|
@@ -1,6 +1,6 @@
|
|
|
|
|
|
#------------------------------------------------------------------------------
|
|
|
-# $File: filesystems,v 1.61 2011/01/10 14:01:10 christos Exp $
|
|
|
+# $File: filesystems,v 1.69 2012/12/18 17:28:43 christos Exp $
|
|
|
# filesystems: file(1) magic for different filesystems
|
|
|
#
|
|
|
0 string \366\366\366\366 PC formatted floppy with no filesystem
|
|
@@ -27,7 +27,8 @@
|
|
|
>>0770 long x %ld blocks
|
|
|
# Is there a boot block written 1 sector in?
|
|
|
>512 belong&077777777 0600407 \b, boot block present
|
|
|
-# Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc
|
|
|
+
|
|
|
+# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
|
|
|
# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
|
|
|
0 string SBMBAKUP_ Smart Boot Manager backup file
|
|
|
>9 string x \b, version %-5.5s
|
|
@@ -41,8 +42,10 @@
|
|
|
>>>>21 ubyte x \b, from drive 0x%x
|
|
|
>>>22 ubyte >0
|
|
|
>>>>21 string x \b, from drive %s
|
|
|
+>>>535 search/17 \x55\xAA
|
|
|
+>>>>&-512 indirect x \b; contains
|
|
|
|
|
|
-# Joerg Jenderek
|
|
|
+# updated by Joerg Jenderek at Nov 2012
|
|
|
# DOS Emulator image is 128 byte, null right padded header + harddisc image
|
|
|
0 string DOSEMU\0
|
|
|
>0x27E leshort 0xAA55
|
|
@@ -52,14 +55,23 @@
|
|
|
>>>>7 ulelong >0 \b, %u heads
|
|
|
>>>>11 ulelong >0 \b, %d sectors/track
|
|
|
>>>>15 ulelong >0 \b, %d cylinders
|
|
|
+>>>>128 indirect x \b; contains
|
|
|
|
|
|
-# updated by Joerg Jenderek at Sep 2007
|
|
|
+# x86 boot sector updated by Joerg Jenderek at Sep 2007,May 2011
|
|
|
+# for any allowed sector sizes
|
|
|
+30 search/481 \x55\xAA
|
|
|
+# to display x86 boot sector (40) before old one (strength=50), SYSLINUX MBR (?) and DOS BPB information (71) like in previous file version
|
|
|
+!:strength +40
|
|
|
+# for sector sizes < 512 Bytes
|
|
|
+>11 uleshort <512
|
|
|
+>>(11.s-2) uleshort 0xAA55 x86 boot sector
|
|
|
+# for sector sizes with 512 or more Bytes
|
|
|
+>0x1FE leshort 0xAA55 x86 boot sector
|
|
|
+# keep old x86 boot sector as dummy for mbr and bootloader displaying
|
|
|
# only for sector sizes with 512 or more Bytes
|
|
|
-0x1FE leshort 0xAA55 x86 boot sector
|
|
|
-# to do also for sectors < than 512 Bytes and some other files, GRR
|
|
|
-#30 search/481 \x55\xAA x86 boot sector
|
|
|
-# not for BeOS floppy 1440k, MBRs
|
|
|
-#(11.s-2) uleshort 0xAA55 x86 boot sector
|
|
|
+0x1FE leshort 0xAA55
|
|
|
+# to display information (51) before DOS BPB (strength=71) and after DOS floppy (120) like in old file version
|
|
|
+!:strength +21
|
|
|
>2 string OSBS \b, OS/BS MBR
|
|
|
# J\xf6rg Jenderek <joerg dot jenderek at web dot de>
|
|
|
>0x8C string Invalid\ partition\ table \b, MS-DOS MBR
|
|
@@ -131,8 +143,7 @@
|
|
|
>>>>>>>420 ubyte&0x0F 0Xf \b ask
|
|
|
>>>>>420 ubyte x \b)
|
|
|
#
|
|
|
->271 string Operating\ system\ loading
|
|
|
->>296 string error\r \b, SYSLINUX MBR (2.10)
|
|
|
+# SYSLINUX MBR moved
|
|
|
# http://www.acronis.de/
|
|
|
>362 string MBR\ Error\ \0\r
|
|
|
>>376 string ress\ any\ key\ to\
|
|
@@ -193,12 +204,7 @@
|
|
|
>>>>321 string Loading\ stage1.5 \b, GRUB version x.y
|
|
|
>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
|
|
|
>>>>374 string GRUB\ \0 \b, GRUB version n.m
|
|
|
-# http://syslinux.zytor.com/
|
|
|
->478 string Boot\ failed\r
|
|
|
->>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62)
|
|
|
->480 string Boot\ failed\r
|
|
|
->>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11)
|
|
|
->484 string Boot\ error\r \b, SYSLINUX bootloader (3.11)
|
|
|
+# SYSLINUX bootloader moved
|
|
|
>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
|
|
|
# http://www.bcdwb.de/bcdw/index_e.htm
|
|
|
>3 string BCDL
|
|
@@ -263,11 +269,14 @@
|
|
|
#OEM-ID=BOOTWIZ0
|
|
|
>442 string Non-system\ disk,\
|
|
|
>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
|
|
|
-# DOS names like F11.SYS are 8 right space padded bytes+3 bytes
|
|
|
+# updated by Joerg Jenderek at Nov 2012
|
|
|
+# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
|
|
|
>>>477 ubyte&0xDF >0
|
|
|
>>>>477 string x \b %-.3s
|
|
|
>>>>>480 ubyte&0xDF >0
|
|
|
->>>>>>480 string x \b%-.5s
|
|
|
+>>>>>>480 string x \b%-.4s
|
|
|
+>>>>>>>484 ubyte&0xDF >0
|
|
|
+>>>>>>>>484 string x \b%-.1s
|
|
|
>>>>485 ubyte&0xDF >0
|
|
|
>>>>>485 string x \b.%-.3s
|
|
|
#
|
|
@@ -279,24 +288,39 @@
|
|
|
>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
|
|
|
>>>>>>200 string >\0 \b, version %-3s
|
|
|
>242 string Bootsector\ from\ C.H.\ Hochst\204
|
|
|
->>278 string No\ Systemdisk.\
|
|
|
->>>293 string Booting\ from\ harddisk.\n\r
|
|
|
->>>441 string Cannot\ load\ from\ harddisk.\n\r
|
|
|
->>>>469 string Insert\ Systemdisk\
|
|
|
->>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader
|
|
|
->>>>>>209 string >\0 \b, version %-4.4s
|
|
|
+# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c
|
|
|
+# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
|
|
|
+# skip name "C.H. Hochstätter" partly because it is sometimes written without umlaut
|
|
|
+>242 search/127 Bootsector\ from\ C.H.\ Hochst
|
|
|
+>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk
|
|
|
+# followed by variants with point,CR-NL or NL-CR
|
|
|
+>>>208 search/261 Cannot\ load\ from\ harddisk.
|
|
|
+# followed by variants CR-NL or NL-CR
|
|
|
+>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key.
|
|
|
+# followed by variants with point,CR-NL or NL-CR
|
|
|
+>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader
|
|
|
+# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
|
|
|
+>>>>>>&0 string x \b, version %-4.4s
|
|
|
>(1.b+2) ubyte 0xe
|
|
|
>>(1.b+3) ubyte 0x1f
|
|
|
>>>(1.b+4) ubyte 0xbe
|
|
|
->>>>(1.b+5) ubyte 0x77
|
|
|
->>>>(1.b+6) ubyte 0x7c
|
|
|
->>>>>(1.b+7) ubyte 0xac
|
|
|
->>>>>>(1.b+8) ubyte 0x22
|
|
|
->>>>>>>(1.b+9) ubyte 0xc0
|
|
|
->>>>>>>>(1.b+10) ubyte 0x74
|
|
|
->>>>>>>>>(1.b+11) ubyte 0xb
|
|
|
->>>>>>>>>>(1.b+12) ubyte 0x56
|
|
|
->>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
|
|
|
+# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
|
|
|
+>>>>(1.b+5) ubyte&0xd3 0x53
|
|
|
+>>>>>(1.b+6) ubyte 0x7c
|
|
|
+# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
|
|
|
+>>>>>>(1.b+7) ubyte 0xac
|
|
|
+>>>>>>>(1.b+8) ubyte 0x22
|
|
|
+>>>>>>>>(1.b+9) ubyte 0xc0
|
|
|
+>>>>>>>>>(1.b+10) ubyte 0x74
|
|
|
+>>>>>>>>>>(1.b+11) ubyte 0x0b
|
|
|
+>>>>>>>>>>>(1.b+12) ubyte 0x56
|
|
|
+>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
|
|
|
+# FAT1X version
|
|
|
+>>>>>>>>>>>>>(1.b+5) ubyte 0x5b
|
|
|
+>>>>>>>>>>>>>>0x5b string >\0 "%-s"
|
|
|
+# FAT32 version
|
|
|
+>>>>>>>>>>>>>(1.b+5) ubyte 0x77
|
|
|
+>>>>>>>>>>>>>>0x77 string >\0 "%-s"
|
|
|
>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display
|
|
|
#>>244 string from\ dosemu-freedos-*-bin.tgz\r
|
|
|
#>>>170 string Sorry,\ could\ not\ load\ an\
|
|
@@ -762,6 +786,18 @@
|
|
|
>>>>>492 string RENF \b, FAT (12 bit)
|
|
|
>>>>>495 string RENF \b, FAT (16 bit)
|
|
|
# x86 bootloader end
|
|
|
+
|
|
|
+# added by Joerg Jenderek at Nov 2012
|
|
|
+# http://www.thenakedpc.com/articles/v04/08/0408-05.html
|
|
|
+# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
|
|
|
+0 string PNCIHISK\0 Norton Utilities disc image data
|
|
|
+# real x86 boot sector with jump instruction
|
|
|
+>509 search/1026 \x55\xAA\xeb
|
|
|
+>>&-1 indirect x \b; contains
|
|
|
+# http://file-extension.net/seeker/file_extension_dat
|
|
|
+0 string PNCIUNDO Norton Disk Doctor UnDo file
|
|
|
+#
|
|
|
+
|
|
|
# updated by Joerg Jenderek at Sep 2007
|
|
|
>3 ubyte 0
|
|
|
#no active flag
|
|
@@ -776,149 +812,13 @@
|
|
|
>>>>>>>466 ubyte 0x05 \b, extended partition table
|
|
|
>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
|
|
|
>>>>>>>466 ubyte 0x0 \b, extended partition table (last)
|
|
|
-# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
|
|
|
-# http://mirror.href.com/thestarman/asm/2bytejumps.htmm#FWD
|
|
|
-# older drives may use Near JuMP instruction E9 xx xx
|
|
|
->0 lelong&0x009000EB 0x009000EB
|
|
|
->0 lelong&0x000000E9 0x000000E9
|
|
|
-# minimal short forward jump found 03cx??
|
|
|
-# maximal short forward jump is 07fx
|
|
|
->1 ubyte <0xff \b, code offset 0x%x
|
|
|
-# mtools-3.9.8/msdos.h
|
|
|
-# usual values are marked with comments to get only informations of strange FAT systems
|
|
|
-# valid sectorsize must be a power of 2 from 32 to 32768
|
|
|
->>11 uleshort&0x000f x
|
|
|
->>>11 uleshort <32769
|
|
|
->>>>11 uleshort >31
|
|
|
->>>>>21 ubyte&0xf0 0xF0
|
|
|
->>>>>>3 string >\0 \b, OEM-ID "%8.8s"
|
|
|
-#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
|
|
|
->>>>>>>8 string IHC \b cached by Windows 9M
|
|
|
->>>>>>11 uleshort >512 \b, Bytes/sector %u
|
|
|
-#>>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
|
|
|
->>>>>>11 uleshort <512 \b, Bytes/sector %u
|
|
|
->>>>>>13 ubyte >1 \b, sectors/cluster %u
|
|
|
-#>>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
|
|
|
->>>>>>14 uleshort >32 \b, reserved sectors %u
|
|
|
-#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
|
|
|
-#>>>>>>14 uleshort >1 \b, reserved sectors %u
|
|
|
-#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
|
|
|
->>>>>>14 uleshort <1 \b, reserved sectors %u
|
|
|
->>>>>>16 ubyte >2 \b, FATs %u
|
|
|
-#>>>>>>16 ubyte =2 \b, FATs %u (usual)
|
|
|
->>>>>>16 ubyte =1 \b, FAT %u
|
|
|
->>>>>>16 ubyte >0
|
|
|
->>>>>>17 uleshort >0 \b, root entries %u
|
|
|
-#>>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
|
|
|
->>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
|
|
|
-#>>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
|
|
|
->>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
|
|
|
-#>>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
|
|
|
->>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
|
|
|
->>>>>>22 uleshort >0 \b, sectors/FAT %u
|
|
|
-#>>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
|
|
|
->>>>>>26 ubyte >2 \b, heads %u
|
|
|
-#>>>>>>26 ubyte =2 \b, heads %u (usual floppy)
|
|
|
->>>>>>26 ubyte =1 \b, heads %u
|
|
|
-#skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
|
|
|
->>>>>>38 ubyte !0x70
|
|
|
->>>>>>>28 ulelong >0 \b, hidden sectors %u
|
|
|
-#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
|
|
|
->>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
|
|
|
-#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
|
|
|
-# FAT<32 specific
|
|
|
->>>>>>82 string !FAT32
|
|
|
-#>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
|
|
|
-#>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
|
|
|
->>>>>>>36 ubyte !0x80
|
|
|
->>>>>>>>36 ubyte !0 \b, physical drive 0x%x
|
|
|
->>>>>>>37 ubyte >0 \b, reserved 0x%x
|
|
|
-#>>>>>>>37 ubyte =0 \b, reserved 0x%x
|
|
|
->>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
|
|
|
->>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
|
|
|
->>>>>>>38 ubyte =0x29
|
|
|
->>>>>>>>39 ulelong x \b, serial number 0x%x
|
|
|
->>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
|
|
|
->>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
|
|
|
->>>>>>>>43 string =NO\ NAME \b, unlabeled
|
|
|
->>>>>>>54 string FAT \b, FAT
|
|
|
->>>>>>>>54 string FAT12 \b (12 bit)
|
|
|
->>>>>>>>54 string FAT16 \b (16 bit)
|
|
|
-# FAT32 specific
|
|
|
->>>>>>82 string FAT32 \b, FAT (32 bit)
|
|
|
->>>>>>>36 ulelong x \b, sectors/FAT %u
|
|
|
->>>>>>>40 uleshort >0 \b, extension flags %u
|
|
|
-#>>>>>>>40 uleshort =0 \b, extension flags %u
|
|
|
->>>>>>>42 uleshort >0 \b, fsVersion %u
|
|
|
-#>>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
|
|
|
->>>>>>>44 ulelong >2 \b, rootdir cluster %u
|
|
|
-#>>>>>>>44 ulelong =2 \b, rootdir cluster %u
|
|
|
-#>>>>>>>44 ulelong =1 \b, rootdir cluster %u
|
|
|
->>>>>>>48 uleshort >1 \b, infoSector %u
|
|
|
-#>>>>>>>48 uleshort =1 \b, infoSector %u (usual)
|
|
|
->>>>>>>48 uleshort <1 \b, infoSector %u
|
|
|
->>>>>>>50 uleshort >6 \b, Backup boot sector %u
|
|
|
-#>>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
|
|
|
->>>>>>>50 uleshort <6 \b, Backup boot sector %u
|
|
|
->>>>>>>54 ulelong >0 \b, reserved1 0x%x
|
|
|
->>>>>>>58 ulelong >0 \b, reserved2 0x%x
|
|
|
->>>>>>>62 ulelong >0 \b, reserved3 0x%x
|
|
|
-# same structure as FAT1X
|
|
|
->>>>>>>64 ubyte >0x80 \b, physical drive 0x%x
|
|
|
-#>>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
|
|
|
->>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x
|
|
|
-#>>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
|
|
|
->>>>>>>65 ubyte >0 \b, reserved 0x%x
|
|
|
->>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
|
|
|
->>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
|
|
|
->>>>>>>66 ubyte =0x29
|
|
|
->>>>>>>>67 ulelong x \b, serial number 0x%x
|
|
|
->>>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
|
|
|
->>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
|
|
|
->>>>>>>71 string =NO\ NAME \b, unlabeled
|
|
|
-### FATs end
|
|
|
+
|
|
|
+# DOS x86 sector separated and moved from "x86 boot sector" by Joerg Jenderek at May 2011
|
|
|
+
|
|
|
>0x200 lelong 0x82564557 \b, BSD disklabel
|
|
|
# FATX
|
|
|
0 string FATX FATX filesystem data
|
|
|
|
|
|
-
|
|
|
-# Minix filesystems - Juan Cespedes <cespedes@debian.org>
|
|
|
-0x410 leshort 0x137f
|
|
|
-!:strength / 2
|
|
|
->0x402 beshort < 100 Minix filesystem, V1, %d zones
|
|
|
->0x1e string minix \b, bootable
|
|
|
-0x410 beshort 0x137f
|
|
|
-!:strength / 2
|
|
|
->0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones
|
|
|
->0x1e string minix \b, bootable
|
|
|
-0x410 leshort 0x138f
|
|
|
-!:strength / 2
|
|
|
->0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones
|
|
|
->0x1e string minix \b, bootable
|
|
|
-0x410 beshort 0x138f
|
|
|
-!:strength / 2
|
|
|
->0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones
|
|
|
->0x1e string minix \b, bootable
|
|
|
-0x410 leshort 0x2468
|
|
|
->0x402 beshort < 100 Minix filesystem, V2, %d zones
|
|
|
->0x1e string minix \b, bootable
|
|
|
-0x410 beshort 0x2468
|
|
|
->0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones
|
|
|
->0x1e string minix \b, bootable
|
|
|
-
|
|
|
-0x410 leshort 0x2478
|
|
|
->0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones
|
|
|
->0x1e string minix \b, bootable
|
|
|
-0x410 leshort 0x2478
|
|
|
->0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones
|
|
|
->0x1e string minix \b, bootable
|
|
|
-0x410 beshort 0x2478
|
|
|
->0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones
|
|
|
->0x1e string minix \b, bootable
|
|
|
-0x410 leshort 0x4d5a
|
|
|
->0x402 beshort !0 Minix filesystem, V3, %d zones
|
|
|
->0x1e string minix \b, bootable
|
|
|
-
|
|
|
# romfs filesystems - Juan Cespedes <cespedes@debian.org>
|
|
|
0 string -rom1fs- romfs filesystem, version 1
|
|
|
>8 belong x %d bytes,
|
|
@@ -933,12 +833,141 @@
|
|
|
|
|
|
0x18b string OS/2 OS/2 Boot Manager
|
|
|
|
|
|
-# updated by Joerg Jenderek at Oct 2008!!
|
|
|
+# updated by Joerg Jenderek at Oct 2008 and Sep 2012
|
|
|
# http://syslinux.zytor.com/iso.php
|
|
|
-0 ulelong 0x7c40eafa isolinux Loader
|
|
|
+# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
|
|
|
+# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
|
|
|
+0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
|
|
|
+>631 search/689 ISOLINUX\ isolinux Loader
|
|
|
+>>&0 string x (version %-4.4s)
|
|
|
# http://syslinux.zytor.com/pxe.php
|
|
|
-0 ulelong 0x007c05ea pxelinux Loader
|
|
|
-0 ulelong 0x60669c66 pxelinux Loader
|
|
|
+# assembler instructions: jmp 7C05
|
|
|
+0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older)
|
|
|
+# assembler instructions: pushfd;pushad
|
|
|
+0 ulelong 0x60669c66 pxelinux loader
|
|
|
+# assembler instructions: jmp 05
|
|
|
+0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer)
|
|
|
+# http://syslinux.zytor.com/wiki/index.php/SYSLINUX
|
|
|
+0 string LDLINUX\ SYS\ SYSLINUX loader
|
|
|
+>12 string x (older version %-4.4s)
|
|
|
+0 string \r\nSYSLINUX\ SYSLINUX loader
|
|
|
+>11 string x (version %-4.4s)
|
|
|
+# syslinux updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012
|
|
|
+# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
|
|
|
+0 ulelong&0x80909bEB 0x009018EB
|
|
|
+# OEM-ID not always "SYSLINUX"
|
|
|
+>434 search/47 Boot\ failed
|
|
|
+# followed by \r\n\0 or :\
|
|
|
+>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older)
|
|
|
+>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9)
|
|
|
+>459 search/30 Boot\ error\r\n\0
|
|
|
+>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer)
|
|
|
+# SYSLINUX MBR updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012
|
|
|
+# assembler instructions: mov di,0600h;mov cx,0100h
|
|
|
+16 search/4 \xbf\x00\x06\xb9\x00\x01
|
|
|
+>94 search/249 Missing\ operating\ system
|
|
|
+# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
|
|
|
+# skip Ranish MBR
|
|
|
+>>408 search/4 HD1/\0
|
|
|
+>>408 default x
|
|
|
+>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR
|
|
|
+# followed by "ing " or space
|
|
|
+>>>>292 search/98 error
|
|
|
+>>>>>&0 string \r (version 3.35 or older)
|
|
|
+>>>>>&0 string .\r (version 3.52 or newer)
|
|
|
+>>>>>&0 default x (version 3.36-3.51 )
|
|
|
+>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR
|
|
|
+>>156 search/10 \0Boot\ partition\ not\ found\r\n
|
|
|
+>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older)
|
|
|
+>>174 search/10 \0Missing\ OS\r\n
|
|
|
+>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer)
|
|
|
+# SYSLINUX END
|
|
|
+
|
|
|
+# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
|
|
|
+# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax,
|
|
|
+0 ubequad 0x31c08ed0bc007c8e
|
|
|
+# mbr_bootsel magic before partition table not reliable with small ipl fragments
|
|
|
+#>444 uleshort 0xb5e1
|
|
|
+>0004 uleshort x
|
|
|
+# ERRorTeXT
|
|
|
+>>181 search/166 Error\ \0\r\n NetBSD mbr
|
|
|
+# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
|
|
|
+>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x
|
|
|
+# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
|
|
|
+>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector
|
|
|
+# BOOT_EXTENDED definitions contains assembler instructions:
|
|
|
+# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
|
|
|
+>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended
|
|
|
+# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
|
|
|
+>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO
|
|
|
+# not TERSE_ERROR
|
|
|
+>>>196 search/106 No\ active\ partition\0
|
|
|
+>>>>&0 string Disk\ read\ error\0
|
|
|
+>>>>>&0 string No\ operating\ system\0 \b,verbose
|
|
|
+# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
|
|
|
+>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS
|
|
|
+# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13
|
|
|
+>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check
|
|
|
+# assembler instructions: movw nametab,bx
|
|
|
+>>>0x26 search/21 \xBB\x94\x07
|
|
|
+# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
|
|
|
+>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94
|
|
|
+>>>>>181 search/166 Error\ \0
|
|
|
+# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
|
|
|
+>>>>>>&3 string x \b,"%s"
|
|
|
+# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
|
|
|
+# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
|
|
|
+# assembler instructions: jmp short 0x58;nop;ASCII
|
|
|
+0 ubequad&0xeb58908000000000 0xeb58900000000000
|
|
|
+# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
|
|
|
+>(1.b+2) ubequad 0xfa31c08ed88ec08e
|
|
|
+# Error messages at end of code
|
|
|
+>>376 string No\ operating\ system\r\n\0
|
|
|
+>>>398 string Disk\ error\r\n\0FDD\0HDD\0
|
|
|
+>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr
|
|
|
+
|
|
|
+# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
|
|
|
+# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
|
|
|
+# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
|
|
|
+# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
|
|
|
+0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC
|
|
|
+# pointer to the data starting with Neil Turton signature string
|
|
|
+>(0x1BC.s) string NDTmbr
|
|
|
+>>&-14 string 1234F\0 Turton mbr (
|
|
|
+# parameters also viewed by install-mbr --list
|
|
|
+>>>(0x1BC.s+7) ubyte x \b%u<=
|
|
|
+>>>(0x1BC.s+9) ubyte x \bVersion<=%u
|
|
|
+#>>>(0x1BC.s+8) ubyte x asm_flag_%x
|
|
|
+>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix
|
|
|
+# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode
|
|
|
+>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk
|
|
|
+#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
|
|
|
+#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x
|
|
|
+#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
|
|
|
+#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x
|
|
|
+# for older versions
|
|
|
+>>>(0x1BC.s+9) ubyte <2
|
|
|
+#>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds
|
|
|
+>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
|
|
|
+# floppy A: or B:
|
|
|
+>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x
|
|
|
+>>>>(0x1BC.s+13) ubyte >1
|
|
|
+# 1st hard disc
|
|
|
+#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x
|
|
|
+# not 1st hard disc
|
|
|
+>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x
|
|
|
+# for version >= 2 maximal timeout can be 65534
|
|
|
+>>>(0x1BC.s+9) ubyte >1
|
|
|
+#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds
|
|
|
+>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds
|
|
|
+# floppy A: or B:
|
|
|
+>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x
|
|
|
+>>>>(0x1BC.s+14) ubyte >1
|
|
|
+# 1st hard disc
|
|
|
+#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x
|
|
|
+# not 1st hard disc
|
|
|
+>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x
|
|
|
+>>>0 ubyte x \b)
|
|
|
|
|
|
# added by Joerg Jenderek
|
|
|
# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
|
|
@@ -995,6 +1024,168 @@
|
|
|
>>>>>0x217 ulong !0xffffffff
|
|
|
>>>>>>0x217 string >\0 \b, configuration file %-s
|
|
|
|
|
|
+# DOS x86 sector updated and separated from "x86 boot sector" by Joerg Jenderek at May 2011
|
|
|
+# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
|
|
|
+# over BIOS parameter block (BPB)
|
|
|
+# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
|
|
|
+# older drives may use Near JuMP instruction E9 xx xx
|
|
|
+# minimal short forward jump found 0x29 for bootloaders or 0x0
|
|
|
+# maximal short forward jump is 0x7f
|
|
|
+# OEM-ID is empty or contain readable bytes
|
|
|
+0 ulelong&0x804000E9 0x000000E9
|
|
|
+# mtools-3.9.8/msdos.h
|
|
|
+# usual values are marked with comments to get only informations of strange FAT systems
|
|
|
+# valid sectorsize must be a power of 2 from 32 to 32768
|
|
|
+>11 uleshort&0xf001f 0
|
|
|
+>>11 uleshort <32769
|
|
|
+>>>11 uleshort >31
|
|
|
+>>>>21 ubyte&0xf0 0xF0
|
|
|
+>>>>>0 ubyte 0xEB
|
|
|
+>>>>>>1 ubyte x \b, code offset 0x%x+2
|
|
|
+>>>>>0 ubyte 0xE9
|
|
|
+>>>>>>1 uleshort x \b, code offset 0x%x+2
|
|
|
+>>>>>3 string >\0 \b, OEM-ID "%-.8s"
|
|
|
+#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
|
|
|
+>>>>>>8 string IHC \b cached by Windows 9M
|
|
|
+>>>>>11 uleshort >512 \b, Bytes/sector %u
|
|
|
+#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
|
|
|
+>>>>>11 uleshort <512 \b, Bytes/sector %u
|
|
|
+>>>>>13 ubyte >1 \b, sectors/cluster %u
|
|
|
+#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
|
|
|
+>>>>>82 string FAT32
|
|
|
+>>>>>>14 uleshort !32 \b, reserved sectors %u
|
|
|
+#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
|
|
|
+>>>>>82 string !FAT32
|
|
|
+>>>>>>14 uleshort >1 \b, reserved sectors %u
|
|
|
+#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
|
|
|
+#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS)
|
|
|
+>>>>>16 ubyte >2 \b, FATs %u
|
|
|
+#>>>>>16 ubyte =2 \b, FATs %u (usual)
|
|
|
+>>>>>16 ubyte =1 \b, FAT %u
|
|
|
+>>>>>16 ubyte >0
|
|
|
+>>>>>17 uleshort >0 \b, root entries %u
|
|
|
+#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
|
|
|
+>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
|
|
|
+#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
|
|
|
+>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
|
|
|
+#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
|
|
|
+>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
|
|
|
+>>>>>22 uleshort >0 \b, sectors/FAT %u
|
|
|
+#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
|
|
|
+>>>>>24 uleshort x \b, sectors/track %u
|
|
|
+>>>>>26 ubyte >2 \b, heads %u
|
|
|
+#>>>>>26 ubyte =2 \b, heads %u (usual floppy)
|
|
|
+>>>>>26 ubyte =1 \b, heads %u
|
|
|
+# valid only for sector sizes with more then 32 Bytes
|
|
|
+>>>>>11 uleshort >32
|
|
|
+# skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
|
|
|
+>>>>>>38 ubyte !0x70
|
|
|
+>>>>>>>28 ulelong >0 \b, hidden sectors %u
|
|
|
+#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
|
|
|
+>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
|
|
|
+#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
|
|
|
+# FAT<32 bit specific
|
|
|
+>>>>>>>82 string !FAT32
|
|
|
+#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
|
|
|
+#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
|
|
|
+>>>>>>>>36 ubyte !0x80
|
|
|
+>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x
|
|
|
+>>>>>>>>37 ubyte >0 \b, reserved 0x%x
|
|
|
+#>>>>>>>>37 ubyte =0 \b, reserved 0x%x
|
|
|
+# value is 0x80 for NTFS
|
|
|
+>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
|
|
|
+>>>>>>>>38 ubyte =0x29
|
|
|
+>>>>>>>>>39 ulelong x \b, serial number 0x%x
|
|
|
+>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
|
|
|
+>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
|
|
|
+>>>>>>>>>43 string =NO\ NAME \b, unlabeled
|
|
|
+# there exist some old floppies without word FAT at offset 54
|
|
|
+# a word like "FATnm " is only a hint for a FAT size on nm-bits
|
|
|
+# Normally the number of clusters is calculated by the values of BPP.
|
|
|
+# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
|
|
|
+# otherwise FAT is 16 bit.
|
|
|
+# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
|
|
|
+>>>>>>54 string FAT \b, FAT
|
|
|
+>>>>>>>54 string FAT12 \b (12 bit)
|
|
|
+>>>>>>>54 string FAT16 \b (16 bit)
|
|
|
+# FAT32 bit specific
|
|
|
+>>>>>82 string FAT32 \b, FAT (32 bit)
|
|
|
+>>>>>>36 ulelong x \b, sectors/FAT %u
|
|
|
+# http://technet.microsoft.com/en-us/library/cc977221.aspx
|
|
|
+>>>>>>40 uleshort >0 \b, extension flags 0x%x
|
|
|
+#>>>>>>40 uleshort =0 \b, extension flags %u
|
|
|
+>>>>>>42 uleshort >0 \b, fsVersion %u
|
|
|
+#>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
|
|
|
+>>>>>>44 ulelong >2 \b, rootdir cluster %u
|
|
|
+#>>>>>>44 ulelong =2 \b, rootdir cluster %u
|
|
|
+#>>>>>>44 ulelong =1 \b, rootdir cluster %u
|
|
|
+>>>>>>48 uleshort >1 \b, infoSector %u
|
|
|
+#>>>>>>48 uleshort =1 \b, infoSector %u (usual)
|
|
|
+>>>>>>48 uleshort <1 \b, infoSector %u
|
|
|
+>>>>>>50 uleshort >6 \b, Backup boot sector %u
|
|
|
+#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
|
|
|
+>>>>>>50 uleshort <6 \b, Backup boot sector %u
|
|
|
+# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
|
|
|
+>>>>>>52 ulelong >0 \b, reserved1 0x%x
|
|
|
+>>>>>>56 ulelong >0 \b, reserved2 0x%x
|
|
|
+>>>>>>60 ulelong >0 \b, reserved3 0x%x
|
|
|
+# same structure as FAT1X
|
|
|
+#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
|
|
|
+#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
|
|
|
+>>>>>>64 ubyte !0x80
|
|
|
+>>>>>>>64 ubyte >0 \b, physical drive 0x%x
|
|
|
+# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
|
|
|
+>>>>>>65 ubyte >0 \b, reserved 0x%x
|
|
|
+>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
|
|
|
+>>>>>>66 ubyte =0x29
|
|
|
+>>>>>>>67 ulelong x \b, serial number 0x%x
|
|
|
+>>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
|
|
|
+>>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
|
|
|
+>>>>>>>71 string =NO\ NAME \b, unlabeled
|
|
|
+# additional tests for floppy image added by Joerg Jenderek
|
|
|
+# no fixed disk
|
|
|
+>>>>>21 ubyte !0xF8
|
|
|
+# floppy media with 12 bit FAT
|
|
|
+>>>>>>54 string !FAT16
|
|
|
+# test for FAT after bootsector
|
|
|
+>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT
|
|
|
+# floppy image
|
|
|
+!:mime application/x-ima
|
|
|
+# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
|
|
|
+# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
|
|
|
+# 0 FATs
|
|
|
+>>>>>16 ubyte =0
|
|
|
+# 0 root entries
|
|
|
+>>>>>>17 uleshort =0
|
|
|
+# 0 DOS sectors
|
|
|
+>>>>>>>19 uleshort =0
|
|
|
+# 0 sectors/FAT
|
|
|
+# dos < 4.0 BootSector value found is 0x80
|
|
|
+#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x)
|
|
|
+>>>>>>>>22 uleshort =0 \b; NTFS
|
|
|
+>>>>>>>>>24 uleshort >0 \b, sectors/track %u
|
|
|
+>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x
|
|
|
+>>>>>>>>>40 ulequad >0 \b, sectors %lld
|
|
|
+>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld
|
|
|
+>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld
|
|
|
+# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
|
|
|
+# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
|
|
|
+>>>>>>>>>64 lelong <256
|
|
|
+>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d
|
|
|
+>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi)
|
|
|
+# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
|
|
|
+# Values 128 to 255 represent index block sizes of 2^(256-N) byte
|
|
|
+>>>>>>>>>68 ulelong <256
|
|
|
+>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d
|
|
|
+#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d)
|
|
|
+>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi)
|
|
|
+>>>>>>>>>72 ulequad x \b, serial number 0%llx
|
|
|
+>>>>>>>>>80 ulelong >0 \b, checksum 0x%x
|
|
|
+#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual)
|
|
|
+>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090
|
|
|
+>>>>>>>>>>&-92 indirect x \b; contains
|
|
|
+### DOS boot sector end
|
|
|
+
|
|
|
9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
|
|
|
>8404 string x last mounted on %s,
|
|
|
#>9504 ledate x last checked at %s,
|
|
@@ -1157,6 +1348,43 @@
|
|
|
#>0x464 lelong &0x0000020 (many subdirs)
|
|
|
#>0x463 lelong &0x0000040 (extra isize)
|
|
|
|
|
|
+# Minix filesystems - Juan Cespedes <cespedes@debian.org>
|
|
|
+0x410 leshort 0x137f
|
|
|
+!:strength / 2
|
|
|
+>0x402 beshort < 100 Minix filesystem, V1, %d zones
|
|
|
+>0x1e string minix \b, bootable
|
|
|
+0x410 beshort 0x137f
|
|
|
+!:strength / 2
|
|
|
+>0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones
|
|
|
+>0x1e string minix \b, bootable
|
|
|
+0x410 leshort 0x138f
|
|
|
+!:strength / 2
|
|
|
+>0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones
|
|
|
+>0x1e string minix \b, bootable
|
|
|
+0x410 beshort 0x138f
|
|
|
+!:strength / 2
|
|
|
+>0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones
|
|
|
+>0x1e string minix \b, bootable
|
|
|
+0x410 leshort 0x2468
|
|
|
+>0x402 beshort < 100 Minix filesystem, V2, %d zones
|
|
|
+>0x1e string minix \b, bootable
|
|
|
+0x410 beshort 0x2468
|
|
|
+>0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones
|
|
|
+>0x1e string minix \b, bootable
|
|
|
+
|
|
|
+0x410 leshort 0x2478
|
|
|
+>0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones
|
|
|
+>0x1e string minix \b, bootable
|
|
|
+0x410 leshort 0x2478
|
|
|
+>0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones
|
|
|
+>0x1e string minix \b, bootable
|
|
|
+0x410 beshort 0x2478
|
|
|
+>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones
|
|
|
+>0x1e string minix \b, bootable
|
|
|
+0x410 leshort 0x4d5a
|
|
|
+>0x402 beshort !0 Minix filesystem, V3, %d zones
|
|
|
+>0x1e string minix \b, bootable
|
|
|
+
|
|
|
# SGI disk labels - Nathan Scott <nathans@debian.org>
|
|
|
0 belong 0x0BE5A941 SGI disk label (volume header)
|
|
|
|
|
@@ -1243,7 +1471,7 @@
|
|
|
>>38917 byte >0x33 (unknown version, ID 0x%X)
|
|
|
>>38917 byte <0x31 (unknown version, ID 0x%X)
|
|
|
# "application id" which appears to be used as a volume label
|
|
|
->32808 string >\0 '%s'
|
|
|
+>32808 string/T >\0 '%s'
|
|
|
>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
|
|
|
37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
|
|
|
!:mime application/x-iso9660-image
|
|
@@ -1569,3 +1797,26 @@
|
|
|
>>&8 lelong x \b, blocksize %d
|
|
|
>>&32 lelong&0x00000006 >0 (dirty)
|
|
|
>>&36 lelong >0 (compressed)
|
|
|
+
|
|
|
+# LFS
|
|
|
+0 lelong 0x070162 LFS filesystem image
|
|
|
+>4 lelong 1 version 1,
|
|
|
+>>8 lelong x \b blocks %u,
|
|
|
+>>12 lelong x \b blocks per segment %u,
|
|
|
+>4 lelong 2 version 2,
|
|
|
+>>8 lelong x \b fragments %u,
|
|
|
+>>12 lelong x \b bytes per segment %u,
|
|
|
+>16 lelong x \b disk blocks %u,
|
|
|
+>20 lelong x \b block size %u,
|
|
|
+>24 lelong x \b fragment size %u,
|
|
|
+>28 lelong x \b fragments per block %u,
|
|
|
+>32 lelong x \b start for free list %u,
|
|
|
+>36 lelong x \b number of free blocks %d,
|
|
|
+>40 lelong x \b number of files %u,
|
|
|
+>44 lelong x \b blocks available for writing %d,
|
|
|
+>48 lelong x \b inodes in cache %d,
|
|
|
+>52 lelong x \b inode file disk address 0x%x,
|
|
|
+>56 lelong x \b inode file inode number %u,
|
|
|
+>60 lelong x \b address of last segment written 0x%x,
|
|
|
+>64 lelong x \b address of next segment to write 0x%x,
|
|
|
+>68 lelong x \b address of current segment written 0x%x
|