|
@@ -11,69 +11,325 @@
|
|
|
# files obtained from most archives. (franklsm@tuns.ca)
|
|
|
0 string SIT! StuffIt Archive (data)
|
|
|
>2 string x : %s
|
|
|
-65 string SIT! StuffIt Archive (rsrc + data)
|
|
|
->2 string x : %s
|
|
|
0 string SITD StuffIt Deluxe (data)
|
|
|
>2 string x : %s
|
|
|
-65 string SITD StuffIt Deluxe (rsrc + data)
|
|
|
->2 string x : %s
|
|
|
0 string Seg StuffIt Deluxe Segment (data)
|
|
|
>2 string x : %s
|
|
|
-65 string Seg StuffIt Deluxe Segment (rsrc + data)
|
|
|
->2 string x : %s
|
|
|
|
|
|
# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
|
|
|
0 string APPL Macintosh Application (data)
|
|
|
->2 string x : %s
|
|
|
-65 string APPL Macintosh Application (rsrc + data)
|
|
|
->2 string x : %s
|
|
|
+>2 string x \b: %s
|
|
|
|
|
|
# Macintosh System files (franklsm@tuns.ca)
|
|
|
0 string zsys Macintosh System File (data)
|
|
|
-65 string zsys Macintosh System File(rsrc + data)
|
|
|
0 string FNDR Macintosh Finder (data)
|
|
|
-65 string FNDR Macintosh Finder(rsrc + data)
|
|
|
0 string libr Macintosh Library (data)
|
|
|
>2 string x : %s
|
|
|
-65 string libr Macintosh Library(rsrc + data)
|
|
|
->2 string x : %s
|
|
|
0 string shlb Macintosh Shared Library (data)
|
|
|
>2 string x : %s
|
|
|
-65 string shlb Macintosh Shared Library(rsrc + data)
|
|
|
->2 string x : %s
|
|
|
0 string cdev Macintosh Control Panel (data)
|
|
|
>2 string x : %s
|
|
|
-65 string cdev Macintosh Control Panel(rsrc + data)
|
|
|
->2 string x : %s
|
|
|
0 string INIT Macintosh Extension (data)
|
|
|
>2 string x : %s
|
|
|
-65 string INIT Macintosh Extension(rsrc + data)
|
|
|
->2 string x : %s
|
|
|
0 string FFIL Macintosh Truetype Font (data)
|
|
|
>2 string x : %s
|
|
|
-65 string FFIL Macintosh Truetype Font(rsrc + data)
|
|
|
->2 string x : %s
|
|
|
0 string LWFN Macintosh Postscript Font (data)
|
|
|
>2 string x : %s
|
|
|
-65 string LWFN Macintosh Postscript Font(rsrc + data)
|
|
|
->2 string x : %s
|
|
|
|
|
|
# Additional Macintosh Files (franklsm@tuns.ca)
|
|
|
-
|
|
|
0 string PACT Macintosh Compact Pro Archive (data)
|
|
|
>2 string x : %s
|
|
|
-65 string PACT Macintosh Compact Pro Archive(rsrc + data)
|
|
|
->2 string x : %s
|
|
|
0 string ttro Macintosh TeachText File (data)
|
|
|
>2 string x : %s
|
|
|
-65 string ttro Macintosh TeachText File(rsrc + data)
|
|
|
->2 string x : %s
|
|
|
0 string TEXT Macintosh TeachText File (data)
|
|
|
>2 string x : %s
|
|
|
-65 string TEXT Macintosh TeachText File(rsrc + data)
|
|
|
->2 string x : %s
|
|
|
0 string PDF Macintosh PDF File (data)
|
|
|
>2 string x : %s
|
|
|
-65 string PDF Macintosh PDF File(rsrc + data)
|
|
|
->2 string x : %s
|
|
|
|
|
|
+# MacBinary format (Eric Fischer, enf@pobox.com)
|
|
|
+#
|
|
|
+# Unfortunately MacBinary doesn't really have a magic number prior
|
|
|
+# to the MacBinary III format. The checksum is really the way to
|
|
|
+# do it, but the magic file format isn't up to the challenge.
|
|
|
+#
|
|
|
+# 0 byte 0
|
|
|
+# 1 byte # filename length
|
|
|
+# 2 string # filename
|
|
|
+# 65 string # file type
|
|
|
+# 69 string # file creator
|
|
|
+# 73 byte # Finder flags
|
|
|
+# 74 byte 0
|
|
|
+# 75 beshort # vertical posn in window
|
|
|
+# 77 beshort # horiz posn in window
|
|
|
+# 79 beshort # window or folder ID
|
|
|
+# 81 byte # protected?
|
|
|
+# 82 byte 0
|
|
|
+# 83 belong # length of data segment
|
|
|
+# 87 belong # length of resource segment
|
|
|
+# 91 belong # file creation date
|
|
|
+# 95 belong # file modification date
|
|
|
+# 99 beshort # length of comment after resource
|
|
|
+# 101 byte # new Finder flags
|
|
|
+# 102 string mBIN # (only in MacBinary III)
|
|
|
+# 106 byte # char. code of file name
|
|
|
+# 107 byte # still more Finder flags
|
|
|
+# 116 belong # total file length
|
|
|
+# 120 beshort # length of add'l header
|
|
|
+# 122 byte 129 # for MacBinary II
|
|
|
+# 122 byte 130 # for MacBinary III
|
|
|
+# 123 byte 129 # minimum version that can read fmt
|
|
|
+# 124 beshort # checksum
|
|
|
+#
|
|
|
+# This attempts to use the version numbers as a magic number, requiring
|
|
|
+# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
|
|
|
+# be 0x81. This works for the files I have, but maybe not for everyone's.
|
|
|
+
|
|
|
+122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
|
|
|
+
|
|
|
+# MacBinary I doesn't have the version number field at all, but MacBinary II
|
|
|
+# has been in use since 1987 so I hope there aren't many really old files
|
|
|
+# floating around that this will miss. The original spec calls for using
|
|
|
+# the nulls in 0, 74, and 82 as the magic number.
|
|
|
+#
|
|
|
+# Another possibility, that would also work for MacBinary I, is to use
|
|
|
+# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
|
|
|
+# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
|
|
|
+# and that 74 will be 0. So something like
|
|
|
+#
|
|
|
+# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
|
|
|
+#
|
|
|
+# >73 byte&0x01 0x01 \b, inited
|
|
|
+# >73 byte&0x02 0x02 \b, changed
|
|
|
+# >73 byte&0x04 0x04 \b, busy
|
|
|
+# >73 byte&0x08 0x08 \b, bozo
|
|
|
+# >73 byte&0x10 0x10 \b, system
|
|
|
+# >73 byte&0x10 0x20 \b, bundle
|
|
|
+# >73 byte&0x10 0x40 \b, invisible
|
|
|
+# >73 byte&0x10 0x80 \b, locked
|
|
|
+
|
|
|
+>65 string x \b, type "%4.4s"
|
|
|
+
|
|
|
+>65 string 8BIM (PhotoShop)
|
|
|
+>65 string ALB3 (PageMaker 3)
|
|
|
+>65 string ALB4 (PageMaker 4)
|
|
|
+>65 string ALT3 (PageMaker 3)
|
|
|
+>65 string APPL (application)
|
|
|
+>65 string AWWP (AppleWorks word processor)
|
|
|
+>65 string CIRC (simulated circuit)
|
|
|
+>65 string DRWG (MacDraw)
|
|
|
+>65 string EPSF (Encapsulated PostScript)
|
|
|
+>65 string FFIL (font suitcase)
|
|
|
+>65 string FKEY (function key)
|
|
|
+>65 string FNDR (Macintosh Finder)
|
|
|
+>65 string GIFf (GIF image)
|
|
|
+>65 string Gzip (GNU gzip)
|
|
|
+>65 string INIT (system extension)
|
|
|
+>65 string LIB\ (library)
|
|
|
+>65 string LWFN (PostScript font)
|
|
|
+>65 string MSBC (Microsoft BASIC)
|
|
|
+>65 string PACT (Compact Pro archive)
|
|
|
+>65 string PDF\ (Portable Document Format)
|
|
|
+>65 string PICT (picture)
|
|
|
+>65 string PNTG (MacPaint picture)
|
|
|
+>65 string PREF (preferences)
|
|
|
+>65 string PROJ (Think C project)
|
|
|
+>65 string QPRJ (Think Pascal project)
|
|
|
+>65 string SCFL (Defender scores)
|
|
|
+>65 string SCRN (startup screen)
|
|
|
+>65 string SITD (StuffIt Deluxe)
|
|
|
+>65 string SPn3 (SuperPaint)
|
|
|
+>65 string STAK (HyperCard stack)
|
|
|
+>65 string Seg\ (StuffIt segment)
|
|
|
+>65 string TARF (Unix tar archive)
|
|
|
+>65 string TEXT (ASCII)
|
|
|
+>65 string TIFF (TIFF image)
|
|
|
+>65 string TOVF (Eudora table of contents)
|
|
|
+>65 string WDBN (Microsoft Word word processor)
|
|
|
+>65 string WORD (MacWrite word processor)
|
|
|
+>65 string XLS\ (Microsoft Excel)
|
|
|
+>65 string ZIVM (compress (.Z))
|
|
|
+>65 string ZSYS (Pre-System 7 system file)
|
|
|
+>65 string acf3 (Aldus FreeHand)
|
|
|
+>65 string cdev (control panel)
|
|
|
+>65 string dfil (Desk Acessory suitcase)
|
|
|
+>65 string libr (library)
|
|
|
+>65 string nX^d (WriteNow word processor)
|
|
|
+>65 string nX^w (WriteNow dictionary)
|
|
|
+>65 string rsrc (resource)
|
|
|
+>65 string scbk (Scrapbook)
|
|
|
+>65 string shlb (shared library)
|
|
|
+>65 string ttro (SimpleText read-only)
|
|
|
+>65 string zsys (system file)
|
|
|
+
|
|
|
+>69 string x \b, creator "%4.4s"
|
|
|
+
|
|
|
+# Somewhere, Apple has a repository of registered Creator IDs. These are
|
|
|
+# just the ones that I happened to have files from and was able to identify.
|
|
|
+
|
|
|
+>69 string 8BIM (Adobe Photoshop)
|
|
|
+>69 string ALD3 (PageMaker 3)
|
|
|
+>69 string ALD4 (PageMaker 4)
|
|
|
+>69 string ALFA (Alpha editor)
|
|
|
+>69 string APLS (Apple Scanner)
|
|
|
+>69 string APSC (Apple Scanner)
|
|
|
+>69 string BRKL (Brickles)
|
|
|
+>69 string BTFT (BitFont)
|
|
|
+>69 string CCL2 (Common Lisp 2)
|
|
|
+>69 string CCL\ (Common Lisp)
|
|
|
+>69 string CDmo (The Talking Moose)
|
|
|
+>69 string CPCT (Compact Pro)
|
|
|
+>69 string CSOm (Eudora)
|
|
|
+>69 string DMOV (Font/DA Mover)
|
|
|
+>69 string DSIM (DigSim)
|
|
|
+>69 string EDIT (Macintosh Edit)
|
|
|
+>69 string ERIK (Macintosh Finder)
|
|
|
+>69 string EXTR (self-extracting archive)
|
|
|
+>69 string Gzip (GNU gzip)
|
|
|
+>69 string KAHL (Think C)
|
|
|
+>69 string LWFU (LaserWriter Utility)
|
|
|
+>69 string LZIV (compress)
|
|
|
+>69 string MACA (MacWrite)
|
|
|
+>69 string MACS (Macintosh operating system)
|
|
|
+>69 string MAcK (MacKnowledge terminal emulator)
|
|
|
+>69 string MLND (Defender)
|
|
|
+>69 string MPNT (MacPaint)
|
|
|
+>69 string MSBB (Microsoft BASIC (binary))
|
|
|
+>69 string MSWD (Microsoft Word)
|
|
|
+>69 string NCSA (NCSA Telnet)
|
|
|
+>69 string PJMM (Think Pascal)
|
|
|
+>69 string PSAL (Hunt the Wumpus)
|
|
|
+>69 string PSI2 (Apple File Exchange)
|
|
|
+>69 string R*ch (BBEdit)
|
|
|
+>69 string RMKR (Resource Maker)
|
|
|
+>69 string RSED (Resource Editor)
|
|
|
+>69 string Rich (BBEdit)
|
|
|
+>69 string SIT! (StuffIt)
|
|
|
+>69 string SPNT (SuperPaint)
|
|
|
+>69 string Unix (NeXT Mac filesystem)
|
|
|
+>69 string VIM! (Vim editor)
|
|
|
+>69 string WILD (HyperCard)
|
|
|
+>69 string XCEL (Microsoft Excel)
|
|
|
+>69 string aCa2 (Fontographer)
|
|
|
+>69 string aca3 (Aldus FreeHand)
|
|
|
+>69 string dosa (Macintosh MS-DOS file system)
|
|
|
+>69 string movr (Font/DA Mover)
|
|
|
+>69 string nX^n (WriteNow)
|
|
|
+>69 string pdos (Apple ProDOS file system)
|
|
|
+>69 string scbk (Scrapbook)
|
|
|
+>69 string ttxt (SimpleText)
|
|
|
+>69 string ufox (Foreign File Access)
|
|
|
+
|
|
|
+# Just in case...
|
|
|
+
|
|
|
+102 string mBIN MacBinary III data with surprising version number
|
|
|
+
|
|
|
+# sas magic from Bruce Foster (bef@nwu.edu)
|
|
|
+#
|
|
|
+#0 string SAS SAS
|
|
|
+#>8 string x %s
|
|
|
+0 string SAS SAS
|
|
|
+>24 string DATA data file
|
|
|
+>24 string CATALOG catalog
|
|
|
+>24 string INDEX data file index
|
|
|
+>24 string VIEW data view
|
|
|
+# spss magic for SPSS system and portable files,
|
|
|
+# from Bruce Foster (bef@nwu.edu).
|
|
|
+
|
|
|
+0 long 0xc1e2c3c9 SPSS Portable File
|
|
|
+>40 string x %s
|
|
|
+
|
|
|
+0 string $FL2 SPSS System File
|
|
|
+>24 string x %s
|
|
|
+
|
|
|
+# Macintosh filesystem data
|
|
|
+# From "Tom N Harris" <telliamed@mac.com>
|
|
|
+# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
|
|
|
+# entries depend on the data arithmetic added after v.35
|
|
|
+# There's also some Pascal strings in here, ditto...
|
|
|
+
|
|
|
+# The boot block signature, according to IM:Files, is
|
|
|
+# "for HFS volumes, this field always contains the value 0x4C4B."
|
|
|
+# But if this is true for MFS or HFS+ volumes, I don't know.
|
|
|
+# Alternatively, the boot block is supposed to be zeroed if it's
|
|
|
+# unused, so a simply >0 should suffice.
|
|
|
+
|
|
|
+0x400 beshort 0xD2D7 Macintosh MFS data
|
|
|
+>0 beshort 0x4C4B (bootable)
|
|
|
+>0x40a beshort &0x8000 (locked)
|
|
|
+>0x402 beldate-0x7C25B080 x created: %s,
|
|
|
+>0x406 beldate-0x7C25B080 >0 last backup: %s,
|
|
|
+>0x414 belong x block size: %d,
|
|
|
+>0x412 beshort x number of blocks: %d,
|
|
|
+>0x424 pstring x volume name: %s
|
|
|
+
|
|
|
+0x400 beshort 0x4244 Macintosh HFS data
|
|
|
+>0 beshort 0x4C4B (bootable)
|
|
|
+>0x40a beshort &0x8000 (locked)
|
|
|
+>0x40a beshort ^0x0100 (mounted)
|
|
|
+>0x40a beshort &0x0800 (unclean)
|
|
|
+>0x402 beldate-0x7C25B080 x created: %s,
|
|
|
+>0x406 beldate-0x7C25B080 x last modified: %s,
|
|
|
+>0x440 beldate-0x7C25B080 >0 last backup: %s,
|
|
|
+>0x414 belong x block size: %d,
|
|
|
+>0x412 beshort x number of blocks: %d,
|
|
|
+>0x424 pstring x volume name: %s
|
|
|
+#>0x480 beshort =0x482B Embedded HFS+ Volume:
|
|
|
+#>>((0x482*(0x414))+(0x41c*512)) x \b
|
|
|
+# Well, this is (theoretically) how we could do this. But it occurs to
|
|
|
+# me that we likely don't read in a large enough chunk. I don't have any
|
|
|
+# HFS+ volumes to see what a typical offset would be.
|
|
|
+
|
|
|
+0x400 beshort 0x482B Macintosh HFS Extended
|
|
|
+>&2 beshort x version %d data
|
|
|
+>0 beshort 0x4C4B (bootable)
|
|
|
+>&4 belong ^0x00000100 (mounted)
|
|
|
+>&4 belong &0x00000800 (unclean)
|
|
|
+>&4 belong &0x00008000 (locked)
|
|
|
+>&8 string x last mounted by: '%.4s',
|
|
|
+# really, that should be treated as a belong and we print a string
|
|
|
+# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
|
|
|
+>&16 beldate-0x7C25B080 x created: %s,
|
|
|
+>&20 beldate-0x7C25B080 x last modified: %s,
|
|
|
+>&24 beldate-0x7C25B080 >0 last backup: %s,
|
|
|
+>&28 beldate-0x7C25B080 >0 last checked: %s,
|
|
|
+>&40 belong x block size: %d,
|
|
|
+>&44 belong x number of blocks: %d,
|
|
|
+>&48 belong x free blocks: %d
|
|
|
+
|
|
|
+# I don't think this is really necessary since it doesn't do much and
|
|
|
+# anything with a valid driver descriptor will also have a valid
|
|
|
+# partition map
|
|
|
+#0 beshort 0x4552 Apple Device Driver data
|
|
|
+#>&24 beshort =1 \b, MacOS
|
|
|
+
|
|
|
+# Is that the partition type a cstring or a pstring? Well, IM says "strings
|
|
|
+# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
|
|
|
+# cstring. Of course, partitions can contain more than four entries, but
|
|
|
+# what're you gonna do?
|
|
|
+0x200 beshort 0x504D Apple Partition data
|
|
|
+>&2 beshort x block size: %d
|
|
|
+>&48 string x first type: %s,
|
|
|
+>&12 belong x number of blocks: %d,
|
|
|
+>(&0x2.S) beshort 0x504D
|
|
|
+>>&48 string x second type: %s
|
|
|
+>>&12 belong x number of blocks: %d,
|
|
|
+>>(&0x2.S) beshort 0x504D
|
|
|
+>>>&48 string x third type: %s
|
|
|
+>>>&12 belong x number of blocks: %d,
|
|
|
+>>>(&0x2.S) beshort 0x504D
|
|
|
+>>>>&48 string x fourth type: %s
|
|
|
+>>>>&12 belong x number of blocks: %d,
|
|
|
+# AFAIK, only the signature is different
|
|
|
+0x200 beshort 0x5453 Apple Old Partition data
|
|
|
+>&2 beshort x block size: %d
|
|
|
+>&48 string x first type: %s,
|
|
|
+>&12 belong x number of blocks: %d,
|
|
|
+>(&0x2.S) beshort 0x504D
|
|
|
+>>&48 string x second type: %s
|
|
|
+>>&12 belong x number of blocks: %d,
|
|
|
+>>(&0x2.S) beshort 0x504D
|
|
|
+>>>&48 string x third type: %s
|
|
|
+>>>&12 belong x number of blocks: %d,
|
|
|
+>>>(&0x2.S) beshort 0x504D
|
|
|
+>>>>&48 string x fourth type: %s
|
|
|
+>>>>&12 belong x number of blocks: %d,
|