archive 29 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922
  1. #------------------------------------------------------------------------------
  2. # $File: archive,v 1.79 2013/02/08 17:24:06 christos Exp $
  3. # archive: file(1) magic for archive formats (see also "msdos" for self-
  4. # extracting compressed archives)
  5. #
  6. # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
  7. # pre-POSIX "tar" archives are handled in the C code.
  8. # POSIX tar archives
  9. 257 string ustar\0 POSIX tar archive
  10. !:mime application/x-tar # encoding: posix
  11. 257 string ustar\040\040\0 GNU tar archive
  12. !:mime application/x-tar # encoding: gnu
  13. # Incremental snapshot gnu-tar format from:
  14. # http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
  15. 0 string GNU\ tar- GNU tar incremental snapshot data
  16. >&0 regex [0-9]\.[0-9]+-[0-9]+ version %s
  17. # cpio archives
  18. #
  19. # Yes, the top two "cpio archive" formats *are* supposed to just be "short".
  20. # The idea is to indicate archives produced on machines with the same
  21. # byte order as the machine running "file" with "cpio archive", and
  22. # to indicate archives produced on machines with the opposite byte order
  23. # from the machine running "file" with "byte-swapped cpio archive".
  24. #
  25. # The SVR4 "cpio(4)" hints that there are additional formats, but they
  26. # are defined as "short"s; I think all the new formats are
  27. # character-header formats and thus are strings, not numbers.
  28. 0 short 070707 cpio archive
  29. !:mime application/x-cpio
  30. 0 short 0143561 byte-swapped cpio archive
  31. !:mime application/x-cpio # encoding: swapped
  32. 0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
  33. 0 string 070701 ASCII cpio archive (SVR4 with no CRC)
  34. 0 string 070702 ASCII cpio archive (SVR4 with CRC)
  35. #
  36. # Various archive formats used by various versions of the "ar"
  37. # command.
  38. #
  39. #
  40. # Original UNIX archive formats.
  41. # They were written with binary values in host byte order, and
  42. # the magic number was a host "int", which might have been 16 bits
  43. # or 32 bits. We don't say "PDP-11" or "VAX", as there might have
  44. # been ports to little-endian 16-bit-int or 32-bit-int platforms
  45. # (x86?) using some of those formats; if none existed, feel free
  46. # to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
  47. # 32-bit. There might have been big-endian ports of that sort as
  48. # well.
  49. #
  50. 0 leshort 0177555 very old 16-bit-int little-endian archive
  51. 0 beshort 0177555 very old 16-bit-int big-endian archive
  52. 0 lelong 0177555 very old 32-bit-int little-endian archive
  53. 0 belong 0177555 very old 32-bit-int big-endian archive
  54. 0 leshort 0177545 old 16-bit-int little-endian archive
  55. >2 string __.SYMDEF random library
  56. 0 beshort 0177545 old 16-bit-int big-endian archive
  57. >2 string __.SYMDEF random library
  58. 0 lelong 0177545 old 32-bit-int little-endian archive
  59. >4 string __.SYMDEF random library
  60. 0 belong 0177545 old 32-bit-int big-endian archive
  61. >4 string __.SYMDEF random library
  62. #
  63. # From "pdp" (but why a 4-byte quantity?)
  64. #
  65. 0 lelong 0x39bed PDP-11 old archive
  66. 0 lelong 0x39bee PDP-11 4.0 archive
  67. #
  68. # XXX - what flavor of APL used this, and was it a variant of
  69. # some ar archive format? It's similar to, but not the same
  70. # as, the APL workspace magic numbers in pdp.
  71. #
  72. 0 long 0100554 apl workspace
  73. #
  74. # System V Release 1 portable(?) archive format.
  75. #
  76. 0 string =<ar> System V Release 1 ar archive
  77. !:mime application/x-archive
  78. #
  79. # Debian package; it's in the portable archive format, and needs to go
  80. # before the entry for regular portable archives, as it's recognized as
  81. # a portable archive whose first member has a name beginning with
  82. # "debian".
  83. #
  84. 0 string =!<arch>\ndebian
  85. !:mime application/x-debian-package
  86. >8 string debian-split part of multipart Debian package
  87. >8 string debian-binary Debian binary package
  88. >8 string !debian
  89. >68 string >\0 (format %s)
  90. # These next two lines do not work, because a bzip2 Debian archive
  91. # still uses gzip for the control.tar (first in the archive). Only
  92. # data.tar varies, and the location of its filename varies too.
  93. # file/libmagic does not current have support for ascii-string based
  94. # (offsets) as of 2005-09-15.
  95. #>81 string bz2 \b, uses bzip2 compression
  96. #>84 string gz \b, uses gzip compression
  97. #>136 ledate x created: %s
  98. #
  99. # MIPS archive; they're in the portable archive format, and need to go
  100. # before the entry for regular portable archives, as it's recognized as
  101. # a portable archive whose first member has a name beginning with
  102. # "__________E".
  103. #
  104. 0 string =!<arch>\n__________E MIPS archive
  105. !:mime application/x-archive
  106. >20 string U with MIPS Ucode members
  107. >21 string L with MIPSEL members
  108. >21 string B with MIPSEB members
  109. >19 string L and an EL hash table
  110. >19 string B and an EB hash table
  111. >22 string X -- out of date
  112. 0 search/1 -h- Software Tools format archive text
  113. #
  114. # BSD/SVR2-and-later portable archive formats.
  115. #
  116. 0 string =!<arch> current ar archive
  117. !:mime application/x-archive
  118. >8 string __.SYMDEF random library
  119. >68 string __.SYMDEF\ SORTED random library
  120. #
  121. # "Thin" archive, as can be produced by GNU ar.
  122. #
  123. 0 string =!<thin>\n thin archive with
  124. >68 belong 0 no symbol entries
  125. >68 belong 1 %d symbol entry
  126. >68 belong >1 %d symbol entries
  127. # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
  128. #
  129. # The first byte is the magic (0x1a), byte 2 is the compression type for
  130. # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
  131. # filename of the first file (null terminated). Since some types collide
  132. # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
  133. # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
  134. 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
  135. !:mime application/x-arc
  136. 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
  137. !:mime application/x-arc
  138. 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
  139. !:mime application/x-arc
  140. 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
  141. !:mime application/x-arc
  142. 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
  143. !:mime application/x-arc
  144. 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
  145. !:mime application/x-arc
  146. # [JW] stuff taken from idarc, obviously ARC successors:
  147. 0 lelong&0x8080ffff 0x00000a1a PAK archive data
  148. !:mime application/x-arc
  149. 0 lelong&0x8080ffff 0x0000141a ARC+ archive data
  150. !:mime application/x-arc
  151. 0 lelong&0x8080ffff 0x0000481a HYP archive data
  152. !:mime application/x-arc
  153. # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
  154. # I can't create either SPARK or ArcFS archives so I have not tested this stuff
  155. # [GRR: the original entries collide with ARC, above; replaced with combined
  156. # version (not tested)]
  157. #0 byte 0x1a RISC OS archive (spark format)
  158. 0 string \032archive RISC OS archive (ArcFS format)
  159. 0 string Archive\000 RISC OS archive (ArcFS format)
  160. # All these were taken from idarc, many could not be verified. Unfortunately,
  161. # there were many low-quality sigs, i.e. easy to trigger false positives.
  162. # Please notify me of any real-world fishy/ambiguous signatures and I'll try
  163. # to get my hands on the actual archiver and see if I find something better. [JW]
  164. # probably many can be enhanced by finding some 0-byte or control char near the start
  165. # idarc calls this Crush/Uncompressed... *shrug*
  166. 0 string CRUSH Crush archive data
  167. # Squeeze It (.sqz)
  168. 0 string HLSQZ Squeeze It archive data
  169. # SQWEZ
  170. 0 string SQWEZ SQWEZ archive data
  171. # HPack (.hpk)
  172. 0 string HPAK HPack archive data
  173. # HAP
  174. 0 string \x91\x33HF HAP archive data
  175. # MD/MDCD
  176. 0 string MDmd MDCD archive data
  177. # LIM
  178. 0 string LIM\x1a LIM archive data
  179. # SAR
  180. 3 string LH5 SAR archive data
  181. # BSArc/BS2
  182. 0 string \212\3SB\020\0 BSArc/BS2 archive data
  183. # Bethesda Softworks Archive (Oblivion)
  184. 0 string BSA\0 BSArc archive data
  185. >4 lelong x version %d
  186. # MAR
  187. 2 string =-ah MAR archive data
  188. # ACB
  189. #0 belong&0x00f800ff 0x00800000 ACB archive data
  190. # CPZ
  191. # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
  192. # JRC
  193. 0 string JRchive JRC archive data
  194. # Quantum
  195. 0 string DS\0 Quantum archive data
  196. # ReSOF
  197. 0 string PK\3\6 ReSOF archive data
  198. # QuArk
  199. 0 string 7\4 QuArk archive data
  200. # YAC
  201. 14 string YC YAC archive data
  202. # X1
  203. 0 string X1 X1 archive data
  204. 0 string XhDr X1 archive data
  205. # CDC Codec (.dqt)
  206. 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
  207. # AMGC
  208. 0 string \xad6" AMGC archive data
  209. # NuLIB
  210. 0 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
  211. # PakLeo
  212. 0 string LEOLZW PAKLeo archive data
  213. # ChArc
  214. 0 string SChF ChArc archive data
  215. # PSA
  216. 0 string PSA PSA archive data
  217. # CrossePAC
  218. 0 string DSIGDCC CrossePAC archive data
  219. # Freeze
  220. 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
  221. # KBoom
  222. 0 string \xc2\xa8MP\xc2\xa8 KBoom archive data
  223. # NSQ, must go after CDC Codec
  224. 0 string \x76\xff NSQ archive data
  225. # DPA
  226. 0 string Dirk\ Paehl DPA archive data
  227. # BA
  228. # TODO: idarc says "bytes 0-2 == bytes 3-5"
  229. # TTComp
  230. 0 string \0\6 TTComp archive data
  231. # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
  232. 0 string ESP ESP archive data
  233. # ZPack
  234. 0 string \1ZPK\1 ZPack archive data
  235. # Sky
  236. 0 string \xbc\x40 Sky archive data
  237. # UFA
  238. 0 string UFA UFA archive data
  239. # Dry
  240. 0 string =-H2O DRY archive data
  241. # FoxSQZ
  242. 0 string FOXSQZ FoxSQZ archive data
  243. # AR7
  244. 0 string ,AR7 AR7 archive data
  245. # PPMZ
  246. 0 string PPMZ PPMZ archive data
  247. # MS Compress
  248. 4 string \x88\xf0\x27 MS Compress archive data
  249. # updated by Joerg Jenderek
  250. >9 string \0
  251. >>0 string KWAJ
  252. >>>7 string \321\003 MS Compress archive data
  253. >>>>14 ulong >0 \b, original size: %ld bytes
  254. >>>>18 ubyte >0x65
  255. >>>>>18 string x \b, was %.8s
  256. >>>>>(10.b-4) string x \b.%.3s
  257. # MP3 (archiver, not lossy audio compression)
  258. 0 string MP3\x1a MP3-Archiver archive data
  259. # ZET
  260. 0 string OZ\xc3\x9d ZET archive data
  261. # TSComp
  262. 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
  263. # ARQ
  264. 0 string gW\4\1 ARQ archive data
  265. # Squash
  266. 3 string OctSqu Squash archive data
  267. # Terse
  268. 0 string \5\1\1\0 Terse archive data
  269. # PUCrunch
  270. 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
  271. # UHarc
  272. 0 string UHA UHarc archive data
  273. # ABComp
  274. 0 string \2AB ABComp archive data
  275. 0 string \3AB2 ABComp archive data
  276. # CMP
  277. 0 string CO\0 CMP archive data
  278. # Splint
  279. 0 string \x93\xb9\x06 Splint archive data
  280. # InstallShield
  281. 0 string \x13\x5d\x65\x8c InstallShield Z archive Data
  282. # Gather
  283. 1 string GTH Gather archive data
  284. # BOA
  285. 0 string BOA BOA archive data
  286. # RAX
  287. 0 string ULEB\xa RAX archive data
  288. # Xtreme
  289. 0 string ULEB\0 Xtreme archive data
  290. # Pack Magic
  291. 0 string @\xc3\xa2\1\0 Pack Magic archive data
  292. # BTS
  293. 0 belong&0xfeffffff 0x1a034465 BTS archive data
  294. # ELI 5750
  295. 0 string Ora\ ELI 5750 archive data
  296. # QFC
  297. 0 string \x1aFC\x1a QFC archive data
  298. 0 string \x1aQF\x1a QFC archive data
  299. # PRO-PACK
  300. 0 string RNC PRO-PACK archive data
  301. # 777
  302. 0 string 777 777 archive data
  303. # LZS221
  304. 0 string sTaC LZS221 archive data
  305. # HPA
  306. 0 string HPA HPA archive data
  307. # Arhangel
  308. 0 string LG Arhangel archive data
  309. # EXP1, uses bzip2
  310. 0 string 0123456789012345BZh EXP1 archive data
  311. # IMP
  312. 0 string IMP\xa IMP archive data
  313. # NRV
  314. 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data
  315. # Squish
  316. 0 string \x73\xb2\x90\xf4 Squish archive data
  317. # Par
  318. 0 string PHILIPP Par archive data
  319. 0 string PAR Par archive data
  320. # HIT
  321. 0 string UB HIT archive data
  322. # SBX
  323. 0 belong&0xfffff000 0x53423000 SBX archive data
  324. # NaShrink
  325. 0 string NSK NaShrink archive data
  326. # SAPCAR
  327. 0 string #\ CAR\ archive\ header SAPCAR archive data
  328. 0 string CAR\ 2.00RG SAPCAR archive data
  329. # Disintegrator
  330. 0 string DST Disintegrator archive data
  331. # ASD
  332. 0 string ASD ASD archive data
  333. # InstallShield CAB
  334. 0 string ISc( InstallShield CAB
  335. # TOP4
  336. 0 string T4\x1a TOP4 archive data
  337. # BatComp left out: sig looks like COM executable
  338. # so TODO: get real 4dos batcomp file and find sig
  339. # BlakHole
  340. 0 string BH\5\7 BlakHole archive data
  341. # BIX
  342. 0 string BIX0 BIX archive data
  343. # ChiefLZA
  344. 0 string ChfLZ ChiefLZA archive data
  345. # Blink
  346. 0 string Blink Blink archive data
  347. # Logitech Compress
  348. 0 string \xda\xfa Logitech Compress archive data
  349. # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
  350. 1 string (C)\ STEPANYUK ARS-Sfx archive data
  351. # AKT/AKT32
  352. 0 string AKT32 AKT32 archive data
  353. 0 string AKT AKT archive data
  354. # NPack
  355. 0 string MSTSM NPack archive data
  356. # PFT
  357. 0 string \0\x50\0\x14 PFT archive data
  358. # SemOne
  359. 0 string SEM SemOne archive data
  360. # PPMD
  361. 0 string \x8f\xaf\xac\x84 PPMD archive data
  362. # FIZ
  363. 0 string FIZ FIZ archive data
  364. # MSXiE
  365. 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data
  366. # DeepFreezer
  367. 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data
  368. # DC
  369. 0 string =<DC- DC archive data
  370. # TPac
  371. 0 string \4TPAC\3 TPac archive data
  372. # Ai
  373. 0 string Ai\1\1\0 Ai archive data
  374. 0 string Ai\1\0\0 Ai archive data
  375. # Ai32
  376. 0 string Ai\2\0 Ai32 archive data
  377. 0 string Ai\2\1 Ai32 archive data
  378. # SBC
  379. 0 string SBC SBC archive data
  380. # Ybs
  381. 0 string YBS Ybs archive data
  382. # DitPack
  383. 0 string \x9e\0\0 DitPack archive data
  384. # DMS
  385. 0 string DMS! DMS archive data
  386. # EPC
  387. 0 string \x8f\xaf\xac\x8c EPC archive data
  388. # VSARC
  389. 0 string VS\x1a VSARC archive data
  390. # PDZ
  391. 0 string PDZ PDZ archive data
  392. # ReDuq
  393. 0 string rdqx ReDuq archive data
  394. # GCA
  395. 0 string GCAX GCA archive data
  396. # PPMN
  397. 0 string pN PPMN archive data
  398. # WinImage
  399. 3 string WINIMAGE WinImage archive data
  400. # Compressia
  401. 0 string CMP0CMP Compressia archive data
  402. # UHBC
  403. 0 string UHB UHBC archive data
  404. # WinHKI
  405. 0 string \x61\x5C\x04\x05 WinHKI archive data
  406. # WWPack data file
  407. 0 string WWP WWPack archive data
  408. # BSN (BSA, PTS-DOS)
  409. 0 string \xffBSG BSN archive data
  410. 1 string \xffBSG BSN archive data
  411. 3 string \xffBSG BSN archive data
  412. 1 string \0\xae\2 BSN archive data
  413. 1 string \0\xae\3 BSN archive data
  414. 1 string \0\xae\7 BSN archive data
  415. # AIN
  416. 0 string \x33\x18 AIN archive data
  417. 0 string \x33\x17 AIN archive data
  418. # XPA32
  419. 0 string xpa\0\1 XPA32 archive data
  420. # SZip (TODO: doesn't catch all versions)
  421. 0 string SZ\x0a\4 SZip archive data
  422. # XPack DiskImage
  423. 0 string jm XPack DiskImage archive data
  424. # XPack Data
  425. 0 string xpa XPack archive data
  426. # XPack Single Data
  427. 0 string \xc3\x8d\ jm XPack single archive data
  428. # TODO: missing due to unknown magic/magic at end of file:
  429. #DWC
  430. #ARG
  431. #ZAR
  432. #PC/3270
  433. #InstallIt
  434. #RKive
  435. #RK
  436. #XPack Diskimage
  437. # These were inspired by idarc, but actually verified
  438. # Dzip archiver (.dz)
  439. 0 string DZ Dzip archive data
  440. >2 byte x \b, version %i
  441. >3 byte x \b.%i
  442. # ZZip archiver (.zz)
  443. 0 string ZZ\ \0\0 ZZip archive data
  444. 0 string ZZ0 ZZip archive data
  445. # PAQ archiver (.paq)
  446. 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
  447. 0 string PAQ PAQ archive data
  448. >3 byte&0xf0 0x30
  449. >>3 byte x (v%c)
  450. # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
  451. 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
  452. 0 string JARCS JAR (ARJ Software, Inc.) archive data
  453. # ARJ archiver (jason@jarthur.Claremont.EDU)
  454. 0 leshort 0xea60 ARJ archive data
  455. !:mime application/x-arj
  456. >5 byte x \b, v%d,
  457. >8 byte &0x04 multi-volume,
  458. >8 byte &0x10 slash-switched,
  459. >8 byte &0x20 backup,
  460. >34 string x original name: %s,
  461. >7 byte 0 os: MS-DOS
  462. >7 byte 1 os: PRIMOS
  463. >7 byte 2 os: Unix
  464. >7 byte 3 os: Amiga
  465. >7 byte 4 os: Macintosh
  466. >7 byte 5 os: OS/2
  467. >7 byte 6 os: Apple ][ GS
  468. >7 byte 7 os: Atari ST
  469. >7 byte 8 os: NeXT
  470. >7 byte 9 os: VAX/VMS
  471. >3 byte >0 %d]
  472. # [JW] idarc says this is also possible
  473. 2 leshort 0xea60 ARJ archive data
  474. # HA archiver (Greg Roelofs, newt@uchicago.edu)
  475. # This is a really bad format. A file containing HAWAII will match this...
  476. #0 string HA HA archive data,
  477. #>2 leshort =1 1 file,
  478. #>2 leshort >1 %u files,
  479. #>4 byte&0x0f =0 first is type CPY
  480. #>4 byte&0x0f =1 first is type ASC
  481. #>4 byte&0x0f =2 first is type HSC
  482. #>4 byte&0x0f =0x0e first is type DIR
  483. #>4 byte&0x0f =0x0f first is type SPECIAL
  484. # suggestion: at least identify small archives (<1024 files)
  485. 0 belong&0xffff00fc 0x48410000 HA archive data
  486. >2 leshort =1 1 file,
  487. >2 leshort >1 %u files,
  488. >4 byte&0x0f =0 first is type CPY
  489. >4 byte&0x0f =1 first is type ASC
  490. >4 byte&0x0f =2 first is type HSC
  491. >4 byte&0x0f =0x0e first is type DIR
  492. >4 byte&0x0f =0x0f first is type SPECIAL
  493. # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
  494. 0 string HPAK HPACK archive data
  495. # JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
  496. 0 string \351,\001JAM\ JAM archive,
  497. >7 string >\0 version %.4s
  498. >0x26 byte =0x27 -
  499. >>0x2b string >\0 label %.11s,
  500. >>0x27 lelong x serial %08x,
  501. >>0x36 string >\0 fstype %.8s
  502. # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
  503. 2 string -lh0- LHarc 1.x/ARX archive data [lh0]
  504. !:mime application/x-lharc
  505. 2 string -lh1- LHarc 1.x/ARX archive data [lh1]
  506. !:mime application/x-lharc
  507. 2 string -lz4- LHarc 1.x archive data [lz4]
  508. !:mime application/x-lharc
  509. 2 string -lz5- LHarc 1.x archive data [lz5]
  510. !:mime application/x-lharc
  511. # [never seen any but the last; -lh4- reported in comp.compression:]
  512. 2 string -lzs- LHa/LZS archive data [lzs]
  513. !:mime application/x-lha
  514. 2 string -lh\40- LHa 2.x? archive data [lh ]
  515. !:mime application/x-lha
  516. 2 string -lhd- LHa 2.x? archive data [lhd]
  517. !:mime application/x-lha
  518. 2 string -lh2- LHa 2.x? archive data [lh2]
  519. !:mime application/x-lha
  520. 2 string -lh3- LHa 2.x? archive data [lh3]
  521. !:mime application/x-lha
  522. 2 string -lh4- LHa (2.x) archive data [lh4]
  523. !:mime application/x-lha
  524. 2 string -lh5- LHa (2.x) archive data [lh5]
  525. !:mime application/x-lha
  526. 2 string -lh6- LHa (2.x) archive data [lh6]
  527. !:mime application/x-lha
  528. 2 string -lh7- LHa (2.x)/LHark archive data [lh7]
  529. !:mime application/x-lha
  530. >20 byte x - header level %d
  531. # taken from idarc [JW]
  532. 2 string -lZ PUT archive data
  533. 2 string -lz LZS archive data
  534. 2 string -sw1- Swag archive data
  535. # RAR archiver (Greg Roelofs, newt@uchicago.edu)
  536. 0 string Rar! RAR archive data,
  537. !:mime application/x-rar
  538. >44 byte x v%0x,
  539. >10 byte >0 flags:
  540. >>10 byte &0x01 Archive volume,
  541. >>10 byte &0x02 Commented,
  542. >>10 byte &0x04 Locked,
  543. >>10 byte &0x08 Solid,
  544. >>10 byte &0x20 Authenticated,
  545. >35 byte 0 os: MS-DOS
  546. >35 byte 1 os: OS/2
  547. >35 byte 2 os: Win32
  548. >35 byte 3 os: Unix
  549. # some old version? idarc says:
  550. 0 string RE\x7e\x5e RAR archive data
  551. # SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
  552. 0 string SQSH squished archive data (Acorn RISCOS)
  553. # UC2 archiver (Greg Roelofs, newt@uchicago.edu)
  554. # [JW] see exe section for self-extracting version
  555. 0 string UC2\x1a UC2 archive data
  556. # PKZIP multi-volume archive
  557. 0 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract
  558. !:mime application/zip
  559. # Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
  560. 0 string PK\005\006 Zip archive data (empty)
  561. 0 string PK\003\004
  562. # Specialised zip formats which start with a member named 'mimetype'
  563. # (stored uncompressed, with no 'extra field') containing the file's MIME type.
  564. # Check for have 8-byte name, 0-byte extra field, name "mimetype", and
  565. # contents starting with "application/":
  566. >26 string \x8\0\0\0mimetypeapplication/
  567. # KOffice / OpenOffice & StarOffice / OpenDocument formats
  568. # From: Abel Cheung <abel@oaka.org>
  569. # KOffice (1.2 or above) formats
  570. # (mimetype contains "application/vnd.kde.<SUBTYPE>")
  571. >>50 string vnd.kde. KOffice (>=1.2)
  572. >>>58 string karbon Karbon document
  573. >>>58 string kchart KChart document
  574. >>>58 string kformula KFormula document
  575. >>>58 string kivio Kivio document
  576. >>>58 string kontour Kontour document
  577. >>>58 string kpresenter KPresenter document
  578. >>>58 string kspread KSpread document
  579. >>>58 string kword KWord document
  580. # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
  581. # (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
  582. >>50 string vnd.sun.xml. OpenOffice.org 1.x
  583. >>>62 string writer Writer
  584. >>>>68 byte !0x2e document
  585. >>>>68 string .template template
  586. >>>>68 string .global global document
  587. >>>62 string calc Calc
  588. >>>>66 byte !0x2e spreadsheet
  589. >>>>66 string .template template
  590. >>>62 string draw Draw
  591. >>>>66 byte !0x2e document
  592. >>>>66 string .template template
  593. >>>62 string impress Impress
  594. >>>>69 byte !0x2e presentation
  595. >>>>69 string .template template
  596. >>>62 string math Math document
  597. >>>62 string base Database file
  598. # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
  599. # http://lists.oasis-open.org/archives/office/200505/msg00006.html
  600. # (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
  601. >>50 string vnd.oasis.opendocument. OpenDocument
  602. >>>73 string text
  603. >>>>77 byte !0x2d Text
  604. !:mime application/vnd.oasis.opendocument.text
  605. >>>>77 string -template Text Template
  606. !:mime application/vnd.oasis.opendocument.text-template
  607. >>>>77 string -web HTML Document Template
  608. !:mime application/vnd.oasis.opendocument.text-web
  609. >>>>77 string -master Master Document
  610. !:mime application/vnd.oasis.opendocument.text-master
  611. >>>73 string graphics
  612. >>>>81 byte !0x2d Drawing
  613. !:mime application/vnd.oasis.opendocument.graphics
  614. >>>>81 string -template Template
  615. !:mime application/vnd.oasis.opendocument.graphics-template
  616. >>>73 string presentation
  617. >>>>85 byte !0x2d Presentation
  618. !:mime application/vnd.oasis.opendocument.presentation
  619. >>>>85 string -template Template
  620. !:mime application/vnd.oasis.opendocument.presentation-template
  621. >>>73 string spreadsheet
  622. >>>>84 byte !0x2d Spreadsheet
  623. !:mime application/vnd.oasis.opendocument.spreadsheet
  624. >>>>84 string -template Template
  625. !:mime application/vnd.oasis.opendocument.spreadsheet-template
  626. >>>73 string chart
  627. >>>>78 byte !0x2d Chart
  628. !:mime application/vnd.oasis.opendocument.chart
  629. >>>>78 string -template Template
  630. !:mime application/vnd.oasis.opendocument.chart-template
  631. >>>73 string formula
  632. >>>>80 byte !0x2d Formula
  633. !:mime application/vnd.oasis.opendocument.formula
  634. >>>>80 string -template Template
  635. !:mime application/vnd.oasis.opendocument.formula-template
  636. >>>73 string database Database
  637. !:mime application/vnd.oasis.opendocument.database
  638. >>>73 string image
  639. >>>>78 byte !0x2d Image
  640. !:mime application/vnd.oasis.opendocument.image
  641. >>>>78 string -template Template
  642. !:mime application/vnd.oasis.opendocument.image-template
  643. # EPUB (OEBPS) books using OCF (OEBPS Container Format)
  644. # http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
  645. # From: Ralf Brown <ralf.brown@gmail.com>
  646. >0x1E string mimetypeapplication/epub+zip EPUB document
  647. !:mime application/epub+zip
  648. # Catch other ZIP-with-mimetype formats
  649. # In a ZIP file, the bytes immediately after a member's contents are
  650. # always "PK". The 2 regex rules here print the "mimetype" member's
  651. # contents up to the first 'P'. Luckily, most MIME types don't contain
  652. # any capital 'P's. This is a kludge.
  653. # (mimetype contains "application/<OTHER>")
  654. >>50 string !epub+zip
  655. >>>50 string !vnd.oasis.opendocument.
  656. >>>>50 string !vnd.sun.xml.
  657. >>>>>50 string !vnd.kde.
  658. >>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
  659. !:mime application/zip
  660. # (mimetype contents other than "application/*")
  661. >26 string \x8\0\0\0mimetype
  662. >>38 string !application/
  663. >>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
  664. !:mime application/zip
  665. # Java Jar files
  666. >(26.s+30) leshort 0xcafe Java Jar file data (zip)
  667. !:mime application/jar
  668. # Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
  669. # Next line excludes specialized formats:
  670. >(26.s+30) leshort !0xcafe
  671. >>26 string !\x8\0\0\0mimetype Zip archive data
  672. !:mime application/zip
  673. >>>4 byte 0x09 \b, at least v0.9 to extract
  674. >>>4 byte 0x0a \b, at least v1.0 to extract
  675. >>>4 byte 0x0b \b, at least v1.1 to extract
  676. >>>4 byte 0x14 \b, at least v2.0 to extract
  677. >>>4 byte 0x2d \b, at least v3.0 to extract
  678. >>>0x161 string WINZIP \b, WinZIP self-extracting
  679. # StarView Metafile
  680. # From Pierre Ducroquet <pinaraf@pinaraf.info>
  681. 0 string VCLMTF StarView MetaFile
  682. >6 beshort x \b, version %d
  683. >8 belong x \b, size %d
  684. # Zoo archiver
  685. 20 lelong 0xfdc4a7dc Zoo archive data
  686. !:mime application/x-zoo
  687. >4 byte >48 \b, v%c.
  688. >>6 byte >47 \b%c
  689. >>>7 byte >47 \b%c
  690. >32 byte >0 \b, modify: v%d
  691. >>33 byte x \b.%d+
  692. >42 lelong 0xfdc4a7dc \b,
  693. >>70 byte >0 extract: v%d
  694. >>>71 byte x \b.%d+
  695. # Shell archives
  696. 10 string #\ This\ is\ a\ shell\ archive shell archive text
  697. !:mime application/octet-stream
  698. #
  699. # LBR. NB: May conflict with the questionable
  700. # "binary Computer Graphics Metafile" format.
  701. #
  702. 0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
  703. #
  704. # PMA (CP/M derivative of LHA)
  705. #
  706. 2 string -pm0- PMarc archive data [pm0]
  707. 2 string -pm1- PMarc archive data [pm1]
  708. 2 string -pm2- PMarc archive data [pm2]
  709. 2 string -pms- PMarc SFX archive (CP/M, DOS)
  710. 5 string -pc1- PopCom compressed executable (CP/M)
  711. # From Rafael Laboissiere <rafael@laboissiere.net>
  712. # The Project Revision Control System (see
  713. # http://prcs.sourceforge.net) generates a packaged project
  714. # file which is recognized by the following entry:
  715. 0 leshort 0xeb81 PRCS packaged project
  716. # Microsoft cabinets
  717. # by David Necas (Yeti) <yeti@physics.muni.cz>
  718. #0 string MSCF\0\0\0\0 Microsoft cabinet file data,
  719. #>25 byte x v%d
  720. #>24 byte x \b.%d
  721. # MPi: All CABs have version 1.3, so this is pointless.
  722. # Better magic in debian-additions.
  723. # GTKtalog catalogs
  724. # by David Necas (Yeti) <yeti@physics.muni.cz>
  725. 4 string gtktalog\ GTKtalog catalog data,
  726. >13 string 3 version 3
  727. >>14 beshort 0x677a (gzipped)
  728. >>14 beshort !0x677a (not gzipped)
  729. >13 string >3 version %s
  730. ############################################################################
  731. # Parity archive reconstruction file, the 'par' file format now used on Usenet.
  732. 0 string PAR\0 PARity archive data
  733. >48 leshort =0 - Index file
  734. >48 leshort >0 - file number %d
  735. # Felix von Leitner <felix-file@fefe.de>
  736. 0 string d8:announce BitTorrent file
  737. !:mime application/x-bittorrent
  738. # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
  739. 0 beshort 0x0e0f Atari MSA archive data
  740. >2 beshort x \b, %d sectors per track
  741. >4 beshort 0 \b, 1 sided
  742. >4 beshort 1 \b, 2 sided
  743. >6 beshort x \b, starting track: %d
  744. >8 beshort x \b, ending track: %d
  745. # Alternate ZIP string (amc@arwen.cs.berkeley.edu)
  746. 0 string PK00PK\003\004 Zip archive data
  747. # ACE archive (from http://www.wotsit.org/download.asp?f=ace)
  748. # by Stefan `Sec` Zehl <sec@42.org>
  749. 7 string **ACE** ACE archive data
  750. >15 byte >0 version %d
  751. >16 byte =0x00 \b, from MS-DOS
  752. >16 byte =0x01 \b, from OS/2
  753. >16 byte =0x02 \b, from Win/32
  754. >16 byte =0x03 \b, from Unix
  755. >16 byte =0x04 \b, from MacOS
  756. >16 byte =0x05 \b, from WinNT
  757. >16 byte =0x06 \b, from Primos
  758. >16 byte =0x07 \b, from AppleGS
  759. >16 byte =0x08 \b, from Atari
  760. >16 byte =0x09 \b, from Vax/VMS
  761. >16 byte =0x0A \b, from Amiga
  762. >16 byte =0x0B \b, from Next
  763. >14 byte x \b, version %d to extract
  764. >5 leshort &0x0080 \b, multiple volumes,
  765. >>17 byte x \b (part %d),
  766. >5 leshort &0x0002 \b, contains comment
  767. >5 leshort &0x0200 \b, sfx
  768. >5 leshort &0x0400 \b, small dictionary
  769. >5 leshort &0x0800 \b, multi-volume
  770. >5 leshort &0x1000 \b, contains AV-String
  771. >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered)
  772. >5 leshort &0x2000 \b, with recovery record
  773. >5 leshort &0x4000 \b, locked
  774. >5 leshort &0x8000 \b, solid
  775. # Date in MS-DOS format (whatever that is)
  776. #>18 lelong x Created on
  777. # sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
  778. # <doj@cubic.org>
  779. 0x1A string sfArk sfArk compressed Soundfont
  780. >0x15 string 2
  781. >>0x1 string >\0 Version %s
  782. >>0x2A string >\0 : %s
  783. # DR-DOS 7.03 Packed File *.??_
  784. 0 string Packed\ File\ Personal NetWare Packed File
  785. >12 string x \b, was "%.12s"
  786. # EET archive
  787. # From: Tilman Sauerbeck <tilman@code-monkey.de>
  788. 0 belong 0x1ee7ff00 EET archive
  789. !:mime application/x-eet
  790. # rzip archives
  791. 0 string RZIP rzip compressed data
  792. >4 byte x - version %d
  793. >5 byte x \b.%d
  794. >6 belong x (%d bytes)
  795. # From: "Robert Dale" <robdale@gmail.com>
  796. 0 belong 123 dar archive,
  797. >4 belong x label "%.8x
  798. >>8 belong x %.8x
  799. >>>12 beshort x %.4x"
  800. >14 byte 0x54 end slice
  801. >14 beshort 0x4e4e multi-part
  802. >14 beshort 0x4e53 multi-part, with -S
  803. # Symbian installation files
  804. # http://www.thouky.co.uk/software/psifs/sis.html
  805. # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
  806. 8 lelong 0x10000419 Symbian installation file
  807. !:mime application/vnd.symbian.install
  808. >4 lelong 0x1000006D (EPOC release 3/4/5)
  809. >4 lelong 0x10003A12 (EPOC release 6)
  810. 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x)
  811. !:mime x-epoc/x-sisx-app
  812. # From "Nelson A. de Oliveira" <naoliv@gmail.com>
  813. 0 string MPQ\032 MoPaQ (MPQ) archive
  814. # From: Dirk Jagdmann <doj@cubic.org>
  815. # xar archive format: http://code.google.com/p/xar/
  816. 0 string xar! xar archive
  817. >6 beshort x - version %ld
  818. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  819. # .kgb
  820. 0 string KGB_arch KGB Archiver file
  821. >10 string x with compression level %.1s
  822. # xar (eXtensible ARchiver) archive
  823. # From: "David Remahl" <dremahl@apple.com>
  824. 0 string xar! xar archive
  825. #>4 beshort x header size %d
  826. >6 beshort x version %d,
  827. #>8 quad x compressed TOC: %d,
  828. #>16 quad x uncompressed TOC: %d,
  829. >24 belong 0 no checksum
  830. >24 belong 1 SHA-1 checksum
  831. >24 belong 2 MD5 checksum
  832. # Type: Parity Archive
  833. # From: Daniel van Eeden <daniel_e@dds.nl>
  834. 0 string PAR2 Parity Archive Volume Set
  835. # Bacula volume format. (Volumes always start with a block header.)
  836. # URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
  837. # From: Adam Buchbinder <adam.buchbinder@gmail.com>
  838. 12 string BB02 Bacula volume
  839. >20 bedate x \b, started %s
  840. # ePub is XHTML + XML inside a ZIP archive. The first member of the
  841. # archive must be an uncompressed file called 'mimetype' with contents
  842. # 'application/epub+zip'
  843. # From: "Michael Gorny" <mgorny@gentoo.org>
  844. # ZPAQ: http://mattmahoney.net/dc/zpaq.html
  845. 0 string zPQ ZPAQ stream
  846. >3 byte x \b, level %d
  847. # BBeB ebook, unencrypted (LRF format)
  848. # URL: http://www.sven.de/librie/Librie/LrfFormat
  849. # From: Adam Buchbinder <adam.buchbinder@gmail.com>
  850. 0 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted
  851. >8 beshort x \b, version %d
  852. >36 byte 1 \b, front-to-back
  853. >36 byte 16 \b, back-to-front
  854. >42 beshort x \b, (%dx,
  855. >44 beshort x %d)