head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC4:1.1.1.9 netbsd-11-0-RC3:1.1.1.9 netbsd-11-0-RC2:1.1.1.9 netbsd-11-0-RC1:1.1.1.9 perseant-exfatfs-base-20250801:1.1.1.9 netbsd-11:1.1.1.9.0.4 netbsd-11-base:1.1.1.9 netbsd-10-1-RELEASE:1.1.1.8 perseant-exfatfs-base-20240630:1.1.1.9 perseant-exfatfs:1.1.1.9.0.2 perseant-exfatfs-base:1.1.1.9 netbsd-8-3-RELEASE:1.1.1.2 netbsd-9-4-RELEASE:1.1.1.4 netbsd-10-0-RELEASE:1.1.1.8 netbsd-10-0-RC6:1.1.1.8 netbsd-10-0-RC5:1.1.1.8 netbsd-10-0-RC4:1.1.1.8 netbsd-10-0-RC3:1.1.1.8 netbsd-10-0-RC2:1.1.1.8 netbsd-10-0-RC1:1.1.1.8 FILE5_45:1.1.1.9 netbsd-10:1.1.1.8.0.2 netbsd-10-base:1.1.1.8 FILE5_43:1.1.1.8 netbsd-9-3-RELEASE:1.1.1.4 cjep_sun2x-base1:1.1.1.7 cjep_sun2x:1.1.1.7.0.4 cjep_sun2x-base:1.1.1.7 cjep_staticlib_x-base1:1.1.1.7 netbsd-9-2-RELEASE:1.1.1.4 cjep_staticlib_x:1.1.1.7.0.2 cjep_staticlib_x-base:1.1.1.7 FILE5_40:1.1.1.7 netbsd-9-1-RELEASE:1.1.1.4 FILE5_39:1.1.1.6 phil-wifi-20200421:1.1.1.5 phil-wifi-20200411:1.1.1.5 is-mlppp:1.1.1.5.0.2 is-mlppp-base:1.1.1.5 phil-wifi-20200406:1.1.1.5 netbsd-8-2-RELEASE:1.1.1.2 netbsd-9-0-RELEASE:1.1.1.4 netbsd-9-0-RC2:1.1.1.4 FILE5_38:1.1.1.5 netbsd-9-0-RC1:1.1.1.4 phil-wifi-20191119:1.1.1.4 netbsd-9:1.1.1.4.0.2 netbsd-9-base:1.1.1.4 phil-wifi-20190609:1.1.1.4 netbsd-8-1-RELEASE:1.1.1.2 FILE5_37:1.1.1.4 netbsd-8-1-RC1:1.1.1.2 pgoyette-compat-merge-20190127:1.1.1.2.44.1 pgoyette-compat-20190127:1.1.1.3 pgoyette-compat-20190118:1.1.1.3 pgoyette-compat-1226:1.1.1.3 pgoyette-compat-1126:1.1.1.3 pgoyette-compat-1020:1.1.1.3 FILE5_35:1.1.1.3 pgoyette-compat-0930:1.1.1.3 pgoyette-compat-0906:1.1.1.3 netbsd-7-2-RELEASE:1.1.1.2 pgoyette-compat-0728:1.1.1.3 netbsd-8-0-RELEASE:1.1.1.2 phil-wifi:1.1.1.3.0.2 phil-wifi-base:1.1.1.3 pgoyette-compat-0625:1.1.1.3 netbsd-8-0-RC2:1.1.1.2 pgoyette-compat-0521:1.1.1.3 pgoyette-compat-0502:1.1.1.3 pgoyette-compat-0422:1.1.1.3 netbsd-8-0-RC1:1.1.1.2 FILE5_33:1.1.1.3 pgoyette-compat-0415:1.1.1.2 pgoyette-compat-0407:1.1.1.2 pgoyette-compat-0330:1.1.1.2 pgoyette-compat-0322:1.1.1.2 pgoyette-compat-0315:1.1.1.2 netbsd-7-1-2-RELEASE:1.1.1.2 pgoyette-compat:1.1.1.2.0.44 pgoyette-compat-base:1.1.1.2 netbsd-7-1-1-RELEASE:1.1.1.2 matt-nb8-mediatek:1.1.1.2.0.42 matt-nb8-mediatek-base:1.1.1.2 FILE5_32:1.1.1.2 perseant-stdc-iso10646:1.1.1.2.0.40 perseant-stdc-iso10646-base:1.1.1.2 netbsd-8:1.1.1.2.0.38 netbsd-8-base:1.1.1.2 FILE5_31:1.1.1.2 prg-localcount2-base3:1.1.1.2 prg-localcount2-base2:1.1.1.2 prg-localcount2-base1:1.1.1.2 prg-localcount2:1.1.1.2.0.36 prg-localcount2-base:1.1.1.2 pgoyette-localcount-20170426:1.1.1.2 bouyer-socketcan-base1:1.1.1.2 pgoyette-localcount-20170320:1.1.1.2 netbsd-7-1:1.1.1.2.0.34 netbsd-7-1-RELEASE:1.1.1.2 netbsd-7-1-RC2:1.1.1.2 FILE5_30:1.1.1.2 netbsd-7-nhusb-base-20170116:1.1.1.2 bouyer-socketcan:1.1.1.2.0.32 bouyer-socketcan-base:1.1.1.2 pgoyette-localcount-20170107:1.1.1.2 netbsd-7-1-RC1:1.1.1.2 pgoyette-localcount-20161104:1.1.1.2 netbsd-7-0-2-RELEASE:1.1.1.2 localcount-20160914:1.1.1.2 netbsd-7-nhusb:1.1.1.2.0.30 netbsd-7-nhusb-base:1.1.1.2 pgoyette-localcount-20160806:1.1.1.2 pgoyette-localcount-20160726:1.1.1.2 pgoyette-localcount:1.1.1.2.0.28 pgoyette-localcount-base:1.1.1.2 netbsd-7-0-1-RELEASE:1.1.1.2 netbsd-7-0:1.1.1.2.0.26 netbsd-7-0-RELEASE:1.1.1.2 netbsd-7-0-RC3:1.1.1.2 netbsd-7-0-RC2:1.1.1.2 netbsd-7-0-RC1:1.1.1.2 FILE5_22:1.1.1.2 FILE5_20:1.1.1.2 netbsd-6-0-6-RELEASE:1.1.1.2 netbsd-6-1-5-RELEASE:1.1.1.2 netbsd-7:1.1.1.2.0.24 netbsd-7-base:1.1.1.2 FILE5_19:1.1.1.2 yamt-pagecache-base9:1.1.1.2 yamt-pagecache-tag8:1.1.1.2 netbsd-6-1-4-RELEASE:1.1.1.2 netbsd-6-0-5-RELEASE:1.1.1.2 tls-earlyentropy:1.1.1.2.0.22 tls-earlyentropy-base:1.1.1.2 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.2 riastradh-drm2-base3:1.1.1.2 netbsd-6-1-3-RELEASE:1.1.1.2 netbsd-6-0-4-RELEASE:1.1.1.2 FILE5_16:1.1.1.2 netbsd-6-1-2-RELEASE:1.1.1.2 netbsd-6-0-3-RELEASE:1.1.1.2 netbsd-6-1-1-RELEASE:1.1.1.2 riastradh-drm2-base2:1.1.1.2 riastradh-drm2-base1:1.1.1.2 riastradh-drm2:1.1.1.2.0.14 riastradh-drm2-base:1.1.1.2 netbsd-6-1:1.1.1.2.0.20 netbsd-6-0-2-RELEASE:1.1.1.2 netbsd-6-1-RELEASE:1.1.1.2 khorben-n900:1.1.1.2.0.18 netbsd-6-1-RC4:1.1.1.2 netbsd-6-1-RC3:1.1.1.2 agc-symver:1.1.1.2.0.16 agc-symver-base:1.1.1.2 FILE5_14:1.1.1.2 netbsd-6-1-RC2:1.1.1.2 netbsd-6-1-RC1:1.1.1.2 yamt-pagecache-base8:1.1.1.2 FILE_5_12:1.1.1.2 netbsd-6-0-1-RELEASE:1.1.1.2 yamt-pagecache-base7:1.1.1.2 matt-nb6-plus-nbase:1.1.1.2 yamt-pagecache-base6:1.1.1.2 netbsd-6-0:1.1.1.2.0.12 netbsd-6-0-RELEASE:1.1.1.2 netbsd-6-0-RC2:1.1.1.2 tls-maxphys:1.1.1.2.0.10 tls-maxphys-base:1.1.1.2 matt-nb6-plus:1.1.1.2.0.8 matt-nb6-plus-base:1.1.1.2 netbsd-6-0-RC1:1.1.1.2 yamt-pagecache-base5:1.1.1.2 yamt-pagecache-base4:1.1.1.2 FILE5_11:1.1.1.2 netbsd-6:1.1.1.2.0.6 netbsd-6-base:1.1.1.2 yamt-pagecache-base3:1.1.1.2 yamt-pagecache-base2:1.1.1.2 yamt-pagecache:1.1.1.2.0.4 yamt-pagecache-base:1.1.1.2 FILE5_09:1.1.1.2 cherry-xenmp:1.1.1.2.0.2 cherry-xenmp-base:1.1.1.2 FILE5_07:1.1.1.2 bouyer-quota2-nbase:1.1.1.1 bouyer-quota2:1.1.1.1.0.4 bouyer-quota2-base:1.1.1.1 matt-mips64-premerge-20101231:1.1.1.1 matt-premerge-20091211:1.1.1.1 jym-xensuspend-base:1.1.1.1 jym-xensuspend:1.1.1.1.0.2 jym-xensuspend-nbase:1.1.1.1 FILE5_03:1.1.1.1 CHRISTOS:1.1.1; locks; strict; comment @# @; 1.1 date 2009.05.08.16.35.08; author christos; state Exp; branches 1.1.1.1; next ; 1.1.1.1 date 2009.05.08.16.35.08; author christos; state Exp; branches 1.1.1.1.2.1; next 1.1.1.2; 1.1.1.2 date 2011.05.12.20.47.01; author christos; state Exp; branches 1.1.1.2.44.1; next 1.1.1.3; 1.1.1.3 date 2018.04.15.19.32.47; author christos; state Exp; branches 1.1.1.3.2.1; next 1.1.1.4; commitid unKSwpX2g9VqBzyA; 1.1.1.4 date 2019.05.22.17.19.57; author christos; state Exp; branches; next 1.1.1.5; commitid VXeNRYYruN1MWdoB; 1.1.1.5 date 2019.12.17.02.23.53; author christos; state Exp; branches; next 1.1.1.6; commitid vqYTz60fS9PNg0PB; 1.1.1.6 date 2020.06.15.00.18.48; author christos; state Exp; branches; next 1.1.1.7; commitid HMbuXSjPojU5LfcC; 1.1.1.7 date 2021.04.09.18.58.02; author christos; state Exp; branches; next 1.1.1.8; commitid W9ddLLbSkHHinEOC; 1.1.1.8 date 2022.09.24.20.07.54; author christos; state Exp; branches; next 1.1.1.9; commitid Nf6F9kcpc0EPC9VD; 1.1.1.9 date 2023.08.18.18.36.51; author christos; state Exp; branches; next ; commitid IX26ghc1E2S0AiBE; 1.1.1.1.2.1 date 2009.05.08.16.35.08; author jym; state dead; branches; next 1.1.1.1.2.2; 1.1.1.1.2.2 date 2009.05.13.18.51.58; author jym; state Exp; branches; next ; 1.1.1.2.44.1 date 2018.04.22.07.20.08; author pgoyette; state Exp; branches; next ; commitid W6xykws0Zbl4kpzA; 1.1.1.3.2.1 date 2019.06.10.21.44.46; author christos; state Exp; branches; next 1.1.1.3.2.2; commitid jtc8rnCzWiEEHGqB; 1.1.1.3.2.2 date 2020.04.08.14.04.04; author martin; state Exp; branches; next ; commitid Qli2aW9E74UFuA3C; desc @@ 1.1 log @Initial revision @ text @ #------------------------------------------------------------------------------ # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured # storage (http://en.wikipedia.org/wiki/Structured_Storage) # Additional tests for OLE 2 Compound Documents should be under this recipe. 0 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document # - Microstation V8 DGN files (www.bentley.com) # Last update on 10/23/2006 by Lester Hightower > 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN # - Visio documents # Last update on 10/23/2006 by Lester Hightower > 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document @ 1.1.1.1 log @from ftp.astron.com @ text @@ 1.1.1.2 log @from ftp.astron.com. - many security related fixes - no MAXPATHLEN limits - fixed missing text specification on ascii magic - new ``pascal'' style string formats - whitespace comparison fix - more magic @ text @a2 1 # $File: ole2compounddocs,v 1.4 2009/09/19 16:28:11 christos Exp $ @ 1.1.1.2.44.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: ole2compounddocs,v 1.5 2017/10/27 21:43:23 christos Exp $ d5 1 a5 1 # storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format) a14 19 # Note: moved & merged Microsoft Office parts from ./msdos Oct 2017 # Update: Joerg Jenderek # from http://filext.com by Derek M Jones # False positive with PPT (also currently this string is too long) #0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer #0 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document #>48 byte 0x1B Excel Document #!:mime application/vnd.ms-excel >546 string bjbj : Microsoft Word Document !:mime application/msword # https://www.macdisk.com/macsigen.php !:apple MSWDWDBN !:ext doc/dot >546 string jbjb : Microsoft Word Document !:mime application/msword !:apple MSWDWDBN !:ext doc @ 1.1.1.3 log @2018-04-15 14:52 Christos Zoulas * release 5.33 2018-02-24 14:50 Christos Zoulas * extend the support for ${x?:} expansions for magic descriptions 2018-02-21 16:25 Christos Zoulas * add support for ${x?:} in mime types to handle pie binaries. 2017-11-03 9:23 Christos Zoulas * add support for negative offsets (offsets from the end of file) 2017-09-26 8:22 Christos Zoulas * close the file on error when writing magic (Steve Grubb) 2017-09-24 12:02 Christos Zoulas * seccomp support (Paul Moore) 2017-09-02 11:53 Christos Zoulas * release 5.32 2017-08-28 16:37 Christos Zoulas * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski) 2017-08-27 03:55 Christos Zoulas * Fix always true condition (Thomas Jarosch) 2017-05-24 17:30 Christos Zoulas * pickier parsing of numeric values in magic files. 2017-05-23 17:55 Christos Zoulas * PR/615 add magic_getflags() @ text @d3 1 a3 1 # $File: ole2compounddocs,v 1.5 2017/10/27 21:43:23 christos Exp $ d5 1 a5 1 # storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format) a14 19 # Note: moved & merged Microsoft Office parts from ./msdos Oct 2017 # Update: Joerg Jenderek # from http://filext.com by Derek M Jones # False positive with PPT (also currently this string is too long) #0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer #0 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document #>48 byte 0x1B Excel Document #!:mime application/vnd.ms-excel >546 string bjbj : Microsoft Word Document !:mime application/msword # https://www.macdisk.com/macsigen.php !:apple MSWDWDBN !:ext doc/dot >546 string jbjb : Microsoft Word Document !:mime application/msword !:apple MSWDWDBN !:ext doc @ 1.1.1.3.2.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: ole2compounddocs,v 1.6 2019/04/19 00:42:27 christos Exp $ d18 1 a18 1 # from https://filext.com by Derek M Jones @ 1.1.1.3.2.2 log @Merge changes from current as of 20200406 @ text @d3 1 a3 1 # $File: ole2compounddocs,v 1.7 2019/08/02 18:08:18 christos Exp $ a6 1 # reference: https://www.openoffice.org/sc/compdocfileformat.pdf d8 1 a8 70 0 string \320\317\021\340\241\261\032\341 # https://digital-preservation.github.io/droid/ # skip droid skeleton like fmt-39-signature-id-128.doc by valid version >0x1A ushort !0xABAB OLE 2 Compound Document #>0x1C uleshort x \b, endnian 0x%4.4x # big endian not tested >>0x1C ubeshort =0xfffe \b, big-endian >>>546 string jbjb : Microsoft Word Document !:mime application/msword !:apple MSWDWDBN !:ext doc # Byte Order 0xFFFE means little-endian found in real world applications #>>0x1C uleshort =0xfffe \b, little-endian >>0x1C uleshort =0xfffe # From: Joerg Jenderek # Major Version 3 or 4 >>>0x1A uleshort x \b, v%u # Minor Version 32h=50 3Bh=59 3Eh=62 >>>0x18 uleshort x \b.%u # SecID of first sector of the directory stream is often 1 but high like 3144h >>>48 ulelong x \b, SecID 0x%x # pointer to root entry only works with standard configuration for SecID ~< 800h # Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls # "ORLEN Factbook 2017.xls" XnView_metadata.doc # "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized >>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB # Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4 >>>0x1E uleshort 0xc \b, blocksize 4096 # jump to one block (4096 bytes per block) before root storage block >>>>(48.l*4096) ubyte x >>>>>&4095 use ole2-directory #>>>0x1E uleshort 9 \b, blocksize 512 >>>0x1E uleshort 9 # jump to one block (512 bytes per block) before root storage block # in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h >>>>(48.l*512) ubyte x >>>>>&511 use ole2-directory # check directory entry structure and display types by GUID 0 name ole2-directory # directory entry name like "Root Entry" #>0 lestring16 x \b, 1st %.10s # type of the entry; 5~Root storage #>66 ubyte x \b, type %x # node colour of the entry: 00H ~ Red 01H ~ Black #>67 ubyte x \b, color %x # the DirIDs of the child nodes. Should both be –1 in the root storage entry #>68 bequad !0xffffffffffffffff \b, DirIDs %llx # second directory entry name like VisioDocument Control000 #>128 lestring16 x \b, 2nd %.20s # third directory entry like WordDocument #>256 lestring16 x \b, 3rd %.20s # forth #>384 lestring16 x \b, 4th %.10s # 5th #>512 lestring16 x \b, 5th %.10s # 6th #>640 lestring16 x \b, 6th %.10s # 7th #>768 lestring16 x \b, 7th %.10s # https://wikileaks.org/ciav7p1/cms/page_13762814.html # https://m.blog.naver.com/superman4u/40047693679 # https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt # http://www.windowstricks.in/online-windows-guid-converter #>80 ubequad !0 \b, clsid 0x%16.16llx #>>88 ubequad x \b%16.16llx # test for "Root Entry" inside directory by type 5 value >66 ubyte 5 # look for CLSID GUID 0 >>88 ubequad 0x0 >>>80 ubequad 0x0 a9 1 # URL: https://en.wikipedia.org/wiki/MicroStation d11 1 a11 132 # 07/24/2019 by Joerg Jenderek # Second directory entry name like Dgn~H Dgn~S >>>>128 lestring16 Dgn~ : Microstation V8 CAD #!:mime application/x-ole-storage !:mime application/x-bentley-dgn # http://www.q-cad.com/files/samples_cad_files/1344468165.dgn !:ext dgn # # URL: http://fileformats.archiveteam.org/wiki/WordPerfect # Second directory entry name PerfectOffice_ >>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic !:mime application/vnd.wordperfect # https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd !:apple ????WPC7 !:ext mst/wpd/wpg # # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor # Second directory entry name MatOST_ >>>>128 lestring16 MatOST : Microsoft Works 3.0 document !:mime application/vnd.ms-works !:apple ????AWWP !:ext wps # # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet # 3rd directory entry name WksSSWorkBook >>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet !:mime application/vnd.ms-works !:apple ????AWSS !:ext xlr # # URL: http://fileformats.archiveteam.org/wiki/XLS # what is the difference to {00020820-0000-0000-c000-000000000046} ? # Second directory entry name Workbook >>>>128 lestring16 Workbook >>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid !:mime application/vnd.ms-excel # https://www.macdisk.com/macsigen.php XLS5 for Excel 5 !:apple ????XLS9 !:ext xls # # URL: http://fileformats.archiveteam.org/wiki/PPT # Second directory entry name Object1 Object12 Object35 >>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation !:mime application/vnd.ms-powerpoint # https://www.macdisk.com/macsigen.php !:apple ????PPT3 !:ext ppt # # URL: https://www.msoutlook.info/question/164 # Second directory entry name __CollDataStm >>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings #!:mime application/vnd.ms-outlook !:mime application/x-ms-srs # %APPDATA%\Microsoft\Outlook\Outlook.srs !:ext srs # # URL: https://www.file-extensions.org/cag-file-extension # Second directory entry name Category >>>>128 lestring16 Category : Microsoft Clip Art Gallery #!:mime application/x-ole-storage !:mime application/x-ms-cag !:apple MScgCGdb !:ext cag/ # # URL: https://www.filesuffix.com/de/extension/rra # 3rd directory entry name StrIndex_StringTable >>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer #!:mime application/x-ole-storage !:mime application/x-ms-rra !:ext rra # # URL: https://www.forensicswiki.org/wiki/Jump_Lists # 3rd directory entry name DestList >>>>256 lestring16 DestList : Windows jump list #!:mime application/x-ole-storage !:mime application/x-ms-jumplist # %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms !:ext automaticDestinations-ms # # URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache # Second directory entry name 256_ >>>>128 lestring16 256_ : Windows thumbnail database 256 #!:mime application/x-ole-storage !:mime application/x-ms-thumbnail # Thumbs.db !:ext db >>>>128 lestring16 96_ : Windows thumbnail database 96 !:mime application/x-ms-thumbnail !:ext db # 3rd directory entry name Catalog_ >>>>256 lestring16 Catalog : Windows thumbnail database !:mime application/x-ms-thumbnail !:ext db # # URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches # Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based # Second directory entry name Control000 >>>>128 lestring16 Control000 : Microsoft old Systeminfo #!:mime application/x-ole-storage !:mime application/x-ms-info !:ext nfo # # URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House # Second directory entry name Thumbnail >>>>128 lestring16 Thumbnail : Corel PrintHouse image #!:mime application/x-ole-storage !:mime application/x-corel-cph !:ext cph # 3rd directory entry name Thumbnail >>>>256 lestring16 Thumbnail : Corel PrintHouse image !:mime application/x-corel-cph !:ext cph # # URL: https://en.wikipedia.org/wiki/Hangul_(word_processor) # Note: "HWP Document File" signature found in FileHeader # Second directory entry name FileHeader hint for Thinkfree Office document >>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor File #!:mime application/haansofthwp !:mime application/x-hwp # https://example-files.online-convert.com/document/hwp/example.hwp !:ext hwp # # URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/ # Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083 >>>>128 lestring16 dd2 : StarOffice Gallery view #!:mime application/x-ole-storage !:mime application/x-star-sdv !:ext sdv # remaining null clsid >>>>128 default x : UNKNOWN !:mime application/x-ole-storage # look for known clsid GUID d13 12 a24 24 # URL: http://fileformats.archiveteam.org/wiki/Visio # Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek >>88 ubequad 0xc000000000000046 : Microsoft >>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template !:mime application/vnd.visio # VSD~Drawing VSS~Stencil VST~Template !:ext vsd/vss/vst >>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template !:mime application/vnd.visio !:ext vsd/vss/vst # # URL: http://fileformats.archiveteam.org/wiki/Windows_Installer >>>80 ubequad 0x84100c0000000000 Windows Installer Package !:mime application/x-msi #!:mime application/x-ms-win-installer !:ext msi >>>80 ubequad 0x86100c0000000000 Windows Installer Patch # ?? !:mime application/x-wine-extension-msp #!:mime application/x-ms-msp !:ext msp # # URL: http://fileformats.archiveteam.org/wiki/DOC >>>80 ubequad 0x0009020000000000 Word 6-95 document or template d26 1 a26 1 # for template MSWDW8TN d29 1 a29 1 >>>80 ubequad 0x0609020000000000 Word 97-2003 document or template d32 1 a32 225 # dot for template; no extension on Macintosh !:ext doc/dot/ # # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor >>>80 ubequad 0x0213020000000000 Works 3-4 document or template !:mime application/vnd.ms-works !:apple ????AWWP # ps for template https://filext.com/file-extension/PS bps for backup !:ext wps/ps/bps # # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database >>>80 ubequad 0x0313020000000000 Works 3-4 database or template !:mime application/vnd.ms-works-db # https://www.macdisk.com/macsigen.php !:apple ????AWDB # db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup !:ext wdb/db/bdb # # URL: https://en.wikipedia.org/wiki/Microsoft_Excel >>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template !:mime application/vnd.ms-excel # https://www.macdisk.com/macsigen.php !:apple ????XLS5 # worksheet/addin/template/no extension on Macintosh !:ext xls/xla/xlt/ # >>>80 ubequad 0x2008020000000000 Excel 97-2003 !:mime application/vnd.ms-excel # https://www.macdisk.com/macsigen.php XLS5 for Excel 5 !:apple ????XLS9 # 3nd directory entry name >>>>256 lestring16 _VBA_PROJECT_CUR addin !:ext xla/ # 4th directory entry name >>>>384 lestring16 _VBA_PROJECT_CUR addin !:ext xla #!:ext xla/ >>>>256 default x worksheet or template !:ext xls/xlt #!:ext xls/xlt/ # # URL: http://fileformats.archiveteam.org/wiki/OLE2 >>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item #>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message #!:mime application/vnd.ms-outlook !:mime application/x-ms-msg !:ext msg # URL: https://wiki.fileformat.com/email/oft/ >>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template #!:mime application/vnd.ms-outlook !:mime application/x-ms-oft !:ext oft # # URL: http://fileformats.archiveteam.org/wiki/PPT >>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation !:mime application/vnd.ms-powerpoint # https://www.macdisk.com/macsigen.php !:apple ????PPT3 !:ext ppt #?? # URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/ >>88 ubequad 0xa29a00aa004a1a72 : Microsoft # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor >>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document !:mime application/vnd.ms-works !:apple ????AWWP !:ext wps # # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database >>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database !:mime application/vnd.ms-works-db !:apple ????AWDB !:ext wdb/bdb #?? >>88 ubequad 0xa40700c04fb932ba : Microsoft # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor >>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document !:mime application/vnd.ms-works !:apple ????AWWP !:ext wps #?? # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher >>88 ubequad 0x00c0000000000046 : Microsoft >>>80 ubequad 0x0112020000000000 Publisher !:mime application/vnd.ms-publisher !:ext pub # # URL: http://fileformats.archiveteam.org/wiki/PPT #?? >>88 ubequad 0xa90300aa00510ea3 : Microsoft >>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation !:mime application/vnd.ms-powerpoint # https://www.macdisk.com/macsigen.php !:apple ????PPT3 !:ext ppt/pot #?? >>88 ubequad 0x86ea00aa00b929e8 : Microsoft >>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template !:mime application/vnd.ms-powerpoint !:apple ????PPT3 # /autostart/template !:ext ppt/pps/pot # # URL: https://en.wikipedia.org/wiki/Microsoft_Project #?? >>88 ubequad 0xbe1100c04fb6faf1 : Microsoft >>>80 ubequad 0x3a8fb774c8c8d111 Project !:mime application/vnd.ms-project !:ext mpp # # URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel) #??? >>88 ubequad 0x99ae04021c007002 : WordPerfect >>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation !:mime application/x-corelpresentations #!:mime application/x-shw-viewer #!:mime image/x-presentations !:ext shw # # URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/ >>>80 ubequad 0x60fe2e4099191b10 9 Graphic #!:mime application/x-wpg #!:mime image/x-wordperfect-graphics !:mime image/x-wpg # https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd !:apple ????WPC9 !:ext wpg # # URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats >>88 ubequad 0x996104021c007002 : StarOffice >>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template # https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html !:mime application/x-starwriter !:ext sdw/vor # >>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template !:mime application/x-starcalc !:ext sdc/vor # >>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template !:mime application/x-starimpress #!:mime application/x-stardraw # sda ?? !:ext sdd/sda/vor #?? >>88 ubequad 0x89cb008029e4b0b1 : StarOffice >>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template !:mime application/x-starcalc !:ext sdc/vor # >>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template !:mime application/vnd.stardivision.cal !:ext sdc/vor # >>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template !:mime application/x-starimpress !:ext sdd/vor #?? >>88 ubequad 0xb12a04021c007002 : StarOffice >>>80 ubequad 0x600459d4fd351c10 StarMath 3.0 !:mime application/x-starmath !:ext smf #?? >>88 ubequad 0x8e2c00001b4cc711 : StarOffice >>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0 !:mime application/x-starchart !:ext sds #?? >>88 ubequad 0xa45e00a0249d57b1 : StarOffice >>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template !:mime application/x-starwriter !:ext sdw/vor #?? >>88 ubequad 0x89ca008029e4b0b1 : StarOffice >>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0 !:mime application/x-starmath !:ext smf # >>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0 !:mime application/x-starchart !:ext sds #?? >>88 ubequad 0xa53f00a0249d57b1 : StarOffice >>>80 ubequad 0x70c90a340de3d011 Master 4.0 document !:mime application/x-starwriter-global !:ext sgl #?? >>88 ubequad 0x89d0008029e4b0b1 : StarOffice >>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0 !:mime application/vnd.stardivision.math !:ext smf # >>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template !:mime application/vnd.stardivision.draw !:ext sda/vor # >>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template !:mime application/vnd.stardivision.impress # sda is used for what? !:ext sdd/vor/sda # >>>80 ubequad 0x214388bfdd85d111 StarChart 5.0 !:mime application/vnd.stardivision.chart !:ext sds # ?? >>88 ubequad 0xaab4006097da561a : StarOffice >>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template !:mime application/vnd.stardivision.writer !:ext sdw/vor # >>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document !:mime application/vnd.stardivision.writer-global !:ext sgl #?? # URL: http://fileformats.archiveteam.org/wiki/FlashPix >>88 ubequad 0x855300aa00a1f95b : Kodak >>>80 ubequad 0x0067615654c1ce11 FlashPIX Image !:mime image/vnd.fpx !:apple ????FPix !:ext fpx # remaining non null clsid >>88 default x : UNKNOWN !:mime application/x-ole-storage >>>80 ubequad !0 \b, clsid 0x%16.16llx >>>88 ubequad x \b%16.16llx @ 1.1.1.4 log @2019-05-14 22:26 Christos Zoulas * release 5.37 2019-05-09 22:27 Christos Zoulas * Make sure that continuation separators are printed with -k within softmagic 2019-05-06 22:27 Christos Zoulas * Change SIGPIPE saving and restoring during compression to use sigaction(2) instead of signal(3) and cache it. (Denys Vlasenko) * Cache stat(2) calls more to reduce number of calls (Denys Vlasenko) 2019-05-06 17:25 Christos Zoulas * PR/77: Handle --mime-type and -k correctly. 2019-05-03 15:26 Christos Zoulas * Switch decompression code to use vfork() because tools like rpmdiff and rpmbuild call libmagic with large process footprints (Denys Vlasenko) 2019-04-07 14:05 Christos Zoulas * PR/75: --enable-zlib, did not work. 2019-02-27 11:54 Christos Zoulas * Improve regex efficiency (Michael Schroeder) by: 1. Prefixing regex searches with regular search for keywords where possible 2. Using memmem(3) where available @ text @d3 1 a3 1 # $File: ole2compounddocs,v 1.6 2019/04/19 00:42:27 christos Exp $ d18 1 a18 1 # from https://filext.com by Derek M Jones @ 1.1.1.5 log @Import 5.38: - Always accept -S (no sandbox) even if we don't support sandboxing - More syscalls elided for sandboxiing - For ELF dynamic means having an interpreter not just PT_DYNAMIC - Check for large ELF session header offset - When saving and restoring a locale, keep the locale name in our own storage. - Add a flag to disable CSV file detection. - Don't pass NULL/0 to memset to appease sanitizers. - Avoid spurious prints when looks for extensions or apple strings in fsmagic. - Add builtin decompressors for xz and and bzip. - Add a limit for the number of CDF elements. - More checks for overflow in CDF. @ text @d3 1 a3 1 # $File: ole2compounddocs,v 1.7 2019/08/02 18:08:18 christos Exp $ a6 1 # reference: https://www.openoffice.org/sc/compdocfileformat.pdf d8 1 a8 70 0 string \320\317\021\340\241\261\032\341 # https://digital-preservation.github.io/droid/ # skip droid skeleton like fmt-39-signature-id-128.doc by valid version >0x1A ushort !0xABAB OLE 2 Compound Document #>0x1C uleshort x \b, endnian 0x%4.4x # big endian not tested >>0x1C ubeshort =0xfffe \b, big-endian >>>546 string jbjb : Microsoft Word Document !:mime application/msword !:apple MSWDWDBN !:ext doc # Byte Order 0xFFFE means little-endian found in real world applications #>>0x1C uleshort =0xfffe \b, little-endian >>0x1C uleshort =0xfffe # From: Joerg Jenderek # Major Version 3 or 4 >>>0x1A uleshort x \b, v%u # Minor Version 32h=50 3Bh=59 3Eh=62 >>>0x18 uleshort x \b.%u # SecID of first sector of the directory stream is often 1 but high like 3144h >>>48 ulelong x \b, SecID 0x%x # pointer to root entry only works with standard configuration for SecID ~< 800h # Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls # "ORLEN Factbook 2017.xls" XnView_metadata.doc # "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized >>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB # Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4 >>>0x1E uleshort 0xc \b, blocksize 4096 # jump to one block (4096 bytes per block) before root storage block >>>>(48.l*4096) ubyte x >>>>>&4095 use ole2-directory #>>>0x1E uleshort 9 \b, blocksize 512 >>>0x1E uleshort 9 # jump to one block (512 bytes per block) before root storage block # in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h >>>>(48.l*512) ubyte x >>>>>&511 use ole2-directory # check directory entry structure and display types by GUID 0 name ole2-directory # directory entry name like "Root Entry" #>0 lestring16 x \b, 1st %.10s # type of the entry; 5~Root storage #>66 ubyte x \b, type %x # node colour of the entry: 00H ~ Red 01H ~ Black #>67 ubyte x \b, color %x # the DirIDs of the child nodes. Should both be –1 in the root storage entry #>68 bequad !0xffffffffffffffff \b, DirIDs %llx # second directory entry name like VisioDocument Control000 #>128 lestring16 x \b, 2nd %.20s # third directory entry like WordDocument #>256 lestring16 x \b, 3rd %.20s # forth #>384 lestring16 x \b, 4th %.10s # 5th #>512 lestring16 x \b, 5th %.10s # 6th #>640 lestring16 x \b, 6th %.10s # 7th #>768 lestring16 x \b, 7th %.10s # https://wikileaks.org/ciav7p1/cms/page_13762814.html # https://m.blog.naver.com/superman4u/40047693679 # https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt # http://www.windowstricks.in/online-windows-guid-converter #>80 ubequad !0 \b, clsid 0x%16.16llx #>>88 ubequad x \b%16.16llx # test for "Root Entry" inside directory by type 5 value >66 ubyte 5 # look for CLSID GUID 0 >>88 ubequad 0x0 >>>80 ubequad 0x0 a9 1 # URL: https://en.wikipedia.org/wiki/MicroStation d11 1 a11 132 # 07/24/2019 by Joerg Jenderek # Second directory entry name like Dgn~H Dgn~S >>>>128 lestring16 Dgn~ : Microstation V8 CAD #!:mime application/x-ole-storage !:mime application/x-bentley-dgn # http://www.q-cad.com/files/samples_cad_files/1344468165.dgn !:ext dgn # # URL: http://fileformats.archiveteam.org/wiki/WordPerfect # Second directory entry name PerfectOffice_ >>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic !:mime application/vnd.wordperfect # https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd !:apple ????WPC7 !:ext mst/wpd/wpg # # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor # Second directory entry name MatOST_ >>>>128 lestring16 MatOST : Microsoft Works 3.0 document !:mime application/vnd.ms-works !:apple ????AWWP !:ext wps # # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet # 3rd directory entry name WksSSWorkBook >>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet !:mime application/vnd.ms-works !:apple ????AWSS !:ext xlr # # URL: http://fileformats.archiveteam.org/wiki/XLS # what is the difference to {00020820-0000-0000-c000-000000000046} ? # Second directory entry name Workbook >>>>128 lestring16 Workbook >>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid !:mime application/vnd.ms-excel # https://www.macdisk.com/macsigen.php XLS5 for Excel 5 !:apple ????XLS9 !:ext xls # # URL: http://fileformats.archiveteam.org/wiki/PPT # Second directory entry name Object1 Object12 Object35 >>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation !:mime application/vnd.ms-powerpoint # https://www.macdisk.com/macsigen.php !:apple ????PPT3 !:ext ppt # # URL: https://www.msoutlook.info/question/164 # Second directory entry name __CollDataStm >>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings #!:mime application/vnd.ms-outlook !:mime application/x-ms-srs # %APPDATA%\Microsoft\Outlook\Outlook.srs !:ext srs # # URL: https://www.file-extensions.org/cag-file-extension # Second directory entry name Category >>>>128 lestring16 Category : Microsoft Clip Art Gallery #!:mime application/x-ole-storage !:mime application/x-ms-cag !:apple MScgCGdb !:ext cag/ # # URL: https://www.filesuffix.com/de/extension/rra # 3rd directory entry name StrIndex_StringTable >>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer #!:mime application/x-ole-storage !:mime application/x-ms-rra !:ext rra # # URL: https://www.forensicswiki.org/wiki/Jump_Lists # 3rd directory entry name DestList >>>>256 lestring16 DestList : Windows jump list #!:mime application/x-ole-storage !:mime application/x-ms-jumplist # %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms !:ext automaticDestinations-ms # # URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache # Second directory entry name 256_ >>>>128 lestring16 256_ : Windows thumbnail database 256 #!:mime application/x-ole-storage !:mime application/x-ms-thumbnail # Thumbs.db !:ext db >>>>128 lestring16 96_ : Windows thumbnail database 96 !:mime application/x-ms-thumbnail !:ext db # 3rd directory entry name Catalog_ >>>>256 lestring16 Catalog : Windows thumbnail database !:mime application/x-ms-thumbnail !:ext db # # URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches # Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based # Second directory entry name Control000 >>>>128 lestring16 Control000 : Microsoft old Systeminfo #!:mime application/x-ole-storage !:mime application/x-ms-info !:ext nfo # # URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House # Second directory entry name Thumbnail >>>>128 lestring16 Thumbnail : Corel PrintHouse image #!:mime application/x-ole-storage !:mime application/x-corel-cph !:ext cph # 3rd directory entry name Thumbnail >>>>256 lestring16 Thumbnail : Corel PrintHouse image !:mime application/x-corel-cph !:ext cph # # URL: https://en.wikipedia.org/wiki/Hangul_(word_processor) # Note: "HWP Document File" signature found in FileHeader # Second directory entry name FileHeader hint for Thinkfree Office document >>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor File #!:mime application/haansofthwp !:mime application/x-hwp # https://example-files.online-convert.com/document/hwp/example.hwp !:ext hwp # # URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/ # Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083 >>>>128 lestring16 dd2 : StarOffice Gallery view #!:mime application/x-ole-storage !:mime application/x-star-sdv !:ext sdv # remaining null clsid >>>>128 default x : UNKNOWN !:mime application/x-ole-storage # look for known clsid GUID d13 12 a24 24 # URL: http://fileformats.archiveteam.org/wiki/Visio # Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek >>88 ubequad 0xc000000000000046 : Microsoft >>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template !:mime application/vnd.visio # VSD~Drawing VSS~Stencil VST~Template !:ext vsd/vss/vst >>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template !:mime application/vnd.visio !:ext vsd/vss/vst # # URL: http://fileformats.archiveteam.org/wiki/Windows_Installer >>>80 ubequad 0x84100c0000000000 Windows Installer Package !:mime application/x-msi #!:mime application/x-ms-win-installer !:ext msi >>>80 ubequad 0x86100c0000000000 Windows Installer Patch # ?? !:mime application/x-wine-extension-msp #!:mime application/x-ms-msp !:ext msp # # URL: http://fileformats.archiveteam.org/wiki/DOC >>>80 ubequad 0x0009020000000000 Word 6-95 document or template d26 1 a26 1 # for template MSWDW8TN d29 1 a29 1 >>>80 ubequad 0x0609020000000000 Word 97-2003 document or template d32 1 a32 225 # dot for template; no extension on Macintosh !:ext doc/dot/ # # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor >>>80 ubequad 0x0213020000000000 Works 3-4 document or template !:mime application/vnd.ms-works !:apple ????AWWP # ps for template https://filext.com/file-extension/PS bps for backup !:ext wps/ps/bps # # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database >>>80 ubequad 0x0313020000000000 Works 3-4 database or template !:mime application/vnd.ms-works-db # https://www.macdisk.com/macsigen.php !:apple ????AWDB # db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup !:ext wdb/db/bdb # # URL: https://en.wikipedia.org/wiki/Microsoft_Excel >>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template !:mime application/vnd.ms-excel # https://www.macdisk.com/macsigen.php !:apple ????XLS5 # worksheet/addin/template/no extension on Macintosh !:ext xls/xla/xlt/ # >>>80 ubequad 0x2008020000000000 Excel 97-2003 !:mime application/vnd.ms-excel # https://www.macdisk.com/macsigen.php XLS5 for Excel 5 !:apple ????XLS9 # 3nd directory entry name >>>>256 lestring16 _VBA_PROJECT_CUR addin !:ext xla/ # 4th directory entry name >>>>384 lestring16 _VBA_PROJECT_CUR addin !:ext xla #!:ext xla/ >>>>256 default x worksheet or template !:ext xls/xlt #!:ext xls/xlt/ # # URL: http://fileformats.archiveteam.org/wiki/OLE2 >>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item #>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message #!:mime application/vnd.ms-outlook !:mime application/x-ms-msg !:ext msg # URL: https://wiki.fileformat.com/email/oft/ >>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template #!:mime application/vnd.ms-outlook !:mime application/x-ms-oft !:ext oft # # URL: http://fileformats.archiveteam.org/wiki/PPT >>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation !:mime application/vnd.ms-powerpoint # https://www.macdisk.com/macsigen.php !:apple ????PPT3 !:ext ppt #?? # URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/ >>88 ubequad 0xa29a00aa004a1a72 : Microsoft # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor >>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document !:mime application/vnd.ms-works !:apple ????AWWP !:ext wps # # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database >>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database !:mime application/vnd.ms-works-db !:apple ????AWDB !:ext wdb/bdb #?? >>88 ubequad 0xa40700c04fb932ba : Microsoft # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor >>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document !:mime application/vnd.ms-works !:apple ????AWWP !:ext wps #?? # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher >>88 ubequad 0x00c0000000000046 : Microsoft >>>80 ubequad 0x0112020000000000 Publisher !:mime application/vnd.ms-publisher !:ext pub # # URL: http://fileformats.archiveteam.org/wiki/PPT #?? >>88 ubequad 0xa90300aa00510ea3 : Microsoft >>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation !:mime application/vnd.ms-powerpoint # https://www.macdisk.com/macsigen.php !:apple ????PPT3 !:ext ppt/pot #?? >>88 ubequad 0x86ea00aa00b929e8 : Microsoft >>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template !:mime application/vnd.ms-powerpoint !:apple ????PPT3 # /autostart/template !:ext ppt/pps/pot # # URL: https://en.wikipedia.org/wiki/Microsoft_Project #?? >>88 ubequad 0xbe1100c04fb6faf1 : Microsoft >>>80 ubequad 0x3a8fb774c8c8d111 Project !:mime application/vnd.ms-project !:ext mpp # # URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel) #??? >>88 ubequad 0x99ae04021c007002 : WordPerfect >>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation !:mime application/x-corelpresentations #!:mime application/x-shw-viewer #!:mime image/x-presentations !:ext shw # # URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/ >>>80 ubequad 0x60fe2e4099191b10 9 Graphic #!:mime application/x-wpg #!:mime image/x-wordperfect-graphics !:mime image/x-wpg # https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd !:apple ????WPC9 !:ext wpg # # URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats >>88 ubequad 0x996104021c007002 : StarOffice >>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template # https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html !:mime application/x-starwriter !:ext sdw/vor # >>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template !:mime application/x-starcalc !:ext sdc/vor # >>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template !:mime application/x-starimpress #!:mime application/x-stardraw # sda ?? !:ext sdd/sda/vor #?? >>88 ubequad 0x89cb008029e4b0b1 : StarOffice >>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template !:mime application/x-starcalc !:ext sdc/vor # >>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template !:mime application/vnd.stardivision.cal !:ext sdc/vor # >>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template !:mime application/x-starimpress !:ext sdd/vor #?? >>88 ubequad 0xb12a04021c007002 : StarOffice >>>80 ubequad 0x600459d4fd351c10 StarMath 3.0 !:mime application/x-starmath !:ext smf #?? >>88 ubequad 0x8e2c00001b4cc711 : StarOffice >>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0 !:mime application/x-starchart !:ext sds #?? >>88 ubequad 0xa45e00a0249d57b1 : StarOffice >>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template !:mime application/x-starwriter !:ext sdw/vor #?? >>88 ubequad 0x89ca008029e4b0b1 : StarOffice >>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0 !:mime application/x-starmath !:ext smf # >>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0 !:mime application/x-starchart !:ext sds #?? >>88 ubequad 0xa53f00a0249d57b1 : StarOffice >>>80 ubequad 0x70c90a340de3d011 Master 4.0 document !:mime application/x-starwriter-global !:ext sgl #?? >>88 ubequad 0x89d0008029e4b0b1 : StarOffice >>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0 !:mime application/vnd.stardivision.math !:ext smf # >>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template !:mime application/vnd.stardivision.draw !:ext sda/vor # >>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template !:mime application/vnd.stardivision.impress # sda is used for what? !:ext sdd/vor/sda # >>>80 ubequad 0x214388bfdd85d111 StarChart 5.0 !:mime application/vnd.stardivision.chart !:ext sds # ?? >>88 ubequad 0xaab4006097da561a : StarOffice >>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template !:mime application/vnd.stardivision.writer !:ext sdw/vor # >>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document !:mime application/vnd.stardivision.writer-global !:ext sgl #?? # URL: http://fileformats.archiveteam.org/wiki/FlashPix >>88 ubequad 0x855300aa00a1f95b : Kodak >>>80 ubequad 0x0067615654c1ce11 FlashPIX Image !:mime image/vnd.fpx !:apple ????FPix !:ext fpx # remaining non null clsid >>88 default x : UNKNOWN !:mime application/x-ole-storage >>>80 ubequad !0 \b, clsid 0x%16.16llx >>>88 ubequad x \b%16.16llx @ 1.1.1.6 log @Import 5.39: * Remove unused subtype_mime (Steve Grubb) * Remove unused check in okstat (Steve Grubb) * Fix mime-type in elf binaries by making sure $x is set * Fix indirect negative offsets broken by OFFNEGATIVE * Fix GUID equality check * PR/165: Handle empty array and strings in JSON * PR/162: Add --exclude-quiet * Fix memory leak in ascmagic (Steve Grubb) * Fix string comparison length with ignore whitespace * Fix mingwin 64 compilation * PR/159: whitelist getpid needed for file_pipe2file() * Indicate negative offsets with a flag OFFNEGATIVE so that -0 works. * Introduce "offset" magic type that can be used to detect the file size, and bail on short files. * document DER better in the magic man page. * fix memory leaks (SonarQube) * rewrite confusing loops (SonarQube) * fix bogus test (SonarQube) * pass a sized buffer to file_fmttime() (SonarQube) * Don't allow * in printf formats, or the code itself (Christoph Biedl) * Introduce a printf output size checker to avoid DoS attacks * Avoid memory leak on error (oss-fuzz) * Check length of string on DER before derefercing and add new types * Add missing DER string (oss-fuzz) * Add missing DER types, and debugging * PR/140: Avoid abort with hand-crafted magic file (gockelhahn) * PR/139: Avoid DoS in printf with hand-crafted magic file (gockelhahn) * PR/138: Avoid crash with hand-crafted magic file (gockelhahn) * PR/136: Fix static build by adding a libmagic.pc (Fabrice Fontaine) * add guid support native support via the "guid" type. @ text @d3 1 a3 1 # $File: ole2compounddocs,v 1.8 2020/03/28 23:10:30 christos Exp $ a29 19 # Sector Shift Exponent in short-stream container stream: 6~64 bytes >>>32 uleshort !6 \b, exponent of short stream %u # total number of sectors used for the FAT >>>44 ulelong >1 \b, %u FAT sectors # SecID of first sector of the short-sector allocation table (Mini FAT) # or -2 (End Of ChainSecID) if not extant >>>60 ulelong !0xffFFffFE \b, Mini FAT start sector 0x%x # total number of sectors used for the short-sector allocation table >>>64 ulelong !1 \b, %u Mini FAT sector # plural s >>>>64 ulelong >1 \bs # SecID of first sector of the master sector allocation table (DIFAT) # or -2 (End Of Chain SecID) if no additional sectors used >>>68 ulelong !0xffFFffFE \b, DIFAT start sector 0x%x # total number of sectors used for the master sector allocation table (DIFAT) >>>72 ulelong >0 \b, %u DIFAT sectors # First part of the master sector allocation table (DIFAT) containing 109 SecIDs #>>>76 ubequad x \b, DIFAT=0x%16.16llx #>>>84 ubequad x \b%16.16llx... d54 1 a54 1 # the DirIDs of the child nodes. Should both be -1 in the root storage entry a209 23 # URL: https://en.wikipedia.org/wiki/SoftMaker_Office # second directory entry name Current User >>>>128 lestring16 Current\ User : SoftMaker # third directory entry name SMNativeObjData >>>>>256 lestring16 SMNativeObjData # 5th directory entry nane PowerPoint >>>>>>512 lestring16 PowerPoint PowerPoint presentation or template !:mime application/vnd.ms-powerpoint !:ext ppt/pps/pot # 4th directory entry name PowerPoint >>>>>384 lestring16 PowerPoint Presentations or template # http://extension.nirsoft.net/prv !:mime application/vnd.softmaker.presentations !:ext prd/prv # third directory entry name like Current User >>>>256 lestring16 Current\ User : SoftMaker # 5th directory entry name PowerPoint >>>>>512 lestring16 PowerPoint Presentations or template # http://extension.nirsoft.net/prd !:mime application/vnd.softmaker.presentations !:ext prd/prv # 2nd directory entry name Pictures >>>>>>128 lestring16 Pictures with pictures a465 6 # URL: https://en.wikipedia.org/wiki/SoftMaker_Office >>88 ubequad 0x95f600a0cc3cca14 : PlanMaker >>>80 ubequad 0x9174088a6452d411 document or template !:mime application/vnd.softmaker.planmaker # pmv for template https://www.file-extensions.org/pmv-file-extension !:ext pmd/pmv @ 1.1.1.7 log @2021-03-30 20:21 Christos Zoulas * release 5.40 2021-02-05 16:31 Christos Zoulas * PR/234: Add limit to the number of bytes to scan for encoding * PR/230: Fix /T (trim flag) for regex 2021-02-01 12:31 Christos Zoulas * PR/77: Trim trailing separator. 2020-12-17 15:44 Christos Zoulas * PR/211: Convert system read errors from corrupt ELF files into human readable error messages 2020-12-08 16:24 Christos Zoulas * fix multithreaded decompression file descriptor issue by using close-on-exec (Denys Vlasenko) 2020-06-27 11:58 Christos Zoulas * Exclude surrogate pairs from utf-8 detection (Michael Liu) 2020-06-25 12:53 Christos Zoulas * Include # to the list of ignored format chars (Werner Fink) @ text @d3 1 a3 1 # $File: ole2compounddocs,v 1.10 2021/02/23 00:51:10 christos Exp $ a212 9 # URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery # Note: format since Gallery 2; sometimes called Corel Multimedia Manager Album # third directory entry name _INFO_ >>>>256 lestring16 _INFO_ : Corel Gallery # second directory entry name _ITEM_ or _DATA_ # later directory entry names: _ALBUM_ _THUMBNAIL_ #!:mime application/x-ole-storage !:mime application/x-corel-gal !:ext gal d234 1 a234 1 # 5th directory entry name PowerPoint a253 6 # second directory entry name like VisioDocument Control000 >>>>>128 lestring16 x with names %.20s # third directory entry like WordDocument >>>>>256 lestring16 x %.20s # forth >>>>>384 lestring16 x %.20s d318 1 a318 1 # 3rd directory entry name @ 1.1.1.8 log @Import file-5.43+; last was file-5.40 2022-09-20 17:12 Christos Zoulas * fixed various clustefuzz issues 2022-09-19 15:54 Christos Zoulas * Fix error detection for decompression code (Vincent Mihalkovic) 2022-09-15 13:50 Christos Zoulas * Add MAGIC_NO_COMPRESS_FORK and use it to produce a more meaningful error message if we are sandboxing. 2022-09-15 10:45 Christos Zoulas * Add built-in lzip decompression support (Michal Gorny) 2022-09-14 10:35 Christos Zoulas * Add built-in zstd decompression support (Martin Rodriguez Reboredo) 2022-09-13 14:55 Christos Zoulas * release 5.43 2022-09-10 9:17 Christos Zoulas * Add octal indirect magic (Michal Gorny) 2022-08-17 11:43 Christos Zoulas * PR/374: avoid infinite loop in non-wide code (piru) * PR/373: Obey MAGIC_CONTINUE with multiple magic files (vismarli) 2022-07-26 11:10 Christos Zoulas * Fix bug with large flist (Florian Weimer) 2022-07-07 13:21 Christos Zoulas * PR/364: Detect non-nul-terminated core filenames from QEMU (mam-ableton) 2022-07-04 15:45 Christos Zoulas * PR/359: Add support for http://ndjson.org/ (darose) * PR/362: Fix wide printing (ro-ee) * PR/358: Fix width for -f - (jpalus) * PR/356: Fix JSON constant parsing (davewhite) 2022-06-10 9:40 Christos Zoulas * release 5.42 2022-05-31 14:50 Christos Zoulas * PR/348: add missing cases to prevent file from aborting on random magic files. 2022-05-27 21:05 Christos Zoulas * PR/351: octalify filenames when not raw before printing. 2022-04-18 17:51 Christos Zoulas * fix regex cacheing bug (Dirk Mueller) * merge file_regcomp and file_regerror() to simplify the code and reduce memory requirements for storing regexes (Dirk Mueller) 2022-03-19 12:56 Christos Zoulas * cache regex (Dirk Mueller) * detect filesystem full by flushing output (Dirk Mueller) 2021-11-19 12:36 Christos Zoulas * implement running decompressor programs using posix_spawnp(2) instead of vfork(2) 2021-10-24 11:51 Christos Zoulas * Add support for msdos dates and times 2021-10-20 9:55 Christos Zoulas * use the system byte swapping functions if available (Werner Fink) 2021-10-18 11:57 Christos Zoulas * release 5.41 2021-09-23 03:51 Christos Zoulas * Avinash Sonawane: Fix tzname detection 2021-09-03 09:17 Christos Zoulas * Fix relationship tests with "search" magic, don't short circuit logic 2021-07-13 01:06 Christos Zoulas * Fix memory leak in compile mode 2021-07-01 03:51 Christos Zoulas * PR/272: kiefermat: Only set returnval = 1 when we printed something (in all cases print or !print). This simplifies the logic and fixes the issue in the PR with -k and --mime-type there was no continuation printed before the default case. 2021-06-30 13:07 Christos Zoulas * PR/270: Don't translate unprintable characters in %s magic formats when -r * PR/269: Avoid undefined behavior with clang (adding offset to NULL) 2021-05-09 18:38 Christos Zoulas * Add a new flag (f) that requires that the match is a full word, not a partial word match. * Add varint types (unused) 2021-04-19 17:17 Christos Zoulas * PR/256: mutableVoid: If the file is less than 3 bytes, use the file length to determine type * PR/259: aleksandr.v.novichkov: mime printing through indirect magic is not taken into account, use match directly so that it does. 2021-04-04 17:02 Christos Zoulas * count the total bytes found not the total byte positions in order to determine encoding (Anatol Belski) @ text @d3 1 a3 1 # $File: ole2compounddocs,v 1.19 2022/09/11 20:52:40 christos Exp $ d13 1 a13 1 #>0x1C uleshort x \b, endnian %#4.4x d29 1 a29 1 >>>48 ulelong x \b, SecID %#x d36 1 a36 1 >>>60 ulelong !0xffFFffFE \b, Mini FAT start sector %#x d43 1 a43 1 >>>68 ulelong !0xffFFffFE \b, DIFAT start sector %#x d47 1 a47 1 #>>>76 ubequad x \b, DIFAT=%#16.16llx d90 2 a91 2 # https://toolslick.com/conversion/data/guid #>80 ubequad !0 \b, clsid %#16.16llx a202 16 # From: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/Microsoft_Access # Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mdz.trid.xml # http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File # Note: only version foo tested and called "Microsoft Access Wizard template" by TrID # Fourth directory entry name TemplateID >>>>384 lestring16 TemplateID : Microsoft Access wizard template # Second directory entry name like \005SummaryInformation and 3rd name like \005DocumentSummaryInformation #!:mime application/x-ole-storage #!:mime application/vnd.ms-office #!:mime application/vnd.ms-access #!:mime application/msaccess !:mime application/x-ms-mdz # http://extension.nirsoft.net/mdz !:ext mdz # a222 12 # From: Joerg Jenderek # URL: https://archive.org/details/iPhoto-Plus-4 # https://filext.com/file-extension/TPL # Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/tpl-ulead.trid.xml # Note: found in Template sub directory in program directory of software iPhoto Plus version 4 # second, third and fourth directory entry name like TplHeader TplMainImage TplPreview >>>>128 lestring16 TplHeader : Ulead iPhoto Template #!:mime application/x-ole-storage !:mime image/x-ulead-tpl # https://www.file-extensions.org/tpl-file-extension-ulead-photo-express-template !:ext tpl # a260 18 # # URL: http://fileformats.archiveteam.org/wiki/PageMaker # Reference: http://mark0.net/download/triddefs_xml.7z/defs/p # pagemaker-generic.trid.xml # pagemaker-pm6.trid.xml # pagemaker-pm65.trid.xml # pmd-pm7.trid.xml # From: Joerg Jenderek # Note: since version 6 embedd as stream with PageMaker name the "old" format handled by ./wordprocessors # verified by Michal Mutl Structured Storage Viewer `SSView.exe brochus.pt6` # Second directory entry name PageMaker >>>>128 lestring16 PageMaker : # look for magic of "old" PageMaker like in 02TEMPLT.T65 >>>>>0 search/0xa900/s \0\0\0\0\0\0\xff\x99 # GRR: jump to PageMaker stream and inspect it by sub routine PageMaker of ./wordprocessors failed with wrong version! #>>>>>>&0 use PageMaker # THIS WORKS PARTLY! >>>>>>&0 indirect x a269 3 # according to file version 5.41 with -e soft option #!:mime application/CDFV2 #!:ext ??? a382 15 # From: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/Microsoft_Works # Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File # Note: probably version 6 and 7 # organize pictures like JPFG images in streams __cf1 with names like # 001.JPG, 002.JPG ... in streams __fname >>88 ubequad 0xa1c800c04f612452 : Microsoft >>>80 ubequad 0xc0c7266eb98cd311 Works portfolio # 2nd directory entry name PfOrder, 3rd __LastID and 4th __SizeUsed #!:mime application/x-ole-storage # https://www.iana.org/assignments/media-types/application/vnd.ms-works !:mime application/vnd.ms-works # https://extension.nirsoft.net/wsb # like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb !:ext wsb a404 22 # From: Joerg Jenderek # URL: https://www.file-extensions.org/ppa-file-extension # https://en.wikipedia.org/wiki/Microsoft_PowerPoint#cite_note-231 # Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File >>88 ubequad 0x871800aa0060263b : Microsoft # only version 8 (97) tested; PowerPoint 4.0 to 11.0 (2004) (Wikipedia); 97 to 2003 (file-extensions.org) >>>80 ubequad 0xf04672810a72cf11 PowerPoint Addin or Wizard # second, third and fourth directory entry name like VBA PROJECT PROJECTwm # http://extension.nirsoft.net/pwz !:mime application/vnd.ms-powerpoint # like: BSHPPT97.PPA "AutoContent Wizard.pwz" !:ext ppa/pwz # # From: Joerg Jenderek # URL: http://fileformats.archiveteam.org/wiki/AWD_(At_Work_Document) # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/awd-fax.trid.xml # Note: called "Microsoft At Work Fax document" by TrID >>88 ubequad 0xb29400dd010f2bf9 : Microsoft >>>80 ubequad 0x801cb0023de01a10 At Work fax Document #!:mime application/x-ole-storage !:mime image/x-ms-awd !:ext awd a411 33 # From: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/Microsoft_Office_shared_tools#Binder # Reference: http://mark0.net/download/triddefs_xml.7z/defs/o/obd.trid.xml # http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File # Note: only version 8 tested and called "Office Binder Document" by TrID and # "Microsoft Office Binder File for Windows" version 97-2000 by DROID fmt/240 >>88 ubequad 0xb21c00aa004ba90b : Microsoft >>>80 ubequad 0x0004855964661b10 Office Binder Document, Template or wizard # second directory entry name like Binder # https://www.file-extensions.org/obd-file-extension #!:mime application/vnd.ms-binder !:mime application/x-msbinder # obt for template; obz for Microsoft Office Binder wizard !:ext obd/obt/obz # # URL: http://fileformats.archiveteam.org/wiki/WordPerfect # Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File # https://github.com/OneWingedShark/WordPerfect/ # blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm # From: Joerg Jenderek # Note: internal version x.2 or 2.2 like in embedded ole6-PerfectOffice_MAIN.wpd # 3rd directory entry name PerfectOffice_OBJECT and 2nd PerfectOffice_MAIN, # which contains WordPerfect document \xffWPC signature handled by ./wordprocessors >>88 ubequad 0x19370000929679cd : WordPerfect 7 >>>80 ubequad 0xff739851ad2d2002 Document !:mime application/vnd.wordperfect #!:apple ????WPC? # https://fossies.org/linux/wp2latex/test/ole6.wpd !:ext wpd #>>>>0 search/0xc01/s \xffWPC \b, WPC SIGNATURE # inspect embedded WordPerfect document by ./wordprocessors with 1 space at end #>>>>>&0 indirect x \b; contains # GRR: the above expression does not work correctly a528 14 # URL: http://fileformats.archiveteam.org/wiki/MAX_(3ds_Max) # https://en.wikipedia.org/wiki/Autodesk_3ds_Max # Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File # Note: called "3D Studio Max Scene" by TrID and "3DS Max" by DROID and # "3DSMax thumbnail" by XnView and verfied by `nconvert -info A380.max` # applies only to "newer" versions (about 2008-2020) >>88 ubequad 0x9fed04143144cc1e : Autodesk >>>80 ubequad 0x7b8cdd1cc081a045 3ds Max #!:mime application/x-ole-storage !:mime model/x-autodesk-max # like: https://static.free3d.com/models/dropbox/dropbox/sq/A380.7z/A380.max !:ext max # also chr for character file according to DROID https://www.nationalarchives.gov.uk/PRONOM/fmt/978 #!:ext max/chr d530 1 a530 4 >>88 default x # GRR: check again for non null clsid because wrong when called by indirect directive >>>88 ubequad !0 : UNKNOWN # https://reposcope.com/mimetype/application/x-ole-storage d532 2 a533 5 # according to file version 5.41 with -e soft option #!:mime application/CDFV2 #!:ext ??? >>>>80 ubequad !0 \b, clsid %#16.16llx >>>>88 ubequad x \b%16.16llx @ 1.1.1.9 log @Update to file-5.45 (Last was file-5.44) 2023-07-27 15:45 Christos Zoulas * release 5.45 2023-07-17 11:53 Christos Zoulas * PR/465: psrok1: Avoid muslc asctime_r crash 2023-05-21 13:05 Christos Zoulas * add SIMH tape format support 2023-02-09 12:50 Christos Zoulas * bump the max size of the elf section notes to be read to 128K and make it configurable 2023-01-08 1:08 Christos Zoulas * PR/415: Fix decompression with program returning empty 2022-12-26 1:47 Christos Zoulas * PR/408: fix -p with seccomp * PR/412: fix MinGW compilation @ text @d3 1 a3 1 # $File: ole2compounddocs,v 1.26 2023/05/15 16:46:12 christos Exp $ a74 1 # NEXT lines for DEBUGGING a203 12 # URL: https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/arn-autoruns-v14.trid.xml # Note: older versions til 13 about middle 2021 handled by ./windows # called "Sysinternals Autoruns data (v14)" by TrID # second, third and fourth directory entry name like Header Items 0 >>>>128 lestring16 Header : Microsoft sysinternals AutoRuns data, version 14 #!:mime application/x-ole-storage !:mime application/x-ms-arn # like: MyHOSTNAME.arn !:ext arn # # From: Joerg Jenderek a251 1 # https://www.hancom.com/etc/hwpDownload.do a252 1 # Hangul Word Processor WORDIAN, 2002 and later is using HWP 5.0 format. d254 1 a254 1 >>>>128 lestring16 FileHeader : Hancom HWP (Hangul Word Processor) file, version 5.0 d308 11 a318 28 >>>>128 default x >>>>>0 use ole2-unknown # look for CLSID where "second" part is 0 >>>80 ubequad !0x0 # # Summary: Family Tree Maker # From: Joerg Jenderek # URL: http://fileformats.archiveteam.org/wiki/Family_Tree_Maker # https://en.wikipedia.org/wiki/Family_Tree_Maker # Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/ftw.trid.xml # Note called "Family Tree Maker Family Tree" by TrID and # "FamilyTree Maker Database" with version "1-4" by DROID via PUID fmt/1352 # tested only with version 2.0 # verified by Michal Mutl Structured Storage Viewer `SSView.exe my.ftw` # newer versions are SQLite based and handled by ./sql # directory names like: IND.DB AUX.DB GENERAL.DB NAME.NDX BIRTH.NDX EXTRA.DB >>>>80 ubequad 0x5702000000000000 : Family Tree Maker Windows database, version 1-4 # look for "File Format (C) Copyright 1993 Banner Blue Software Inc. - All Rights Reserved" in GENERAL.DB #>>>>>0 search/0x5460c/s F\0i\0l\0e\0\040\0F\0o\0r\0m\0a\0t\0\040\0(\0C\0)\0 \b, VERSION # GRR: jump to version value like 2 does not work! #>>>>>>&-8 ubyte x %u #!:mime application/x-ole-storage !:mime application/x-fmt # FBK is used for backup of FTW !:ext ftw/fbk # >>>>80 default x >>>>>0 use ole2-unknown d323 2 a324 2 >>88 ubequad 0xc000000000000046 >>>80 ubequad 0x131a020000000000 : Microsoft Visio 2000-2002 Document, stencil or template d328 1 a328 1 >>>80 ubequad 0x141a020000000000 : Microsoft Visio 2003-2010 Document, stencil or template d333 1 a333 4 # https://en.wikipedia.org/wiki/Windows_Installer#ICE_validation # Update: Joerg Jenderek # Windows Installer Package *.MSI or validation module *.CUB >>>80 ubequad 0x84100c0000000000 : Microsoft Windows Installer Package or validation module d336 2 a337 13 # https://learn.microsoft.com/en-us/windows/win32/msi/internal-consistency-evaluators-ices # cub is used for validation module like: Vstalogo.cub XPlogo.cub darice.cub logo.cub mergemod.cub #!:mime application/x-ms-cub !:ext msi/cub # From: Joerg Jenderek # URL: http://en.wikipedia.org/wiki/Windows_Installer # Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mst.trid.xml # called "Windows SDK Setup Transform script" by TrID >>>80 ubequad 0x82100c0000000000 : Microsoft Windows Installer transform script #!:mime application/x-ole-storage !:mime application/x-ms-mst !:ext mst >>>80 ubequad 0x86100c0000000000 : Microsoft Windows Installer Patch d344 1 a344 1 >>>80 ubequad 0x0009020000000000 : Microsoft Word 6-95 document or template d349 1 a349 1 >>>80 ubequad 0x0609020000000000 : Microsoft Word 97-2003 document or template d356 1 a356 1 >>>80 ubequad 0x0213020000000000 : Microsoft Works 3-4 document or template d363 1 a363 1 >>>80 ubequad 0x0313020000000000 : Microsoft Works 3-4 database or template d371 1 a371 1 >>>80 ubequad 0x1008020000000000 : Microsoft Excel 5-95 worksheet, addin or template d378 1 a378 1 >>>80 ubequad 0x2008020000000000 : Microsoft Excel 97-2003 d394 2 a395 2 >>>80 ubequad 0x0b0d020000000000 : Microsoft Outlook 97-2003 item #>>>80 ubequad 0x0b0d020000000000 : Microsoft Outlook 97-2003 Message d400 1 a400 1 >>>80 ubequad 0x46f0060000000000 : Microsoft Outlook 97-2003 item template d406 1 a406 1 >>>80 ubequad 0x5148040000000000 : Microsoft PowerPoint 4.0 presentation a410 13 # Summary: "newer" Greenstreet Art drawing # From: Joerg Jenderek # URL: http://fileformats.archiveteam.org/wiki/GST_ART # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/art-gst-docfile.trid.xml # Note: called like "Greenstreet Art drawing" by TrID # Note: CONTENT stream contains binary part of older versions with phrase GST:ART at offset 16 # verified by Michal Mutl Structured Storage Viewer `SSView.exe BCARD2.ART` >>>80 ubequad 0x602c020000000000 : Greenstreet Art drawing #!:mime application/x-ole-storage !:mime image/x-greenstreet-art !:ext art >>>80 default x >>>>0 use ole2-unknown a549 13 # From: Joerg Jenderek # URL: http://fileformats.archiveteam.org/wiki/CorelCAD # https://en.wikipedia.org/wiki/CorelCAD # Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/ccd-corelcad.trid.xml # Note: called "CorelCAD Drawing" by TrID and CorelCAD # directory entry names like Contents ViewInfo CustomViewDescriptions LayerInfo >>88 ubequad 0xbe26db67235e2689 : Corel >>>80 ubequad 0x20f414de1cacce11 \bCAD Drawing or Template #!:mime application/x-ole-storage !:mime application/x-corel-cad # CCT for CorelCAD Template !:ext ccd/cct # d664 2 a665 4 >>>0 use ole2-unknown # display information about directory for not detected CDF files 0 name ole2-unknown >80 ubequad x : UNKNOWN d671 3 a673 16 >80 ubequad !0 \b, clsid %#16.16llx >>88 ubequad x \b%16.16llx # converted hexadecimal format to standard GUUID notation >>80 guid x {%s} # second directory entry name like VisioDocument Control000 >128 lestring16 x with names %.20s # third directory entry like WordDocument Preview.dib >256 lestring16 x %.20s # forth like \005SummaryInformation >384 lestring16 x %.25s # 5th >512 lestring16 x %.10s # 6th >640 lestring16 x %.10s # 7th >768 lestring16 x %.10s @ 1.1.1.1.2.1 log @file ole2compounddocs was added on branch jym-xensuspend on 2009-05-13 18:51:58 +0000 @ text @d1 13 @ 1.1.1.1.2.2 log @Sync with HEAD. Second commit. See http://mail-index.netbsd.org/source-changes/2009/05/13/msg221222.html @ text @a0 13 #------------------------------------------------------------------------------ # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured # storage (http://en.wikipedia.org/wiki/Structured_Storage) # Additional tests for OLE 2 Compound Documents should be under this recipe. 0 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document # - Microstation V8 DGN files (www.bentley.com) # Last update on 10/23/2006 by Lester Hightower > 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN # - Visio documents # Last update on 10/23/2006 by Lester Hightower > 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document @