong x \b-%08x >0x47a ubeshort x \b%04x >0x147c lestring16 x \b, volume name "%s" # Minix filesystems - Juan Cespedes 0x410 leshort 0x137f !:strength / 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x137f !:strength / 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x138f !:strength / 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x138f !:strength / 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones >0x1e string minix \b, bootable # Weak Magic: this is $x #0x410 leshort 0x2468 #>0x402 beshort < 100 #>>0x402 beshort > -1 Minix filesystem, V2, 14 char names #>0x1e string minix \b, bootable #0x410 beshort 0x2468 #>0x402 beshort < 100 #>0x402 beshort > -1 Minix filesystem, V2 (big endian) #>0x1e string minix \b, bootable #0x410 leshort 0x2478 #>0x402 beshort < 100 #>0x402 beshort > -1 Minix filesystem, V2, 30 char names #>0x1e string minix \b, bootable #0x410 leshort 0x2478 #>0x402 beshort < 100 #>0x402 beshort > -1 Minix filesystem, V2, 30 char names #>0x1e string minix \b, bootable #0x410 beshort 0x2478 #>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian) #>0x1e string minix \b, bootable # Weak Magic! this is MD #0x418 leshort 0x4d5a #>0x402 beshort <100 #>>0x402 beshort > -1 Minix filesystem, V3, 60 char names # SGI disk labels - Nathan Scott 0 belong 0x0BE5A941 SGI disk label (volume header) # SGI XFS filesystem - Nathan Scott 0 belong 0x58465342 SGI XFS filesystem data >0x4 belong x (blksz %d, >0x68 beshort x inosz %d, >0x64 beshort ^0x2004 v1 dirs) >0x64 beshort &0x2004 v2 dirs) ############################################################################ # Minix-ST kernel floppy 0x800 belong 0x46fc2700 Atari-ST Minix kernel image # https://en.wikipedia.org/wiki/BIOS_parameter_block # floppies with valid BPB and any instruction at beginning >19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy >19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy ############################################################################ # Hmmm, is this a better way of detecting _standard_ floppy images ? 19 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 19 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k # | | | | | # | | | | heads # | | | sectors/track # | | sectors/FAT # | media descriptor # BPB: sectors # Valid media descriptor bytes for MS-DOS: # # Byte Capacity Media Size and Type # ------------------------------------------------- # # F0 2.88 MB 3.5-inch, 2-sided, 36-sector # F0 1.44 MB 3.5-inch, 2-sided, 18-sector # F9 720K 3.5-inch, 2-sided, 9-sector # F9 1.2 MB 5.25-inch, 2-sided, 15-sector # FD 360K 5.25-inch, 2-sided, 9-sector # FF 320K 5.25-inch, 2-sided, 8-sector # FC 180K 5.25-inch, 1-sided, 9-sector # FE 160K 5.25-inch, 1-sided, 8-sector # FE 250K 8-inch, 1-sided, single-density # FD 500K 8-inch, 2-sided, single-density # FE 1.2 MB 8-inch, 2-sided, double-density # F8 ----- Fixed disk # # FC xxxK Apricot 70x1x9 boot disk. # # Originally a bitmap: # xxxxxxx0 Not two sided # xxxxxxx1 Double sided # xxxxxx0x Not 8 SPT # xxxxxx1x 8 SPT # xxxxx0xx Not Removable drive # xxxxx1xx Removable drive # 11111xxx Must be one. # # But now it's rather random: # 111111xx Low density disk # 00 SS, Not 8 SPT # 01 DS, Not 8 SPT # 10 SS, 8 SPT # 11 DS, 8 SPT # # 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 # 11110000 High density 3 1/2 floppy disk # 11111000 Hard disk any format # # all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 # https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions # Too Weak. #512 ubelong&0xE0ffff00 0xE0ffff00 # without valid Media descriptor in place of BPB, cases with are done at other places #>21 ubyte <0xE5 floppy with old FAT filesystem # but valid Media descriptor at begin of FAT #>>512 ubyte =0xed 720k #>>512 ubyte =0xf0 1440k #>>512 ubyte =0xf8 720k #>>512 ubyte =0xf9 1220k #>>512 ubyte =0xfa 320k #>>512 ubyte =0xfb 640k #>>512 ubyte =0xfc 180k # look like an old DOS directory entry #>>>0xA0E ubequad 0 #>>>>0xA00 ubequad !0 #!:mime application/x-ima #>>512 ubyte =0xfd # look for 2nd FAT at different location to distinguish between 360k and 500k #>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k #>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k #>>>0xA0E ubequad 0 #!:mime application/x-ima #>>512 ubyte =0xfe #>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k #>>>>0x60E ubequad 0 #>>>>>0x600 ubequad !0 #!:mime application/x-ima #>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k #>>512 ubyte =0xff 320k #>>>0x60E ubequad 0 #>>>>0x600 ubequad !0 #!:mime application/x-ima #>>512 ubyte x \b, Media descriptor %#x # without x86 jump instruction #>>0 ulelong&0x804000E9 !0x000000E9 # assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV #>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader # IOSYS.COM+MSDOS.COM #>>>>0xc4 use 2xDOS-filename #>>0 ulelong&0x804000E9 =0x000000E9 # only x86 short jump instruction found #>>>0 ubyte =0xEB #>>>>1 ubyte x \b, code offset %#x+2 # https://thestarman.pcministry.com/DOS/ibm100/Boot.htm # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 #>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader # ibmbio.com+ibmdos.com #>>>>>0x176 use DOS-filename #>>>>>0x181 ubyte x \b+ #>>>>>0x182 use DOS-filename # https://thestarman.pcministry.com/DOS/ibm110/Boot.htm # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV #>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader # ibmbio.com+ibmdos.com #>>>>>0x18b use DOS-filename #>>>>>0x196 ubyte x \b+ #>>>>>0x197 use DOS-filename # https://en.wikipedia.org/wiki/Zenith_Data_Systems # assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 #>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader # IO.SYS+MSDOS.SYS #>>>>>0x20 use 2xDOS-filename # https://en.wikipedia.org/wiki/Corona_Data_Systems # assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; #>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader # IO.SYS+MSDOS.SYS #>>>>>0x69 use 2xDOS-filename # assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; #>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader # defect IO.SYS+MSDOS.SYS ? #>>>>>0x162 use 2xDOS-filename 0 name cdrom >38913 string !NSR0 ISO 9660 CD-ROM filesystem data !:mime application/x-iso9660-image !:ext iso/iso9660 >38913 string NSR0 UDF filesystem data !:mime application/x-iso9660-image !:ext iso/udf >>38917 string 1 (version 1.0) >>38917 string 2 (version 1.5) >>38917 string 3 (version 2.0) >>38917 byte >0x33 (unknown version, ID %#X) >>38917 byte <0x31 (unknown version, ID %#X) # The next line is not necessary because the MBR staff is done looking for boot signature >0x1FE leshort 0xAA55 (DOS/MBR boot sector) # "application id" which appears to be used as a volume label >32808 string/T >\0 '%.32s' >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) !:mime application/x-iso9660-image 32777 string CDROM High Sierra CD-ROM filesystem data # "application id" which appears to be used as a volume label >32816 string/T >\0 '%.32s' # CDROM Filesystems # https://en.wikipedia.org/wiki/ISO_9660 # Modified for UDF by gerardo.cacciari@@gmail.com 32769 string CD001 # mime line at that position does not work # to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51) #!:strength -11 # to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51) !:strength +35 >0 use cdrom # URL: https://en.wikipedia.org/wiki/NRG_(file_format) # Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/ # 11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh # From: Joerg Jenderek # Note: Only for nero disc with once (DAO) type after 300 KB header 339969 string CD001 Nero CD image at 0x4B000 !:mime application/x-nrg !:ext nrg >307200 use cdrom # .cso files # Reference: https://pismotec.com/ciso/ciso.h # NOTE: There are two other formats with the same magic but # completely incompatible specifications: # - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h # - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h 0 string CISO # Other fields are used to determine what type of CISO this is: # - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) # - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) # - 0x10 == 0x00004000: For >2GB files using maxcso... # https://github.com/unknownbrackets/maxcso/issues/26 # - None of the above: Compact ISO. >4 lelong !0 >>4 lelong !0x200000 >>>16 lelong !0x800 >>>>16 lelong !0x4000 Compressed ISO CD image # cramfs filesystem - russell@@coker.com.au 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian >4 lelong x size %u >8 lelong &1 version #2 >8 lelong &2 sorted_dirs >8 lelong &4 hole_support >32 lelong x CRC %#x, >36 lelong x edition %u, >40 lelong x %u blocks, >44 lelong x %u files 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian >4 belong x size %u >8 belong &1 version #2 >8 belong &2 sorted_dirs >8 belong &4 hole_support >32 belong x CRC %#x, >36 belong x edition %u, >40 belong x %u blocks, >44 belong x %u files # reiserfs - russell@@coker.com.au 0x10034 string ReIsErFs ReiserFS V3.5 0x10034 string ReIsEr2Fs ReiserFS V3.6 0x10034 string ReIsEr3Fs ReiserFS V3.6.19 >0x1002c leshort x block size %d >0x10032 leshort &2 (mounted or unclean) >0x10000 lelong x num blocks %d >0x10040 lelong 1 tea hash >0x10040 lelong 2 yura hash >0x10040 lelong 3 r5 hash # EST flat binary format (which isn't, but anyway) # From: Mark Brown 0 string ESTFBINR EST flat binary # Aculab VoIP firmware # From: Mark Brown 0 string VoIP\ Startup\ and Aculab VoIP firmware >35 string x format %s # From: Mark Brown [old] # From: Behan Webster 0 belong 0x27051956 u-boot legacy uImage, >32 string x %s, >28 byte 0 Invalid os/ >28 byte 1 OpenBSD/ >28 byte 2 NetBSD/ >28 byte 3 FreeBSD/ >28 byte 4 4.4BSD/ >28 byte 5 Linux/ >28 byte 6 SVR4/ >28 byte 7 Esix/ >28 byte 8 Solaris/ >28 byte 9 Irix/ >28 byte 10 SCO/ >28 byte 11 Dell/ >28 byte 12 NCR/ >28 byte 13 LynxOS/ >28 byte 14 VxWorks/ >28 byte 15 pSOS/ >28 byte 16 QNX/ >28 byte 17 Firmware/ >28 byte 18 RTEMS/ >28 byte 19 ARTOS/ >28 byte 20 Unity OS/ >28 byte 21 INTEGRITY/ >29 byte 0 \bInvalid CPU, >29 byte 1 \bAlpha, >29 byte 2 \bARM, >29 byte 3 \bIntel x86, >29 byte 4 \bIA64, >29 byte 5 \bMIPS, >29 byte 6 \bMIPS 64-bit, >29 byte 7 \bPowerPC, >29 byte 8 \bIBM S390, >29 byte 9 \bSuperH, >29 byte 10 \bSparc, >29 byte 11 \bSparc 64-bit, >29 byte 12 \bM68K, >29 byte 13 \bNios-32, >29 byte 14 \bMicroBlaze, >29 byte 15 \bNios-II, >29 byte 16 \bBlackfin, >29 byte 17 \bAVR32, >29 byte 18 \bSTMicroelectronics ST200, >29 byte 19 \bSandbox architecture, >29 byte 20 \bANDES Technology NDS32, >29 byte 21 \bOpenRISC 1000, >29 byte 22 \bARM 64-bit, >29 byte 23 \bDesignWare ARC, >29 byte 24 \bx86_64, >29 byte 25 \bXtensa, >29 byte 26 \bRISC-V, >30 byte 0 Invalid Image >30 byte 1 Standalone Program >30 byte 2 OS Kernel Image >30 byte 3 RAMDisk Image >30 byte 4 Multi-File Image >30 byte 5 Firmware Image >30 byte 6 Script File >30 byte 7 Filesystem Image (any type) >30 byte 8 Binary Flat Device Tree BLOB >31 byte 0 (Not compressed), >31 byte 1 (gzip), >31 byte 2 (bzip2), >31 byte 3 (lzma), >12 belong x %d bytes, >8 bedate x %s, >16 belong x Load Address: %#08X, >20 belong x Entry Point: %#08X, >4 belong x Header CRC: %#08X, >24 belong x Data CRC: %#08X # JFFS2 file system 0 leshort 0x1984 Linux old jffs2 filesystem data little endian 0 beshort 0x1984 Linux old jffs2 filesystem data big endian 0 leshort 0x1985 Linux jffs2 filesystem data little endian 0 beshort 0x1985 Linux jffs2 filesystem data big endian # Squashfs 0 name squashfs >28 beshort x version %d. >30 beshort x \b%d, >20 beshort 0 uncompressed, >20 beshort 1 zlib >20 beshort 2 lzma >20 beshort 3 lzo >20 beshort 4 xz >20 beshort 5 lz4 >20 beshort 6 zstd >20 beshort >0 compressed, >28 beshort <3 >>8 belong x %d bytes, >28 beshort >2 >>28 beshort <4 >>>63 bequad x %lld bytes, >>28 beshort >3 >>>40 bequad x %lld bytes, #>>67 belong x %d bytes, >4 belong x %d inodes, >28 beshort <2 >>32 beshort x blocksize: %d bytes, >28 beshort >1 >>28 beshort <4 >>>51 belong x blocksize: %d bytes, >>28 beshort >3 >>>12 belong x blocksize: %d bytes, >28 beshort <4 >>39 bedate x created: %s >28 beshort >3 >>8 bedate x created: %s 0 string sqsh Squashfs filesystem, big endian, >0 use squashfs 0 string hsqs Squashfs filesystem, little endian, >0 use \^squashfs # AFS Dump Magic # From: Ty Sarna 0 string \x01\xb3\xa1\x13\x22 AFS Dump >&0 belong x (v%d) >>&0 byte 0x76 >>>&0 belong x Vol %d, >>>>&0 byte 0x6e >>>>>&0 string x %s >>>>>>&1 byte 0x74 >>>>>>>&0 beshort 2 >>>>>>>>&4 bedate x on: %s >>>>>>>>&0 bedate =0 full dump >>>>>>>>&0 bedate !0 incremental since: %s #---------------------------------------------------------- #delta ISO Daniel Novotny (dnovotny@@redhat.com) 0 string DISO Delta ISO data !:strength +50 >4 belong x version %d # VMS backup savesets - gerardo.cacciari@@gmail.com # 4 string \x01\x00\x01\x00\x01\x00 >(0.s+16) string \x01\x01 >>&(&0.b+8) byte 0x42 OpenVMS backup saveset data >>>40 lelong x (block size %d, >>>49 string >\0 original name '%s', >>>2 short 1024 VAX generated) >>>2 short 2048 AXP generated) >>>2 short 4096 I64 generated) # Summary: Oracle Clustered Filesystem # Created by: Aaron Botsis 8 string OracleCFS Oracle Clustered Filesystem, >4 long x rev %d >0 long x \b.%d, >560 string x label: %.64s, >136 string x mountpoint: %.128s # Summary: Oracle ASM tagged volume # Created by: Aaron Botsis 32 string ORCLDISK Oracle ASM Volume, >40 string x Disk Name: %0.12s 32 string ORCLCLRD Oracle ASM Volume (cleared), >40 string x Disk Name: %0.12s # Oracle Clustered Filesystem - Aaron Botsis 8 string OracleCFS Oracle Clustered Filesystem, >4 long x rev %d >0 long x \b.%d, >560 string x label: %.64s, >136 string x mountpoint: %.128s # Oracle ASM tagged volume - Aaron Botsis 32 string ORCLDISK Oracle ASM Volume, >40 string x Disk Name: %0.12s 32 string ORCLCLRD Oracle ASM Volume (cleared), >40 string x Disk Name: %0.12s # Compaq/HP RILOE floppy image # From: Dirk Jagdmann 0 string CPQRFBLO Compaq/HP RILOE floppy image #------------------------------------------------------------------------------ # Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). # These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, # which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@@gmail.com # 1008 string DECFILE11 Files-11 On-Disk Structure >525 byte x (ODS-%d); >1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; >1017 string B >>525 byte 2 VAX/VMS or OpenVMS file system; >>525 byte 5 OpenVMS Alpha or Itanium file system; >984 string x volume label is '%-12.12s' # From: Thomas Klausner # https://filext.com/file-extension/DAA # describes the daa file format. The magic would be: 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive # From Albert Cahalan # really le32 operation,destination,payloadsize (but quite predictable) # 01 00 00 00 00 00 00 c0 00 02 00 00 0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware # From Eric Sandeen # GFS2 0x10000 belong 0x01161970 >0x10018 belong 0x0000051d GFS1 Filesystem >>0x10024 belong x (blocksize %d, >>0x10060 string >\0 lockproto %s) >0x10018 belong 0x00000709 GFS2 Filesystem >>0x10024 belong x (blocksize %d, >>0x10060 string >\0 lockproto %s) # Russell Coker 0x10040 string _BHRfS_M BTRFS Filesystem >0x1012b string >\0 label "%s", >0x10090 lelong x sectorsize %d, >0x10094 lelong x nodesize %d, >0x10098 lelong x leafsize %d, >0x10020 ubelong x UUID=%08x- >0x10024 ubeshort x \b%04x- >0x10026 ubeshort x \b%04x- >0x10028 ubeshort x \b%04x- >0x1002a ubeshort x \b%04x >0x1002c ubelong x \b%08x, >0x10078 lequad x %lld/ >0x10070 lequad x \b%lld bytes used, >0x10088 lequad x %lld devices 0 string btrfs-stream BTRFS stream file # dvdisaster's .ecc # From: "Nelson A. de Oliveira" 0 string *dvdisaster* dvdisaster error correction file # xfs metadump image # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog # but can we do the << ? For now it's always 512 (0x200) anyway. 0 string XFSM >0x200 string XFSB XFS filesystem metadump image # Type: CROM filesystem # From: Werner Fink 0 string CROMFS CROMFS >6 string >\0 \b version %2.2s, >8 ulequad >0 \b block data at %lld, >16 ulequad >0 \b fblock table at %lld, >24 ulequad >0 \b inode table at %lld, >32 ulequad >0 \b root at %lld, >40 ulelong >0 \b fblock size = %d, >44 ulelong >0 \b block size = %d, >48 ulequad >0 \b bytes = %lld # Type: xfs metadump image # From: Daniel Novotny # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog # but can we do the << ? For now it's always 512 (0x200) anyway. 0 string XFSM >0x200 string XFSB XFS filesystem metadump image # Type: delta ISO # From: Daniel Novotny 0 string DISO Delta ISO data, >4 belong x version %d # JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) # See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. # From: Adam Buchbinder 0x8000 string JFS1 # Because it's text-only magic, check a binary value (version) to be sure. # Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be # mountable. >&0 lelong <3 JFS2 filesystem image # Label is followed by a UUID; we have to limit string length to avoid # appending the UUID in the case of a 16-byte label. >>&144 regex [\x20-\x7E]{1,16} (label "%s") >>&0 lequad x \b, %lld blocks >>&8 lelong x \b, blocksize %d >>&32 lelong&0x00000006 >0 (dirty) >>&36 lelong >0 (compressed) # LFS 0 lelong 0x070162 LFS filesystem image >4 lelong 1 version 1, >>8 lelong x \b blocks %u, >>12 lelong x \b blocks per segment %u, >4 lelong 2 version 2, >>8 lelong x \b fragments %u, >>12 lelong x \b bytes per segment %u, >16 lelong x \b disk blocks %u, >20 lelong x \b block size %u, >24 lelong x \b fragment size %u, >28 lelong x \b fragments per block %u, >32 lelong x \b start for free list %u, >36 lelong x \b number of free blocks %d, >40 lelong x \b number of files %u, >44 lelong x \b blocks available for writing %d, >48 lelong x \b inodes in cache %d, >52 lelong x \b inode file disk address %#x, >56 lelong x \b inode file inode number %u, >60 lelong x \b address of last segment written %#x, >64 lelong x \b address of next segment to write %#x, >68 lelong x \b address of current segment written %#x 0 string td\000 floppy image data (TeleDisk, compressed) 0 string TD\000 floppy image data (TeleDisk) 0 string CQ\024 floppy image data (CopyQM, >16 leshort x %d sectors, >18 leshort x %d heads.) 0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) # URL: http://fileformats.archiveteam.org/wiki/LoadDskF/SaveDskF # Update: Joerg Jenderek # Note: called "IBM SKF disk image" by TrID # verfied by 7-Zip `7z l -tFAT -slt *.dsk` and # `deark -l -m loaddskf 06200D19.DSK` # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf-old.trid.xml 0 beshort 0xAA58 >0 use SaveDskF # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf.trid.xml 0 beshort 0xAA59 >0 use SaveDskF # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf-comp.trid.xml 0 beshort 0xAA5A # skip foo by additional check for unused upper byte of media type in SaveDskF header #>3 ubyte =0 # skip bar by additional check for valid "low" number of heads in SaveDskF header #>>26 uleshort <3 # skip foo by additional check for unused double word field in SaveDskF header #>>>30 long =0 #>>>>0 use SaveDskF >0 use SaveDskF # display information about IBM SaveDskF floppy disk images 0 name SaveDskF # SaveDskF magic >0 beshort x floppy image data (IBM SaveDskF #!:mime application/octet-stream !:mime application/x-ibm-dsk !:ext dsk # also suffix with digit (1dk .2dk ...); NO example FOUND! #!:ext dsk/1dk/2dk >1 ubyte =0x58 \b, old) >1 ubyte =0x59 \b) >1 ubyte =0x5A \b, compressed) # media type; the first byte of the FAT like: 0xF0 (usual floppy) 0xF9 0xFE # https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system >2 ubyte !0xF0 \b, Media descriptor %#x # upper byte of media type is not used; so this seems to be nil >3 ubyte !0 \b, upper byte of media type %#x # sector size in bytes as in the BIOS parameter block like: 512 ; SAVEDSKF.EXE with other sizes produce garbage images >4 uleshort !512 \b, Bytes/sector %u # cluster mask; number of sectors per cluster, minus 1 >6 uleshort+1 >1 \b, sectors/cluster %u #>6 uleshort+1 x \b, sectors/cluster %u # cluster shift; log2(cluster size / sector size) like: 0~1=ClusterSize/SectorSize >7 ubyte >0 \b, cluster shift %u #>7 ubyte x \b, cluster shift %u # reserved sectors; as in the BIOS parameter block like: 1 256 (2M256R-K.DSK) >8 uleshort >1 \b, reserved sectors %u #>8 uleshort x \b, reserved sectors %u # FAT copies; as in the BIOS parameter block like: 2 (usual) 1 (2-NK.DSK) >10 ubyte !2 \b, FAT # plural s >>10 ubyte >1 \bs >>10 ubyte x %u # root directory entries; as in the BIOS parameter block like: 224 (usual) 64 (H1-NK.DSK) 4096 (2-NK.DSK) >11 uleshort !224 \b, root entries %u # sector number of first cluster (count sectors used by boot sector, FATs and root directory) like: 7 10 29 33 288 >13 uleshort !33 \b, 1st cluster at sector %u # number of clusters in image; empty clusters at the end are not saved and counted like: 2372 2848 >15 uleshort x \b, %u clusters # sectors/FAT; as in the BIOS parameter block like: 1 (H1-NK.DSK) 7 9 >17 ubyte !9 \b, sectors/FAT %u # sector number of root directory (ie, count of sectors used by boot sector and FATs) like: 3 (H1-NK.DSK) 9 10 15 19 274 (2M256R-K.DSK) >18 uleshort !19 \b, root directory at sector %u # checksum; sum of all bytes in the file >20 ulelong x \b, checksum %#8.8x # cylinders; number of cylinders like: 40 80 >24 uleshort !80 \b, %u cylinders #>24 uleshort x \b, %u cylinders # heads; number of heads as in the BIOS parameter block like: 1 (H1-NK.DSK) 2 >26 uleshort !2 \b, heads %u #>26 uleshort x \b, heads %u # sectors/track; number of sectors per track as in the BIOS parameter block like: 8 15 18 36 >28 uleshort !18 \b, sectors/track %u #>28 uleshort x \b, sectors/track %u # unused double word field seems to be always like: 0 >30 ulelong !0 \b, at 0x1E %#x # number of sectors in images like: 1017 2786 2880 >34 uleshort x \b, sectors %u # if string is "printable" it can be a real comment >(36.s) ubyte !0x00 # if 1st sector is far enough away (> 0x29) then there is space for comment part >>38 uleshort >41 # offset to comment string like: 28h=40 >>>36 uleshort x \b, at %#x # comment string terminated with \r\n\0 >>>(36.s) string x "%s" # offset to the first sector like: 0 (If this is 0, assume it is 0x200) 29h=41 (DISPLAY3.DSK) 31h 43h 45h 46h 48h 50h 200h=512 >38 uleshort !0 \b, 1st sector at %#x # FOR DEBUGGING! #>(38.s) ubelong x SECTOR CONTENT %x # not compressed floppy image implies readable DOS boot sector inside image >>1 ubyte !0x5A # when not compressed it is readable as DOS boot sector via ./filesystems #>>>(38.s) indirect x \b; contains >38 uleshort =0 \b, 1st sector at 0x200 (0) # maybe standard DOS boot sector; NO example FOUND HERE! #>>0x200 indirect x \b; contains 0 string \074CPM_Disk\076 disk image data (YAZE) # From: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/Central_Point_Software#cite_note-6 # Reference: https://www.robcraig.com/download/transcopy-5-x-file-format # https://www.robcraig.com/download/transcopy-file-format-by-gene-thompson # http://mark0.net/download/triddefs_xml.7z/defs/t/tc-transcopy.trid.xml # TransCopy signature 0 beshort 0x5AA5 # skip Intel serial flash ROM with invalid 0 disk sides handled by ./intel >0x103 ubyte !0 # skip Intel serial flash ROM with unlikely "high" start cylinder 100 handled by ./intel #>>0x101 ubyte <100 VALID_START_CYLINDER # skip Intel serial flash ROM with unlikely description handled by ./intel #>>>2 beshort !0xF00f VALID_DESCRIPTION # skip Intel serial flash ROM with invalid disk types 89h 88h handled by ./intel #>>>>0x100 byte !0x89 VALID_DISK_TYPE >>0 use tc-floppy # display information of Central Point Software (CPS) Option Board TransCopy floppy image 0 name tc-floppy >0 beshort x TransCopy disk image #!:mime application/octet-stream !:mime application/x-floppy-image-tc # like: disk04.tc VOCALC2.TC WIZ5_A.tc WIZ2_720.IMG !:ext tc/img # 1st description (optional 0-terminated maximal 32) like: # "Project Workbench 2.20" "Visi On Calc" "Wizardry V Disk 1 of 3" >2 string >\0 %.32s # 2nd desc. (optional 0-terminated maximal 32) like: # "(1988)." "Advanced - Utility" 'Program Disk 2" >0x22 string >\0 "%.32s" # Looks like ascii (like MESSAGES) formatted with attribute bytes (190)? # not needed for disk copy #>>0x42 string x '%.190s' #>>0x88 lestring16 x "%.8s" # disktype: 2~MFM High Density 3~MFM Double Density 4~Apple II GCR 5~FM Single Density # 6~Commodore GCR 7~MFM Double Density 8~Commodore Amiga Ch~Atari FM FFh~Unknown >0x100 ubyte !0xFF \b, disk type %u # StartingCylinder like: 0 >0x101 ubyte x \b, cylinder >0x101 ubyte !0 start=%u # EndingCylinder like: 40 (often) 41 79 >0x102 ubyte x end=%u # NumberOfSides like: 2 >0x103 ubyte !2 \b, %u sides # TrackIncrement like: 1 >0x104 ubyte !1 \b, track increment %u # TrackPosTbl Track skew #>0x105 ubequad x \b, Track skew %#16.16llx # TrackOffsTbl #>0x305 ubequad x \b, TrackOffsTbl %#16.16llx # TrackLngthTbl #>0x505 ubequad x \b, TrackLngthTbl %#16.16llx # TrackTypeTable #>0x705 ubequad x \b, TrackTypeTable %#16.16llx # Address mark timing #>0x905 ubequad x \b, Address mark timing %#16.16llx # Track fragment #>0x2905 ubequad !0 \b, Track fragment %#16.16llx # Track data #>0x4000 ubequad !0 \b, Track data %#16.16llx # ReFS # Richard W.M. Jones 0 string \0\0\0ReFS\0 ReFS filesystem image # EFW encase image file format: # Gregoire Passault # http://www.forensicswiki.org/wiki/Encase_image_file_format 0 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format # UBIfs # Linux kernel sources: fs/ubifs/ubifs-media.h 0 lelong 0x06101831 >0x16 leshort 0 UBIfs image >0x08 lequad x \b, sequence number %llu >0x10 leshort x \b, length %u >0x04 lelong x \b, CRC %#08x 0 lelong 0x23494255 >0x04 leshort <2 >0x05 string \0\0\0 >0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 >0x04 leshort x UBI image, version %u # NEC PC-88 2D disk image # From Fabio R. Schmidlin 0x20 ulelong&0xFFFFFEFF 0x2A0 >0x10 string \0\0\0\0\0\0\0\0\0\0 >>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 >>>0x1A ubyte&0xEF 0 >>>>0x1B ubyte&0x8F 0 >>>>>0x1B ubyte&70 <0x40 >>>>>>0x1C ulelong >0x21 >>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s >>>>>>>>0x1B ubyte 0 \b, media=2D >>>>>>>>0x1B ubyte 0x10 \b, media=2DD >>>>>>>>0x1B ubyte 0x20 \b, media=2HD >>>>>>>>0x1B ubyte 0x30 \b, media=1D >>>>>>>>0x1B ubyte 0x40 \b, media=1DD >>>>>>>>0x1A ubyte 0x10 \b, write-protected # HDD Raw Copy Tool disk image, file extension: .imgc # From Benjamin Vanheuverzwijn 0 pstring HDD\ Raw\ Copy\ Tool %s >0x100 pstring x %s >0x200 pstring x - HD model: %s #>0x300 pstring x unknown %s >0x400 pstring x serial: %s #>0x500 pstring x unknown: %s !:ext imgc # http://martin.hinner.info/fs/bfs/bfs-structure.html 0 lelong 0x1BADFACE SCO UnixWare BFS filesystem # https://arstechnica.com/information-technology/2018/07/the-beos-filesystem/ 32 lelong 0x42465331 BE/OS BFS1 filesystem >36 lelong x \b, byte order %d >40 lelong x \b, block size %d >44 lelong x \b, block shift %d >48 lequad x \b, total blocks %lld >56 lequad x \b, used blocks %lld 0 name next >0 lelong x \b, size %d >4 string x \b, label %s # https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-44.3\ # /IONeXTPartitionScheme.h 0 string NeXT NeXT version 1 disklabel >12 use next 0 string dlV1 NeXT version 2 disklabel >12 use next 0 string dlV2 NeXT version 3 disklabel >12 use next # bcachefs # From: Thomas Weißschuh 0 name bcachefs-uuid >0 ubelong x \b%08x >4 ubeshort x \b-%04x >6 ubeshort x \b-%04x >8 ubeshort x \b-%04x >10 ubelong x \b-%08x >14 ubeshort x \b%04x 0 name bcachefs bcachefs >0x68 lequad 8 \b, UUID= >>0x38 use bcachefs-uuid >>0x48 string >0 \b, label "%.32s" >>0x10 uleshort x \b, version %u >>0x12 uleshort x \b, min version %u >>0x7a byte x \b, device %d # assumes the first field is the members field >>0x2f4 ulelong 0x01 \b/UUID= >>>0x2f0 default x >>>&(0x07a.b*56) use bcachefs-uuid >>0x07b byte x \b, %d devices >>0x090 byte ^0x02 \b (unclean) 0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 >0x1000 use bcachefs 0x1018 string \xc6\x85\x73\xf6\x66\xce\x90\xa9\xd9\x6a\x60\xcf\x80\x3d\xf7\xef >0x1000 use bcachefs # EROFS # https://kernel.googlesource.com/pub/scm/linux/kernel/git/xiang/erofs-utils/\ # +/refs/heads/experimental/include/erofs_fs.h#12 1024 lelong 0xE0F5E1E2 EROFS filesystem #>1028 lelong x \b, checksum=%#x >1032 lelong >0 \b, compat: >>1032 lelong &1 SB_CHKSUM >>1032 lelong &2 MTIME >1036 byte x \b, blocksize=%u >1037 byte x \b, exslots=%u #>1038 leshort x \b, root_nid=%d #>1040 lequad x \b, inodes=%ld #>1048 leldate x \b, build_time=%s #>1056 lelong x \b.%d #>1060 lelong x \b, blocks=%d #>1064 lelong x \b, metadata@@%#x #>1068 lelong x \b, xattr@@%#x >1072 guid x \b, uuid=%s >1088 string >0 \b, name=%s >1104 lelong >0 \b, incompat: >>1104 lelong &1 LZ4_0PADDING >>1104 lelong &2 BIG_PCLUSTER >>1104 lelong &4 CHUNKED_FILE >>1104 lelong &8 DEVICE_TABLE >>1104 lelong &16 ZTAILPACKING # YAFFS # The layout itself is undocumented, determined by the memory layout of the # reference implementation. This signature is derived from the # reference implementation code and generated test cases # We recognize the start of an object header defined by yaffs_obj_hdr: # (Note the values being encoded depending on platform endianess) # u32 type /* enum yaffs_obj_type, valid 1-5 */ # u32 parent_obj_id; /* 1 for root objects we recognize */ # u16 sum_no_longer_used; /* checksum of name. Not used by YAFFS and memset to 0xFF */ # YCHAR name[YAFFS_MAX_NAME_LENGTH + 1]; # mkyaffsimage always writes a root directory with empty name, then processing the target directory contents # mkyaffs2image directly proceeds to writing entries with the appropriate u32 YAFFS_OBJECT_TYPE (1-5 valid), each with parent id 1 0 name yaffs >0 ulelong 1 \b, type file >0 ulelong 2 \b, type symlink >0 ulelong 3 \b, type root or directory >0 ulelong 4 \b, type hardlink >0 ulelong 5 \b, type special >0xA byte 0 \b, v1 root directory >0xA byte !0 \b, object entry >>0xA string x (name: "%s") # Little Endian: XX 00 00 00 01 00 00 00 FF FF YY # XX: 01 - 05 (object type) # YY: 00 for version 1 root directory, > 00 for version 2 (name data) 0x1 string \x00\x00\x00\x01\x00\x00\x00\xFF\xFF >0 ulelong 0 >0 ulelong >5 >0 default x YAFFS filesystem root entry (little endian) >>0 use yaffs # Big Endian: 00 00 00 XX 00 00 00 01 FF FF YY # XX: 01 - 05 (object type) # YY: 00 for version 1 root directory, > 00 for version 2 (name data) 0x4 string \x00\x00\x00\x01\xFF\xFF >0 string \x00\x00\x00 >>0 ubelong 0 >>0 ubelong >5 >>0 default x YAFFS filesystem root entry (big endian) >>>0 use \^yaffs @ 1.21 log @dedup @ text @d2 1 a2 1 # $File: filesystems,v 1.152 2022/12/10 20:56:50 christos Exp $ d2606 7 a2612 7 0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 bcachefs >0x1068 lequad 8 \b, UUID= >>0x1038 use bcachefs-uuid >>0x1048 string >0 \b, label "%.32s" >>0x1010 uleshort x \b, version %u >>0x1012 uleshort x \b, min version %u >>0x107a byte x \b, device %d d2614 11 a2624 5 >>0x12f4 ulelong 0x01 \b/UUID= >>>0x12f0 default x >>>&(0x107a.b*56) use bcachefs-uuid >>0x107b byte x \b, %d devices >>0x1090 byte ^0x02 \b (unclean) d2651 44 @ 1.20 log @Add magic to recognize FFSv2ea @ text @d2 1 a2 1 # $File: filesystems,v 1.150 2022/07/04 16:40:33 christos Exp $ d1599 2 a1600 1 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), d1616 2 a1617 79 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) >&-1164 string x last mounted on %s, >&-696 string >\0 volume name %s, >&-304 leqldate x last written at %s, >&-1167 byte x clean flag %d, >&-1168 byte x readonly flag %d, >&-296 lequad x number of blocks %lld, >&-288 lequad x number of data blocks %lld, >&-1332 lelong x number of cylinder groups %d, >&-1328 lelong x block size %d, >&-1324 lelong x fragment size %d, >&-180 lelong x average file size %d, >&-176 lelong x average number of files in dir %d, >&-272 lequad x pending blocks to free %lld, >&-264 lelong x pending inodes to free %d, >&-664 lequad x system-wide uuid %0llx, >&-1316 lelong x minimum percentage of free blocks %d, >&-1248 lelong 0 TIME optimization >&-1248 lelong 1 SPACE optimization 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) >&-1164 string x last mounted on %s, >&-696 string >\0 volume name %s, >&-304 leqldate x last written at %s, >&-1167 byte x clean flag %d, >&-1168 byte x readonly flag %d, >&-296 lequad x number of blocks %lld, >&-288 lequad x number of data blocks %lld, >&-1332 lelong x number of cylinder groups %d, >&-1328 lelong x block size %d, >&-1324 lelong x fragment size %d, >&-180 lelong x average file size %d, >&-176 lelong x average number of files in dir %d, >&-272 lequad x pending blocks to free %lld, >&-264 lelong x pending inodes to free %d, >&-664 lequad x system-wide uuid %0llx, >&-1316 lelong x minimum percentage of free blocks %d, >&-1248 lelong 0 TIME optimization >&-1248 lelong 1 SPACE optimization 42332 lelong 0x19012038 Unix Fast File system [v2ea] (little-endian) >&-1164 string x last mounted on %s, >&-696 string >\0 volume name %s, >&-304 leqldate x last written at %s, >&-1167 byte x clean flag %d, >&-1168 byte x readonly flag %d, >&-296 lequad x number of blocks %lld, >&-288 lequad x number of data blocks %lld, >&-1332 lelong x number of cylinder groups %d, >&-1328 lelong x block size %d, >&-1324 lelong x fragment size %d, >&-180 lelong x average file size %d, >&-176 lelong x average number of files in dir %d, >&-272 lequad x pending blocks to free %lld, >&-264 lelong x pending inodes to free %d, >&-664 lequad x system-wide uuid %0llx, >&-1316 lelong x minimum percentage of free blocks %d, >&-1248 lelong 0 TIME optimization >&-1248 lelong 1 SPACE optimization 66908 lelong 0x19012038 Unix Fast File system [v2ea] (little-endian) >&-1164 string x last mounted on %s, >&-696 string >\0 volume name %s, >&-304 leqldate x last written at %s, >&-1167 byte x clean flag %d, >&-1168 byte x readonly flag %d, >&-296 lequad x number of blocks %lld, >&-288 lequad x number of data blocks %lld, >&-1332 lelong x number of cylinder groups %d, >&-1328 lelong x block size %d, >&-1324 lelong x fragment size %d, >&-180 lelong x average file size %d, >&-176 lelong x average number of files in dir %d, >&-272 lequad x pending blocks to free %lld, >&-264 lelong x pending inodes to free %d, >&-664 lequad x system-wide uuid %0llx, >&-1316 lelong x minimum percentage of free blocks %d, >&-1248 lelong 0 TIME optimization >&-1248 lelong 1 SPACE optimization d1624 30 a1653 14 >8404 string x last mounted on %s, #>9504 bedate x last checked at %s, >8224 bedate x last written at %s, >8401 byte x clean flag %d, >8228 belong x number of blocks %d, >8232 belong x number of data blocks %d, >8236 belong x number of cylinder groups %d, >8240 belong x block size %d, >8244 belong x fragment size %d, >8252 belong x minimum percentage of free blocks %d, >8256 belong x rotational delay %dms, >8260 belong x disk rotational speed %drps, >8320 belong 0 TIME optimization >8320 belong 1 SPACE optimization d1656 10 a1665 18 >&-1164 string x last mounted on %s, >&-696 string >\0 volume name %s, >&-304 beqldate x last written at %s, >&-1167 byte x clean flag %d, >&-1168 byte x readonly flag %d, >&-296 bequad x number of blocks %lld, >&-288 bequad x number of data blocks %lld, >&-1332 belong x number of cylinder groups %d, >&-1328 belong x block size %d, >&-1324 belong x fragment size %d, >&-180 belong x average file size %d, >&-176 belong x average number of files in dir %d, >&-272 bequad x pending blocks to free %lld, >&-264 belong x pending inodes to free %d, >&-664 bequad x system-wide uuid %0llx, >&-1316 belong x minimum percentage of free blocks %d, >&-1248 belong 0 TIME optimization >&-1248 belong 1 SPACE optimization d1668 1 a1668 58 >&-1164 string x last mounted on %s, >&-696 string >\0 volume name %s, >&-304 beqldate x last written at %s, >&-1167 byte x clean flag %d, >&-1168 byte x readonly flag %d, >&-296 bequad x number of blocks %lld, >&-288 bequad x number of data blocks %lld, >&-1332 belong x number of cylinder groups %d, >&-1328 belong x block size %d, >&-1324 belong x fragment size %d, >&-180 belong x average file size %d, >&-176 belong x average number of files in dir %d, >&-272 bequad x pending blocks to free %lld, >&-264 belong x pending inodes to free %d, >&-664 bequad x system-wide uuid %0llx, >&-1316 belong x minimum percentage of free blocks %d, >&-1248 belong 0 TIME optimization >&-1248 belong 1 SPACE optimization 42332 belong 0x19012038 Unix Fast File system [v2ea] (big-endian) >&-1164 string x last mounted on %s, >&-696 string >\0 volume name %s, >&-304 beqldate x last written at %s, >&-1167 byte x clean flag %d, >&-1168 byte x readonly flag %d, >&-296 bequad x number of blocks %lld, >&-288 bequad x number of data blocks %lld, >&-1332 belong x number of cylinder groups %d, >&-1328 belong x block size %d, >&-1324 belong x fragment size %d, >&-180 belong x average file size %d, >&-176 belong x average number of files in dir %d, >&-272 bequad x pending blocks to free %lld, >&-264 belong x pending inodes to free %d, >&-664 bequad x system-wide uuid %0llx, >&-1316 belong x minimum percentage of free blocks %d, >&-1248 belong 0 TIME optimization >&-1248 belong 1 SPACE optimization 66908 belong 0x19012038 Unix Fast File system [v2ea] (big-endian) >&-1164 string x last mounted on %s, >&-696 string >\0 volume name %s, >&-304 beqldate x last written at %s, >&-1167 byte x clean flag %d, >&-1168 byte x readonly flag %d, >&-296 bequad x number of blocks %lld, >&-288 bequad x number of data blocks %lld, >&-1332 belong x number of cylinder groups %d, >&-1328 belong x block size %d, >&-1324 belong x fragment size %d, >&-180 belong x average file size %d, >&-176 belong x average number of files in dir %d, >&-272 bequad x pending blocks to free %lld, >&-264 belong x pending inodes to free %d, >&-664 bequad x system-wide uuid %0llx, >&-1316 belong x minimum percentage of free blocks %d, >&-1248 belong 0 TIME optimization >&-1248 belong 1 SPACE optimization @ 1.19 log @merge changes between 5.40 and 5.43 @ text @d1655 40 d1755 40 @ 1.18 log @merge local changes between 5.39 and 5.40 and add magic entries from HEAD. @ text @d2 1 a2 1 # $File: filesystems,v 1.141 2021/04/04 17:46:17 christos Exp $ d223 1 a223 1 >>>>21 ubyte x \b, from drive 0x%x d274 1 a274 1 >>>0x64 ulelong x \b, serial number 0x%x d311 1 a311 1 >>>>>0x49 ubyte >0 at offset 0x%x d319 1 a319 1 >>>>>0x74 ubyte >0 at offset 0x%x d327 1 a327 1 >>>>>0x79 ubyte >0 at offset 0x%x d342 1 a342 1 >>>>0x3C ubyte x at offset 0x%x+0xFF d415 1 a415 1 >>0x1b8 ulelong >0 \b, disk signature 0x%-.4x d420 1 a420 1 >>>>0xDC ubyte x with driveID 0x%x d467 1 a467 1 >>>>>>438 ubyte x \b,0x%x dots d473 1 a473 1 >>>>>>419 ubyte x \b0x%x seconds d512 1 a512 1 >>>>0x3E ubyte x \b, stage1 version 0x%x d514 1 a514 1 >>>>0x40 ubyte <0xFF \b, boot drive 0x%x d516 9 a524 9 >>>>0x41 ubyte >0 \b, LBA flag 0x%x >>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x #>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) >>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x #>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) >>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x >>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x #>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) >>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x d1129 1 a1129 1 >>4 ubyte x : ID=0x%x d1131 1 a1131 1 >>0 ubyte >0x80 0x%x d1229 1 a1229 1 >>>0x1B8 ubelong >0 \b,Serial 0x%-.8x d1280 1 a1280 1 #>>>(0x1BC.s+10) ubyte x \b,flags 0x%x d1282 1 a1282 1 #>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x d1288 1 a1288 1 >>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x d1291 1 a1291 1 #>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x d1293 1 a1293 1 >>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x d1299 1 a1299 1 >>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x d1302 1 a1302 1 #>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x d1304 1 a1304 1 >>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x d1333 3 a1335 3 >>>>>0x20C ubyte x \b, identifier 0x%x #>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) >>>>>0x20D ubyte >0 \b, LBA flag 0x%x d1350 1 a1350 1 >>>>>0x210 ubyte x \b, identifier 0x%x d1352 2 a1353 2 #>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) >>>>>0x211 ubyte >0 \b, LBA flag 0x%x d1380 1 a1380 1 >>>>>>1 ubyte x \b, code offset 0x%x+2 d1382 1 a1382 1 >>>>>>1 uleshort x \b, code offset 0x%x+3 d1407 3 a1409 3 >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x d1428 2 a1429 2 #>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) #>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) d1431 1 a1431 1 >>>>>>>>>36 ubyte !0 \b, physical drive 0x%x d1434 2 a1435 2 >>>>>>>>37 ubyte >0 \b, reserved 0x%x #>>>>>>>>37 ubyte =0 \b, reserved 0x%x d1437 1 a1437 1 >>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) d1439 1 a1439 1 >>>>>>>>>39 ulelong x \b, serial number 0x%x d1481 1 a1481 1 >>>>>>40 uleshort >0 \b, extension flags 0x%x d1498 3 a1500 3 >>>>>>52 ulelong >0 \b, reserved1 0x%x >>>>>>56 ulelong >0 \b, reserved2 0x%x >>>>>>60 ulelong >0 \b, reserved3 0x%x d1502 2 a1503 2 #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) d1505 1 a1505 1 >>>>>>>64 ubyte >0 \b, physical drive 0x%x d1507 2 a1508 2 >>>>>>65 ubyte >0 \b, reserved 0x%x >>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) d1510 1 a1510 1 >>>>>>>67 ulelong x \b, serial number 0x%x d1533 1 a1533 1 #38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) d1536 1 a1536 1 >>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x d1552 2 a1553 2 >>>>>>>>>80 ulelong >0 \b, checksum 0x%x #>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) d1720 7 a1726 1 >0xa0 ulelong x flags 0x%x d1946 1 a1946 1 #>>512 ubyte x \b, Media descriptor 0x%x d1956 1 a1956 1 #>>>>1 ubyte x \b, code offset 0x%x+2 d1996 2 a1997 2 >>38917 byte >0x33 (unknown version, ID 0x%X) >>38917 byte <0x31 (unknown version, ID 0x%X) d2055 1 a2055 1 >32 lelong x CRC 0x%x, d2065 1 a2065 1 >32 belong x CRC 0x%x, d2158 4 a2161 4 >16 belong x Load Address: 0x%08X, >20 belong x Entry Point: 0x%08X, >4 belong x Header CRC: 0x%08X, >24 belong x Data CRC: 0x%08X d2320 2 d2389 1 a2389 1 >52 lelong x \b inode file disk address 0x%x, d2391 3 a2393 3 >60 lelong x \b address of last segment written 0x%x, >64 lelong x \b address of next segment to write 0x%x, >68 lelong x \b address of current segment written 0x%x d2404 98 a2501 3 0 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 0 beshort 0xAA59 floppy image data (IBM SaveDskF) 0 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) d2505 60 d2580 1 a2580 1 >0x04 lelong x \b, CRC 0x%08x d2639 51 @ 1.17 log @merge conflicts @ text @d2 1 a2 1 # $File: filesystems,v 1.133 2020/05/17 19:32:00 christos Exp $ d264 12 d506 1 a506 1 # usual values are marked with comments to get only informations of strange GRUB loaders d548 1 a548 1 # skip Linux style boot sector starting with assember instructions mov 0x7c0,ax; d563 1 a563 1 # skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, d1311 1 a1311 1 # usual values are marked with comments to get only informations of strange GRUB loaders d1373 1 a1373 1 # usual values are marked with comments to get only informations of strange FAT systems d1436 1 a1436 1 # extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others d1742 6 a1747 6 >0x468 belong x \b, UUID=%08x >0x46c beshort x \b-%04x >0x46e beshort x \b-%04x >0x470 beshort x \b-%04x >0x472 belong x \b-%08x >0x476 beshort x \b%04x d1770 6 a1775 6 >0x46c belong x \b, UUID=%08x >0x470 beshort x \b-%04x >0x472 beshort x \b-%04x >0x474 beshort x \b-%04x >0x476 belong x \b-%08x >0x47a beshort x \b%04x d1995 1 a1995 1 >32808 string/T >\0 '%s' d2000 3 d2299 14 a2312 14 0x10040 string _BHRfS_M BTRFS Filesystem >0x1012b string >\0 label "%s", >0x10090 lelong x sectorsize %d, >0x10094 lelong x nodesize %d, >0x10098 lelong x leafsize %d, >0x10020 belong x UUID=%08x- >0x10024 beshort x \b%04x- >0x10026 beshort x \b%04x- >0x10028 beshort x \b%04x- >0x1002a beshort x \b%04x >0x1002c belong x \b%08x, >0x10078 lequad x %lld/ >0x10070 lequad x \b%lld bytes used, >0x10088 lequad x %lld devices d2451 25 @ 1.16 log @merge conflicts @ text @d2 1 a2 1 # $File: filesystems,v 1.131 2019/11/15 23:49:38 christos Exp $ d1997 1 a1997 1 !:strength +34 d2185 1 a2185 1 >0 use ^squashfs @ 1.15 log @merge conflicts @ text @d2 1 a2 1 # $File: filesystems,v 1.128 2019/04/23 15:43:27 christos Exp $ a2059 4 # JFFS - russell@@coker.com.au 0 lelong 0x34383931 Linux Journalled Flash File system, little endian 0 belong 0x34383931 Linux Journalled Flash File system, big endian d2121 1 d2144 1 d2146 1 d2149 1 a2149 1 0 string sqsh Squashfs filesystem, big endian, d2151 9 a2159 1 >30 beshort x \b%d, d2163 1 a2163 1 >>28 beshort <4 d2165 1 a2165 1 >>28 beshort >3 d2172 1 a2172 1 >>28 beshort <4 d2174 1 a2174 1 >>28 beshort >3 d2176 1 a2176 1 >28 beshort <4 d2178 1 a2178 1 >28 beshort >3 d2180 4 d2185 1 a2185 22 >28 leshort x version %d. >30 leshort x \b%d, >28 leshort <3 >>8 lelong x %d bytes, >28 leshort >2 >>28 leshort <4 >>>63 lequad x %lld bytes, >>28 leshort >3 >>>40 lequad x %lld bytes, #>>63 lelong x %d bytes, >4 lelong x %d inodes, >28 leshort <2 >>32 leshort x blocksize: %d bytes, >28 leshort >1 >>28 leshort <4 >>>51 lelong x blocksize: %d bytes, >>28 leshort >3 >>>12 lelong x blocksize: %d bytes, >28 leshort <4 >>39 ledate x created: %s >28 leshort >3 >>8 ledate x created: %s @ 1.14 log @merge conflicts for file-5.33 @ text @d2 1 a2 1 # $File: filesystems,v 1.124 2018/01/12 12:35:30 christos Exp $ d271 2 a272 2 # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/ # and http://en.wikipedia.org/wiki/Master_Boot_Record d276 1 a276 1 # Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) d279 1 a279 1 # http://thestarman.pcministry.com/asm/mbr/200MBR.htm d285 1 a285 1 # NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm d317 1 a317 1 # Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) d344 1 a344 1 # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm d365 1 a365 1 # Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) d383 1 a383 1 # Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm) d401 2 a402 2 # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs # http://en.wikipedia.org/wiki/MBR_disk_signature#ID d404 1 a404 1 # driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm d468 1 a468 1 # http://www.acronis.de/ d473 2 a474 2 # http://www.visopsys.org/ # http://partitionlogic.org.uk/ d493 1 a493 1 # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data d552 1 a552 1 # http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm d565 1 a565 1 # http://www.acronis.de/ d998 2 a999 2 # http://www.visopsys.org/ # http://partitionlogic.org.uk/ d1026 2 a1027 2 # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO # and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector d1090 1 a1090 1 # http://en.wikipedia.org/wiki/Master_boot_record#PTE d1157 1 a1157 1 # http://syslinux.zytor.com/iso.php d1163 1 a1163 1 # http://syslinux.zytor.com/pxe.php d1170 1 a1170 1 # http://syslinux.zytor.com/wiki/index.php/SYSLINUX d1216 1 a1216 1 # NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS d1252 1 a1252 1 # Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ d1265 1 a1265 1 # variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode d1298 1 a1298 1 # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data d1353 1 a1353 1 # http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD d1406 1 a1406 1 # http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block d1468 1 a1468 1 # http://technet.microsoft.com/en-us/library/cc977221.aspx d1485 1 a1485 1 # corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO d1511 1 a1511 1 # NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm d1542 28 a1569 8 >>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 >>>>>>>>>>&-92 indirect x \b; contains # For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 # http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm # unused assembler instructions JMP y2;NOP;NOP 0x056 ulelong&0xFFFF0FFF 0x909002EB # unicode loadername terminated by CTRL-D >(0.s*2) ulelong&0xFFFFFF00 0x00040000 d1571 4 a1574 3 >>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s >>0x12 string $ >>>0x0c lestring16 x \b%-2.2s d1713 1 a1713 1 # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ d1825 1 a1825 1 # http://en.wikipedia.org/wiki/BIOS_parameter_block d1895 1 a1895 1 # http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions d1908 1 a1908 1 # look like an an old DOS directory entry d1939 1 a1939 1 # http://thestarman.pcministry.com/DOS/ibm100/Boot.htm d1946 1 a1946 1 # http://thestarman.pcministry.com/DOS/ibm110/Boot.htm d1953 1 a1953 1 # http://en.wikipedia.org/wiki/Zenith_Data_Systems d1958 1 a1958 1 # http://en.wikipedia.org/wiki/Corona_Data_Systems d2011 1 a2011 1 # Reference: http://pismotec.com/ciso/ciso.h d2020 2 d2025 2 a2026 1 >>>0x10 lelong !0x800 Compressed ISO CD image d2274 1 a2274 1 # http://filext.com/file-extension/DAA @ 1.14.2.1 log @Sync with HEAD @ text @d2 1 a2 1 # $File: filesystems,v 1.128 2019/04/23 15:43:27 christos Exp $ d271 2 a272 2 # added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/ # and https://en.wikipedia.org/wiki/Master_Boot_Record d276 1 a276 1 # Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) d279 1 a279 1 # https://thestarman.pcministry.com/asm/mbr/200MBR.htm d285 1 a285 1 # NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm d317 1 a317 1 # Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) d344 1 a344 1 # https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm d365 1 a365 1 # Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) d383 1 a383 1 # Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm) d401 2 a402 2 # https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs # https://en.wikipedia.org/wiki/MBR_disk_signature#ID d404 1 a404 1 # driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm d468 1 a468 1 # https://www.acronis.de/ d473 2 a474 2 # https://www.visopsys.org/ # https://partitionlogic.org.uk/ d493 1 a493 1 # https://www.gnu.org/software/grub/manual/grub.html#Embedded-data d552 1 a552 1 # https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm d565 1 a565 1 # https://www.acronis.de/ d998 2 a999 2 # https://www.visopsys.org/ # https://partitionlogic.org.uk/ d1026 2 a1027 2 # added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO # and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector d1090 1 a1090 1 # https://en.wikipedia.org/wiki/Master_boot_record#PTE d1157 1 a1157 1 # https://syslinux.zytor.com/iso.php d1163 1 a1163 1 # https://syslinux.zytor.com/pxe.php d1170 1 a1170 1 # https://syslinux.zytor.com/wiki/index.php/SYSLINUX d1216 1 a1216 1 # NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS d1252 1 a1252 1 # Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/ d1265 1 a1265 1 # variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode d1298 1 a1298 1 # https://www.gnu.org/software/grub/manual/grub.html#Embedded-data d1353 1 a1353 1 # https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD d1406 1 a1406 1 # https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block d1468 1 a1468 1 # https://technet.microsoft.com/en-us/library/cc977221.aspx d1485 1 a1485 1 # corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO d1511 1 a1511 1 # NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm d1542 8 a1549 28 # unicode loadername size jump >>>>>>>>>(0x200.s*2) ubyte x # in next sector loadername terminated by unicode CTRL-D and $ >>>>>>>>>>&0x1FF ulequad&0x0000FFffFFffFF00 0x0000002400040000 \b; contains # if 2nd NTFS sectors is found then assume whole filesystem #!:mime application/x-raw-disk-image !:ext img/bin/ntfs >>>>>>>>>>>0x200 use ntfs-sector2 # For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019 # https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm # unused assembler instructions short JMP y2;NOP;NOP 0x056 ulelong&0xFFFF0FFF 0x909002EB NTFS #!:mime application/octet-stream !:ext bin >0 use ntfs-sector2 # https://memory.dataram.com/products-and-services/software/ramdisk # assembler instructions JMP C000;NOP 0x056 ulelong 0x9000c0e9 NTFS #!:mime application/octet-stream !:ext bin >0 use ntfs-sector2 # check for characteristics of second NTFS sector and then display loader name 0 name ntfs-sector2 # number of utf16 characters of loadername >0 uleshort <8 # unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP >>0x056 ulelong&0xFF0000FD 0x900000E9 d1551 3 a1553 4 >>>0x002 lestring16 x bootstrap %-5.5s # check for 7 character length of loader name like BOOTMGR >>>0 uleshort 7 >>>>0x0c lestring16 x \b%-2.2s d1692 1 a1692 1 # https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ d1804 1 a1804 1 # https://en.wikipedia.org/wiki/BIOS_parameter_block d1874 1 a1874 1 # https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions d1887 1 a1887 1 # look like an old DOS directory entry d1918 1 a1918 1 # https://thestarman.pcministry.com/DOS/ibm100/Boot.htm d1925 1 a1925 1 # https://thestarman.pcministry.com/DOS/ibm110/Boot.htm d1932 1 a1932 1 # https://en.wikipedia.org/wiki/Zenith_Data_Systems d1937 1 a1937 1 # https://en.wikipedia.org/wiki/Corona_Data_Systems d1990 1 a1990 1 # Reference: https://pismotec.com/ciso/ciso.h a1998 2 # - 0x10 == 0x00004000: For >2GB files using maxcso... # https://github.com/unknownbrackets/maxcso/issues/26 d2002 1 a2002 2 >>>16 lelong !0x800 >>>>16 lelong !0x4000 Compressed ISO CD image d2250 1 a2250 1 # https://filext.com/file-extension/DAA @ 1.14.2.2 log @Merge changes from current as of 20200406 @ text @d2 1 a2 1 # $File: filesystems,v 1.131 2019/11/15 23:49:38 christos Exp $ d2060 4 a2124 1 >29 byte 26 \bRISC-V, a2146 1 0 beshort 0x1984 Linux old jffs2 filesystem data big endian a2147 1 0 beshort 0x1985 Linux jffs2 filesystem data big endian d2150 1 a2150 1 0 name squashfs d2152 1 a2152 9 >30 beshort x \b%d, >20 beshort 0 uncompressed, >20 beshort 1 zlib >20 beshort 2 lzma >20 beshort 3 lzo >20 beshort 4 xz >20 beshort 5 lz4 >20 beshort 6 zstd >20 beshort >0 compressed, d2156 1 a2156 1 >>28 beshort <4 d2158 1 a2158 1 >>28 beshort >3 d2165 1 a2165 1 >>28 beshort <4 d2167 1 a2167 1 >>28 beshort >3 d2169 1 a2169 1 >28 beshort <4 d2171 1 a2171 1 >28 beshort >3 a2172 4 0 string sqsh Squashfs filesystem, big endian, >0 use squashfs d2174 22 a2195 1 >0 use ^squashfs @ 1.13 log @merge file-5.32 @ text @d2 1 a2 1 # $File: filesystems,v 1.122 2017/07/21 10:34:41 christos Exp $ d1735 10 d1950 1 d1953 1 d1979 10 @ 1.13.2.1 log @Sync with HEAD @ text @d2 1 a2 1 # $File: filesystems,v 1.124 2018/01/12 12:35:30 christos Exp $ a1734 10 # f2fs filesystem - Tuomas Tynkkynen 0x400 lelong 0xF2F52010 F2FS filesystem >0x46c belong x \b, UUID=%08x >0x470 beshort x \b-%04x >0x472 beshort x \b-%04x >0x474 beshort x \b-%04x >0x476 belong x \b-%08x >0x47a beshort x \b%04x >0x147c lestring16 x \b, volume name "%s" a1939 1 !:ext iso/iso9660 a1941 1 !:ext iso/udf a1966 10 # URL: https://en.wikipedia.org/wiki/NRG_(file_format) # Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/ # 11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh # From: Joerg Jenderek # Note: Only for nero disc with once (DAO) type after 300 KB header 339969 string CD001 Nero CD image at 0x4B000 !:mime application/x-nrg !:ext nrg >307200 use cdrom @ 1.12 log @merge 5.31 @ text @d2 1 a2 1 # $File: filesystems,v 1.120 2017/03/24 19:29:26 christos Exp $ d1962 1 a1962 1 !:strength -11 d1964 2 a1965 3 # does not work #!:strength +33 >0 use cdrom d2390 10 @ 1.11 log @merge conflicts @ text @d2 1 a2 1 # $File: filesystems,v 1.116 2017/01/03 11:25:37 christos Exp $ d5 1 a5 1 0 name partid d190 1 a190 1 0774 beshort 0xdabe d216 1 a216 1 >>14 string =_ d222 1 a222 1 >>>22 ubyte 0 d224 1 a224 1 >>>22 ubyte >0 d226 2 a227 2 >>>535 search/17 \x55\xAA >>>>&-512 indirect x \b; contains d231 2 a232 2 0 string DOSEMU\0 >0x27E leshort 0xAA55 d234 1 a234 1 >>19 ubyte 128 d239 1 a239 1 >>>>128 indirect x \b; contains d246 2 a247 2 >509 search/1026 \x55\xAA\xeb >>&-1 indirect x \b; contains d254 1 a254 1 30 search/481 \x55\xAA d259 1 a259 1 >11 uleshort <512 d273 1 a273 1 # test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by d278 1 a278 1 >>8 ubequad 0x8bf45007501ffbfc d284 1 a284 1 >>>0x16 ubyte 0xF2 d319 1 a319 1 >>8 ubequad 0x5007501ffcbe1b7c d364 1 a364 1 >>8 ubequad 0xc08ed8be007cbf00 d405 1 a405 1 >>0xDA uleshort 0 d409 1 a409 1 # hours, minutes and seconds d414 3 a416 3 # assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov >0 ubequad 0xfab830008ed0bc00 # assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov d421 2 a422 2 >0x9D string Invalid\ partition\ table$ >>181 string No\ Operating\ System$ d424 2 a425 2 >0x9D string Invalid\ partition\ table$ >>181 string No\ operating\ system$ d427 2 a428 2 >342 string Invalid\ partition\ table$ >>366 string No\ operating\ system$ d430 7 a436 7 >295 string NEWLDR\0 >>302 string Bad\ PT\ $ >>>310 string No\ OS\ $ >>>>317 string OS\ load\ err$ >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ >>>>>>>387 string Copyright\ (c)\ 1984,1998 d444 4 a447 4 #>>313 string F0\ .\ .\ . #>>>322 string disk\ 1 #>>>>382 string FAT3 >64 string no\ active\ partition\ found d450 3 a452 3 >387 search/4 \0\ Error!\r >>378 search/7 Virus! >>>397 search/4 Booting\ d469 2 a470 2 >362 string MBR\ Error\ \0\r >>376 string ress\ any\ key\ to\ d475 1 a475 1 >309 string No\ bootable\ partition\ found\r d477 1 a477 1 >349 string No\ bootable\ partition\ found\r d480 1 a480 1 >0x40 string SBML d482 1 a482 1 >>43 string SMART\ BTMGR d485 1 a485 1 #>>>>3 strings SBM d495 1 a495 1 >342 search/60 \0Geom\0 d497 1 a497 1 >>0x41 ubyte <2 d499 1 a499 1 # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 d524 1 a524 1 >>>343 string Geom\0Read\0\ Error\0 d531 1 a531 1 >3 string BCDL d535 1 a535 1 >3 string !IHISK d537 3 a539 3 >>0 belong !0xb8c0078e # not Linux kernel >>>514 string !HdrS d541 3 a543 3 >>>>422 string !Be\ Boot\ Loader # jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr >>>>>0 ubelong&0xFD000000 =0xE9000000 d545 1 a545 1 >>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e d548 1 a548 1 >>>>>0 ubelong&0xFD000000 !0xE9000000 d550 1 a550 1 >>>>>>0 string !RRaA d553 1 a553 1 >>>>>>>0 ubequad !0xfa660fb64610668b d555 1 a555 1 >>>>>>>>0 ubequad !0x660fb64610668b4e d557 1 a557 1 >>>>>>>>>0 string !\r\n d559 1 a559 1 >>>>>>>>>>446 ubyte 0 d561 1 a561 1 >>>>>>>>>>446 ubyte >0x7F d568 1 a568 1 >442 string Non-system\ disk,\ d573 1 a573 1 >>>447 ubyte x \b d576 5 a580 5 >185 string FDBOOT\ Version\ >>204 string \rNo\ Systemdisk.\ >>>220 string Booting\ from\ harddisk.\n\r >>>245 string Cannot\ load\ from\ harddisk.\n\r >>>>273 string Insert\ Systemdisk\ d583 1 a583 1 >242 string Bootsector\ from\ C.H.\ Hochst\204 d587 2 a588 2 >242 search/127 Bootsector\ from\ C.H.\ Hochst >>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk d590 1 a590 1 >>>208 search/261 Cannot\ load\ from\ harddisk. d592 1 a592 1 >>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. d597 3 a599 3 >(1.b+2) ubyte 0xe >>(1.b+3) ubyte 0x1f >>>(1.b+4) ubyte 0xbe d601 2 a602 2 >>>>(1.b+5) ubyte&0xd3 0x53 >>>>>(1.b+6) ubyte 0x7c d604 6 a609 6 >>>>>>(1.b+7) ubyte 0xac >>>>>>>(1.b+8) ubyte 0x22 >>>>>>>>(1.b+9) ubyte 0xc0 >>>>>>>>>(1.b+10) ubyte 0x74 >>>>>>>>>>(1.b+11) ubyte 0x0b >>>>>>>>>>>(1.b+12) ubyte 0x56 d612 1 a612 1 >>>>>>>>>>>>>(1.b+5) ubyte 0x5b d615 1 a615 1 >>>>>>>>>>>>>(1.b+5) ubyte 0x77 d618 7 a624 7 #>>244 string from\ dosemu-freedos-*-bin.tgz\r #>>>170 string Sorry,\ could\ not\ load\ an\ #>>>>195 string operating\ system.\r\n # >103 string This\ is\ not\ a\ bootable\ disk.\ >>132 string Please\ insert\ a\ bootable\ >>>157 string floppy\ and\r\n d627 2 a628 2 >66 string Solaris\ Boot\ Sector >>99 string Incomplete\ MDBoot\ load. d632 3 a634 3 >408 string OS/2\ !!\ SYS01475\r\0 >>429 string OS/2\ !!\ SYS02025\r\0 >>>450 string OS/2\ !!\ SYS02027\r\0 d637 3 a639 3 >409 string OS/2\ !!\ SYS01475\r\0 >>430 string OS/2\ !!\ SYS02025\r\0 >>>451 string OS/2\ !!\ SYS02027\r\0 d641 7 a647 7 >112 string This\ disk\ is\ not\ bootable\r >>142 string If\ you\ wish\ to\ make\ it\ bootable >>>176 string run\ the\ DOS\ program\ SYS\ >>>200 string after\ the\r >>>>216 string system\ has\ been\ loaded\r\n >>>>>242 string Please\ insert\ a\ DOS\ diskette\ >>>>>271 string into\r\n\ the\ drive\ and\ d650 2 a651 2 >430 string NTLDR\ is\ missing\xFF\r\n >>449 string Disk\ error\xFF\r\n d654 1 a654 1 >>>>417 ubyte&0xDF >0 d656 1 a656 1 >>>>>>422 ubyte&0xDF >0 d658 1 a658 1 >>>>>425 ubyte&0xDF >0 d661 2 a662 2 >>>>371 ubyte >0x20 >>>>>368 ubyte&0xDF >0 d664 1 a664 1 >>>>>>>373 ubyte&0xDF >0 d666 1 a666 1 >>>>>>376 ubyte&0xDF >0 d669 2 a670 2 >430 string NTLDR\ nicht\ gefunden\xFF\r\n >>453 string Datentr\204gerfehler\xFF\r\n d672 1 a672 1 >>>>417 ubyte&0xDF >0 d674 1 a674 1 >>>>>>422 ubyte&0xDF >0 d676 1 a676 1 >>>>>425 ubyte&0xDF >0 d679 2 a680 2 >>>>379 string \0 >>>>>368 ubyte&0xDF >0 d682 1 a682 1 >>>>>>>373 ubyte&0xDF >0 d685 2 a686 2 >430 string NTLDR\ fehlt\xFF\r\n >>444 string Datentr\204gerfehler\xFF\r\n d688 1 a688 1 >>>>417 ubyte&0xDF >0 d690 1 a690 1 >>>>>>422 ubyte&0xDF >0 d692 1 a692 1 >>>>>425 ubyte&0xDF >0 d695 2 a696 2 >>>>371 ubyte >0x20 >>>>>368 ubyte&0xDF >0 d698 1 a698 1 >>>>>>>373 ubyte&0xDF >0 d700 1 a700 1 >>>>>>376 ubyte&0xDF >0 d703 2 a704 2 >430 string NTLDR\ fehlt\xFF\r\n >>444 string Medienfehler\xFF\r\n d706 2 a707 2 >>>>371 ubyte >0x20 >>>>>368 ubyte&0xDF >0 d709 1 a709 1 >>>>>>>373 ubyte&0xDF >0 d711 1 a711 1 >>>>>>376 ubyte&0xDF >0 d714 1 a714 1 >>>>417 ubyte&0xDF >0 d716 1 a716 1 >>>>>>422 ubyte&0xDF >0 d718 1 a718 1 >>>>>425 ubyte&0xDF >0 d721 2 a722 2 >430 string Datentr\204ger\ entfernen\xFF\r\n >>454 string Medienfehler\xFF\r\n d724 2 a725 2 >>>>379 string \0 >>>>>368 ubyte&0xDF >0 d727 1 a727 1 >>>>>>>373 ubyte&0xDF >0 d729 1 a729 1 >>>>>>376 ubyte&0xDF >0 d732 1 a732 1 >>>>417 ubyte&0xDF >0 d734 1 a734 1 >>>>>>422 ubyte&0xDF >0 d736 1 a736 1 >>>>>425 ubyte&0xDF >0 d740 2 a741 2 #>3 string NTFS\ \ \ \ >389 string Fehler\ beim\ Lesen\ d743 1 a743 1 >>>426 string NTLDR\ fehlt d746 1 a746 1 #>3 string NTFS\ \ \ \ d748 4 a751 4 >>345 string A\ kernel\ file\ is\ missing\ >>>370 string from\ the\ disk.\r >>>>484 string NTLDR\ is\ compressed >>>>>429 string Insert\ a\ system\ diskette\ d755 3 a757 3 >>389 string Invalid\ system\ disk\xFF\r\n >>>411 string Disk\ I/O\ error >>>>428 string Replace\ the\ disk,\ and\ d760 1 a760 1 >>>>>>472 ubyte&0xDF >0 d762 1 a762 1 >>>>>>>>474 ubyte&0xDF >0 d764 1 a764 1 >>>>>>>>>>479 ubyte&0xDF >0 d766 1 a766 1 >>>>>>>480 ubyte&0xDF >0 d771 1 a771 1 >>>>>>>>>488 ubyte&0xDF >0 d773 1 a773 1 >>>>>>>>491 ubyte&0xDF >0 d776 3 a778 3 >>390 string Invalid\ system\ disk\xFF\r\n >>>412 string Disk\ I/O\ error\xFF\r\n >>>>429 string Replace\ the\ disk,\ and\ d780 3 a782 3 >>388 string Ungueltiges\ System\ \xFF\r\n >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>427 string Datentraeger\ wechseln\ und\ d785 1 a785 1 >>>>>>497 ubyte&0xDF >0 d787 1 a787 1 >>>>>>>>502 ubyte&0xDF >0 d789 1 a789 1 >>>>>>>>>>503 ubyte&0xDF >0 d791 1 a791 1 >>>>>>>>>>>>504 ubyte&0xDF >0 d793 1 a793 1 >>>>>>505 ubyte&0xDF >0 d798 1 a798 1 >>>>>>>>474 ubyte&0xDF >0 d800 1 a800 1 >>>>>>>>>>479 ubyte&0xDF >0 d802 1 a802 1 >>>>>>>480 ubyte&0xDF >0 d807 1 a807 1 >>>>>>>>>488 ubyte&0xDF >0 d809 1 a809 1 >>>>>>>>491 ubyte&0xDF >0 d812 3 a814 3 >>390 string Ungueltiges\ System\ \xFF\r\n >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>429 string Datentraeger\ wechseln\ und\ d817 1 a817 1 >>>>>>497 ubyte&0xDF >0 d819 1 a819 1 >>>>>>>>504 ubyte&0xDF >0 d821 1 a821 1 >>>>>>505 ubyte&0xDF >0 d826 1 a826 1 >>>>>>>>474 ubyte&0xDF >0 d828 1 a828 1 >>>>>>>480 ubyte&0xDF >0 d833 1 a833 1 >>>>>>>>>488 ubyte&0xDF >0 d835 1 a835 1 >>>>>>>>491 ubyte&0xDF >0 d838 3 a840 3 >>389 string Ungueltiges\ System\ \xFF\r\n >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>428 string Datentraeger\ wechseln\ und\ d844 1 a844 1 >>>>>>>474 ubyte&0xDF >0 d846 1 a846 1 >>>>>>>>479 ubyte&0xDF >0 d848 1 a848 1 >>>>>>480 ubyte&0xDF >0 d852 1 a852 1 >>>>>>>488 ubyte&0xDF >0 d854 1 a854 1 >>>>>>>>490 ubyte&0xDF >0 d856 1 a856 1 >>>>>>>491 ubyte&0xDF >0 d859 2 a860 2 >>416 string Kein\ System\ oder\ >>>433 string Laufwerksfehler d864 1 a864 1 >>>>>>481 ubyte&0xDF >0 d866 1 a866 1 >>>>>487 ubyte&0xDF >0 d871 1 a871 1 >>>>>>>>495 ubyte&0xDF >0 d873 1 a873 1 >>>>>>>498 ubyte&0xDF >0 d876 3 a878 3 >376 search/41 Non-System\ disk\ or\ >>395 search/41 disk\ error\r >>>407 search/41 Replace\ and\ d884 1 a884 1 >>>>>468 search/18 \0 d887 1 a887 1 >>>>>>>&-20 ubyte&0xDF >0 d889 1 a889 1 >>>>>>>>>&-16 ubyte&0xDF >0 d896 1 a896 1 >>>>>>>>&-6 ubyte&0xDF >0 d898 1 a898 1 >>>>>>>>>>&-5 ubyte&0xDF >0 d903 1 a903 1 >>469 string Insert\ Systemdisk\ d905 1 a905 1 #>43 string \224R-LOADER\ \ SYS =label d910 3 a912 3 >98 string Press\ a\ key\ to\ retry\0\r >>120 string Cannot\ find\ file\ \0\r >>>139 string Disk\ read\ error\0\r d915 1 a915 1 >>>>>44 ubyte&0xDF >0 d917 1 a917 1 >>>>>>>50 ubyte&0xDF >0 d919 1 a919 1 >>>>>>52 ubyte&0xDF >0 d922 2 a923 2 >70 string IBMBIO\ \ COM >>472 string Cannot\ load\ DOS!\ d925 1 a925 1 >>471 string Cannot\ load\ DOS\ d928 1 a928 1 >444 string KERNEL\ \ SYS d930 1 a930 1 >499 string KERNEL\ \ SYS d932 1 a932 1 >449 string KERNEL\ \ SYS d935 1 a935 1 >449 string Loading\ FreeDOS d937 1 a937 1 >>>497 ubyte&0xDF >0 d939 1 a939 1 >>>>>503 ubyte&0xDF >0 d941 1 a941 1 >>>>>>>504 ubyte&0xDF >0 d943 1 a943 1 >>>>505 ubyte&0xDF >0 d948 1 a948 1 >125 string Loading\ FreeDOS...\r d950 1 a950 1 >>>441 ubyte&0xDF >0 d952 1 a952 1 >>>>>447 ubyte&0xDF >0 d954 1 a954 1 >>>>>>>448 ubyte&0xDF >0 d956 1 a956 1 >>>>449 ubyte&0xDF >0 d958 1 a958 1 >124 string FreeDOS\0 d961 1 a961 1 >>>497 ubyte&0xDF >0 d963 1 a963 1 >>>>>503 ubyte&0xDF >0 d965 1 a965 1 >>>>>>>504 ubyte&0xDF >0 d967 1 a967 1 >>>>505 ubyte&0xDF >0 d970 1 a970 1 >>>497 ubyte&0xDF >0 d972 1 a972 1 >>>>>503 ubyte&0xDF >0 d974 1 a974 1 >>>>>>>504 ubyte&0xDF >0 d976 1 a976 1 >>>>505 ubyte&0xDF >0 d979 1 a979 1 >>>497 ubyte&0xDF >0 d981 1 a981 1 >>>>>503 ubyte&0xDF >0 d983 1 a983 1 >>>>>>>504 ubyte&0xDF >0 d985 1 a985 1 >>>>505 ubyte&0xDF >0 d987 1 a987 1 >336 string Error!\ d989 1 a989 1 >>>497 ubyte&0xDF >0 d991 1 a991 1 >>>>>503 ubyte&0xDF >0 d993 1 a993 1 >>>>>>>504 ubyte&0xDF >0 d995 1 a995 1 >>>>505 ubyte&0xDF >0 d1001 3 a1003 3 >478 ulelong 0 >>(1.b+326) string I/O\ Error\ reading\ >>>(1.b+344) string Visopsys\ loader\r d1006 3 a1008 3 >494 ubyte >0x4D >>495 string >E >>>495 string >>>3 string BootProg d1014 1 a1014 1 >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader d1028 1 a1028 1 >0 string RRaA d1035 1 a1035 1 >3 ubyte 0 d1037 1 a1037 1 >>446 ubyte 0 d1039 1 a1039 1 >>>450 ubyte >0 d1041 2 a1042 2 >>>>482 ubyte 0 >>>>>498 ubyte 0 d1044 1 a1044 1 >>>>>>466 ubyte <0x10 d1057 2 a1058 2 # space=0x20 (00100000b) means empty >0 ubyte&0xDF >0 d1060 1 a1060 1 >>>1 ubyte&0xDF >0 d1062 1 a1062 1 >>>>>2 ubyte&0xDF >0 d1064 1 a1064 1 >>>>>>>3 ubyte&0xDF >0 d1066 1 a1066 1 >>>>>>>>>4 ubyte&0xDF >0 d1068 1 a1068 1 >>>>>>>>>>>5 ubyte&0xDF >0 d1070 1 a1070 1 >>>>>>>>>>>>>6 ubyte&0xDF >0 d1072 1 a1072 1 >>>>>>>>>>>>>>>7 ubyte&0xDF >0 d1077 1 a1077 1 >>>>9 ubyte&0xDF >0 d1079 1 a1079 1 >>>>>>10 ubyte&0xDF >0 d1085 1 a1085 1 >0 ubyte x \b d1104 1 a1104 1 >>0 ubyte 0 d1106 2 a1107 2 # active flag 0x80, 0x81, ... >>0 ubyte >0x7F d1139 1 a1139 1 # FATX d1160 1 a1160 1 0 ulequad&0x909000007cc0eafa 0x909000007c40eafa d1177 1 a1177 1 0 ulelong&0x80909bEB 0x009018EB d1179 2 a1180 2 >434 search/47 Boot\ failed # followed by \r\n\0 or :\ d1183 1 a1183 1 >459 search/30 Boot\ error\r\n\0 d1187 1 a1187 1 16 search/4 \xbf\x00\x06\xb9\x00\x01 d1190 1 a1190 1 >94 search/249 Missing\ operating\ system d1193 2 a1194 2 >>408 search/4 HD1/\0 >>408 default x d1197 1 a1197 1 >>>>292 search/98 error d1202 1 a1202 1 >>156 search/10 \0Boot\ partition\ not\ found\r\n d1204 1 a1204 1 >>174 search/10 \0Missing\ OS\r\n d1210 1 a1210 1 0 ubequad 0x31c08ed0bc007c8e d1212 2 a1213 2 #>444 uleshort 0xb5e1 >0004 uleshort x d1220 1 a1220 1 # BOOT_EXTENDED definitions contains assembler instructions: d1226 2 a1227 2 >>>196 search/106 No\ active\ partition\0 >>>>&0 string Disk\ read\ error\0 d1234 1 a1234 1 >>>0x26 search/21 \xBB\x94\x07 d1236 2 a1237 2 >>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 >>>>>181 search/166 Error\ \0 d1244 1 a1244 1 0 ubequad&0xeb58908000000000 0xeb58900000000000 d1246 1 a1246 1 >(1.b+2) ubequad 0xfa31c08ed88ec08e d1248 2 a1249 2 >>376 string No\ operating\ system\r\n\0 >>>398 string Disk\ error\r\n\0FDD\0HDD\0 d1252 1 a1252 1 # Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ d1256 1 a1256 1 0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC d1258 1 a1258 1 >(0x1BC.s) string NDTmbr d1272 1 a1272 1 >>>(0x1BC.s+9) ubyte <2 d1277 1 a1277 1 >>>>(0x1BC.s+13) ubyte >1 d1283 1 a1283 1 >>>(0x1BC.s+9) ubyte >1 d1288 1 a1288 1 >>>>(0x1BC.s+14) ubyte >1 d1300 1 a1300 1 0x200 uleshort 0x70EA d1302 1 a1302 1 >0x206 ubeshort >0x0300 d1304 2 a1305 2 >>0x212 ubyte >0x29 >>>0x213 ubyte >0x29 d1307 1 a1307 1 #>>>0 ulelong&0x00BE5652 0x00BE5652 d1319 1 a1319 1 >>>>0x20C ulelong&0x2E300000 0x2E300000 d1327 1 a1327 1 >>>>>>0x215 ulong 0xffffffff d1329 1 a1329 1 >>>>>>0x215 ulong !0xffffffff d1332 1 a1332 1 >>>>0x20C ulelong&0x2E300000 !0x2E300000 d1337 1 a1337 1 # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 d1345 1 a1345 1 >>>>>0x217 ulong 0xffffffff d1347 1 a1347 1 >>>>>0x217 ulong !0xffffffff d1363 4 a1366 4 >11 uleshort&0x001f 0 >>11 uleshort <32769 >>>11 uleshort >31 >>>>21 ubyte&0xf0 0xF0 d1369 1 a1369 1 >>>>>0 ubyte 0xE9 d1380 1 a1380 1 >>>>>82 string/c fat32 d1383 1 a1383 1 >>>>>82 string/c !fat32 d1393 1 a1393 1 >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) d1405 1 a1405 1 >>>>>11 uleshort >32 d1409 1 a1409 1 >>>>>>38 ubyte&0x56 =0 d1412 1 a1412 1 >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) d1414 2 a1415 2 # FAT<32 bit specific >>>>>>>82 string/c !fat32 d1418 1 a1418 1 >>>>>>>>36 ubyte !0x80 d1438 1 a1438 1 >>>>>82 string/c !fat32 d1441 1 a1441 1 >>>>>>54 default x d1446 1 a1446 1 >>>>>>>21 ubyte =0xF0 d1452 1 a1452 1 >>>>>>>21 ubyte =0xF8 d1458 1 a1458 1 >>>>>>>21 ubyte =0xFA d1482 2 a1483 2 #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) >>>>>>50 default x d1489 1 a1489 1 # same structure as FAT1X d1492 1 a1492 1 >>>>>>64 ubyte !0x80 d1503 2 a1504 2 # no fixed disk >>>>>21 ubyte !0xF8 d1506 1 a1506 1 >>>>>>54 string !FAT16 d1514 1 a1514 1 >>>>>16 ubyte =0 d1516 1 a1516 1 >>>>>>17 uleshort =0 d1518 1 a1518 1 >>>>>>>19 uleshort =0 d1529 2 a1530 2 # Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. >>>>>>>>>64 lelong <256 d1535 1 a1535 1 >>>>>>>>>68 ulelong <256 d1542 2 a1543 2 >>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 >>>>>>>>>>&-92 indirect x \b; contains d1547 1 a1547 1 0x056 ulelong&0xFFFF0FFF 0x909002EB d1549 1 a1549 1 >(0.s*2) ulelong&0xFFFFFF00 0x00040000 d1552 1 a1552 1 >>0x12 string $ d1556 10 d1682 7 d1838 1 a1838 1 # F8 ----- Fixed disk d1866 1 a1866 1 #512 ubelong&0xE0ffff00 0xE0ffff00 d1878 2 a1879 2 #>>>0xA0E ubequad 0 #>>>>0xA00 ubequad !0 d1881 1 a1881 1 #>>512 ubyte =0xfd d1885 1 a1885 1 #>>>0xA0E ubequad 0 d1887 1 a1887 1 #>>512 ubyte =0xfe d1889 2 a1890 2 #>>>>0x60E ubequad 0 #>>>>>0x600 ubequad !0 d1894 2 a1895 2 #>>>0x60E ubequad 0 #>>>>0x600 ubequad !0 d1899 2 a1900 2 #>>0 ulelong&0x804000E9 !0x000000E9 # assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV d1904 1 a1904 1 #>>0 ulelong&0x804000E9 =0x000000E9 d1909 2 a1910 2 # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 #>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader d1916 2 a1917 2 # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV #>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader d1923 1 a1923 1 # assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 d1928 1 a1928 1 # assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; d1932 1 a1932 1 # assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; d2153 1 a2153 1 # From: Ty Sarna d2268 1 a2268 1 # xfs metadump image d2340 2 a2341 2 0 string CQ\024 floppy image data (CopyQM, >16 leshort x %d sectors, @ 1.10 log @merge conflicts @ text @d2 1 a2 1 # $File: filesystems,v 1.108 2015/01/01 17:43:47 christos Exp $ a541 2 >>>>>32769 string CD001 >>>>>>0 use cdrom d1722 1 a1722 1 >0x402 beshort > -1 Minix filesystem, V1, %d zones d1739 24 a1762 23 0x410 leshort 0x2468 >0x402 beshort < 100 >>0x402 beshort > -1 Minix filesystem, V2, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x2468 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2478 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2478 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x2478 >0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x4d5a >0x402 beshort !0 Minix filesystem, V3, %d zones >0x1e string minix \b, bootable d1930 2 d1952 13 a1964 1 0 string CISO Compressed ISO CD image d2056 7 d2231 15 a2245 7 # BTRFS 0x10040 string _BHRfS_M BTRFS Filesystem >0x1012b string >\0 (label "%s", >0x10090 lelong x sectorsize %d, >0x10094 lelong x nodesize %d, >0x10098 lelong x leafsize %d) @ 1.10.4.1 log @Sync with HEAD @ text @d2 1 a2 1 # $File: filesystems,v 1.116 2017/01/03 11:25:37 christos Exp $ d542 2 d1724 1 a1724 1 >0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones d1741 23 a1763 24 # Weak Magic: this is $x #0x410 leshort 0x2468 #>0x402 beshort < 100 #>>0x402 beshort > -1 Minix filesystem, V2, 14 char names #>0x1e string minix \b, bootable #0x410 beshort 0x2468 #>0x402 beshort < 100 #>0x402 beshort > -1 Minix filesystem, V2 (big endian) #>0x1e string minix \b, bootable #0x410 leshort 0x2478 #>0x402 beshort < 100 #>0x402 beshort > -1 Minix filesystem, V2, 30 char names #>0x1e string minix \b, bootable #0x410 leshort 0x2478 #>0x402 beshort < 100 #>0x402 beshort > -1 Minix filesystem, V2, 30 char names #>0x1e string minix \b, bootable #0x410 beshort 0x2478 #>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian) #>0x1e string minix \b, bootable # Weak Magic! this is MD #0x418 leshort 0x4d5a #>0x402 beshort <100 #>>0x402 beshort > -1 Minix filesystem, V3, 60 char names a1930 2 # The next line is not necessary because the MBR staff is done looking for boot signature >0x1FE leshort 0xAA55 (DOS/MBR boot sector) d1951 1 a1951 13 # Reference: http://pismotec.com/ciso/ciso.h # NOTE: There are two other formats with the same magic but # completely incompatible specifications: # - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h # - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h 0 string CISO # Other fields are used to determine what type of CISO this is: # - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) # - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) # - None of the above: Compact ISO. >4 lelong !0 >>4 lelong !0x200000 >>>0x10 lelong !0x800 Compressed ISO CD image a2042 7 >29 byte 19 \bSandbox architecture, >29 byte 20 \bANDES Technology NDS32, >29 byte 21 \bOpenRISC 1000, >29 byte 22 \bARM 64-bit, >29 byte 23 \bDesignWare ARC, >29 byte 24 \bx86_64, >29 byte 25 \bXtensa, d2211 7 a2217 15 # Russell Coker 0x10040 string _BHRfS_M BTRFS Filesystem >0x1012b string >\0 label "%s", >0x10090 lelong x sectorsize %d, >0x10094 lelong x nodesize %d, >0x10098 lelong x leafsize %d, >0x10020 belong x UUID=%08x- >0x10024 beshort x \b%04x- >0x10026 beshort x \b%04x- >0x10028 beshort x \b%04x- >0x1002a beshort x \b%04x >0x1002c belong x \b%08x, >0x10078 lequad x %lld/ >0x10070 lequad x \b%lld bytes used, >0x10088 lequad x %lld devices @ 1.10.2.1 log @Sync with HEAD @ text @d2 1 a2 1 # $File: filesystems,v 1.116 2017/01/03 11:25:37 christos Exp $ d542 2 d1724 1 a1724 1 >0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones d1741 23 a1763 24 # Weak Magic: this is $x #0x410 leshort 0x2468 #>0x402 beshort < 100 #>>0x402 beshort > -1 Minix filesystem, V2, 14 char names #>0x1e string minix \b, bootable #0x410 beshort 0x2468 #>0x402 beshort < 100 #>0x402 beshort > -1 Minix filesystem, V2 (big endian) #>0x1e string minix \b, bootable #0x410 leshort 0x2478 #>0x402 beshort < 100 #>0x402 beshort > -1 Minix filesystem, V2, 30 char names #>0x1e string minix \b, bootable #0x410 leshort 0x2478 #>0x402 beshort < 100 #>0x402 beshort > -1 Minix filesystem, V2, 30 char names #>0x1e string minix \b, bootable #0x410 beshort 0x2478 #>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian) #>0x1e string minix \b, bootable # Weak Magic! this is MD #0x418 leshort 0x4d5a #>0x402 beshort <100 #>>0x402 beshort > -1 Minix filesystem, V3, 60 char names a1930 2 # The next line is not necessary because the MBR staff is done looking for boot signature >0x1FE leshort 0xAA55 (DOS/MBR boot sector) d1951 1 a1951 13 # Reference: http://pismotec.com/ciso/ciso.h # NOTE: There are two other formats with the same magic but # completely incompatible specifications: # - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h # - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h 0 string CISO # Other fields are used to determine what type of CISO this is: # - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) # - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) # - None of the above: Compact ISO. >4 lelong !0 >>4 lelong !0x200000 >>>0x10 lelong !0x800 Compressed ISO CD image a2042 7 >29 byte 19 \bSandbox architecture, >29 byte 20 \bANDES Technology NDS32, >29 byte 21 \bOpenRISC 1000, >29 byte 22 \bARM 64-bit, >29 byte 23 \bDesignWare ARC, >29 byte 24 \bx86_64, >29 byte 25 \bXtensa, d2211 7 a2217 15 # Russell Coker 0x10040 string _BHRfS_M BTRFS Filesystem >0x1012b string >\0 label "%s", >0x10090 lelong x sectorsize %d, >0x10094 lelong x nodesize %d, >0x10098 lelong x leafsize %d, >0x10020 belong x UUID=%08x- >0x10024 beshort x \b%04x- >0x10026 beshort x \b%04x- >0x10028 beshort x \b%04x- >0x1002a beshort x \b%04x >0x1002c belong x \b%08x, >0x10078 lequad x %lld/ >0x10070 lequad x \b%lld bytes used, >0x10088 lequad x %lld devices @ 1.9 log @welcome to file-5.20 @ text @d2 1 a2 1 # $File: filesystems,v 1.103 2014/09/11 15:09:34 christos Exp $ d263 1 d266 1 a266 1 0x1FE leshort 0xAA55 d269 2 a270 2 !:strength +70 >2 string OSBS OS/BS MBR d542 2 d1049 1 a1049 1 >>>>>>>466 ubyte 0x0 \b, extended partition table (last) d1242 1 d1361 1 d1369 1 a1369 1 >>>>>0 ubyte 0xEB d1921 1 a1921 10 # CDROM Filesystems # https://en.wikipedia.org/wiki/ISO_9660 # Modified for UDF by gerardo.cacciari@@gmail.com 32769 string CD001 # mime line at that position does not work # to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51) !:strength -11 # to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51) # does not work #!:strength +33 d1938 12 d2132 1 @ 1.8 log @merge conflicts @ text @d2 1 a2 1 # $File: filesystems,v 1.95 2014/06/03 19:17:27 christos Exp $ d257 1 a257 1 !:strength +72 d268 2 a269 2 !:strength +21 >2 string OSBS \b, OS/BS MBR d1356 1 a1356 1 0 ulelong&0x804000E9 0x000000E9 d1360 1 a1360 1 >11 uleshort&0xf001f 0 d1367 1 a1367 1 >>>>>>1 uleshort x \b, code offset 0x%x+2 d1376 2 a1377 1 >>>>>82 string FAT32 d1380 1 a1380 1 >>>>>82 string !FAT32 d1403 4 a1406 2 # skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk >>>>>>38 ubyte !0x70 d1412 1 a1412 1 >>>>>>>82 string !FAT32 d1417 2 d1421 1 a1421 1 # value is 0x80 for NTFS d1423 2 a1425 1 >>>>>>>>>39 ulelong x \b, serial number 0x%x d1435 27 a1461 3 >>>>>>54 string FAT \b, FAT >>>>>>>54 string FAT12 \b (12 bit) >>>>>>>54 string FAT16 \b (16 bit) d1463 1 a1463 1 >>>>>82 string FAT32 \b, FAT (32 bit) d1476 3 a1478 1 >>>>>>50 uleshort >6 \b, Backup boot sector %u d1480 2 a1481 1 >>>>>>50 uleshort <6 \b, Backup boot sector %u d1917 1 d1919 8 a1926 1 32769 string CD001 # a1927 1 >38913 string !NSR0 ISO 9660 CD-ROM filesystem data d1929 1 a2174 1 >525 byte x Level %d d2309 28 a2336 11 0 belong 0x31181006 >0x16 short 0 UBIfs image >0x08 lequad x \b, sequence number %llu >0x10 leshort x \b, length %u >0x04 lelong x \b, CRC 0x%08x 0 belong 0x55424923 >0x04 short <2 >0x05 string \0\0\0 >0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 >0x04 short x UBI image, version %u @ 1.7 log @merge conflicts @ text @d2 1 a2 1 # $File: filesystems,v 1.85 2013/11/19 23:54:05 christos Exp $ d207 2 a208 2 >>0764 long >0 start cyl %ld, >>0770 long x %ld blocks d252 1 a252 1 # DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011 d265 2 a266 2 0x1FE leshort 0xAA55 DOS/MBR boot sector !:strength +72 d268 1 a268 1 #!:strength +21 d322 2 a323 2 # "Ungültige Partitionstabelle" nn=0x10F for german version # "Table de partition erronée" nn=0x10F for french version d333 1 a333 1 # "Erreur lors du chargement du système d'exploitation" nn=0x12a for french version d339 1 a339 1 # "Système d'exploitation manquant" nn=0x15e for french version d350 1 a350 1 # "Ungültige Partitionstabelle" xx=0x12C for german version d371 1 a371 1 # "Ungültige Partitionstabelle" xx=0x1?? for german version d389 1 a389 1 # "Ungültige Partitionstabelle" xx=0x1?? for german version d522 1 a522 1 #unkown version d569 1 a569 1 # updated by Joerg Jenderek at Nov 2012 d571 3 a573 8 >>>477 ubyte&0xDF >0 >>>>477 string x \b %-.3s >>>>>480 ubyte&0xDF >0 >>>>>>480 string x \b%-.4s >>>>>>>484 ubyte&0xDF >0 >>>>>>>>484 string x \b%-.1s >>>>485 ubyte&0xDF >0 >>>>>485 string x \b.%-.3s d1013 2 a1014 23 >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader >>>>>499 string x \b %-.1s >>>>>>500 ubyte&0xDF >0 >>>>>>>500 string x \b%-.1s >>>>>>>>501 ubyte&0xDF >0 >>>>>>>>>501 string x \b%-.1s >>>>>>>>>>502 ubyte&0xDF >0 >>>>>>>>>>>502 string x \b%-.1s >>>>>>>>>>>>503 ubyte&0xDF >0 >>>>>>>>>>>>>503 string x \b%-.1s >>>>>>>>>>>>>>504 ubyte&0xDF >0 >>>>>>>>>>>>>>>504 string x \b%-.1s >>>>>>>>>>>>>>>>505 ubyte&0xDF >0 >>>>>>>>>>>>>>>>>505 string x \b%-.1s >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s #name extension >>>>>507 ubyte&0xDF >0 \b. >>>>>>507 string x \b%-.1s >>>>>>>508 ubyte&0xDF >0 >>>>>>>>508 string x \b%-.1s >>>>>>>>>509 ubyte&0xDF >0 >>>>>>>>>>509 string x \b%-.1s a1020 32 # http://alexfru.chat.ru/epm.html#bootprog >494 ubyte >0x4D >>495 string >E >>>495 string >>>3 string BootProg # It just looks for a program file name at the root directory # and loads corresponding file with following execution. # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader >>>>>499 string x \b %-.1s >>>>>>500 ubyte&0xDF >0 >>>>>>>500 string x \b%-.1s >>>>>>>>501 ubyte&0xDF >0 >>>>>>>>>501 string x \b%-.1s >>>>>>>>>>502 ubyte&0xDF >0 >>>>>>>>>>>502 string x \b%-.1s >>>>>>>>>>>>503 ubyte&0xDF >0 >>>>>>>>>>>>>503 string x \b%-.1s >>>>>>>>>>>>>>504 ubyte&0xDF >0 >>>>>>>>>>>>>>>504 string x \b%-.1s >>>>>>>>>>>>>>>>505 ubyte&0xDF >0 >>>>>>>>>>>>>>>>>505 string x \b%-.1s >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s #name extension >>>>>507 ubyte&0xDF >0 \b. >>>>>>507 string x \b%-.1s >>>>>>>508 ubyte&0xDF >0 >>>>>>>>508 string x \b%-.1s >>>>>>>>>509 ubyte&0xDF >0 >>>>>>>>>>509 string x \b%-.1s a1022 4 #If the boot sector fails to find needed program in the root directory, #it also hangs with another message ("NF"). >>>>>492 string RENF \b, FAT (12 bit) >>>>>495 string RENF \b, FAT (16 bit) d1025 27 a1088 27 # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO # and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector >0 string RRaA >>0x1E4 string rrAa \b, FSInfosector #>>0x1FC uleshort =0 SHOULD BE ZERO >>>0x1E8 ulelong <0xffffffff \b, %u free clusters >>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u # updated by Joerg Jenderek at Sep 2007 >3 ubyte 0 #no active flag >>446 ubyte 0 # partition 1 not empty >>>450 ubyte >0 # partitions 3,4 empty >>>>482 ubyte 0 >>>>>498 ubyte 0 # partition 2 ID=0,5,15 >>>>>>466 ubyte <0x10 >>>>>>>466 ubyte 0x05 \b, extended partition table >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) >>>>>>>466 ubyte 0x0 \b, extended partition table (last) # DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 >0x200 lelong 0x82564557 \b, BSD disklabel d1271 1 a1271 1 #>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds d1314 1 a1314 1 #>>>>0x208 ulelong =0xffffff \b, %u (default) d1388 1 a1388 1 #>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) d1390 1 a1390 1 #>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) d1395 1 a1395 1 #>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) d1437 1 a1437 1 #>>>>>>40 uleshort =0 \b, extension flags %u d1496 1 a1496 1 >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi) d1502 1 a1502 1 >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi) d1550 1 a1550 1 >&-264 lelong x pending inodes to free %ld, d1570 1 a1570 1 >&-264 lelong x pending inodes to free %ld, d1610 1 a1610 1 >&-264 belong x pending inodes to free %ld, d1630 1 a1630 1 >&-264 belong x pending inodes to free %ld, d1811 2 a1812 1 512 ubelong&0xE0ffff00 0xE0ffff00 d1814 1 a1814 1 >21 ubyte <0xE5 floppy with old FAT filesystem d1822 1 a1822 1 >>512 ubyte =0xfc 180k d1824 4 a1827 4 >>>0xA0E ubequad 0 >>>>0xA00 ubequad !0 !:mime application/x-ima >>512 ubyte =0xfd d1829 1 a1829 1 >>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k d1831 7 a1837 7 >>>0xA0E ubequad 0 !:mime application/x-ima >>512 ubyte =0xfe >>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k >>>>0x60E ubequad 0 >>>>>0x600 ubequad !0 !:mime application/x-ima d1839 5 a1843 5 >>512 ubyte =0xff 320k >>>0x60E ubequad 0 >>>>0x600 ubequad !0 !:mime application/x-ima >>512 ubyte x \b, Media descriptor 0x%x d1845 1 a1845 1 >>0 ulelong&0x804000E9 !0x000000E9 d1847 1 a1847 1 >>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader d1849 2 a1850 2 >>>>0xc4 use 2xDOS-filename >>0 ulelong&0x804000E9 =0x000000E9 d1852 2 a1853 2 >>>0 ubyte =0xEB >>>>1 ubyte x \b, code offset 0x%x+2 d1856 1 a1856 1 >>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader d1858 3 a1860 3 >>>>>0x176 use DOS-filename >>>>>0x181 ubyte x \b+ >>>>>0x182 use DOS-filename d1863 1 a1863 1 >>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader d1865 3 a1867 3 >>>>>0x18b use DOS-filename >>>>>0x196 ubyte x \b+ >>>>>0x197 use DOS-filename d1870 1 a1870 1 >>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader d1872 1 a1872 1 >>>>>0x20 use 2xDOS-filename d1875 1 a1875 1 >>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader d1877 1 a1877 1 >>>>>0x69 use 2xDOS-filename d1879 1 a1879 1 >>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader d1906 1 a1906 1 >4 lelong x size %lu d1911 3 a1913 3 >36 lelong x edition %lu, >40 lelong x %lu blocks, >44 lelong x %lu files d1916 1 a1916 1 >4 belong x size %lu d1921 3 a1923 3 >36 belong x edition %lu, >40 belong x %lu blocks, >44 belong x %lu files d2188 2 a2189 2 >40 ulelong >0 \b fblock size = %ld, >44 ulelong >0 \b block size = %ld, d2266 14 @ 1.7.2.1 log @Rebase. @ text @d2 1 a2 1 # $File: filesystems,v 1.95 2014/06/03 19:17:27 christos Exp $ d207 2 a208 2 >>0764 long >0 start cyl %d, >>0770 long x %d blocks d252 1 a252 1 # DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013 d265 2 a266 2 0x1FE leshort 0xAA55 # d268 1 a268 1 !:strength +21 d322 2 a323 2 # "Ung\201ltige Partitionstabelle" nn=0x10F for german version # "Table de partition erron\202e" nn=0x10F for french version d333 1 a333 1 # "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version d339 1 a339 1 # "Syst\212me d'exploitation manquant" nn=0x15e for french version d350 1 a350 1 # "Ung\201ltige Partitionstabelle" xx=0x12C for german version d371 1 a371 1 # "Ung\201ltige Partitionstabelle" xx=0x1?? for german version d389 1 a389 1 # "Ung\201ltige Partitionstabelle" xx=0x1?? for german version d522 1 a522 1 # unknown version d569 1 a569 1 # updated by Joerg Jenderek at Nov 2012, Sep 2013 d571 8 a578 3 # display 1 space >>>447 ubyte x \b >>>477 use DOS-filename d1018 23 a1040 2 >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader >>>>>499 use DOS-filename d1047 32 d1081 4 a1086 27 # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO # and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector >0 string RRaA >>0x1E4 string rrAa \b, FSInfosector #>>0x1FC uleshort =0 SHOULD BE ZERO >>>0x1E8 ulelong <0xffffffff \b, %u free clusters >>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u # updated by Joerg Jenderek at Sep 2007 >3 ubyte 0 #no active flag >>446 ubyte 0 # partition 1 not empty >>>450 ubyte >0 # partitions 3,4 empty >>>>482 ubyte 0 >>>>>498 ubyte 0 # partition 2 ID=0,5,15 >>>>>>466 ubyte <0x10 >>>>>>>466 ubyte 0x05 \b, extended partition table >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) >>>>>>>466 ubyte 0x0 \b, extended partition table (last) # DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 >0x200 lelong 0x82564557 \b, BSD disklabel d1124 27 d1333 1 a1333 1 #>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds d1376 1 a1376 1 #>>>>0x208 ulelong =0xffffff \b, %lu (default) d1450 1 a1450 1 #>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) d1452 1 a1452 1 #>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) d1457 1 a1457 1 #>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) d1499 1 a1499 1 #>>>>>>40 uleshort =0 \b, extension flags %hu d1558 1 a1558 1 >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) d1564 1 a1564 1 >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) d1612 1 a1612 1 >&-264 lelong x pending inodes to free %d, d1632 1 a1632 1 >&-264 lelong x pending inodes to free %d, d1672 1 a1672 1 >&-264 belong x pending inodes to free %d, d1692 1 a1692 1 >&-264 belong x pending inodes to free %d, d1873 1 a1873 2 # Too Weak. #512 ubelong&0xE0ffff00 0xE0ffff00 d1875 1 a1875 1 #>21 ubyte <0xE5 floppy with old FAT filesystem d1883 1 a1883 1 #>>512 ubyte =0xfc 180k d1885 4 a1888 4 #>>>0xA0E ubequad 0 #>>>>0xA00 ubequad !0 #!:mime application/x-ima #>>512 ubyte =0xfd d1890 1 a1890 1 #>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k d1892 7 a1898 7 #>>>0xA0E ubequad 0 #!:mime application/x-ima #>>512 ubyte =0xfe #>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k #>>>>0x60E ubequad 0 #>>>>>0x600 ubequad !0 #!:mime application/x-ima d1900 5 a1904 5 #>>512 ubyte =0xff 320k #>>>0x60E ubequad 0 #>>>>0x600 ubequad !0 #!:mime application/x-ima #>>512 ubyte x \b, Media descriptor 0x%x d1906 1 a1906 1 #>>0 ulelong&0x804000E9 !0x000000E9 d1908 1 a1908 1 #>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader d1910 2 a1911 2 #>>>>0xc4 use 2xDOS-filename #>>0 ulelong&0x804000E9 =0x000000E9 d1913 2 a1914 2 #>>>0 ubyte =0xEB #>>>>1 ubyte x \b, code offset 0x%x+2 d1917 1 a1917 1 #>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader d1919 3 a1921 3 #>>>>>0x176 use DOS-filename #>>>>>0x181 ubyte x \b+ #>>>>>0x182 use DOS-filename d1924 1 a1924 1 #>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader d1926 3 a1928 3 #>>>>>0x18b use DOS-filename #>>>>>0x196 ubyte x \b+ #>>>>>0x197 use DOS-filename d1931 1 a1931 1 #>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader d1933 1 a1933 1 #>>>>>0x20 use 2xDOS-filename d1936 1 a1936 1 #>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader d1938 1 a1938 1 #>>>>>0x69 use 2xDOS-filename d1940 1 a1940 1 #>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader d1967 1 a1967 1 >4 lelong x size %u d1972 3 a1974 3 >36 lelong x edition %u, >40 lelong x %u blocks, >44 lelong x %u files d1977 1 a1977 1 >4 belong x size %u d1982 3 a1984 3 >36 belong x edition %u, >40 belong x %u blocks, >44 belong x %u files d2249 2 a2250 2 >40 ulelong >0 \b fblock size = %d, >44 ulelong >0 \b block size = %d, a2326 14 # UBIfs # Linux kernel sources: fs/ubifs/ubifs-media.h 0 belong 0x31181006 >0x16 short 0 UBIfs image >0x08 lequad x \b, sequence number %llu >0x10 leshort x \b, length %u >0x04 lelong x \b, CRC 0x%08x 0 belong 0x55424923 >0x04 short <2 >0x05 string \0\0\0 >0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 >0x04 short x UBI image, version %u @ 1.6 log @merge new file @ text @a0 1 d2 1 a2 1 # $File: filesystems,v 1.77 2013/03/14 01:38:30 christos Exp $ d5 182 d241 12 a252 1 # x86 boot sector updated by Joerg Jenderek at Sep 2007,May 2011 d255 1 a255 1 # to display x86 boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) d260 1 a260 1 >>(11.s-2) uleshort 0xAA55 x86 boot sector d262 2 a263 2 >0x1FE leshort 0xAA55 x86 boot sector # keep old x86 boot sector as dummy for mbr and bootloader displaying d265 2 a266 1 0x1FE leshort 0xAA55 d268 1 a268 1 !:strength +21 d532 31 a562 54 # mbr partition table entries # OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs >3 string !MS >>3 string !SYSLINUX >>>3 string !MTOOL >>>>3 string !NEWLDR >>>>>5 string !DOS # not FAT (32 bit) >>>>>>82 string !FAT32 #not Linux kernel >>>>>>>514 string !HdrS #not BeOS >>>>>>>>422 string !Be\ Boot\ Loader # active flag 0 or 0x80 and type > 0 >>>>>>>>>446 ubyte <0x81 >>>>>>>>>>446 ubyte&0x7F 0 >>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x >>>>>>>>>>>>446 ubyte 0x80 \b, active >>>>>>>>>>>>447 ubyte x \b, starthead %u #>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x #>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d >>>>>>>>>>>>454 ulelong x \b, startsector %u >>>>>>>>>>>>458 ulelong x \b, %u sectors # >>>>>>>>>462 ubyte <0x81 >>>>>>>>>>462 ubyte&0x7F 0 >>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x >>>>>>>>>>>>462 ubyte 0x80 \b, active >>>>>>>>>>>>463 ubyte x \b, starthead %u #>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x #>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d >>>>>>>>>>>>470 ulelong x \b, startsector %u >>>>>>>>>>>>474 ulelong x \b, %u sectors # >>>>>>>>>478 ubyte <0x81 >>>>>>>>>>478 ubyte&0x7F 0 >>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x >>>>>>>>>>>>478 ubyte 0x80 \b, active >>>>>>>>>>>>479 ubyte x \b, starthead %u #>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x #>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x #>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d >>>>>>>>>>>>486 ulelong x \b, startsector %u >>>>>>>>>>>>490 ulelong x \b, %u sectors # >>>>>>>>>494 ubyte <0x81 >>>>>>>>>>494 ubyte&0x7F 0 >>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x >>>>>>>>>>>>494 ubyte 0x80 \b, active >>>>>>>>>>>>495 ubyte x \b, starthead %u #>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x #>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d >>>>>>>>>>>>502 ulelong x \b, startsector %u >>>>>>>>>>>>506 ulelong x \b, %u sectors d1087 37 a1131 11 # added by Joerg Jenderek at Nov 2012 # http://www.thenakedpc.com/articles/v04/08/0408-05.html # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 0 string PNCIHISK\0 Norton Utilities disc image data # real x86 boot sector with jump instruction >509 search/1026 \x55\xAA\xeb >>&-1 indirect x \b; contains # http://file-extension.net/seeker/file_extension_dat 0 string PNCIUNDO Norton Disk Doctor UnDo file # d1147 1 a1147 1 # DOS x86 sector separated and moved from "x86 boot sector" by Joerg Jenderek at May 2011 d1150 50 d1236 1 a1236 1 # syslinux updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 d1246 1 a1246 1 # SYSLINUX MBR updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 d1249 1 a1249 1 # to display SYSLINUX MBR (36) before old x86 boot sector one with partition table (strength=50+21) d1410 1 a1410 1 # DOS x86 sector updated and separated from "x86 boot sector" by Joerg Jenderek at May 2011 d1802 4 a1805 2 >19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy >19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy d1809 4 a1812 4 19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector d1814 1 a1814 6 >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector d1816 13 a1828 2 19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k 19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k d1871 73 d1960 1 a1960 1 32776 string CDROM High Sierra CD-ROM filesystem data d2318 9 @ 1.5 log @merge changes @ text @d3 1 a3 1 # $File: filesystems,v 1.69 2012/12/18 17:28:43 christos Exp $ d63 3 a65 2 # to display x86 boot sector (40) before old one (strength=50), SYSLINUX MBR (?) and DOS BPB information (71) like in previous file version !:strength +40 d74 1 a74 1 # to display information (51) before DOS BPB (strength=71) and after DOS floppy (120) like in old file version d77 149 a225 2 # J\xf6rg Jenderek >0x8C string Invalid\ partition\ table \b, MS-DOS MBR d244 3 a246 24 >0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222 >>0x1B8 ubelong >0 \b, Serial 0x%-.4x >0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950 >271 string Invalid\ partition\ table\0 >>295 string Error\ loading\ operating\ system\0 >>>326 string Missing\ operating\ system\0 \b, mbr # >139 string Invalid\ partition\ table\0 >>163 string Error\ loading\ operating\ system\0 >>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr # http://www.heise.de/ct/05/09/006/ page 184 #HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes >>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x >300 string Invalid\ partition\ table\0 >>324 string Error\ loading\ operating\ system\0 >>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR #??>>>389 string Invalid\ system\ disk >>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x >300 string Ung\201ltige\ Partitionstabelle #split string to avoid error: String too long >>328 string Fehler\ beim\ Laden\ >>>346 string des\ Betriebssystems >>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german) >>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x d420 1 a420 1 # skip name "C.H. Hochstätter" partly because it is sometimes written without umlaut d917 8 d1003 2 d1324 11 a1334 1 ### DOS boot sector end d1501 2 a1502 1 >0x402 beshort < 100 Minix filesystem, V1, %d zones d1506 2 a1507 1 >0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones d1511 2 a1512 1 >0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones d1516 2 a1517 1 >0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones d1520 2 a1521 1 >0x402 beshort < 100 Minix filesystem, V2, %d zones d1524 2 a1525 1 >0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones d1529 2 a1530 1 >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones d1533 2 a1534 1 >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones d1612 2 a1613 2 # 11111001 Double density 3½ floppy disk, high density 5¼ # 11110000 High density 3½ floppy disk a1799 2 0 string td\000 floppy image data (TeleDisk) d1976 15 @ 1.4 log @resolve conflicts @ text @d3 1 a3 1 # $File: filesystems,v 1.61 2011/01/10 14:01:10 christos Exp $ d30 2 a31 1 # Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc d45 2 d48 1 a48 1 # Joerg Jenderek d58 1 d60 11 a70 1 # updated by Joerg Jenderek at Sep 2007 d72 3 a74 5 0x1FE leshort 0xAA55 x86 boot sector # to do also for sectors < than 512 Bytes and some other files, GRR #30 search/481 \x55\xAA x86 boot sector # not for BeOS floppy 1440k, MBRs #(11.s-2) uleshort 0xAA55 x86 boot sector d146 1 a146 2 >271 string Operating\ system\ loading >>296 string error\r \b, SYSLINUX MBR (2.10) d207 1 a207 6 # http://syslinux.zytor.com/ >478 string Boot\ failed\r >>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62) >480 string Boot\ failed\r >>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11) >484 string Boot\ error\r \b, SYSLINUX bootloader (3.11) d272 2 a273 1 # DOS names like F11.SYS are 8 right space padded bytes+3 bytes d277 3 a279 1 >>>>>>480 string x \b%-.5s d291 13 a303 6 >>278 string No\ Systemdisk.\ >>>293 string Booting\ from\ harddisk.\n\r >>>441 string Cannot\ load\ from\ harddisk.\n\r >>>>469 string Insert\ Systemdisk\ >>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader >>>>>>209 string >\0 \b, version %-4.4s d307 17 a323 9 >>>>(1.b+5) ubyte 0x77 >>>>(1.b+6) ubyte 0x7c >>>>>(1.b+7) ubyte 0xac >>>>>>(1.b+8) ubyte 0x22 >>>>>>>(1.b+9) ubyte 0xc0 >>>>>>>>(1.b+10) ubyte 0x74 >>>>>>>>>(1.b+11) ubyte 0xb >>>>>>>>>>(1.b+12) ubyte 0x56 >>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display d789 12 d815 3 a817 101 # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 # http://mirror.href.com/thestarman/asm/2bytejumps.htmm#FWD # older drives may use Near JuMP instruction E9 xx xx >0 lelong&0x009000EB 0x009000EB >0 lelong&0x000000E9 0x000000E9 # minimal short forward jump found 03cx?? # maximal short forward jump is 07fx >1 ubyte <0xff \b, code offset 0x%x # mtools-3.9.8/msdos.h # usual values are marked with comments to get only informations of strange FAT systems # valid sectorsize must be a power of 2 from 32 to 32768 >>11 uleshort&0x000f x >>>11 uleshort <32769 >>>>11 uleshort >31 >>>>>21 ubyte&0xf0 0xF0 >>>>>>3 string >\0 \b, OEM-ID "%8.8s" #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC >>>>>>>8 string IHC \b cached by Windows 9M >>>>>>11 uleshort >512 \b, Bytes/sector %u #>>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) >>>>>>11 uleshort <512 \b, Bytes/sector %u >>>>>>13 ubyte >1 \b, sectors/cluster %u #>>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) >>>>>>14 uleshort >32 \b, reserved sectors %u #>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) #>>>>>>14 uleshort >1 \b, reserved sectors %u #>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) >>>>>>14 uleshort <1 \b, reserved sectors %u >>>>>>16 ubyte >2 \b, FATs %u #>>>>>>16 ubyte =2 \b, FATs %u (usual) >>>>>>16 ubyte =1 \b, FAT %u >>>>>>16 ubyte >0 >>>>>>17 uleshort >0 \b, root entries %u #>>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) >>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) #>>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) >>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x #>>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) >>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x >>>>>>22 uleshort >0 \b, sectors/FAT %u #>>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) >>>>>>26 ubyte >2 \b, heads %u #>>>>>>26 ubyte =2 \b, heads %u (usual floppy) >>>>>>26 ubyte =1 \b, heads %u #skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk >>>>>>38 ubyte !0x70 >>>>>>>28 ulelong >0 \b, hidden sectors %u #>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) #>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) # FAT<32 specific >>>>>>82 string !FAT32 #>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) #>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) >>>>>>>36 ubyte !0x80 >>>>>>>>36 ubyte !0 \b, physical drive 0x%x >>>>>>>37 ubyte >0 \b, reserved 0x%x #>>>>>>>37 ubyte =0 \b, reserved 0x%x >>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>>38 ubyte =0x29 >>>>>>>>39 ulelong x \b, serial number 0x%x >>>>>>>>43 string >>>>>>>43 string >NO\ NAME \b, label: "%11.11s" >>>>>>>>43 string =NO\ NAME \b, unlabeled >>>>>>>54 string FAT \b, FAT >>>>>>>>54 string FAT12 \b (12 bit) >>>>>>>>54 string FAT16 \b (16 bit) # FAT32 specific >>>>>>82 string FAT32 \b, FAT (32 bit) >>>>>>>36 ulelong x \b, sectors/FAT %u >>>>>>>40 uleshort >0 \b, extension flags %u #>>>>>>>40 uleshort =0 \b, extension flags %u >>>>>>>42 uleshort >0 \b, fsVersion %u #>>>>>>>42 uleshort =0 \b, fsVersion %u (usual) >>>>>>>44 ulelong >2 \b, rootdir cluster %u #>>>>>>>44 ulelong =2 \b, rootdir cluster %u #>>>>>>>44 ulelong =1 \b, rootdir cluster %u >>>>>>>48 uleshort >1 \b, infoSector %u #>>>>>>>48 uleshort =1 \b, infoSector %u (usual) >>>>>>>48 uleshort <1 \b, infoSector %u >>>>>>>50 uleshort >6 \b, Backup boot sector %u #>>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) >>>>>>>50 uleshort <6 \b, Backup boot sector %u >>>>>>>54 ulelong >0 \b, reserved1 0x%x >>>>>>>58 ulelong >0 \b, reserved2 0x%x >>>>>>>62 ulelong >0 \b, reserved3 0x%x # same structure as FAT1X >>>>>>>64 ubyte >0x80 \b, physical drive 0x%x #>>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) >>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x #>>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) >>>>>>>65 ubyte >0 \b, reserved 0x%x >>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>>66 ubyte =0x29 >>>>>>>>67 ulelong x \b, serial number 0x%x >>>>>>>>71 string >>>>>>71 string >NO\ NAME \b, label: "%11.11s" >>>>>>>71 string =NO\ NAME \b, unlabeled ### FATs end a821 38 # Minix filesystems - Juan Cespedes 0x410 leshort 0x137f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x137f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x138f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x138f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2468 >0x402 beshort < 100 Minix filesystem, V2, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x2468 >0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2478 >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2478 >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x2478 >0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x4d5a >0x402 beshort !0 Minix filesystem, V3, %d zones >0x1e string minix \b, bootable d836 1 a836 1 # updated by Joerg Jenderek at Oct 2008!! d838 5 a842 1 0 ulelong 0x7c40eafa isolinux Loader d844 127 a970 2 0 ulelong 0x007c05ea pxelinux Loader 0 ulelong 0x60669c66 pxelinux Loader d1027 162 d1351 37 d1474 1 a1474 1 >32808 string >\0 '%s' d1800 23 @ 1.4.10.1 log @resync with head @ text @d3 1 a3 1 # $File: filesystems,v 1.69 2012/12/18 17:28:43 christos Exp $ d30 1 a30 2 # Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk a43 2 >>>535 search/17 \x55\xAA >>>>&-512 indirect x \b; contains d45 1 a45 1 # updated by Joerg Jenderek at Nov 2012 a54 1 >>>>128 indirect x \b; contains d56 1 a56 11 # x86 boot sector updated by Joerg Jenderek at Sep 2007,May 2011 # for any allowed sector sizes 30 search/481 \x55\xAA # to display x86 boot sector (40) before old one (strength=50), SYSLINUX MBR (?) and DOS BPB information (71) like in previous file version !:strength +40 # for sector sizes < 512 Bytes >11 uleshort <512 >>(11.s-2) uleshort 0xAA55 x86 boot sector # for sector sizes with 512 or more Bytes >0x1FE leshort 0xAA55 x86 boot sector # keep old x86 boot sector as dummy for mbr and bootloader displaying d58 5 a62 3 0x1FE leshort 0xAA55 # to display information (51) before DOS BPB (strength=71) and after DOS floppy (120) like in old file version !:strength +21 d134 2 a135 1 # SYSLINUX MBR moved d196 6 a201 1 # SYSLINUX bootloader moved d266 1 a266 2 # updated by Joerg Jenderek at Nov 2012 # DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes d270 1 a270 3 >>>>>>480 string x \b%-.4s >>>>>>>484 ubyte&0xDF >0 >>>>>>>>484 string x \b%-.1s d282 6 a287 13 # http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c # updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string # skip name "C.H. Hochstätter" partly because it is sometimes written without umlaut >242 search/127 Bootsector\ from\ C.H.\ Hochst >>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk # followed by variants with point,CR-NL or NL-CR >>>208 search/261 Cannot\ load\ from\ harddisk. # followed by variants CR-NL or NL-CR >>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. # followed by variants with point,CR-NL or NL-CR >>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader # followed by string like "6.50 (c) 1993-2004 Gilles Vollant" >>>>>>&0 string x \b, version %-4.4s d291 9 a299 17 # message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others >>>>(1.b+5) ubyte&0xd3 0x53 >>>>>(1.b+6) ubyte 0x7c # assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, >>>>>>(1.b+7) ubyte 0xac >>>>>>>(1.b+8) ubyte 0x22 >>>>>>>>(1.b+9) ubyte 0xc0 >>>>>>>>>(1.b+10) ubyte 0x74 >>>>>>>>>>(1.b+11) ubyte 0x0b >>>>>>>>>>>(1.b+12) ubyte 0x56 >>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display # FAT1X version >>>>>>>>>>>>>(1.b+5) ubyte 0x5b >>>>>>>>>>>>>>0x5b string >\0 "%-s" # FAT32 version >>>>>>>>>>>>>(1.b+5) ubyte 0x77 >>>>>>>>>>>>>>0x77 string >\0 "%-s" a764 12 # added by Joerg Jenderek at Nov 2012 # http://www.thenakedpc.com/articles/v04/08/0408-05.html # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 0 string PNCIHISK\0 Norton Utilities disc image data # real x86 boot sector with jump instruction >509 search/1026 \x55\xAA\xeb >>&-1 indirect x \b; contains # http://file-extension.net/seeker/file_extension_dat 0 string PNCIUNDO Norton Disk Doctor UnDo file # d779 101 a879 3 # DOS x86 sector separated and moved from "x86 boot sector" by Joerg Jenderek at May 2011 d884 38 d936 1 a936 1 # updated by Joerg Jenderek at Oct 2008 and Sep 2012 d938 1 a938 5 # tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 # assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 0 ulequad&0x909000007cc0eafa 0x909000007c40eafa >631 search/689 ISOLINUX\ isolinux Loader >>&0 string x (version %-4.4s) d940 2 a941 127 # assembler instructions: jmp 7C05 0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) # assembler instructions: pushfd;pushad 0 ulelong 0x60669c66 pxelinux loader # assembler instructions: jmp 05 0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) # http://syslinux.zytor.com/wiki/index.php/SYSLINUX 0 string LDLINUX\ SYS\ SYSLINUX loader >12 string x (older version %-4.4s) 0 string \r\nSYSLINUX\ SYSLINUX loader >11 string x (version %-4.4s) # syslinux updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 # assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 0 ulelong&0x80909bEB 0x009018EB # OEM-ID not always "SYSLINUX" >434 search/47 Boot\ failed # followed by \r\n\0 or :\ >>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) >>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) >459 search/30 Boot\ error\r\n\0 >>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) # SYSLINUX MBR updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 # assembler instructions: mov di,0600h;mov cx,0100h 16 search/4 \xbf\x00\x06\xb9\x00\x01 >94 search/249 Missing\ operating\ system # followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other # skip Ranish MBR >>408 search/4 HD1/\0 >>408 default x >>>250 search/118 \0Operating\ system\ load SYSLINUX MBR # followed by "ing " or space >>>>292 search/98 error >>>>>&0 string \r (version 3.35 or older) >>>>>&0 string .\r (version 3.52 or newer) >>>>>&0 default x (version 3.36-3.51 ) >368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR >>156 search/10 \0Boot\ partition\ not\ found\r\n >>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) >>174 search/10 \0Missing\ OS\r\n >>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) # SYSLINUX END # NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 # assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 0 ubequad 0x31c08ed0bc007c8e # mbr_bootsel magic before partition table not reliable with small ipl fragments #>444 uleshort 0xb5e1 >0004 uleshort x # ERRorTeXT >>181 search/166 Error\ \0\r\n NetBSD mbr # NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS >>>0x1B8 ubelong >0 \b,Serial 0x%-.8x # BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx >>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector # BOOT_EXTENDED definitions contains assembler instructions: # xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 >>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended # COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al >>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO # not TERSE_ERROR >>>196 search/106 No\ active\ partition\0 >>>>&0 string Disk\ read\ error\0 >>>>>&0 string No\ operating\ system\0 \b,verbose # not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 >>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS # not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 >>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check # assembler instructions: movw nametab,bx >>>0x26 search/21 \xBB\x94\x07 # not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf >>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 >>>>>181 search/166 Error\ \0 # "a: disk" , "Fn: diskn" or "NetBSD MBR boot" >>>>>>&3 string x \b,"%s" # Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html # added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 # assembler instructions: jmp short 0x58;nop;ASCII 0 ubequad&0xeb58908000000000 0xeb58900000000000 # assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, >(1.b+2) ubequad 0xfa31c08ed88ec08e # Error messages at end of code >>376 string No\ operating\ system\r\n\0 >>>398 string Disk\ error\r\n\0FDD\0HDD\0 >>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr # Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ # added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 # for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, # or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC # pointer to the data starting with Neil Turton signature string >(0x1BC.s) string NDTmbr >>&-14 string 1234F\0 Turton mbr ( # parameters also viewed by install-mbr --list >>>(0x1BC.s+7) ubyte x \b%u<= >>>(0x1BC.s+9) ubyte x \bVersion<=%u #>>>(0x1BC.s+8) ubyte x asm_flag_%x >>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix # variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode >>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk #0x1~1,..,0x8~4,0x10~F,0x80~A enabled #>>>(0x1BC.s+10) ubyte x \b,flags 0x%x #0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot #>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x # for older versions >>>(0x1BC.s+9) ubyte <2 #>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds >>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds # floppy A: or B: >>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x >>>>(0x1BC.s+13) ubyte >1 # 1st hard disc #>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x # not 1st hard disc >>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x # for version >= 2 maximal timeout can be 65534 >>>(0x1BC.s+9) ubyte >1 #>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds >>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds # floppy A: or B: >>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x >>>>(0x1BC.s+14) ubyte >1 # 1st hard disc #>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x # not 1st hard disc >>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x >>>0 ubyte x \b) a997 162 # DOS x86 sector updated and separated from "x86 boot sector" by Joerg Jenderek at May 2011 # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 # over BIOS parameter block (BPB) # http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD # older drives may use Near JuMP instruction E9 xx xx # minimal short forward jump found 0x29 for bootloaders or 0x0 # maximal short forward jump is 0x7f # OEM-ID is empty or contain readable bytes 0 ulelong&0x804000E9 0x000000E9 # mtools-3.9.8/msdos.h # usual values are marked with comments to get only informations of strange FAT systems # valid sectorsize must be a power of 2 from 32 to 32768 >11 uleshort&0xf001f 0 >>11 uleshort <32769 >>>11 uleshort >31 >>>>21 ubyte&0xf0 0xF0 >>>>>0 ubyte 0xEB >>>>>>1 ubyte x \b, code offset 0x%x+2 >>>>>0 ubyte 0xE9 >>>>>>1 uleshort x \b, code offset 0x%x+2 >>>>>3 string >\0 \b, OEM-ID "%-.8s" #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC >>>>>>8 string IHC \b cached by Windows 9M >>>>>11 uleshort >512 \b, Bytes/sector %u #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) >>>>>11 uleshort <512 \b, Bytes/sector %u >>>>>13 ubyte >1 \b, sectors/cluster %u #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) >>>>>82 string FAT32 >>>>>>14 uleshort !32 \b, reserved sectors %u #>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) >>>>>82 string !FAT32 >>>>>>14 uleshort >1 \b, reserved sectors %u #>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) #>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) >>>>>16 ubyte >2 \b, FATs %u #>>>>>16 ubyte =2 \b, FATs %u (usual) >>>>>16 ubyte =1 \b, FAT %u >>>>>16 ubyte >0 >>>>>17 uleshort >0 \b, root entries %u #>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) #>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x >>>>>22 uleshort >0 \b, sectors/FAT %u #>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) >>>>>24 uleshort x \b, sectors/track %u >>>>>26 ubyte >2 \b, heads %u #>>>>>26 ubyte =2 \b, heads %u (usual floppy) >>>>>26 ubyte =1 \b, heads %u # valid only for sector sizes with more then 32 Bytes >>>>>11 uleshort >32 # skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk >>>>>>38 ubyte !0x70 >>>>>>>28 ulelong >0 \b, hidden sectors %u #>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) #>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) # FAT<32 bit specific >>>>>>>82 string !FAT32 #>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) #>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) >>>>>>>>36 ubyte !0x80 >>>>>>>>>36 ubyte !0 \b, physical drive 0x%x >>>>>>>>37 ubyte >0 \b, reserved 0x%x #>>>>>>>>37 ubyte =0 \b, reserved 0x%x # value is 0x80 for NTFS >>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>>>38 ubyte =0x29 >>>>>>>>>39 ulelong x \b, serial number 0x%x >>>>>>>>>43 string >>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" >>>>>>>>>43 string =NO\ NAME \b, unlabeled # there exist some old floppies without word FAT at offset 54 # a word like "FATnm " is only a hint for a FAT size on nm-bits # Normally the number of clusters is calculated by the values of BPP. # if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, # otherwise FAT is 16 bit. # http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html >>>>>>54 string FAT \b, FAT >>>>>>>54 string FAT12 \b (12 bit) >>>>>>>54 string FAT16 \b (16 bit) # FAT32 bit specific >>>>>82 string FAT32 \b, FAT (32 bit) >>>>>>36 ulelong x \b, sectors/FAT %u # http://technet.microsoft.com/en-us/library/cc977221.aspx >>>>>>40 uleshort >0 \b, extension flags 0x%x #>>>>>>40 uleshort =0 \b, extension flags %u >>>>>>42 uleshort >0 \b, fsVersion %u #>>>>>>42 uleshort =0 \b, fsVersion %u (usual) >>>>>>44 ulelong >2 \b, rootdir cluster %u #>>>>>>44 ulelong =2 \b, rootdir cluster %u #>>>>>>44 ulelong =1 \b, rootdir cluster %u >>>>>>48 uleshort >1 \b, infoSector %u #>>>>>>48 uleshort =1 \b, infoSector %u (usual) >>>>>>48 uleshort <1 \b, infoSector %u >>>>>>50 uleshort >6 \b, Backup boot sector %u #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) >>>>>>50 uleshort <6 \b, Backup boot sector %u # corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO >>>>>>52 ulelong >0 \b, reserved1 0x%x >>>>>>56 ulelong >0 \b, reserved2 0x%x >>>>>>60 ulelong >0 \b, reserved3 0x%x # same structure as FAT1X #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) >>>>>>64 ubyte !0x80 >>>>>>>64 ubyte >0 \b, physical drive 0x%x # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too >>>>>>65 ubyte >0 \b, reserved 0x%x >>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>66 ubyte =0x29 >>>>>>>67 ulelong x \b, serial number 0x%x >>>>>>>71 string >>>>>>71 string >NO\ NAME \b, label: "%11.11s" >>>>>>>71 string =NO\ NAME \b, unlabeled # additional tests for floppy image added by Joerg Jenderek # no fixed disk >>>>>21 ubyte !0xF8 # floppy media with 12 bit FAT >>>>>>54 string !FAT16 # test for FAT after bootsector >>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT # floppy image !:mime application/x-ima # NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm # and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html # 0 FATs >>>>>16 ubyte =0 # 0 root entries >>>>>>17 uleshort =0 # 0 DOS sectors >>>>>>>19 uleshort =0 # 0 sectors/FAT # dos < 4.0 BootSector value found is 0x80 #38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) >>>>>>>>22 uleshort =0 \b; NTFS >>>>>>>>>24 uleshort >0 \b, sectors/track %u >>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x >>>>>>>>>40 ulequad >0 \b, sectors %lld >>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld >>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld # Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. # Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. >>>>>>>>>64 lelong <256 >>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi) # Values 0 to 127 represent index block sizes of 0 to 127 clusters. # Values 128 to 255 represent index block sizes of 2^(256-N) byte >>>>>>>>>68 ulelong <256 >>>>>>>>>>68 ulelong <128 \b, clusters/index block %d #>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi) >>>>>>>>>72 ulequad x \b, serial number 0%llx >>>>>>>>>80 ulelong >0 \b, checksum 0x%x #>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) >>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 >>>>>>>>>>&-92 indirect x \b; contains ### DOS boot sector end a1159 37 # Minix filesystems - Juan Cespedes 0x410 leshort 0x137f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x137f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x138f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x138f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2468 >0x402 beshort < 100 Minix filesystem, V2, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x2468 >0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2478 >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2478 >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x2478 >0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x4d5a >0x402 beshort !0 Minix filesystem, V3, %d zones >0x1e string minix \b, bootable d1246 1 a1246 1 >32808 string/T >\0 '%s' a1571 23 # LFS 0 lelong 0x070162 LFS filesystem image >4 lelong 1 version 1, >>8 lelong x \b blocks %u, >>12 lelong x \b blocks per segment %u, >4 lelong 2 version 2, >>8 lelong x \b fragments %u, >>12 lelong x \b bytes per segment %u, >16 lelong x \b disk blocks %u, >20 lelong x \b block size %u, >24 lelong x \b fragment size %u, >28 lelong x \b fragments per block %u, >32 lelong x \b start for free list %u, >36 lelong x \b number of free blocks %d, >40 lelong x \b number of files %u, >44 lelong x \b blocks available for writing %d, >48 lelong x \b inodes in cache %d, >52 lelong x \b inode file disk address 0x%x, >56 lelong x \b inode file inode number %u, >60 lelong x \b address of last segment written 0x%x, >64 lelong x \b address of next segment to write 0x%x, >68 lelong x \b address of current segment written 0x%x @ 1.4.10.2 log @resync from head @ text @d3 1 a3 1 # $File: filesystems,v 1.77 2013/03/14 01:38:30 christos Exp $ d63 2 a64 3 # to display x86 boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) # DOS BPB information (70) and after DOS floppy (120) like in previous file version !:strength +72 d73 1 a73 1 # to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version d76 2 a77 149 # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/ # and http://en.wikipedia.org/wiki/Master_Boot_Record # test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by # characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 >0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR # Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) # assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld >>8 ubequad 0x8bf45007501ffbfc # http://thestarman.pcministry.com/asm/mbr/200MBR.htm >>>0x16 ubyte 0xF3 \b,DOS 2 >>>>219 regex Author\ -\ Author: # found "David Litton" , "A Pehrsson " >>>>>&0 string x "%s" >>>0x16 ubyte 0xF2 # NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm # assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz >>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 # version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) >>>>0x22 default x \b,D0S version 3.3-7.0 # error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) # where nn is string offset varying for different languages # "Invalid partition table" nn=0x8b for english version >>>>>(0x49.b) string Invalid\ partition\ table english >>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german >>>>>(0x49.b) string Table\ de\ partition\ invalide french >>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese >>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish >>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian >>>>>0x49 ubyte >0 at offset 0x%x >>>>>>(0x49.b) string >\0 "%s" # "Error loading operating system" nn=0xa3 for english version # "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version # "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version # "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version # "Error al cargar sistema operativo" nn=0xa8 for spanish version # "Errore durante il caricamento del sistema operativo" nn=0xae for italian version >>>>>0x74 ubyte >0 at offset 0x%x >>>>>>(0x74.b) string >\0 "%s" # "Missing operating system" nn=0xc2 for english version # "Betriebssystem fehlt" nn=0xcd for german version # "Syst\212me d'exploitation absent" nn=0xd2 for french version # "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version # "Falta sistema operativo" nn=0xca for spanish version # "Sistema operativo mancante" nn=0xe2 for italian version >>>>>0x79 ubyte >0 at offset 0x%x >>>>>>(0x79.b) string >\0 "%s" # Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) # assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b >>8 ubequad 0x5007501ffcbe1b7c # assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 >>>24 ubequad 0xf3a4cbbebe07b104 9M # "Invalid partition table" nn=0x10F for english version # "Ungültige Partitionstabelle" nn=0x10F for german version # "Table de partition erronée" nn=0x10F for french version # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version >>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english >>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german >>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french >>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian >>>>0x3C ubyte x at offset 0x%x+0xFF >>>>(0x3C.b+0x0FF) string >\0 "%s" # "Error loading operating system" nn=0x127 for english version # "Fehler beim Laden des Betriebssystems" nn=0x12b for german version # "Erreur lors du chargement du système d'exploitation" nn=0x12a for french version # "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version >>>>0xBD ubyte x at offset 0x1%x >>>>(0xBD.b+0x100) string >\0 "%s" # "Missing operating system" nn=0x146 for english version # "Betriebssystem fehlt" nn=0x151 for german version # "Système d'exploitation manquant" nn=0x15e for french version # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version >>>>0xA9 ubyte x at offset 0x1%x >>>>(0xA9.b+0x100) string >\0 "%s" # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm # assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 >>>24 ubequad 0xf3a4cbbdbe07b104 XP # where xxyyzz are lower bits from offsets of error messages varying for different languages >>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english >>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german # "Invalid partition table" xx=0x12C for english version # "Ungültige Partitionstabelle" xx=0x12C for german version >>>>0x1b5 ubyte >0 at offset 0x1%x >>>>(0x1b5.b+0x100) string >\0 "%s" # "Error loading operating system" yy=0x144 for english version # "Fehler beim Laden des Betriebssystems" yy=0x148 for german version >>>>0x1b6 ubyte >0 at offset 0x1%x >>>>(0x1b6.b+0x100) string >\0 "%s" # "Missing operating system" zz=0x163 for english version # "Betriebssystem nicht vorhanden" zz=0x16e for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" # Microsoft Windows Vista or 7 # assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 >>8 ubequad 0xc08ed8be007cbf00 # Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) # assembler instructions: jnz 0729;cmp ebx,"TCPA" >>>0xEC ubequad 0x753b6681fb544350 Vista # where xxyyzz are lower bits from offsets of error messages varying for different languages >>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english #>>>>0x1B4 ubelong&0x00FFFFFF ? german # "Invalid partition table" xx=0x162 for english version # "Ungültige Partitionstabelle" xx=0x1?? for german version >>>>0x1b5 ubyte >0 at offset 0x1%x >>>>(0x1b5.b+0x100) string >\0 "%s" # "Error loading operating system" yy=0x17a for english version # "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version >>>>0x1b6 ubyte >0 at offset 0x1%x >>>>(0x1b6.b+0x100) string >\0 "%s" # "Missing operating system" zz=0x199 for english version # "Betriebssystem nicht vorhanden" zz=0x1?? for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" # Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm) # assembler instructions: cmp ebx,"TCPA";cmp >>>0xEC ubequad 0x6681fb5443504175 Windows 7 # where xxyyzz are lower bits from offsets of error messages varying for different languages >>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english #>>>>0x1B4 ubelong&0x00FFFFFF ? german # "Invalid partition table" xx=0x163 for english version # "Ungültige Partitionstabelle" xx=0x1?? for german version >>>>0x1b5 ubyte >0 at offset 0x1%x >>>>(0x1b5.b+0x100) string >\0 "%s" # "Error loading operating system" yy=0x17b for english version # "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version >>>>0x1b6 ubyte >0 at offset 0x1%x >>>>(0x1b6.b+0x100) string >\0 "%s" # "Missing operating system" zz=0x19a for english version # "Betriebssystem nicht vorhanden" zz=0x1?? for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs # http://en.wikipedia.org/wiki/MBR_disk_signature#ID >>0x1b8 ulelong >0 \b, disk signature 0x%-.4x # driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm >>0xDA uleshort 0 >>>0xDC ulelong >0 \b, created # physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive >>>>0xDC ubyte x with driveID 0x%x # hours, minutes and seconds >>>>0xDf ubyte x at %x >>>>0xDe ubyte x \b:%x >>>>0xDd ubyte x \b:%x # special case for Microsoft MS-DOS 3.21 spanish # assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov >0 ubequad 0xfab830008ed0bc00 # assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov >>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish # Microsoft MBR IPL end d96 24 a119 3 # # tests for different MS-DOS Master Boot Records (MBR) moved and merged # d293 1 a293 1 # skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut a789 8 # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO # and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector >0 string RRaA >>0x1E4 string rrAa \b, FSInfosector #>>0x1FC uleshort =0 SHOULD BE ZERO >>>0x1E8 ulelong <0xffffffff \b, %u free clusters >>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u a867 2 # to display SYSLINUX MBR (36) before old x86 boot sector one with partition table (strength=50+21) !:strength +36 d1187 1 a1187 11 # For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 # http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm # unused assembler instructions JMP y2;NOP;NOP 0x056 ulelong&0xFFFF0FFF 0x909002EB # unicode loadername terminated by CTRL-D >(0.s*2) ulelong&0xFFFFFF00 0x00040000 # loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR >>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s >>0x12 string $ >>>0x0c lestring16 x \b%-2.2s ### DOS,NTFS boot sectors end d1354 1 a1354 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1, %d zones d1358 1 a1358 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones d1362 1 a1362 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones d1366 1 a1366 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones d1369 1 a1369 2 >0x402 beshort < 100 >>0x402 beshort > -1 Minix filesystem, V2, %d zones d1372 1 a1372 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones d1376 1 a1376 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones d1379 1 a1379 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones d1457 2 a1458 2 # 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 # 11110000 High density 3 1/2 floppy disk d1645 2 a1822 15 0 string td\000 floppy image data (TeleDisk, compressed) 0 string TD\000 floppy image data (TeleDisk) 0 string CQ\024 floppy image data (CopyQM, >16 leshort x %d sectors, >18 leshort x %d heads.) 0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 0 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 0 beshort 0xAA59 floppy image data (IBM SaveDskF) 0 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) 0 string \074CPM_Disk\076 disk image data (YAZE) @ 1.4.10.3 log @Rebase to HEAD as of a few days ago. @ text @d1 1 d3 1 a3 1 # $File: filesystems,v 1.95 2014/06/03 19:17:27 christos Exp $ a5 182 0 name partid >0 ubyte 0x00 Unused >0 ubyte 0x01 12-bit FAT >0 ubyte 0x02 XENIX / >0 ubyte 0x03 XENIX /usr >0 ubyte 0x04 16-bit FAT, less than 32M >0 ubyte 0x05 extended partition >0 ubyte 0x06 16-bit FAT, more than 32M >0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX >0 ubyte 0x08 AIX or os, or etc. >0 ubyte 0x09 AIX boot partition or Coherent >0 ubyte 0x0a O/2 boot manager or Coherent swap >0 ubyte 0x0b 32-bit FAT >0 ubyte 0x0c 32-bit FAT, LBA-mapped >0 ubyte 0x0d 7XXX, LBA-mapped >0 ubyte 0x0e 16-bit FAT, LBA-mapped >0 ubyte 0x0f extended partition, LBA-mapped >0 ubyte 0x10 OPUS >0 ubyte 0x11 OS/2 DOS 12-bit FAT >0 ubyte 0x12 Compaq diagnostics >0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M >0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M >0 ubyte 0x17 OS/2 hidden IFS >0 ubyte 0x18 AST Windows swapfile >0 ubyte 0x19 Willowtech Photon coS >0 ubyte 0x1b hidden win95 fat 32 >0 ubyte 0x1c hidden win95 fat 32 lba >0 ubyte 0x1d hidden win95 fat 16 lba >0 ubyte 0x20 Willowsoft OFS1 >0 ubyte 0x21 reserved >0 ubyte 0x23 reserved >0 ubyte 0x24 NEC DOS >0 ubyte 0x26 reserved >0 ubyte 0x31 reserved >0 ubyte 0x32 Alien Internet Services NOS >0 ubyte 0x33 reserved >0 ubyte 0x34 reserved >0 ubyte 0x35 JFS on OS2 >0 ubyte 0x36 reserved >0 ubyte 0x38 Theos >0 ubyte 0x39 Plan 9, or Theos spanned >0 ubyte 0x3a Theos ver 4 4gb partition >0 ubyte 0x3b Theos ve 4 extended partition >0 ubyte 0x3c PartitionMagic recovery >0 ubyte 0x3d Hidden Netware >0 ubyte 0x40 VENIX 286 or LynxOS >0 ubyte 0x41 PReP >0 ubyte 0x42 linux swap sharing DRDOS disk >0 ubyte 0x43 linux sharing DRDOS disk >0 ubyte 0x44 GoBack change utility >0 ubyte 0x45 Boot US Boot manager >0 ubyte 0x46 EUMEL/Elan or Ergos 3 >0 ubyte 0x47 EUMEL/Elan or Ergos 3 >0 ubyte 0x48 EUMEL/Elan or Ergos 3 >0 ubyte 0x4a ALFX/THIN filesystem for DOS >0 ubyte 0x4c Oberon partition >0 ubyte 0x4d QNX4.x >0 ubyte 0x4e QNX4.x 2nd part >0 ubyte 0x4f QNX4.x 3rd part >0 ubyte 0x50 DM (disk manager) >0 ubyte 0x51 DM6 Aux1 (or Novell) >0 ubyte 0x52 CP/M or Microport SysV/AT >0 ubyte 0x53 DM6 Aux3 >0 ubyte 0x54 DM6 DDO >0 ubyte 0x55 EZ-Drive (disk manager) >0 ubyte 0x56 Golden Bow (disk manager) >0 ubyte 0x57 Drive PRO >0 ubyte 0x5c Priam Edisk (disk manager) >0 ubyte 0x61 SpeedStor >0 ubyte 0x63 GNU HURD or Mach or Sys V/386 >0 ubyte 0x64 Novell Netware 2.xx or Speedstore >0 ubyte 0x65 Novell Netware 3.xx >0 ubyte 0x66 Novell 386 Netware >0 ubyte 0x67 Novell >0 ubyte 0x68 Novell >0 ubyte 0x69 Novell >0 ubyte 0x70 DiskSecure Multi-Boot >0 ubyte 0x71 reserved >0 ubyte 0x73 reserved >0 ubyte 0x74 reserved >0 ubyte 0x75 PC/IX >0 ubyte 0x76 reserved >0 ubyte 0x77 M2FS/M2CS partition >0 ubyte 0x78 XOSL boot loader filesystem >0 ubyte 0x80 MINIX until 1.4a >0 ubyte 0x81 MINIX since 1.4b >0 ubyte 0x82 Linux swap or Solaris >0 ubyte 0x83 Linux native >0 ubyte 0x84 OS/2 hidden C: drive >0 ubyte 0x85 Linux extended partition >0 ubyte 0x86 NT FAT volume set >0 ubyte 0x87 NTFS volume set or HPFS mirrored >0 ubyte 0x8a Linux Kernel AiR-BOOT partition >0 ubyte 0x8b Legacy Fault tolerant FAT32 >0 ubyte 0x8c Legacy Fault tolerant FAT32 ext >0 ubyte 0x8d Hidden free FDISK FAT12 >0 ubyte 0x8e Linux Logical Volume Manager >0 ubyte 0x90 Hidden free FDISK FAT16 >0 ubyte 0x91 Hidden free FDISK DOS EXT >0 ubyte 0x92 Hidden free FDISK FAT16 Big >0 ubyte 0x93 Amoeba filesystem >0 ubyte 0x94 Amoeba bad block table >0 ubyte 0x95 MIT EXOPC native partitions >0 ubyte 0x97 Hidden free FDISK FAT32 >0 ubyte 0x98 Datalight ROM-DOS Super-Boot >0 ubyte 0x99 Mylex EISA SCSI >0 ubyte 0x9a Hidden free FDISK FAT16 LBA >0 ubyte 0x9b Hidden free FDISK EXT LBA >0 ubyte 0x9f BSDI? >0 ubyte 0xa0 IBM Thinkpad hibernation >0 ubyte 0xa1 HP Volume expansion (SpeedStor) >0 ubyte 0xa3 HP Volume expansion (SpeedStor) >0 ubyte 0xa4 HP Volume expansion (SpeedStor) >0 ubyte 0xa5 386BSD partition type >0 ubyte 0xa6 OpenBSD partition type >0 ubyte 0xa7 NeXTSTEP 486 >0 ubyte 0xa8 Apple UFS >0 ubyte 0xa9 NetBSD partition type >0 ubyte 0xaa Olivetty Fat12 1.44MB Service part >0 ubyte 0xab Apple Boot >0 ubyte 0xae SHAG OS filesystem >0 ubyte 0xaf Apple HFS >0 ubyte 0xb0 BootStar Dummy >0 ubyte 0xb1 reserved >0 ubyte 0xb3 reserved >0 ubyte 0xb4 reserved >0 ubyte 0xb6 reserved >0 ubyte 0xb7 BSDI BSD/386 filesystem >0 ubyte 0xb8 BSDI BSD/386 swap >0 ubyte 0xbb Boot Wizard Hidden >0 ubyte 0xbe Solaris 8 partition type >0 ubyte 0xbf Solaris partition type >0 ubyte 0xc0 CTOS >0 ubyte 0xc1 DRDOS/sec (FAT-12) >0 ubyte 0xc2 Hidden Linux >0 ubyte 0xc3 Hidden Linux swap >0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) >0 ubyte 0xc5 DRDOS/sec (EXT) >0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) >0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled >0 ubyte 0xc8 Reserved for DR-DOS 8.0+ >0 ubyte 0xc9 Reserved for DR-DOS 8.0+ >0 ubyte 0xca Reserved for DR-DOS 8.0+ >0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS >0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA >0 ubyte 0xcd CTOS Memdump >0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA >0 ubyte 0xcf DR-DOS 7.04+ EXT LBA >0 ubyte 0xd0 REAL/32 secure big partition >0 ubyte 0xd1 Old Multiuser DOS FAT12 >0 ubyte 0xd4 Old Multiuser DOS FAT16 Small >0 ubyte 0xd5 Old Multiuser DOS Extended >0 ubyte 0xd6 Old Multiuser DOS FAT16 Big >0 ubyte 0xd8 CP/M 86 >0 ubyte 0xdb CP/M or Concurrent CP/M >0 ubyte 0xdd Hidden CTOS Memdump >0 ubyte 0xde Dell PowerEdge Server utilities >0 ubyte 0xdf DG/UX virtual disk manager >0 ubyte 0xe0 STMicroelectronics ST AVFS >0 ubyte 0xe1 DOS access or SpeedStor 12-bit >0 ubyte 0xe3 DOS R/O or Storage Dimensions >0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. >0 ubyte 0xe5 reserved >0 ubyte 0xe6 reserved >0 ubyte 0xeb BeOS >0 ubyte 0xee GPT Protective MBR >0 ubyte 0xef EFI system partition >0 ubyte 0xf0 Linux PA-RISC boot loader >0 ubyte 0xf1 SpeedStor or Storage Dimensions >0 ubyte 0xf2 DOS 3.3+ Secondary >0 ubyte 0xf3 reserved >0 ubyte 0xf4 SpeedStor large partition >0 ubyte 0xf5 Prologue multi-volumen partition >0 ubyte 0xf6 reserved >0 ubyte 0xf9 pCache: ext2/ext3 persistent cache >0 ubyte 0xfa Bochs x86 emulator >0 ubyte 0xfb VMware File System >0 ubyte 0xfc VMware Swap >0 ubyte 0xfd Linux RAID partition persistent sb >0 ubyte 0xfe LANstep or IBM PS/2 IML >0 ubyte 0xff Xenix Bad Block Table d26 2 a27 2 >>0764 long >0 start cyl %d, >>0770 long x %d blocks d60 1 a60 12 # added by Joerg Jenderek at Nov 2012 # http://www.thenakedpc.com/articles/v04/08/0408-05.html # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 0 string PNCIHISK\0 Norton Utilities disc image data # real x86 boot sector with jump instruction >509 search/1026 \x55\xAA\xeb >>&-1 indirect x \b; contains # http://file-extension.net/seeker/file_extension_dat 0 string PNCIUNDO Norton Disk Doctor UnDo file # # DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013 d63 1 a63 1 # to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) d68 1 a68 1 >>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector d70 2 a71 2 >0x1FE leshort 0xAA55 DOS/MBR boot sector # keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying d73 1 a73 2 0x1FE leshort 0xAA55 # d129 2 a130 2 # "Ung\201ltige Partitionstabelle" nn=0x10F for german version # "Table de partition erron\202e" nn=0x10F for french version d140 1 a140 1 # "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version d146 1 a146 1 # "Syst\212me d'exploitation manquant" nn=0x15e for french version d157 1 a157 1 # "Ung\201ltige Partitionstabelle" xx=0x12C for german version d178 1 a178 1 # "Ung\201ltige Partitionstabelle" xx=0x1?? for german version d196 1 a196 1 # "Ung\201ltige Partitionstabelle" xx=0x1?? for german version d329 1 a329 1 # unknown version d339 54 a392 31 # mbr partition table entries updated by Joerg Jenderek at Sep 2013 # skip Norton Utilities disc image data >3 string !IHISK # skip Linux style boot sector starting with assember instructions mov 0x7c0,ax; >>0 belong !0xb8c0078e # not Linux kernel >>>514 string !HdrS # not BeOS >>>>422 string !Be\ Boot\ Loader # jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr >>>>>0 ubelong&0xFD000000 =0xE9000000 # AdvanceMAME mbr >>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e >>>>>>>446 use partition-table # mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader >>>>>0 ubelong&0xFD000000 !0xE9000000 # skip FSInfosector >>>>>>0 string !RRaA # skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, # http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm >>>>>>>0 ubequad !0xfa660fb64610668b # skip 13rd sector of MS x86 bootloader >>>>>>>>0 ubequad !0x660fb64610668b4e # skip sector starting with DOS new line >>>>>>>>>0 string !\r\n # allowed active flag 0,80h-FFh >>>>>>>>>>446 ubyte 0 >>>>>>>>>>>446 use partition-table >>>>>>>>>>446 ubyte >0x7F >>>>>>>>>>>446 use partition-table # TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries d399 1 a399 1 # updated by Joerg Jenderek at Nov 2012, Sep 2013 d401 8 a408 3 # display 1 space >>>447 ubyte x \b >>>477 use DOS-filename d848 23 a870 2 >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader >>>>>499 use DOS-filename d877 32 d911 4 d925 11 d951 1 a951 1 # DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 a953 87 # by Joerg Jenderek at Apr 2013 # Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension # like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 0 name DOS-filename # space=0x20 (00100000b) means empty >0 ubyte&0xDF >0 >>0 ubyte x \b%c >>>1 ubyte&0xDF >0 >>>>1 ubyte x \b%c >>>>>2 ubyte&0xDF >0 >>>>>>2 ubyte x \b%c >>>>>>>3 ubyte&0xDF >0 >>>>>>>>3 ubyte x \b%c >>>>>>>>>4 ubyte&0xDF >0 >>>>>>>>>>4 ubyte x \b%c >>>>>>>>>>>5 ubyte&0xDF >0 >>>>>>>>>>>>5 ubyte x \b%c >>>>>>>>>>>>>6 ubyte&0xDF >0 >>>>>>>>>>>>>>6 ubyte x \b%c >>>>>>>>>>>>>>>7 ubyte&0xDF >0 >>>>>>>>>>>>>>>>7 ubyte x \b%c # DOS filename extension >>8 ubyte&0xDF >0 \b. >>>8 ubyte x \b%c >>>>9 ubyte&0xDF >0 >>>>>9 ubyte x \b%c >>>>>>10 ubyte&0xDF >0 >>>>>>>10 ubyte x \b%c # Print 2 following DOS filenames from directory entry form # like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 0 name 2xDOS-filename # display 1 space >0 ubyte x \b >0 use DOS-filename >11 ubyte x \b+ >11 use DOS-filename # http://en.wikipedia.org/wiki/Master_boot_record#PTE # display standard partition table 0 name partition-table #>0 ubyte x PARTITION-TABLE # test and display 1st til 4th partition table entry >0 use partition-entry-test >16 use partition-entry-test >32 use partition-entry-test >48 use partition-entry-test # test for entry of partition table 0 name partition-entry-test # partition type ID > 0 >4 ubyte >0 # active flag 0 >>0 ubyte 0 >>>0 use partition-entry # active flag 0x80, 0x81, ... >>0 ubyte >0x7F >>>0 use partition-entry # Print entry of partition table 0 name partition-entry # partition type ID > 0 >4 ubyte >0 \b; partition >>64 leshort 0xAA55 1 >>48 leshort 0xAA55 2 >>32 leshort 0xAA55 3 >>16 leshort 0xAA55 4 >>4 ubyte x : ID=0x%x >>0 ubyte&0x80 0x80 \b, active >>0 ubyte >0x80 0x%x >>1 ubyte x \b, start-CHS ( >>1 use partition-chs >>5 ubyte x \b), end-CHS ( >>5 use partition-chs >>8 ulelong x \b), startsector %u >>12 ulelong x \b, %u sectors # Print cylinder,head,sector (CHS) of partition entry 0 name partition-chs # cylinder >1 ubyte x \b0x >1 ubyte&0xC0 0x40 \b1 >1 ubyte&0xC0 0x80 \b2 >1 ubyte&0xC0 0xC0 \b3 >2 ubyte x \b%x # head >0 ubyte x \b,%u # sector >1 ubyte&0x3F x \b,%u d990 1 a990 1 # syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 d1000 1 a1000 1 # SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 d1003 1 a1003 1 # to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) d1087 1 a1087 1 #>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds d1130 1 a1130 1 #>>>>0x208 ulelong =0xffffff \b, %lu (default) d1164 1 a1164 1 # DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 d1204 1 a1204 1 #>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) d1206 1 a1206 1 #>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) d1211 1 a1211 1 #>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) d1253 1 a1253 1 #>>>>>>40 uleshort =0 \b, extension flags %hu d1312 1 a1312 1 >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) d1318 1 a1318 1 >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) d1366 1 a1366 1 >&-264 lelong x pending inodes to free %d, d1386 1 a1386 1 >&-264 lelong x pending inodes to free %d, d1426 1 a1426 1 >&-264 belong x pending inodes to free %d, d1446 1 a1446 1 >&-264 belong x pending inodes to free %d, d1556 2 a1557 4 # http://en.wikipedia.org/wiki/BIOS_parameter_block # floppies with valid BPB and any instruction at beginning >19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy >19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy d1561 4 a1564 4 19 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector d1566 6 a1571 1 >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector d1573 2 a1574 13 19 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 19 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k # | | | | | # | | | | heads # | | | sectors/track # | | sectors/FAT # | media descriptor # BPB: sectors a1616 74 # all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 # http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions # Too Weak. #512 ubelong&0xE0ffff00 0xE0ffff00 # without valid Media descriptor in place of BPB, cases with are done at other places #>21 ubyte <0xE5 floppy with old FAT filesystem # but valid Media descriptor at begin of FAT #>>512 ubyte =0xed 720k #>>512 ubyte =0xf0 1440k #>>512 ubyte =0xf8 720k #>>512 ubyte =0xf9 1220k #>>512 ubyte =0xfa 320k #>>512 ubyte =0xfb 640k #>>512 ubyte =0xfc 180k # look like an an old DOS directory entry #>>>0xA0E ubequad 0 #>>>>0xA00 ubequad !0 #!:mime application/x-ima #>>512 ubyte =0xfd # look for 2nd FAT at different location to distinguish between 360k and 500k #>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k #>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k #>>>0xA0E ubequad 0 #!:mime application/x-ima #>>512 ubyte =0xfe #>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k #>>>>0x60E ubequad 0 #>>>>>0x600 ubequad !0 #!:mime application/x-ima #>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k #>>512 ubyte =0xff 320k #>>>0x60E ubequad 0 #>>>>0x600 ubequad !0 #!:mime application/x-ima #>>512 ubyte x \b, Media descriptor 0x%x # without x86 jump instruction #>>0 ulelong&0x804000E9 !0x000000E9 # assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV #>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader # IOSYS.COM+MSDOS.COM #>>>>0xc4 use 2xDOS-filename #>>0 ulelong&0x804000E9 =0x000000E9 # only x86 short jump instruction found #>>>0 ubyte =0xEB #>>>>1 ubyte x \b, code offset 0x%x+2 # http://thestarman.pcministry.com/DOS/ibm100/Boot.htm # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 #>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader # ibmbio.com+ibmdos.com #>>>>>0x176 use DOS-filename #>>>>>0x181 ubyte x \b+ #>>>>>0x182 use DOS-filename # http://thestarman.pcministry.com/DOS/ibm110/Boot.htm # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV #>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader # ibmbio.com+ibmdos.com #>>>>>0x18b use DOS-filename #>>>>>0x196 ubyte x \b+ #>>>>>0x197 use DOS-filename # http://en.wikipedia.org/wiki/Zenith_Data_Systems # assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 #>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader # IO.SYS+MSDOS.SYS #>>>>>0x20 use 2xDOS-filename # http://en.wikipedia.org/wiki/Corona_Data_Systems # assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; #>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader # IO.SYS+MSDOS.SYS #>>>>>0x69 use 2xDOS-filename # assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; #>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader # defect IO.SYS+MSDOS.SYS ? #>>>>>0x162 use 2xDOS-filename d1633 1 a1633 1 32777 string CDROM High Sierra CD-ROM filesystem data d1640 1 a1640 1 >4 lelong x size %u d1645 3 a1647 3 >36 lelong x edition %u, >40 lelong x %u blocks, >44 lelong x %u files d1650 1 a1650 1 >4 belong x size %u d1655 3 a1657 3 >36 belong x edition %u, >40 belong x %u blocks, >44 belong x %u files d1922 2 a1923 2 >40 ulelong >0 \b fblock size = %d, >44 ulelong >0 \b block size = %d, a1990 23 # ReFS # Richard W.M. Jones 0 string \0\0\0ReFS\0 ReFS filesystem image # EFW encase image file format: # Gregoire Passault # http://www.forensicswiki.org/wiki/Encase_image_file_format 0 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format # UBIfs # Linux kernel sources: fs/ubifs/ubifs-media.h 0 belong 0x31181006 >0x16 short 0 UBIfs image >0x08 lequad x \b, sequence number %llu >0x10 leshort x \b, length %u >0x04 lelong x \b, CRC 0x%08x 0 belong 0x55424923 >0x04 short <2 >0x05 string \0\0\0 >0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 >0x04 short x UBI image, version %u @ 1.4.4.1 log @sync with head @ text @d3 1 a3 1 # $File: filesystems,v 1.69 2012/12/18 17:28:43 christos Exp $ d30 1 a30 2 # Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk a43 2 >>>535 search/17 \x55\xAA >>>>&-512 indirect x \b; contains d45 1 a45 1 # updated by Joerg Jenderek at Nov 2012 a54 1 >>>>128 indirect x \b; contains d56 1 a56 11 # x86 boot sector updated by Joerg Jenderek at Sep 2007,May 2011 # for any allowed sector sizes 30 search/481 \x55\xAA # to display x86 boot sector (40) before old one (strength=50), SYSLINUX MBR (?) and DOS BPB information (71) like in previous file version !:strength +40 # for sector sizes < 512 Bytes >11 uleshort <512 >>(11.s-2) uleshort 0xAA55 x86 boot sector # for sector sizes with 512 or more Bytes >0x1FE leshort 0xAA55 x86 boot sector # keep old x86 boot sector as dummy for mbr and bootloader displaying d58 5 a62 3 0x1FE leshort 0xAA55 # to display information (51) before DOS BPB (strength=71) and after DOS floppy (120) like in old file version !:strength +21 d134 2 a135 1 # SYSLINUX MBR moved d196 6 a201 1 # SYSLINUX bootloader moved d266 1 a266 2 # updated by Joerg Jenderek at Nov 2012 # DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes d270 1 a270 3 >>>>>>480 string x \b%-.4s >>>>>>>484 ubyte&0xDF >0 >>>>>>>>484 string x \b%-.1s d282 6 a287 13 # http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c # updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string # skip name "C.H. Hochstätter" partly because it is sometimes written without umlaut >242 search/127 Bootsector\ from\ C.H.\ Hochst >>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk # followed by variants with point,CR-NL or NL-CR >>>208 search/261 Cannot\ load\ from\ harddisk. # followed by variants CR-NL or NL-CR >>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. # followed by variants with point,CR-NL or NL-CR >>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader # followed by string like "6.50 (c) 1993-2004 Gilles Vollant" >>>>>>&0 string x \b, version %-4.4s d291 9 a299 17 # message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others >>>>(1.b+5) ubyte&0xd3 0x53 >>>>>(1.b+6) ubyte 0x7c # assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, >>>>>>(1.b+7) ubyte 0xac >>>>>>>(1.b+8) ubyte 0x22 >>>>>>>>(1.b+9) ubyte 0xc0 >>>>>>>>>(1.b+10) ubyte 0x74 >>>>>>>>>>(1.b+11) ubyte 0x0b >>>>>>>>>>>(1.b+12) ubyte 0x56 >>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display # FAT1X version >>>>>>>>>>>>>(1.b+5) ubyte 0x5b >>>>>>>>>>>>>>0x5b string >\0 "%-s" # FAT32 version >>>>>>>>>>>>>(1.b+5) ubyte 0x77 >>>>>>>>>>>>>>0x77 string >\0 "%-s" a764 12 # added by Joerg Jenderek at Nov 2012 # http://www.thenakedpc.com/articles/v04/08/0408-05.html # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 0 string PNCIHISK\0 Norton Utilities disc image data # real x86 boot sector with jump instruction >509 search/1026 \x55\xAA\xeb >>&-1 indirect x \b; contains # http://file-extension.net/seeker/file_extension_dat 0 string PNCIUNDO Norton Disk Doctor UnDo file # d779 101 a879 3 # DOS x86 sector separated and moved from "x86 boot sector" by Joerg Jenderek at May 2011 d884 38 d936 1 a936 1 # updated by Joerg Jenderek at Oct 2008 and Sep 2012 d938 1 a938 5 # tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 # assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 0 ulequad&0x909000007cc0eafa 0x909000007c40eafa >631 search/689 ISOLINUX\ isolinux Loader >>&0 string x (version %-4.4s) d940 2 a941 127 # assembler instructions: jmp 7C05 0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) # assembler instructions: pushfd;pushad 0 ulelong 0x60669c66 pxelinux loader # assembler instructions: jmp 05 0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) # http://syslinux.zytor.com/wiki/index.php/SYSLINUX 0 string LDLINUX\ SYS\ SYSLINUX loader >12 string x (older version %-4.4s) 0 string \r\nSYSLINUX\ SYSLINUX loader >11 string x (version %-4.4s) # syslinux updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 # assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 0 ulelong&0x80909bEB 0x009018EB # OEM-ID not always "SYSLINUX" >434 search/47 Boot\ failed # followed by \r\n\0 or :\ >>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) >>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) >459 search/30 Boot\ error\r\n\0 >>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) # SYSLINUX MBR updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 # assembler instructions: mov di,0600h;mov cx,0100h 16 search/4 \xbf\x00\x06\xb9\x00\x01 >94 search/249 Missing\ operating\ system # followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other # skip Ranish MBR >>408 search/4 HD1/\0 >>408 default x >>>250 search/118 \0Operating\ system\ load SYSLINUX MBR # followed by "ing " or space >>>>292 search/98 error >>>>>&0 string \r (version 3.35 or older) >>>>>&0 string .\r (version 3.52 or newer) >>>>>&0 default x (version 3.36-3.51 ) >368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR >>156 search/10 \0Boot\ partition\ not\ found\r\n >>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) >>174 search/10 \0Missing\ OS\r\n >>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) # SYSLINUX END # NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 # assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 0 ubequad 0x31c08ed0bc007c8e # mbr_bootsel magic before partition table not reliable with small ipl fragments #>444 uleshort 0xb5e1 >0004 uleshort x # ERRorTeXT >>181 search/166 Error\ \0\r\n NetBSD mbr # NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS >>>0x1B8 ubelong >0 \b,Serial 0x%-.8x # BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx >>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector # BOOT_EXTENDED definitions contains assembler instructions: # xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 >>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended # COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al >>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO # not TERSE_ERROR >>>196 search/106 No\ active\ partition\0 >>>>&0 string Disk\ read\ error\0 >>>>>&0 string No\ operating\ system\0 \b,verbose # not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 >>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS # not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 >>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check # assembler instructions: movw nametab,bx >>>0x26 search/21 \xBB\x94\x07 # not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf >>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 >>>>>181 search/166 Error\ \0 # "a: disk" , "Fn: diskn" or "NetBSD MBR boot" >>>>>>&3 string x \b,"%s" # Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html # added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 # assembler instructions: jmp short 0x58;nop;ASCII 0 ubequad&0xeb58908000000000 0xeb58900000000000 # assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, >(1.b+2) ubequad 0xfa31c08ed88ec08e # Error messages at end of code >>376 string No\ operating\ system\r\n\0 >>>398 string Disk\ error\r\n\0FDD\0HDD\0 >>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr # Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ # added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 # for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, # or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC # pointer to the data starting with Neil Turton signature string >(0x1BC.s) string NDTmbr >>&-14 string 1234F\0 Turton mbr ( # parameters also viewed by install-mbr --list >>>(0x1BC.s+7) ubyte x \b%u<= >>>(0x1BC.s+9) ubyte x \bVersion<=%u #>>>(0x1BC.s+8) ubyte x asm_flag_%x >>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix # variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode >>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk #0x1~1,..,0x8~4,0x10~F,0x80~A enabled #>>>(0x1BC.s+10) ubyte x \b,flags 0x%x #0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot #>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x # for older versions >>>(0x1BC.s+9) ubyte <2 #>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds >>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds # floppy A: or B: >>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x >>>>(0x1BC.s+13) ubyte >1 # 1st hard disc #>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x # not 1st hard disc >>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x # for version >= 2 maximal timeout can be 65534 >>>(0x1BC.s+9) ubyte >1 #>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds >>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds # floppy A: or B: >>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x >>>>(0x1BC.s+14) ubyte >1 # 1st hard disc #>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x # not 1st hard disc >>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x >>>0 ubyte x \b) a997 162 # DOS x86 sector updated and separated from "x86 boot sector" by Joerg Jenderek at May 2011 # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 # over BIOS parameter block (BPB) # http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD # older drives may use Near JuMP instruction E9 xx xx # minimal short forward jump found 0x29 for bootloaders or 0x0 # maximal short forward jump is 0x7f # OEM-ID is empty or contain readable bytes 0 ulelong&0x804000E9 0x000000E9 # mtools-3.9.8/msdos.h # usual values are marked with comments to get only informations of strange FAT systems # valid sectorsize must be a power of 2 from 32 to 32768 >11 uleshort&0xf001f 0 >>11 uleshort <32769 >>>11 uleshort >31 >>>>21 ubyte&0xf0 0xF0 >>>>>0 ubyte 0xEB >>>>>>1 ubyte x \b, code offset 0x%x+2 >>>>>0 ubyte 0xE9 >>>>>>1 uleshort x \b, code offset 0x%x+2 >>>>>3 string >\0 \b, OEM-ID "%-.8s" #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC >>>>>>8 string IHC \b cached by Windows 9M >>>>>11 uleshort >512 \b, Bytes/sector %u #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) >>>>>11 uleshort <512 \b, Bytes/sector %u >>>>>13 ubyte >1 \b, sectors/cluster %u #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) >>>>>82 string FAT32 >>>>>>14 uleshort !32 \b, reserved sectors %u #>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) >>>>>82 string !FAT32 >>>>>>14 uleshort >1 \b, reserved sectors %u #>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) #>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) >>>>>16 ubyte >2 \b, FATs %u #>>>>>16 ubyte =2 \b, FATs %u (usual) >>>>>16 ubyte =1 \b, FAT %u >>>>>16 ubyte >0 >>>>>17 uleshort >0 \b, root entries %u #>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) #>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x >>>>>22 uleshort >0 \b, sectors/FAT %u #>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) >>>>>24 uleshort x \b, sectors/track %u >>>>>26 ubyte >2 \b, heads %u #>>>>>26 ubyte =2 \b, heads %u (usual floppy) >>>>>26 ubyte =1 \b, heads %u # valid only for sector sizes with more then 32 Bytes >>>>>11 uleshort >32 # skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk >>>>>>38 ubyte !0x70 >>>>>>>28 ulelong >0 \b, hidden sectors %u #>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) #>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) # FAT<32 bit specific >>>>>>>82 string !FAT32 #>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) #>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) >>>>>>>>36 ubyte !0x80 >>>>>>>>>36 ubyte !0 \b, physical drive 0x%x >>>>>>>>37 ubyte >0 \b, reserved 0x%x #>>>>>>>>37 ubyte =0 \b, reserved 0x%x # value is 0x80 for NTFS >>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>>>38 ubyte =0x29 >>>>>>>>>39 ulelong x \b, serial number 0x%x >>>>>>>>>43 string >>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" >>>>>>>>>43 string =NO\ NAME \b, unlabeled # there exist some old floppies without word FAT at offset 54 # a word like "FATnm " is only a hint for a FAT size on nm-bits # Normally the number of clusters is calculated by the values of BPP. # if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, # otherwise FAT is 16 bit. # http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html >>>>>>54 string FAT \b, FAT >>>>>>>54 string FAT12 \b (12 bit) >>>>>>>54 string FAT16 \b (16 bit) # FAT32 bit specific >>>>>82 string FAT32 \b, FAT (32 bit) >>>>>>36 ulelong x \b, sectors/FAT %u # http://technet.microsoft.com/en-us/library/cc977221.aspx >>>>>>40 uleshort >0 \b, extension flags 0x%x #>>>>>>40 uleshort =0 \b, extension flags %u >>>>>>42 uleshort >0 \b, fsVersion %u #>>>>>>42 uleshort =0 \b, fsVersion %u (usual) >>>>>>44 ulelong >2 \b, rootdir cluster %u #>>>>>>44 ulelong =2 \b, rootdir cluster %u #>>>>>>44 ulelong =1 \b, rootdir cluster %u >>>>>>48 uleshort >1 \b, infoSector %u #>>>>>>48 uleshort =1 \b, infoSector %u (usual) >>>>>>48 uleshort <1 \b, infoSector %u >>>>>>50 uleshort >6 \b, Backup boot sector %u #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) >>>>>>50 uleshort <6 \b, Backup boot sector %u # corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO >>>>>>52 ulelong >0 \b, reserved1 0x%x >>>>>>56 ulelong >0 \b, reserved2 0x%x >>>>>>60 ulelong >0 \b, reserved3 0x%x # same structure as FAT1X #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) >>>>>>64 ubyte !0x80 >>>>>>>64 ubyte >0 \b, physical drive 0x%x # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too >>>>>>65 ubyte >0 \b, reserved 0x%x >>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>66 ubyte =0x29 >>>>>>>67 ulelong x \b, serial number 0x%x >>>>>>>71 string >>>>>>71 string >NO\ NAME \b, label: "%11.11s" >>>>>>>71 string =NO\ NAME \b, unlabeled # additional tests for floppy image added by Joerg Jenderek # no fixed disk >>>>>21 ubyte !0xF8 # floppy media with 12 bit FAT >>>>>>54 string !FAT16 # test for FAT after bootsector >>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT # floppy image !:mime application/x-ima # NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm # and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html # 0 FATs >>>>>16 ubyte =0 # 0 root entries >>>>>>17 uleshort =0 # 0 DOS sectors >>>>>>>19 uleshort =0 # 0 sectors/FAT # dos < 4.0 BootSector value found is 0x80 #38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) >>>>>>>>22 uleshort =0 \b; NTFS >>>>>>>>>24 uleshort >0 \b, sectors/track %u >>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x >>>>>>>>>40 ulequad >0 \b, sectors %lld >>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld >>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld # Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. # Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. >>>>>>>>>64 lelong <256 >>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi) # Values 0 to 127 represent index block sizes of 0 to 127 clusters. # Values 128 to 255 represent index block sizes of 2^(256-N) byte >>>>>>>>>68 ulelong <256 >>>>>>>>>>68 ulelong <128 \b, clusters/index block %d #>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi) >>>>>>>>>72 ulequad x \b, serial number 0%llx >>>>>>>>>80 ulelong >0 \b, checksum 0x%x #>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) >>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 >>>>>>>>>>&-92 indirect x \b; contains ### DOS boot sector end a1159 37 # Minix filesystems - Juan Cespedes 0x410 leshort 0x137f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x137f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x138f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x138f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2468 >0x402 beshort < 100 Minix filesystem, V2, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x2468 >0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2478 >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2478 >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x2478 >0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x4d5a >0x402 beshort !0 Minix filesystem, V3, %d zones >0x1e string minix \b, bootable d1246 1 a1246 1 >32808 string/T >\0 '%s' a1571 23 # LFS 0 lelong 0x070162 LFS filesystem image >4 lelong 1 version 1, >>8 lelong x \b blocks %u, >>12 lelong x \b blocks per segment %u, >4 lelong 2 version 2, >>8 lelong x \b fragments %u, >>12 lelong x \b bytes per segment %u, >16 lelong x \b disk blocks %u, >20 lelong x \b block size %u, >24 lelong x \b fragment size %u, >28 lelong x \b fragments per block %u, >32 lelong x \b start for free list %u, >36 lelong x \b number of free blocks %d, >40 lelong x \b number of files %u, >44 lelong x \b blocks available for writing %d, >48 lelong x \b inodes in cache %d, >52 lelong x \b inode file disk address 0x%x, >56 lelong x \b inode file inode number %u, >60 lelong x \b address of last segment written 0x%x, >64 lelong x \b address of next segment to write 0x%x, >68 lelong x \b address of current segment written 0x%x @ 1.4.4.2 log @sync with head. for a reference, the tree before this commit was tagged as yamt-pagecache-tag8. this commit was splitted into small chunks to avoid a limitation of cvs. ("Protocol error: too many arguments") @ text @d1 1 d3 1 a3 1 # $File: filesystems,v 1.85 2013/11/19 23:54:05 christos Exp $ a5 182 0 name partid >0 ubyte 0x00 Unused >0 ubyte 0x01 12-bit FAT >0 ubyte 0x02 XENIX / >0 ubyte 0x03 XENIX /usr >0 ubyte 0x04 16-bit FAT, less than 32M >0 ubyte 0x05 extended partition >0 ubyte 0x06 16-bit FAT, more than 32M >0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX >0 ubyte 0x08 AIX or os, or etc. >0 ubyte 0x09 AIX boot partition or Coherent >0 ubyte 0x0a O/2 boot manager or Coherent swap >0 ubyte 0x0b 32-bit FAT >0 ubyte 0x0c 32-bit FAT, LBA-mapped >0 ubyte 0x0d 7XXX, LBA-mapped >0 ubyte 0x0e 16-bit FAT, LBA-mapped >0 ubyte 0x0f extended partition, LBA-mapped >0 ubyte 0x10 OPUS >0 ubyte 0x11 OS/2 DOS 12-bit FAT >0 ubyte 0x12 Compaq diagnostics >0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M >0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M >0 ubyte 0x17 OS/2 hidden IFS >0 ubyte 0x18 AST Windows swapfile >0 ubyte 0x19 Willowtech Photon coS >0 ubyte 0x1b hidden win95 fat 32 >0 ubyte 0x1c hidden win95 fat 32 lba >0 ubyte 0x1d hidden win95 fat 16 lba >0 ubyte 0x20 Willowsoft OFS1 >0 ubyte 0x21 reserved >0 ubyte 0x23 reserved >0 ubyte 0x24 NEC DOS >0 ubyte 0x26 reserved >0 ubyte 0x31 reserved >0 ubyte 0x32 Alien Internet Services NOS >0 ubyte 0x33 reserved >0 ubyte 0x34 reserved >0 ubyte 0x35 JFS on OS2 >0 ubyte 0x36 reserved >0 ubyte 0x38 Theos >0 ubyte 0x39 Plan 9, or Theos spanned >0 ubyte 0x3a Theos ver 4 4gb partition >0 ubyte 0x3b Theos ve 4 extended partition >0 ubyte 0x3c PartitionMagic recovery >0 ubyte 0x3d Hidden Netware >0 ubyte 0x40 VENIX 286 or LynxOS >0 ubyte 0x41 PReP >0 ubyte 0x42 linux swap sharing DRDOS disk >0 ubyte 0x43 linux sharing DRDOS disk >0 ubyte 0x44 GoBack change utility >0 ubyte 0x45 Boot US Boot manager >0 ubyte 0x46 EUMEL/Elan or Ergos 3 >0 ubyte 0x47 EUMEL/Elan or Ergos 3 >0 ubyte 0x48 EUMEL/Elan or Ergos 3 >0 ubyte 0x4a ALFX/THIN filesystem for DOS >0 ubyte 0x4c Oberon partition >0 ubyte 0x4d QNX4.x >0 ubyte 0x4e QNX4.x 2nd part >0 ubyte 0x4f QNX4.x 3rd part >0 ubyte 0x50 DM (disk manager) >0 ubyte 0x51 DM6 Aux1 (or Novell) >0 ubyte 0x52 CP/M or Microport SysV/AT >0 ubyte 0x53 DM6 Aux3 >0 ubyte 0x54 DM6 DDO >0 ubyte 0x55 EZ-Drive (disk manager) >0 ubyte 0x56 Golden Bow (disk manager) >0 ubyte 0x57 Drive PRO >0 ubyte 0x5c Priam Edisk (disk manager) >0 ubyte 0x61 SpeedStor >0 ubyte 0x63 GNU HURD or Mach or Sys V/386 >0 ubyte 0x64 Novell Netware 2.xx or Speedstore >0 ubyte 0x65 Novell Netware 3.xx >0 ubyte 0x66 Novell 386 Netware >0 ubyte 0x67 Novell >0 ubyte 0x68 Novell >0 ubyte 0x69 Novell >0 ubyte 0x70 DiskSecure Multi-Boot >0 ubyte 0x71 reserved >0 ubyte 0x73 reserved >0 ubyte 0x74 reserved >0 ubyte 0x75 PC/IX >0 ubyte 0x76 reserved >0 ubyte 0x77 M2FS/M2CS partition >0 ubyte 0x78 XOSL boot loader filesystem >0 ubyte 0x80 MINIX until 1.4a >0 ubyte 0x81 MINIX since 1.4b >0 ubyte 0x82 Linux swap or Solaris >0 ubyte 0x83 Linux native >0 ubyte 0x84 OS/2 hidden C: drive >0 ubyte 0x85 Linux extended partition >0 ubyte 0x86 NT FAT volume set >0 ubyte 0x87 NTFS volume set or HPFS mirrored >0 ubyte 0x8a Linux Kernel AiR-BOOT partition >0 ubyte 0x8b Legacy Fault tolerant FAT32 >0 ubyte 0x8c Legacy Fault tolerant FAT32 ext >0 ubyte 0x8d Hidden free FDISK FAT12 >0 ubyte 0x8e Linux Logical Volume Manager >0 ubyte 0x90 Hidden free FDISK FAT16 >0 ubyte 0x91 Hidden free FDISK DOS EXT >0 ubyte 0x92 Hidden free FDISK FAT16 Big >0 ubyte 0x93 Amoeba filesystem >0 ubyte 0x94 Amoeba bad block table >0 ubyte 0x95 MIT EXOPC native partitions >0 ubyte 0x97 Hidden free FDISK FAT32 >0 ubyte 0x98 Datalight ROM-DOS Super-Boot >0 ubyte 0x99 Mylex EISA SCSI >0 ubyte 0x9a Hidden free FDISK FAT16 LBA >0 ubyte 0x9b Hidden free FDISK EXT LBA >0 ubyte 0x9f BSDI? >0 ubyte 0xa0 IBM Thinkpad hibernation >0 ubyte 0xa1 HP Volume expansion (SpeedStor) >0 ubyte 0xa3 HP Volume expansion (SpeedStor) >0 ubyte 0xa4 HP Volume expansion (SpeedStor) >0 ubyte 0xa5 386BSD partition type >0 ubyte 0xa6 OpenBSD partition type >0 ubyte 0xa7 NeXTSTEP 486 >0 ubyte 0xa8 Apple UFS >0 ubyte 0xa9 NetBSD partition type >0 ubyte 0xaa Olivetty Fat12 1.44MB Service part >0 ubyte 0xab Apple Boot >0 ubyte 0xae SHAG OS filesystem >0 ubyte 0xaf Apple HFS >0 ubyte 0xb0 BootStar Dummy >0 ubyte 0xb1 reserved >0 ubyte 0xb3 reserved >0 ubyte 0xb4 reserved >0 ubyte 0xb6 reserved >0 ubyte 0xb7 BSDI BSD/386 filesystem >0 ubyte 0xb8 BSDI BSD/386 swap >0 ubyte 0xbb Boot Wizard Hidden >0 ubyte 0xbe Solaris 8 partition type >0 ubyte 0xbf Solaris partition type >0 ubyte 0xc0 CTOS >0 ubyte 0xc1 DRDOS/sec (FAT-12) >0 ubyte 0xc2 Hidden Linux >0 ubyte 0xc3 Hidden Linux swap >0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) >0 ubyte 0xc5 DRDOS/sec (EXT) >0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) >0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled >0 ubyte 0xc8 Reserved for DR-DOS 8.0+ >0 ubyte 0xc9 Reserved for DR-DOS 8.0+ >0 ubyte 0xca Reserved for DR-DOS 8.0+ >0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS >0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA >0 ubyte 0xcd CTOS Memdump >0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA >0 ubyte 0xcf DR-DOS 7.04+ EXT LBA >0 ubyte 0xd0 REAL/32 secure big partition >0 ubyte 0xd1 Old Multiuser DOS FAT12 >0 ubyte 0xd4 Old Multiuser DOS FAT16 Small >0 ubyte 0xd5 Old Multiuser DOS Extended >0 ubyte 0xd6 Old Multiuser DOS FAT16 Big >0 ubyte 0xd8 CP/M 86 >0 ubyte 0xdb CP/M or Concurrent CP/M >0 ubyte 0xdd Hidden CTOS Memdump >0 ubyte 0xde Dell PowerEdge Server utilities >0 ubyte 0xdf DG/UX virtual disk manager >0 ubyte 0xe0 STMicroelectronics ST AVFS >0 ubyte 0xe1 DOS access or SpeedStor 12-bit >0 ubyte 0xe3 DOS R/O or Storage Dimensions >0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. >0 ubyte 0xe5 reserved >0 ubyte 0xe6 reserved >0 ubyte 0xeb BeOS >0 ubyte 0xee GPT Protective MBR >0 ubyte 0xef EFI system partition >0 ubyte 0xf0 Linux PA-RISC boot loader >0 ubyte 0xf1 SpeedStor or Storage Dimensions >0 ubyte 0xf2 DOS 3.3+ Secondary >0 ubyte 0xf3 reserved >0 ubyte 0xf4 SpeedStor large partition >0 ubyte 0xf5 Prologue multi-volumen partition >0 ubyte 0xf6 reserved >0 ubyte 0xf9 pCache: ext2/ext3 persistent cache >0 ubyte 0xfa Bochs x86 emulator >0 ubyte 0xfb VMware File System >0 ubyte 0xfc VMware Swap >0 ubyte 0xfd Linux RAID partition persistent sb >0 ubyte 0xfe LANstep or IBM PS/2 IML >0 ubyte 0xff Xenix Bad Block Table d60 1 a60 12 # added by Joerg Jenderek at Nov 2012 # http://www.thenakedpc.com/articles/v04/08/0408-05.html # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 0 string PNCIHISK\0 Norton Utilities disc image data # real x86 boot sector with jump instruction >509 search/1026 \x55\xAA\xeb >>&-1 indirect x \b; contains # http://file-extension.net/seeker/file_extension_dat 0 string PNCIUNDO Norton Disk Doctor UnDo file # # DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011 d63 2 a64 3 # to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) # DOS BPB information (70) and after DOS floppy (120) like in previous file version !:strength +72 d67 1 a67 1 >>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector d69 2 a70 2 >0x1FE leshort 0xAA55 DOS/MBR boot sector # keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying d72 3 a74 4 0x1FE leshort 0xAA55 DOS/MBR boot sector !:strength +72 # to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version #!:strength +21 d76 2 a77 149 # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/ # and http://en.wikipedia.org/wiki/Master_Boot_Record # test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by # characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 >0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR # Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) # assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld >>8 ubequad 0x8bf45007501ffbfc # http://thestarman.pcministry.com/asm/mbr/200MBR.htm >>>0x16 ubyte 0xF3 \b,DOS 2 >>>>219 regex Author\ -\ Author: # found "David Litton" , "A Pehrsson " >>>>>&0 string x "%s" >>>0x16 ubyte 0xF2 # NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm # assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz >>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 # version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) >>>>0x22 default x \b,D0S version 3.3-7.0 # error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) # where nn is string offset varying for different languages # "Invalid partition table" nn=0x8b for english version >>>>>(0x49.b) string Invalid\ partition\ table english >>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german >>>>>(0x49.b) string Table\ de\ partition\ invalide french >>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese >>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish >>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian >>>>>0x49 ubyte >0 at offset 0x%x >>>>>>(0x49.b) string >\0 "%s" # "Error loading operating system" nn=0xa3 for english version # "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version # "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version # "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version # "Error al cargar sistema operativo" nn=0xa8 for spanish version # "Errore durante il caricamento del sistema operativo" nn=0xae for italian version >>>>>0x74 ubyte >0 at offset 0x%x >>>>>>(0x74.b) string >\0 "%s" # "Missing operating system" nn=0xc2 for english version # "Betriebssystem fehlt" nn=0xcd for german version # "Syst\212me d'exploitation absent" nn=0xd2 for french version # "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version # "Falta sistema operativo" nn=0xca for spanish version # "Sistema operativo mancante" nn=0xe2 for italian version >>>>>0x79 ubyte >0 at offset 0x%x >>>>>>(0x79.b) string >\0 "%s" # Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) # assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b >>8 ubequad 0x5007501ffcbe1b7c # assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 >>>24 ubequad 0xf3a4cbbebe07b104 9M # "Invalid partition table" nn=0x10F for english version # "Ungültige Partitionstabelle" nn=0x10F for german version # "Table de partition erronée" nn=0x10F for french version # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version >>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english >>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german >>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french >>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian >>>>0x3C ubyte x at offset 0x%x+0xFF >>>>(0x3C.b+0x0FF) string >\0 "%s" # "Error loading operating system" nn=0x127 for english version # "Fehler beim Laden des Betriebssystems" nn=0x12b for german version # "Erreur lors du chargement du système d'exploitation" nn=0x12a for french version # "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version >>>>0xBD ubyte x at offset 0x1%x >>>>(0xBD.b+0x100) string >\0 "%s" # "Missing operating system" nn=0x146 for english version # "Betriebssystem fehlt" nn=0x151 for german version # "Système d'exploitation manquant" nn=0x15e for french version # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version >>>>0xA9 ubyte x at offset 0x1%x >>>>(0xA9.b+0x100) string >\0 "%s" # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm # assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 >>>24 ubequad 0xf3a4cbbdbe07b104 XP # where xxyyzz are lower bits from offsets of error messages varying for different languages >>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english >>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german # "Invalid partition table" xx=0x12C for english version # "Ungültige Partitionstabelle" xx=0x12C for german version >>>>0x1b5 ubyte >0 at offset 0x1%x >>>>(0x1b5.b+0x100) string >\0 "%s" # "Error loading operating system" yy=0x144 for english version # "Fehler beim Laden des Betriebssystems" yy=0x148 for german version >>>>0x1b6 ubyte >0 at offset 0x1%x >>>>(0x1b6.b+0x100) string >\0 "%s" # "Missing operating system" zz=0x163 for english version # "Betriebssystem nicht vorhanden" zz=0x16e for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" # Microsoft Windows Vista or 7 # assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 >>8 ubequad 0xc08ed8be007cbf00 # Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) # assembler instructions: jnz 0729;cmp ebx,"TCPA" >>>0xEC ubequad 0x753b6681fb544350 Vista # where xxyyzz are lower bits from offsets of error messages varying for different languages >>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english #>>>>0x1B4 ubelong&0x00FFFFFF ? german # "Invalid partition table" xx=0x162 for english version # "Ungültige Partitionstabelle" xx=0x1?? for german version >>>>0x1b5 ubyte >0 at offset 0x1%x >>>>(0x1b5.b+0x100) string >\0 "%s" # "Error loading operating system" yy=0x17a for english version # "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version >>>>0x1b6 ubyte >0 at offset 0x1%x >>>>(0x1b6.b+0x100) string >\0 "%s" # "Missing operating system" zz=0x199 for english version # "Betriebssystem nicht vorhanden" zz=0x1?? for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" # Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm) # assembler instructions: cmp ebx,"TCPA";cmp >>>0xEC ubequad 0x6681fb5443504175 Windows 7 # where xxyyzz are lower bits from offsets of error messages varying for different languages >>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english #>>>>0x1B4 ubelong&0x00FFFFFF ? german # "Invalid partition table" xx=0x163 for english version # "Ungültige Partitionstabelle" xx=0x1?? for german version >>>>0x1b5 ubyte >0 at offset 0x1%x >>>>(0x1b5.b+0x100) string >\0 "%s" # "Error loading operating system" yy=0x17b for english version # "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version >>>>0x1b6 ubyte >0 at offset 0x1%x >>>>(0x1b6.b+0x100) string >\0 "%s" # "Missing operating system" zz=0x19a for english version # "Betriebssystem nicht vorhanden" zz=0x1?? for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs # http://en.wikipedia.org/wiki/MBR_disk_signature#ID >>0x1b8 ulelong >0 \b, disk signature 0x%-.4x # driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm >>0xDA uleshort 0 >>>0xDC ulelong >0 \b, created # physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive >>>>0xDC ubyte x with driveID 0x%x # hours, minutes and seconds >>>>0xDf ubyte x at %x >>>>0xDe ubyte x \b:%x >>>>0xDd ubyte x \b:%x # special case for Microsoft MS-DOS 3.21 spanish # assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov >0 ubequad 0xfab830008ed0bc00 # assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov >>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish # Microsoft MBR IPL end d96 24 a119 3 # # tests for different MS-DOS Master Boot Records (MBR) moved and merged # d212 54 a265 31 # mbr partition table entries updated by Joerg Jenderek at Sep 2013 # skip Norton Utilities disc image data >3 string !IHISK # skip Linux style boot sector starting with assember instructions mov 0x7c0,ax; >>0 belong !0xb8c0078e # not Linux kernel >>>514 string !HdrS # not BeOS >>>>422 string !Be\ Boot\ Loader # jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr >>>>>0 ubelong&0xFD000000 =0xE9000000 # AdvanceMAME mbr >>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e >>>>>>>446 use partition-table # mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader >>>>>0 ubelong&0xFD000000 !0xE9000000 # skip FSInfosector >>>>>>0 string !RRaA # skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, # http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm >>>>>>>0 ubequad !0xfa660fb64610668b # skip 13rd sector of MS x86 bootloader >>>>>>>>0 ubequad !0x660fb64610668b4e # skip sector starting with DOS new line >>>>>>>>>0 string !\r\n # allowed active flag 0,80h-FFh >>>>>>>>>>446 ubyte 0 >>>>>>>>>>>446 use partition-table >>>>>>>>>>446 ubyte >0x7F >>>>>>>>>>>446 use partition-table # TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries d293 1 a293 1 # skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut d790 10 a799 44 # by Joerg Jenderek at Apr 2013 # Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension # like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 0 name DOS-filename # space=0x20 (00100000b) means empty >0 ubyte&0xDF >0 >>0 ubyte x \b%c >>>1 ubyte&0xDF >0 >>>>1 ubyte x \b%c >>>>>2 ubyte&0xDF >0 >>>>>>2 ubyte x \b%c >>>>>>>3 ubyte&0xDF >0 >>>>>>>>3 ubyte x \b%c >>>>>>>>>4 ubyte&0xDF >0 >>>>>>>>>>4 ubyte x \b%c >>>>>>>>>>>5 ubyte&0xDF >0 >>>>>>>>>>>>5 ubyte x \b%c >>>>>>>>>>>>>6 ubyte&0xDF >0 >>>>>>>>>>>>>>6 ubyte x \b%c >>>>>>>>>>>>>>>7 ubyte&0xDF >0 >>>>>>>>>>>>>>>>7 ubyte x \b%c # DOS filename extension >>8 ubyte&0xDF >0 \b. >>>8 ubyte x \b%c >>>>9 ubyte&0xDF >0 >>>>>9 ubyte x \b%c >>>>>>10 ubyte&0xDF >0 >>>>>>>10 ubyte x \b%c # Print 2 following DOS filenames from directory entry form # like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 0 name 2xDOS-filename # display 1 space >0 ubyte x \b >0 use DOS-filename >11 ubyte x \b+ >11 use DOS-filename # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO # and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector >0 string RRaA >>0x1E4 string rrAa \b, FSInfosector #>>0x1FC uleshort =0 SHOULD BE ZERO >>>0x1E8 ulelong <0xffffffff \b, %u free clusters >>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u d816 1 a816 1 # DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 a818 50 # http://en.wikipedia.org/wiki/Master_boot_record#PTE # display standard partition table 0 name partition-table #>0 ubyte x PARTITION-TABLE # test and display 1st til 4th partition table entry >0 use partition-entry-test >16 use partition-entry-test >32 use partition-entry-test >48 use partition-entry-test # test for entry of partition table 0 name partition-entry-test # partition type ID > 0 >4 ubyte >0 # active flag 0 >>0 ubyte 0 >>>0 use partition-entry # active flag 0x80, 0x81, ... >>0 ubyte >0x7F >>>0 use partition-entry # Print entry of partition table 0 name partition-entry # partition type ID > 0 >4 ubyte >0 \b; partition >>64 leshort 0xAA55 1 >>48 leshort 0xAA55 2 >>32 leshort 0xAA55 3 >>16 leshort 0xAA55 4 >>4 ubyte x : ID=0x%x >>0 ubyte&0x80 0x80 \b, active >>0 ubyte >0x80 0x%x >>1 ubyte x \b, start-CHS ( >>1 use partition-chs >>5 ubyte x \b), end-CHS ( >>5 use partition-chs >>8 ulelong x \b), startsector %u >>12 ulelong x \b, %u sectors # Print cylinder,head,sector (CHS) of partition entry 0 name partition-chs # cylinder >1 ubyte x \b0x >1 ubyte&0xC0 0x40 \b1 >1 ubyte&0xC0 0x80 \b2 >1 ubyte&0xC0 0xC0 \b3 >2 ubyte x \b%x # head >0 ubyte x \b,%u # sector >1 ubyte&0x3F x \b,%u d855 1 a855 1 # syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 d865 1 a865 1 # SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 a867 2 # to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) !:strength +36 d1027 1 a1027 1 # DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 d1187 1 a1187 11 # For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 # http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm # unused assembler instructions JMP y2;NOP;NOP 0x056 ulelong&0xFFFF0FFF 0x909002EB # unicode loadername terminated by CTRL-D >(0.s*2) ulelong&0xFFFFFF00 0x00040000 # loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR >>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s >>0x12 string $ >>>0x0c lestring16 x \b%-2.2s ### DOS,NTFS boot sectors end d1354 1 a1354 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1, %d zones d1358 1 a1358 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones d1362 1 a1362 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones d1366 1 a1366 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones d1369 1 a1369 2 >0x402 beshort < 100 >>0x402 beshort > -1 Minix filesystem, V2, %d zones d1372 1 a1372 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones d1376 1 a1376 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones d1379 1 a1379 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones d1401 2 a1402 4 # http://en.wikipedia.org/wiki/BIOS_parameter_block # floppies with valid BPB and any instruction at beginning >19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy >19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy d1406 4 a1409 4 19 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector d1411 6 a1416 1 >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector d1418 2 a1419 13 19 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 19 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k # | | | | | # | | | | heads # | | | sectors/track # | | sectors/FAT # | media descriptor # BPB: sectors d1457 2 a1458 2 # 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 # 11110000 High density 3 1/2 floppy disk a1461 73 # all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 # http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions 512 ubelong&0xE0ffff00 0xE0ffff00 # without valid Media descriptor in place of BPB, cases with are done at other places >21 ubyte <0xE5 floppy with old FAT filesystem # but valid Media descriptor at begin of FAT #>>512 ubyte =0xed 720k #>>512 ubyte =0xf0 1440k #>>512 ubyte =0xf8 720k #>>512 ubyte =0xf9 1220k #>>512 ubyte =0xfa 320k #>>512 ubyte =0xfb 640k >>512 ubyte =0xfc 180k # look like an an old DOS directory entry >>>0xA0E ubequad 0 >>>>0xA00 ubequad !0 !:mime application/x-ima >>512 ubyte =0xfd # look for 2nd FAT at different location to distinguish between 360k and 500k >>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k #>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k >>>0xA0E ubequad 0 !:mime application/x-ima >>512 ubyte =0xfe >>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k >>>>0x60E ubequad 0 >>>>>0x600 ubequad !0 !:mime application/x-ima #>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k >>512 ubyte =0xff 320k >>>0x60E ubequad 0 >>>>0x600 ubequad !0 !:mime application/x-ima >>512 ubyte x \b, Media descriptor 0x%x # without x86 jump instruction >>0 ulelong&0x804000E9 !0x000000E9 # assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV >>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader # IOSYS.COM+MSDOS.COM >>>>0xc4 use 2xDOS-filename >>0 ulelong&0x804000E9 =0x000000E9 # only x86 short jump instruction found >>>0 ubyte =0xEB >>>>1 ubyte x \b, code offset 0x%x+2 # http://thestarman.pcministry.com/DOS/ibm100/Boot.htm # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 >>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader # ibmbio.com+ibmdos.com >>>>>0x176 use DOS-filename >>>>>0x181 ubyte x \b+ >>>>>0x182 use DOS-filename # http://thestarman.pcministry.com/DOS/ibm110/Boot.htm # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV >>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader # ibmbio.com+ibmdos.com >>>>>0x18b use DOS-filename >>>>>0x196 ubyte x \b+ >>>>>0x197 use DOS-filename # http://en.wikipedia.org/wiki/Zenith_Data_Systems # assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 >>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader # IO.SYS+MSDOS.SYS >>>>>0x20 use 2xDOS-filename # http://en.wikipedia.org/wiki/Corona_Data_Systems # assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; >>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader # IO.SYS+MSDOS.SYS >>>>>0x69 use 2xDOS-filename # assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; >>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader # defect IO.SYS+MSDOS.SYS ? #>>>>>0x162 use 2xDOS-filename d1478 1 a1478 1 32777 string CDROM High Sierra CD-ROM filesystem data d1645 2 a1822 24 0 string td\000 floppy image data (TeleDisk, compressed) 0 string TD\000 floppy image data (TeleDisk) 0 string CQ\024 floppy image data (CopyQM, >16 leshort x %d sectors, >18 leshort x %d heads.) 0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 0 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 0 beshort 0xAA59 floppy image data (IBM SaveDskF) 0 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) 0 string \074CPM_Disk\076 disk image data (YAZE) # ReFS # Richard W.M. Jones 0 string \0\0\0ReFS\0 ReFS filesystem image # EFW encase image file format: # Gregoire Passault # http://www.forensicswiki.org/wiki/Encase_image_file_format 0 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format @ 1.3 log @Fix typo in comments, no code change. @ text @d3 1 d886 34 a919 3 0x410 leshort 0x137f Minix filesystem 0x410 beshort 0x137f Minix filesystem (big endian) >0x402 beshort !0 \b, %d zones a920 3 0x410 leshort 0x138f Minix filesystem, 30 char names 0x410 leshort 0x2468 Minix filesystem, version 2 0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names d1116 2 d1133 8 a1140 1 >>0x460 lelong >0x000003f ext4 filesystem data d1142 2 a1143 2 >0x460 lelong &0x0000004 (needs journal recovery) >0x43a leshort &0x0000002 (errors) d1145 7 a1151 7 >0x460 lelong &0x0000001 (compressed) #>0x460 lelong &0x0000002 (filetype) #>0x460 lelong &0x0000010 (meta bg) >0x460 lelong &0x0000040 (extents) >0x460 lelong &0x0000080 (64bit) #>0x460 lelong &0x0000100 (mmp) #>0x460 lelong &0x0000200 (flex bg) d1153 6 a1158 6 #>0x464 lelong &0x0000001 (sparse super) >0x464 lelong &0x0000002 (large files) >0x464 lelong &0x0000008 (huge files) #>0x464 lelong &0x0000010 (gdt checksum) #>0x464 lelong &0x0000020 (many subdirs) #>0x463 lelong &0x0000040 (extra isize) d1236 1 a1236 1 32769 string CD001 d1279 1 d1300 64 a1363 5 # u-boot/PPCBoot image file # From: Mark Brown 0 belong 0x27051956 u-boot/PPCBoot image >4 string PPCBoot >>12 string x version %s d1376 4 a1379 1 >>63 bequad x %lld bytes, d1385 8 a1392 2 >>51 belong x blocksize: %d bytes, >39 bedate x created: %s d1399 4 a1402 1 >>63 lequad x %lld bytes, d1408 8 a1415 2 >>51 lelong x blocksize: %d bytes, >39 ledate x created: %s d1434 4 d1482 3 a1484 3 # Files-11 On-Disk Structure (OpenVMS file system) - gerardo.cacciari@@gmail.com # These bits come from LBN 1 (home block) of ODS-2 and ODS-5 volumes, which is # mapped to VBN 2 of [000000]INDEXF.SYS;1 d1486 1 a1486 1 1008 string DECFILE11B Files-11 On-Disk Structure d1488 5 a1492 1 >525 byte x (ODS-%d OpenVMS file system), d1507 7 a1513 3 0x10000 belong 0x01161970 GFS2 Filesystem >0x10024 belong x (blocksize %d, >0x10060 string >\0 lockproto %s) d1526 46 @ 1.2 log @apply our local patches @ text @d205 1 a205 1 # mbr partion table entries d259 1 a259 1 # mbr partion table entries end @ 1.2.2.1 log @file filesystems was added on branch jym-xensuspend on 2009-05-13 18:51:55 +0000 @ text @d1 1397 @ 1.2.2.2 log @Sync with HEAD. Second commit. See http://mail-index.netbsd.org/source-changes/2009/05/13/msg221222.html @ text @a0 1397 #------------------------------------------------------------------------------ # filesystems: file(1) magic for different filesystems # 0 string \366\366\366\366 PC formatted floppy with no filesystem # Sun disk labels # From /usr/include/sun/dklabel.h: 0774 beshort 0xdabe # modified by Joerg Jenderek, because original test # succeeds for Cabinet archive dao360.dl_ with negative blocks >0770 long >0 Sun disk label >>0 string x '%s >>>31 string >\0 \b%s >>>>63 string >\0 \b%s >>>>>95 string >\0 \b%s >>0 string x \b' >>0734 short >0 %d rpm, >>0736 short >0 %d phys cys, >>0740 short >0 %d alts/cyl, >>0746 short >0 %d interleave, >>0750 short >0 %d data cyls, >>0752 short >0 %d alt cyls, >>0754 short >0 %d heads/partition, >>0756 short >0 %d sectors/track, >>0764 long >0 start cyl %ld, >>0770 long x %ld blocks # Is there a boot block written 1 sector in? >512 belong&077777777 0600407 \b, boot block present # Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc # (http://btmgr.sourceforge.net/docs/user-guide-3.html) 0 string SBMBAKUP_ Smart Boot Manager backup file >9 string x \b, version %-5.5s >>14 string =_ >>>15 string x %-.1s >>>>16 string =_ \b. >>>>>17 string x \b%-.1s >>>>>>18 string =_ \b. >>>>>>>19 string x \b%-.1s >>>22 ubyte 0 >>>>21 ubyte x \b, from drive 0x%x >>>22 ubyte >0 >>>>21 string x \b, from drive %s # Joerg Jenderek # DOS Emulator image is 128 byte, null right padded header + harddisc image 0 string DOSEMU\0 >0x27E leshort 0xAA55 #offset is 128 >>19 ubyte 128 >>>(19.b-1) ubyte 0x0 DOS Emulator image >>>>7 ulelong >0 \b, %u heads >>>>11 ulelong >0 \b, %d sectors/track >>>>15 ulelong >0 \b, %d cylinders # updated by Joerg Jenderek at Sep 2007 # only for sector sizes with 512 or more Bytes 0x1FE leshort 0xAA55 x86 boot sector # to do also for sectors < than 512 Bytes and some other files, GRR #30 search/481 \x55\xAA x86 boot sector # not for BeOS floppy 1440k, MBRs #(11.s-2) uleshort 0xAA55 x86 boot sector >2 string OSBS \b, OS/BS MBR # J\xf6rg Jenderek >0x8C string Invalid\ partition\ table \b, MS-DOS MBR # dr-dos with some upper-, lowercase variants >0x9D string Invalid\ partition\ table$ >>181 string No\ Operating\ System$ >>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 >0x9D string Invalid\ partition\ table$ >>181 string No\ operating\ system$ >>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 >342 string Invalid\ partition\ table$ >>366 string No\ operating\ system$ >>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 >295 string NEWLDR\0 >>302 string Bad\ PT\ $ >>>310 string No\ OS\ $ >>>>317 string OS\ load\ err$ >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ >>>>>>>387 string Copyright\ (c)\ 1984,1998 >>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) >0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222 >>0x1B8 ubelong >0 \b, Serial 0x%-.4x >0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950 >271 string Invalid\ partition\ table\0 >>295 string Error\ loading\ operating\ system\0 >>>326 string Missing\ operating\ system\0 \b, mbr # >139 string Invalid\ partition\ table\0 >>163 string Error\ loading\ operating\ system\0 >>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr # http://www.heise.de/ct/05/09/006/ page 184 #HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes >>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x >300 string Invalid\ partition\ table\0 >>324 string Error\ loading\ operating\ system\0 >>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR #??>>>389 string Invalid\ system\ disk >>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x >300 string Ung\201ltige\ Partitionstabelle #split string to avoid error: String too long >>328 string Fehler\ beim\ Laden\ >>>346 string des\ Betriebssystems >>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german) >>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x #>0x145 string Default:\ F \b, FREE-DOS MBR #>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR >0x145 search/7 Default:\ F \b, FREE-DOS MBR #>>313 string F0\ .\ .\ . #>>>322 string disk\ 1 #>>>>382 string FAT3 >64 string no\ active\ partition\ found >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR # Ranish Partition Manager http://www.ranish.com/part/ >387 search/4 \0\ Error!\r >>378 search/7 Virus! >>>397 search/4 Booting\ >>>>408 search/4 HD1/\0 \b, Ranish MBR ( >>>>>416 string Writing\ changes... \b2.37 >>>>>>438 ubyte x \b,0x%x dots >>>>>>440 ubyte >0 \b,virus check >>>>>>441 ubyte >0 \b,partition %c #2.38,2.42,2.44 >>>>>416 string !Writing\ changes... \b >>>>>>418 ubyte 1 \bvirus check, >>>>>>419 ubyte x \b0x%x seconds >>>>>>420 ubyte&0x0F >0 \b,partition >>>>>>>420 ubyte&0x0F <5 \b %x >>>>>>>420 ubyte&0x0F 0Xf \b ask >>>>>420 ubyte x \b) # >271 string Operating\ system\ loading >>296 string error\r \b, SYSLINUX MBR (2.10) # http://www.acronis.de/ >362 string MBR\ Error\ \0\r >>376 string ress\ any\ key\ to\ >>>392 string boot\ from\ floppy...\0 \b, Acronis MBR # added by Joerg Jenderek # http://www.visopsys.org/ # http://partitionlogic.org.uk/ >309 string No\ bootable\ partition\ found\r >>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR >349 string No\ bootable\ partition\ found\r >>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR # bootloader, bootmanager >0x40 string SBML # label with 11 characters of FAT 12 bit filesystem >>43 string SMART\ BTMGR >>>430 string SBMK\ Bad!\r \b, Smart Boot Manager # OEM-ID not always "SBM" #>>>>3 strings SBM >>>>6 string >\0 \b, version %s >382 string XOSLLOADXCF \b, eXtended Operating System Loader >6 string LILO \b, LInux i386 boot LOader >>120 string LILO \b, version 22.3.4 SuSe >>172 string LILO \b, version 22.5.8 Debian # updated by Joerg Jenderek at Oct 2008 # variables according to grub-0.97/stage1/stage1.S or # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data # usual values are marked with comments to get only informations of strange GRUB loaders >342 search/60 \0Geom\0 #>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 >>0x41 ubyte <2 >>>0x3E ubyte >2 \b; GRand Unified Bootloader # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 >>>>0x3E ubyte x \b, stage1 version 0x%x #If it is 0xFF, use a drive passed by BIOS >>>>0x40 ubyte <0xFF \b, boot drive 0x%x # in most case 0,1,0x2e for GRUB 0.5.95 >>>>0x41 ubyte >0 \b, LBA flag 0x%x >>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x #>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) >>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x #>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) >>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x >>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x #>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) >>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x >>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>>>>394 string stage1 \b, GRUB version 0.5.95 >>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 >>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>>>>377 string GRUB\ \0 \b, GRUB version 0.94 >>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 >>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>>>>385 string GRUB\ \0 \b, GRUB version 0.97 #unkown version >>>343 string Geom\0Read\0\ Error\0 >>>>321 string Loading\ stage1.5 \b, GRUB version x.y >>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>>>374 string GRUB\ \0 \b, GRUB version n.m # http://syslinux.zytor.com/ >478 string Boot\ failed\r >>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62) >480 string Boot\ failed\r >>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11) >484 string Boot\ error\r \b, SYSLINUX bootloader (3.11) >395 string chksum\0\ ERROR!\0 \b, Gujin bootloader # http://www.bcdwb.de/bcdw/index_e.htm >3 string BCDL >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) # mbr partion table entries # OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs >3 string !MS >>3 string !SYSLINUX >>>3 string !MTOOL >>>>3 string !NEWLDR >>>>>5 string !DOS # not FAT (32 bit) >>>>>>82 string !FAT32 #not Linux kernel >>>>>>>514 string !HdrS #not BeOS >>>>>>>>422 string !Be\ Boot\ Loader # active flag 0 or 0x80 and type > 0 >>>>>>>>>446 ubyte <0x81 >>>>>>>>>>446 ubyte&0x7F 0 >>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x >>>>>>>>>>>>446 ubyte 0x80 \b, active >>>>>>>>>>>>447 ubyte x \b, starthead %u #>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x #>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d >>>>>>>>>>>>454 ulelong x \b, startsector %u >>>>>>>>>>>>458 ulelong x \b, %u sectors # >>>>>>>>>462 ubyte <0x81 >>>>>>>>>>462 ubyte&0x7F 0 >>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x >>>>>>>>>>>>462 ubyte 0x80 \b, active >>>>>>>>>>>>463 ubyte x \b, starthead %u #>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x #>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d >>>>>>>>>>>>470 ulelong x \b, startsector %u >>>>>>>>>>>>474 ulelong x \b, %u sectors # >>>>>>>>>478 ubyte <0x81 >>>>>>>>>>478 ubyte&0x7F 0 >>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x >>>>>>>>>>>>478 ubyte 0x80 \b, active >>>>>>>>>>>>479 ubyte x \b, starthead %u #>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x #>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x #>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d >>>>>>>>>>>>486 ulelong x \b, startsector %u >>>>>>>>>>>>490 ulelong x \b, %u sectors # >>>>>>>>>494 ubyte <0x81 >>>>>>>>>>494 ubyte&0x7F 0 >>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x >>>>>>>>>>>>494 ubyte 0x80 \b, active >>>>>>>>>>>>495 ubyte x \b, starthead %u #>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x #>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d >>>>>>>>>>>>502 ulelong x \b, startsector %u >>>>>>>>>>>>506 ulelong x \b, %u sectors # mbr partion table entries end # http://www.acronis.de/ #FAT label=ACRONIS\ SZ #OEM-ID=BOOTWIZ0 >442 string Non-system\ disk,\ >>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader # DOS names like F11.SYS are 8 right space padded bytes+3 bytes >>>477 ubyte&0xDF >0 >>>>477 string x \b %-.3s >>>>>480 ubyte&0xDF >0 >>>>>>480 string x \b%-.5s >>>>485 ubyte&0xDF >0 >>>>>485 string x \b.%-.3s # >185 string FDBOOT\ Version\ >>204 string \rNo\ Systemdisk.\ >>>220 string Booting\ from\ harddisk.\n\r >>>245 string Cannot\ load\ from\ harddisk.\n\r >>>>273 string Insert\ Systemdisk\ >>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader >>>>>>200 string >\0 \b, version %-3s >242 string Bootsector\ from\ C.H.\ Hochst\204 >>278 string No\ Systemdisk.\ >>>293 string Booting\ from\ harddisk.\n\r >>>441 string Cannot\ load\ from\ harddisk.\n\r >>>>469 string Insert\ Systemdisk\ >>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader >>>>>>209 string >\0 \b, version %-4.4s >(1.b+2) ubyte 0xe >>(1.b+3) ubyte 0x1f >>>(1.b+4) ubyte 0xbe >>>>(1.b+5) ubyte 0x77 >>>>(1.b+6) ubyte 0x7c >>>>>(1.b+7) ubyte 0xac >>>>>>(1.b+8) ubyte 0x22 >>>>>>>(1.b+9) ubyte 0xc0 >>>>>>>>(1.b+10) ubyte 0x74 >>>>>>>>>(1.b+11) ubyte 0xb >>>>>>>>>>(1.b+12) ubyte 0x56 >>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display >214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display #>>244 string from\ dosemu-freedos-*-bin.tgz\r #>>>170 string Sorry,\ could\ not\ load\ an\ #>>>>195 string operating\ system.\r\n # >103 string This\ is\ not\ a\ bootable\ disk.\ >>132 string Please\ insert\ a\ bootable\ >>>157 string floppy\ and\r\n >>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display # >66 string Solaris\ Boot\ Sector >>99 string Incomplete\ MDBoot\ load. >>>89 string Version \b, Sun Solaris Bootloader >>>>97 byte x version %c # >408 string OS/2\ !!\ SYS01475\r\0 >>429 string OS/2\ !!\ SYS02025\r\0 >>>450 string OS/2\ !!\ SYS02027\r\0 >>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader # >409 string OS/2\ !!\ SYS01475\r\0 >>430 string OS/2\ !!\ SYS02025\r\0 >>>451 string OS/2\ !!\ SYS02027\r\0 >>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader >112 string This\ disk\ is\ not\ bootable\r >>142 string If\ you\ wish\ to\ make\ it\ bootable >>>176 string run\ the\ DOS\ program\ SYS\ >>>200 string after\ the\r >>>>216 string system\ has\ been\ loaded\r\n >>>>>242 string Please\ insert\ a\ DOS\ diskette\ >>>>>271 string into\r\n\ the\ drive\ and\ >>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display # XP >430 string NTLDR\ is\ missing\xFF\r\n >>449 string Disk\ error\xFF\r\n >>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes >>>>417 ubyte&0xDF >0 >>>>>417 string x %-.5s >>>>>>422 ubyte&0xDF >0 >>>>>>>422 string x \b%-.3s >>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s # >>>>371 ubyte >0x20 >>>>>368 ubyte&0xDF >0 >>>>>>368 string x %-.5s >>>>>>>373 ubyte&0xDF >0 >>>>>>>>373 string x \b%-.3s >>>>>>376 ubyte&0xDF >0 >>>>>>>376 string x \b.%-.3s # >430 string NTLDR\ nicht\ gefunden\xFF\r\n >>453 string Datentr\204gerfehler\xFF\r\n >>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) >>>>417 ubyte&0xDF >0 >>>>>417 string x %-.5s >>>>>>422 ubyte&0xDF >0 >>>>>>>422 string x \b%-.3s >>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s # offset variant >>>>379 string \0 >>>>>368 ubyte&0xDF >0 >>>>>>368 string x %-.5s >>>>>>>373 ubyte&0xDF >0 >>>>>>>>373 string x \b%-.3s # >430 string NTLDR\ fehlt\xFF\r\n >>444 string Datentr\204gerfehler\xFF\r\n >>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) >>>>417 ubyte&0xDF >0 >>>>>417 string x %-.5s >>>>>>422 ubyte&0xDF >0 >>>>>>>422 string x \b%-.3s >>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s # variant >>>>371 ubyte >0x20 >>>>>368 ubyte&0xDF >0 >>>>>>368 string x %-.5s >>>>>>>373 ubyte&0xDF >0 >>>>>>>>373 string x \b%-.3s >>>>>>376 ubyte&0xDF >0 >>>>>>>376 string x \b.%-.3s # >430 string NTLDR\ fehlt\xFF\r\n >>444 string Medienfehler\xFF\r\n >>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) >>>>371 ubyte >0x20 >>>>>368 ubyte&0xDF >0 >>>>>>368 string x %-.5s >>>>>>>373 ubyte&0xDF >0 >>>>>>>>373 string x \b%-.3s >>>>>>376 ubyte&0xDF >0 >>>>>>>376 string x \b.%-.3s # variant >>>>417 ubyte&0xDF >0 >>>>>417 string x %-.5s >>>>>>422 ubyte&0xDF >0 >>>>>>>422 string x \b%-.3s >>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s # >430 string Datentr\204ger\ entfernen\xFF\r\n >>454 string Medienfehler\xFF\r\n >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) >>>>379 string \0 >>>>>368 ubyte&0xDF >0 >>>>>>368 string x %-.5s >>>>>>>373 ubyte&0xDF >0 >>>>>>>>373 string x \b%-.3s >>>>>>376 ubyte&0xDF >0 >>>>>>>376 string x \b.%-.3s # variant >>>>417 ubyte&0xDF >0 >>>>>417 string x %-.5s >>>>>>422 ubyte&0xDF >0 >>>>>>>422 string x \b%-.3s >>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s # #>3 string NTFS\ \ \ \ >389 string Fehler\ beim\ Lesen\ >>407 string des\ Datentr\204gers >>>426 string NTLDR\ fehlt >>>>440 string NTLDR\ ist\ komprimiert >>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) #>3 string NTFS\ \ \ \ >313 string A\ disk\ read\ error\ occurred.\r >>345 string A\ kernel\ file\ is\ missing\ >>>370 string from\ the\ disk.\r >>>>484 string NTLDR\ is\ compressed >>>>>429 string Insert\ a\ system\ diskette\ >>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS # DOS loader variants different languages,offsets >472 ubyte&0xDF >0 >>389 string Invalid\ system\ disk\xFF\r\n >>>411 string Disk\ I/O\ error >>>>428 string Replace\ the\ disk,\ and\ >>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader #IO.SYS >>>>>>472 ubyte&0xDF >0 >>>>>>>472 string x \b %-.2s >>>>>>>>474 ubyte&0xDF >0 >>>>>>>>>474 string x \b%-.5s >>>>>>>>>>479 ubyte&0xDF >0 >>>>>>>>>>>479 string x \b%-.1s >>>>>>>480 ubyte&0xDF >0 >>>>>>>>480 string x \b.%-.3s #MSDOS.SYS >>>>>>>483 ubyte&0xDF >0 \b+ >>>>>>>>483 string x \b%-.5s >>>>>>>>>488 ubyte&0xDF >0 >>>>>>>>>>488 string x \b%-.3s >>>>>>>>491 ubyte&0xDF >0 >>>>>>>>>491 string x \b.%-.3s # >>390 string Invalid\ system\ disk\xFF\r\n >>>412 string Disk\ I/O\ error\xFF\r\n >>>>429 string Replace\ the\ disk,\ and\ >>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader >>388 string Ungueltiges\ System\ \xFF\r\n >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>427 string Datentraeger\ wechseln\ und\ >>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) #WINBOOT.SYS only not spaces (0xDF) >>>>>>497 ubyte&0xDF >0 >>>>>>>497 string x %-.5s >>>>>>>>502 ubyte&0xDF >0 >>>>>>>>>502 string x \b%-.1s >>>>>>>>>>503 ubyte&0xDF >0 >>>>>>>>>>>503 string x \b%-.1s >>>>>>>>>>>>504 ubyte&0xDF >0 >>>>>>>>>>>>>504 string x \b%-.1s >>>>>>505 ubyte&0xDF >0 >>>>>>>505 string x \b.%-.3s #IO.SYS >>>>>>472 ubyte&0xDF >0 or >>>>>>>472 string x \b %-.2s >>>>>>>>474 ubyte&0xDF >0 >>>>>>>>>474 string x \b%-.5s >>>>>>>>>>479 ubyte&0xDF >0 >>>>>>>>>>>479 string x \b%-.1s >>>>>>>480 ubyte&0xDF >0 >>>>>>>>480 string x \b.%-.3s #MSDOS.SYS >>>>>>>483 ubyte&0xDF >0 \b+ >>>>>>>>483 string x \b%-.5s >>>>>>>>>488 ubyte&0xDF >0 >>>>>>>>>>488 string x \b%-.3s >>>>>>>>491 ubyte&0xDF >0 >>>>>>>>>491 string x \b.%-.3s # >>390 string Ungueltiges\ System\ \xFF\r\n >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>429 string Datentraeger\ wechseln\ und\ >>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) #WINBOOT.SYS only not spaces (0xDF) >>>>>>497 ubyte&0xDF >0 >>>>>>>497 string x %-.7s >>>>>>>>504 ubyte&0xDF >0 >>>>>>>>>504 string x \b%-.1s >>>>>>505 ubyte&0xDF >0 >>>>>>>505 string x \b.%-.3s #IO.SYS >>>>>>472 ubyte&0xDF >0 or >>>>>>>472 string x \b %-.2s >>>>>>>>474 ubyte&0xDF >0 >>>>>>>>>474 string x \b%-.6s >>>>>>>480 ubyte&0xDF >0 >>>>>>>>480 string x \b.%-.3s #MSDOS.SYS >>>>>>>483 ubyte&0xDF >0 \b+ >>>>>>>>483 string x \b%-.5s >>>>>>>>>488 ubyte&0xDF >0 >>>>>>>>>>488 string x \b%-.3s >>>>>>>>491 ubyte&0xDF >0 >>>>>>>>>491 string x \b.%-.3s # >>389 string Ungueltiges\ System\ \xFF\r\n >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>428 string Datentraeger\ wechseln\ und\ >>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) # DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes >>>>>>472 string x %-.2s >>>>>>>474 ubyte&0xDF >0 >>>>>>>>474 string x \b%-.5s >>>>>>>>479 ubyte&0xDF >0 >>>>>>>>>479 string x \b%-.1s >>>>>>480 ubyte&0xDF >0 >>>>>>>480 string x \b.%-.3s >>>>>>483 ubyte&0xDF >0 \b+ >>>>>>>483 string x \b%-.5s >>>>>>>488 ubyte&0xDF >0 >>>>>>>>488 string x \b%-.2s >>>>>>>>490 ubyte&0xDF >0 >>>>>>>>>490 string x \b%-.1s >>>>>>>491 ubyte&0xDF >0 >>>>>>>>491 string x \b.%-.3s >479 ubyte&0xDF >0 >>416 string Kein\ System\ oder\ >>>433 string Laufwerksfehler >>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) #IO.SYS >>>>>479 string x \b %-.2s >>>>>>481 ubyte&0xDF >0 >>>>>>>481 string x \b%-.6s >>>>>487 ubyte&0xDF >0 >>>>>>487 string x \b.%-.3s #MSDOS.SYS >>>>>>490 ubyte&0xDF >0 \b+ >>>>>>>490 string x \b%-.5s >>>>>>>>495 ubyte&0xDF >0 >>>>>>>>>495 string x \b%-.3s >>>>>>>498 ubyte&0xDF >0 >>>>>>>>498 string x \b.%-.3s # >376 search/41 Non-System\ disk\ or\ >>395 search/41 disk\ error\r >>>407 search/41 Replace\ and\ >>>>419 search/41 press\ \b, >>>>419 search/41 strike\ \b, old >>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader #449 Disk\ Boot\ failure\r MS 3.21 #466 Boot\ Failure\r MS 3.30 >>>>>468 search/18 \0 #IO.SYS,IBMBIO.COM >>>>>>&0 string x \b %-.2s >>>>>>>&-20 ubyte&0xDF >0 >>>>>>>>&-1 string x \b%-.4s >>>>>>>>>&-16 ubyte&0xDF >0 >>>>>>>>>>&-1 string x \b%-.2s >>>>>>&8 ubyte&0xDF >0 \b. >>>>>>>&-1 string x \b%-.3s #MSDOS.SYS,IBMDOS.COM >>>>>>&11 ubyte&0xDF >0 \b+ >>>>>>>&-1 string x \b%-.5s >>>>>>>>&-6 ubyte&0xDF >0 >>>>>>>>>&-1 string x \b%-.1s >>>>>>>>>>&-5 ubyte&0xDF >0 >>>>>>>>>>>&-1 string x \b%-.2s >>>>>>>&7 ubyte&0xDF >0 \b. >>>>>>>>&-1 string x \b%-.3s >441 string Cannot\ load\ from\ harddisk.\n\r >>469 string Insert\ Systemdisk\ >>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader #>43 string \224R-LOADER\ \ SYS =label >54 string SYS >>324 string VASKK >>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) # >98 string Press\ a\ key\ to\ retry\0\r >>120 string Cannot\ find\ file\ \0\r >>>139 string Disk\ read\ error\0\r >>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader #DRBIOS.SYS >>>>>44 ubyte&0xDF >0 >>>>>>44 string x \b %-.6s >>>>>>>50 ubyte&0xDF >0 >>>>>>>>50 string x \b%-.2s >>>>>>52 ubyte&0xDF >0 >>>>>>>52 string x \b.%-.3s # >70 string IBMBIO\ \ COM >>472 string Cannot\ load\ DOS!\ >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader >>471 string Cannot\ load\ DOS\ >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader #?? >444 string KERNEL\ \ SYS >>314 string BOOT\ error! \b, FREE-DOS Bootloader >499 string KERNEL\ \ SYS >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader >449 string KERNEL\ \ SYS >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader # >449 string Loading\ FreeDOS >>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader >>>497 ubyte&0xDF >0 >>>>497 string x \b %-.6s >>>>>503 ubyte&0xDF >0 >>>>>>503 string x \b%-.1s >>>>>>>504 ubyte&0xDF >0 >>>>>>>>504 string x \b%-.1s >>>>505 ubyte&0xDF >0 >>>>>505 string x \b.%-.3s # >331 string Error!.0 \b, FREE-DOS 1.0 bootloader # >125 string Loading\ FreeDOS...\r >>311 string BOOT\ error!\r \b, FREE-DOS bootloader >>>441 ubyte&0xDF >0 >>>>441 string x \b %-.6s >>>>>447 ubyte&0xDF >0 >>>>>>447 string x \b%-.1s >>>>>>>448 ubyte&0xDF >0 >>>>>>>>448 string x \b%-.1s >>>>449 ubyte&0xDF >0 >>>>>449 string x \b.%-.3s >124 string FreeDOS\0 >>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes >>>497 ubyte&0xDF >0 >>>>497 string x \b %-.6s >>>>>503 ubyte&0xDF >0 >>>>>>503 string x \b%-.1s >>>>>>>504 ubyte&0xDF >0 >>>>>>>>504 string x \b%-.1s >>>>505 ubyte&0xDF >0 >>>>>505 string x \b.%-.3s >>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader >>>497 ubyte&0xDF >0 >>>>497 string x \b %-.6s >>>>>503 ubyte&0xDF >0 >>>>>>503 string x \b%-.1s >>>>>>>504 ubyte&0xDF >0 >>>>>>>>504 string x \b%-.1s >>>>505 ubyte&0xDF >0 >>>>>505 string x \b.%-.3s >>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader >>>497 ubyte&0xDF >0 >>>>497 string x \b %-.6s >>>>>503 ubyte&0xDF >0 >>>>>>503 string x \b%-.1s >>>>>>>504 ubyte&0xDF >0 >>>>>>>>504 string x \b%-.1s >>>>505 ubyte&0xDF >0 >>>>>505 string x \b.%-.3s >336 string Error!\ >>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader >>>497 ubyte&0xDF >0 >>>>497 string x \b %-.6s >>>>>503 ubyte&0xDF >0 >>>>>>503 string x \b%-.1s >>>>>>>504 ubyte&0xDF >0 >>>>>>>>504 string x \b%-.1s >>>>505 ubyte&0xDF >0 >>>>>505 string x \b.%-.3s # added by Joerg Jenderek # http://www.visopsys.org/ # http://partitionlogic.org.uk/ # OEM-ID=Visopsys >478 ulelong 0 >>(1.b+326) string I/O\ Error\ reading\ >>>(1.b+344) string Visopsys\ loader\r >>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader # http://alexfru.chat.ru/epm.html#bootprog >494 ubyte >0x4D >>495 string >E >>>495 string >>>3 string BootProg # It just looks for a program file name at the root directory # and loads corresponding file with following execution. # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader >>>>>499 string x \b %-.1s >>>>>>500 ubyte&0xDF >0 >>>>>>>500 string x \b%-.1s >>>>>>>>501 ubyte&0xDF >0 >>>>>>>>>501 string x \b%-.1s >>>>>>>>>>502 ubyte&0xDF >0 >>>>>>>>>>>502 string x \b%-.1s >>>>>>>>>>>>503 ubyte&0xDF >0 >>>>>>>>>>>>>503 string x \b%-.1s >>>>>>>>>>>>>>504 ubyte&0xDF >0 >>>>>>>>>>>>>>>504 string x \b%-.1s >>>>>>>>>>>>>>>>505 ubyte&0xDF >0 >>>>>>>>>>>>>>>>>505 string x \b%-.1s >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s #name extension >>>>>507 ubyte&0xDF >0 \b. >>>>>>507 string x \b%-.1s >>>>>>>508 ubyte&0xDF >0 >>>>>>>>508 string x \b%-.1s >>>>>>>>>509 ubyte&0xDF >0 >>>>>>>>>>509 string x \b%-.1s #If the boot sector fails to read any other sector, #it prints a very short message ("RE") to the screen and hangs the computer. #If the boot sector fails to find needed program in the root directory, #it also hangs with another message ("NF"). >>>>>492 string RENF \b, FAT (12 bit) >>>>>495 string RENF \b, FAT (16 bit) # http://alexfru.chat.ru/epm.html#bootprog >494 ubyte >0x4D >>495 string >E >>>495 string >>>3 string BootProg # It just looks for a program file name at the root directory # and loads corresponding file with following execution. # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader >>>>>499 string x \b %-.1s >>>>>>500 ubyte&0xDF >0 >>>>>>>500 string x \b%-.1s >>>>>>>>501 ubyte&0xDF >0 >>>>>>>>>501 string x \b%-.1s >>>>>>>>>>502 ubyte&0xDF >0 >>>>>>>>>>>502 string x \b%-.1s >>>>>>>>>>>>503 ubyte&0xDF >0 >>>>>>>>>>>>>503 string x \b%-.1s >>>>>>>>>>>>>>504 ubyte&0xDF >0 >>>>>>>>>>>>>>>504 string x \b%-.1s >>>>>>>>>>>>>>>>505 ubyte&0xDF >0 >>>>>>>>>>>>>>>>>505 string x \b%-.1s >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s #name extension >>>>>507 ubyte&0xDF >0 \b. >>>>>>507 string x \b%-.1s >>>>>>>508 ubyte&0xDF >0 >>>>>>>>508 string x \b%-.1s >>>>>>>>>509 ubyte&0xDF >0 >>>>>>>>>>509 string x \b%-.1s #If the boot sector fails to read any other sector, #it prints a very short message ("RE") to the screen and hangs the computer. #If the boot sector fails to find needed program in the root directory, #it also hangs with another message ("NF"). >>>>>492 string RENF \b, FAT (12 bit) >>>>>495 string RENF \b, FAT (16 bit) # x86 bootloader end # updated by Joerg Jenderek at Sep 2007 >3 ubyte 0 #no active flag >>446 ubyte 0 # partition 1 not empty >>>450 ubyte >0 # partitions 3,4 empty >>>>482 ubyte 0 >>>>>498 ubyte 0 # partition 2 ID=0,5,15 >>>>>>466 ubyte <0x10 >>>>>>>466 ubyte 0x05 \b, extended partition table >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) >>>>>>>466 ubyte 0x0 \b, extended partition table (last) # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 # http://mirror.href.com/thestarman/asm/2bytejumps.htmm#FWD # older drives may use Near JuMP instruction E9 xx xx >0 lelong&0x009000EB 0x009000EB >0 lelong&0x000000E9 0x000000E9 # minimal short forward jump found 03cx?? # maximal short forward jump is 07fx >1 ubyte <0xff \b, code offset 0x%x # mtools-3.9.8/msdos.h # usual values are marked with comments to get only informations of strange FAT systems # valid sectorsize must be a power of 2 from 32 to 32768 >>11 uleshort&0x000f x >>>11 uleshort <32769 >>>>11 uleshort >31 >>>>>21 ubyte&0xf0 0xF0 >>>>>>3 string >\0 \b, OEM-ID "%8.8s" #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC >>>>>>>8 string IHC \b cached by Windows 9M >>>>>>11 uleshort >512 \b, Bytes/sector %u #>>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) >>>>>>11 uleshort <512 \b, Bytes/sector %u >>>>>>13 ubyte >1 \b, sectors/cluster %u #>>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) >>>>>>14 uleshort >32 \b, reserved sectors %u #>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) #>>>>>>14 uleshort >1 \b, reserved sectors %u #>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) >>>>>>14 uleshort <1 \b, reserved sectors %u >>>>>>16 ubyte >2 \b, FATs %u #>>>>>>16 ubyte =2 \b, FATs %u (usual) >>>>>>16 ubyte =1 \b, FAT %u >>>>>>16 ubyte >0 >>>>>>17 uleshort >0 \b, root entries %u #>>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) >>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) #>>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) >>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x #>>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) >>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x >>>>>>22 uleshort >0 \b, sectors/FAT %u #>>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) >>>>>>26 ubyte >2 \b, heads %u #>>>>>>26 ubyte =2 \b, heads %u (usual floppy) >>>>>>26 ubyte =1 \b, heads %u #skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk >>>>>>38 ubyte !0x70 >>>>>>>28 ulelong >0 \b, hidden sectors %u #>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) #>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) # FAT<32 specific >>>>>>82 string !FAT32 #>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) #>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) >>>>>>>36 ubyte !0x80 >>>>>>>>36 ubyte !0 \b, physical drive 0x%x >>>>>>>37 ubyte >0 \b, reserved 0x%x #>>>>>>>37 ubyte =0 \b, reserved 0x%x >>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>>38 ubyte =0x29 >>>>>>>>39 ulelong x \b, serial number 0x%x >>>>>>>>43 string >>>>>>>43 string >NO\ NAME \b, label: "%11.11s" >>>>>>>>43 string =NO\ NAME \b, unlabeled >>>>>>>54 string FAT \b, FAT >>>>>>>>54 string FAT12 \b (12 bit) >>>>>>>>54 string FAT16 \b (16 bit) # FAT32 specific >>>>>>82 string FAT32 \b, FAT (32 bit) >>>>>>>36 ulelong x \b, sectors/FAT %u >>>>>>>40 uleshort >0 \b, extension flags %u #>>>>>>>40 uleshort =0 \b, extension flags %u >>>>>>>42 uleshort >0 \b, fsVersion %u #>>>>>>>42 uleshort =0 \b, fsVersion %u (usual) >>>>>>>44 ulelong >2 \b, rootdir cluster %u #>>>>>>>44 ulelong =2 \b, rootdir cluster %u #>>>>>>>44 ulelong =1 \b, rootdir cluster %u >>>>>>>48 uleshort >1 \b, infoSector %u #>>>>>>>48 uleshort =1 \b, infoSector %u (usual) >>>>>>>48 uleshort <1 \b, infoSector %u >>>>>>>50 uleshort >6 \b, Backup boot sector %u #>>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) >>>>>>>50 uleshort <6 \b, Backup boot sector %u >>>>>>>54 ulelong >0 \b, reserved1 0x%x >>>>>>>58 ulelong >0 \b, reserved2 0x%x >>>>>>>62 ulelong >0 \b, reserved3 0x%x # same structure as FAT1X >>>>>>>64 ubyte >0x80 \b, physical drive 0x%x #>>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) >>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x #>>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) >>>>>>>65 ubyte >0 \b, reserved 0x%x >>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>>66 ubyte =0x29 >>>>>>>>67 ulelong x \b, serial number 0x%x >>>>>>>>71 string >>>>>>71 string >NO\ NAME \b, label: "%11.11s" >>>>>>>71 string =NO\ NAME \b, unlabeled ### FATs end >0x200 lelong 0x82564557 \b, BSD disklabel # FATX 0 string FATX FATX filesystem data # Minix filesystems - Juan Cespedes 0x410 leshort 0x137f Minix filesystem 0x410 beshort 0x137f Minix filesystem (big endian) >0x402 beshort !0 \b, %d zones >0x1e string minix \b, bootable 0x410 leshort 0x138f Minix filesystem, 30 char names 0x410 leshort 0x2468 Minix filesystem, version 2 0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names # romfs filesystems - Juan Cespedes 0 string -rom1fs- romfs filesystem, version 1 >8 belong x %d bytes, >16 string x named %s. # netboot image - Juan Cespedes 0 lelong 0x1b031336L Netboot image, >4 lelong&0xFFFFFF00 0 >>4 lelong&0x100 0x000 mode 2 >>4 lelong&0x100 0x100 mode 3 >4 lelong&0xFFFFFF00 !0 unknown mode 0x18b string OS/2 OS/2 Boot Manager # updated by Joerg Jenderek at Oct 2008!! # http://syslinux.zytor.com/iso.php 0 ulelong 0x7c40eafa isolinux Loader # http://syslinux.zytor.com/pxe.php 0 ulelong 0x007c05ea pxelinux Loader 0 ulelong 0x60669c66 pxelinux Loader # added by Joerg Jenderek # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or # grub-1.94/kern/i386/pc/startup.S # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data # usual values are marked with comments to get only informations of strange GRUB loaders 0x200 uleshort 0x70EA # found only version 3.{1,2} >0x206 ubeshort >0x0300 # GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" >>0x212 ubyte >0x29 >>>0x213 ubyte >0x29 # not iso9660_stage1_5 #>>>0 ulelong&0x00BE5652 0x00BE5652 >>>>0x213 ubyte >0x29 GRand Unified Bootloader # config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" >>>>0x217 ubyte 0xFF stage1_5 >>>>0x217 ubyte <0xFF stage2 >>>>0x206 ubyte x \b version %u >>>>0x207 ubyte x \b.%u # module_size for 1.94 >>>>0x208 ulelong <0xffffff \b, installed partition %u #>>>>0x208 ulelong =0xffffff \b, %u (default) >>>>0x208 ulelong >0xffffff \b, installed partition %u # GRUB 0.5.95 unofficial >>>>0x20C ulelong&0x2E300000 0x2E300000 # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs >>>>>0x20C ubyte x \b, identifier 0x%x #>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) >>>>>0x20D ubyte >0 \b, LBA flag 0x%x # GRUB version as string >>>>>0x20E string >\0 \b, GRUB version %-s # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default >>>>>>0x215 ulong 0xffffffff >>>>>>>0x219 string >\0 \b, configuration file %-s >>>>>>0x215 ulong !0xffffffff >>>>>>>0x215 string >\0 \b, configuration file %-s # newer GRUB versions >>>>0x20C ulelong&0x2E300000 !0x2E300000 ##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) >>>>>0x20C ulelong >0 \b, saved entry %d # for 1.94 contains kernel image size # for 0.93,0.94,0.96,0.97 # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 >>>>>0x210 ubyte x \b, identifier 0x%x # The flag for LBA forcing is in most cases 0 #>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) >>>>>0x211 ubyte >0 \b, LBA flag 0x%x # GRUB version as string >>>>>0x212 string >\0 \b, GRUB version %-s # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default >>>>>0x217 ulong 0xffffffff >>>>>>0x21b string >\0 \b, configuration file %-s >>>>>0x217 ulong !0xffffffff >>>>>>0x217 string >\0 \b, configuration file %-s 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), >8404 string x last mounted on %s, #>9504 ledate x last checked at %s, >8224 ledate x last written at %s, >8401 byte x clean flag %d, >8228 lelong x number of blocks %d, >8232 lelong x number of data blocks %d, >8236 lelong x number of cylinder groups %d, >8240 lelong x block size %d, >8244 lelong x fragment size %d, >8252 lelong x minimum percentage of free blocks %d, >8256 lelong x rotational delay %dms, >8260 lelong x disk rotational speed %drps, >8320 lelong 0 TIME optimization >8320 lelong 1 SPACE optimization 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) >&-1164 string x last mounted on %s, >&-696 string >\0 volume name %s, >&-304 leqldate x last written at %s, >&-1167 byte x clean flag %d, >&-1168 byte x readonly flag %d, >&-296 lequad x number of blocks %lld, >&-288 lequad x number of data blocks %lld, >&-1332 lelong x number of cylinder groups %d, >&-1328 lelong x block size %d, >&-1324 lelong x fragment size %d, >&-180 lelong x average file size %d, >&-176 lelong x average number of files in dir %d, >&-272 lequad x pending blocks to free %lld, >&-264 lelong x pending inodes to free %ld, >&-664 lequad x system-wide uuid %0llx, >&-1316 lelong x minimum percentage of free blocks %d, >&-1248 lelong 0 TIME optimization >&-1248 lelong 1 SPACE optimization 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) >&-1164 string x last mounted on %s, >&-696 string >\0 volume name %s, >&-304 leqldate x last written at %s, >&-1167 byte x clean flag %d, >&-1168 byte x readonly flag %d, >&-296 lequad x number of blocks %lld, >&-288 lequad x number of data blocks %lld, >&-1332 lelong x number of cylinder groups %d, >&-1328 lelong x block size %d, >&-1324 lelong x fragment size %d, >&-180 lelong x average file size %d, >&-176 lelong x average number of files in dir %d, >&-272 lequad x pending blocks to free %lld, >&-264 lelong x pending inodes to free %ld, >&-664 lequad x system-wide uuid %0llx, >&-1316 lelong x minimum percentage of free blocks %d, >&-1248 lelong 0 TIME optimization >&-1248 lelong 1 SPACE optimization 9564 belong 0x00011954 Unix Fast File system [v1] (big-endian), >7168 belong 0x4c41424c Apple UFS Volume >>7186 string x named %s, >>7176 belong x volume label version %d, >>7180 bedate x created on %s, >8404 string x last mounted on %s, #>9504 bedate x last checked at %s, >8224 bedate x last written at %s, >8401 byte x clean flag %d, >8228 belong x number of blocks %d, >8232 belong x number of data blocks %d, >8236 belong x number of cylinder groups %d, >8240 belong x block size %d, >8244 belong x fragment size %d, >8252 belong x minimum percentage of free blocks %d, >8256 belong x rotational delay %dms, >8260 belong x disk rotational speed %drps, >8320 belong 0 TIME optimization >8320 belong 1 SPACE optimization 42332 belong 0x19540119 Unix Fast File system [v2] (big-endian) >&-1164 string x last mounted on %s, >&-696 string >\0 volume name %s, >&-304 beqldate x last written at %s, >&-1167 byte x clean flag %d, >&-1168 byte x readonly flag %d, >&-296 bequad x number of blocks %lld, >&-288 bequad x number of data blocks %lld, >&-1332 belong x number of cylinder groups %d, >&-1328 belong x block size %d, >&-1324 belong x fragment size %d, >&-180 belong x average file size %d, >&-176 belong x average number of files in dir %d, >&-272 bequad x pending blocks to free %lld, >&-264 belong x pending inodes to free %ld, >&-664 bequad x system-wide uuid %0llx, >&-1316 belong x minimum percentage of free blocks %d, >&-1248 belong 0 TIME optimization >&-1248 belong 1 SPACE optimization 66908 belong 0x19540119 Unix Fast File system [v2] (big-endian) >&-1164 string x last mounted on %s, >&-696 string >\0 volume name %s, >&-304 beqldate x last written at %s, >&-1167 byte x clean flag %d, >&-1168 byte x readonly flag %d, >&-296 bequad x number of blocks %lld, >&-288 bequad x number of data blocks %lld, >&-1332 belong x number of cylinder groups %d, >&-1328 belong x block size %d, >&-1324 belong x fragment size %d, >&-180 belong x average file size %d, >&-176 belong x average number of files in dir %d, >&-272 bequad x pending blocks to free %lld, >&-264 belong x pending inodes to free %ld, >&-664 bequad x system-wide uuid %0llx, >&-1316 belong x minimum percentage of free blocks %d, >&-1248 belong 0 TIME optimization >&-1248 belong 1 SPACE optimization # ext2/ext3 filesystems - Andreas Dilger # ext4 filesystem - Eric Sandeen 0x438 leshort 0xEF53 Linux >0x44c lelong x rev %d >0x43e leshort x \b.%d # No journal? ext2 >0x45c lelong ^0x0000004 ext2 filesystem data >>0x43a leshort ^0x0000001 (mounted or unclean) # Has a journal? ext3 or ext4 >0x45c lelong &0x0000004 # and small INCOMPAT? >>0x460 lelong <0x0000040 # and small RO_COMPAT? >>>0x464 lelong <0x0000008 ext3 filesystem data # else large RO_COMPAT? >>>0x464 lelong >0x0000007 ext4 filesystem data # else large INCOMPAT? >>0x460 lelong >0x000003f ext4 filesystem data # General flags for any ext* fs >0x460 lelong &0x0000004 (needs journal recovery) >0x43a leshort &0x0000002 (errors) # INCOMPAT flags >0x460 lelong &0x0000001 (compressed) #>0x460 lelong &0x0000002 (filetype) #>0x460 lelong &0x0000010 (meta bg) >0x460 lelong &0x0000040 (extents) >0x460 lelong &0x0000080 (64bit) #>0x460 lelong &0x0000100 (mmp) #>0x460 lelong &0x0000200 (flex bg) # RO_INCOMPAT flags #>0x464 lelong &0x0000001 (sparse super) >0x464 lelong &0x0000002 (large files) >0x464 lelong &0x0000008 (huge files) #>0x464 lelong &0x0000010 (gdt checksum) #>0x464 lelong &0x0000020 (many subdirs) #>0x463 lelong &0x0000040 (extra isize) # SGI disk labels - Nathan Scott 0 belong 0x0BE5A941 SGI disk label (volume header) # SGI XFS filesystem - Nathan Scott 0 belong 0x58465342 SGI XFS filesystem data >0x4 belong x (blksz %d, >0x68 beshort x inosz %d, >0x64 beshort ^0x2004 v1 dirs) >0x64 beshort &0x2004 v2 dirs) ############################################################################ # Minix-ST kernel floppy 0x800 belong 0x46fc2700 Atari-ST Minix kernel image >19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy >19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy ############################################################################ # Hmmm, is this a better way of detecting _standard_ floppy images ? 19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k 19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k # Valid media descriptor bytes for MS-DOS: # # Byte Capacity Media Size and Type # ------------------------------------------------- # # F0 2.88 MB 3.5-inch, 2-sided, 36-sector # F0 1.44 MB 3.5-inch, 2-sided, 18-sector # F9 720K 3.5-inch, 2-sided, 9-sector # F9 1.2 MB 5.25-inch, 2-sided, 15-sector # FD 360K 5.25-inch, 2-sided, 9-sector # FF 320K 5.25-inch, 2-sided, 8-sector # FC 180K 5.25-inch, 1-sided, 9-sector # FE 160K 5.25-inch, 1-sided, 8-sector # FE 250K 8-inch, 1-sided, single-density # FD 500K 8-inch, 2-sided, single-density # FE 1.2 MB 8-inch, 2-sided, double-density # F8 ----- Fixed disk # # FC xxxK Apricot 70x1x9 boot disk. # # Originally a bitmap: # xxxxxxx0 Not two sided # xxxxxxx1 Double sided # xxxxxx0x Not 8 SPT # xxxxxx1x 8 SPT # xxxxx0xx Not Removable drive # xxxxx1xx Removable drive # 11111xxx Must be one. # # But now it's rather random: # 111111xx Low density disk # 00 SS, Not 8 SPT # 01 DS, Not 8 SPT # 10 SS, 8 SPT # 11 DS, 8 SPT # # 11111001 Double density 3½ floppy disk, high density 5¼ # 11110000 High density 3½ floppy disk # 11111000 Hard disk any format # # CDROM Filesystems # Modified for UDF by gerardo.cacciari@@gmail.com 32769 string CD001 !:mime application/x-iso9660-image >38913 string !NSR0 ISO 9660 CD-ROM filesystem data >38913 string NSR0 UDF filesystem data >>38917 string 1 (version 1.0) >>38917 string 2 (version 1.5) >>38917 string 3 (version 2.0) >>38917 byte >0x33 (unknown version, ID 0x%X) >>38917 byte <0x31 (unknown version, ID 0x%X) # "application id" which appears to be used as a volume label >32808 string >\0 '%s' >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) !:mime application/x-iso9660-image 32776 string CDROM High Sierra CD-ROM filesystem data # .cso files 0 string CISO Compressed ISO CD image # cramfs filesystem - russell@@coker.com.au 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian >4 lelong x size %lu >8 lelong &1 version #2 >8 lelong &2 sorted_dirs >8 lelong &4 hole_support >32 lelong x CRC 0x%x, >36 lelong x edition %lu, >40 lelong x %lu blocks, >44 lelong x %lu files 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian >4 belong x size %lu >8 belong &1 version #2 >8 belong &2 sorted_dirs >8 belong &4 hole_support >32 belong x CRC 0x%x, >36 belong x edition %lu, >40 belong x %lu blocks, >44 belong x %lu files # reiserfs - russell@@coker.com.au 0x10034 string ReIsErFs ReiserFS V3.5 0x10034 string ReIsEr2Fs ReiserFS V3.6 >0x1002c leshort x block size %d >0x10032 leshort &2 (mounted or unclean) >0x10000 lelong x num blocks %d >0x10040 lelong 1 tea hash >0x10040 lelong 2 yura hash >0x10040 lelong 3 r5 hash # JFFS - russell@@coker.com.au 0 lelong 0x34383931 Linux Journalled Flash File system, little endian 0 belong 0x34383931 Linux Journalled Flash File system, big endian # EST flat binary format (which isn't, but anyway) # From: Mark Brown 0 string ESTFBINR EST flat binary # Aculab VoIP firmware # From: Mark Brown 0 string VoIP\ Startup\ and Aculab VoIP firmware >35 string x format %s # u-boot/PPCBoot image file # From: Mark Brown 0 belong 0x27051956 u-boot/PPCBoot image >4 string PPCBoot >>12 string x version %s # JFFS2 file system 0 leshort 0x1984 Linux old jffs2 filesystem data little endian 0 leshort 0x1985 Linux jffs2 filesystem data little endian # Squashfs 0 string sqsh Squashfs filesystem, big endian, >28 beshort x version %d. >30 beshort x \b%d, >28 beshort <3 >>8 belong x %d bytes, >28 beshort >2 >>63 bequad x %lld bytes, #>>67 belong x %d bytes, >4 belong x %d inodes, >28 beshort <2 >>32 beshort x blocksize: %d bytes, >28 beshort >1 >>51 belong x blocksize: %d bytes, >39 bedate x created: %s 0 string hsqs Squashfs filesystem, little endian, >28 leshort x version %d. >30 leshort x \b%d, >28 leshort <3 >>8 lelong x %d bytes, >28 leshort >2 >>63 lequad x %lld bytes, #>>63 lelong x %d bytes, >4 lelong x %d inodes, >28 leshort <2 >>32 leshort x blocksize: %d bytes, >28 leshort >1 >>51 lelong x blocksize: %d bytes, >39 ledate x created: %s 0 string td\000 floppy image data (TeleDisk) # AFS Dump Magic # From: Ty Sarna 0 string \x01\xb3\xa1\x13\x22 AFS Dump >&0 belong x (v%d) >>&0 byte 0x76 >>>&0 belong x Vol %d, >>>>&0 byte 0x6e >>>>>&0 string x %s >>>>>>&1 byte 0x74 >>>>>>>&0 beshort 2 >>>>>>>>&4 bedate x on: %s >>>>>>>>&0 bedate =0 full dump >>>>>>>>&0 bedate !0 incremental since: %s #---------------------------------------------------------- # VMS backup savesets - gerardo.cacciari@@gmail.com # 4 string \x01\x00\x01\x00\x01\x00 >(0.s+16) string \x01\x01 >>&(&0.b+8) byte 0x42 OpenVMS backup saveset data >>>40 lelong x (block size %d, >>>49 string >\0 original name '%s', >>>2 short 1024 VAX generated) >>>2 short 2048 AXP generated) >>>2 short 4096 I64 generated) # Summary: Oracle Clustered Filesystem # Created by: Aaron Botsis 8 string OracleCFS Oracle Clustered Filesystem, >4 long x rev %d >0 long x \b.%d, >560 string x label: %.64s, >136 string x mountpoint: %.128s # Summary: Oracle ASM tagged volume # Created by: Aaron Botsis 32 string ORCLDISK Oracle ASM Volume, >40 string x Disk Name: %0.12s 32 string ORCLCLRD Oracle ASM Volume (cleared), >40 string x Disk Name: %0.12s # Oracle Clustered Filesystem - Aaron Botsis 8 string OracleCFS Oracle Clustered Filesystem, >4 long x rev %d >0 long x \b.%d, >560 string x label: %.64s, >136 string x mountpoint: %.128s # Oracle ASM tagged volume - Aaron Botsis 32 string ORCLDISK Oracle ASM Volume, >40 string x Disk Name: %0.12s 32 string ORCLCLRD Oracle ASM Volume (cleared), >40 string x Disk Name: %0.12s # Compaq/HP RILOE floppy image # From: Dirk Jagdmann 0 string CPQRFBLO Compaq/HP RILOE floppy image #------------------------------------------------------------------------------ # Files-11 On-Disk Structure (OpenVMS file system) - gerardo.cacciari@@gmail.com # These bits come from LBN 1 (home block) of ODS-2 and ODS-5 volumes, which is # mapped to VBN 2 of [000000]INDEXF.SYS;1 # 1008 string DECFILE11B Files-11 On-Disk Structure >525 byte x Level %d >525 byte x (ODS-%d OpenVMS file system), >984 string x volume label is '%-12.12s' # From: Thomas Klausner # http://filext.com/file-extension/DAA # describes the daa file format. The magic would be: 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive # From Albert Cahalan # really le32 operation,destination,payloadsize (but quite predictable) # 01 00 00 00 00 00 00 c0 00 02 00 00 0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware # From Eric Sandeen # GFS2 0x10000 belong 0x01161970 GFS2 Filesystem >0x10024 belong x (blocksize %d, >0x10060 string >\0 lockproto %s) # BTRFS 0x10040 string _BHRfS_M BTRFS Filesystem >0x1012b string >\0 (label "%s", >0x10090 lelong x sectorsize %d, >0x10094 lelong x nodesize %d, >0x10098 lelong x leafsize %d) # dvdisaster's .ecc # From: "Nelson A. de Oliveira" 0 string *dvdisaster* dvdisaster error correction file @ 1.1 log @Initial revision @ text @d1214 3 @ 1.1.1.1 log @from ftp.astron.com @ text @@ 1.1.1.2 log @from ftp.astron.com. - many security related fixes - no MAXPATHLEN limits - fixed missing text specification on ascii magic - new ``pascal'' style string formats - whitespace comparison fix - more magic @ text @a2 1 # $File: filesystems,v 1.61 2011/01/10 14:01:10 christos Exp $ d205 1 a205 1 # mbr partition table entries d259 1 a259 1 # mbr partition table entries end d885 3 a887 34 0x410 leshort 0x137f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x137f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x138f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x138f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2468 >0x402 beshort < 100 Minix filesystem, V2, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x2468 >0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2478 >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2478 >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x2478 >0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x4d5a >0x402 beshort !0 Minix filesystem, V3, %d zones d889 3 a1086 2 # volume label and UUID Russell Coker # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ d1102 1 a1102 8 >>0x460 lelong >0x000003f ext4 filesystem data >0x468 belong x \b, UUID=%08x >0x46c beshort x \b-%04x >0x46e beshort x \b-%04x >0x470 beshort x \b-%04x >0x472 belong x \b-%08x >0x476 beshort x \b%04x >0x478 string >0 \b, volume name "%s" d1104 2 a1105 2 >0x460 lelong &0x0000004 (needs journal recovery) >0x43a leshort &0x0000002 (errors) d1107 7 a1113 7 >0x460 lelong &0x0000001 (compressed) #>0x460 lelong &0x0000002 (filetype) #>0x460 lelong &0x0000010 (meta bg) >0x460 lelong &0x0000040 (extents) >0x460 lelong &0x0000080 (64bit) #>0x460 lelong &0x0000100 (mmp) #>0x460 lelong &0x0000200 (flex bg) d1115 6 a1120 6 #>0x464 lelong &0x0000001 (sparse super) >0x464 lelong &0x0000002 (large files) >0x464 lelong &0x0000008 (huge files) #>0x464 lelong &0x0000010 (gdt checksum) #>0x464 lelong &0x0000020 (many subdirs) #>0x463 lelong &0x0000040 (extra isize) d1198 1 a1198 1 32769 string CD001 # a1213 3 # .cso files 0 string CISO Compressed ISO CD image a1237 1 0x10034 string ReIsEr3Fs ReiserFS V3.6.19 d1258 5 a1262 64 # From: Mark Brown [old] # From: Behan Webster 0 belong 0x27051956 u-boot legacy uImage, >32 string x %s, >28 byte 0 Invalid os/ >28 byte 1 OpenBSD/ >28 byte 2 NetBSD/ >28 byte 3 FreeBSD/ >28 byte 4 4.4BSD/ >28 byte 5 Linux/ >28 byte 6 SVR4/ >28 byte 7 Esix/ >28 byte 8 Solaris/ >28 byte 9 Irix/ >28 byte 10 SCO/ >28 byte 11 Dell/ >28 byte 12 NCR/ >28 byte 13 LynxOS/ >28 byte 14 VxWorks/ >28 byte 15 pSOS/ >28 byte 16 QNX/ >28 byte 17 Firmware/ >28 byte 18 RTEMS/ >28 byte 19 ARTOS/ >28 byte 20 Unity OS/ >28 byte 21 INTEGRITY/ >29 byte 0 \bInvalid CPU, >29 byte 1 \bAlpha, >29 byte 2 \bARM, >29 byte 3 \bIntel x86, >29 byte 4 \bIA64, >29 byte 5 \bMIPS, >29 byte 6 \bMIPS 64-bit, >29 byte 7 \bPowerPC, >29 byte 8 \bIBM S390, >29 byte 9 \bSuperH, >29 byte 10 \bSparc, >29 byte 11 \bSparc 64-bit, >29 byte 12 \bM68K, >29 byte 13 \bNios-32, >29 byte 14 \bMicroBlaze, >29 byte 15 \bNios-II, >29 byte 16 \bBlackfin, >29 byte 17 \bAVR32, >29 byte 18 \bSTMicroelectronics ST200, >30 byte 0 Invalid Image >30 byte 1 Standalone Program >30 byte 2 OS Kernel Image >30 byte 3 RAMDisk Image >30 byte 4 Multi-File Image >30 byte 5 Firmware Image >30 byte 6 Script File >30 byte 7 Filesystem Image (any type) >30 byte 8 Binary Flat Device Tree BLOB >31 byte 0 (Not compressed), >31 byte 1 (gzip), >31 byte 2 (bzip2), >31 byte 3 (lzma), >12 belong x %d bytes, >8 bedate x %s, >16 belong x Load Address: 0x%08X, >20 belong x Entry Point: 0x%08X, >4 belong x Header CRC: 0x%08X, >24 belong x Data CRC: 0x%08X d1275 1 a1275 4 >>28 beshort <4 >>>63 bequad x %lld bytes, >>28 beshort >3 >>>40 bequad x %lld bytes, d1281 2 a1282 8 >>28 beshort <4 >>>51 belong x blocksize: %d bytes, >>28 beshort >3 >>>12 belong x blocksize: %d bytes, >28 beshort <4 >>39 bedate x created: %s >28 beshort >3 >>8 bedate x created: %s d1289 1 a1289 4 >>28 leshort <4 >>>63 lequad x %lld bytes, >>28 leshort >3 >>>40 lequad x %lld bytes, d1295 2 a1296 8 >>28 leshort <4 >>>51 lelong x blocksize: %d bytes, >>28 leshort >3 >>>12 lelong x blocksize: %d bytes, >28 leshort <4 >>39 ledate x created: %s >28 leshort >3 >>8 ledate x created: %s a1314 4 #delta ISO Daniel Novotny (dnovotny@@redhat.com) 0 string DISO Delta ISO data >4 belong x version %d d1359 3 a1361 3 # Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). # These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, # which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@@gmail.com d1363 1 a1363 1 1008 string DECFILE11 Files-11 On-Disk Structure d1365 1 a1365 5 >525 byte x (ODS-%d); >1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; >1017 string B >>525 byte 2 VAX/VMS or OpenVMS file system; >>525 byte 5 OpenVMS Alpha or Itanium file system; d1380 3 a1382 7 0x10000 belong 0x01161970 >0x10018 belong 0x0000051d GFS1 Filesystem >>0x10024 belong x (blocksize %d, >>0x10060 string >\0 lockproto %s) >0x10018 belong 0x00000709 GFS2 Filesystem >>0x10024 belong x (blocksize %d, >>0x10060 string >\0 lockproto %s) a1394 46 # xfs metadump image # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog # but can we do the << ? For now it's always 512 (0x200) anyway. 0 string XFSM >0x200 string XFSB XFS filesystem metadump image # Type: CROM filesystem # From: Werner Fink 0 string CROMFS CROMFS >6 string >\0 \b version %2.2s, >8 ulequad >0 \b block data at %lld, >16 ulequad >0 \b fblock table at %lld, >24 ulequad >0 \b inode table at %lld, >32 ulequad >0 \b root at %lld, >40 ulelong >0 \b fblock size = %ld, >44 ulelong >0 \b block size = %ld, >48 ulequad >0 \b bytes = %lld # Type: xfs metadump image # From: Daniel Novotny # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog # but can we do the << ? For now it's always 512 (0x200) anyway. 0 string XFSM >0x200 string XFSB XFS filesystem metadump image # Type: delta ISO # From: Daniel Novotny 0 string DISO Delta ISO data, >4 belong x version %d # JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) # See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. # From: Adam Buchbinder 0x8000 string JFS1 # Because it's text-only magic, check a binary value (version) to be sure. # Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be # mountable. >&0 lelong <3 JFS2 filesystem image # Label is followed by a UUID; we have to limit string length to avoid # appending the UUID in the case of a 16-byte label. >>&144 regex [\x20-\x7E]{1,16} (label "%s") >>&0 lequad x \b, %lld blocks >>&8 lelong x \b, blocksize %d >>&32 lelong&0x00000006 >0 (dirty) >>&36 lelong >0 (compressed) @ 1.1.1.3 log @from ftp.astron.com @ text @d3 1 a3 1 # $File: filesystems,v 1.69 2012/12/18 17:28:43 christos Exp $ d30 1 a30 2 # Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk a43 2 >>>535 search/17 \x55\xAA >>>>&-512 indirect x \b; contains d45 1 a45 1 # updated by Joerg Jenderek at Nov 2012 a54 1 >>>>128 indirect x \b; contains d56 1 a56 11 # x86 boot sector updated by Joerg Jenderek at Sep 2007,May 2011 # for any allowed sector sizes 30 search/481 \x55\xAA # to display x86 boot sector (40) before old one (strength=50), SYSLINUX MBR (?) and DOS BPB information (71) like in previous file version !:strength +40 # for sector sizes < 512 Bytes >11 uleshort <512 >>(11.s-2) uleshort 0xAA55 x86 boot sector # for sector sizes with 512 or more Bytes >0x1FE leshort 0xAA55 x86 boot sector # keep old x86 boot sector as dummy for mbr and bootloader displaying d58 5 a62 3 0x1FE leshort 0xAA55 # to display information (51) before DOS BPB (strength=71) and after DOS floppy (120) like in old file version !:strength +21 d134 2 a135 1 # SYSLINUX MBR moved d196 6 a201 1 # SYSLINUX bootloader moved d266 1 a266 2 # updated by Joerg Jenderek at Nov 2012 # DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes d270 1 a270 3 >>>>>>480 string x \b%-.4s >>>>>>>484 ubyte&0xDF >0 >>>>>>>>484 string x \b%-.1s d282 6 a287 13 # http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c # updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string # skip name "C.H. Hochstätter" partly because it is sometimes written without umlaut >242 search/127 Bootsector\ from\ C.H.\ Hochst >>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk # followed by variants with point,CR-NL or NL-CR >>>208 search/261 Cannot\ load\ from\ harddisk. # followed by variants CR-NL or NL-CR >>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. # followed by variants with point,CR-NL or NL-CR >>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader # followed by string like "6.50 (c) 1993-2004 Gilles Vollant" >>>>>>&0 string x \b, version %-4.4s d291 9 a299 17 # message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others >>>>(1.b+5) ubyte&0xd3 0x53 >>>>>(1.b+6) ubyte 0x7c # assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, >>>>>>(1.b+7) ubyte 0xac >>>>>>>(1.b+8) ubyte 0x22 >>>>>>>>(1.b+9) ubyte 0xc0 >>>>>>>>>(1.b+10) ubyte 0x74 >>>>>>>>>>(1.b+11) ubyte 0x0b >>>>>>>>>>>(1.b+12) ubyte 0x56 >>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display # FAT1X version >>>>>>>>>>>>>(1.b+5) ubyte 0x5b >>>>>>>>>>>>>>0x5b string >\0 "%-s" # FAT32 version >>>>>>>>>>>>>(1.b+5) ubyte 0x77 >>>>>>>>>>>>>>0x77 string >\0 "%-s" a764 12 # added by Joerg Jenderek at Nov 2012 # http://www.thenakedpc.com/articles/v04/08/0408-05.html # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 0 string PNCIHISK\0 Norton Utilities disc image data # real x86 boot sector with jump instruction >509 search/1026 \x55\xAA\xeb >>&-1 indirect x \b; contains # http://file-extension.net/seeker/file_extension_dat 0 string PNCIUNDO Norton Disk Doctor UnDo file # d779 101 a879 3 # DOS x86 sector separated and moved from "x86 boot sector" by Joerg Jenderek at May 2011 d884 38 d936 1 a936 1 # updated by Joerg Jenderek at Oct 2008 and Sep 2012 d938 1 a938 5 # tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 # assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 0 ulequad&0x909000007cc0eafa 0x909000007c40eafa >631 search/689 ISOLINUX\ isolinux Loader >>&0 string x (version %-4.4s) d940 2 a941 127 # assembler instructions: jmp 7C05 0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) # assembler instructions: pushfd;pushad 0 ulelong 0x60669c66 pxelinux loader # assembler instructions: jmp 05 0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) # http://syslinux.zytor.com/wiki/index.php/SYSLINUX 0 string LDLINUX\ SYS\ SYSLINUX loader >12 string x (older version %-4.4s) 0 string \r\nSYSLINUX\ SYSLINUX loader >11 string x (version %-4.4s) # syslinux updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 # assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 0 ulelong&0x80909bEB 0x009018EB # OEM-ID not always "SYSLINUX" >434 search/47 Boot\ failed # followed by \r\n\0 or :\ >>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) >>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) >459 search/30 Boot\ error\r\n\0 >>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) # SYSLINUX MBR updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 # assembler instructions: mov di,0600h;mov cx,0100h 16 search/4 \xbf\x00\x06\xb9\x00\x01 >94 search/249 Missing\ operating\ system # followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other # skip Ranish MBR >>408 search/4 HD1/\0 >>408 default x >>>250 search/118 \0Operating\ system\ load SYSLINUX MBR # followed by "ing " or space >>>>292 search/98 error >>>>>&0 string \r (version 3.35 or older) >>>>>&0 string .\r (version 3.52 or newer) >>>>>&0 default x (version 3.36-3.51 ) >368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR >>156 search/10 \0Boot\ partition\ not\ found\r\n >>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) >>174 search/10 \0Missing\ OS\r\n >>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) # SYSLINUX END # NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 # assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 0 ubequad 0x31c08ed0bc007c8e # mbr_bootsel magic before partition table not reliable with small ipl fragments #>444 uleshort 0xb5e1 >0004 uleshort x # ERRorTeXT >>181 search/166 Error\ \0\r\n NetBSD mbr # NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS >>>0x1B8 ubelong >0 \b,Serial 0x%-.8x # BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx >>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector # BOOT_EXTENDED definitions contains assembler instructions: # xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 >>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended # COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al >>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO # not TERSE_ERROR >>>196 search/106 No\ active\ partition\0 >>>>&0 string Disk\ read\ error\0 >>>>>&0 string No\ operating\ system\0 \b,verbose # not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 >>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS # not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 >>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check # assembler instructions: movw nametab,bx >>>0x26 search/21 \xBB\x94\x07 # not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf >>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 >>>>>181 search/166 Error\ \0 # "a: disk" , "Fn: diskn" or "NetBSD MBR boot" >>>>>>&3 string x \b,"%s" # Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html # added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 # assembler instructions: jmp short 0x58;nop;ASCII 0 ubequad&0xeb58908000000000 0xeb58900000000000 # assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, >(1.b+2) ubequad 0xfa31c08ed88ec08e # Error messages at end of code >>376 string No\ operating\ system\r\n\0 >>>398 string Disk\ error\r\n\0FDD\0HDD\0 >>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr # Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ # added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 # for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, # or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC # pointer to the data starting with Neil Turton signature string >(0x1BC.s) string NDTmbr >>&-14 string 1234F\0 Turton mbr ( # parameters also viewed by install-mbr --list >>>(0x1BC.s+7) ubyte x \b%u<= >>>(0x1BC.s+9) ubyte x \bVersion<=%u #>>>(0x1BC.s+8) ubyte x asm_flag_%x >>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix # variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode >>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk #0x1~1,..,0x8~4,0x10~F,0x80~A enabled #>>>(0x1BC.s+10) ubyte x \b,flags 0x%x #0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot #>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x # for older versions >>>(0x1BC.s+9) ubyte <2 #>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds >>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds # floppy A: or B: >>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x >>>>(0x1BC.s+13) ubyte >1 # 1st hard disc #>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x # not 1st hard disc >>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x # for version >= 2 maximal timeout can be 65534 >>>(0x1BC.s+9) ubyte >1 #>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds >>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds # floppy A: or B: >>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x >>>>(0x1BC.s+14) ubyte >1 # 1st hard disc #>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x # not 1st hard disc >>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x >>>0 ubyte x \b) a997 162 # DOS x86 sector updated and separated from "x86 boot sector" by Joerg Jenderek at May 2011 # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 # over BIOS parameter block (BPB) # http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD # older drives may use Near JuMP instruction E9 xx xx # minimal short forward jump found 0x29 for bootloaders or 0x0 # maximal short forward jump is 0x7f # OEM-ID is empty or contain readable bytes 0 ulelong&0x804000E9 0x000000E9 # mtools-3.9.8/msdos.h # usual values are marked with comments to get only informations of strange FAT systems # valid sectorsize must be a power of 2 from 32 to 32768 >11 uleshort&0xf001f 0 >>11 uleshort <32769 >>>11 uleshort >31 >>>>21 ubyte&0xf0 0xF0 >>>>>0 ubyte 0xEB >>>>>>1 ubyte x \b, code offset 0x%x+2 >>>>>0 ubyte 0xE9 >>>>>>1 uleshort x \b, code offset 0x%x+2 >>>>>3 string >\0 \b, OEM-ID "%-.8s" #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC >>>>>>8 string IHC \b cached by Windows 9M >>>>>11 uleshort >512 \b, Bytes/sector %u #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) >>>>>11 uleshort <512 \b, Bytes/sector %u >>>>>13 ubyte >1 \b, sectors/cluster %u #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) >>>>>82 string FAT32 >>>>>>14 uleshort !32 \b, reserved sectors %u #>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) >>>>>82 string !FAT32 >>>>>>14 uleshort >1 \b, reserved sectors %u #>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) #>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) >>>>>16 ubyte >2 \b, FATs %u #>>>>>16 ubyte =2 \b, FATs %u (usual) >>>>>16 ubyte =1 \b, FAT %u >>>>>16 ubyte >0 >>>>>17 uleshort >0 \b, root entries %u #>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) #>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x >>>>>22 uleshort >0 \b, sectors/FAT %u #>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) >>>>>24 uleshort x \b, sectors/track %u >>>>>26 ubyte >2 \b, heads %u #>>>>>26 ubyte =2 \b, heads %u (usual floppy) >>>>>26 ubyte =1 \b, heads %u # valid only for sector sizes with more then 32 Bytes >>>>>11 uleshort >32 # skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk >>>>>>38 ubyte !0x70 >>>>>>>28 ulelong >0 \b, hidden sectors %u #>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) #>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) # FAT<32 bit specific >>>>>>>82 string !FAT32 #>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) #>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) >>>>>>>>36 ubyte !0x80 >>>>>>>>>36 ubyte !0 \b, physical drive 0x%x >>>>>>>>37 ubyte >0 \b, reserved 0x%x #>>>>>>>>37 ubyte =0 \b, reserved 0x%x # value is 0x80 for NTFS >>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>>>38 ubyte =0x29 >>>>>>>>>39 ulelong x \b, serial number 0x%x >>>>>>>>>43 string >>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" >>>>>>>>>43 string =NO\ NAME \b, unlabeled # there exist some old floppies without word FAT at offset 54 # a word like "FATnm " is only a hint for a FAT size on nm-bits # Normally the number of clusters is calculated by the values of BPP. # if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, # otherwise FAT is 16 bit. # http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html >>>>>>54 string FAT \b, FAT >>>>>>>54 string FAT12 \b (12 bit) >>>>>>>54 string FAT16 \b (16 bit) # FAT32 bit specific >>>>>82 string FAT32 \b, FAT (32 bit) >>>>>>36 ulelong x \b, sectors/FAT %u # http://technet.microsoft.com/en-us/library/cc977221.aspx >>>>>>40 uleshort >0 \b, extension flags 0x%x #>>>>>>40 uleshort =0 \b, extension flags %u >>>>>>42 uleshort >0 \b, fsVersion %u #>>>>>>42 uleshort =0 \b, fsVersion %u (usual) >>>>>>44 ulelong >2 \b, rootdir cluster %u #>>>>>>44 ulelong =2 \b, rootdir cluster %u #>>>>>>44 ulelong =1 \b, rootdir cluster %u >>>>>>48 uleshort >1 \b, infoSector %u #>>>>>>48 uleshort =1 \b, infoSector %u (usual) >>>>>>48 uleshort <1 \b, infoSector %u >>>>>>50 uleshort >6 \b, Backup boot sector %u #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) >>>>>>50 uleshort <6 \b, Backup boot sector %u # corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO >>>>>>52 ulelong >0 \b, reserved1 0x%x >>>>>>56 ulelong >0 \b, reserved2 0x%x >>>>>>60 ulelong >0 \b, reserved3 0x%x # same structure as FAT1X #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) >>>>>>64 ubyte !0x80 >>>>>>>64 ubyte >0 \b, physical drive 0x%x # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too >>>>>>65 ubyte >0 \b, reserved 0x%x >>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>66 ubyte =0x29 >>>>>>>67 ulelong x \b, serial number 0x%x >>>>>>>71 string >>>>>>71 string >NO\ NAME \b, label: "%11.11s" >>>>>>>71 string =NO\ NAME \b, unlabeled # additional tests for floppy image added by Joerg Jenderek # no fixed disk >>>>>21 ubyte !0xF8 # floppy media with 12 bit FAT >>>>>>54 string !FAT16 # test for FAT after bootsector >>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT # floppy image !:mime application/x-ima # NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm # and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html # 0 FATs >>>>>16 ubyte =0 # 0 root entries >>>>>>17 uleshort =0 # 0 DOS sectors >>>>>>>19 uleshort =0 # 0 sectors/FAT # dos < 4.0 BootSector value found is 0x80 #38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) >>>>>>>>22 uleshort =0 \b; NTFS >>>>>>>>>24 uleshort >0 \b, sectors/track %u >>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x >>>>>>>>>40 ulequad >0 \b, sectors %lld >>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld >>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld # Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. # Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. >>>>>>>>>64 lelong <256 >>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi) # Values 0 to 127 represent index block sizes of 0 to 127 clusters. # Values 128 to 255 represent index block sizes of 2^(256-N) byte >>>>>>>>>68 ulelong <256 >>>>>>>>>>68 ulelong <128 \b, clusters/index block %d #>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi) >>>>>>>>>72 ulequad x \b, serial number 0%llx >>>>>>>>>80 ulelong >0 \b, checksum 0x%x #>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) >>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 >>>>>>>>>>&-92 indirect x \b; contains ### DOS boot sector end a1159 37 # Minix filesystems - Juan Cespedes 0x410 leshort 0x137f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x137f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x138f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x138f !:strength / 2 >0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2468 >0x402 beshort < 100 Minix filesystem, V2, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x2468 >0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2478 >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 leshort 0x2478 >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x2478 >0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones >0x1e string minix \b, bootable 0x410 leshort 0x4d5a >0x402 beshort !0 Minix filesystem, V3, %d zones >0x1e string minix \b, bootable d1246 1 a1246 1 >32808 string/T >\0 '%s' a1571 23 # LFS 0 lelong 0x070162 LFS filesystem image >4 lelong 1 version 1, >>8 lelong x \b blocks %u, >>12 lelong x \b blocks per segment %u, >4 lelong 2 version 2, >>8 lelong x \b fragments %u, >>12 lelong x \b bytes per segment %u, >16 lelong x \b disk blocks %u, >20 lelong x \b block size %u, >24 lelong x \b fragment size %u, >28 lelong x \b fragments per block %u, >32 lelong x \b start for free list %u, >36 lelong x \b number of free blocks %d, >40 lelong x \b number of files %u, >44 lelong x \b blocks available for writing %d, >48 lelong x \b inodes in cache %d, >52 lelong x \b inode file disk address 0x%x, >56 lelong x \b inode file inode number %u, >60 lelong x \b address of last segment written 0x%x, >64 lelong x \b address of next segment to write 0x%x, >68 lelong x \b address of current segment written 0x%x @ 1.1.1.4 log @import file-5.14 changes are "name" + "use" keyword features, bug fixes @ text @d3 1 a3 1 # $File: filesystems,v 1.77 2013/03/14 01:38:30 christos Exp $ d63 2 a64 3 # to display x86 boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) # DOS BPB information (70) and after DOS floppy (120) like in previous file version !:strength +72 d73 1 a73 1 # to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version d76 2 a77 149 # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/ # and http://en.wikipedia.org/wiki/Master_Boot_Record # test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by # characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 >0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR # Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) # assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld >>8 ubequad 0x8bf45007501ffbfc # http://thestarman.pcministry.com/asm/mbr/200MBR.htm >>>0x16 ubyte 0xF3 \b,DOS 2 >>>>219 regex Author\ -\ Author: # found "David Litton" , "A Pehrsson " >>>>>&0 string x "%s" >>>0x16 ubyte 0xF2 # NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm # assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz >>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 # version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) >>>>0x22 default x \b,D0S version 3.3-7.0 # error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) # where nn is string offset varying for different languages # "Invalid partition table" nn=0x8b for english version >>>>>(0x49.b) string Invalid\ partition\ table english >>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german >>>>>(0x49.b) string Table\ de\ partition\ invalide french >>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese >>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish >>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian >>>>>0x49 ubyte >0 at offset 0x%x >>>>>>(0x49.b) string >\0 "%s" # "Error loading operating system" nn=0xa3 for english version # "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version # "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version # "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version # "Error al cargar sistema operativo" nn=0xa8 for spanish version # "Errore durante il caricamento del sistema operativo" nn=0xae for italian version >>>>>0x74 ubyte >0 at offset 0x%x >>>>>>(0x74.b) string >\0 "%s" # "Missing operating system" nn=0xc2 for english version # "Betriebssystem fehlt" nn=0xcd for german version # "Syst\212me d'exploitation absent" nn=0xd2 for french version # "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version # "Falta sistema operativo" nn=0xca for spanish version # "Sistema operativo mancante" nn=0xe2 for italian version >>>>>0x79 ubyte >0 at offset 0x%x >>>>>>(0x79.b) string >\0 "%s" # Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) # assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b >>8 ubequad 0x5007501ffcbe1b7c # assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 >>>24 ubequad 0xf3a4cbbebe07b104 9M # "Invalid partition table" nn=0x10F for english version # "Ungültige Partitionstabelle" nn=0x10F for german version # "Table de partition erronée" nn=0x10F for french version # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version >>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english >>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german >>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french >>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian >>>>0x3C ubyte x at offset 0x%x+0xFF >>>>(0x3C.b+0x0FF) string >\0 "%s" # "Error loading operating system" nn=0x127 for english version # "Fehler beim Laden des Betriebssystems" nn=0x12b for german version # "Erreur lors du chargement du système d'exploitation" nn=0x12a for french version # "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version >>>>0xBD ubyte x at offset 0x1%x >>>>(0xBD.b+0x100) string >\0 "%s" # "Missing operating system" nn=0x146 for english version # "Betriebssystem fehlt" nn=0x151 for german version # "Système d'exploitation manquant" nn=0x15e for french version # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version >>>>0xA9 ubyte x at offset 0x1%x >>>>(0xA9.b+0x100) string >\0 "%s" # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm # assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 >>>24 ubequad 0xf3a4cbbdbe07b104 XP # where xxyyzz are lower bits from offsets of error messages varying for different languages >>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english >>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german # "Invalid partition table" xx=0x12C for english version # "Ungültige Partitionstabelle" xx=0x12C for german version >>>>0x1b5 ubyte >0 at offset 0x1%x >>>>(0x1b5.b+0x100) string >\0 "%s" # "Error loading operating system" yy=0x144 for english version # "Fehler beim Laden des Betriebssystems" yy=0x148 for german version >>>>0x1b6 ubyte >0 at offset 0x1%x >>>>(0x1b6.b+0x100) string >\0 "%s" # "Missing operating system" zz=0x163 for english version # "Betriebssystem nicht vorhanden" zz=0x16e for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" # Microsoft Windows Vista or 7 # assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 >>8 ubequad 0xc08ed8be007cbf00 # Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) # assembler instructions: jnz 0729;cmp ebx,"TCPA" >>>0xEC ubequad 0x753b6681fb544350 Vista # where xxyyzz are lower bits from offsets of error messages varying for different languages >>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english #>>>>0x1B4 ubelong&0x00FFFFFF ? german # "Invalid partition table" xx=0x162 for english version # "Ungültige Partitionstabelle" xx=0x1?? for german version >>>>0x1b5 ubyte >0 at offset 0x1%x >>>>(0x1b5.b+0x100) string >\0 "%s" # "Error loading operating system" yy=0x17a for english version # "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version >>>>0x1b6 ubyte >0 at offset 0x1%x >>>>(0x1b6.b+0x100) string >\0 "%s" # "Missing operating system" zz=0x199 for english version # "Betriebssystem nicht vorhanden" zz=0x1?? for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" # Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm) # assembler instructions: cmp ebx,"TCPA";cmp >>>0xEC ubequad 0x6681fb5443504175 Windows 7 # where xxyyzz are lower bits from offsets of error messages varying for different languages >>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english #>>>>0x1B4 ubelong&0x00FFFFFF ? german # "Invalid partition table" xx=0x163 for english version # "Ungültige Partitionstabelle" xx=0x1?? for german version >>>>0x1b5 ubyte >0 at offset 0x1%x >>>>(0x1b5.b+0x100) string >\0 "%s" # "Error loading operating system" yy=0x17b for english version # "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version >>>>0x1b6 ubyte >0 at offset 0x1%x >>>>(0x1b6.b+0x100) string >\0 "%s" # "Missing operating system" zz=0x19a for english version # "Betriebssystem nicht vorhanden" zz=0x1?? for german version >>>>0x1b7 ubyte >0 at offset 0x1%x >>>>(0x1b7.b+0x100) string >\0 "%s" # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs # http://en.wikipedia.org/wiki/MBR_disk_signature#ID >>0x1b8 ulelong >0 \b, disk signature 0x%-.4x # driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm >>0xDA uleshort 0 >>>0xDC ulelong >0 \b, created # physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive >>>>0xDC ubyte x with driveID 0x%x # hours, minutes and seconds >>>>0xDf ubyte x at %x >>>>0xDe ubyte x \b:%x >>>>0xDd ubyte x \b:%x # special case for Microsoft MS-DOS 3.21 spanish # assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov >0 ubequad 0xfab830008ed0bc00 # assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov >>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish # Microsoft MBR IPL end d96 24 a119 3 # # tests for different MS-DOS Master Boot Records (MBR) moved and merged # d293 1 a293 1 # skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut a789 8 # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO # and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector >0 string RRaA >>0x1E4 string rrAa \b, FSInfosector #>>0x1FC uleshort =0 SHOULD BE ZERO >>>0x1E8 ulelong <0xffffffff \b, %u free clusters >>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u a867 2 # to display SYSLINUX MBR (36) before old x86 boot sector one with partition table (strength=50+21) !:strength +36 d1187 1 a1187 11 # For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 # http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm # unused assembler instructions JMP y2;NOP;NOP 0x056 ulelong&0xFFFF0FFF 0x909002EB # unicode loadername terminated by CTRL-D >(0.s*2) ulelong&0xFFFFFF00 0x00040000 # loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR >>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s >>0x12 string $ >>>0x0c lestring16 x \b%-2.2s ### DOS,NTFS boot sectors end d1354 1 a1354 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1, %d zones d1358 1 a1358 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones d1362 1 a1362 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones d1366 1 a1366 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones d1369 1 a1369 2 >0x402 beshort < 100 >>0x402 beshort > -1 Minix filesystem, V2, %d zones d1372 1 a1372 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones d1376 1 a1376 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones d1379 1 a1379 2 >0x402 beshort < 100 >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones d1457 2 a1458 2 # 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 # 11110000 High density 3 1/2 floppy disk d1645 2 a1822 15 0 string td\000 floppy image data (TeleDisk, compressed) 0 string TD\000 floppy image data (TeleDisk) 0 string CQ\024 floppy image data (CopyQM, >16 leshort x %d sectors, >18 leshort x %d heads.) 0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 0 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 0 beshort 0xAA59 floppy image data (IBM SaveDskF) 0 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) 0 string \074CPM_Disk\076 disk image data (YAZE) @ 1.1.1.5 log @from ftp.astron.com, this is a bug fix release: * always leave magic file loaded, don't unload for magic_check, etc. * fix default encoding to binary instead of unknown which broke recently * handle empty and one byte files, less specially so that --mime-encoding does not break completely. * fix erroneous non-zero exit code from non-existant file and message * add CDF MSI file detection (Guy Helmer) @ text @d1 1 d3 1 a3 1 # $File: filesystems,v 1.85 2013/11/19 23:54:05 christos Exp $ a5 182 0 name partid >0 ubyte 0x00 Unused >0 ubyte 0x01 12-bit FAT >0 ubyte 0x02 XENIX / >0 ubyte 0x03 XENIX /usr >0 ubyte 0x04 16-bit FAT, less than 32M >0 ubyte 0x05 extended partition >0 ubyte 0x06 16-bit FAT, more than 32M >0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX >0 ubyte 0x08 AIX or os, or etc. >0 ubyte 0x09 AIX boot partition or Coherent >0 ubyte 0x0a O/2 boot manager or Coherent swap >0 ubyte 0x0b 32-bit FAT >0 ubyte 0x0c 32-bit FAT, LBA-mapped >0 ubyte 0x0d 7XXX, LBA-mapped >0 ubyte 0x0e 16-bit FAT, LBA-mapped >0 ubyte 0x0f extended partition, LBA-mapped >0 ubyte 0x10 OPUS >0 ubyte 0x11 OS/2 DOS 12-bit FAT >0 ubyte 0x12 Compaq diagnostics >0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M >0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M >0 ubyte 0x17 OS/2 hidden IFS >0 ubyte 0x18 AST Windows swapfile >0 ubyte 0x19 Willowtech Photon coS >0 ubyte 0x1b hidden win95 fat 32 >0 ubyte 0x1c hidden win95 fat 32 lba >0 ubyte 0x1d hidden win95 fat 16 lba >0 ubyte 0x20 Willowsoft OFS1 >0 ubyte 0x21 reserved >0 ubyte 0x23 reserved >0 ubyte 0x24 NEC DOS >0 ubyte 0x26 reserved >0 ubyte 0x31 reserved >0 ubyte 0x32 Alien Internet Services NOS >0 ubyte 0x33 reserved >0 ubyte 0x34 reserved >0 ubyte 0x35 JFS on OS2 >0 ubyte 0x36 reserved >0 ubyte 0x38 Theos >0 ubyte 0x39 Plan 9, or Theos spanned >0 ubyte 0x3a Theos ver 4 4gb partition >0 ubyte 0x3b Theos ve 4 extended partition >0 ubyte 0x3c PartitionMagic recovery >0 ubyte 0x3d Hidden Netware >0 ubyte 0x40 VENIX 286 or LynxOS >0 ubyte 0x41 PReP >0 ubyte 0x42 linux swap sharing DRDOS disk >0 ubyte 0x43 linux sharing DRDOS disk >0 ubyte 0x44 GoBack change utility >0 ubyte 0x45 Boot US Boot manager >0 ubyte 0x46 EUMEL/Elan or Ergos 3 >0 ubyte 0x47 EUMEL/Elan or Ergos 3 >0 ubyte 0x48 EUMEL/Elan or Ergos 3 >0 ubyte 0x4a ALFX/THIN filesystem for DOS >0 ubyte 0x4c Oberon partition >0 ubyte 0x4d QNX4.x >0 ubyte 0x4e QNX4.x 2nd part >0 ubyte 0x4f QNX4.x 3rd part >0 ubyte 0x50 DM (disk manager) >0 ubyte 0x51 DM6 Aux1 (or Novell) >0 ubyte 0x52 CP/M or Microport SysV/AT >0 ubyte 0x53 DM6 Aux3 >0 ubyte 0x54 DM6 DDO >0 ubyte 0x55 EZ-Drive (disk manager) >0 ubyte 0x56 Golden Bow (disk manager) >0 ubyte 0x57 Drive PRO >0 ubyte 0x5c Priam Edisk (disk manager) >0 ubyte 0x61 SpeedStor >0 ubyte 0x63 GNU HURD or Mach or Sys V/386 >0 ubyte 0x64 Novell Netware 2.xx or Speedstore >0 ubyte 0x65 Novell Netware 3.xx >0 ubyte 0x66 Novell 386 Netware >0 ubyte 0x67 Novell >0 ubyte 0x68 Novell >0 ubyte 0x69 Novell >0 ubyte 0x70 DiskSecure Multi-Boot >0 ubyte 0x71 reserved >0 ubyte 0x73 reserved >0 ubyte 0x74 reserved >0 ubyte 0x75 PC/IX >0 ubyte 0x76 reserved >0 ubyte 0x77 M2FS/M2CS partition >0 ubyte 0x78 XOSL boot loader filesystem >0 ubyte 0x80 MINIX until 1.4a >0 ubyte 0x81 MINIX since 1.4b >0 ubyte 0x82 Linux swap or Solaris >0 ubyte 0x83 Linux native >0 ubyte 0x84 OS/2 hidden C: drive >0 ubyte 0x85 Linux extended partition >0 ubyte 0x86 NT FAT volume set >0 ubyte 0x87 NTFS volume set or HPFS mirrored >0 ubyte 0x8a Linux Kernel AiR-BOOT partition >0 ubyte 0x8b Legacy Fault tolerant FAT32 >0 ubyte 0x8c Legacy Fault tolerant FAT32 ext >0 ubyte 0x8d Hidden free FDISK FAT12 >0 ubyte 0x8e Linux Logical Volume Manager >0 ubyte 0x90 Hidden free FDISK FAT16 >0 ubyte 0x91 Hidden free FDISK DOS EXT >0 ubyte 0x92 Hidden free FDISK FAT16 Big >0 ubyte 0x93 Amoeba filesystem >0 ubyte 0x94 Amoeba bad block table >0 ubyte 0x95 MIT EXOPC native partitions >0 ubyte 0x97 Hidden free FDISK FAT32 >0 ubyte 0x98 Datalight ROM-DOS Super-Boot >0 ubyte 0x99 Mylex EISA SCSI >0 ubyte 0x9a Hidden free FDISK FAT16 LBA >0 ubyte 0x9b Hidden free FDISK EXT LBA >0 ubyte 0x9f BSDI? >0 ubyte 0xa0 IBM Thinkpad hibernation >0 ubyte 0xa1 HP Volume expansion (SpeedStor) >0 ubyte 0xa3 HP Volume expansion (SpeedStor) >0 ubyte 0xa4 HP Volume expansion (SpeedStor) >0 ubyte 0xa5 386BSD partition type >0 ubyte 0xa6 OpenBSD partition type >0 ubyte 0xa7 NeXTSTEP 486 >0 ubyte 0xa8 Apple UFS >0 ubyte 0xa9 NetBSD partition type >0 ubyte 0xaa Olivetty Fat12 1.44MB Service part >0 ubyte 0xab Apple Boot >0 ubyte 0xae SHAG OS filesystem >0 ubyte 0xaf Apple HFS >0 ubyte 0xb0 BootStar Dummy >0 ubyte 0xb1 reserved >0 ubyte 0xb3 reserved >0 ubyte 0xb4 reserved >0 ubyte 0xb6 reserved >0 ubyte 0xb7 BSDI BSD/386 filesystem >0 ubyte 0xb8 BSDI BSD/386 swap >0 ubyte 0xbb Boot Wizard Hidden >0 ubyte 0xbe Solaris 8 partition type >0 ubyte 0xbf Solaris partition type >0 ubyte 0xc0 CTOS >0 ubyte 0xc1 DRDOS/sec (FAT-12) >0 ubyte 0xc2 Hidden Linux >0 ubyte 0xc3 Hidden Linux swap >0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) >0 ubyte 0xc5 DRDOS/sec (EXT) >0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) >0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled >0 ubyte 0xc8 Reserved for DR-DOS 8.0+ >0 ubyte 0xc9 Reserved for DR-DOS 8.0+ >0 ubyte 0xca Reserved for DR-DOS 8.0+ >0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS >0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA >0 ubyte 0xcd CTOS Memdump >0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA >0 ubyte 0xcf DR-DOS 7.04+ EXT LBA >0 ubyte 0xd0 REAL/32 secure big partition >0 ubyte 0xd1 Old Multiuser DOS FAT12 >0 ubyte 0xd4 Old Multiuser DOS FAT16 Small >0 ubyte 0xd5 Old Multiuser DOS Extended >0 ubyte 0xd6 Old Multiuser DOS FAT16 Big >0 ubyte 0xd8 CP/M 86 >0 ubyte 0xdb CP/M or Concurrent CP/M >0 ubyte 0xdd Hidden CTOS Memdump >0 ubyte 0xde Dell PowerEdge Server utilities >0 ubyte 0xdf DG/UX virtual disk manager >0 ubyte 0xe0 STMicroelectronics ST AVFS >0 ubyte 0xe1 DOS access or SpeedStor 12-bit >0 ubyte 0xe3 DOS R/O or Storage Dimensions >0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. >0 ubyte 0xe5 reserved >0 ubyte 0xe6 reserved >0 ubyte 0xeb BeOS >0 ubyte 0xee GPT Protective MBR >0 ubyte 0xef EFI system partition >0 ubyte 0xf0 Linux PA-RISC boot loader >0 ubyte 0xf1 SpeedStor or Storage Dimensions >0 ubyte 0xf2 DOS 3.3+ Secondary >0 ubyte 0xf3 reserved >0 ubyte 0xf4 SpeedStor large partition >0 ubyte 0xf5 Prologue multi-volumen partition >0 ubyte 0xf6 reserved >0 ubyte 0xf9 pCache: ext2/ext3 persistent cache >0 ubyte 0xfa Bochs x86 emulator >0 ubyte 0xfb VMware File System >0 ubyte 0xfc VMware Swap >0 ubyte 0xfd Linux RAID partition persistent sb >0 ubyte 0xfe LANstep or IBM PS/2 IML >0 ubyte 0xff Xenix Bad Block Table d60 1 a60 12 # added by Joerg Jenderek at Nov 2012 # http://www.thenakedpc.com/articles/v04/08/0408-05.html # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 0 string PNCIHISK\0 Norton Utilities disc image data # real x86 boot sector with jump instruction >509 search/1026 \x55\xAA\xeb >>&-1 indirect x \b; contains # http://file-extension.net/seeker/file_extension_dat 0 string PNCIUNDO Norton Disk Doctor UnDo file # # DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011 d63 1 a63 1 # to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) d68 1 a68 1 >>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector d70 2 a71 2 >0x1FE leshort 0xAA55 DOS/MBR boot sector # keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying d73 1 a73 2 0x1FE leshort 0xAA55 DOS/MBR boot sector !:strength +72 d75 1 a75 1 #!:strength +21 d339 54 a392 31 # mbr partition table entries updated by Joerg Jenderek at Sep 2013 # skip Norton Utilities disc image data >3 string !IHISK # skip Linux style boot sector starting with assember instructions mov 0x7c0,ax; >>0 belong !0xb8c0078e # not Linux kernel >>>514 string !HdrS # not BeOS >>>>422 string !Be\ Boot\ Loader # jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr >>>>>0 ubelong&0xFD000000 =0xE9000000 # AdvanceMAME mbr >>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e >>>>>>>446 use partition-table # mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader >>>>>0 ubelong&0xFD000000 !0xE9000000 # skip FSInfosector >>>>>>0 string !RRaA # skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, # http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm >>>>>>>0 ubequad !0xfa660fb64610668b # skip 13rd sector of MS x86 bootloader >>>>>>>>0 ubequad !0x660fb64610668b4e # skip sector starting with DOS new line >>>>>>>>>0 string !\r\n # allowed active flag 0,80h-FFh >>>>>>>>>>446 ubyte 0 >>>>>>>>>>>446 use partition-table >>>>>>>>>>446 ubyte >0x7F >>>>>>>>>>>446 use partition-table # TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries a916 37 # by Joerg Jenderek at Apr 2013 # Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension # like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 0 name DOS-filename # space=0x20 (00100000b) means empty >0 ubyte&0xDF >0 >>0 ubyte x \b%c >>>1 ubyte&0xDF >0 >>>>1 ubyte x \b%c >>>>>2 ubyte&0xDF >0 >>>>>>2 ubyte x \b%c >>>>>>>3 ubyte&0xDF >0 >>>>>>>>3 ubyte x \b%c >>>>>>>>>4 ubyte&0xDF >0 >>>>>>>>>>4 ubyte x \b%c >>>>>>>>>>>5 ubyte&0xDF >0 >>>>>>>>>>>>5 ubyte x \b%c >>>>>>>>>>>>>6 ubyte&0xDF >0 >>>>>>>>>>>>>>6 ubyte x \b%c >>>>>>>>>>>>>>>7 ubyte&0xDF >0 >>>>>>>>>>>>>>>>7 ubyte x \b%c # DOS filename extension >>8 ubyte&0xDF >0 \b. >>>8 ubyte x \b%c >>>>9 ubyte&0xDF >0 >>>>>9 ubyte x \b%c >>>>>>10 ubyte&0xDF >0 >>>>>>>10 ubyte x \b%c # Print 2 following DOS filenames from directory entry form # like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 0 name 2xDOS-filename # display 1 space >0 ubyte x \b >0 use DOS-filename >11 ubyte x \b+ >11 use DOS-filename d925 11 d951 1 a951 1 # DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 a953 50 # http://en.wikipedia.org/wiki/Master_boot_record#PTE # display standard partition table 0 name partition-table #>0 ubyte x PARTITION-TABLE # test and display 1st til 4th partition table entry >0 use partition-entry-test >16 use partition-entry-test >32 use partition-entry-test >48 use partition-entry-test # test for entry of partition table 0 name partition-entry-test # partition type ID > 0 >4 ubyte >0 # active flag 0 >>0 ubyte 0 >>>0 use partition-entry # active flag 0x80, 0x81, ... >>0 ubyte >0x7F >>>0 use partition-entry # Print entry of partition table 0 name partition-entry # partition type ID > 0 >4 ubyte >0 \b; partition >>64 leshort 0xAA55 1 >>48 leshort 0xAA55 2 >>32 leshort 0xAA55 3 >>16 leshort 0xAA55 4 >>4 ubyte x : ID=0x%x >>0 ubyte&0x80 0x80 \b, active >>0 ubyte >0x80 0x%x >>1 ubyte x \b, start-CHS ( >>1 use partition-chs >>5 ubyte x \b), end-CHS ( >>5 use partition-chs >>8 ulelong x \b), startsector %u >>12 ulelong x \b, %u sectors # Print cylinder,head,sector (CHS) of partition entry 0 name partition-chs # cylinder >1 ubyte x \b0x >1 ubyte&0xC0 0x40 \b1 >1 ubyte&0xC0 0x80 \b2 >1 ubyte&0xC0 0xC0 \b3 >2 ubyte x \b%x # head >0 ubyte x \b,%u # sector >1 ubyte&0x3F x \b,%u d990 1 a990 1 # syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 d1000 1 a1000 1 # SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 d1003 1 a1003 1 # to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) d1164 1 a1164 1 # DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 d1556 2 a1557 4 # http://en.wikipedia.org/wiki/BIOS_parameter_block # floppies with valid BPB and any instruction at beginning >19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy >19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy d1561 4 a1564 4 19 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector d1566 6 a1571 1 >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector d1573 2 a1574 13 19 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 19 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 19 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k # | | | | | # | | | | heads # | | | sectors/track # | | sectors/FAT # | media descriptor # BPB: sectors a1616 73 # all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 # http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions 512 ubelong&0xE0ffff00 0xE0ffff00 # without valid Media descriptor in place of BPB, cases with are done at other places >21 ubyte <0xE5 floppy with old FAT filesystem # but valid Media descriptor at begin of FAT #>>512 ubyte =0xed 720k #>>512 ubyte =0xf0 1440k #>>512 ubyte =0xf8 720k #>>512 ubyte =0xf9 1220k #>>512 ubyte =0xfa 320k #>>512 ubyte =0xfb 640k >>512 ubyte =0xfc 180k # look like an an old DOS directory entry >>>0xA0E ubequad 0 >>>>0xA00 ubequad !0 !:mime application/x-ima >>512 ubyte =0xfd # look for 2nd FAT at different location to distinguish between 360k and 500k >>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k #>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k >>>0xA0E ubequad 0 !:mime application/x-ima >>512 ubyte =0xfe >>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k >>>>0x60E ubequad 0 >>>>>0x600 ubequad !0 !:mime application/x-ima #>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k >>512 ubyte =0xff 320k >>>0x60E ubequad 0 >>>>0x600 ubequad !0 !:mime application/x-ima >>512 ubyte x \b, Media descriptor 0x%x # without x86 jump instruction >>0 ulelong&0x804000E9 !0x000000E9 # assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV >>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader # IOSYS.COM+MSDOS.COM >>>>0xc4 use 2xDOS-filename >>0 ulelong&0x804000E9 =0x000000E9 # only x86 short jump instruction found >>>0 ubyte =0xEB >>>>1 ubyte x \b, code offset 0x%x+2 # http://thestarman.pcministry.com/DOS/ibm100/Boot.htm # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 >>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader # ibmbio.com+ibmdos.com >>>>>0x176 use DOS-filename >>>>>0x181 ubyte x \b+ >>>>>0x182 use DOS-filename # http://thestarman.pcministry.com/DOS/ibm110/Boot.htm # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV >>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader # ibmbio.com+ibmdos.com >>>>>0x18b use DOS-filename >>>>>0x196 ubyte x \b+ >>>>>0x197 use DOS-filename # http://en.wikipedia.org/wiki/Zenith_Data_Systems # assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 >>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader # IO.SYS+MSDOS.SYS >>>>>0x20 use 2xDOS-filename # http://en.wikipedia.org/wiki/Corona_Data_Systems # assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; >>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader # IO.SYS+MSDOS.SYS >>>>>0x69 use 2xDOS-filename # assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; >>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader # defect IO.SYS+MSDOS.SYS ? #>>>>>0x162 use 2xDOS-filename d1633 1 a1633 1 32777 string CDROM High Sierra CD-ROM filesystem data a1990 9 # ReFS # Richard W.M. Jones 0 string \0\0\0ReFS\0 ReFS filesystem image # EFW encase image file format: # Gregoire Passault # http://www.forensicswiki.org/wiki/Encase_image_file_format 0 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format @ 1.1.1.6 log @import file-5.19 2014-06-09 9:04 Christos Zoulas * Misc buffer overruns and missing buffer size tests in cdf parsing (Francisco Alonso, Jan Kaluza) 2014-06-02 14:50 Christos Zoulas * Enforce limit of 8K on regex searches that have no limits * Allow the l modifier for regex to mean line count. Default to byte count. If line count is specified, assume a max of 80 characters per line to limit the byte count. * Don't allow conversions to be used for dates, allowing the mask field to be used as an offset. 2014-05-30 12:51 Christos Zoulas * Make the range operator limit the length of the regex search. 2014-05-14 19:23 Christos Zoulas * PR/347: Windows fixes * PR/352: Hangul word processor recognition * PR/354: Encoding irregularities in text files 2014-05-06 6:12 Christos Zoulas * Fix uninitialized title in CDF files (Jan Kaluza) 2014-05-04 14:55 Christos Zoulas * PR/351: Fix compilation of empty files 2014-04-30 17:39 Christos Zoulas * Fix integer formats: We don't specify 'l' or 'h' and 'hh' specifiers anymore, only 'll' for quads and nothing for the rest. This is so that magic writing is simpler. 2014-04-01 15:25 Christos Zoulas * PR/341: Jan Kaluza, fix memory leak * PR/342: Jan Kaluza, fix out of bounds read 2014-03-28 15:25 Christos Zoulas * Fix issue with long formats not matching fmtcheck @ text @d2 1 a2 1 # $File: filesystems,v 1.95 2014/06/03 19:17:27 christos Exp $ d207 2 a208 2 >>0764 long >0 start cyl %d, >>0770 long x %d blocks d252 1 a252 1 # DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013 d265 2 a266 2 0x1FE leshort 0xAA55 # d268 1 a268 1 !:strength +21 d322 2 a323 2 # "Ung\201ltige Partitionstabelle" nn=0x10F for german version # "Table de partition erron\202e" nn=0x10F for french version d333 1 a333 1 # "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version d339 1 a339 1 # "Syst\212me d'exploitation manquant" nn=0x15e for french version d350 1 a350 1 # "Ung\201ltige Partitionstabelle" xx=0x12C for german version d371 1 a371 1 # "Ung\201ltige Partitionstabelle" xx=0x1?? for german version d389 1 a389 1 # "Ung\201ltige Partitionstabelle" xx=0x1?? for german version d522 1 a522 1 # unknown version d569 1 a569 1 # updated by Joerg Jenderek at Nov 2012, Sep 2013 d571 8 a578 3 # display 1 space >>>447 ubyte x \b >>>477 use DOS-filename d1018 23 a1040 2 >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader >>>>>499 use DOS-filename d1047 32 d1081 4 a1086 27 # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO # and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector >0 string RRaA >>0x1E4 string rrAa \b, FSInfosector #>>0x1FC uleshort =0 SHOULD BE ZERO >>>0x1E8 ulelong <0xffffffff \b, %u free clusters >>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u # updated by Joerg Jenderek at Sep 2007 >3 ubyte 0 #no active flag >>446 ubyte 0 # partition 1 not empty >>>450 ubyte >0 # partitions 3,4 empty >>>>482 ubyte 0 >>>>>498 ubyte 0 # partition 2 ID=0,5,15 >>>>>>466 ubyte <0x10 >>>>>>>466 ubyte 0x05 \b, extended partition table >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) >>>>>>>466 ubyte 0x0 \b, extended partition table (last) # DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 >0x200 lelong 0x82564557 \b, BSD disklabel d1124 27 d1333 1 a1333 1 #>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds d1376 1 a1376 1 #>>>>0x208 ulelong =0xffffff \b, %lu (default) d1450 1 a1450 1 #>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) d1452 1 a1452 1 #>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) d1457 1 a1457 1 #>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) d1499 1 a1499 1 #>>>>>>40 uleshort =0 \b, extension flags %hu d1558 1 a1558 1 >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) d1564 1 a1564 1 >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) d1612 1 a1612 1 >&-264 lelong x pending inodes to free %d, d1632 1 a1632 1 >&-264 lelong x pending inodes to free %d, d1672 1 a1672 1 >&-264 belong x pending inodes to free %d, d1692 1 a1692 1 >&-264 belong x pending inodes to free %d, d1873 1 a1873 2 # Too Weak. #512 ubelong&0xE0ffff00 0xE0ffff00 d1875 1 a1875 1 #>21 ubyte <0xE5 floppy with old FAT filesystem d1883 1 a1883 1 #>>512 ubyte =0xfc 180k d1885 4 a1888 4 #>>>0xA0E ubequad 0 #>>>>0xA00 ubequad !0 #!:mime application/x-ima #>>512 ubyte =0xfd d1890 1 a1890 1 #>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k d1892 7 a1898 7 #>>>0xA0E ubequad 0 #!:mime application/x-ima #>>512 ubyte =0xfe #>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k #>>>>0x60E ubequad 0 #>>>>>0x600 ubequad !0 #!:mime application/x-ima d1900 5 a1904 5 #>>512 ubyte =0xff 320k #>>>0x60E ubequad 0 #>>>>0x600 ubequad !0 #!:mime application/x-ima #>>512 ubyte x \b, Media descriptor 0x%x d1906 1 a1906 1 #>>0 ulelong&0x804000E9 !0x000000E9 d1908 1 a1908 1 #>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader d1910 2 a1911 2 #>>>>0xc4 use 2xDOS-filename #>>0 ulelong&0x804000E9 =0x000000E9 d1913 2 a1914 2 #>>>0 ubyte =0xEB #>>>>1 ubyte x \b, code offset 0x%x+2 d1917 1 a1917 1 #>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader d1919 3 a1921 3 #>>>>>0x176 use DOS-filename #>>>>>0x181 ubyte x \b+ #>>>>>0x182 use DOS-filename d1924 1 a1924 1 #>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader d1926 3 a1928 3 #>>>>>0x18b use DOS-filename #>>>>>0x196 ubyte x \b+ #>>>>>0x197 use DOS-filename d1931 1 a1931 1 #>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader d1933 1 a1933 1 #>>>>>0x20 use 2xDOS-filename d1936 1 a1936 1 #>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader d1938 1 a1938 1 #>>>>>0x69 use 2xDOS-filename d1940 1 a1940 1 #>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader d1967 1 a1967 1 >4 lelong x size %u d1972 3 a1974 3 >36 lelong x edition %u, >40 lelong x %u blocks, >44 lelong x %u files d1977 1 a1977 1 >4 belong x size %u d1982 3 a1984 3 >36 belong x edition %u, >40 belong x %u blocks, >44 belong x %u files d2249 2 a2250 2 >40 ulelong >0 \b fblock size = %d, >44 ulelong >0 \b block size = %d, a2326 14 # UBIfs # Linux kernel sources: fs/ubifs/ubifs-media.h 0 belong 0x31181006 >0x16 short 0 UBIfs image >0x08 lequad x \b, sequence number %llu >0x10 leshort x \b, length %u >0x04 lelong x \b, CRC 0x%08x 0 belong 0x55424923 >0x04 short <2 >0x05 string \0\0\0 >0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 >0x04 short x UBI image, version %u @ 1.1.1.7 log @import file-5.20; bug fixes and better image magic descriptions. @ text @d2 1 a2 1 # $File: filesystems,v 1.103 2014/09/11 15:09:34 christos Exp $ d257 1 a257 1 !:strength +65 d268 2 a269 2 !:strength +70 >2 string OSBS OS/BS MBR d1356 1 a1356 1 0 ulelong&0x804000E9 0x000000E9 d1360 1 a1360 1 >11 uleshort&0x001f 0 d1367 1 a1367 1 >>>>>>1 uleshort x \b, code offset 0x%x+3 d1376 1 a1376 2 # for lazy FAT32 implementation like Transcend digital photo frame PF830 >>>>>82 string/c fat32 d1379 1 a1379 1 >>>>>82 string/c !fat32 d1402 2 a1403 4 # http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block # skip for values 2,2Ah,70h,73h,DFh # and continue for extended boot signature values 0,28h,29h,80h >>>>>>38 ubyte&0x56 =0 d1409 1 a1409 1 >>>>>>>82 string/c !fat32 a1413 2 # VGA-copy CRC or # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too d1416 1 a1416 1 # extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others d1418 1 a1418 1 >>>>>>>>38 ubyte&0xFE =0x28 a1419 1 >>>>>>>>38 ubyte =0x29 d1429 3 a1431 27 >>>>>82 string/c !fat32 >>>>>>54 string FAT12 \b, FAT (12 bit) >>>>>>54 string FAT16 \b, FAT (16 bit) >>>>>>54 default x # determinate FAT bit size by media descriptor # small floppies implies FAT12 >>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor) # with media descriptor F0h floppy or maybe superfloppy with FAT16 >>>>>>>21 ubyte =0xF0 # superfloppy (many sectors) implies FAT16 >>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors) # no superfloppy with media descriptor F0h implies FAT12 >>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors) # with media descriptor F8h floppy or hard disc with FAT12 or FAT16 >>>>>>>21 ubyte =0xF8 # 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12 >>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry) # hard disc with FAT12 or FAT16 >>>>>>>>19 default x \b, FAT (1Y bit by descriptor) # with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc >>>>>>>21 ubyte =0xFA # 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12 >>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry) # RAM disc with FAT12 or FAT16 or Tandy hard disc >>>>>>>>19 default x \b, FAT (1Y bit by descriptor) # others are floppy >>>>>>>21 default x \b, FAT (12 bit by descriptor) d1433 1 a1433 1 >>>>>82 string/c fat32 \b, FAT (32 bit) d1446 1 a1446 3 # 0 or 0xFFFF instead of usual 6 means no backup sector >>>>>>50 uleshort =0xFFFF \b, no Backup boot sector >>>>>>50 uleshort =0 \b, no Backup boot sector d1448 1 a1448 2 >>>>>>50 default x >>>>>>>50 uleshort x \b, Backup boot sector %u a1883 1 # https://en.wikipedia.org/wiki/ISO_9660 d1885 2 a1886 7 32769 string CD001 # mime line at that position does not work # to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51) !:strength -11 # to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51) # does not work #!:strength +33 a1887 1 !:mime application/x-iso9660-image a1888 1 !:mime application/x-iso9660-image d2134 1 d2269 11 a2279 28 0 lelong 0x06101831 >0x16 leshort 0 UBIfs image >0x08 lequad x \b, sequence number %llu >0x10 leshort x \b, length %u >0x04 lelong x \b, CRC 0x%08x 0 lelong 0x23494255 >0x04 leshort <2 >0x05 string \0\0\0 >0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 >0x04 leshort x UBI image, version %u # NEC PC-88 2D disk image # From Fabio R. Schmidlin 0x20 ulelong&0xFFFFFEFF 0x2A0 >0x10 string \0\0\0\0\0\0\0\0\0\0 >>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 >>>0x1A ubyte&0xEF 0 >>>>0x1B ubyte&0x8F 0 >>>>>0x1B ubyte&70 <0x40 >>>>>>0x1C ulelong >0x21 >>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s >>>>>>>>0x1B ubyte 0 \b, media=2D >>>>>>>>0x1B ubyte 0x10 \b, media=2DD >>>>>>>>0x1B ubyte 0x20 \b, media=2HD >>>>>>>>0x1B ubyte 0x30 \b, media=1D >>>>>>>>0x1B ubyte 0x40 \b, media=1DD >>>>>>>>0x1A ubyte 0x10 \b, write-protected @ 1.1.1.8 log @Import file-5.22 @ text @d2 1 a2 1 # $File: filesystems,v 1.108 2015/01/01 17:43:47 christos Exp $ a262 1 d265 1 a265 1 0x1FE leshort 0xAA55 DOS/MBR boot sector d268 2 a269 2 !:strength +65 >2 string OSBS OS/BS MBR a540 2 >>>>>32769 string CD001 >>>>>>0 use cdrom d1046 1 a1046 1 >>>>>>>466 ubyte 0x0 \b, extended partition table (last) a1238 1 >>>446 use partition-table a1356 1 !:strength +60 d1364 1 a1364 1 >>>>>0 ubyte 0xEB DOS/MBR boot sector d1916 10 a1925 1 0 name cdrom a1941 12 # CDROM Filesystems # https://en.wikipedia.org/wiki/ISO_9660 # Modified for UDF by gerardo.cacciari@@gmail.com 32769 string CD001 # mime line at that position does not work # to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51) !:strength -11 # to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51) # does not work #!:strength +33 >0 use cdrom a2123 1 !:strength +50 @ 1.1.1.9 log @2017-02-10 12:24 Christos Zoulas * release 5.30 2017-02-07 23:27 Christos Zoulas * If we exceeded the offset in a search return no match (Christoph Biedl) * Be more lenient on corrupt CDF files (Christoph Biedl) 2017-02-04 16:46 Christos Zoulas * pacify ubsan sign extension (oss-fuzz/524) 2017-02-01 12:42 Christos Zoulas * off by one in cdf parsing (PR/593) * report debugging sections in elf (PR/591) 2016-11-06 10:52 Christos Zoulas * Allow @@@@@@ in extensions * Add missing overflow check in der magic (Jonas Wagner) 2016-10-25 10:40 Christos Zoulas * release 5.29 2016-10-24 11:20 Christos Zoulas * der getlength overflow (Jonas Wagner) * multiple magic file load failure (Christoph Biedl) 2016-10-17 11:26 Christos Zoulas * CDF parsing improvements (Guy Helmer) 2016-07-20 7:26 Christos Zoulas * Add support for signed indirect offsets 2016-07-18 7:41 Christos Zoulas * cat /dev/null | file - should print empty (Christoph Biedl) 2016-07-05 15:20 Christos Zoulas * Bump string size from 64 to 96. 2016-06-13 20:20 Christos Zoulas * PR/556: Fix separators on annotations. 2016-06-13 19:40 Christos Zoulas * release 5.28 * fix leak on allocation failure 2016-06-01 1:20 Christos Zoulas * PR/555: Avoid overflow for offset > nbytes * PR/550: Segv on DER parsing: - use the correct variable for length - set offset to 0 on failure. 2016-05-13 12:00 Christos Zoulas * release 5.27 2016-04-18 9:35 Christos Zoulas * Errors comparing DER entries or computing offsets are just indications of malformed non-DER files. Don't print them. * Offset comparison was off-by-one. * Fix compression code (Werner Fink) * Put new bytes constant in the right file (not the generated one) 2016-04-16 18:34 Christos Zoulas * release 5.26 2016-03-31 13:50 Christos Zoulas * make the number of bytes read from files configurable. 2016-03-21 13:40 Christos Zoulas * Add bounds checks for DER code (discovered by Thomas Jarosch) * Change indirect recursion limit to indirect use count and bump from 15 to 50 to prevent abuse. 2016-03-13 20:39 Christos Zoulas * Add -00 which prints filename\0description\0 2016-03-01 13:28 Christos Zoulas * Fix ID3 indirect parsing 2016-01-19 10:18 Christos Zoulas * add DER parsing capability 2015-11-13 10:35 Christos Zoulas * provide dprintf(3) for the OS's that don't have it. 2015-11-11 16:25 Christos Zoulas * redo the compression code report decompression errors 2015-11-10 23:25 Christos Zoulas * REG_STARTEND code is not working as expected, delete it. 2015-11-09 16:05 Christos Zoulas * Add zlib support if we have it. 2015-11-05 11:22 Christos Zoulas * PR/492: compression forking was broken with magic_buffer. 2015-09-16 9:50 Christos Zoulas * release 5.25 2015-09-11 13:25 Christos Zoulas * add a limit to the length of regex searches 2015-09-08 9:50 Christos Zoulas * fix problems with --parameter (Christoph Biedl) 2015-07-11 10:35 Christos Zoulas * Windows fixes PR/466 (Jason Hood) 2015-07-09 10:35 Christos Zoulas * release 5.24 2015-06-11 8:52 Christos Zoulas * redo long option encoding to fix off-by-one in 5.23 2015-06-10 13:50 Christos Zoulas * release 5.23 2015-06-09 16:10 Christos Zoulas * Fix issue with regex range for magic with offset * Always return true from mget with USE (success to mget not match indication). Fixes mime evaluation after USE magic * PR/459: Don't insert magic entries to the list if there are parsing errors for them. 2015-06-03 16:00 Christos Zoulas * PR/455: Add utf-7 encoding 2015-06-03 14:30 Christos Zoulas * PR/455: Implement -Z, look inside, but don't report on compression * PR/454: Fix allocation error on bad magic. 2015-05-29 10:30 Christos Zoulas * handle MAGIC_CONTINUE everywhere, not just in softmagic 2015-05-21 14:30 Christos Zoulas * don't print descriptions for NAME types when mime. 2015-04-09 15:59 Christos Zoulas * Add --extension to list the known extensions for this file type Idea by Andrew J Roazen 2015-02-14 12:23 Christos Zoulas * Bump file search buffer size to 1M. 2015-01-09 14:35 Christos Zoulas * Fix multiple issues with date formats reported by Christoph Biedl: - T_LOCAL meaning was reversed - Arithmetic did not work Also stop adjusting daylight savings for gmt printing. 2015-01-05 13:00 Christos Zoulas * PR/411: Fix memory corruption from corrupt cdf file. @ text @d2 1 a2 1 # $File: filesystems,v 1.116 2017/01/03 11:25:37 christos Exp $ d542 2 d1724 1 a1724 1 >0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones d1741 23 a1763 24 # Weak Magic: this is $x #0x410 leshort 0x2468 #>0x402 beshort < 100 #>>0x402 beshort > -1 Minix filesystem, V2, 14 char names #>0x1e string minix \b, bootable #0x410 beshort 0x2468 #>0x402 beshort < 100 #>0x402 beshort > -1 Minix filesystem, V2 (big endian) #>0x1e string minix \b, bootable #0x410 leshort 0x2478 #>0x402 beshort < 100 #>0x402 beshort > -1 Minix filesystem, V2, 30 char names #>0x1e string minix \b, bootable #0x410 leshort 0x2478 #>0x402 beshort < 100 #>0x402 beshort > -1 Minix filesystem, V2, 30 char names #>0x1e string minix \b, bootable #0x410 beshort 0x2478 #>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian) #>0x1e string minix \b, bootable # Weak Magic! this is MD #0x418 leshort 0x4d5a #>0x402 beshort <100 #>>0x402 beshort > -1 Minix filesystem, V3, 60 char names a1930 2 # The next line is not necessary because the MBR staff is done looking for boot signature >0x1FE leshort 0xAA55 (DOS/MBR boot sector) d1951 1 a1951 13 # Reference: http://pismotec.com/ciso/ciso.h # NOTE: There are two other formats with the same magic but # completely incompatible specifications: # - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h # - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h 0 string CISO # Other fields are used to determine what type of CISO this is: # - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) # - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) # - None of the above: Compact ISO. >4 lelong !0 >>4 lelong !0x200000 >>>0x10 lelong !0x800 Compressed ISO CD image a2042 7 >29 byte 19 \bSandbox architecture, >29 byte 20 \bANDES Technology NDS32, >29 byte 21 \bOpenRISC 1000, >29 byte 22 \bARM 64-bit, >29 byte 23 \bDesignWare ARC, >29 byte 24 \bx86_64, >29 byte 25 \bXtensa, d2211 7 a2217 15 # Russell Coker 0x10040 string _BHRfS_M BTRFS Filesystem >0x1012b string >\0 label "%s", >0x10090 lelong x sectorsize %d, >0x10094 lelong x nodesize %d, >0x10098 lelong x leafsize %d, >0x10020 belong x UUID=%08x- >0x10024 beshort x \b%04x- >0x10026 beshort x \b%04x- >0x10028 beshort x \b%04x- >0x1002a beshort x \b%04x >0x1002c belong x \b%08x, >0x10078 lequad x %lld/ >0x10070 lequad x \b%lld bytes used, >0x10088 lequad x %lld devices @ 1.1.1.10 log @Import file-5.31; mostly oss-fuzz found bugs. @ text @d2 1 a2 1 # $File: filesystems,v 1.120 2017/03/24 19:29:26 christos Exp $ d5 1 a5 1 0 name partid d190 1 a190 1 0774 beshort 0xdabe d216 1 a216 1 >>14 string =_ d222 1 a222 1 >>>22 ubyte 0 d224 1 a224 1 >>>22 ubyte >0 d226 2 a227 2 >>>535 search/17 \x55\xAA >>>>&-512 indirect x \b; contains d231 2 a232 2 0 string DOSEMU\0 >0x27E leshort 0xAA55 d234 1 a234 1 >>19 ubyte 128 d239 1 a239 1 >>>>128 indirect x \b; contains d246 2 a247 2 >509 search/1026 \x55\xAA\xeb >>&-1 indirect x \b; contains d254 1 a254 1 30 search/481 \x55\xAA d259 1 a259 1 >11 uleshort <512 d273 1 a273 1 # test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by d278 1 a278 1 >>8 ubequad 0x8bf45007501ffbfc d284 1 a284 1 >>>0x16 ubyte 0xF2 d319 1 a319 1 >>8 ubequad 0x5007501ffcbe1b7c d364 1 a364 1 >>8 ubequad 0xc08ed8be007cbf00 d405 1 a405 1 >>0xDA uleshort 0 d409 1 a409 1 # hours, minutes and seconds d414 3 a416 3 # assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov >0 ubequad 0xfab830008ed0bc00 # assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov d421 2 a422 2 >0x9D string Invalid\ partition\ table$ >>181 string No\ Operating\ System$ d424 2 a425 2 >0x9D string Invalid\ partition\ table$ >>181 string No\ operating\ system$ d427 2 a428 2 >342 string Invalid\ partition\ table$ >>366 string No\ operating\ system$ d430 7 a436 7 >295 string NEWLDR\0 >>302 string Bad\ PT\ $ >>>310 string No\ OS\ $ >>>>317 string OS\ load\ err$ >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ >>>>>>>387 string Copyright\ (c)\ 1984,1998 d444 4 a447 4 #>>313 string F0\ .\ .\ . #>>>322 string disk\ 1 #>>>>382 string FAT3 >64 string no\ active\ partition\ found d450 3 a452 3 >387 search/4 \0\ Error!\r >>378 search/7 Virus! >>>397 search/4 Booting\040 d469 2 a470 2 >362 string MBR\ Error\ \0\r >>376 string ress\ any\ key\ to\040 d475 1 a475 1 >309 string No\ bootable\ partition\ found\r d477 1 a477 1 >349 string No\ bootable\ partition\ found\r d480 1 a480 1 >0x40 string SBML d482 1 a482 1 >>43 string SMART\ BTMGR d485 1 a485 1 #>>>>3 strings SBM d495 1 a495 1 >342 search/60 \0Geom\0 d497 1 a497 1 >>0x41 ubyte <2 d499 1 a499 1 # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 d524 1 a524 1 >>>343 string Geom\0Read\0\ Error\0 d531 1 a531 1 >3 string BCDL d535 1 a535 1 >3 string !IHISK d537 3 a539 3 >>0 belong !0xb8c0078e # not Linux kernel >>>514 string !HdrS d541 3 a543 3 >>>>422 string !Be\ Boot\ Loader # jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr >>>>>0 ubelong&0xFD000000 =0xE9000000 d545 1 a545 1 >>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e d548 1 a548 1 >>>>>0 ubelong&0xFD000000 !0xE9000000 d550 1 a550 1 >>>>>>0 string !RRaA d553 1 a553 1 >>>>>>>0 ubequad !0xfa660fb64610668b d555 1 a555 1 >>>>>>>>0 ubequad !0x660fb64610668b4e d557 1 a557 1 >>>>>>>>>0 string !\r\n d559 1 a559 1 >>>>>>>>>>446 ubyte 0 d561 1 a561 1 >>>>>>>>>>446 ubyte >0x7F d568 1 a568 1 >442 string Non-system\ disk,\040 d573 1 a573 1 >>>447 ubyte x \b d576 5 a580 5 >185 string FDBOOT\ Version\040 >>204 string \rNo\ Systemdisk.\040 >>>220 string Booting\ from\ harddisk.\n\r >>>245 string Cannot\ load\ from\ harddisk.\n\r >>>>273 string Insert\ Systemdisk\040 d583 1 a583 1 >242 string Bootsector\ from\ C.H.\ Hochst\204 d587 2 a588 2 >242 search/127 Bootsector\ from\ C.H.\ Hochst >>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk d590 1 a590 1 >>>208 search/261 Cannot\ load\ from\ harddisk. d592 1 a592 1 >>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. d597 3 a599 3 >(1.b+2) ubyte 0xe >>(1.b+3) ubyte 0x1f >>>(1.b+4) ubyte 0xbe d601 2 a602 2 >>>>(1.b+5) ubyte&0xd3 0x53 >>>>>(1.b+6) ubyte 0x7c d604 6 a609 6 >>>>>>(1.b+7) ubyte 0xac >>>>>>>(1.b+8) ubyte 0x22 >>>>>>>>(1.b+9) ubyte 0xc0 >>>>>>>>>(1.b+10) ubyte 0x74 >>>>>>>>>>(1.b+11) ubyte 0x0b >>>>>>>>>>>(1.b+12) ubyte 0x56 d612 1 a612 1 >>>>>>>>>>>>>(1.b+5) ubyte 0x5b d615 1 a615 1 >>>>>>>>>>>>>(1.b+5) ubyte 0x77 d618 7 a624 7 #>>244 string from\ dosemu-freedos-*-bin.tgz\r #>>>170 string Sorry,\ could\ not\ load\ an\040 #>>>>195 string operating\ system.\r\n # >103 string This\ is\ not\ a\ bootable\ disk.\040 >>132 string Please\ insert\ a\ bootable\040 >>>157 string floppy\ and\r\n d627 2 a628 2 >66 string Solaris\ Boot\ Sector >>99 string Incomplete\ MDBoot\ load. d632 3 a634 3 >408 string OS/2\ !!\ SYS01475\r\0 >>429 string OS/2\ !!\ SYS02025\r\0 >>>450 string OS/2\ !!\ SYS02027\r\0 d637 3 a639 3 >409 string OS/2\ !!\ SYS01475\r\0 >>430 string OS/2\ !!\ SYS02025\r\0 >>>451 string OS/2\ !!\ SYS02027\r\0 d641 7 a647 7 >112 string This\ disk\ is\ not\ bootable\r >>142 string If\ you\ wish\ to\ make\ it\ bootable >>>176 string run\ the\ DOS\ program\ SYS\040 >>>200 string after\ the\r >>>>216 string system\ has\ been\ loaded\r\n >>>>>242 string Please\ insert\ a\ DOS\ diskette\040 >>>>>271 string into\r\n\ the\ drive\ and\040 d650 2 a651 2 >430 string NTLDR\ is\ missing\xFF\r\n >>449 string Disk\ error\xFF\r\n d654 1 a654 1 >>>>417 ubyte&0xDF >0 d656 1 a656 1 >>>>>>422 ubyte&0xDF >0 d658 1 a658 1 >>>>>425 ubyte&0xDF >0 d661 2 a662 2 >>>>371 ubyte >0x20 >>>>>368 ubyte&0xDF >0 d664 1 a664 1 >>>>>>>373 ubyte&0xDF >0 d666 1 a666 1 >>>>>>376 ubyte&0xDF >0 d669 2 a670 2 >430 string NTLDR\ nicht\ gefunden\xFF\r\n >>453 string Datentr\204gerfehler\xFF\r\n d672 1 a672 1 >>>>417 ubyte&0xDF >0 d674 1 a674 1 >>>>>>422 ubyte&0xDF >0 d676 1 a676 1 >>>>>425 ubyte&0xDF >0 d679 2 a680 2 >>>>379 string \0 >>>>>368 ubyte&0xDF >0 d682 1 a682 1 >>>>>>>373 ubyte&0xDF >0 d685 2 a686 2 >430 string NTLDR\ fehlt\xFF\r\n >>444 string Datentr\204gerfehler\xFF\r\n d688 1 a688 1 >>>>417 ubyte&0xDF >0 d690 1 a690 1 >>>>>>422 ubyte&0xDF >0 d692 1 a692 1 >>>>>425 ubyte&0xDF >0 d695 2 a696 2 >>>>371 ubyte >0x20 >>>>>368 ubyte&0xDF >0 d698 1 a698 1 >>>>>>>373 ubyte&0xDF >0 d700 1 a700 1 >>>>>>376 ubyte&0xDF >0 d703 2 a704 2 >430 string NTLDR\ fehlt\xFF\r\n >>444 string Medienfehler\xFF\r\n d706 2 a707 2 >>>>371 ubyte >0x20 >>>>>368 ubyte&0xDF >0 d709 1 a709 1 >>>>>>>373 ubyte&0xDF >0 d711 1 a711 1 >>>>>>376 ubyte&0xDF >0 d714 1 a714 1 >>>>417 ubyte&0xDF >0 d716 1 a716 1 >>>>>>422 ubyte&0xDF >0 d718 1 a718 1 >>>>>425 ubyte&0xDF >0 d721 2 a722 2 >430 string Datentr\204ger\ entfernen\xFF\r\n >>454 string Medienfehler\xFF\r\n d724 2 a725 2 >>>>379 string \0 >>>>>368 ubyte&0xDF >0 d727 1 a727 1 >>>>>>>373 ubyte&0xDF >0 d729 1 a729 1 >>>>>>376 ubyte&0xDF >0 d732 1 a732 1 >>>>417 ubyte&0xDF >0 d734 1 a734 1 >>>>>>422 ubyte&0xDF >0 d736 1 a736 1 >>>>>425 ubyte&0xDF >0 d740 2 a741 2 #>3 string NTFS\ \ \ \040 >389 string Fehler\ beim\ Lesen\040 d743 1 a743 1 >>>426 string NTLDR\ fehlt d746 1 a746 1 #>3 string NTFS\ \ \ \040 d748 4 a751 4 >>345 string A\ kernel\ file\ is\ missing\040 >>>370 string from\ the\ disk.\r >>>>484 string NTLDR\ is\ compressed >>>>>429 string Insert\ a\ system\ diskette\040 d755 3 a757 3 >>389 string Invalid\ system\ disk\xFF\r\n >>>411 string Disk\ I/O\ error >>>>428 string Replace\ the\ disk,\ and\040 d760 1 a760 1 >>>>>>472 ubyte&0xDF >0 d762 1 a762 1 >>>>>>>>474 ubyte&0xDF >0 d764 1 a764 1 >>>>>>>>>>479 ubyte&0xDF >0 d766 1 a766 1 >>>>>>>480 ubyte&0xDF >0 d771 1 a771 1 >>>>>>>>>488 ubyte&0xDF >0 d773 1 a773 1 >>>>>>>>491 ubyte&0xDF >0 d776 3 a778 3 >>390 string Invalid\ system\ disk\xFF\r\n >>>412 string Disk\ I/O\ error\xFF\r\n >>>>429 string Replace\ the\ disk,\ and\040 d780 3 a782 3 >>388 string Ungueltiges\ System\ \xFF\r\n >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>427 string Datentraeger\ wechseln\ und\040 d785 1 a785 1 >>>>>>497 ubyte&0xDF >0 d787 1 a787 1 >>>>>>>>502 ubyte&0xDF >0 d789 1 a789 1 >>>>>>>>>>503 ubyte&0xDF >0 d791 1 a791 1 >>>>>>>>>>>>504 ubyte&0xDF >0 d793 1 a793 1 >>>>>>505 ubyte&0xDF >0 d798 1 a798 1 >>>>>>>>474 ubyte&0xDF >0 d800 1 a800 1 >>>>>>>>>>479 ubyte&0xDF >0 d802 1 a802 1 >>>>>>>480 ubyte&0xDF >0 d807 1 a807 1 >>>>>>>>>488 ubyte&0xDF >0 d809 1 a809 1 >>>>>>>>491 ubyte&0xDF >0 d812 3 a814 3 >>390 string Ungueltiges\ System\ \xFF\r\n >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>429 string Datentraeger\ wechseln\ und\040 d817 1 a817 1 >>>>>>497 ubyte&0xDF >0 d819 1 a819 1 >>>>>>>>504 ubyte&0xDF >0 d821 1 a821 1 >>>>>>505 ubyte&0xDF >0 d826 1 a826 1 >>>>>>>>474 ubyte&0xDF >0 d828 1 a828 1 >>>>>>>480 ubyte&0xDF >0 d833 1 a833 1 >>>>>>>>>488 ubyte&0xDF >0 d835 1 a835 1 >>>>>>>>491 ubyte&0xDF >0 d838 3 a840 3 >>389 string Ungueltiges\ System\ \xFF\r\n >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>428 string Datentraeger\ wechseln\ und\040 d844 1 a844 1 >>>>>>>474 ubyte&0xDF >0 d846 1 a846 1 >>>>>>>>479 ubyte&0xDF >0 d848 1 a848 1 >>>>>>480 ubyte&0xDF >0 d852 1 a852 1 >>>>>>>488 ubyte&0xDF >0 d854 1 a854 1 >>>>>>>>490 ubyte&0xDF >0 d856 1 a856 1 >>>>>>>491 ubyte&0xDF >0 d859 2 a860 2 >>416 string Kein\ System\ oder\040 >>>433 string Laufwerksfehler d864 1 a864 1 >>>>>>481 ubyte&0xDF >0 d866 1 a866 1 >>>>>487 ubyte&0xDF >0 d871 1 a871 1 >>>>>>>>495 ubyte&0xDF >0 d873 1 a873 1 >>>>>>>498 ubyte&0xDF >0 d876 3 a878 3 >376 search/41 Non-System\ disk\ or\040 >>395 search/41 disk\ error\r >>>407 search/41 Replace\ and\040 d884 1 a884 1 >>>>>468 search/18 \0 d887 1 a887 1 >>>>>>>&-20 ubyte&0xDF >0 d889 1 a889 1 >>>>>>>>>&-16 ubyte&0xDF >0 d896 1 a896 1 >>>>>>>>&-6 ubyte&0xDF >0 d898 1 a898 1 >>>>>>>>>>&-5 ubyte&0xDF >0 d903 1 a903 1 >>469 string Insert\ Systemdisk\040 d905 1 a905 1 #>43 string \224R-LOADER\ \ SYS =label d910 3 a912 3 >98 string Press\ a\ key\ to\ retry\0\r >>120 string Cannot\ find\ file\ \0\r >>>139 string Disk\ read\ error\0\r d915 1 a915 1 >>>>>44 ubyte&0xDF >0 d917 1 a917 1 >>>>>>>50 ubyte&0xDF >0 d919 1 a919 1 >>>>>>52 ubyte&0xDF >0 d922 2 a923 2 >70 string IBMBIO\ \ COM >>472 string Cannot\ load\ DOS!\040 d925 1 a925 1 >>471 string Cannot\ load\ DOS\040 d928 1 a928 1 >444 string KERNEL\ \ SYS d930 1 a930 1 >499 string KERNEL\ \ SYS d932 1 a932 1 >449 string KERNEL\ \ SYS d935 1 a935 1 >449 string Loading\ FreeDOS d937 1 a937 1 >>>497 ubyte&0xDF >0 d939 1 a939 1 >>>>>503 ubyte&0xDF >0 d941 1 a941 1 >>>>>>>504 ubyte&0xDF >0 d943 1 a943 1 >>>>505 ubyte&0xDF >0 d948 1 a948 1 >125 string Loading\ FreeDOS...\r d950 1 a950 1 >>>441 ubyte&0xDF >0 d952 1 a952 1 >>>>>447 ubyte&0xDF >0 d954 1 a954 1 >>>>>>>448 ubyte&0xDF >0 d956 1 a956 1 >>>>449 ubyte&0xDF >0 d958 1 a958 1 >124 string FreeDOS\0 d961 1 a961 1 >>>497 ubyte&0xDF >0 d963 1 a963 1 >>>>>503 ubyte&0xDF >0 d965 1 a965 1 >>>>>>>504 ubyte&0xDF >0 d967 1 a967 1 >>>>505 ubyte&0xDF >0 d970 1 a970 1 >>>497 ubyte&0xDF >0 d972 1 a972 1 >>>>>503 ubyte&0xDF >0 d974 1 a974 1 >>>>>>>504 ubyte&0xDF >0 d976 1 a976 1 >>>>505 ubyte&0xDF >0 d979 1 a979 1 >>>497 ubyte&0xDF >0 d981 1 a981 1 >>>>>503 ubyte&0xDF >0 d983 1 a983 1 >>>>>>>504 ubyte&0xDF >0 d985 1 a985 1 >>>>505 ubyte&0xDF >0 d987 1 a987 1 >336 string Error!\040 d989 1 a989 1 >>>497 ubyte&0xDF >0 d991 1 a991 1 >>>>>503 ubyte&0xDF >0 d993 1 a993 1 >>>>>>>504 ubyte&0xDF >0 d995 1 a995 1 >>>>505 ubyte&0xDF >0 d1001 3 a1003 3 >478 ulelong 0 >>(1.b+326) string I/O\ Error\ reading\040 >>>(1.b+344) string Visopsys\ loader\r d1006 3 a1008 3 >494 ubyte >0x4D >>495 string >E >>>495 string >>>3 string BootProg d1014 1 a1014 1 >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader d1028 1 a1028 1 >0 string RRaA d1035 1 a1035 1 >3 ubyte 0 d1037 1 a1037 1 >>446 ubyte 0 d1039 1 a1039 1 >>>450 ubyte >0 d1041 2 a1042 2 >>>>482 ubyte 0 >>>>>498 ubyte 0 d1044 1 a1044 1 >>>>>>466 ubyte <0x10 d1057 2 a1058 2 # space=0x20 (00100000b) means empty >0 ubyte&0xDF >0 d1060 1 a1060 1 >>>1 ubyte&0xDF >0 d1062 1 a1062 1 >>>>>2 ubyte&0xDF >0 d1064 1 a1064 1 >>>>>>>3 ubyte&0xDF >0 d1066 1 a1066 1 >>>>>>>>>4 ubyte&0xDF >0 d1068 1 a1068 1 >>>>>>>>>>>5 ubyte&0xDF >0 d1070 1 a1070 1 >>>>>>>>>>>>>6 ubyte&0xDF >0 d1072 1 a1072 1 >>>>>>>>>>>>>>>7 ubyte&0xDF >0 d1077 1 a1077 1 >>>>9 ubyte&0xDF >0 d1079 1 a1079 1 >>>>>>10 ubyte&0xDF >0 d1085 1 a1085 1 >0 ubyte x \b d1104 1 a1104 1 >>0 ubyte 0 d1106 2 a1107 2 # active flag 0x80, 0x81, ... >>0 ubyte >0x7F d1139 1 a1139 1 # FATX d1160 1 a1160 1 0 ulequad&0x909000007cc0eafa 0x909000007c40eafa d1177 1 a1177 1 0 ulelong&0x80909bEB 0x009018EB d1179 2 a1180 2 >434 search/47 Boot\ failed # followed by \r\n\0 or :\ d1183 1 a1183 1 >459 search/30 Boot\ error\r\n\0 d1187 1 a1187 1 16 search/4 \xbf\x00\x06\xb9\x00\x01 d1190 1 a1190 1 >94 search/249 Missing\ operating\ system d1193 2 a1194 2 >>408 search/4 HD1/\0 >>408 default x d1197 1 a1197 1 >>>>292 search/98 error d1202 1 a1202 1 >>156 search/10 \0Boot\ partition\ not\ found\r\n d1204 1 a1204 1 >>174 search/10 \0Missing\ OS\r\n d1210 1 a1210 1 0 ubequad 0x31c08ed0bc007c8e d1212 2 a1213 2 #>444 uleshort 0xb5e1 >0004 uleshort x d1220 1 a1220 1 # BOOT_EXTENDED definitions contains assembler instructions: d1226 2 a1227 2 >>>196 search/106 No\ active\ partition\0 >>>>&0 string Disk\ read\ error\0 d1234 1 a1234 1 >>>0x26 search/21 \xBB\x94\x07 d1236 2 a1237 2 >>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 >>>>>181 search/166 Error\ \0 d1244 1 a1244 1 0 ubequad&0xeb58908000000000 0xeb58900000000000 d1246 1 a1246 1 >(1.b+2) ubequad 0xfa31c08ed88ec08e d1248 2 a1249 2 >>376 string No\ operating\ system\r\n\0 >>>398 string Disk\ error\r\n\0FDD\0HDD\0 d1252 1 a1252 1 # Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ d1256 1 a1256 1 0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC d1258 1 a1258 1 >(0x1BC.s) string NDTmbr d1272 1 a1272 1 >>>(0x1BC.s+9) ubyte <2 d1277 1 a1277 1 >>>>(0x1BC.s+13) ubyte >1 d1283 1 a1283 1 >>>(0x1BC.s+9) ubyte >1 d1288 1 a1288 1 >>>>(0x1BC.s+14) ubyte >1 d1300 1 a1300 1 0x200 uleshort 0x70EA d1302 1 a1302 1 >0x206 ubeshort >0x0300 d1304 2 a1305 2 >>0x212 ubyte >0x29 >>>0x213 ubyte >0x29 d1307 1 a1307 1 #>>>0 ulelong&0x00BE5652 0x00BE5652 d1319 1 a1319 1 >>>>0x20C ulelong&0x2E300000 0x2E300000 d1327 1 a1327 1 >>>>>>0x215 ulong 0xffffffff d1329 1 a1329 1 >>>>>>0x215 ulong !0xffffffff d1332 1 a1332 1 >>>>0x20C ulelong&0x2E300000 !0x2E300000 d1337 1 a1337 1 # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 d1345 1 a1345 1 >>>>>0x217 ulong 0xffffffff d1347 1 a1347 1 >>>>>0x217 ulong !0xffffffff d1363 4 a1366 4 >11 uleshort&0x001f 0 >>11 uleshort <32769 >>>11 uleshort >31 >>>>21 ubyte&0xf0 0xF0 d1369 1 a1369 1 >>>>>0 ubyte 0xE9 d1380 1 a1380 1 >>>>>82 string/c fat32 d1383 1 a1383 1 >>>>>82 string/c !fat32 d1393 1 a1393 1 >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) d1405 1 a1405 1 >>>>>11 uleshort >32 d1409 1 a1409 1 >>>>>>38 ubyte&0x56 =0 d1412 1 a1412 1 >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) d1414 2 a1415 2 # FAT<32 bit specific >>>>>>>82 string/c !fat32 d1418 1 a1418 1 >>>>>>>>36 ubyte !0x80 d1438 1 a1438 1 >>>>>82 string/c !fat32 d1441 1 a1441 1 >>>>>>54 default x d1446 1 a1446 1 >>>>>>>21 ubyte =0xF0 d1452 1 a1452 1 >>>>>>>21 ubyte =0xF8 d1458 1 a1458 1 >>>>>>>21 ubyte =0xFA d1482 2 a1483 2 #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) >>>>>>50 default x d1489 1 a1489 1 # same structure as FAT1X d1492 1 a1492 1 >>>>>>64 ubyte !0x80 d1503 2 a1504 2 # no fixed disk >>>>>21 ubyte !0xF8 d1506 1 a1506 1 >>>>>>54 string !FAT16 d1514 1 a1514 1 >>>>>16 ubyte =0 d1516 1 a1516 1 >>>>>>17 uleshort =0 d1518 1 a1518 1 >>>>>>>19 uleshort =0 d1529 2 a1530 2 # Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. >>>>>>>>>64 lelong <256 d1535 1 a1535 1 >>>>>>>>>68 ulelong <256 d1542 2 a1543 2 >>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 >>>>>>>>>>&-92 indirect x \b; contains d1547 1 a1547 1 0x056 ulelong&0xFFFF0FFF 0x909002EB d1549 1 a1549 1 >(0.s*2) ulelong&0xFFFFFF00 0x00040000 d1552 1 a1552 1 >>0x12 string $ a1555 10 # ntfsclone-image is a special save format for NTFS volumes, # created and restored by the ntfsclone program 0 string \0ntfsclone-image ntfsclone image, >0x10 byte x version %d. >0x11 byte x \b%d, >0x12 lelong x cluster size %d, >0x16 lequad x device size %lld, >0x1e lequad x %lld total clusters, >0x26 lequad x %lld clusters in use a1671 7 0 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian), >0x90 lelong+1 x volume %d >0x94 lelong x (of %d), >0x50 string x name %s, >0x98 ulelong x version %u, >0xa0 ulelong x flags 0x%x d1821 1 a1821 1 # F8 ----- Fixed disk d1849 1 a1849 1 #512 ubelong&0xE0ffff00 0xE0ffff00 d1861 2 a1862 2 #>>>0xA0E ubequad 0 #>>>>0xA00 ubequad !0 d1864 1 a1864 1 #>>512 ubyte =0xfd d1868 1 a1868 1 #>>>0xA0E ubequad 0 d1870 1 a1870 1 #>>512 ubyte =0xfe d1872 2 a1873 2 #>>>>0x60E ubequad 0 #>>>>>0x600 ubequad !0 d1877 2 a1878 2 #>>>0x60E ubequad 0 #>>>>0x600 ubequad !0 d1882 2 a1883 2 #>>0 ulelong&0x804000E9 !0x000000E9 # assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV d1887 1 a1887 1 #>>0 ulelong&0x804000E9 =0x000000E9 d1892 2 a1893 2 # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 #>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader d1899 2 a1900 2 # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV #>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader d1906 1 a1906 1 # assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 d1911 1 a1911 1 # assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; d1915 1 a1915 1 # assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; d2136 1 a2136 1 # From: Ty Sarna d2251 1 a2251 1 # xfs metadump image d2323 2 a2324 2 0 string CQ\024 floppy image data (CopyQM, >16 leshort x %d sectors, @ 1.1.1.11 log @2017-09-02 11:53 Christos Zoulas * release 5.32 2017-08-28 16:37 Christos Zoulas * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski) 2017-08-27 03:55 Christos Zoulas * Fix always true condition (Thomas Jarosch) 2017-05-24 17:30 Christos Zoulas * pickier parsing of numeric values in magic files. 2017-05-23 17:55 Christos Zoulas * PR/615 add magic_getflags() 2017-05-23 13:55 Christos Zoulas * release 5.31 2017-03-17 20:32 Christos Zoulas * remove trailing spaces from magic files * refactor is_tar * better bounds checks for cdf @ text @d2 1 a2 1 # $File: filesystems,v 1.122 2017/07/21 10:34:41 christos Exp $ d1962 1 a1962 1 #!:strength -11 d1964 3 a1966 2 !:strength +34 >0 use cdrom a2390 10 # HDD Raw Copy Tool disk image, file extension: .imgc # From Benjamin Vanheuverzwijn 0 pstring HDD\ Raw\ Copy\ Tool %s >0x100 pstring x %s >0x200 pstring x - HD model: %s #>0x300 pstring x unknown %s >0x400 pstring x serial: %s #>0x500 pstring x unknown: %s !:ext imgc @ 1.1.1.12 log @2018-04-15 14:52 Christos Zoulas * release 5.33 2018-02-24 14:50 Christos Zoulas * extend the support for ${x?:} expansions for magic descriptions 2018-02-21 16:25 Christos Zoulas * add support for ${x?:} in mime types to handle pie binaries. 2017-11-03 9:23 Christos Zoulas * add support for negative offsets (offsets from the end of file) 2017-09-26 8:22 Christos Zoulas * close the file on error when writing magic (Steve Grubb) 2017-09-24 12:02 Christos Zoulas * seccomp support (Paul Moore) 2017-09-02 11:53 Christos Zoulas * release 5.32 2017-08-28 16:37 Christos Zoulas * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski) 2017-08-27 03:55 Christos Zoulas * Fix always true condition (Thomas Jarosch) 2017-05-24 17:30 Christos Zoulas * pickier parsing of numeric values in magic files. 2017-05-23 17:55 Christos Zoulas * PR/615 add magic_getflags() @ text @d2 1 a2 1 # $File: filesystems,v 1.124 2018/01/12 12:35:30 christos Exp $ a1734 10 # f2fs filesystem - Tuomas Tynkkynen 0x400 lelong 0xF2F52010 F2FS filesystem >0x46c belong x \b, UUID=%08x >0x470 beshort x \b-%04x >0x472 beshort x \b-%04x >0x474 beshort x \b-%04x >0x476 belong x \b-%08x >0x47a beshort x \b%04x >0x147c lestring16 x \b, volume name "%s" a1939 1 !:ext iso/iso9660 a1941 1 !:ext iso/udf a1966 10 # URL: https://en.wikipedia.org/wiki/NRG_(file_format) # Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/ # 11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh # From: Joerg Jenderek # Note: Only for nero disc with once (DAO) type after 300 KB header 339969 string CD001 Nero CD image at 0x4B000 !:mime application/x-nrg !:ext nrg >307200 use cdrom @ 1.1.1.13 log @2019-05-14 22:26 Christos Zoulas * release 5.37 2019-05-09 22:27 Christos Zoulas * Make sure that continuation separators are printed with -k within softmagic 2019-05-06 22:27 Christos Zoulas * Change SIGPIPE saving and restoring during compression to use sigaction(2) instead of signal(3) and cache it. (Denys Vlasenko) * Cache stat(2) calls more to reduce number of calls (Denys Vlasenko) 2019-05-06 17:25 Christos Zoulas * PR/77: Handle --mime-type and -k correctly. 2019-05-03 15:26 Christos Zoulas * Switch decompression code to use vfork() because tools like rpmdiff and rpmbuild call libmagic with large process footprints (Denys Vlasenko) 2019-04-07 14:05 Christos Zoulas * PR/75: --enable-zlib, did not work. 2019-02-27 11:54 Christos Zoulas * Improve regex efficiency (Michael Schroeder) by: 1. Prefixing regex searches with regular search for keywords where possible 2. Using memmem(3) where available @ text @d2 1 a2 1 # $File: filesystems,v 1.128 2019/04/23 15:43:27 christos Exp $ d271 2 a272 2 # added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/ # and https://en.wikipedia.org/wiki/Master_Boot_Record d276 1 a276 1 # Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) d279 1 a279 1 # https://thestarman.pcministry.com/asm/mbr/200MBR.htm d285 1 a285 1 # NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm d317 1 a317 1 # Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) d344 1 a344 1 # https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm d365 1 a365 1 # Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) d383 1 a383 1 # Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm) d401 2 a402 2 # https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs # https://en.wikipedia.org/wiki/MBR_disk_signature#ID d404 1 a404 1 # driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm d468 1 a468 1 # https://www.acronis.de/ d473 2 a474 2 # https://www.visopsys.org/ # https://partitionlogic.org.uk/ d493 1 a493 1 # https://www.gnu.org/software/grub/manual/grub.html#Embedded-data d552 1 a552 1 # https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm d565 1 a565 1 # https://www.acronis.de/ d998 2 a999 2 # https://www.visopsys.org/ # https://partitionlogic.org.uk/ d1026 2 a1027 2 # added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO # and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector d1090 1 a1090 1 # https://en.wikipedia.org/wiki/Master_boot_record#PTE d1157 1 a1157 1 # https://syslinux.zytor.com/iso.php d1163 1 a1163 1 # https://syslinux.zytor.com/pxe.php d1170 1 a1170 1 # https://syslinux.zytor.com/wiki/index.php/SYSLINUX d1216 1 a1216 1 # NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS d1252 1 a1252 1 # Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/ d1265 1 a1265 1 # variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode d1298 1 a1298 1 # https://www.gnu.org/software/grub/manual/grub.html#Embedded-data d1353 1 a1353 1 # https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD d1406 1 a1406 1 # https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block d1468 1 a1468 1 # https://technet.microsoft.com/en-us/library/cc977221.aspx d1485 1 a1485 1 # corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO d1511 1 a1511 1 # NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm d1542 8 a1549 28 # unicode loadername size jump >>>>>>>>>(0x200.s*2) ubyte x # in next sector loadername terminated by unicode CTRL-D and $ >>>>>>>>>>&0x1FF ulequad&0x0000FFffFFffFF00 0x0000002400040000 \b; contains # if 2nd NTFS sectors is found then assume whole filesystem #!:mime application/x-raw-disk-image !:ext img/bin/ntfs >>>>>>>>>>>0x200 use ntfs-sector2 # For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019 # https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm # unused assembler instructions short JMP y2;NOP;NOP 0x056 ulelong&0xFFFF0FFF 0x909002EB NTFS #!:mime application/octet-stream !:ext bin >0 use ntfs-sector2 # https://memory.dataram.com/products-and-services/software/ramdisk # assembler instructions JMP C000;NOP 0x056 ulelong 0x9000c0e9 NTFS #!:mime application/octet-stream !:ext bin >0 use ntfs-sector2 # check for characteristics of second NTFS sector and then display loader name 0 name ntfs-sector2 # number of utf16 characters of loadername >0 uleshort <8 # unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP >>0x056 ulelong&0xFF0000FD 0x900000E9 d1551 3 a1553 4 >>>0x002 lestring16 x bootstrap %-5.5s # check for 7 character length of loader name like BOOTMGR >>>0 uleshort 7 >>>>0x0c lestring16 x \b%-2.2s d1692 1 a1692 1 # https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ d1804 1 a1804 1 # https://en.wikipedia.org/wiki/BIOS_parameter_block d1874 1 a1874 1 # https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions d1887 1 a1887 1 # look like an old DOS directory entry d1918 1 a1918 1 # https://thestarman.pcministry.com/DOS/ibm100/Boot.htm d1925 1 a1925 1 # https://thestarman.pcministry.com/DOS/ibm110/Boot.htm d1932 1 a1932 1 # https://en.wikipedia.org/wiki/Zenith_Data_Systems d1937 1 a1937 1 # https://en.wikipedia.org/wiki/Corona_Data_Systems d1990 1 a1990 1 # Reference: https://pismotec.com/ciso/ciso.h a1998 2 # - 0x10 == 0x00004000: For >2GB files using maxcso... # https://github.com/unknownbrackets/maxcso/issues/26 d2002 1 a2002 2 >>>16 lelong !0x800 >>>>16 lelong !0x4000 Compressed ISO CD image d2250 1 a2250 1 # https://filext.com/file-extension/DAA @ 1.1.1.14 log @Import 5.38: - Always accept -S (no sandbox) even if we don't support sandboxing - More syscalls elided for sandboxiing - For ELF dynamic means having an interpreter not just PT_DYNAMIC - Check for large ELF session header offset - When saving and restoring a locale, keep the locale name in our own storage. - Add a flag to disable CSV file detection. - Don't pass NULL/0 to memset to appease sanitizers. - Avoid spurious prints when looks for extensions or apple strings in fsmagic. - Add builtin decompressors for xz and and bzip. - Add a limit for the number of CDF elements. - More checks for overflow in CDF. @ text @d2 1 a2 1 # $File: filesystems,v 1.131 2019/11/15 23:49:38 christos Exp $ d2060 4 a2124 1 >29 byte 26 \bRISC-V, a2146 1 0 beshort 0x1984 Linux old jffs2 filesystem data big endian a2147 1 0 beshort 0x1985 Linux jffs2 filesystem data big endian d2150 1 a2150 1 0 name squashfs d2152 1 a2152 9 >30 beshort x \b%d, >20 beshort 0 uncompressed, >20 beshort 1 zlib >20 beshort 2 lzma >20 beshort 3 lzo >20 beshort 4 xz >20 beshort 5 lz4 >20 beshort 6 zstd >20 beshort >0 compressed, d2156 1 a2156 1 >>28 beshort <4 d2158 1 a2158 1 >>28 beshort >3 d2165 1 a2165 1 >>28 beshort <4 d2167 1 a2167 1 >>28 beshort >3 d2169 1 a2169 1 >28 beshort <4 d2171 1 a2171 1 >28 beshort >3 a2172 4 0 string sqsh Squashfs filesystem, big endian, >0 use squashfs d2174 22 a2195 1 >0 use ^squashfs @ 1.1.1.15 log @Import 5.39: * Remove unused subtype_mime (Steve Grubb) * Remove unused check in okstat (Steve Grubb) * Fix mime-type in elf binaries by making sure $x is set * Fix indirect negative offsets broken by OFFNEGATIVE * Fix GUID equality check * PR/165: Handle empty array and strings in JSON * PR/162: Add --exclude-quiet * Fix memory leak in ascmagic (Steve Grubb) * Fix string comparison length with ignore whitespace * Fix mingwin 64 compilation * PR/159: whitelist getpid needed for file_pipe2file() * Indicate negative offsets with a flag OFFNEGATIVE so that -0 works. * Introduce "offset" magic type that can be used to detect the file size, and bail on short files. * document DER better in the magic man page. * fix memory leaks (SonarQube) * rewrite confusing loops (SonarQube) * fix bogus test (SonarQube) * pass a sized buffer to file_fmttime() (SonarQube) * Don't allow * in printf formats, or the code itself (Christoph Biedl) * Introduce a printf output size checker to avoid DoS attacks * Avoid memory leak on error (oss-fuzz) * Check length of string on DER before derefercing and add new types * Add missing DER string (oss-fuzz) * Add missing DER types, and debugging * PR/140: Avoid abort with hand-crafted magic file (gockelhahn) * PR/139: Avoid DoS in printf with hand-crafted magic file (gockelhahn) * PR/138: Avoid crash with hand-crafted magic file (gockelhahn) * PR/136: Fix static build by adding a libmagic.pc (Fabrice Fontaine) * add guid support native support via the "guid" type. @ text @d2 1 a2 1 # $File: filesystems,v 1.133 2020/05/17 19:32:00 christos Exp $ d1997 1 a1997 1 !:strength +35 d2185 1 a2185 1 >0 use \^squashfs @ 1.1.1.16 log @2021-03-30 20:21 Christos Zoulas * release 5.40 2021-02-05 16:31 Christos Zoulas * PR/234: Add limit to the number of bytes to scan for encoding * PR/230: Fix /T (trim flag) for regex 2021-02-01 12:31 Christos Zoulas * PR/77: Trim trailing separator. 2020-12-17 15:44 Christos Zoulas * PR/211: Convert system read errors from corrupt ELF files into human readable error messages 2020-12-08 16:24 Christos Zoulas * fix multithreaded decompression file descriptor issue by using close-on-exec (Denys Vlasenko) 2020-06-27 11:58 Christos Zoulas * Exclude surrogate pairs from utf-8 detection (Michael Liu) 2020-06-25 12:53 Christos Zoulas * Include # to the list of ignored format chars (Werner Fink) @ text @d2 1 a2 1 # $File: filesystems,v 1.140 2021/02/23 00:51:10 christos Exp $ a263 12 # ExFAT 3 string/w =EXFAT >0x1FE leshort 0xAA55 >>0x6E ubyte 1 >>>0x6F ubyte 0x80 >>>0 ubyte 0xEB DOS/MBR boot sector, >>>0x69 ubyte x ExFAT Filesystem version %d. >>>0x68 ubyte x \b%d >>>0x6d ubyte x \b, (1<<%d) sectors per cluster >>>0x48 ulequad x \b, sectors %lld >>>0x64 ulelong x \b, serial number 0x%x d494 1 a494 1 # usual values are marked with comments to get only information of strange GRUB loaders d536 1 a536 1 # skip Linux style boot sector starting with assembler instructions mov 0x7c0,ax; d551 1 a551 1 # skip 3rd sector of MS x86 bootloader with assembler instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, d1299 1 a1299 1 # usual values are marked with comments to get only information of strange GRUB loaders d1361 1 a1361 1 # usual values are marked with comments to get only information of strange FAT systems d1424 1 a1424 1 # extended boot signature value is 0x80 for NTFS, 0x28 or 0x29 for others d1983 1 a1983 1 >32808 string/T >\0 '%.32s' a1987 3 # "application id" which appears to be used as a volume label >32816 string/T >\0 '%.32s' a2435 25 # http://martin.hinner.info/fs/bfs/bfs-structure.html 0 lelong 0x1BADFACE SCO UnixWare BFS filesystem # https://arstechnica.com/information-technology/2018/07/the-beos-filesystem/ 32 lelong 0x42465331 BE/OS BFS1 filesystem >36 lelong x \b, byte order %d >40 lelong x \b, block size %d >44 lelong x \b, block shift %d >48 lequad x \b, total blocks %lld >56 lequad x \b, used blocks %lld 0 name next >0 lelong x \b, size %d >4 string x \b, label %s # https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-44.3\ # /IONeXTPartitionScheme.h 0 string NeXT NeXT version 1 disklabel >12 use next 0 string dlV1 NeXT version 2 disklabel >12 use next 0 string dlV2 NeXT version 3 disklabel >12 use next @ 1.1.1.17 log @Import file-5.43+; last was file-5.40 2022-09-20 17:12 Christos Zoulas * fixed various clustefuzz issues 2022-09-19 15:54 Christos Zoulas * Fix error detection for decompression code (Vincent Mihalkovic) 2022-09-15 13:50 Christos Zoulas * Add MAGIC_NO_COMPRESS_FORK and use it to produce a more meaningful error message if we are sandboxing. 2022-09-15 10:45 Christos Zoulas * Add built-in lzip decompression support (Michal Gorny) 2022-09-14 10:35 Christos Zoulas * Add built-in zstd decompression support (Martin Rodriguez Reboredo) 2022-09-13 14:55 Christos Zoulas * release 5.43 2022-09-10 9:17 Christos Zoulas * Add octal indirect magic (Michal Gorny) 2022-08-17 11:43 Christos Zoulas * PR/374: avoid infinite loop in non-wide code (piru) * PR/373: Obey MAGIC_CONTINUE with multiple magic files (vismarli) 2022-07-26 11:10 Christos Zoulas * Fix bug with large flist (Florian Weimer) 2022-07-07 13:21 Christos Zoulas * PR/364: Detect non-nul-terminated core filenames from QEMU (mam-ableton) 2022-07-04 15:45 Christos Zoulas * PR/359: Add support for http://ndjson.org/ (darose) * PR/362: Fix wide printing (ro-ee) * PR/358: Fix width for -f - (jpalus) * PR/356: Fix JSON constant parsing (davewhite) 2022-06-10 9:40 Christos Zoulas * release 5.42 2022-05-31 14:50 Christos Zoulas * PR/348: add missing cases to prevent file from aborting on random magic files. 2022-05-27 21:05 Christos Zoulas * PR/351: octalify filenames when not raw before printing. 2022-04-18 17:51 Christos Zoulas * fix regex cacheing bug (Dirk Mueller) * merge file_regcomp and file_regerror() to simplify the code and reduce memory requirements for storing regexes (Dirk Mueller) 2022-03-19 12:56 Christos Zoulas * cache regex (Dirk Mueller) * detect filesystem full by flushing output (Dirk Mueller) 2021-11-19 12:36 Christos Zoulas * implement running decompressor programs using posix_spawnp(2) instead of vfork(2) 2021-10-24 11:51 Christos Zoulas * Add support for msdos dates and times 2021-10-20 9:55 Christos Zoulas * use the system byte swapping functions if available (Werner Fink) 2021-10-18 11:57 Christos Zoulas * release 5.41 2021-09-23 03:51 Christos Zoulas * Avinash Sonawane: Fix tzname detection 2021-09-03 09:17 Christos Zoulas * Fix relationship tests with "search" magic, don't short circuit logic 2021-07-13 01:06 Christos Zoulas * Fix memory leak in compile mode 2021-07-01 03:51 Christos Zoulas * PR/272: kiefermat: Only set returnval = 1 when we printed something (in all cases print or !print). This simplifies the logic and fixes the issue in the PR with -k and --mime-type there was no continuation printed before the default case. 2021-06-30 13:07 Christos Zoulas * PR/270: Don't translate unprintable characters in %s magic formats when -r * PR/269: Avoid undefined behavior with clang (adding offset to NULL) 2021-05-09 18:38 Christos Zoulas * Add a new flag (f) that requires that the match is a full word, not a partial word match. * Add varint types (unused) 2021-04-19 17:17 Christos Zoulas * PR/256: mutableVoid: If the file is less than 3 bytes, use the file length to determine type * PR/259: aleksandr.v.novichkov: mime printing through indirect magic is not taken into account, use match directly so that it does. 2021-04-04 17:02 Christos Zoulas * count the total bytes found not the total byte positions in order to determine encoding (Anatol Belski) @ text @d2 1 a2 1 # $File: filesystems,v 1.150 2022/07/04 16:40:33 christos Exp $ d223 1 a223 1 >>>>21 ubyte x \b, from drive %#x d274 1 a274 1 >>>0x64 ulelong x \b, serial number %#x d311 1 a311 1 >>>>>0x49 ubyte >0 at offset %#x d319 1 a319 1 >>>>>0x74 ubyte >0 at offset %#x d327 1 a327 1 >>>>>0x79 ubyte >0 at offset %#x d342 1 a342 1 >>>>0x3C ubyte x at offset %#x+0xFF d415 1 a415 1 >>0x1b8 ulelong >0 \b, disk signature %#-.4x d420 1 a420 1 >>>>0xDC ubyte x with driveID %#x d467 1 a467 1 >>>>>>438 ubyte x \b,%#x dots d473 1 a473 1 >>>>>>419 ubyte x \b%#x seconds d512 1 a512 1 >>>>0x3E ubyte x \b, stage1 version %#x d514 1 a514 1 >>>>0x40 ubyte <0xFF \b, boot drive %#x d516 9 a524 9 >>>>0x41 ubyte >0 \b, LBA flag %#x >>>>0x42 uleshort <0x8000 \b, stage2 address %#x #>>>>0x42 uleshort =0x8000 \b, stage2 address %#x (usual) >>>>0x42 uleshort >0x8000 \b, stage2 address %#x #>>>>0x44 ulelong =1 \b, 1st sector stage2 %#x (default) >>>>0x44 ulelong >1 \b, 1st sector stage2 %#x >>>>0x48 uleshort <0x800 \b, stage2 segment %#x #>>>>0x48 uleshort =0x800 \b, stage2 segment %#x (usual) >>>>0x48 uleshort >0x800 \b, stage2 segment %#x d1129 1 a1129 1 >>4 ubyte x : ID=%#x d1131 1 a1131 1 >>0 ubyte >0x80 %#x d1229 1 a1229 1 >>>0x1B8 ubelong >0 \b,Serial %#-.8x d1280 1 a1280 1 #>>>(0x1BC.s+10) ubyte x \b,flags %#x d1282 1 a1282 1 #>>>(0x1BC.s+11) ubyte x \b,cfg_def %#x d1288 1 a1288 1 >>>>(0x1BC.s+13) ubyte <2 \b,floppy %#x d1291 1 a1291 1 #>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive %#x d1293 1 a1293 1 >>>>>(0x1BC.s+13) ubyte !0x80 \b,drive %#x d1299 1 a1299 1 >>>>(0x1BC.s+14) ubyte <2 \b,floppy %#x d1302 1 a1302 1 #>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive %#x d1304 1 a1304 1 >>>>>(0x1BC.s+14) ubyte !0x80 \b,drive %#x d1333 3 a1335 3 >>>>>0x20C ubyte x \b, identifier %#x #>>>>>0x20D ubyte =0 \b, LBA flag %#x (default) >>>>>0x20D ubyte >0 \b, LBA flag %#x d1350 1 a1350 1 >>>>>0x210 ubyte x \b, identifier %#x d1352 2 a1353 2 #>>>>>0x211 ubyte =0 \b, LBA flag %#x (default) >>>>>0x211 ubyte >0 \b, LBA flag %#x d1380 1 a1380 1 >>>>>>1 ubyte x \b, code offset %#x+2 d1382 1 a1382 1 >>>>>>1 uleshort x \b, code offset %#x+3 d1407 3 a1409 3 >>>>>21 ubyte >0xF0 \b, Media descriptor %#x #>>>>>21 ubyte =0xF0 \b, Media descriptor %#x (usual floppy) >>>>>21 ubyte <0xF0 \b, Media descriptor %#x d1428 2 a1429 2 #>>>>>>>>36 ubyte 0x80 \b, physical drive %#x=0x80 (usual harddisk) #>>>>>>>>36 ubyte 0 \b, physical drive %#x=0 (usual floppy) d1431 1 a1431 1 >>>>>>>>>36 ubyte !0 \b, physical drive %#x d1434 2 a1435 2 >>>>>>>>37 ubyte >0 \b, reserved %#x #>>>>>>>>37 ubyte =0 \b, reserved %#x d1437 1 a1437 1 >>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (%#x) d1439 1 a1439 1 >>>>>>>>>39 ulelong x \b, serial number %#x d1481 1 a1481 1 >>>>>>40 uleshort >0 \b, extension flags %#x d1498 3 a1500 3 >>>>>>52 ulelong >0 \b, reserved1 %#x >>>>>>56 ulelong >0 \b, reserved2 %#x >>>>>>60 ulelong >0 \b, reserved3 %#x d1502 2 a1503 2 #>>>>>>64 ubyte =0x80 \b, physical drive %#x=80 (usual harddisk) #>>>>>>64 ubyte =0 \b, physical drive %#x=0 (usual floppy) d1505 1 a1505 1 >>>>>>>64 ubyte >0 \b, physical drive %#x d1507 2 a1508 2 >>>>>>65 ubyte >0 \b, reserved %#x >>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (%#x) d1510 1 a1510 1 >>>>>>>67 ulelong x \b, serial number %#x d1533 1 a1533 1 #38 ubyte =0x80 \b, dos < 4.0 BootSector (%#x) d1536 1 a1536 1 >>>>>>>>>36 ulelong !0x800080 \b, physical drive %#x d1552 2 a1553 2 >>>>>>>>>80 ulelong >0 \b, checksum %#x #>>>>>>>>>80 ulelong =0 \b, checksum %#x=0 (usual) d1720 1 a1720 7 >0xa0 ulelong x flags %#x 0 ulequad 0x48414d3205172011 HAMMER2 filesystem (little-endian), >0x3b byte x volume %d, >0x28 ulequad/1073741824 x size %lluGB, >0x30 ulelong x version %u, >0x34 ulelong x flags %#x d1742 6 a1747 6 >0x468 ubelong x \b, UUID=%08x >0x46c ubeshort x \b-%04x >0x46e ubeshort x \b-%04x >0x470 ubeshort x \b-%04x >0x472 ubelong x \b-%08x >0x476 ubeshort x \b%04x d1770 6 a1775 6 >0x46c ubelong x \b, UUID=%08x >0x470 ubeshort x \b-%04x >0x472 ubeshort x \b-%04x >0x474 ubeshort x \b-%04x >0x476 ubelong x \b-%08x >0x47a ubeshort x \b%04x d1940 1 a1940 1 #>>512 ubyte x \b, Media descriptor %#x d1950 1 a1950 1 #>>>>1 ubyte x \b, code offset %#x+2 d1990 2 a1991 2 >>38917 byte >0x33 (unknown version, ID %#X) >>38917 byte <0x31 (unknown version, ID %#X) d2049 1 a2049 1 >32 lelong x CRC %#x, d2059 1 a2059 1 >32 belong x CRC %#x, d2152 4 a2155 4 >16 belong x Load Address: %#08X, >20 belong x Entry Point: %#08X, >4 belong x Header CRC: %#08X, >24 belong x Data CRC: %#08X d2299 14 a2312 16 0x10040 string _BHRfS_M BTRFS Filesystem >0x1012b string >\0 label "%s", >0x10090 lelong x sectorsize %d, >0x10094 lelong x nodesize %d, >0x10098 lelong x leafsize %d, >0x10020 ubelong x UUID=%08x- >0x10024 ubeshort x \b%04x- >0x10026 ubeshort x \b%04x- >0x10028 ubeshort x \b%04x- >0x1002a ubeshort x \b%04x >0x1002c ubelong x \b%08x, >0x10078 lequad x %lld/ >0x10070 lequad x \b%lld bytes used, >0x10088 lequad x %lld devices 0 string btrfs-stream BTRFS stream file d2381 1 a2381 1 >52 lelong x \b inode file disk address %#x, d2383 3 a2385 3 >60 lelong x \b address of last segment written %#x, >64 lelong x \b address of next segment to write %#x, >68 lelong x \b address of current segment written %#x d2396 3 a2398 98 # URL: http://fileformats.archiveteam.org/wiki/LoadDskF/SaveDskF # Update: Joerg Jenderek # Note: called "IBM SKF disk image" by TrID # verfied by 7-Zip `7z l -tFAT -slt *.dsk` and # `deark -l -m loaddskf 06200D19.DSK` # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf-old.trid.xml 0 beshort 0xAA58 >0 use SaveDskF # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf.trid.xml 0 beshort 0xAA59 >0 use SaveDskF # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf-comp.trid.xml 0 beshort 0xAA5A # skip foo by additional check for unused upper byte of media type in SaveDskF header #>3 ubyte =0 # skip bar by additional check for valid "low" number of heads in SaveDskF header #>>26 uleshort <3 # skip foo by additional check for unused double word field in SaveDskF header #>>>30 long =0 #>>>>0 use SaveDskF >0 use SaveDskF # display information about IBM SaveDskF floppy disk images 0 name SaveDskF # SaveDskF magic >0 beshort x floppy image data (IBM SaveDskF #!:mime application/octet-stream !:mime application/x-ibm-dsk !:ext dsk # also suffix with digit (1dk .2dk ...); NO example FOUND! #!:ext dsk/1dk/2dk >1 ubyte =0x58 \b, old) >1 ubyte =0x59 \b) >1 ubyte =0x5A \b, compressed) # media type; the first byte of the FAT like: 0xF0 (usual floppy) 0xF9 0xFE # https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system >2 ubyte !0xF0 \b, Media descriptor %#x # upper byte of media type is not used; so this seems to be nil >3 ubyte !0 \b, upper byte of media type %#x # sector size in bytes as in the BIOS parameter block like: 512 ; SAVEDSKF.EXE with other sizes produce garbage images >4 uleshort !512 \b, Bytes/sector %u # cluster mask; number of sectors per cluster, minus 1 >6 uleshort+1 >1 \b, sectors/cluster %u #>6 uleshort+1 x \b, sectors/cluster %u # cluster shift; log2(cluster size / sector size) like: 0~1=ClusterSize/SectorSize >7 ubyte >0 \b, cluster shift %u #>7 ubyte x \b, cluster shift %u # reserved sectors; as in the BIOS parameter block like: 1 256 (2M256R-K.DSK) >8 uleshort >1 \b, reserved sectors %u #>8 uleshort x \b, reserved sectors %u # FAT copies; as in the BIOS parameter block like: 2 (usual) 1 (2-NK.DSK) >10 ubyte !2 \b, FAT # plural s >>10 ubyte >1 \bs >>10 ubyte x %u # root directory entries; as in the BIOS parameter block like: 224 (usual) 64 (H1-NK.DSK) 4096 (2-NK.DSK) >11 uleshort !224 \b, root entries %u # sector number of first cluster (count sectors used by boot sector, FATs and root directory) like: 7 10 29 33 288 >13 uleshort !33 \b, 1st cluster at sector %u # number of clusters in image; empty clusters at the end are not saved and counted like: 2372 2848 >15 uleshort x \b, %u clusters # sectors/FAT; as in the BIOS parameter block like: 1 (H1-NK.DSK) 7 9 >17 ubyte !9 \b, sectors/FAT %u # sector number of root directory (ie, count of sectors used by boot sector and FATs) like: 3 (H1-NK.DSK) 9 10 15 19 274 (2M256R-K.DSK) >18 uleshort !19 \b, root directory at sector %u # checksum; sum of all bytes in the file >20 ulelong x \b, checksum %#8.8x # cylinders; number of cylinders like: 40 80 >24 uleshort !80 \b, %u cylinders #>24 uleshort x \b, %u cylinders # heads; number of heads as in the BIOS parameter block like: 1 (H1-NK.DSK) 2 >26 uleshort !2 \b, heads %u #>26 uleshort x \b, heads %u # sectors/track; number of sectors per track as in the BIOS parameter block like: 8 15 18 36 >28 uleshort !18 \b, sectors/track %u #>28 uleshort x \b, sectors/track %u # unused double word field seems to be always like: 0 >30 ulelong !0 \b, at 0x1E %#x # number of sectors in images like: 1017 2786 2880 >34 uleshort x \b, sectors %u # if string is "printable" it can be a real comment >(36.s) ubyte !0x00 # if 1st sector is far enough away (> 0x29) then there is space for comment part >>38 uleshort >41 # offset to comment string like: 28h=40 >>>36 uleshort x \b, at %#x # comment string terminated with \r\n\0 >>>(36.s) string x "%s" # offset to the first sector like: 0 (If this is 0, assume it is 0x200) 29h=41 (DISPLAY3.DSK) 31h 43h 45h 46h 48h 50h 200h=512 >38 uleshort !0 \b, 1st sector at %#x # FOR DEBUGGING! #>(38.s) ubelong x SECTOR CONTENT %x # not compressed floppy image implies readable DOS boot sector inside image >>1 ubyte !0x5A # when not compressed it is readable as DOS boot sector via ./filesystems #>>>(38.s) indirect x \b; contains >38 uleshort =0 \b, 1st sector at 0x200 (0) # maybe standard DOS boot sector; NO example FOUND HERE! #>>0x200 indirect x \b; contains a2401 60 # From: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/Central_Point_Software#cite_note-6 # Reference: https://www.robcraig.com/download/transcopy-5-x-file-format # https://www.robcraig.com/download/transcopy-file-format-by-gene-thompson # http://mark0.net/download/triddefs_xml.7z/defs/t/tc-transcopy.trid.xml # TransCopy signature 0 beshort 0x5AA5 # skip Intel serial flash ROM with invalid 0 disk sides handled by ./intel >0x103 ubyte !0 # skip Intel serial flash ROM with unlikely "high" start cylinder 100 handled by ./intel #>>0x101 ubyte <100 VALID_START_CYLINDER # skip Intel serial flash ROM with unlikely description handled by ./intel #>>>2 beshort !0xF00f VALID_DESCRIPTION # skip Intel serial flash ROM with invalid disk types 89h 88h handled by ./intel #>>>>0x100 byte !0x89 VALID_DISK_TYPE >>0 use tc-floppy # display information of Central Point Software (CPS) Option Board TransCopy floppy image 0 name tc-floppy >0 beshort x TransCopy disk image #!:mime application/octet-stream !:mime application/x-floppy-image-tc # like: disk04.tc VOCALC2.TC WIZ5_A.tc WIZ2_720.IMG !:ext tc/img # 1st description (optional 0-terminated maximal 32) like: # "Project Workbench 2.20" "Visi On Calc" "Wizardry V Disk 1 of 3" >2 string >\0 %.32s # 2nd desc. (optional 0-terminated maximal 32) like: # "(1988)." "Advanced - Utility" 'Program Disk 2" >0x22 string >\0 "%.32s" # Looks like ascii (like MESSAGES) formatted with attribute bytes (190)? # not needed for disk copy #>>0x42 string x '%.190s' #>>0x88 lestring16 x "%.8s" # disktype: 2~MFM High Density 3~MFM Double Density 4~Apple II GCR 5~FM Single Density # 6~Commodore GCR 7~MFM Double Density 8~Commodore Amiga Ch~Atari FM FFh~Unknown >0x100 ubyte !0xFF \b, disk type %u # StartingCylinder like: 0 >0x101 ubyte x \b, cylinder >0x101 ubyte !0 start=%u # EndingCylinder like: 40 (often) 41 79 >0x102 ubyte x end=%u # NumberOfSides like: 2 >0x103 ubyte !2 \b, %u sides # TrackIncrement like: 1 >0x104 ubyte !1 \b, track increment %u # TrackPosTbl Track skew #>0x105 ubequad x \b, Track skew %#16.16llx # TrackOffsTbl #>0x305 ubequad x \b, TrackOffsTbl %#16.16llx # TrackLngthTbl #>0x505 ubequad x \b, TrackLngthTbl %#16.16llx # TrackTypeTable #>0x705 ubequad x \b, TrackTypeTable %#16.16llx # Address mark timing #>0x905 ubequad x \b, Address mark timing %#16.16llx # Track fragment #>0x2905 ubequad !0 \b, Track fragment %#16.16llx # Track data #>0x4000 ubequad !0 \b, Track data %#16.16llx d2417 1 a2417 1 >0x04 lelong x \b, CRC %#08x a2475 51 # bcachefs # From: Thomas Weißschuh 0 name bcachefs-uuid >0 ubelong x \b%08x >4 ubeshort x \b-%04x >6 ubeshort x \b-%04x >8 ubeshort x \b-%04x >10 ubelong x \b-%08x >14 ubeshort x \b%04x 0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 bcachefs >0x1068 lequad 8 \b, UUID= >>0x1038 use bcachefs-uuid >>0x1048 string >0 \b, label "%.32s" >>0x1010 uleshort x \b, version %u >>0x1012 uleshort x \b, min version %u >>0x107a byte x \b, device %d # assumes the first field is the members field >>0x12f4 ulelong 0x01 \b/UUID= >>>0x12f0 default x >>>&(0x107a.b*56) use bcachefs-uuid >>0x107b byte x \b, %d devices >>0x1090 byte ^0x02 \b (unclean) # EROFS # https://kernel.googlesource.com/pub/scm/linux/kernel/git/xiang/erofs-utils/\ # +/refs/heads/experimental/include/erofs_fs.h#12 1024 lelong 0xE0F5E1E2 EROFS filesystem #>1028 lelong x \b, checksum=%#x >1032 lelong >0 \b, compat: >>1032 lelong &1 SB_CHKSUM >>1032 lelong &2 MTIME >1036 byte x \b, blocksize=%u >1037 byte x \b, exslots=%u #>1038 leshort x \b, root_nid=%d #>1040 lequad x \b, inodes=%ld #>1048 leldate x \b, build_time=%s #>1056 lelong x \b.%d #>1060 lelong x \b, blocks=%d #>1064 lelong x \b, metadata@@%#x #>1068 lelong x \b, xattr@@%#x >1072 guid x \b, uuid=%s >1088 string >0 \b, name=%s >1104 lelong >0 \b, incompat: >>1104 lelong &1 LZ4_0PADDING >>1104 lelong &2 BIG_PCLUSTER >>1104 lelong &4 CHUNKED_FILE >>1104 lelong &8 DEVICE_TABLE >>1104 lelong &16 ZTAILPACKING @ 1.1.1.18 log @Update to file-5.45 (Last was file-5.44) 2023-07-27 15:45 Christos Zoulas * release 5.45 2023-07-17 11:53 Christos Zoulas * PR/465: psrok1: Avoid muslc asctime_r crash 2023-05-21 13:05 Christos Zoulas * add SIMH tape format support 2023-02-09 12:50 Christos Zoulas * bump the max size of the elf section notes to be read to 128K and make it configurable 2023-01-08 1:08 Christos Zoulas * PR/415: Fix decompression with program returning empty 2022-12-26 1:47 Christos Zoulas * PR/408: fix -p with seccomp * PR/412: fix MinGW compilation @ text @d2 1 a2 1 # $File: filesystems,v 1.158 2023/05/21 17:19:08 christos Exp $ d1599 1 a1599 2 0 name ffsv1 d1615 39 a1653 2 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), >0 use ffsv1 d1660 14 a1673 30 >0 use \^ffsv1 0 name ffsv2 >212 string x last mounted on %s, >680 string >\0 volume name %s, >1072 leqldate x last written at %s, >209 byte x clean flag %d, >210 byte x readonly flag %d, >1080 lequad x number of blocks %lld, >1088 lequad x number of data blocks %lld, >44 lelong x number of cylinder groups %d, >48 lelong x block size %d, >52 lelong x fragment size %d, >1196 lelong x average file size %d, >1200 lelong x average number of files in dir %d, >1104 lequad x pending blocks to free %lld, >1112 lelong x pending inodes to free %d, >712 lequad x system-wide uuid %0llx, >60 lelong x minimum percentage of free blocks %d, >128 lelong 0 TIME optimization >128 lelong 1 SPACE optimization 42332 lelong 0x19012038 Unix Fast File system [v2ea] (little-endian) >40960 use ffsv2 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) >40960 use ffsv2 42332 belong 0x19012038 Unix Fast File system [v2ea] (little-endian) >40960 use \^ffsv2 d1676 18 a1693 10 >40960 use \^ffsv2 66908 lelong 0x19012038 Unix Fast File system [v2ea] (little-endian) >65536 use ffsv2 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) >65536 use ffsv2 66908 belong 0x19012038 Unix Fast File system [v2ea] (little-endian) >65536 use \^ffsv2 d1696 18 a1713 1 >65536 use \^ffsv2 d2651 7 a2657 7 0 name bcachefs bcachefs >0x68 lequad 8 \b, UUID= >>0x38 use bcachefs-uuid >>0x48 string >0 \b, label "%.32s" >>0x10 uleshort x \b, version %u >>0x12 uleshort x \b, min version %u >>0x7a byte x \b, device %d d2659 5 a2663 11 >>0x2f4 ulelong 0x01 \b/UUID= >>>0x2f0 default x >>>&(0x07a.b*56) use bcachefs-uuid >>0x07b byte x \b, %d devices >>0x090 byte ^0x02 \b (unclean) 0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 >0x1000 use bcachefs 0x1018 string \xc6\x85\x73\xf6\x66\xce\x90\xa9\xd9\x6a\x60\xcf\x80\x3d\xf7\xef >0x1000 use bcachefs a2689 44 # YAFFS # The layout itself is undocumented, determined by the memory layout of the # reference implementation. This signature is derived from the # reference implementation code and generated test cases # We recognize the start of an object header defined by yaffs_obj_hdr: # (Note the values being encoded depending on platform endianess) # u32 type /* enum yaffs_obj_type, valid 1-5 */ # u32 parent_obj_id; /* 1 for root objects we recognize */ # u16 sum_no_longer_used; /* checksum of name. Not used by YAFFS and memset to 0xFF */ # YCHAR name[YAFFS_MAX_NAME_LENGTH + 1]; # mkyaffsimage always writes a root directory with empty name, then processing the target directory contents # mkyaffs2image directly proceeds to writing entries with the appropriate u32 YAFFS_OBJECT_TYPE (1-5 valid), each with parent id 1 0 name yaffs >0 ulelong 1 \b, type file >0 ulelong 2 \b, type symlink >0 ulelong 3 \b, type root or directory >0 ulelong 4 \b, type hardlink >0 ulelong 5 \b, type special >0xA byte 0 \b, v1 root directory >0xA byte !0 \b, object entry >>0xA string x (name: "%s") # Little Endian: XX 00 00 00 01 00 00 00 FF FF YY # XX: 01 - 05 (object type) # YY: 00 for version 1 root directory, > 00 for version 2 (name data) 0x1 string \x00\x00\x00\x01\x00\x00\x00\xFF\xFF >0 ulelong 0 >0 ulelong >5 >0 default x YAFFS filesystem root entry (little endian) >>0 use yaffs # Big Endian: 00 00 00 XX 00 00 00 01 FF FF YY # XX: 01 - 05 (object type) # YY: 00 for version 1 root directory, > 00 for version 2 (name data) 0x4 string \x00\x00\x00\x01\xFF\xFF >0 string \x00\x00\x00 >>0 ubelong 0 >>0 ubelong >5 >>0 default x YAFFS filesystem root entry (big endian) >>>0 use \^yaffs @