filesystems 88 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326
  1. #------------------------------------------------------------------------------
  2. # $File: filesystems,v 1.85 2013/11/19 23:54:05 christos Exp $
  3. # filesystems: file(1) magic for different filesystems
  4. #
  5. 0 name partid
  6. >0 ubyte 0x00 Unused
  7. >0 ubyte 0x01 12-bit FAT
  8. >0 ubyte 0x02 XENIX /
  9. >0 ubyte 0x03 XENIX /usr
  10. >0 ubyte 0x04 16-bit FAT, less than 32M
  11. >0 ubyte 0x05 extended partition
  12. >0 ubyte 0x06 16-bit FAT, more than 32M
  13. >0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX
  14. >0 ubyte 0x08 AIX or os, or etc.
  15. >0 ubyte 0x09 AIX boot partition or Coherent
  16. >0 ubyte 0x0a O/2 boot manager or Coherent swap
  17. >0 ubyte 0x0b 32-bit FAT
  18. >0 ubyte 0x0c 32-bit FAT, LBA-mapped
  19. >0 ubyte 0x0d 7XXX, LBA-mapped
  20. >0 ubyte 0x0e 16-bit FAT, LBA-mapped
  21. >0 ubyte 0x0f extended partition, LBA-mapped
  22. >0 ubyte 0x10 OPUS
  23. >0 ubyte 0x11 OS/2 DOS 12-bit FAT
  24. >0 ubyte 0x12 Compaq diagnostics
  25. >0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M
  26. >0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M
  27. >0 ubyte 0x17 OS/2 hidden IFS
  28. >0 ubyte 0x18 AST Windows swapfile
  29. >0 ubyte 0x19 Willowtech Photon coS
  30. >0 ubyte 0x1b hidden win95 fat 32
  31. >0 ubyte 0x1c hidden win95 fat 32 lba
  32. >0 ubyte 0x1d hidden win95 fat 16 lba
  33. >0 ubyte 0x20 Willowsoft OFS1
  34. >0 ubyte 0x21 reserved
  35. >0 ubyte 0x23 reserved
  36. >0 ubyte 0x24 NEC DOS
  37. >0 ubyte 0x26 reserved
  38. >0 ubyte 0x31 reserved
  39. >0 ubyte 0x32 Alien Internet Services NOS
  40. >0 ubyte 0x33 reserved
  41. >0 ubyte 0x34 reserved
  42. >0 ubyte 0x35 JFS on OS2
  43. >0 ubyte 0x36 reserved
  44. >0 ubyte 0x38 Theos
  45. >0 ubyte 0x39 Plan 9, or Theos spanned
  46. >0 ubyte 0x3a Theos ver 4 4gb partition
  47. >0 ubyte 0x3b Theos ve 4 extended partition
  48. >0 ubyte 0x3c PartitionMagic recovery
  49. >0 ubyte 0x3d Hidden Netware
  50. >0 ubyte 0x40 VENIX 286 or LynxOS
  51. >0 ubyte 0x41 PReP
  52. >0 ubyte 0x42 linux swap sharing DRDOS disk
  53. >0 ubyte 0x43 linux sharing DRDOS disk
  54. >0 ubyte 0x44 GoBack change utility
  55. >0 ubyte 0x45 Boot US Boot manager
  56. >0 ubyte 0x46 EUMEL/Elan or Ergos 3
  57. >0 ubyte 0x47 EUMEL/Elan or Ergos 3
  58. >0 ubyte 0x48 EUMEL/Elan or Ergos 3
  59. >0 ubyte 0x4a ALFX/THIN filesystem for DOS
  60. >0 ubyte 0x4c Oberon partition
  61. >0 ubyte 0x4d QNX4.x
  62. >0 ubyte 0x4e QNX4.x 2nd part
  63. >0 ubyte 0x4f QNX4.x 3rd part
  64. >0 ubyte 0x50 DM (disk manager)
  65. >0 ubyte 0x51 DM6 Aux1 (or Novell)
  66. >0 ubyte 0x52 CP/M or Microport SysV/AT
  67. >0 ubyte 0x53 DM6 Aux3
  68. >0 ubyte 0x54 DM6 DDO
  69. >0 ubyte 0x55 EZ-Drive (disk manager)
  70. >0 ubyte 0x56 Golden Bow (disk manager)
  71. >0 ubyte 0x57 Drive PRO
  72. >0 ubyte 0x5c Priam Edisk (disk manager)
  73. >0 ubyte 0x61 SpeedStor
  74. >0 ubyte 0x63 GNU HURD or Mach or Sys V/386
  75. >0 ubyte 0x64 Novell Netware 2.xx or Speedstore
  76. >0 ubyte 0x65 Novell Netware 3.xx
  77. >0 ubyte 0x66 Novell 386 Netware
  78. >0 ubyte 0x67 Novell
  79. >0 ubyte 0x68 Novell
  80. >0 ubyte 0x69 Novell
  81. >0 ubyte 0x70 DiskSecure Multi-Boot
  82. >0 ubyte 0x71 reserved
  83. >0 ubyte 0x73 reserved
  84. >0 ubyte 0x74 reserved
  85. >0 ubyte 0x75 PC/IX
  86. >0 ubyte 0x76 reserved
  87. >0 ubyte 0x77 M2FS/M2CS partition
  88. >0 ubyte 0x78 XOSL boot loader filesystem
  89. >0 ubyte 0x80 MINIX until 1.4a
  90. >0 ubyte 0x81 MINIX since 1.4b
  91. >0 ubyte 0x82 Linux swap or Solaris
  92. >0 ubyte 0x83 Linux native
  93. >0 ubyte 0x84 OS/2 hidden C: drive
  94. >0 ubyte 0x85 Linux extended partition
  95. >0 ubyte 0x86 NT FAT volume set
  96. >0 ubyte 0x87 NTFS volume set or HPFS mirrored
  97. >0 ubyte 0x8a Linux Kernel AiR-BOOT partition
  98. >0 ubyte 0x8b Legacy Fault tolerant FAT32
  99. >0 ubyte 0x8c Legacy Fault tolerant FAT32 ext
  100. >0 ubyte 0x8d Hidden free FDISK FAT12
  101. >0 ubyte 0x8e Linux Logical Volume Manager
  102. >0 ubyte 0x90 Hidden free FDISK FAT16
  103. >0 ubyte 0x91 Hidden free FDISK DOS EXT
  104. >0 ubyte 0x92 Hidden free FDISK FAT16 Big
  105. >0 ubyte 0x93 Amoeba filesystem
  106. >0 ubyte 0x94 Amoeba bad block table
  107. >0 ubyte 0x95 MIT EXOPC native partitions
  108. >0 ubyte 0x97 Hidden free FDISK FAT32
  109. >0 ubyte 0x98 Datalight ROM-DOS Super-Boot
  110. >0 ubyte 0x99 Mylex EISA SCSI
  111. >0 ubyte 0x9a Hidden free FDISK FAT16 LBA
  112. >0 ubyte 0x9b Hidden free FDISK EXT LBA
  113. >0 ubyte 0x9f BSDI?
  114. >0 ubyte 0xa0 IBM Thinkpad hibernation
  115. >0 ubyte 0xa1 HP Volume expansion (SpeedStor)
  116. >0 ubyte 0xa3 HP Volume expansion (SpeedStor)
  117. >0 ubyte 0xa4 HP Volume expansion (SpeedStor)
  118. >0 ubyte 0xa5 386BSD partition type
  119. >0 ubyte 0xa6 OpenBSD partition type
  120. >0 ubyte 0xa7 NeXTSTEP 486
  121. >0 ubyte 0xa8 Apple UFS
  122. >0 ubyte 0xa9 NetBSD partition type
  123. >0 ubyte 0xaa Olivetty Fat12 1.44MB Service part
  124. >0 ubyte 0xab Apple Boot
  125. >0 ubyte 0xae SHAG OS filesystem
  126. >0 ubyte 0xaf Apple HFS
  127. >0 ubyte 0xb0 BootStar Dummy
  128. >0 ubyte 0xb1 reserved
  129. >0 ubyte 0xb3 reserved
  130. >0 ubyte 0xb4 reserved
  131. >0 ubyte 0xb6 reserved
  132. >0 ubyte 0xb7 BSDI BSD/386 filesystem
  133. >0 ubyte 0xb8 BSDI BSD/386 swap
  134. >0 ubyte 0xbb Boot Wizard Hidden
  135. >0 ubyte 0xbe Solaris 8 partition type
  136. >0 ubyte 0xbf Solaris partition type
  137. >0 ubyte 0xc0 CTOS
  138. >0 ubyte 0xc1 DRDOS/sec (FAT-12)
  139. >0 ubyte 0xc2 Hidden Linux
  140. >0 ubyte 0xc3 Hidden Linux swap
  141. >0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M)
  142. >0 ubyte 0xc5 DRDOS/sec (EXT)
  143. >0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M)
  144. >0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled
  145. >0 ubyte 0xc8 Reserved for DR-DOS 8.0+
  146. >0 ubyte 0xc9 Reserved for DR-DOS 8.0+
  147. >0 ubyte 0xca Reserved for DR-DOS 8.0+
  148. >0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS
  149. >0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA
  150. >0 ubyte 0xcd CTOS Memdump
  151. >0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA
  152. >0 ubyte 0xcf DR-DOS 7.04+ EXT LBA
  153. >0 ubyte 0xd0 REAL/32 secure big partition
  154. >0 ubyte 0xd1 Old Multiuser DOS FAT12
  155. >0 ubyte 0xd4 Old Multiuser DOS FAT16 Small
  156. >0 ubyte 0xd5 Old Multiuser DOS Extended
  157. >0 ubyte 0xd6 Old Multiuser DOS FAT16 Big
  158. >0 ubyte 0xd8 CP/M 86
  159. >0 ubyte 0xdb CP/M or Concurrent CP/M
  160. >0 ubyte 0xdd Hidden CTOS Memdump
  161. >0 ubyte 0xde Dell PowerEdge Server utilities
  162. >0 ubyte 0xdf DG/UX virtual disk manager
  163. >0 ubyte 0xe0 STMicroelectronics ST AVFS
  164. >0 ubyte 0xe1 DOS access or SpeedStor 12-bit
  165. >0 ubyte 0xe3 DOS R/O or Storage Dimensions
  166. >0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl.
  167. >0 ubyte 0xe5 reserved
  168. >0 ubyte 0xe6 reserved
  169. >0 ubyte 0xeb BeOS
  170. >0 ubyte 0xee GPT Protective MBR
  171. >0 ubyte 0xef EFI system partition
  172. >0 ubyte 0xf0 Linux PA-RISC boot loader
  173. >0 ubyte 0xf1 SpeedStor or Storage Dimensions
  174. >0 ubyte 0xf2 DOS 3.3+ Secondary
  175. >0 ubyte 0xf3 reserved
  176. >0 ubyte 0xf4 SpeedStor large partition
  177. >0 ubyte 0xf5 Prologue multi-volumen partition
  178. >0 ubyte 0xf6 reserved
  179. >0 ubyte 0xf9 pCache: ext2/ext3 persistent cache
  180. >0 ubyte 0xfa Bochs x86 emulator
  181. >0 ubyte 0xfb VMware File System
  182. >0 ubyte 0xfc VMware Swap
  183. >0 ubyte 0xfd Linux RAID partition persistent sb
  184. >0 ubyte 0xfe LANstep or IBM PS/2 IML
  185. >0 ubyte 0xff Xenix Bad Block Table
  186. 0 string \366\366\366\366 PC formatted floppy with no filesystem
  187. # Sun disk labels
  188. # From /usr/include/sun/dklabel.h:
  189. 0774 beshort 0xdabe
  190. # modified by Joerg Jenderek, because original test
  191. # succeeds for Cabinet archive dao360.dl_ with negative blocks
  192. >0770 long >0 Sun disk label
  193. >>0 string x '%s
  194. >>>31 string >\0 \b%s
  195. >>>>63 string >\0 \b%s
  196. >>>>>95 string >\0 \b%s
  197. >>0 string x \b'
  198. >>0734 short >0 %d rpm,
  199. >>0736 short >0 %d phys cys,
  200. >>0740 short >0 %d alts/cyl,
  201. >>0746 short >0 %d interleave,
  202. >>0750 short >0 %d data cyls,
  203. >>0752 short >0 %d alt cyls,
  204. >>0754 short >0 %d heads/partition,
  205. >>0756 short >0 %d sectors/track,
  206. >>0764 long >0 start cyl %ld,
  207. >>0770 long x %ld blocks
  208. # Is there a boot block written 1 sector in?
  209. >512 belong&077777777 0600407 \b, boot block present
  210. # Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
  211. # (http://btmgr.sourceforge.net/docs/user-guide-3.html)
  212. 0 string SBMBAKUP_ Smart Boot Manager backup file
  213. >9 string x \b, version %-5.5s
  214. >>14 string =_
  215. >>>15 string x %-.1s
  216. >>>>16 string =_ \b.
  217. >>>>>17 string x \b%-.1s
  218. >>>>>>18 string =_ \b.
  219. >>>>>>>19 string x \b%-.1s
  220. >>>22 ubyte 0
  221. >>>>21 ubyte x \b, from drive 0x%x
  222. >>>22 ubyte >0
  223. >>>>21 string x \b, from drive %s
  224. >>>535 search/17 \x55\xAA
  225. >>>>&-512 indirect x \b; contains
  226. # updated by Joerg Jenderek at Nov 2012
  227. # DOS Emulator image is 128 byte, null right padded header + harddisc image
  228. 0 string DOSEMU\0
  229. >0x27E leshort 0xAA55
  230. #offset is 128
  231. >>19 ubyte 128
  232. >>>(19.b-1) ubyte 0x0 DOS Emulator image
  233. >>>>7 ulelong >0 \b, %u heads
  234. >>>>11 ulelong >0 \b, %d sectors/track
  235. >>>>15 ulelong >0 \b, %d cylinders
  236. >>>>128 indirect x \b; contains
  237. # added by Joerg Jenderek at Nov 2012
  238. # http://www.thenakedpc.com/articles/v04/08/0408-05.html
  239. # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
  240. 0 string PNCIHISK\0 Norton Utilities disc image data
  241. # real x86 boot sector with jump instruction
  242. >509 search/1026 \x55\xAA\xeb
  243. >>&-1 indirect x \b; contains
  244. # http://file-extension.net/seeker/file_extension_dat
  245. 0 string PNCIUNDO Norton Disk Doctor UnDo file
  246. #
  247. # DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011
  248. # for any allowed sector sizes
  249. 30 search/481 \x55\xAA
  250. # to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
  251. # DOS BPB information (70) and after DOS floppy (120) like in previous file version
  252. !:strength +72
  253. # for sector sizes < 512 Bytes
  254. >11 uleshort <512
  255. >>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector
  256. # for sector sizes with 512 or more Bytes
  257. >0x1FE leshort 0xAA55 DOS/MBR boot sector
  258. # keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
  259. # only for sector sizes with 512 or more Bytes
  260. 0x1FE leshort 0xAA55 DOS/MBR boot sector
  261. !:strength +72
  262. # to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
  263. #!:strength +21
  264. >2 string OSBS \b, OS/BS MBR
  265. # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
  266. # and http://en.wikipedia.org/wiki/Master_Boot_Record
  267. # test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
  268. # characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
  269. >0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR
  270. # Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
  271. # assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
  272. >>8 ubequad 0x8bf45007501ffbfc
  273. # http://thestarman.pcministry.com/asm/mbr/200MBR.htm
  274. >>>0x16 ubyte 0xF3 \b,DOS 2
  275. >>>>219 regex Author\ -\ Author:
  276. # found "David Litton" , "A Pehrsson "
  277. >>>>>&0 string x "%s"
  278. >>>0x16 ubyte 0xF2
  279. # NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
  280. # assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
  281. >>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3
  282. # version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
  283. >>>>0x22 default x \b,D0S version 3.3-7.0
  284. # error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
  285. # where nn is string offset varying for different languages
  286. # "Invalid partition table" nn=0x8b for english version
  287. >>>>>(0x49.b) string Invalid\ partition\ table english
  288. >>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german
  289. >>>>>(0x49.b) string Table\ de\ partition\ invalide french
  290. >>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese
  291. >>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish
  292. >>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian
  293. >>>>>0x49 ubyte >0 at offset 0x%x
  294. >>>>>>(0x49.b) string >\0 "%s"
  295. # "Error loading operating system" nn=0xa3 for english version
  296. # "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version
  297. # "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version
  298. # "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version
  299. # "Error al cargar sistema operativo" nn=0xa8 for spanish version
  300. # "Errore durante il caricamento del sistema operativo" nn=0xae for italian version
  301. >>>>>0x74 ubyte >0 at offset 0x%x
  302. >>>>>>(0x74.b) string >\0 "%s"
  303. # "Missing operating system" nn=0xc2 for english version
  304. # "Betriebssystem fehlt" nn=0xcd for german version
  305. # "Syst\212me d'exploitation absent" nn=0xd2 for french version
  306. # "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version
  307. # "Falta sistema operativo" nn=0xca for spanish version
  308. # "Sistema operativo mancante" nn=0xe2 for italian version
  309. >>>>>0x79 ubyte >0 at offset 0x%x
  310. >>>>>>(0x79.b) string >\0 "%s"
  311. # Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
  312. # assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b
  313. >>8 ubequad 0x5007501ffcbe1b7c
  314. # assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
  315. >>>24 ubequad 0xf3a4cbbebe07b104 9M
  316. # "Invalid partition table" nn=0x10F for english version
  317. # "Ungültige Partitionstabelle" nn=0x10F for german version
  318. # "Table de partition erronée" nn=0x10F for french version
  319. # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version
  320. >>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english
  321. >>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german
  322. >>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french
  323. >>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian
  324. >>>>0x3C ubyte x at offset 0x%x+0xFF
  325. >>>>(0x3C.b+0x0FF) string >\0 "%s"
  326. # "Error loading operating system" nn=0x127 for english version
  327. # "Fehler beim Laden des Betriebssystems" nn=0x12b for german version
  328. # "Erreur lors du chargement du système d'exploitation" nn=0x12a for french version
  329. # "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version
  330. >>>>0xBD ubyte x at offset 0x1%x
  331. >>>>(0xBD.b+0x100) string >\0 "%s"
  332. # "Missing operating system" nn=0x146 for english version
  333. # "Betriebssystem fehlt" nn=0x151 for german version
  334. # "Système d'exploitation manquant" nn=0x15e for french version
  335. # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version
  336. >>>>0xA9 ubyte x at offset 0x1%x
  337. >>>>(0xA9.b+0x100) string >\0 "%s"
  338. # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
  339. # assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
  340. >>>24 ubequad 0xf3a4cbbdbe07b104 XP
  341. # where xxyyzz are lower bits from offsets of error messages varying for different languages
  342. >>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english
  343. >>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german
  344. # "Invalid partition table" xx=0x12C for english version
  345. # "Ungültige Partitionstabelle" xx=0x12C for german version
  346. >>>>0x1b5 ubyte >0 at offset 0x1%x
  347. >>>>(0x1b5.b+0x100) string >\0 "%s"
  348. # "Error loading operating system" yy=0x144 for english version
  349. # "Fehler beim Laden des Betriebssystems" yy=0x148 for german version
  350. >>>>0x1b6 ubyte >0 at offset 0x1%x
  351. >>>>(0x1b6.b+0x100) string >\0 "%s"
  352. # "Missing operating system" zz=0x163 for english version
  353. # "Betriebssystem nicht vorhanden" zz=0x16e for german version
  354. >>>>0x1b7 ubyte >0 at offset 0x1%x
  355. >>>>(0x1b7.b+0x100) string >\0 "%s"
  356. # Microsoft Windows Vista or 7
  357. # assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
  358. >>8 ubequad 0xc08ed8be007cbf00
  359. # Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
  360. # assembler instructions: jnz 0729;cmp ebx,"TCPA"
  361. >>>0xEC ubequad 0x753b6681fb544350 Vista
  362. # where xxyyzz are lower bits from offsets of error messages varying for different languages
  363. >>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english
  364. #>>>>0x1B4 ubelong&0x00FFFFFF ? german
  365. # "Invalid partition table" xx=0x162 for english version
  366. # "Ungültige Partitionstabelle" xx=0x1?? for german version
  367. >>>>0x1b5 ubyte >0 at offset 0x1%x
  368. >>>>(0x1b5.b+0x100) string >\0 "%s"
  369. # "Error loading operating system" yy=0x17a for english version
  370. # "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version
  371. >>>>0x1b6 ubyte >0 at offset 0x1%x
  372. >>>>(0x1b6.b+0x100) string >\0 "%s"
  373. # "Missing operating system" zz=0x199 for english version
  374. # "Betriebssystem nicht vorhanden" zz=0x1?? for german version
  375. >>>>0x1b7 ubyte >0 at offset 0x1%x
  376. >>>>(0x1b7.b+0x100) string >\0 "%s"
  377. # Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
  378. # assembler instructions: cmp ebx,"TCPA";cmp
  379. >>>0xEC ubequad 0x6681fb5443504175 Windows 7
  380. # where xxyyzz are lower bits from offsets of error messages varying for different languages
  381. >>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english
  382. #>>>>0x1B4 ubelong&0x00FFFFFF ? german
  383. # "Invalid partition table" xx=0x163 for english version
  384. # "Ungültige Partitionstabelle" xx=0x1?? for german version
  385. >>>>0x1b5 ubyte >0 at offset 0x1%x
  386. >>>>(0x1b5.b+0x100) string >\0 "%s"
  387. # "Error loading operating system" yy=0x17b for english version
  388. # "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version
  389. >>>>0x1b6 ubyte >0 at offset 0x1%x
  390. >>>>(0x1b6.b+0x100) string >\0 "%s"
  391. # "Missing operating system" zz=0x19a for english version
  392. # "Betriebssystem nicht vorhanden" zz=0x1?? for german version
  393. >>>>0x1b7 ubyte >0 at offset 0x1%x
  394. >>>>(0x1b7.b+0x100) string >\0 "%s"
  395. # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
  396. # http://en.wikipedia.org/wiki/MBR_disk_signature#ID
  397. >>0x1b8 ulelong >0 \b, disk signature 0x%-.4x
  398. # driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm
  399. >>0xDA uleshort 0
  400. >>>0xDC ulelong >0 \b, created
  401. # physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
  402. >>>>0xDC ubyte x with driveID 0x%x
  403. # hours, minutes and seconds
  404. >>>>0xDf ubyte x at %x
  405. >>>>0xDe ubyte x \b:%x
  406. >>>>0xDd ubyte x \b:%x
  407. # special case for Microsoft MS-DOS 3.21 spanish
  408. # assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
  409. >0 ubequad 0xfab830008ed0bc00
  410. # assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
  411. >>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish
  412. # Microsoft MBR IPL end
  413. # dr-dos with some upper-, lowercase variants
  414. >0x9D string Invalid\ partition\ table$
  415. >>181 string No\ Operating\ System$
  416. >>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
  417. >0x9D string Invalid\ partition\ table$
  418. >>181 string No\ operating\ system$
  419. >>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
  420. >342 string Invalid\ partition\ table$
  421. >>366 string No\ operating\ system$
  422. >>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
  423. >295 string NEWLDR\0
  424. >>302 string Bad\ PT\ $
  425. >>>310 string No\ OS\ $
  426. >>>>317 string OS\ load\ err$
  427. >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
  428. >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
  429. >>>>>>>387 string Copyright\ (c)\ 1984,1998
  430. >>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
  431. #
  432. # tests for different MS-DOS Master Boot Records (MBR) moved and merged
  433. #
  434. #>0x145 string Default:\ F \b, FREE-DOS MBR
  435. #>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR
  436. >0x145 search/7 Default:\ F \b, FREE-DOS MBR
  437. #>>313 string F0\ .\ .\ .
  438. #>>>322 string disk\ 1
  439. #>>>>382 string FAT3
  440. >64 string no\ active\ partition\ found
  441. >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
  442. # Ranish Partition Manager http://www.ranish.com/part/
  443. >387 search/4 \0\ Error!\r
  444. >>378 search/7 Virus!
  445. >>>397 search/4 Booting\
  446. >>>>408 search/4 HD1/\0 \b, Ranish MBR (
  447. >>>>>416 string Writing\ changes... \b2.37
  448. >>>>>>438 ubyte x \b,0x%x dots
  449. >>>>>>440 ubyte >0 \b,virus check
  450. >>>>>>441 ubyte >0 \b,partition %c
  451. #2.38,2.42,2.44
  452. >>>>>416 string !Writing\ changes... \b
  453. >>>>>>418 ubyte 1 \bvirus check,
  454. >>>>>>419 ubyte x \b0x%x seconds
  455. >>>>>>420 ubyte&0x0F >0 \b,partition
  456. >>>>>>>420 ubyte&0x0F <5 \b %x
  457. >>>>>>>420 ubyte&0x0F 0Xf \b ask
  458. >>>>>420 ubyte x \b)
  459. #
  460. # SYSLINUX MBR moved
  461. # http://www.acronis.de/
  462. >362 string MBR\ Error\ \0\r
  463. >>376 string ress\ any\ key\ to\
  464. >>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
  465. # added by Joerg Jenderek
  466. # http://www.visopsys.org/
  467. # http://partitionlogic.org.uk/
  468. >309 string No\ bootable\ partition\ found\r
  469. >>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
  470. >349 string No\ bootable\ partition\ found\r
  471. >>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
  472. # bootloader, bootmanager
  473. >0x40 string SBML
  474. # label with 11 characters of FAT 12 bit filesystem
  475. >>43 string SMART\ BTMGR
  476. >>>430 string SBMK\ Bad!\r \b, Smart Boot Manager
  477. # OEM-ID not always "SBM"
  478. #>>>>3 strings SBM
  479. >>>>6 string >\0 \b, version %s
  480. >382 string XOSLLOADXCF \b, eXtended Operating System Loader
  481. >6 string LILO \b, LInux i386 boot LOader
  482. >>120 string LILO \b, version 22.3.4 SuSe
  483. >>172 string LILO \b, version 22.5.8 Debian
  484. # updated by Joerg Jenderek at Oct 2008
  485. # variables according to grub-0.97/stage1/stage1.S or
  486. # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
  487. # usual values are marked with comments to get only informations of strange GRUB loaders
  488. >342 search/60 \0Geom\0
  489. #>0 ulelong x %x=0x009048EB , 0x2a9048EB 0
  490. >>0x41 ubyte <2
  491. >>>0x3E ubyte >2 \b; GRand Unified Bootloader
  492. # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
  493. >>>>0x3E ubyte x \b, stage1 version 0x%x
  494. #If it is 0xFF, use a drive passed by BIOS
  495. >>>>0x40 ubyte <0xFF \b, boot drive 0x%x
  496. # in most case 0,1,0x2e for GRUB 0.5.95
  497. >>>>0x41 ubyte >0 \b, LBA flag 0x%x
  498. >>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x
  499. #>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual)
  500. >>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x
  501. #>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default)
  502. >>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x
  503. >>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x
  504. #>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual)
  505. >>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x
  506. >>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
  507. >>>>>394 string stage1 \b, GRUB version 0.5.95
  508. >>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
  509. >>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94
  510. >>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
  511. >>>>>377 string GRUB\ \0 \b, GRUB version 0.94
  512. >>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0
  513. >>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
  514. >>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
  515. >>>>>385 string GRUB\ \0 \b, GRUB version 0.97
  516. #unkown version
  517. >>>343 string Geom\0Read\0\ Error\0
  518. >>>>321 string Loading\ stage1.5 \b, GRUB version x.y
  519. >>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
  520. >>>>374 string GRUB\ \0 \b, GRUB version n.m
  521. # SYSLINUX bootloader moved
  522. >395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
  523. # http://www.bcdwb.de/bcdw/index_e.htm
  524. >3 string BCDL
  525. >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
  526. # mbr partition table entries updated by Joerg Jenderek at Sep 2013
  527. # skip Norton Utilities disc image data
  528. >3 string !IHISK
  529. # skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
  530. >>0 belong !0xb8c0078e
  531. # not Linux kernel
  532. >>>514 string !HdrS
  533. # not BeOS
  534. >>>>422 string !Be\ Boot\ Loader
  535. # jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
  536. >>>>>0 ubelong&0xFD000000 =0xE9000000
  537. # AdvanceMAME mbr
  538. >>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e
  539. >>>>>>>446 use partition-table
  540. # mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
  541. >>>>>0 ubelong&0xFD000000 !0xE9000000
  542. # skip FSInfosector
  543. >>>>>>0 string !RRaA
  544. # skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
  545. # http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
  546. >>>>>>>0 ubequad !0xfa660fb64610668b
  547. # skip 13rd sector of MS x86 bootloader
  548. >>>>>>>>0 ubequad !0x660fb64610668b4e
  549. # skip sector starting with DOS new line
  550. >>>>>>>>>0 string !\r\n
  551. # allowed active flag 0,80h-FFh
  552. >>>>>>>>>>446 ubyte 0
  553. >>>>>>>>>>>446 use partition-table
  554. >>>>>>>>>>446 ubyte >0x7F
  555. >>>>>>>>>>>446 use partition-table
  556. # TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
  557. # mbr partition table entries end
  558. # http://www.acronis.de/
  559. #FAT label=ACRONIS\ SZ
  560. #OEM-ID=BOOTWIZ0
  561. >442 string Non-system\ disk,\
  562. >>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
  563. # updated by Joerg Jenderek at Nov 2012
  564. # DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
  565. >>>477 ubyte&0xDF >0
  566. >>>>477 string x \b %-.3s
  567. >>>>>480 ubyte&0xDF >0
  568. >>>>>>480 string x \b%-.4s
  569. >>>>>>>484 ubyte&0xDF >0
  570. >>>>>>>>484 string x \b%-.1s
  571. >>>>485 ubyte&0xDF >0
  572. >>>>>485 string x \b.%-.3s
  573. #
  574. >185 string FDBOOT\ Version\
  575. >>204 string \rNo\ Systemdisk.\
  576. >>>220 string Booting\ from\ harddisk.\n\r
  577. >>>245 string Cannot\ load\ from\ harddisk.\n\r
  578. >>>>273 string Insert\ Systemdisk\
  579. >>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
  580. >>>>>>200 string >\0 \b, version %-3s
  581. >242 string Bootsector\ from\ C.H.\ Hochst\204
  582. # http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c
  583. # updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
  584. # skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
  585. >242 search/127 Bootsector\ from\ C.H.\ Hochst
  586. >>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk
  587. # followed by variants with point,CR-NL or NL-CR
  588. >>>208 search/261 Cannot\ load\ from\ harddisk.
  589. # followed by variants CR-NL or NL-CR
  590. >>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key.
  591. # followed by variants with point,CR-NL or NL-CR
  592. >>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader
  593. # followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
  594. >>>>>>&0 string x \b, version %-4.4s
  595. >(1.b+2) ubyte 0xe
  596. >>(1.b+3) ubyte 0x1f
  597. >>>(1.b+4) ubyte 0xbe
  598. # message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
  599. >>>>(1.b+5) ubyte&0xd3 0x53
  600. >>>>>(1.b+6) ubyte 0x7c
  601. # assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
  602. >>>>>>(1.b+7) ubyte 0xac
  603. >>>>>>>(1.b+8) ubyte 0x22
  604. >>>>>>>>(1.b+9) ubyte 0xc0
  605. >>>>>>>>>(1.b+10) ubyte 0x74
  606. >>>>>>>>>>(1.b+11) ubyte 0x0b
  607. >>>>>>>>>>>(1.b+12) ubyte 0x56
  608. >>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
  609. # FAT1X version
  610. >>>>>>>>>>>>>(1.b+5) ubyte 0x5b
  611. >>>>>>>>>>>>>>0x5b string >\0 "%-s"
  612. # FAT32 version
  613. >>>>>>>>>>>>>(1.b+5) ubyte 0x77
  614. >>>>>>>>>>>>>>0x77 string >\0 "%-s"
  615. >214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display
  616. #>>244 string from\ dosemu-freedos-*-bin.tgz\r
  617. #>>>170 string Sorry,\ could\ not\ load\ an\
  618. #>>>>195 string operating\ system.\r\n
  619. #
  620. >103 string This\ is\ not\ a\ bootable\ disk.\
  621. >>132 string Please\ insert\ a\ bootable\
  622. >>>157 string floppy\ and\r\n
  623. >>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
  624. #
  625. >66 string Solaris\ Boot\ Sector
  626. >>99 string Incomplete\ MDBoot\ load.
  627. >>>89 string Version \b, Sun Solaris Bootloader
  628. >>>>97 byte x version %c
  629. #
  630. >408 string OS/2\ !!\ SYS01475\r\0
  631. >>429 string OS/2\ !!\ SYS02025\r\0
  632. >>>450 string OS/2\ !!\ SYS02027\r\0
  633. >>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
  634. #
  635. >409 string OS/2\ !!\ SYS01475\r\0
  636. >>430 string OS/2\ !!\ SYS02025\r\0
  637. >>>451 string OS/2\ !!\ SYS02027\r\0
  638. >>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
  639. >112 string This\ disk\ is\ not\ bootable\r
  640. >>142 string If\ you\ wish\ to\ make\ it\ bootable
  641. >>>176 string run\ the\ DOS\ program\ SYS\
  642. >>>200 string after\ the\r
  643. >>>>216 string system\ has\ been\ loaded\r\n
  644. >>>>>242 string Please\ insert\ a\ DOS\ diskette\
  645. >>>>>271 string into\r\n\ the\ drive\ and\
  646. >>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
  647. # XP
  648. >430 string NTLDR\ is\ missing\xFF\r\n
  649. >>449 string Disk\ error\xFF\r\n
  650. >>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
  651. # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
  652. >>>>417 ubyte&0xDF >0
  653. >>>>>417 string x %-.5s
  654. >>>>>>422 ubyte&0xDF >0
  655. >>>>>>>422 string x \b%-.3s
  656. >>>>>425 ubyte&0xDF >0
  657. >>>>>>425 string >\ \b.%-.3s
  658. #
  659. >>>>371 ubyte >0x20
  660. >>>>>368 ubyte&0xDF >0
  661. >>>>>>368 string x %-.5s
  662. >>>>>>>373 ubyte&0xDF >0
  663. >>>>>>>>373 string x \b%-.3s
  664. >>>>>>376 ubyte&0xDF >0
  665. >>>>>>>376 string x \b.%-.3s
  666. #
  667. >430 string NTLDR\ nicht\ gefunden\xFF\r\n
  668. >>453 string Datentr\204gerfehler\xFF\r\n
  669. >>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
  670. >>>>417 ubyte&0xDF >0
  671. >>>>>417 string x %-.5s
  672. >>>>>>422 ubyte&0xDF >0
  673. >>>>>>>422 string x \b%-.3s
  674. >>>>>425 ubyte&0xDF >0
  675. >>>>>>425 string >\ \b.%-.3s
  676. # offset variant
  677. >>>>379 string \0
  678. >>>>>368 ubyte&0xDF >0
  679. >>>>>>368 string x %-.5s
  680. >>>>>>>373 ubyte&0xDF >0
  681. >>>>>>>>373 string x \b%-.3s
  682. #
  683. >430 string NTLDR\ fehlt\xFF\r\n
  684. >>444 string Datentr\204gerfehler\xFF\r\n
  685. >>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
  686. >>>>417 ubyte&0xDF >0
  687. >>>>>417 string x %-.5s
  688. >>>>>>422 ubyte&0xDF >0
  689. >>>>>>>422 string x \b%-.3s
  690. >>>>>425 ubyte&0xDF >0
  691. >>>>>>425 string >\ \b.%-.3s
  692. # variant
  693. >>>>371 ubyte >0x20
  694. >>>>>368 ubyte&0xDF >0
  695. >>>>>>368 string x %-.5s
  696. >>>>>>>373 ubyte&0xDF >0
  697. >>>>>>>>373 string x \b%-.3s
  698. >>>>>>376 ubyte&0xDF >0
  699. >>>>>>>376 string x \b.%-.3s
  700. #
  701. >430 string NTLDR\ fehlt\xFF\r\n
  702. >>444 string Medienfehler\xFF\r\n
  703. >>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
  704. >>>>371 ubyte >0x20
  705. >>>>>368 ubyte&0xDF >0
  706. >>>>>>368 string x %-.5s
  707. >>>>>>>373 ubyte&0xDF >0
  708. >>>>>>>>373 string x \b%-.3s
  709. >>>>>>376 ubyte&0xDF >0
  710. >>>>>>>376 string x \b.%-.3s
  711. # variant
  712. >>>>417 ubyte&0xDF >0
  713. >>>>>417 string x %-.5s
  714. >>>>>>422 ubyte&0xDF >0
  715. >>>>>>>422 string x \b%-.3s
  716. >>>>>425 ubyte&0xDF >0
  717. >>>>>>425 string >\ \b.%-.3s
  718. #
  719. >430 string Datentr\204ger\ entfernen\xFF\r\n
  720. >>454 string Medienfehler\xFF\r\n
  721. >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
  722. >>>>379 string \0
  723. >>>>>368 ubyte&0xDF >0
  724. >>>>>>368 string x %-.5s
  725. >>>>>>>373 ubyte&0xDF >0
  726. >>>>>>>>373 string x \b%-.3s
  727. >>>>>>376 ubyte&0xDF >0
  728. >>>>>>>376 string x \b.%-.3s
  729. # variant
  730. >>>>417 ubyte&0xDF >0
  731. >>>>>417 string x %-.5s
  732. >>>>>>422 ubyte&0xDF >0
  733. >>>>>>>422 string x \b%-.3s
  734. >>>>>425 ubyte&0xDF >0
  735. >>>>>>425 string >\ \b.%-.3s
  736. #
  737. #>3 string NTFS\ \ \ \
  738. >389 string Fehler\ beim\ Lesen\
  739. >>407 string des\ Datentr\204gers
  740. >>>426 string NTLDR\ fehlt
  741. >>>>440 string NTLDR\ ist\ komprimiert
  742. >>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
  743. #>3 string NTFS\ \ \ \
  744. >313 string A\ disk\ read\ error\ occurred.\r
  745. >>345 string A\ kernel\ file\ is\ missing\
  746. >>>370 string from\ the\ disk.\r
  747. >>>>484 string NTLDR\ is\ compressed
  748. >>>>>429 string Insert\ a\ system\ diskette\
  749. >>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
  750. # DOS loader variants different languages,offsets
  751. >472 ubyte&0xDF >0
  752. >>389 string Invalid\ system\ disk\xFF\r\n
  753. >>>411 string Disk\ I/O\ error
  754. >>>>428 string Replace\ the\ disk,\ and\
  755. >>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
  756. #IO.SYS
  757. >>>>>>472 ubyte&0xDF >0
  758. >>>>>>>472 string x \b %-.2s
  759. >>>>>>>>474 ubyte&0xDF >0
  760. >>>>>>>>>474 string x \b%-.5s
  761. >>>>>>>>>>479 ubyte&0xDF >0
  762. >>>>>>>>>>>479 string x \b%-.1s
  763. >>>>>>>480 ubyte&0xDF >0
  764. >>>>>>>>480 string x \b.%-.3s
  765. #MSDOS.SYS
  766. >>>>>>>483 ubyte&0xDF >0 \b+
  767. >>>>>>>>483 string x \b%-.5s
  768. >>>>>>>>>488 ubyte&0xDF >0
  769. >>>>>>>>>>488 string x \b%-.3s
  770. >>>>>>>>491 ubyte&0xDF >0
  771. >>>>>>>>>491 string x \b.%-.3s
  772. #
  773. >>390 string Invalid\ system\ disk\xFF\r\n
  774. >>>412 string Disk\ I/O\ error\xFF\r\n
  775. >>>>429 string Replace\ the\ disk,\ and\
  776. >>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
  777. >>388 string Ungueltiges\ System\ \xFF\r\n
  778. >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
  779. >>>>427 string Datentraeger\ wechseln\ und\
  780. >>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
  781. #WINBOOT.SYS only not spaces (0xDF)
  782. >>>>>>497 ubyte&0xDF >0
  783. >>>>>>>497 string x %-.5s
  784. >>>>>>>>502 ubyte&0xDF >0
  785. >>>>>>>>>502 string x \b%-.1s
  786. >>>>>>>>>>503 ubyte&0xDF >0
  787. >>>>>>>>>>>503 string x \b%-.1s
  788. >>>>>>>>>>>>504 ubyte&0xDF >0
  789. >>>>>>>>>>>>>504 string x \b%-.1s
  790. >>>>>>505 ubyte&0xDF >0
  791. >>>>>>>505 string x \b.%-.3s
  792. #IO.SYS
  793. >>>>>>472 ubyte&0xDF >0 or
  794. >>>>>>>472 string x \b %-.2s
  795. >>>>>>>>474 ubyte&0xDF >0
  796. >>>>>>>>>474 string x \b%-.5s
  797. >>>>>>>>>>479 ubyte&0xDF >0
  798. >>>>>>>>>>>479 string x \b%-.1s
  799. >>>>>>>480 ubyte&0xDF >0
  800. >>>>>>>>480 string x \b.%-.3s
  801. #MSDOS.SYS
  802. >>>>>>>483 ubyte&0xDF >0 \b+
  803. >>>>>>>>483 string x \b%-.5s
  804. >>>>>>>>>488 ubyte&0xDF >0
  805. >>>>>>>>>>488 string x \b%-.3s
  806. >>>>>>>>491 ubyte&0xDF >0
  807. >>>>>>>>>491 string x \b.%-.3s
  808. #
  809. >>390 string Ungueltiges\ System\ \xFF\r\n
  810. >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
  811. >>>>429 string Datentraeger\ wechseln\ und\
  812. >>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
  813. #WINBOOT.SYS only not spaces (0xDF)
  814. >>>>>>497 ubyte&0xDF >0
  815. >>>>>>>497 string x %-.7s
  816. >>>>>>>>504 ubyte&0xDF >0
  817. >>>>>>>>>504 string x \b%-.1s
  818. >>>>>>505 ubyte&0xDF >0
  819. >>>>>>>505 string x \b.%-.3s
  820. #IO.SYS
  821. >>>>>>472 ubyte&0xDF >0 or
  822. >>>>>>>472 string x \b %-.2s
  823. >>>>>>>>474 ubyte&0xDF >0
  824. >>>>>>>>>474 string x \b%-.6s
  825. >>>>>>>480 ubyte&0xDF >0
  826. >>>>>>>>480 string x \b.%-.3s
  827. #MSDOS.SYS
  828. >>>>>>>483 ubyte&0xDF >0 \b+
  829. >>>>>>>>483 string x \b%-.5s
  830. >>>>>>>>>488 ubyte&0xDF >0
  831. >>>>>>>>>>488 string x \b%-.3s
  832. >>>>>>>>491 ubyte&0xDF >0
  833. >>>>>>>>>491 string x \b.%-.3s
  834. #
  835. >>389 string Ungueltiges\ System\ \xFF\r\n
  836. >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
  837. >>>>428 string Datentraeger\ wechseln\ und\
  838. >>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
  839. # DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
  840. >>>>>>472 string x %-.2s
  841. >>>>>>>474 ubyte&0xDF >0
  842. >>>>>>>>474 string x \b%-.5s
  843. >>>>>>>>479 ubyte&0xDF >0
  844. >>>>>>>>>479 string x \b%-.1s
  845. >>>>>>480 ubyte&0xDF >0
  846. >>>>>>>480 string x \b.%-.3s
  847. >>>>>>483 ubyte&0xDF >0 \b+
  848. >>>>>>>483 string x \b%-.5s
  849. >>>>>>>488 ubyte&0xDF >0
  850. >>>>>>>>488 string x \b%-.2s
  851. >>>>>>>>490 ubyte&0xDF >0
  852. >>>>>>>>>490 string x \b%-.1s
  853. >>>>>>>491 ubyte&0xDF >0
  854. >>>>>>>>491 string x \b.%-.3s
  855. >479 ubyte&0xDF >0
  856. >>416 string Kein\ System\ oder\
  857. >>>433 string Laufwerksfehler
  858. >>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
  859. #IO.SYS
  860. >>>>>479 string x \b %-.2s
  861. >>>>>>481 ubyte&0xDF >0
  862. >>>>>>>481 string x \b%-.6s
  863. >>>>>487 ubyte&0xDF >0
  864. >>>>>>487 string x \b.%-.3s
  865. #MSDOS.SYS
  866. >>>>>>490 ubyte&0xDF >0 \b+
  867. >>>>>>>490 string x \b%-.5s
  868. >>>>>>>>495 ubyte&0xDF >0
  869. >>>>>>>>>495 string x \b%-.3s
  870. >>>>>>>498 ubyte&0xDF >0
  871. >>>>>>>>498 string x \b.%-.3s
  872. #
  873. >376 search/41 Non-System\ disk\ or\
  874. >>395 search/41 disk\ error\r
  875. >>>407 search/41 Replace\ and\
  876. >>>>419 search/41 press\ \b,
  877. >>>>419 search/41 strike\ \b, old
  878. >>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader
  879. #449 Disk\ Boot\ failure\r MS 3.21
  880. #466 Boot\ Failure\r MS 3.30
  881. >>>>>468 search/18 \0
  882. #IO.SYS,IBMBIO.COM
  883. >>>>>>&0 string x \b %-.2s
  884. >>>>>>>&-20 ubyte&0xDF >0
  885. >>>>>>>>&-1 string x \b%-.4s
  886. >>>>>>>>>&-16 ubyte&0xDF >0
  887. >>>>>>>>>>&-1 string x \b%-.2s
  888. >>>>>>&8 ubyte&0xDF >0 \b.
  889. >>>>>>>&-1 string x \b%-.3s
  890. #MSDOS.SYS,IBMDOS.COM
  891. >>>>>>&11 ubyte&0xDF >0 \b+
  892. >>>>>>>&-1 string x \b%-.5s
  893. >>>>>>>>&-6 ubyte&0xDF >0
  894. >>>>>>>>>&-1 string x \b%-.1s
  895. >>>>>>>>>>&-5 ubyte&0xDF >0
  896. >>>>>>>>>>>&-1 string x \b%-.2s
  897. >>>>>>>&7 ubyte&0xDF >0 \b.
  898. >>>>>>>>&-1 string x \b%-.3s
  899. >441 string Cannot\ load\ from\ harddisk.\n\r
  900. >>469 string Insert\ Systemdisk\
  901. >>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader
  902. #>43 string \224R-LOADER\ \ SYS =label
  903. >54 string SYS
  904. >>324 string VASKK
  905. >>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
  906. #
  907. >98 string Press\ a\ key\ to\ retry\0\r
  908. >>120 string Cannot\ find\ file\ \0\r
  909. >>>139 string Disk\ read\ error\0\r
  910. >>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader
  911. #DRBIOS.SYS
  912. >>>>>44 ubyte&0xDF >0
  913. >>>>>>44 string x \b %-.6s
  914. >>>>>>>50 ubyte&0xDF >0
  915. >>>>>>>>50 string x \b%-.2s
  916. >>>>>>52 ubyte&0xDF >0
  917. >>>>>>>52 string x \b.%-.3s
  918. #
  919. >70 string IBMBIO\ \ COM
  920. >>472 string Cannot\ load\ DOS!\
  921. >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
  922. >>471 string Cannot\ load\ DOS\
  923. >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
  924. #??
  925. >444 string KERNEL\ \ SYS
  926. >>314 string BOOT\ error! \b, FREE-DOS Bootloader
  927. >499 string KERNEL\ \ SYS
  928. >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
  929. >449 string KERNEL\ \ SYS
  930. >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
  931. #
  932. >449 string Loading\ FreeDOS
  933. >>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader
  934. >>>497 ubyte&0xDF >0
  935. >>>>497 string x \b %-.6s
  936. >>>>>503 ubyte&0xDF >0
  937. >>>>>>503 string x \b%-.1s
  938. >>>>>>>504 ubyte&0xDF >0
  939. >>>>>>>>504 string x \b%-.1s
  940. >>>>505 ubyte&0xDF >0
  941. >>>>>505 string x \b.%-.3s
  942. #
  943. >331 string Error!.0 \b, FREE-DOS 1.0 bootloader
  944. #
  945. >125 string Loading\ FreeDOS...\r
  946. >>311 string BOOT\ error!\r \b, FREE-DOS bootloader
  947. >>>441 ubyte&0xDF >0
  948. >>>>441 string x \b %-.6s
  949. >>>>>447 ubyte&0xDF >0
  950. >>>>>>447 string x \b%-.1s
  951. >>>>>>>448 ubyte&0xDF >0
  952. >>>>>>>>448 string x \b%-.1s
  953. >>>>449 ubyte&0xDF >0
  954. >>>>>449 string x \b.%-.3s
  955. >124 string FreeDOS\0
  956. >>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
  957. # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
  958. >>>497 ubyte&0xDF >0
  959. >>>>497 string x \b %-.6s
  960. >>>>>503 ubyte&0xDF >0
  961. >>>>>>503 string x \b%-.1s
  962. >>>>>>>504 ubyte&0xDF >0
  963. >>>>>>>>504 string x \b%-.1s
  964. >>>>505 ubyte&0xDF >0
  965. >>>>>505 string x \b.%-.3s
  966. >>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
  967. >>>497 ubyte&0xDF >0
  968. >>>>497 string x \b %-.6s
  969. >>>>>503 ubyte&0xDF >0
  970. >>>>>>503 string x \b%-.1s
  971. >>>>>>>504 ubyte&0xDF >0
  972. >>>>>>>>504 string x \b%-.1s
  973. >>>>505 ubyte&0xDF >0
  974. >>>>>505 string x \b.%-.3s
  975. >>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
  976. >>>497 ubyte&0xDF >0
  977. >>>>497 string x \b %-.6s
  978. >>>>>503 ubyte&0xDF >0
  979. >>>>>>503 string x \b%-.1s
  980. >>>>>>>504 ubyte&0xDF >0
  981. >>>>>>>>504 string x \b%-.1s
  982. >>>>505 ubyte&0xDF >0
  983. >>>>>505 string x \b.%-.3s
  984. >336 string Error!\
  985. >>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
  986. >>>497 ubyte&0xDF >0
  987. >>>>497 string x \b %-.6s
  988. >>>>>503 ubyte&0xDF >0
  989. >>>>>>503 string x \b%-.1s
  990. >>>>>>>504 ubyte&0xDF >0
  991. >>>>>>>>504 string x \b%-.1s
  992. >>>>505 ubyte&0xDF >0
  993. >>>>>505 string x \b.%-.3s
  994. # added by Joerg Jenderek
  995. # http://www.visopsys.org/
  996. # http://partitionlogic.org.uk/
  997. # OEM-ID=Visopsys
  998. >478 ulelong 0
  999. >>(1.b+326) string I/O\ Error\ reading\
  1000. >>>(1.b+344) string Visopsys\ loader\r
  1001. >>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
  1002. # http://alexfru.chat.ru/epm.html#bootprog
  1003. >494 ubyte >0x4D
  1004. >>495 string >E
  1005. >>>495 string <S
  1006. #OEM-ID is not reliable
  1007. >>>>3 string BootProg
  1008. # It just looks for a program file name at the root directory
  1009. # and loads corresponding file with following execution.
  1010. # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
  1011. >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
  1012. >>>>>499 string x \b %-.1s
  1013. >>>>>>500 ubyte&0xDF >0
  1014. >>>>>>>500 string x \b%-.1s
  1015. >>>>>>>>501 ubyte&0xDF >0
  1016. >>>>>>>>>501 string x \b%-.1s
  1017. >>>>>>>>>>502 ubyte&0xDF >0
  1018. >>>>>>>>>>>502 string x \b%-.1s
  1019. >>>>>>>>>>>>503 ubyte&0xDF >0
  1020. >>>>>>>>>>>>>503 string x \b%-.1s
  1021. >>>>>>>>>>>>>>504 ubyte&0xDF >0
  1022. >>>>>>>>>>>>>>>504 string x \b%-.1s
  1023. >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
  1024. >>>>>>>>>>>>>>>>>505 string x \b%-.1s
  1025. >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
  1026. >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
  1027. #name extension
  1028. >>>>>507 ubyte&0xDF >0 \b.
  1029. >>>>>>507 string x \b%-.1s
  1030. >>>>>>>508 ubyte&0xDF >0
  1031. >>>>>>>>508 string x \b%-.1s
  1032. >>>>>>>>>509 ubyte&0xDF >0
  1033. >>>>>>>>>>509 string x \b%-.1s
  1034. #If the boot sector fails to read any other sector,
  1035. #it prints a very short message ("RE") to the screen and hangs the computer.
  1036. #If the boot sector fails to find needed program in the root directory,
  1037. #it also hangs with another message ("NF").
  1038. >>>>>492 string RENF \b, FAT (12 bit)
  1039. >>>>>495 string RENF \b, FAT (16 bit)
  1040. # http://alexfru.chat.ru/epm.html#bootprog
  1041. >494 ubyte >0x4D
  1042. >>495 string >E
  1043. >>>495 string <S
  1044. #OEM-ID is not reliable
  1045. >>>>3 string BootProg
  1046. # It just looks for a program file name at the root directory
  1047. # and loads corresponding file with following execution.
  1048. # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
  1049. >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
  1050. >>>>>499 string x \b %-.1s
  1051. >>>>>>500 ubyte&0xDF >0
  1052. >>>>>>>500 string x \b%-.1s
  1053. >>>>>>>>501 ubyte&0xDF >0
  1054. >>>>>>>>>501 string x \b%-.1s
  1055. >>>>>>>>>>502 ubyte&0xDF >0
  1056. >>>>>>>>>>>502 string x \b%-.1s
  1057. >>>>>>>>>>>>503 ubyte&0xDF >0
  1058. >>>>>>>>>>>>>503 string x \b%-.1s
  1059. >>>>>>>>>>>>>>504 ubyte&0xDF >0
  1060. >>>>>>>>>>>>>>>504 string x \b%-.1s
  1061. >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
  1062. >>>>>>>>>>>>>>>>>505 string x \b%-.1s
  1063. >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
  1064. >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
  1065. #name extension
  1066. >>>>>507 ubyte&0xDF >0 \b.
  1067. >>>>>>507 string x \b%-.1s
  1068. >>>>>>>508 ubyte&0xDF >0
  1069. >>>>>>>>508 string x \b%-.1s
  1070. >>>>>>>>>509 ubyte&0xDF >0
  1071. >>>>>>>>>>509 string x \b%-.1s
  1072. #If the boot sector fails to read any other sector,
  1073. #it prints a very short message ("RE") to the screen and hangs the computer.
  1074. #If the boot sector fails to find needed program in the root directory,
  1075. #it also hangs with another message ("NF").
  1076. >>>>>492 string RENF \b, FAT (12 bit)
  1077. >>>>>495 string RENF \b, FAT (16 bit)
  1078. # x86 bootloader end
  1079. # by Joerg Jenderek at Apr 2013
  1080. # Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
  1081. # like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
  1082. 0 name DOS-filename
  1083. # space=0x20 (00100000b) means empty
  1084. >0 ubyte&0xDF >0
  1085. >>0 ubyte x \b%c
  1086. >>>1 ubyte&0xDF >0
  1087. >>>>1 ubyte x \b%c
  1088. >>>>>2 ubyte&0xDF >0
  1089. >>>>>>2 ubyte x \b%c
  1090. >>>>>>>3 ubyte&0xDF >0
  1091. >>>>>>>>3 ubyte x \b%c
  1092. >>>>>>>>>4 ubyte&0xDF >0
  1093. >>>>>>>>>>4 ubyte x \b%c
  1094. >>>>>>>>>>>5 ubyte&0xDF >0
  1095. >>>>>>>>>>>>5 ubyte x \b%c
  1096. >>>>>>>>>>>>>6 ubyte&0xDF >0
  1097. >>>>>>>>>>>>>>6 ubyte x \b%c
  1098. >>>>>>>>>>>>>>>7 ubyte&0xDF >0
  1099. >>>>>>>>>>>>>>>>7 ubyte x \b%c
  1100. # DOS filename extension
  1101. >>8 ubyte&0xDF >0 \b.
  1102. >>>8 ubyte x \b%c
  1103. >>>>9 ubyte&0xDF >0
  1104. >>>>>9 ubyte x \b%c
  1105. >>>>>>10 ubyte&0xDF >0
  1106. >>>>>>>10 ubyte x \b%c
  1107. # Print 2 following DOS filenames from directory entry form
  1108. # like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
  1109. 0 name 2xDOS-filename
  1110. # display 1 space
  1111. >0 ubyte x \b
  1112. >0 use DOS-filename
  1113. >11 ubyte x \b+
  1114. >11 use DOS-filename
  1115. # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
  1116. # and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
  1117. >0 string RRaA
  1118. >>0x1E4 string rrAa \b, FSInfosector
  1119. #>>0x1FC uleshort =0 SHOULD BE ZERO
  1120. >>>0x1E8 ulelong <0xffffffff \b, %u free clusters
  1121. >>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u
  1122. # updated by Joerg Jenderek at Sep 2007
  1123. >3 ubyte 0
  1124. #no active flag
  1125. >>446 ubyte 0
  1126. # partition 1 not empty
  1127. >>>450 ubyte >0
  1128. # partitions 3,4 empty
  1129. >>>>482 ubyte 0
  1130. >>>>>498 ubyte 0
  1131. # partition 2 ID=0,5,15
  1132. >>>>>>466 ubyte <0x10
  1133. >>>>>>>466 ubyte 0x05 \b, extended partition table
  1134. >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
  1135. >>>>>>>466 ubyte 0x0 \b, extended partition table (last)
  1136. # DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
  1137. >0x200 lelong 0x82564557 \b, BSD disklabel
  1138. # http://en.wikipedia.org/wiki/Master_boot_record#PTE
  1139. # display standard partition table
  1140. 0 name partition-table
  1141. #>0 ubyte x PARTITION-TABLE
  1142. # test and display 1st til 4th partition table entry
  1143. >0 use partition-entry-test
  1144. >16 use partition-entry-test
  1145. >32 use partition-entry-test
  1146. >48 use partition-entry-test
  1147. # test for entry of partition table
  1148. 0 name partition-entry-test
  1149. # partition type ID > 0
  1150. >4 ubyte >0
  1151. # active flag 0
  1152. >>0 ubyte 0
  1153. >>>0 use partition-entry
  1154. # active flag 0x80, 0x81, ...
  1155. >>0 ubyte >0x7F
  1156. >>>0 use partition-entry
  1157. # Print entry of partition table
  1158. 0 name partition-entry
  1159. # partition type ID > 0
  1160. >4 ubyte >0 \b; partition
  1161. >>64 leshort 0xAA55 1
  1162. >>48 leshort 0xAA55 2
  1163. >>32 leshort 0xAA55 3
  1164. >>16 leshort 0xAA55 4
  1165. >>4 ubyte x : ID=0x%x
  1166. >>0 ubyte&0x80 0x80 \b, active
  1167. >>0 ubyte >0x80 0x%x
  1168. >>1 ubyte x \b, start-CHS (
  1169. >>1 use partition-chs
  1170. >>5 ubyte x \b), end-CHS (
  1171. >>5 use partition-chs
  1172. >>8 ulelong x \b), startsector %u
  1173. >>12 ulelong x \b, %u sectors
  1174. # Print cylinder,head,sector (CHS) of partition entry
  1175. 0 name partition-chs
  1176. # cylinder
  1177. >1 ubyte x \b0x
  1178. >1 ubyte&0xC0 0x40 \b1
  1179. >1 ubyte&0xC0 0x80 \b2
  1180. >1 ubyte&0xC0 0xC0 \b3
  1181. >2 ubyte x \b%x
  1182. # head
  1183. >0 ubyte x \b,%u
  1184. # sector
  1185. >1 ubyte&0x3F x \b,%u
  1186. # FATX
  1187. 0 string FATX FATX filesystem data
  1188. # romfs filesystems - Juan Cespedes <cespedes@debian.org>
  1189. 0 string -rom1fs- romfs filesystem, version 1
  1190. >8 belong x %d bytes,
  1191. >16 string x named %s.
  1192. # netboot image - Juan Cespedes <cespedes@debian.org>
  1193. 0 lelong 0x1b031336L Netboot image,
  1194. >4 lelong&0xFFFFFF00 0
  1195. >>4 lelong&0x100 0x000 mode 2
  1196. >>4 lelong&0x100 0x100 mode 3
  1197. >4 lelong&0xFFFFFF00 !0 unknown mode
  1198. 0x18b string OS/2 OS/2 Boot Manager
  1199. # updated by Joerg Jenderek at Oct 2008 and Sep 2012
  1200. # http://syslinux.zytor.com/iso.php
  1201. # tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
  1202. # assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
  1203. 0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
  1204. >631 search/689 ISOLINUX\ isolinux Loader
  1205. >>&0 string x (version %-4.4s)
  1206. # http://syslinux.zytor.com/pxe.php
  1207. # assembler instructions: jmp 7C05
  1208. 0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older)
  1209. # assembler instructions: pushfd;pushad
  1210. 0 ulelong 0x60669c66 pxelinux loader
  1211. # assembler instructions: jmp 05
  1212. 0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer)
  1213. # http://syslinux.zytor.com/wiki/index.php/SYSLINUX
  1214. 0 string LDLINUX\ SYS\ SYSLINUX loader
  1215. >12 string x (older version %-4.4s)
  1216. 0 string \r\nSYSLINUX\ SYSLINUX loader
  1217. >11 string x (version %-4.4s)
  1218. # syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
  1219. # assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
  1220. 0 ulelong&0x80909bEB 0x009018EB
  1221. # OEM-ID not always "SYSLINUX"
  1222. >434 search/47 Boot\ failed
  1223. # followed by \r\n\0 or :\
  1224. >>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older)
  1225. >>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9)
  1226. >459 search/30 Boot\ error\r\n\0
  1227. >>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer)
  1228. # SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
  1229. # assembler instructions: mov di,0600h;mov cx,0100h
  1230. 16 search/4 \xbf\x00\x06\xb9\x00\x01
  1231. # to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
  1232. !:strength +36
  1233. >94 search/249 Missing\ operating\ system
  1234. # followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
  1235. # skip Ranish MBR
  1236. >>408 search/4 HD1/\0
  1237. >>408 default x
  1238. >>>250 search/118 \0Operating\ system\ load SYSLINUX MBR
  1239. # followed by "ing " or space
  1240. >>>>292 search/98 error
  1241. >>>>>&0 string \r (version 3.35 or older)
  1242. >>>>>&0 string .\r (version 3.52 or newer)
  1243. >>>>>&0 default x (version 3.36-3.51 )
  1244. >368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR
  1245. >>156 search/10 \0Boot\ partition\ not\ found\r\n
  1246. >>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older)
  1247. >>174 search/10 \0Missing\ OS\r\n
  1248. >>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer)
  1249. # SYSLINUX END
  1250. # NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
  1251. # assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax,
  1252. 0 ubequad 0x31c08ed0bc007c8e
  1253. # mbr_bootsel magic before partition table not reliable with small ipl fragments
  1254. #>444 uleshort 0xb5e1
  1255. >0004 uleshort x
  1256. # ERRorTeXT
  1257. >>181 search/166 Error\ \0\r\n NetBSD mbr
  1258. # NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
  1259. >>>0x1B8 ubelong >0 \b,Serial 0x%-.8x
  1260. # BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
  1261. >>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector
  1262. # BOOT_EXTENDED definitions contains assembler instructions:
  1263. # xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
  1264. >>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended
  1265. # COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
  1266. >>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO
  1267. # not TERSE_ERROR
  1268. >>>196 search/106 No\ active\ partition\0
  1269. >>>>&0 string Disk\ read\ error\0
  1270. >>>>>&0 string No\ operating\ system\0 \b,verbose
  1271. # not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
  1272. >>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS
  1273. # not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13
  1274. >>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check
  1275. # assembler instructions: movw nametab,bx
  1276. >>>0x26 search/21 \xBB\x94\x07
  1277. # not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
  1278. >>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94
  1279. >>>>>181 search/166 Error\ \0
  1280. # "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
  1281. >>>>>>&3 string x \b,"%s"
  1282. # Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
  1283. # added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
  1284. # assembler instructions: jmp short 0x58;nop;ASCII
  1285. 0 ubequad&0xeb58908000000000 0xeb58900000000000
  1286. # assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
  1287. >(1.b+2) ubequad 0xfa31c08ed88ec08e
  1288. # Error messages at end of code
  1289. >>376 string No\ operating\ system\r\n\0
  1290. >>>398 string Disk\ error\r\n\0FDD\0HDD\0
  1291. >>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr
  1292. # Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
  1293. # added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
  1294. # for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
  1295. # or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
  1296. 0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC
  1297. # pointer to the data starting with Neil Turton signature string
  1298. >(0x1BC.s) string NDTmbr
  1299. >>&-14 string 1234F\0 Turton mbr (
  1300. # parameters also viewed by install-mbr --list
  1301. >>>(0x1BC.s+7) ubyte x \b%u<=
  1302. >>>(0x1BC.s+9) ubyte x \bVersion<=%u
  1303. #>>>(0x1BC.s+8) ubyte x asm_flag_%x
  1304. >>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix
  1305. # variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode
  1306. >>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk
  1307. #0x1~1,..,0x8~4,0x10~F,0x80~A enabled
  1308. #>>>(0x1BC.s+10) ubyte x \b,flags 0x%x
  1309. #0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
  1310. #>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x
  1311. # for older versions
  1312. >>>(0x1BC.s+9) ubyte <2
  1313. #>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds
  1314. >>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
  1315. # floppy A: or B:
  1316. >>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x
  1317. >>>>(0x1BC.s+13) ubyte >1
  1318. # 1st hard disc
  1319. #>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x
  1320. # not 1st hard disc
  1321. >>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x
  1322. # for version >= 2 maximal timeout can be 65534
  1323. >>>(0x1BC.s+9) ubyte >1
  1324. #>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds
  1325. >>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds
  1326. # floppy A: or B:
  1327. >>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x
  1328. >>>>(0x1BC.s+14) ubyte >1
  1329. # 1st hard disc
  1330. #>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x
  1331. # not 1st hard disc
  1332. >>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x
  1333. >>>0 ubyte x \b)
  1334. # added by Joerg Jenderek
  1335. # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
  1336. # grub-1.94/kern/i386/pc/startup.S
  1337. # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
  1338. # usual values are marked with comments to get only informations of strange GRUB loaders
  1339. 0x200 uleshort 0x70EA
  1340. # found only version 3.{1,2}
  1341. >0x206 ubeshort >0x0300
  1342. # GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
  1343. >>0x212 ubyte >0x29
  1344. >>>0x213 ubyte >0x29
  1345. # not iso9660_stage1_5
  1346. #>>>0 ulelong&0x00BE5652 0x00BE5652
  1347. >>>>0x213 ubyte >0x29 GRand Unified Bootloader
  1348. # config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
  1349. >>>>0x217 ubyte 0xFF stage1_5
  1350. >>>>0x217 ubyte <0xFF stage2
  1351. >>>>0x206 ubyte x \b version %u
  1352. >>>>0x207 ubyte x \b.%u
  1353. # module_size for 1.94
  1354. >>>>0x208 ulelong <0xffffff \b, installed partition %u
  1355. #>>>>0x208 ulelong =0xffffff \b, %u (default)
  1356. >>>>0x208 ulelong >0xffffff \b, installed partition %u
  1357. # GRUB 0.5.95 unofficial
  1358. >>>>0x20C ulelong&0x2E300000 0x2E300000
  1359. # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
  1360. >>>>>0x20C ubyte x \b, identifier 0x%x
  1361. #>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
  1362. >>>>>0x20D ubyte >0 \b, LBA flag 0x%x
  1363. # GRUB version as string
  1364. >>>>>0x20E string >\0 \b, GRUB version %-s
  1365. # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
  1366. >>>>>>0x215 ulong 0xffffffff
  1367. >>>>>>>0x219 string >\0 \b, configuration file %-s
  1368. >>>>>>0x215 ulong !0xffffffff
  1369. >>>>>>>0x215 string >\0 \b, configuration file %-s
  1370. # newer GRUB versions
  1371. >>>>0x20C ulelong&0x2E300000 !0x2E300000
  1372. ##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
  1373. >>>>>0x20C ulelong >0 \b, saved entry %d
  1374. # for 1.94 contains kernel image size
  1375. # for 0.93,0.94,0.96,0.97
  1376. # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
  1377. >>>>>0x210 ubyte x \b, identifier 0x%x
  1378. # The flag for LBA forcing is in most cases 0
  1379. #>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
  1380. >>>>>0x211 ubyte >0 \b, LBA flag 0x%x
  1381. # GRUB version as string
  1382. >>>>>0x212 string >\0 \b, GRUB version %-s
  1383. # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
  1384. >>>>>0x217 ulong 0xffffffff
  1385. >>>>>>0x21b string >\0 \b, configuration file %-s
  1386. >>>>>0x217 ulong !0xffffffff
  1387. >>>>>>0x217 string >\0 \b, configuration file %-s
  1388. # DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
  1389. # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
  1390. # over BIOS parameter block (BPB)
  1391. # http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
  1392. # older drives may use Near JuMP instruction E9 xx xx
  1393. # minimal short forward jump found 0x29 for bootloaders or 0x0
  1394. # maximal short forward jump is 0x7f
  1395. # OEM-ID is empty or contain readable bytes
  1396. 0 ulelong&0x804000E9 0x000000E9
  1397. # mtools-3.9.8/msdos.h
  1398. # usual values are marked with comments to get only informations of strange FAT systems
  1399. # valid sectorsize must be a power of 2 from 32 to 32768
  1400. >11 uleshort&0xf001f 0
  1401. >>11 uleshort <32769
  1402. >>>11 uleshort >31
  1403. >>>>21 ubyte&0xf0 0xF0
  1404. >>>>>0 ubyte 0xEB
  1405. >>>>>>1 ubyte x \b, code offset 0x%x+2
  1406. >>>>>0 ubyte 0xE9
  1407. >>>>>>1 uleshort x \b, code offset 0x%x+2
  1408. >>>>>3 string >\0 \b, OEM-ID "%-.8s"
  1409. #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
  1410. >>>>>>8 string IHC \b cached by Windows 9M
  1411. >>>>>11 uleshort >512 \b, Bytes/sector %u
  1412. #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
  1413. >>>>>11 uleshort <512 \b, Bytes/sector %u
  1414. >>>>>13 ubyte >1 \b, sectors/cluster %u
  1415. #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
  1416. >>>>>82 string FAT32
  1417. >>>>>>14 uleshort !32 \b, reserved sectors %u
  1418. #>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
  1419. >>>>>82 string !FAT32
  1420. >>>>>>14 uleshort >1 \b, reserved sectors %u
  1421. #>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
  1422. #>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS)
  1423. >>>>>16 ubyte >2 \b, FATs %u
  1424. #>>>>>16 ubyte =2 \b, FATs %u (usual)
  1425. >>>>>16 ubyte =1 \b, FAT %u
  1426. >>>>>16 ubyte >0
  1427. >>>>>17 uleshort >0 \b, root entries %u
  1428. #>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
  1429. >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
  1430. #>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
  1431. >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
  1432. #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
  1433. >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
  1434. >>>>>22 uleshort >0 \b, sectors/FAT %u
  1435. #>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
  1436. >>>>>24 uleshort x \b, sectors/track %u
  1437. >>>>>26 ubyte >2 \b, heads %u
  1438. #>>>>>26 ubyte =2 \b, heads %u (usual floppy)
  1439. >>>>>26 ubyte =1 \b, heads %u
  1440. # valid only for sector sizes with more then 32 Bytes
  1441. >>>>>11 uleshort >32
  1442. # skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
  1443. >>>>>>38 ubyte !0x70
  1444. >>>>>>>28 ulelong >0 \b, hidden sectors %u
  1445. #>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
  1446. >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
  1447. #>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
  1448. # FAT<32 bit specific
  1449. >>>>>>>82 string !FAT32
  1450. #>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
  1451. #>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
  1452. >>>>>>>>36 ubyte !0x80
  1453. >>>>>>>>>36 ubyte !0 \b, physical drive 0x%x
  1454. >>>>>>>>37 ubyte >0 \b, reserved 0x%x
  1455. #>>>>>>>>37 ubyte =0 \b, reserved 0x%x
  1456. # value is 0x80 for NTFS
  1457. >>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
  1458. >>>>>>>>38 ubyte =0x29
  1459. >>>>>>>>>39 ulelong x \b, serial number 0x%x
  1460. >>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
  1461. >>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
  1462. >>>>>>>>>43 string =NO\ NAME \b, unlabeled
  1463. # there exist some old floppies without word FAT at offset 54
  1464. # a word like "FATnm " is only a hint for a FAT size on nm-bits
  1465. # Normally the number of clusters is calculated by the values of BPP.
  1466. # if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
  1467. # otherwise FAT is 16 bit.
  1468. # http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
  1469. >>>>>>54 string FAT \b, FAT
  1470. >>>>>>>54 string FAT12 \b (12 bit)
  1471. >>>>>>>54 string FAT16 \b (16 bit)
  1472. # FAT32 bit specific
  1473. >>>>>82 string FAT32 \b, FAT (32 bit)
  1474. >>>>>>36 ulelong x \b, sectors/FAT %u
  1475. # http://technet.microsoft.com/en-us/library/cc977221.aspx
  1476. >>>>>>40 uleshort >0 \b, extension flags 0x%x
  1477. #>>>>>>40 uleshort =0 \b, extension flags %u
  1478. >>>>>>42 uleshort >0 \b, fsVersion %u
  1479. #>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
  1480. >>>>>>44 ulelong >2 \b, rootdir cluster %u
  1481. #>>>>>>44 ulelong =2 \b, rootdir cluster %u
  1482. #>>>>>>44 ulelong =1 \b, rootdir cluster %u
  1483. >>>>>>48 uleshort >1 \b, infoSector %u
  1484. #>>>>>>48 uleshort =1 \b, infoSector %u (usual)
  1485. >>>>>>48 uleshort <1 \b, infoSector %u
  1486. >>>>>>50 uleshort >6 \b, Backup boot sector %u
  1487. #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
  1488. >>>>>>50 uleshort <6 \b, Backup boot sector %u
  1489. # corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
  1490. >>>>>>52 ulelong >0 \b, reserved1 0x%x
  1491. >>>>>>56 ulelong >0 \b, reserved2 0x%x
  1492. >>>>>>60 ulelong >0 \b, reserved3 0x%x
  1493. # same structure as FAT1X
  1494. #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
  1495. #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
  1496. >>>>>>64 ubyte !0x80
  1497. >>>>>>>64 ubyte >0 \b, physical drive 0x%x
  1498. # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
  1499. >>>>>>65 ubyte >0 \b, reserved 0x%x
  1500. >>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
  1501. >>>>>>66 ubyte =0x29
  1502. >>>>>>>67 ulelong x \b, serial number 0x%x
  1503. >>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
  1504. >>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
  1505. >>>>>>>71 string =NO\ NAME \b, unlabeled
  1506. # additional tests for floppy image added by Joerg Jenderek
  1507. # no fixed disk
  1508. >>>>>21 ubyte !0xF8
  1509. # floppy media with 12 bit FAT
  1510. >>>>>>54 string !FAT16
  1511. # test for FAT after bootsector
  1512. >>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT
  1513. # floppy image
  1514. !:mime application/x-ima
  1515. # NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
  1516. # and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
  1517. # 0 FATs
  1518. >>>>>16 ubyte =0
  1519. # 0 root entries
  1520. >>>>>>17 uleshort =0
  1521. # 0 DOS sectors
  1522. >>>>>>>19 uleshort =0
  1523. # 0 sectors/FAT
  1524. # dos < 4.0 BootSector value found is 0x80
  1525. #38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x)
  1526. >>>>>>>>22 uleshort =0 \b; NTFS
  1527. >>>>>>>>>24 uleshort >0 \b, sectors/track %u
  1528. >>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x
  1529. >>>>>>>>>40 ulequad >0 \b, sectors %lld
  1530. >>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld
  1531. >>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld
  1532. # Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
  1533. # Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
  1534. >>>>>>>>>64 lelong <256
  1535. >>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d
  1536. >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi)
  1537. # Values 0 to 127 represent index block sizes of 0 to 127 clusters.
  1538. # Values 128 to 255 represent index block sizes of 2^(256-N) byte
  1539. >>>>>>>>>68 ulelong <256
  1540. >>>>>>>>>>68 ulelong <128 \b, clusters/index block %d
  1541. #>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d)
  1542. >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi)
  1543. >>>>>>>>>72 ulequad x \b, serial number 0%llx
  1544. >>>>>>>>>80 ulelong >0 \b, checksum 0x%x
  1545. #>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual)
  1546. >>>>>>>>>0x258 ulelong&0x00009090 =0x00009090
  1547. >>>>>>>>>>&-92 indirect x \b; contains
  1548. # For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
  1549. # http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
  1550. # unused assembler instructions JMP y2;NOP;NOP
  1551. 0x056 ulelong&0xFFFF0FFF 0x909002EB
  1552. # unicode loadername terminated by CTRL-D
  1553. >(0.s*2) ulelong&0xFFFFFF00 0x00040000
  1554. # loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
  1555. >>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s
  1556. >>0x12 string $
  1557. >>>0x0c lestring16 x \b%-2.2s
  1558. ### DOS,NTFS boot sectors end
  1559. 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
  1560. >8404 string x last mounted on %s,
  1561. #>9504 ledate x last checked at %s,
  1562. >8224 ledate x last written at %s,
  1563. >8401 byte x clean flag %d,
  1564. >8228 lelong x number of blocks %d,
  1565. >8232 lelong x number of data blocks %d,
  1566. >8236 lelong x number of cylinder groups %d,
  1567. >8240 lelong x block size %d,
  1568. >8244 lelong x fragment size %d,
  1569. >8252 lelong x minimum percentage of free blocks %d,
  1570. >8256 lelong x rotational delay %dms,
  1571. >8260 lelong x disk rotational speed %drps,
  1572. >8320 lelong 0 TIME optimization
  1573. >8320 lelong 1 SPACE optimization
  1574. 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  1575. >&-1164 string x last mounted on %s,
  1576. >&-696 string >\0 volume name %s,
  1577. >&-304 leqldate x last written at %s,
  1578. >&-1167 byte x clean flag %d,
  1579. >&-1168 byte x readonly flag %d,
  1580. >&-296 lequad x number of blocks %lld,
  1581. >&-288 lequad x number of data blocks %lld,
  1582. >&-1332 lelong x number of cylinder groups %d,
  1583. >&-1328 lelong x block size %d,
  1584. >&-1324 lelong x fragment size %d,
  1585. >&-180 lelong x average file size %d,
  1586. >&-176 lelong x average number of files in dir %d,
  1587. >&-272 lequad x pending blocks to free %lld,
  1588. >&-264 lelong x pending inodes to free %ld,
  1589. >&-664 lequad x system-wide uuid %0llx,
  1590. >&-1316 lelong x minimum percentage of free blocks %d,
  1591. >&-1248 lelong 0 TIME optimization
  1592. >&-1248 lelong 1 SPACE optimization
  1593. 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  1594. >&-1164 string x last mounted on %s,
  1595. >&-696 string >\0 volume name %s,
  1596. >&-304 leqldate x last written at %s,
  1597. >&-1167 byte x clean flag %d,
  1598. >&-1168 byte x readonly flag %d,
  1599. >&-296 lequad x number of blocks %lld,
  1600. >&-288 lequad x number of data blocks %lld,
  1601. >&-1332 lelong x number of cylinder groups %d,
  1602. >&-1328 lelong x block size %d,
  1603. >&-1324 lelong x fragment size %d,
  1604. >&-180 lelong x average file size %d,
  1605. >&-176 lelong x average number of files in dir %d,
  1606. >&-272 lequad x pending blocks to free %lld,
  1607. >&-264 lelong x pending inodes to free %ld,
  1608. >&-664 lequad x system-wide uuid %0llx,
  1609. >&-1316 lelong x minimum percentage of free blocks %d,
  1610. >&-1248 lelong 0 TIME optimization
  1611. >&-1248 lelong 1 SPACE optimization
  1612. 9564 belong 0x00011954 Unix Fast File system [v1] (big-endian),
  1613. >7168 belong 0x4c41424c Apple UFS Volume
  1614. >>7186 string x named %s,
  1615. >>7176 belong x volume label version %d,
  1616. >>7180 bedate x created on %s,
  1617. >8404 string x last mounted on %s,
  1618. #>9504 bedate x last checked at %s,
  1619. >8224 bedate x last written at %s,
  1620. >8401 byte x clean flag %d,
  1621. >8228 belong x number of blocks %d,
  1622. >8232 belong x number of data blocks %d,
  1623. >8236 belong x number of cylinder groups %d,
  1624. >8240 belong x block size %d,
  1625. >8244 belong x fragment size %d,
  1626. >8252 belong x minimum percentage of free blocks %d,
  1627. >8256 belong x rotational delay %dms,
  1628. >8260 belong x disk rotational speed %drps,
  1629. >8320 belong 0 TIME optimization
  1630. >8320 belong 1 SPACE optimization
  1631. 42332 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  1632. >&-1164 string x last mounted on %s,
  1633. >&-696 string >\0 volume name %s,
  1634. >&-304 beqldate x last written at %s,
  1635. >&-1167 byte x clean flag %d,
  1636. >&-1168 byte x readonly flag %d,
  1637. >&-296 bequad x number of blocks %lld,
  1638. >&-288 bequad x number of data blocks %lld,
  1639. >&-1332 belong x number of cylinder groups %d,
  1640. >&-1328 belong x block size %d,
  1641. >&-1324 belong x fragment size %d,
  1642. >&-180 belong x average file size %d,
  1643. >&-176 belong x average number of files in dir %d,
  1644. >&-272 bequad x pending blocks to free %lld,
  1645. >&-264 belong x pending inodes to free %ld,
  1646. >&-664 bequad x system-wide uuid %0llx,
  1647. >&-1316 belong x minimum percentage of free blocks %d,
  1648. >&-1248 belong 0 TIME optimization
  1649. >&-1248 belong 1 SPACE optimization
  1650. 66908 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  1651. >&-1164 string x last mounted on %s,
  1652. >&-696 string >\0 volume name %s,
  1653. >&-304 beqldate x last written at %s,
  1654. >&-1167 byte x clean flag %d,
  1655. >&-1168 byte x readonly flag %d,
  1656. >&-296 bequad x number of blocks %lld,
  1657. >&-288 bequad x number of data blocks %lld,
  1658. >&-1332 belong x number of cylinder groups %d,
  1659. >&-1328 belong x block size %d,
  1660. >&-1324 belong x fragment size %d,
  1661. >&-180 belong x average file size %d,
  1662. >&-176 belong x average number of files in dir %d,
  1663. >&-272 bequad x pending blocks to free %lld,
  1664. >&-264 belong x pending inodes to free %ld,
  1665. >&-664 bequad x system-wide uuid %0llx,
  1666. >&-1316 belong x minimum percentage of free blocks %d,
  1667. >&-1248 belong 0 TIME optimization
  1668. >&-1248 belong 1 SPACE optimization
  1669. # ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
  1670. # ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
  1671. # volume label and UUID Russell Coker
  1672. # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
  1673. 0x438 leshort 0xEF53 Linux
  1674. >0x44c lelong x rev %d
  1675. >0x43e leshort x \b.%d
  1676. # No journal? ext2
  1677. >0x45c lelong ^0x0000004 ext2 filesystem data
  1678. >>0x43a leshort ^0x0000001 (mounted or unclean)
  1679. # Has a journal? ext3 or ext4
  1680. >0x45c lelong &0x0000004
  1681. # and small INCOMPAT?
  1682. >>0x460 lelong <0x0000040
  1683. # and small RO_COMPAT?
  1684. >>>0x464 lelong <0x0000008 ext3 filesystem data
  1685. # else large RO_COMPAT?
  1686. >>>0x464 lelong >0x0000007 ext4 filesystem data
  1687. # else large INCOMPAT?
  1688. >>0x460 lelong >0x000003f ext4 filesystem data
  1689. >0x468 belong x \b, UUID=%08x
  1690. >0x46c beshort x \b-%04x
  1691. >0x46e beshort x \b-%04x
  1692. >0x470 beshort x \b-%04x
  1693. >0x472 belong x \b-%08x
  1694. >0x476 beshort x \b%04x
  1695. >0x478 string >0 \b, volume name "%s"
  1696. # General flags for any ext* fs
  1697. >0x460 lelong &0x0000004 (needs journal recovery)
  1698. >0x43a leshort &0x0000002 (errors)
  1699. # INCOMPAT flags
  1700. >0x460 lelong &0x0000001 (compressed)
  1701. #>0x460 lelong &0x0000002 (filetype)
  1702. #>0x460 lelong &0x0000010 (meta bg)
  1703. >0x460 lelong &0x0000040 (extents)
  1704. >0x460 lelong &0x0000080 (64bit)
  1705. #>0x460 lelong &0x0000100 (mmp)
  1706. #>0x460 lelong &0x0000200 (flex bg)
  1707. # RO_INCOMPAT flags
  1708. #>0x464 lelong &0x0000001 (sparse super)
  1709. >0x464 lelong &0x0000002 (large files)
  1710. >0x464 lelong &0x0000008 (huge files)
  1711. #>0x464 lelong &0x0000010 (gdt checksum)
  1712. #>0x464 lelong &0x0000020 (many subdirs)
  1713. #>0x463 lelong &0x0000040 (extra isize)
  1714. # Minix filesystems - Juan Cespedes <cespedes@debian.org>
  1715. 0x410 leshort 0x137f
  1716. !:strength / 2
  1717. >0x402 beshort < 100
  1718. >0x402 beshort > -1 Minix filesystem, V1, %d zones
  1719. >0x1e string minix \b, bootable
  1720. 0x410 beshort 0x137f
  1721. !:strength / 2
  1722. >0x402 beshort < 100
  1723. >0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones
  1724. >0x1e string minix \b, bootable
  1725. 0x410 leshort 0x138f
  1726. !:strength / 2
  1727. >0x402 beshort < 100
  1728. >0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones
  1729. >0x1e string minix \b, bootable
  1730. 0x410 beshort 0x138f
  1731. !:strength / 2
  1732. >0x402 beshort < 100
  1733. >0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones
  1734. >0x1e string minix \b, bootable
  1735. 0x410 leshort 0x2468
  1736. >0x402 beshort < 100
  1737. >>0x402 beshort > -1 Minix filesystem, V2, %d zones
  1738. >0x1e string minix \b, bootable
  1739. 0x410 beshort 0x2468
  1740. >0x402 beshort < 100
  1741. >0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones
  1742. >0x1e string minix \b, bootable
  1743. 0x410 leshort 0x2478
  1744. >0x402 beshort < 100
  1745. >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones
  1746. >0x1e string minix \b, bootable
  1747. 0x410 leshort 0x2478
  1748. >0x402 beshort < 100
  1749. >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones
  1750. >0x1e string minix \b, bootable
  1751. 0x410 beshort 0x2478
  1752. >0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones
  1753. >0x1e string minix \b, bootable
  1754. 0x410 leshort 0x4d5a
  1755. >0x402 beshort !0 Minix filesystem, V3, %d zones
  1756. >0x1e string minix \b, bootable
  1757. # SGI disk labels - Nathan Scott <nathans@debian.org>
  1758. 0 belong 0x0BE5A941 SGI disk label (volume header)
  1759. # SGI XFS filesystem - Nathan Scott <nathans@debian.org>
  1760. 0 belong 0x58465342 SGI XFS filesystem data
  1761. >0x4 belong x (blksz %d,
  1762. >0x68 beshort x inosz %d,
  1763. >0x64 beshort ^0x2004 v1 dirs)
  1764. >0x64 beshort &0x2004 v2 dirs)
  1765. ############################################################################
  1766. # Minix-ST kernel floppy
  1767. 0x800 belong 0x46fc2700 Atari-ST Minix kernel image
  1768. # http://en.wikipedia.org/wiki/BIOS_parameter_block
  1769. # floppies with valid BPB and any instruction at beginning
  1770. >19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy
  1771. >19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy
  1772. ############################################################################
  1773. # Hmmm, is this a better way of detecting _standard_ floppy images ?
  1774. 19 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k
  1775. >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
  1776. 19 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k
  1777. >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
  1778. 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
  1779. >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
  1780. 19 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM
  1781. >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
  1782. 19 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs
  1783. >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
  1784. 19 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k
  1785. 19 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k
  1786. # | | | | |
  1787. # | | | | heads
  1788. # | | | sectors/track
  1789. # | | sectors/FAT
  1790. # | media descriptor
  1791. # BPB: sectors
  1792. # Valid media descriptor bytes for MS-DOS:
  1793. #
  1794. # Byte Capacity Media Size and Type
  1795. # -------------------------------------------------
  1796. #
  1797. # F0 2.88 MB 3.5-inch, 2-sided, 36-sector
  1798. # F0 1.44 MB 3.5-inch, 2-sided, 18-sector
  1799. # F9 720K 3.5-inch, 2-sided, 9-sector
  1800. # F9 1.2 MB 5.25-inch, 2-sided, 15-sector
  1801. # FD 360K 5.25-inch, 2-sided, 9-sector
  1802. # FF 320K 5.25-inch, 2-sided, 8-sector
  1803. # FC 180K 5.25-inch, 1-sided, 9-sector
  1804. # FE 160K 5.25-inch, 1-sided, 8-sector
  1805. # FE 250K 8-inch, 1-sided, single-density
  1806. # FD 500K 8-inch, 2-sided, single-density
  1807. # FE 1.2 MB 8-inch, 2-sided, double-density
  1808. # F8 ----- Fixed disk
  1809. #
  1810. # FC xxxK Apricot 70x1x9 boot disk.
  1811. #
  1812. # Originally a bitmap:
  1813. # xxxxxxx0 Not two sided
  1814. # xxxxxxx1 Double sided
  1815. # xxxxxx0x Not 8 SPT
  1816. # xxxxxx1x 8 SPT
  1817. # xxxxx0xx Not Removable drive
  1818. # xxxxx1xx Removable drive
  1819. # 11111xxx Must be one.
  1820. #
  1821. # But now it's rather random:
  1822. # 111111xx Low density disk
  1823. # 00 SS, Not 8 SPT
  1824. # 01 DS, Not 8 SPT
  1825. # 10 SS, 8 SPT
  1826. # 11 DS, 8 SPT
  1827. #
  1828. # 11111001 Double density 3 1/2 floppy disk, high density 5 1/4
  1829. # 11110000 High density 3 1/2 floppy disk
  1830. # 11111000 Hard disk any format
  1831. #
  1832. # all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
  1833. # http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
  1834. 512 ubelong&0xE0ffff00 0xE0ffff00
  1835. # without valid Media descriptor in place of BPB, cases with are done at other places
  1836. >21 ubyte <0xE5 floppy with old FAT filesystem
  1837. # but valid Media descriptor at begin of FAT
  1838. #>>512 ubyte =0xed 720k
  1839. #>>512 ubyte =0xf0 1440k
  1840. #>>512 ubyte =0xf8 720k
  1841. #>>512 ubyte =0xf9 1220k
  1842. #>>512 ubyte =0xfa 320k
  1843. #>>512 ubyte =0xfb 640k
  1844. >>512 ubyte =0xfc 180k
  1845. # look like an an old DOS directory entry
  1846. >>>0xA0E ubequad 0
  1847. >>>>0xA00 ubequad !0
  1848. !:mime application/x-ima
  1849. >>512 ubyte =0xfd
  1850. # look for 2nd FAT at different location to distinguish between 360k and 500k
  1851. >>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k
  1852. #>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k
  1853. >>>0xA0E ubequad 0
  1854. !:mime application/x-ima
  1855. >>512 ubyte =0xfe
  1856. >>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k
  1857. >>>>0x60E ubequad 0
  1858. >>>>>0x600 ubequad !0
  1859. !:mime application/x-ima
  1860. #>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k
  1861. >>512 ubyte =0xff 320k
  1862. >>>0x60E ubequad 0
  1863. >>>>0x600 ubequad !0
  1864. !:mime application/x-ima
  1865. >>512 ubyte x \b, Media descriptor 0x%x
  1866. # without x86 jump instruction
  1867. >>0 ulelong&0x804000E9 !0x000000E9
  1868. # assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
  1869. >>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader
  1870. # IOSYS.COM+MSDOS.COM
  1871. >>>>0xc4 use 2xDOS-filename
  1872. >>0 ulelong&0x804000E9 =0x000000E9
  1873. # only x86 short jump instruction found
  1874. >>>0 ubyte =0xEB
  1875. >>>>1 ubyte x \b, code offset 0x%x+2
  1876. # http://thestarman.pcministry.com/DOS/ibm100/Boot.htm
  1877. # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
  1878. >>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader
  1879. # ibmbio.com+ibmdos.com
  1880. >>>>>0x176 use DOS-filename
  1881. >>>>>0x181 ubyte x \b+
  1882. >>>>>0x182 use DOS-filename
  1883. # http://thestarman.pcministry.com/DOS/ibm110/Boot.htm
  1884. # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
  1885. >>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader
  1886. # ibmbio.com+ibmdos.com
  1887. >>>>>0x18b use DOS-filename
  1888. >>>>>0x196 ubyte x \b+
  1889. >>>>>0x197 use DOS-filename
  1890. # http://en.wikipedia.org/wiki/Zenith_Data_Systems
  1891. # assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
  1892. >>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader
  1893. # IO.SYS+MSDOS.SYS
  1894. >>>>>0x20 use 2xDOS-filename
  1895. # http://en.wikipedia.org/wiki/Corona_Data_Systems
  1896. # assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
  1897. >>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader
  1898. # IO.SYS+MSDOS.SYS
  1899. >>>>>0x69 use 2xDOS-filename
  1900. # assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
  1901. >>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader
  1902. # defect IO.SYS+MSDOS.SYS ?
  1903. #>>>>>0x162 use 2xDOS-filename
  1904. # CDROM Filesystems
  1905. # Modified for UDF by gerardo.cacciari@gmail.com
  1906. 32769 string CD001 #
  1907. !:mime application/x-iso9660-image
  1908. >38913 string !NSR0 ISO 9660 CD-ROM filesystem data
  1909. >38913 string NSR0 UDF filesystem data
  1910. >>38917 string 1 (version 1.0)
  1911. >>38917 string 2 (version 1.5)
  1912. >>38917 string 3 (version 2.0)
  1913. >>38917 byte >0x33 (unknown version, ID 0x%X)
  1914. >>38917 byte <0x31 (unknown version, ID 0x%X)
  1915. # "application id" which appears to be used as a volume label
  1916. >32808 string/T >\0 '%s'
  1917. >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
  1918. 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
  1919. !:mime application/x-iso9660-image
  1920. 32777 string CDROM High Sierra CD-ROM filesystem data
  1921. # .cso files
  1922. 0 string CISO Compressed ISO CD image
  1923. # cramfs filesystem - russell@coker.com.au
  1924. 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
  1925. >4 lelong x size %lu
  1926. >8 lelong &1 version #2
  1927. >8 lelong &2 sorted_dirs
  1928. >8 lelong &4 hole_support
  1929. >32 lelong x CRC 0x%x,
  1930. >36 lelong x edition %lu,
  1931. >40 lelong x %lu blocks,
  1932. >44 lelong x %lu files
  1933. 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
  1934. >4 belong x size %lu
  1935. >8 belong &1 version #2
  1936. >8 belong &2 sorted_dirs
  1937. >8 belong &4 hole_support
  1938. >32 belong x CRC 0x%x,
  1939. >36 belong x edition %lu,
  1940. >40 belong x %lu blocks,
  1941. >44 belong x %lu files
  1942. # reiserfs - russell@coker.com.au
  1943. 0x10034 string ReIsErFs ReiserFS V3.5
  1944. 0x10034 string ReIsEr2Fs ReiserFS V3.6
  1945. 0x10034 string ReIsEr3Fs ReiserFS V3.6.19
  1946. >0x1002c leshort x block size %d
  1947. >0x10032 leshort &2 (mounted or unclean)
  1948. >0x10000 lelong x num blocks %d
  1949. >0x10040 lelong 1 tea hash
  1950. >0x10040 lelong 2 yura hash
  1951. >0x10040 lelong 3 r5 hash
  1952. # JFFS - russell@coker.com.au
  1953. 0 lelong 0x34383931 Linux Journalled Flash File system, little endian
  1954. 0 belong 0x34383931 Linux Journalled Flash File system, big endian
  1955. # EST flat binary format (which isn't, but anyway)
  1956. # From: Mark Brown <broonie@sirena.org.uk>
  1957. 0 string ESTFBINR EST flat binary
  1958. # Aculab VoIP firmware
  1959. # From: Mark Brown <broonie@sirena.org.uk>
  1960. 0 string VoIP\ Startup\ and Aculab VoIP firmware
  1961. >35 string x format %s
  1962. # From: Mark Brown <broonie@sirena.org.uk> [old]
  1963. # From: Behan Webster <behanw@websterwood.com>
  1964. 0 belong 0x27051956 u-boot legacy uImage,
  1965. >32 string x %s,
  1966. >28 byte 0 Invalid os/
  1967. >28 byte 1 OpenBSD/
  1968. >28 byte 2 NetBSD/
  1969. >28 byte 3 FreeBSD/
  1970. >28 byte 4 4.4BSD/
  1971. >28 byte 5 Linux/
  1972. >28 byte 6 SVR4/
  1973. >28 byte 7 Esix/
  1974. >28 byte 8 Solaris/
  1975. >28 byte 9 Irix/
  1976. >28 byte 10 SCO/
  1977. >28 byte 11 Dell/
  1978. >28 byte 12 NCR/
  1979. >28 byte 13 LynxOS/
  1980. >28 byte 14 VxWorks/
  1981. >28 byte 15 pSOS/
  1982. >28 byte 16 QNX/
  1983. >28 byte 17 Firmware/
  1984. >28 byte 18 RTEMS/
  1985. >28 byte 19 ARTOS/
  1986. >28 byte 20 Unity OS/
  1987. >28 byte 21 INTEGRITY/
  1988. >29 byte 0 \bInvalid CPU,
  1989. >29 byte 1 \bAlpha,
  1990. >29 byte 2 \bARM,
  1991. >29 byte 3 \bIntel x86,
  1992. >29 byte 4 \bIA64,
  1993. >29 byte 5 \bMIPS,
  1994. >29 byte 6 \bMIPS 64-bit,
  1995. >29 byte 7 \bPowerPC,
  1996. >29 byte 8 \bIBM S390,
  1997. >29 byte 9 \bSuperH,
  1998. >29 byte 10 \bSparc,
  1999. >29 byte 11 \bSparc 64-bit,
  2000. >29 byte 12 \bM68K,
  2001. >29 byte 13 \bNios-32,
  2002. >29 byte 14 \bMicroBlaze,
  2003. >29 byte 15 \bNios-II,
  2004. >29 byte 16 \bBlackfin,
  2005. >29 byte 17 \bAVR32,
  2006. >29 byte 18 \bSTMicroelectronics ST200,
  2007. >30 byte 0 Invalid Image
  2008. >30 byte 1 Standalone Program
  2009. >30 byte 2 OS Kernel Image
  2010. >30 byte 3 RAMDisk Image
  2011. >30 byte 4 Multi-File Image
  2012. >30 byte 5 Firmware Image
  2013. >30 byte 6 Script File
  2014. >30 byte 7 Filesystem Image (any type)
  2015. >30 byte 8 Binary Flat Device Tree BLOB
  2016. >31 byte 0 (Not compressed),
  2017. >31 byte 1 (gzip),
  2018. >31 byte 2 (bzip2),
  2019. >31 byte 3 (lzma),
  2020. >12 belong x %d bytes,
  2021. >8 bedate x %s,
  2022. >16 belong x Load Address: 0x%08X,
  2023. >20 belong x Entry Point: 0x%08X,
  2024. >4 belong x Header CRC: 0x%08X,
  2025. >24 belong x Data CRC: 0x%08X
  2026. # JFFS2 file system
  2027. 0 leshort 0x1984 Linux old jffs2 filesystem data little endian
  2028. 0 leshort 0x1985 Linux jffs2 filesystem data little endian
  2029. # Squashfs
  2030. 0 string sqsh Squashfs filesystem, big endian,
  2031. >28 beshort x version %d.
  2032. >30 beshort x \b%d,
  2033. >28 beshort <3
  2034. >>8 belong x %d bytes,
  2035. >28 beshort >2
  2036. >>28 beshort <4
  2037. >>>63 bequad x %lld bytes,
  2038. >>28 beshort >3
  2039. >>>40 bequad x %lld bytes,
  2040. #>>67 belong x %d bytes,
  2041. >4 belong x %d inodes,
  2042. >28 beshort <2
  2043. >>32 beshort x blocksize: %d bytes,
  2044. >28 beshort >1
  2045. >>28 beshort <4
  2046. >>>51 belong x blocksize: %d bytes,
  2047. >>28 beshort >3
  2048. >>>12 belong x blocksize: %d bytes,
  2049. >28 beshort <4
  2050. >>39 bedate x created: %s
  2051. >28 beshort >3
  2052. >>8 bedate x created: %s
  2053. 0 string hsqs Squashfs filesystem, little endian,
  2054. >28 leshort x version %d.
  2055. >30 leshort x \b%d,
  2056. >28 leshort <3
  2057. >>8 lelong x %d bytes,
  2058. >28 leshort >2
  2059. >>28 leshort <4
  2060. >>>63 lequad x %lld bytes,
  2061. >>28 leshort >3
  2062. >>>40 lequad x %lld bytes,
  2063. #>>63 lelong x %d bytes,
  2064. >4 lelong x %d inodes,
  2065. >28 leshort <2
  2066. >>32 leshort x blocksize: %d bytes,
  2067. >28 leshort >1
  2068. >>28 leshort <4
  2069. >>>51 lelong x blocksize: %d bytes,
  2070. >>28 leshort >3
  2071. >>>12 lelong x blocksize: %d bytes,
  2072. >28 leshort <4
  2073. >>39 ledate x created: %s
  2074. >28 leshort >3
  2075. >>8 ledate x created: %s
  2076. # AFS Dump Magic
  2077. # From: Ty Sarna <tsarna@sarna.org>
  2078. 0 string \x01\xb3\xa1\x13\x22 AFS Dump
  2079. >&0 belong x (v%d)
  2080. >>&0 byte 0x76
  2081. >>>&0 belong x Vol %d,
  2082. >>>>&0 byte 0x6e
  2083. >>>>>&0 string x %s
  2084. >>>>>>&1 byte 0x74
  2085. >>>>>>>&0 beshort 2
  2086. >>>>>>>>&4 bedate x on: %s
  2087. >>>>>>>>&0 bedate =0 full dump
  2088. >>>>>>>>&0 bedate !0 incremental since: %s
  2089. #----------------------------------------------------------
  2090. #delta ISO Daniel Novotny (dnovotny@redhat.com)
  2091. 0 string DISO Delta ISO data
  2092. >4 belong x version %d
  2093. # VMS backup savesets - gerardo.cacciari@gmail.com
  2094. #
  2095. 4 string \x01\x00\x01\x00\x01\x00
  2096. >(0.s+16) string \x01\x01
  2097. >>&(&0.b+8) byte 0x42 OpenVMS backup saveset data
  2098. >>>40 lelong x (block size %d,
  2099. >>>49 string >\0 original name '%s',
  2100. >>>2 short 1024 VAX generated)
  2101. >>>2 short 2048 AXP generated)
  2102. >>>2 short 4096 I64 generated)
  2103. # Summary: Oracle Clustered Filesystem
  2104. # Created by: Aaron Botsis <redhat@digitalmafia.org>
  2105. 8 string OracleCFS Oracle Clustered Filesystem,
  2106. >4 long x rev %d
  2107. >0 long x \b.%d,
  2108. >560 string x label: %.64s,
  2109. >136 string x mountpoint: %.128s
  2110. # Summary: Oracle ASM tagged volume
  2111. # Created by: Aaron Botsis <redhat@digitalmafia.org>
  2112. 32 string ORCLDISK Oracle ASM Volume,
  2113. >40 string x Disk Name: %0.12s
  2114. 32 string ORCLCLRD Oracle ASM Volume (cleared),
  2115. >40 string x Disk Name: %0.12s
  2116. # Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
  2117. 8 string OracleCFS Oracle Clustered Filesystem,
  2118. >4 long x rev %d
  2119. >0 long x \b.%d,
  2120. >560 string x label: %.64s,
  2121. >136 string x mountpoint: %.128s
  2122. # Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
  2123. 32 string ORCLDISK Oracle ASM Volume,
  2124. >40 string x Disk Name: %0.12s
  2125. 32 string ORCLCLRD Oracle ASM Volume (cleared),
  2126. >40 string x Disk Name: %0.12s
  2127. # Compaq/HP RILOE floppy image
  2128. # From: Dirk Jagdmann <doj@cubic.org>
  2129. 0 string CPQRFBLO Compaq/HP RILOE floppy image
  2130. #------------------------------------------------------------------------------
  2131. # Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
  2132. # These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
  2133. # which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
  2134. #
  2135. 1008 string DECFILE11 Files-11 On-Disk Structure
  2136. >525 byte x Level %d
  2137. >525 byte x (ODS-%d);
  2138. >1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system;
  2139. >1017 string B
  2140. >>525 byte 2 VAX/VMS or OpenVMS file system;
  2141. >>525 byte 5 OpenVMS Alpha or Itanium file system;
  2142. >984 string x volume label is '%-12.12s'
  2143. # From: Thomas Klausner <wiz@NetBSD.org>
  2144. # http://filext.com/file-extension/DAA
  2145. # describes the daa file format. The magic would be:
  2146. 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive
  2147. # From Albert Cahalan <acahalan@gmail.com>
  2148. # really le32 operation,destination,payloadsize (but quite predictable)
  2149. # 01 00 00 00 00 00 00 c0 00 02 00 00
  2150. 0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware
  2151. # From Eric Sandeen
  2152. # GFS2
  2153. 0x10000 belong 0x01161970
  2154. >0x10018 belong 0x0000051d GFS1 Filesystem
  2155. >>0x10024 belong x (blocksize %d,
  2156. >>0x10060 string >\0 lockproto %s)
  2157. >0x10018 belong 0x00000709 GFS2 Filesystem
  2158. >>0x10024 belong x (blocksize %d,
  2159. >>0x10060 string >\0 lockproto %s)
  2160. # BTRFS
  2161. 0x10040 string _BHRfS_M BTRFS Filesystem
  2162. >0x1012b string >\0 (label "%s",
  2163. >0x10090 lelong x sectorsize %d,
  2164. >0x10094 lelong x nodesize %d,
  2165. >0x10098 lelong x leafsize %d)
  2166. # dvdisaster's .ecc
  2167. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  2168. 0 string *dvdisaster* dvdisaster error correction file
  2169. # xfs metadump image
  2170. # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
  2171. # but can we do the << ? For now it's always 512 (0x200) anyway.
  2172. 0 string XFSM
  2173. >0x200 string XFSB XFS filesystem metadump image
  2174. # Type: CROM filesystem
  2175. # From: Werner Fink <werner@suse.de>
  2176. 0 string CROMFS CROMFS
  2177. >6 string >\0 \b version %2.2s,
  2178. >8 ulequad >0 \b block data at %lld,
  2179. >16 ulequad >0 \b fblock table at %lld,
  2180. >24 ulequad >0 \b inode table at %lld,
  2181. >32 ulequad >0 \b root at %lld,
  2182. >40 ulelong >0 \b fblock size = %ld,
  2183. >44 ulelong >0 \b block size = %ld,
  2184. >48 ulequad >0 \b bytes = %lld
  2185. # Type: xfs metadump image
  2186. # From: Daniel Novotny <dnovotny@redhat.com>
  2187. # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
  2188. # but can we do the << ? For now it's always 512 (0x200) anyway.
  2189. 0 string XFSM
  2190. >0x200 string XFSB XFS filesystem metadump image
  2191. # Type: delta ISO
  2192. # From: Daniel Novotny <dnovotny@redhat.com>
  2193. 0 string DISO Delta ISO data,
  2194. >4 belong x version %d
  2195. # JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
  2196. # See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
  2197. # From: Adam Buchbinder <adam.buchbinder@gmail.com>
  2198. 0x8000 string JFS1
  2199. # Because it's text-only magic, check a binary value (version) to be sure.
  2200. # Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
  2201. # mountable.
  2202. >&0 lelong <3 JFS2 filesystem image
  2203. # Label is followed by a UUID; we have to limit string length to avoid
  2204. # appending the UUID in the case of a 16-byte label.
  2205. >>&144 regex [\x20-\x7E]{1,16} (label "%s")
  2206. >>&0 lequad x \b, %lld blocks
  2207. >>&8 lelong x \b, blocksize %d
  2208. >>&32 lelong&0x00000006 >0 (dirty)
  2209. >>&36 lelong >0 (compressed)
  2210. # LFS
  2211. 0 lelong 0x070162 LFS filesystem image
  2212. >4 lelong 1 version 1,
  2213. >>8 lelong x \b blocks %u,
  2214. >>12 lelong x \b blocks per segment %u,
  2215. >4 lelong 2 version 2,
  2216. >>8 lelong x \b fragments %u,
  2217. >>12 lelong x \b bytes per segment %u,
  2218. >16 lelong x \b disk blocks %u,
  2219. >20 lelong x \b block size %u,
  2220. >24 lelong x \b fragment size %u,
  2221. >28 lelong x \b fragments per block %u,
  2222. >32 lelong x \b start for free list %u,
  2223. >36 lelong x \b number of free blocks %d,
  2224. >40 lelong x \b number of files %u,
  2225. >44 lelong x \b blocks available for writing %d,
  2226. >48 lelong x \b inodes in cache %d,
  2227. >52 lelong x \b inode file disk address 0x%x,
  2228. >56 lelong x \b inode file inode number %u,
  2229. >60 lelong x \b address of last segment written 0x%x,
  2230. >64 lelong x \b address of next segment to write 0x%x,
  2231. >68 lelong x \b address of current segment written 0x%x
  2232. 0 string td\000 floppy image data (TeleDisk, compressed)
  2233. 0 string TD\000 floppy image data (TeleDisk)
  2234. 0 string CQ\024 floppy image data (CopyQM,
  2235. >16 leshort x %d sectors,
  2236. >18 leshort x %d heads.)
  2237. 0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk)
  2238. 0 beshort 0xAA58 floppy image data (IBM SaveDskF, old)
  2239. 0 beshort 0xAA59 floppy image data (IBM SaveDskF)
  2240. 0 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed)
  2241. 0 string \074CPM_Disk\076 disk image data (YAZE)
  2242. # ReFS
  2243. # Richard W.M. Jones <rjones@redhat.com>
  2244. 0 string \0\0\0ReFS\0 ReFS filesystem image
  2245. # EFW encase image file format:
  2246. # Gregoire Passault
  2247. # http://www.forensicswiki.org/wiki/Encase_image_file_format
  2248. 0 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format