macintosh 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390
  1. #------------------------------------------------------------------------------
  2. # $File: macintosh,v 1.22 2011/05/17 17:40:31 rrt Exp $
  3. # macintosh description
  4. #
  5. # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
  6. # Daniel Quinlan, quinlan@yggdrasil.com
  7. 11 string must\ be\ converted\ with\ BinHex BinHex binary text
  8. !:mime application/mac-binhex40
  9. >41 string x \b, version %.3s
  10. # Stuffit archives are the de facto standard of compression for Macintosh
  11. # files obtained from most archives. (franklsm@tuns.ca)
  12. 0 string SIT! StuffIt Archive (data)
  13. !:mime application/x-stuffit
  14. !:apple SIT!SIT!
  15. >2 string x : %s
  16. 0 string SITD StuffIt Deluxe (data)
  17. >2 string x : %s
  18. 0 string Seg StuffIt Deluxe Segment (data)
  19. >2 string x : %s
  20. # Newer StuffIt archives (grant@netbsd.org)
  21. 0 string StuffIt StuffIt Archive
  22. !:mime application/x-stuffit
  23. !:apple SIT!SIT!
  24. #>162 string >0 : %s
  25. # Macintosh Applications and Installation binaries (franklsm@tuns.ca)
  26. # GRR: Too weak
  27. #0 string APPL Macintosh Application (data)
  28. #>2 string x \b: %s
  29. # Macintosh System files (franklsm@tuns.ca)
  30. # GRR: Too weak
  31. #0 string zsys Macintosh System File (data)
  32. #0 string FNDR Macintosh Finder (data)
  33. #0 string libr Macintosh Library (data)
  34. #>2 string x : %s
  35. #0 string shlb Macintosh Shared Library (data)
  36. #>2 string x : %s
  37. #0 string cdev Macintosh Control Panel (data)
  38. #>2 string x : %s
  39. #0 string INIT Macintosh Extension (data)
  40. #>2 string x : %s
  41. #0 string FFIL Macintosh Truetype Font (data)
  42. #>2 string x : %s
  43. #0 string LWFN Macintosh Postscript Font (data)
  44. #>2 string x : %s
  45. # Additional Macintosh Files (franklsm@tuns.ca)
  46. # GRR: Too weak
  47. #0 string PACT Macintosh Compact Pro Archive (data)
  48. #>2 string x : %s
  49. #0 string ttro Macintosh TeachText File (data)
  50. #>2 string x : %s
  51. #0 string TEXT Macintosh TeachText File (data)
  52. #>2 string x : %s
  53. #0 string PDF Macintosh PDF File (data)
  54. #>2 string x : %s
  55. # MacBinary format (Eric Fischer, enf@pobox.com)
  56. #
  57. # Unfortunately MacBinary doesn't really have a magic number prior
  58. # to the MacBinary III format. The checksum is really the way to
  59. # do it, but the magic file format isn't up to the challenge.
  60. #
  61. # 0 byte 0
  62. # 1 byte # filename length
  63. # 2 string # filename
  64. # 65 string # file type
  65. # 69 string # file creator
  66. # 73 byte # Finder flags
  67. # 74 byte 0
  68. # 75 beshort # vertical posn in window
  69. # 77 beshort # horiz posn in window
  70. # 79 beshort # window or folder ID
  71. # 81 byte # protected?
  72. # 82 byte 0
  73. # 83 belong # length of data segment
  74. # 87 belong # length of resource segment
  75. # 91 belong # file creation date
  76. # 95 belong # file modification date
  77. # 99 beshort # length of comment after resource
  78. # 101 byte # new Finder flags
  79. # 102 string mBIN # (only in MacBinary III)
  80. # 106 byte # char. code of file name
  81. # 107 byte # still more Finder flags
  82. # 116 belong # total file length
  83. # 120 beshort # length of add'l header
  84. # 122 byte 129 # for MacBinary II
  85. # 122 byte 130 # for MacBinary III
  86. # 123 byte 129 # minimum version that can read fmt
  87. # 124 beshort # checksum
  88. #
  89. # This attempts to use the version numbers as a magic number, requiring
  90. # that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
  91. # be 0x81. This works for the files I have, but maybe not for everyone's.
  92. # Unfortunately, this magic is quite weak - MPi
  93. #122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
  94. # MacBinary I doesn't have the version number field at all, but MacBinary II
  95. # has been in use since 1987 so I hope there aren't many really old files
  96. # floating around that this will miss. The original spec calls for using
  97. # the nulls in 0, 74, and 82 as the magic number.
  98. #
  99. # Another possibility, that would also work for MacBinary I, is to use
  100. # the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
  101. # have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
  102. # and that 74 will be 0. So something like
  103. #
  104. # 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
  105. #
  106. # >73 byte&0x01 0x01 \b, inited
  107. # >73 byte&0x02 0x02 \b, changed
  108. # >73 byte&0x04 0x04 \b, busy
  109. # >73 byte&0x08 0x08 \b, bozo
  110. # >73 byte&0x10 0x10 \b, system
  111. # >73 byte&0x10 0x20 \b, bundle
  112. # >73 byte&0x10 0x40 \b, invisible
  113. # >73 byte&0x10 0x80 \b, locked
  114. #>65 string x \b, type "%4.4s"
  115. #>65 string 8BIM (PhotoShop)
  116. #>65 string ALB3 (PageMaker 3)
  117. #>65 string ALB4 (PageMaker 4)
  118. #>65 string ALT3 (PageMaker 3)
  119. #>65 string APPL (application)
  120. #>65 string AWWP (AppleWorks word processor)
  121. #>65 string CIRC (simulated circuit)
  122. #>65 string DRWG (MacDraw)
  123. #>65 string EPSF (Encapsulated PostScript)
  124. #>65 string FFIL (font suitcase)
  125. #>65 string FKEY (function key)
  126. #>65 string FNDR (Macintosh Finder)
  127. #>65 string GIFf (GIF image)
  128. #>65 string Gzip (GNU gzip)
  129. #>65 string INIT (system extension)
  130. #>65 string LIB\ (library)
  131. #>65 string LWFN (PostScript font)
  132. #>65 string MSBC (Microsoft BASIC)
  133. #>65 string PACT (Compact Pro archive)
  134. #>65 string PDF\ (Portable Document Format)
  135. #>65 string PICT (picture)
  136. #>65 string PNTG (MacPaint picture)
  137. #>65 string PREF (preferences)
  138. #>65 string PROJ (Think C project)
  139. #>65 string QPRJ (Think Pascal project)
  140. #>65 string SCFL (Defender scores)
  141. #>65 string SCRN (startup screen)
  142. #>65 string SITD (StuffIt Deluxe)
  143. #>65 string SPn3 (SuperPaint)
  144. #>65 string STAK (HyperCard stack)
  145. #>65 string Seg\ (StuffIt segment)
  146. #>65 string TARF (Unix tar archive)
  147. #>65 string TEXT (ASCII)
  148. #>65 string TIFF (TIFF image)
  149. #>65 string TOVF (Eudora table of contents)
  150. #>65 string WDBN (Microsoft Word word processor)
  151. #>65 string WORD (MacWrite word processor)
  152. #>65 string XLS\ (Microsoft Excel)
  153. #>65 string ZIVM (compress (.Z))
  154. #>65 string ZSYS (Pre-System 7 system file)
  155. #>65 string acf3 (Aldus FreeHand)
  156. #>65 string cdev (control panel)
  157. #>65 string dfil (Desk Acessory suitcase)
  158. #>65 string libr (library)
  159. #>65 string nX^d (WriteNow word processor)
  160. #>65 string nX^w (WriteNow dictionary)
  161. #>65 string rsrc (resource)
  162. #>65 string scbk (Scrapbook)
  163. #>65 string shlb (shared library)
  164. #>65 string ttro (SimpleText read-only)
  165. #>65 string zsys (system file)
  166. #>69 string x \b, creator "%4.4s"
  167. # Somewhere, Apple has a repository of registered Creator IDs. These are
  168. # just the ones that I happened to have files from and was able to identify.
  169. #>69 string 8BIM (Adobe Photoshop)
  170. #>69 string ALD3 (PageMaker 3)
  171. #>69 string ALD4 (PageMaker 4)
  172. #>69 string ALFA (Alpha editor)
  173. #>69 string APLS (Apple Scanner)
  174. #>69 string APSC (Apple Scanner)
  175. #>69 string BRKL (Brickles)
  176. #>69 string BTFT (BitFont)
  177. #>69 string CCL2 (Common Lisp 2)
  178. #>69 string CCL\ (Common Lisp)
  179. #>69 string CDmo (The Talking Moose)
  180. #>69 string CPCT (Compact Pro)
  181. #>69 string CSOm (Eudora)
  182. #>69 string DMOV (Font/DA Mover)
  183. #>69 string DSIM (DigSim)
  184. #>69 string EDIT (Macintosh Edit)
  185. #>69 string ERIK (Macintosh Finder)
  186. #>69 string EXTR (self-extracting archive)
  187. #>69 string Gzip (GNU gzip)
  188. #>69 string KAHL (Think C)
  189. #>69 string LWFU (LaserWriter Utility)
  190. #>69 string LZIV (compress)
  191. #>69 string MACA (MacWrite)
  192. #>69 string MACS (Macintosh operating system)
  193. #>69 string MAcK (MacKnowledge terminal emulator)
  194. #>69 string MLND (Defender)
  195. #>69 string MPNT (MacPaint)
  196. #>69 string MSBB (Microsoft BASIC (binary))
  197. #>69 string MSWD (Microsoft Word)
  198. #>69 string NCSA (NCSA Telnet)
  199. #>69 string PJMM (Think Pascal)
  200. #>69 string PSAL (Hunt the Wumpus)
  201. #>69 string PSI2 (Apple File Exchange)
  202. #>69 string R*ch (BBEdit)
  203. #>69 string RMKR (Resource Maker)
  204. #>69 string RSED (Resource Editor)
  205. #>69 string Rich (BBEdit)
  206. #>69 string SIT! (StuffIt)
  207. #>69 string SPNT (SuperPaint)
  208. #>69 string Unix (NeXT Mac filesystem)
  209. #>69 string VIM! (Vim editor)
  210. #>69 string WILD (HyperCard)
  211. #>69 string XCEL (Microsoft Excel)
  212. #>69 string aCa2 (Fontographer)
  213. #>69 string aca3 (Aldus FreeHand)
  214. #>69 string dosa (Macintosh MS-DOS file system)
  215. #>69 string movr (Font/DA Mover)
  216. #>69 string nX^n (WriteNow)
  217. #>69 string pdos (Apple ProDOS file system)
  218. #>69 string scbk (Scrapbook)
  219. #>69 string ttxt (SimpleText)
  220. #>69 string ufox (Foreign File Access)
  221. # Just in case...
  222. 102 string mBIN MacBinary III data with surprising version number
  223. # sas magic from Bruce Foster (bef@nwu.edu)
  224. #
  225. #0 string SAS SAS
  226. #>8 string x %s
  227. 0 string SAS SAS
  228. >24 string DATA data file
  229. >24 string CATALOG catalog
  230. >24 string INDEX data file index
  231. >24 string VIEW data view
  232. # sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
  233. #
  234. 0x54 string SAS SAS 7+
  235. >0x9C string DATA data file
  236. >0x9C string CATALOG catalog
  237. >0x9C string INDEX data file index
  238. >0x9C string VIEW data view
  239. # spss magic for SPSS system and portable files,
  240. # from Bruce Foster (bef@nwu.edu).
  241. 0 long 0xc1e2c3c9 SPSS Portable File
  242. >40 string x %s
  243. 0 string $FL2 SPSS System File
  244. >24 string x %s
  245. # Macintosh filesystem data
  246. # From "Tom N Harris" <telliamed@mac.com>
  247. # Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
  248. # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
  249. # entries depend on the data arithmetic added after v.35
  250. # There's also some Pascal strings in here, ditto...
  251. # The boot block signature, according to IM:Files, is
  252. # "for HFS volumes, this field always contains the value 0x4C4B."
  253. # But if this is true for MFS or HFS+ volumes, I don't know.
  254. # Alternatively, the boot block is supposed to be zeroed if it's
  255. # unused, so a simply >0 should suffice.
  256. 0x400 beshort 0xD2D7 Macintosh MFS data
  257. >0 beshort 0x4C4B (bootable)
  258. >0x40a beshort &0x8000 (locked)
  259. >0x402 beldate-0x7C25B080 x created: %s,
  260. >0x406 beldate-0x7C25B080 >0 last backup: %s,
  261. >0x414 belong x block size: %d,
  262. >0x412 beshort x number of blocks: %d,
  263. >0x424 pstring x volume name: %s
  264. # "BD" gives many false positives
  265. #0x400 beshort 0x4244 Macintosh HFS data
  266. #>0 beshort 0x4C4B (bootable)
  267. #>0x40a beshort &0x8000 (locked)
  268. #>0x40a beshort ^0x0100 (mounted)
  269. #>0x40a beshort &0x0200 (spared blocks)
  270. #>0x40a beshort &0x0800 (unclean)
  271. #>0x47C beshort 0x482B (Embedded HFS+ Volume)
  272. #>0x402 beldate-0x7C25B080 x created: %s,
  273. #>0x406 beldate-0x7C25B080 x last modified: %s,
  274. #>0x440 beldate-0x7C25B080 >0 last backup: %s,
  275. #>0x414 belong x block size: %d,
  276. #>0x412 beshort x number of blocks: %d,
  277. #>0x424 pstring x volume name: %s
  278. 0x400 beshort 0x482B Macintosh HFS Extended
  279. >&0 beshort x version %d data
  280. >0 beshort 0x4C4B (bootable)
  281. >0x404 belong ^0x00000100 (mounted)
  282. >&2 belong &0x00000200 (spared blocks)
  283. >&2 belong &0x00000800 (unclean)
  284. >&2 belong &0x00008000 (locked)
  285. >&6 string x last mounted by: '%.4s',
  286. # really, that should be treated as a belong and we print a string
  287. # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
  288. >&14 beldate-0x7C25B080 x created: %s,
  289. # only the creation date is local time, all other timestamps in HFS+ are UTC.
  290. >&18 bedate-0x7C25B080 x last modified: %s,
  291. >&22 bedate-0x7C25B080 >0 last backup: %s,
  292. >&26 bedate-0x7C25B080 >0 last checked: %s,
  293. >&38 belong x block size: %d,
  294. >&42 belong x number of blocks: %d,
  295. >&46 belong x free blocks: %d
  296. # I don't think this is really necessary since it doesn't do much and
  297. # anything with a valid driver descriptor will also have a valid
  298. # partition map
  299. #0 beshort 0x4552 Apple Device Driver data
  300. #>&24 beshort =1 \b, MacOS
  301. # Is that the partition type a cstring or a pstring? Well, IM says "strings
  302. # shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
  303. # cstring. Of course, partitions can contain more than four entries, but
  304. # what're you gonna do?
  305. # GRR: This magic is too weak, it is just "PM"
  306. #0x200 beshort 0x504D Apple Partition data
  307. #>0x2 beshort x (block size: %d):
  308. #>0x230 string x first type: %s,
  309. #>0x210 string x name: %s,
  310. #>0x254 belong x number of blocks: %d,
  311. #>0x400 beshort 0x504D
  312. #>>0x430 string x second type: %s,
  313. #>>0x410 string x name: %s,
  314. #>>0x454 belong x number of blocks: %d,
  315. #>>0x600 beshort 0x504D
  316. #>>>0x630 string x third type: %s,
  317. #>>>0x610 string x name: %s,
  318. #>>>0x654 belong x number of blocks: %d,
  319. #>>0x800 beshort 0x504D
  320. #>>>0x830 string x fourth type: %s,
  321. #>>>0x810 string x name: %s,
  322. #>>>0x854 belong x number of blocks: %d,
  323. #>>>0xa00 beshort 0x504D
  324. #>>>>0xa30 string x fifth type: %s,
  325. #>>>>0xa10 string x name: %s,
  326. #>>>>0xa54 belong x number of blocks: %d
  327. #>>>0xc00 beshort 0x504D
  328. #>>>>0xc30 string x sixth type: %s,
  329. #>>>>0xc10 string x name: %s,
  330. #>>>>0xc54 belong x number of blocks: %d
  331. ## AFAIK, only the signature is different
  332. #0x200 beshort 0x5453 Apple Old Partition data
  333. #>0x2 beshort x block size: %d,
  334. #>0x230 string x first type: %s,
  335. #>0x210 string x name: %s,
  336. #>0x254 belong x number of blocks: %d,
  337. #>0x400 beshort 0x504D
  338. #>>0x430 string x second type: %s,
  339. #>>0x410 string x name: %s,
  340. #>>0x454 belong x number of blocks: %d,
  341. #>>0x800 beshort 0x504D
  342. #>>>0x830 string x third type: %s,
  343. #>>>0x810 string x name: %s,
  344. #>>>0x854 belong x number of blocks: %d,
  345. #>>>0xa00 beshort 0x504D
  346. #>>>>0xa30 string x fourth type: %s,
  347. #>>>>0xa10 string x name: %s,
  348. #>>>>0xa54 belong x number of blocks: %d
  349. # From: Remi Mommsen <mommsen@slac.stanford.edu>
  350. 0 string BOMStore Mac OS X bill of materials (BOM) file
  351. # From: Adam Buchbinder <adam.buchbinder@gmail.com>
  352. # URL: http://en.wikipedia.org/wiki/Datafork_TrueType
  353. # Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
  354. # TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
  355. # don't know what they mean.
  356. 0 belong 0x100
  357. >(0x4.L+24) beshort x
  358. >>&4 belong 0x73666e74 Mac OSX datafork font, TrueType
  359. >>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT'
  360. >>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT'
  361. >>&4 belong 0x504f5354 Mac OSX datafork font, PostScript