filesystems 77 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979
  1. #------------------------------------------------------------------------------
  2. # $File: filesystems,v 1.76 2013/02/18 18:45:41 christos Exp $
  3. # filesystems: file(1) magic for different filesystems
  4. #
  5. 0 string \366\366\366\366 PC formatted floppy with no filesystem
  6. # Sun disk labels
  7. # From /usr/include/sun/dklabel.h:
  8. 0774 beshort 0xdabe
  9. # modified by Joerg Jenderek, because original test
  10. # succeeds for Cabinet archive dao360.dl_ with negative blocks
  11. >0770 long >0 Sun disk label
  12. >>0 string x '%s
  13. >>>31 string >\0 \b%s
  14. >>>>63 string >\0 \b%s
  15. >>>>>95 string >\0 \b%s
  16. >>0 string x \b'
  17. >>0734 short >0 %d rpm,
  18. >>0736 short >0 %d phys cys,
  19. >>0740 short >0 %d alts/cyl,
  20. >>0746 short >0 %d interleave,
  21. >>0750 short >0 %d data cyls,
  22. >>0752 short >0 %d alt cyls,
  23. >>0754 short >0 %d heads/partition,
  24. >>0756 short >0 %d sectors/track,
  25. >>0764 long >0 start cyl %ld,
  26. >>0770 long x %ld blocks
  27. # Is there a boot block written 1 sector in?
  28. >512 belong&077777777 0600407 \b, boot block present
  29. # Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
  30. # (http://btmgr.sourceforge.net/docs/user-guide-3.html)
  31. 0 string SBMBAKUP_ Smart Boot Manager backup file
  32. >9 string x \b, version %-5.5s
  33. >>14 string =_
  34. >>>15 string x %-.1s
  35. >>>>16 string =_ \b.
  36. >>>>>17 string x \b%-.1s
  37. >>>>>>18 string =_ \b.
  38. >>>>>>>19 string x \b%-.1s
  39. >>>22 ubyte 0
  40. >>>>21 ubyte x \b, from drive 0x%x
  41. >>>22 ubyte >0
  42. >>>>21 string x \b, from drive %s
  43. >>>535 search/17 \x55\xAA
  44. >>>>&-512 indirect x \b; contains
  45. # updated by Joerg Jenderek at Nov 2012
  46. # DOS Emulator image is 128 byte, null right padded header + harddisc image
  47. 0 string DOSEMU\0
  48. >0x27E leshort 0xAA55
  49. #offset is 128
  50. >>19 ubyte 128
  51. >>>(19.b-1) ubyte 0x0 DOS Emulator image
  52. >>>>7 ulelong >0 \b, %u heads
  53. >>>>11 ulelong >0 \b, %d sectors/track
  54. >>>>15 ulelong >0 \b, %d cylinders
  55. >>>>128 indirect x \b; contains
  56. # x86 boot sector updated by Joerg Jenderek at Sep 2007,May 2011
  57. # for any allowed sector sizes
  58. 30 search/481 \x55\xAA
  59. # to display x86 boot sector (40) before old one (strength=50), SYSLINUX MBR (?) and DOS BPB information (71) like in previous file version
  60. !:strength +30
  61. # for sector sizes < 512 Bytes
  62. >11 uleshort <512
  63. >>(11.s-2) uleshort 0xAA55 x86 boot sector
  64. # for sector sizes with 512 or more Bytes
  65. >0x1FE leshort 0xAA55 x86 boot sector
  66. # keep old x86 boot sector as dummy for mbr and bootloader displaying
  67. # only for sector sizes with 512 or more Bytes
  68. 0x1FE leshort 0xAA55
  69. # to display information (51) before DOS BPB (strength=71) and after DOS floppy (120) like in old file version
  70. !:strength +21
  71. >2 string OSBS \b, OS/BS MBR
  72. # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
  73. # and http://en.wikipedia.org/wiki/Master_Boot_Record
  74. # test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
  75. # characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
  76. >0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR
  77. # Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
  78. # assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
  79. >>8 ubequad 0x8bf45007501ffbfc
  80. # http://thestarman.pcministry.com/asm/mbr/200MBR.htm
  81. >>>0x16 ubyte 0xF3 \b,DOS 2
  82. >>>>219 regex Author\ -\ Author:
  83. # found "David Litton" , "A Pehrsson "
  84. >>>>>&0 string x "%s"
  85. >>>0x16 ubyte 0xF2
  86. # NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
  87. # assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
  88. >>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3
  89. # version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
  90. >>>>0x22 default x \b,D0S version 3.3-7.0
  91. # error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
  92. # where nn is string offset varying for different languages
  93. # "Invalid partition table" nn=0x8b for english version
  94. >>>>>(0x49.b) string Invalid\ partition\ table english
  95. >>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german
  96. >>>>>(0x49.b) string Table\ de\ partition\ invalide french
  97. >>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese
  98. >>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish
  99. >>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian
  100. >>>>>0x49 ubyte >0 at offset 0x%x
  101. >>>>>>(0x49.b) string >\0 "%s"
  102. # "Error loading operating system" nn=0xa3 for english version
  103. # "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version
  104. # "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version
  105. # "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version
  106. # "Error al cargar sistema operativo" nn=0xa8 for spanish version
  107. # "Errore durante il caricamento del sistema operativo" nn=0xae for italian version
  108. >>>>>0x74 ubyte >0 at offset 0x%x
  109. >>>>>>(0x74.b) string >\0 "%s"
  110. # "Missing operating system" nn=0xc2 for english version
  111. # "Betriebssystem fehlt" nn=0xcd for german version
  112. # "Syst\212me d'exploitation absent" nn=0xd2 for french version
  113. # "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version
  114. # "Falta sistema operativo" nn=0xca for spanish version
  115. # "Sistema operativo mancante" nn=0xe2 for italian version
  116. >>>>>0x79 ubyte >0 at offset 0x%x
  117. >>>>>>(0x79.b) string >\0 "%s"
  118. # Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
  119. # assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b
  120. >>8 ubequad 0x5007501ffcbe1b7c
  121. # assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
  122. >>>24 ubequad 0xf3a4cbbebe07b104 9M
  123. # "Invalid partition table" nn=0x10F for english version
  124. # "Ungültige Partitionstabelle" nn=0x10F for german version
  125. # "Table de partition erronée" nn=0x10F for french version
  126. # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version
  127. >>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english
  128. >>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german
  129. >>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french
  130. >>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian
  131. >>>>0x3C ubyte x at offset 0x%x+0xFF
  132. >>>>(0x3C.b+0x0FF) string >\0 "%s"
  133. # "Error loading operating system" nn=0x127 for english version
  134. # "Fehler beim Laden des Betriebssystems" nn=0x12b for german version
  135. # "Erreur lors du chargement du système d'exploitation" nn=0x12a for french version
  136. # "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version
  137. >>>>0xBD ubyte x at offset 0x1%x
  138. >>>>(0xBD.b+0x100) string >\0 "%s"
  139. # "Missing operating system" nn=0x146 for english version
  140. # "Betriebssystem fehlt" nn=0x151 for german version
  141. # "Système d'exploitation manquant" nn=0x15e for french version
  142. # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version
  143. >>>>0xA9 ubyte x at offset 0x1%x
  144. >>>>(0xA9.b+0x100) string >\0 "%s"
  145. # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
  146. # assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
  147. >>>24 ubequad 0xf3a4cbbdbe07b104 XP
  148. # where xxyyzz are lower bits from offsets of error messages varying for different languages
  149. >>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english
  150. >>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german
  151. # "Invalid partition table" xx=0x12C for english version
  152. # "Ungültige Partitionstabelle" xx=0x12C for german version
  153. >>>>0x1b5 ubyte >0 at offset 0x1%x
  154. >>>>(0x1b5.b+0x100) string >\0 "%s"
  155. # "Error loading operating system" yy=0x144 for english version
  156. # "Fehler beim Laden des Betriebssystems" yy=0x148 for german version
  157. >>>>0x1b6 ubyte >0 at offset 0x1%x
  158. >>>>(0x1b6.b+0x100) string >\0 "%s"
  159. # "Missing operating system" zz=0x163 for english version
  160. # "Betriebssystem nicht vorhanden" zz=0x16e for german version
  161. >>>>0x1b7 ubyte >0 at offset 0x1%x
  162. >>>>(0x1b7.b+0x100) string >\0 "%s"
  163. # Microsoft Windows Vista or 7
  164. # assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
  165. >>8 ubequad 0xc08ed8be007cbf00
  166. # Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
  167. # assembler instructions: jnz 0729;cmp ebx,"TCPA"
  168. >>>0xEC ubequad 0x753b6681fb544350 Vista
  169. # where xxyyzz are lower bits from offsets of error messages varying for different languages
  170. >>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english
  171. #>>>>0x1B4 ubelong&0x00FFFFFF ? german
  172. # "Invalid partition table" xx=0x162 for english version
  173. # "Ungültige Partitionstabelle" xx=0x1?? for german version
  174. >>>>0x1b5 ubyte >0 at offset 0x1%x
  175. >>>>(0x1b5.b+0x100) string >\0 "%s"
  176. # "Error loading operating system" yy=0x17a for english version
  177. # "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version
  178. >>>>0x1b6 ubyte >0 at offset 0x1%x
  179. >>>>(0x1b6.b+0x100) string >\0 "%s"
  180. # "Missing operating system" zz=0x199 for english version
  181. # "Betriebssystem nicht vorhanden" zz=0x1?? for german version
  182. >>>>0x1b7 ubyte >0 at offset 0x1%x
  183. >>>>(0x1b7.b+0x100) string >\0 "%s"
  184. # Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
  185. # assembler instructions: cmp ebx,"TCPA";cmp
  186. >>>0xEC ubequad 0x6681fb5443504175 Windows 7
  187. # where xxyyzz are lower bits from offsets of error messages varying for different languages
  188. >>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english
  189. #>>>>0x1B4 ubelong&0x00FFFFFF ? german
  190. # "Invalid partition table" xx=0x163 for english version
  191. # "Ungültige Partitionstabelle" xx=0x1?? for german version
  192. >>>>0x1b5 ubyte >0 at offset 0x1%x
  193. >>>>(0x1b5.b+0x100) string >\0 "%s"
  194. # "Error loading operating system" yy=0x17b for english version
  195. # "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version
  196. >>>>0x1b6 ubyte >0 at offset 0x1%x
  197. >>>>(0x1b6.b+0x100) string >\0 "%s"
  198. # "Missing operating system" zz=0x19a for english version
  199. # "Betriebssystem nicht vorhanden" zz=0x1?? for german version
  200. >>>>0x1b7 ubyte >0 at offset 0x1%x
  201. >>>>(0x1b7.b+0x100) string >\0 "%s"
  202. # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
  203. # http://en.wikipedia.org/wiki/MBR_disk_signature#ID
  204. >>0x1b8 ulelong >0 \b, disk signature 0x%-.4x
  205. # driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm
  206. >>0xDA uleshort 0
  207. >>>0xDC ulelong >0 \b, created
  208. # physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
  209. >>>>0xDC ubyte x with driveID 0x%x
  210. # hours, minutes and seconds
  211. >>>>0xDf ubyte x at %x
  212. >>>>0xDe ubyte x \b:%x
  213. >>>>0xDd ubyte x \b:%x
  214. # special case for Microsoft MS-DOS 3.21 spanish
  215. # assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
  216. >0 ubequad 0xfab830008ed0bc00
  217. # assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
  218. >>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish
  219. # Microsoft MBR IPL end
  220. # dr-dos with some upper-, lowercase variants
  221. >0x9D string Invalid\ partition\ table$
  222. >>181 string No\ Operating\ System$
  223. >>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
  224. >0x9D string Invalid\ partition\ table$
  225. >>181 string No\ operating\ system$
  226. >>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
  227. >342 string Invalid\ partition\ table$
  228. >>366 string No\ operating\ system$
  229. >>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
  230. >295 string NEWLDR\0
  231. >>302 string Bad\ PT\ $
  232. >>>310 string No\ OS\ $
  233. >>>>317 string OS\ load\ err$
  234. >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
  235. >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
  236. >>>>>>>387 string Copyright\ (c)\ 1984,1998
  237. >>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
  238. #
  239. # tests for different MS-DOS Master Boot Records (MBR) moved and merged
  240. #
  241. #>0x145 string Default:\ F \b, FREE-DOS MBR
  242. #>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR
  243. >0x145 search/7 Default:\ F \b, FREE-DOS MBR
  244. #>>313 string F0\ .\ .\ .
  245. #>>>322 string disk\ 1
  246. #>>>>382 string FAT3
  247. >64 string no\ active\ partition\ found
  248. >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
  249. # Ranish Partition Manager http://www.ranish.com/part/
  250. >387 search/4 \0\ Error!\r
  251. >>378 search/7 Virus!
  252. >>>397 search/4 Booting\
  253. >>>>408 search/4 HD1/\0 \b, Ranish MBR (
  254. >>>>>416 string Writing\ changes... \b2.37
  255. >>>>>>438 ubyte x \b,0x%x dots
  256. >>>>>>440 ubyte >0 \b,virus check
  257. >>>>>>441 ubyte >0 \b,partition %c
  258. #2.38,2.42,2.44
  259. >>>>>416 string !Writing\ changes... \b
  260. >>>>>>418 ubyte 1 \bvirus check,
  261. >>>>>>419 ubyte x \b0x%x seconds
  262. >>>>>>420 ubyte&0x0F >0 \b,partition
  263. >>>>>>>420 ubyte&0x0F <5 \b %x
  264. >>>>>>>420 ubyte&0x0F 0Xf \b ask
  265. >>>>>420 ubyte x \b)
  266. #
  267. # SYSLINUX MBR moved
  268. # http://www.acronis.de/
  269. >362 string MBR\ Error\ \0\r
  270. >>376 string ress\ any\ key\ to\
  271. >>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
  272. # added by Joerg Jenderek
  273. # http://www.visopsys.org/
  274. # http://partitionlogic.org.uk/
  275. >309 string No\ bootable\ partition\ found\r
  276. >>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
  277. >349 string No\ bootable\ partition\ found\r
  278. >>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
  279. # bootloader, bootmanager
  280. >0x40 string SBML
  281. # label with 11 characters of FAT 12 bit filesystem
  282. >>43 string SMART\ BTMGR
  283. >>>430 string SBMK\ Bad!\r \b, Smart Boot Manager
  284. # OEM-ID not always "SBM"
  285. #>>>>3 strings SBM
  286. >>>>6 string >\0 \b, version %s
  287. >382 string XOSLLOADXCF \b, eXtended Operating System Loader
  288. >6 string LILO \b, LInux i386 boot LOader
  289. >>120 string LILO \b, version 22.3.4 SuSe
  290. >>172 string LILO \b, version 22.5.8 Debian
  291. # updated by Joerg Jenderek at Oct 2008
  292. # variables according to grub-0.97/stage1/stage1.S or
  293. # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
  294. # usual values are marked with comments to get only informations of strange GRUB loaders
  295. >342 search/60 \0Geom\0
  296. #>0 ulelong x %x=0x009048EB , 0x2a9048EB 0
  297. >>0x41 ubyte <2
  298. >>>0x3E ubyte >2 \b; GRand Unified Bootloader
  299. # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
  300. >>>>0x3E ubyte x \b, stage1 version 0x%x
  301. #If it is 0xFF, use a drive passed by BIOS
  302. >>>>0x40 ubyte <0xFF \b, boot drive 0x%x
  303. # in most case 0,1,0x2e for GRUB 0.5.95
  304. >>>>0x41 ubyte >0 \b, LBA flag 0x%x
  305. >>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x
  306. #>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual)
  307. >>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x
  308. #>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default)
  309. >>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x
  310. >>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x
  311. #>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual)
  312. >>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x
  313. >>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
  314. >>>>>394 string stage1 \b, GRUB version 0.5.95
  315. >>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
  316. >>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94
  317. >>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
  318. >>>>>377 string GRUB\ \0 \b, GRUB version 0.94
  319. >>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0
  320. >>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
  321. >>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
  322. >>>>>385 string GRUB\ \0 \b, GRUB version 0.97
  323. #unkown version
  324. >>>343 string Geom\0Read\0\ Error\0
  325. >>>>321 string Loading\ stage1.5 \b, GRUB version x.y
  326. >>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
  327. >>>>374 string GRUB\ \0 \b, GRUB version n.m
  328. # SYSLINUX bootloader moved
  329. >395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
  330. # http://www.bcdwb.de/bcdw/index_e.htm
  331. >3 string BCDL
  332. >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
  333. # mbr partition table entries
  334. # OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs
  335. >3 string !MS
  336. >>3 string !SYSLINUX
  337. >>>3 string !MTOOL
  338. >>>>3 string !NEWLDR
  339. >>>>>5 string !DOS
  340. # not FAT (32 bit)
  341. >>>>>>82 string !FAT32
  342. #not Linux kernel
  343. >>>>>>>514 string !HdrS
  344. #not BeOS
  345. >>>>>>>>422 string !Be\ Boot\ Loader
  346. # active flag 0 or 0x80 and type > 0
  347. >>>>>>>>>446 ubyte <0x81
  348. >>>>>>>>>>446 ubyte&0x7F 0
  349. >>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x
  350. >>>>>>>>>>>>446 ubyte 0x80 \b, active
  351. >>>>>>>>>>>>447 ubyte x \b, starthead %u
  352. #>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x
  353. #>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d
  354. >>>>>>>>>>>>454 ulelong x \b, startsector %u
  355. >>>>>>>>>>>>458 ulelong x \b, %u sectors
  356. #
  357. >>>>>>>>>462 ubyte <0x81
  358. >>>>>>>>>>462 ubyte&0x7F 0
  359. >>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x
  360. >>>>>>>>>>>>462 ubyte 0x80 \b, active
  361. >>>>>>>>>>>>463 ubyte x \b, starthead %u
  362. #>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x
  363. #>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d
  364. >>>>>>>>>>>>470 ulelong x \b, startsector %u
  365. >>>>>>>>>>>>474 ulelong x \b, %u sectors
  366. #
  367. >>>>>>>>>478 ubyte <0x81
  368. >>>>>>>>>>478 ubyte&0x7F 0
  369. >>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x
  370. >>>>>>>>>>>>478 ubyte 0x80 \b, active
  371. >>>>>>>>>>>>479 ubyte x \b, starthead %u
  372. #>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x
  373. #>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x
  374. #>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d
  375. >>>>>>>>>>>>486 ulelong x \b, startsector %u
  376. >>>>>>>>>>>>490 ulelong x \b, %u sectors
  377. #
  378. >>>>>>>>>494 ubyte <0x81
  379. >>>>>>>>>>494 ubyte&0x7F 0
  380. >>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x
  381. >>>>>>>>>>>>494 ubyte 0x80 \b, active
  382. >>>>>>>>>>>>495 ubyte x \b, starthead %u
  383. #>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x
  384. #>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d
  385. >>>>>>>>>>>>502 ulelong x \b, startsector %u
  386. >>>>>>>>>>>>506 ulelong x \b, %u sectors
  387. # mbr partition table entries end
  388. # http://www.acronis.de/
  389. #FAT label=ACRONIS\ SZ
  390. #OEM-ID=BOOTWIZ0
  391. >442 string Non-system\ disk,\
  392. >>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
  393. # updated by Joerg Jenderek at Nov 2012
  394. # DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
  395. >>>477 ubyte&0xDF >0
  396. >>>>477 string x \b %-.3s
  397. >>>>>480 ubyte&0xDF >0
  398. >>>>>>480 string x \b%-.4s
  399. >>>>>>>484 ubyte&0xDF >0
  400. >>>>>>>>484 string x \b%-.1s
  401. >>>>485 ubyte&0xDF >0
  402. >>>>>485 string x \b.%-.3s
  403. #
  404. >185 string FDBOOT\ Version\
  405. >>204 string \rNo\ Systemdisk.\
  406. >>>220 string Booting\ from\ harddisk.\n\r
  407. >>>245 string Cannot\ load\ from\ harddisk.\n\r
  408. >>>>273 string Insert\ Systemdisk\
  409. >>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
  410. >>>>>>200 string >\0 \b, version %-3s
  411. >242 string Bootsector\ from\ C.H.\ Hochst\204
  412. # http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c
  413. # updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
  414. # skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
  415. >242 search/127 Bootsector\ from\ C.H.\ Hochst
  416. >>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk
  417. # followed by variants with point,CR-NL or NL-CR
  418. >>>208 search/261 Cannot\ load\ from\ harddisk.
  419. # followed by variants CR-NL or NL-CR
  420. >>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key.
  421. # followed by variants with point,CR-NL or NL-CR
  422. >>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader
  423. # followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
  424. >>>>>>&0 string x \b, version %-4.4s
  425. >(1.b+2) ubyte 0xe
  426. >>(1.b+3) ubyte 0x1f
  427. >>>(1.b+4) ubyte 0xbe
  428. # message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
  429. >>>>(1.b+5) ubyte&0xd3 0x53
  430. >>>>>(1.b+6) ubyte 0x7c
  431. # assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
  432. >>>>>>(1.b+7) ubyte 0xac
  433. >>>>>>>(1.b+8) ubyte 0x22
  434. >>>>>>>>(1.b+9) ubyte 0xc0
  435. >>>>>>>>>(1.b+10) ubyte 0x74
  436. >>>>>>>>>>(1.b+11) ubyte 0x0b
  437. >>>>>>>>>>>(1.b+12) ubyte 0x56
  438. >>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
  439. # FAT1X version
  440. >>>>>>>>>>>>>(1.b+5) ubyte 0x5b
  441. >>>>>>>>>>>>>>0x5b string >\0 "%-s"
  442. # FAT32 version
  443. >>>>>>>>>>>>>(1.b+5) ubyte 0x77
  444. >>>>>>>>>>>>>>0x77 string >\0 "%-s"
  445. >214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display
  446. #>>244 string from\ dosemu-freedos-*-bin.tgz\r
  447. #>>>170 string Sorry,\ could\ not\ load\ an\
  448. #>>>>195 string operating\ system.\r\n
  449. #
  450. >103 string This\ is\ not\ a\ bootable\ disk.\
  451. >>132 string Please\ insert\ a\ bootable\
  452. >>>157 string floppy\ and\r\n
  453. >>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
  454. #
  455. >66 string Solaris\ Boot\ Sector
  456. >>99 string Incomplete\ MDBoot\ load.
  457. >>>89 string Version \b, Sun Solaris Bootloader
  458. >>>>97 byte x version %c
  459. #
  460. >408 string OS/2\ !!\ SYS01475\r\0
  461. >>429 string OS/2\ !!\ SYS02025\r\0
  462. >>>450 string OS/2\ !!\ SYS02027\r\0
  463. >>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
  464. #
  465. >409 string OS/2\ !!\ SYS01475\r\0
  466. >>430 string OS/2\ !!\ SYS02025\r\0
  467. >>>451 string OS/2\ !!\ SYS02027\r\0
  468. >>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
  469. >112 string This\ disk\ is\ not\ bootable\r
  470. >>142 string If\ you\ wish\ to\ make\ it\ bootable
  471. >>>176 string run\ the\ DOS\ program\ SYS\
  472. >>>200 string after\ the\r
  473. >>>>216 string system\ has\ been\ loaded\r\n
  474. >>>>>242 string Please\ insert\ a\ DOS\ diskette\
  475. >>>>>271 string into\r\n\ the\ drive\ and\
  476. >>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
  477. # XP
  478. >430 string NTLDR\ is\ missing\xFF\r\n
  479. >>449 string Disk\ error\xFF\r\n
  480. >>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
  481. # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
  482. >>>>417 ubyte&0xDF >0
  483. >>>>>417 string x %-.5s
  484. >>>>>>422 ubyte&0xDF >0
  485. >>>>>>>422 string x \b%-.3s
  486. >>>>>425 ubyte&0xDF >0
  487. >>>>>>425 string >\ \b.%-.3s
  488. #
  489. >>>>371 ubyte >0x20
  490. >>>>>368 ubyte&0xDF >0
  491. >>>>>>368 string x %-.5s
  492. >>>>>>>373 ubyte&0xDF >0
  493. >>>>>>>>373 string x \b%-.3s
  494. >>>>>>376 ubyte&0xDF >0
  495. >>>>>>>376 string x \b.%-.3s
  496. #
  497. >430 string NTLDR\ nicht\ gefunden\xFF\r\n
  498. >>453 string Datentr\204gerfehler\xFF\r\n
  499. >>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
  500. >>>>417 ubyte&0xDF >0
  501. >>>>>417 string x %-.5s
  502. >>>>>>422 ubyte&0xDF >0
  503. >>>>>>>422 string x \b%-.3s
  504. >>>>>425 ubyte&0xDF >0
  505. >>>>>>425 string >\ \b.%-.3s
  506. # offset variant
  507. >>>>379 string \0
  508. >>>>>368 ubyte&0xDF >0
  509. >>>>>>368 string x %-.5s
  510. >>>>>>>373 ubyte&0xDF >0
  511. >>>>>>>>373 string x \b%-.3s
  512. #
  513. >430 string NTLDR\ fehlt\xFF\r\n
  514. >>444 string Datentr\204gerfehler\xFF\r\n
  515. >>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
  516. >>>>417 ubyte&0xDF >0
  517. >>>>>417 string x %-.5s
  518. >>>>>>422 ubyte&0xDF >0
  519. >>>>>>>422 string x \b%-.3s
  520. >>>>>425 ubyte&0xDF >0
  521. >>>>>>425 string >\ \b.%-.3s
  522. # variant
  523. >>>>371 ubyte >0x20
  524. >>>>>368 ubyte&0xDF >0
  525. >>>>>>368 string x %-.5s
  526. >>>>>>>373 ubyte&0xDF >0
  527. >>>>>>>>373 string x \b%-.3s
  528. >>>>>>376 ubyte&0xDF >0
  529. >>>>>>>376 string x \b.%-.3s
  530. #
  531. >430 string NTLDR\ fehlt\xFF\r\n
  532. >>444 string Medienfehler\xFF\r\n
  533. >>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
  534. >>>>371 ubyte >0x20
  535. >>>>>368 ubyte&0xDF >0
  536. >>>>>>368 string x %-.5s
  537. >>>>>>>373 ubyte&0xDF >0
  538. >>>>>>>>373 string x \b%-.3s
  539. >>>>>>376 ubyte&0xDF >0
  540. >>>>>>>376 string x \b.%-.3s
  541. # variant
  542. >>>>417 ubyte&0xDF >0
  543. >>>>>417 string x %-.5s
  544. >>>>>>422 ubyte&0xDF >0
  545. >>>>>>>422 string x \b%-.3s
  546. >>>>>425 ubyte&0xDF >0
  547. >>>>>>425 string >\ \b.%-.3s
  548. #
  549. >430 string Datentr\204ger\ entfernen\xFF\r\n
  550. >>454 string Medienfehler\xFF\r\n
  551. >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
  552. >>>>379 string \0
  553. >>>>>368 ubyte&0xDF >0
  554. >>>>>>368 string x %-.5s
  555. >>>>>>>373 ubyte&0xDF >0
  556. >>>>>>>>373 string x \b%-.3s
  557. >>>>>>376 ubyte&0xDF >0
  558. >>>>>>>376 string x \b.%-.3s
  559. # variant
  560. >>>>417 ubyte&0xDF >0
  561. >>>>>417 string x %-.5s
  562. >>>>>>422 ubyte&0xDF >0
  563. >>>>>>>422 string x \b%-.3s
  564. >>>>>425 ubyte&0xDF >0
  565. >>>>>>425 string >\ \b.%-.3s
  566. #
  567. #>3 string NTFS\ \ \ \
  568. >389 string Fehler\ beim\ Lesen\
  569. >>407 string des\ Datentr\204gers
  570. >>>426 string NTLDR\ fehlt
  571. >>>>440 string NTLDR\ ist\ komprimiert
  572. >>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
  573. #>3 string NTFS\ \ \ \
  574. >313 string A\ disk\ read\ error\ occurred.\r
  575. >>345 string A\ kernel\ file\ is\ missing\
  576. >>>370 string from\ the\ disk.\r
  577. >>>>484 string NTLDR\ is\ compressed
  578. >>>>>429 string Insert\ a\ system\ diskette\
  579. >>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
  580. # DOS loader variants different languages,offsets
  581. >472 ubyte&0xDF >0
  582. >>389 string Invalid\ system\ disk\xFF\r\n
  583. >>>411 string Disk\ I/O\ error
  584. >>>>428 string Replace\ the\ disk,\ and\
  585. >>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
  586. #IO.SYS
  587. >>>>>>472 ubyte&0xDF >0
  588. >>>>>>>472 string x \b %-.2s
  589. >>>>>>>>474 ubyte&0xDF >0
  590. >>>>>>>>>474 string x \b%-.5s
  591. >>>>>>>>>>479 ubyte&0xDF >0
  592. >>>>>>>>>>>479 string x \b%-.1s
  593. >>>>>>>480 ubyte&0xDF >0
  594. >>>>>>>>480 string x \b.%-.3s
  595. #MSDOS.SYS
  596. >>>>>>>483 ubyte&0xDF >0 \b+
  597. >>>>>>>>483 string x \b%-.5s
  598. >>>>>>>>>488 ubyte&0xDF >0
  599. >>>>>>>>>>488 string x \b%-.3s
  600. >>>>>>>>491 ubyte&0xDF >0
  601. >>>>>>>>>491 string x \b.%-.3s
  602. #
  603. >>390 string Invalid\ system\ disk\xFF\r\n
  604. >>>412 string Disk\ I/O\ error\xFF\r\n
  605. >>>>429 string Replace\ the\ disk,\ and\
  606. >>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
  607. >>388 string Ungueltiges\ System\ \xFF\r\n
  608. >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
  609. >>>>427 string Datentraeger\ wechseln\ und\
  610. >>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
  611. #WINBOOT.SYS only not spaces (0xDF)
  612. >>>>>>497 ubyte&0xDF >0
  613. >>>>>>>497 string x %-.5s
  614. >>>>>>>>502 ubyte&0xDF >0
  615. >>>>>>>>>502 string x \b%-.1s
  616. >>>>>>>>>>503 ubyte&0xDF >0
  617. >>>>>>>>>>>503 string x \b%-.1s
  618. >>>>>>>>>>>>504 ubyte&0xDF >0
  619. >>>>>>>>>>>>>504 string x \b%-.1s
  620. >>>>>>505 ubyte&0xDF >0
  621. >>>>>>>505 string x \b.%-.3s
  622. #IO.SYS
  623. >>>>>>472 ubyte&0xDF >0 or
  624. >>>>>>>472 string x \b %-.2s
  625. >>>>>>>>474 ubyte&0xDF >0
  626. >>>>>>>>>474 string x \b%-.5s
  627. >>>>>>>>>>479 ubyte&0xDF >0
  628. >>>>>>>>>>>479 string x \b%-.1s
  629. >>>>>>>480 ubyte&0xDF >0
  630. >>>>>>>>480 string x \b.%-.3s
  631. #MSDOS.SYS
  632. >>>>>>>483 ubyte&0xDF >0 \b+
  633. >>>>>>>>483 string x \b%-.5s
  634. >>>>>>>>>488 ubyte&0xDF >0
  635. >>>>>>>>>>488 string x \b%-.3s
  636. >>>>>>>>491 ubyte&0xDF >0
  637. >>>>>>>>>491 string x \b.%-.3s
  638. #
  639. >>390 string Ungueltiges\ System\ \xFF\r\n
  640. >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
  641. >>>>429 string Datentraeger\ wechseln\ und\
  642. >>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
  643. #WINBOOT.SYS only not spaces (0xDF)
  644. >>>>>>497 ubyte&0xDF >0
  645. >>>>>>>497 string x %-.7s
  646. >>>>>>>>504 ubyte&0xDF >0
  647. >>>>>>>>>504 string x \b%-.1s
  648. >>>>>>505 ubyte&0xDF >0
  649. >>>>>>>505 string x \b.%-.3s
  650. #IO.SYS
  651. >>>>>>472 ubyte&0xDF >0 or
  652. >>>>>>>472 string x \b %-.2s
  653. >>>>>>>>474 ubyte&0xDF >0
  654. >>>>>>>>>474 string x \b%-.6s
  655. >>>>>>>480 ubyte&0xDF >0
  656. >>>>>>>>480 string x \b.%-.3s
  657. #MSDOS.SYS
  658. >>>>>>>483 ubyte&0xDF >0 \b+
  659. >>>>>>>>483 string x \b%-.5s
  660. >>>>>>>>>488 ubyte&0xDF >0
  661. >>>>>>>>>>488 string x \b%-.3s
  662. >>>>>>>>491 ubyte&0xDF >0
  663. >>>>>>>>>491 string x \b.%-.3s
  664. #
  665. >>389 string Ungueltiges\ System\ \xFF\r\n
  666. >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
  667. >>>>428 string Datentraeger\ wechseln\ und\
  668. >>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
  669. # DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
  670. >>>>>>472 string x %-.2s
  671. >>>>>>>474 ubyte&0xDF >0
  672. >>>>>>>>474 string x \b%-.5s
  673. >>>>>>>>479 ubyte&0xDF >0
  674. >>>>>>>>>479 string x \b%-.1s
  675. >>>>>>480 ubyte&0xDF >0
  676. >>>>>>>480 string x \b.%-.3s
  677. >>>>>>483 ubyte&0xDF >0 \b+
  678. >>>>>>>483 string x \b%-.5s
  679. >>>>>>>488 ubyte&0xDF >0
  680. >>>>>>>>488 string x \b%-.2s
  681. >>>>>>>>490 ubyte&0xDF >0
  682. >>>>>>>>>490 string x \b%-.1s
  683. >>>>>>>491 ubyte&0xDF >0
  684. >>>>>>>>491 string x \b.%-.3s
  685. >479 ubyte&0xDF >0
  686. >>416 string Kein\ System\ oder\
  687. >>>433 string Laufwerksfehler
  688. >>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
  689. #IO.SYS
  690. >>>>>479 string x \b %-.2s
  691. >>>>>>481 ubyte&0xDF >0
  692. >>>>>>>481 string x \b%-.6s
  693. >>>>>487 ubyte&0xDF >0
  694. >>>>>>487 string x \b.%-.3s
  695. #MSDOS.SYS
  696. >>>>>>490 ubyte&0xDF >0 \b+
  697. >>>>>>>490 string x \b%-.5s
  698. >>>>>>>>495 ubyte&0xDF >0
  699. >>>>>>>>>495 string x \b%-.3s
  700. >>>>>>>498 ubyte&0xDF >0
  701. >>>>>>>>498 string x \b.%-.3s
  702. #
  703. >376 search/41 Non-System\ disk\ or\
  704. >>395 search/41 disk\ error\r
  705. >>>407 search/41 Replace\ and\
  706. >>>>419 search/41 press\ \b,
  707. >>>>419 search/41 strike\ \b, old
  708. >>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader
  709. #449 Disk\ Boot\ failure\r MS 3.21
  710. #466 Boot\ Failure\r MS 3.30
  711. >>>>>468 search/18 \0
  712. #IO.SYS,IBMBIO.COM
  713. >>>>>>&0 string x \b %-.2s
  714. >>>>>>>&-20 ubyte&0xDF >0
  715. >>>>>>>>&-1 string x \b%-.4s
  716. >>>>>>>>>&-16 ubyte&0xDF >0
  717. >>>>>>>>>>&-1 string x \b%-.2s
  718. >>>>>>&8 ubyte&0xDF >0 \b.
  719. >>>>>>>&-1 string x \b%-.3s
  720. #MSDOS.SYS,IBMDOS.COM
  721. >>>>>>&11 ubyte&0xDF >0 \b+
  722. >>>>>>>&-1 string x \b%-.5s
  723. >>>>>>>>&-6 ubyte&0xDF >0
  724. >>>>>>>>>&-1 string x \b%-.1s
  725. >>>>>>>>>>&-5 ubyte&0xDF >0
  726. >>>>>>>>>>>&-1 string x \b%-.2s
  727. >>>>>>>&7 ubyte&0xDF >0 \b.
  728. >>>>>>>>&-1 string x \b%-.3s
  729. >441 string Cannot\ load\ from\ harddisk.\n\r
  730. >>469 string Insert\ Systemdisk\
  731. >>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader
  732. #>43 string \224R-LOADER\ \ SYS =label
  733. >54 string SYS
  734. >>324 string VASKK
  735. >>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
  736. #
  737. >98 string Press\ a\ key\ to\ retry\0\r
  738. >>120 string Cannot\ find\ file\ \0\r
  739. >>>139 string Disk\ read\ error\0\r
  740. >>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader
  741. #DRBIOS.SYS
  742. >>>>>44 ubyte&0xDF >0
  743. >>>>>>44 string x \b %-.6s
  744. >>>>>>>50 ubyte&0xDF >0
  745. >>>>>>>>50 string x \b%-.2s
  746. >>>>>>52 ubyte&0xDF >0
  747. >>>>>>>52 string x \b.%-.3s
  748. #
  749. >70 string IBMBIO\ \ COM
  750. >>472 string Cannot\ load\ DOS!\
  751. >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
  752. >>471 string Cannot\ load\ DOS\
  753. >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
  754. #??
  755. >444 string KERNEL\ \ SYS
  756. >>314 string BOOT\ error! \b, FREE-DOS Bootloader
  757. >499 string KERNEL\ \ SYS
  758. >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
  759. >449 string KERNEL\ \ SYS
  760. >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
  761. #
  762. >449 string Loading\ FreeDOS
  763. >>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader
  764. >>>497 ubyte&0xDF >0
  765. >>>>497 string x \b %-.6s
  766. >>>>>503 ubyte&0xDF >0
  767. >>>>>>503 string x \b%-.1s
  768. >>>>>>>504 ubyte&0xDF >0
  769. >>>>>>>>504 string x \b%-.1s
  770. >>>>505 ubyte&0xDF >0
  771. >>>>>505 string x \b.%-.3s
  772. #
  773. >331 string Error!.0 \b, FREE-DOS 1.0 bootloader
  774. #
  775. >125 string Loading\ FreeDOS...\r
  776. >>311 string BOOT\ error!\r \b, FREE-DOS bootloader
  777. >>>441 ubyte&0xDF >0
  778. >>>>441 string x \b %-.6s
  779. >>>>>447 ubyte&0xDF >0
  780. >>>>>>447 string x \b%-.1s
  781. >>>>>>>448 ubyte&0xDF >0
  782. >>>>>>>>448 string x \b%-.1s
  783. >>>>449 ubyte&0xDF >0
  784. >>>>>449 string x \b.%-.3s
  785. >124 string FreeDOS\0
  786. >>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
  787. # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
  788. >>>497 ubyte&0xDF >0
  789. >>>>497 string x \b %-.6s
  790. >>>>>503 ubyte&0xDF >0
  791. >>>>>>503 string x \b%-.1s
  792. >>>>>>>504 ubyte&0xDF >0
  793. >>>>>>>>504 string x \b%-.1s
  794. >>>>505 ubyte&0xDF >0
  795. >>>>>505 string x \b.%-.3s
  796. >>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
  797. >>>497 ubyte&0xDF >0
  798. >>>>497 string x \b %-.6s
  799. >>>>>503 ubyte&0xDF >0
  800. >>>>>>503 string x \b%-.1s
  801. >>>>>>>504 ubyte&0xDF >0
  802. >>>>>>>>504 string x \b%-.1s
  803. >>>>505 ubyte&0xDF >0
  804. >>>>>505 string x \b.%-.3s
  805. >>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
  806. >>>497 ubyte&0xDF >0
  807. >>>>497 string x \b %-.6s
  808. >>>>>503 ubyte&0xDF >0
  809. >>>>>>503 string x \b%-.1s
  810. >>>>>>>504 ubyte&0xDF >0
  811. >>>>>>>>504 string x \b%-.1s
  812. >>>>505 ubyte&0xDF >0
  813. >>>>>505 string x \b.%-.3s
  814. >336 string Error!\
  815. >>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
  816. >>>497 ubyte&0xDF >0
  817. >>>>497 string x \b %-.6s
  818. >>>>>503 ubyte&0xDF >0
  819. >>>>>>503 string x \b%-.1s
  820. >>>>>>>504 ubyte&0xDF >0
  821. >>>>>>>>504 string x \b%-.1s
  822. >>>>505 ubyte&0xDF >0
  823. >>>>>505 string x \b.%-.3s
  824. # added by Joerg Jenderek
  825. # http://www.visopsys.org/
  826. # http://partitionlogic.org.uk/
  827. # OEM-ID=Visopsys
  828. >478 ulelong 0
  829. >>(1.b+326) string I/O\ Error\ reading\
  830. >>>(1.b+344) string Visopsys\ loader\r
  831. >>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
  832. # http://alexfru.chat.ru/epm.html#bootprog
  833. >494 ubyte >0x4D
  834. >>495 string >E
  835. >>>495 string <S
  836. #OEM-ID is not reliable
  837. >>>>3 string BootProg
  838. # It just looks for a program file name at the root directory
  839. # and loads corresponding file with following execution.
  840. # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
  841. >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
  842. >>>>>499 string x \b %-.1s
  843. >>>>>>500 ubyte&0xDF >0
  844. >>>>>>>500 string x \b%-.1s
  845. >>>>>>>>501 ubyte&0xDF >0
  846. >>>>>>>>>501 string x \b%-.1s
  847. >>>>>>>>>>502 ubyte&0xDF >0
  848. >>>>>>>>>>>502 string x \b%-.1s
  849. >>>>>>>>>>>>503 ubyte&0xDF >0
  850. >>>>>>>>>>>>>503 string x \b%-.1s
  851. >>>>>>>>>>>>>>504 ubyte&0xDF >0
  852. >>>>>>>>>>>>>>>504 string x \b%-.1s
  853. >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
  854. >>>>>>>>>>>>>>>>>505 string x \b%-.1s
  855. >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
  856. >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
  857. #name extension
  858. >>>>>507 ubyte&0xDF >0 \b.
  859. >>>>>>507 string x \b%-.1s
  860. >>>>>>>508 ubyte&0xDF >0
  861. >>>>>>>>508 string x \b%-.1s
  862. >>>>>>>>>509 ubyte&0xDF >0
  863. >>>>>>>>>>509 string x \b%-.1s
  864. #If the boot sector fails to read any other sector,
  865. #it prints a very short message ("RE") to the screen and hangs the computer.
  866. #If the boot sector fails to find needed program in the root directory,
  867. #it also hangs with another message ("NF").
  868. >>>>>492 string RENF \b, FAT (12 bit)
  869. >>>>>495 string RENF \b, FAT (16 bit)
  870. # http://alexfru.chat.ru/epm.html#bootprog
  871. >494 ubyte >0x4D
  872. >>495 string >E
  873. >>>495 string <S
  874. #OEM-ID is not reliable
  875. >>>>3 string BootProg
  876. # It just looks for a program file name at the root directory
  877. # and loads corresponding file with following execution.
  878. # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
  879. >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
  880. >>>>>499 string x \b %-.1s
  881. >>>>>>500 ubyte&0xDF >0
  882. >>>>>>>500 string x \b%-.1s
  883. >>>>>>>>501 ubyte&0xDF >0
  884. >>>>>>>>>501 string x \b%-.1s
  885. >>>>>>>>>>502 ubyte&0xDF >0
  886. >>>>>>>>>>>502 string x \b%-.1s
  887. >>>>>>>>>>>>503 ubyte&0xDF >0
  888. >>>>>>>>>>>>>503 string x \b%-.1s
  889. >>>>>>>>>>>>>>504 ubyte&0xDF >0
  890. >>>>>>>>>>>>>>>504 string x \b%-.1s
  891. >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
  892. >>>>>>>>>>>>>>>>>505 string x \b%-.1s
  893. >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
  894. >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
  895. #name extension
  896. >>>>>507 ubyte&0xDF >0 \b.
  897. >>>>>>507 string x \b%-.1s
  898. >>>>>>>508 ubyte&0xDF >0
  899. >>>>>>>>508 string x \b%-.1s
  900. >>>>>>>>>509 ubyte&0xDF >0
  901. >>>>>>>>>>509 string x \b%-.1s
  902. #If the boot sector fails to read any other sector,
  903. #it prints a very short message ("RE") to the screen and hangs the computer.
  904. #If the boot sector fails to find needed program in the root directory,
  905. #it also hangs with another message ("NF").
  906. >>>>>492 string RENF \b, FAT (12 bit)
  907. >>>>>495 string RENF \b, FAT (16 bit)
  908. # x86 bootloader end
  909. # added by Joerg Jenderek at Nov 2012
  910. # http://www.thenakedpc.com/articles/v04/08/0408-05.html
  911. # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
  912. 0 string PNCIHISK\0 Norton Utilities disc image data
  913. # real x86 boot sector with jump instruction
  914. >509 search/1026 \x55\xAA\xeb
  915. >>&-1 indirect x \b; contains
  916. # http://file-extension.net/seeker/file_extension_dat
  917. 0 string PNCIUNDO Norton Disk Doctor UnDo file
  918. #
  919. # updated by Joerg Jenderek at Sep 2007
  920. >3 ubyte 0
  921. #no active flag
  922. >>446 ubyte 0
  923. # partition 1 not empty
  924. >>>450 ubyte >0
  925. # partitions 3,4 empty
  926. >>>>482 ubyte 0
  927. >>>>>498 ubyte 0
  928. # partition 2 ID=0,5,15
  929. >>>>>>466 ubyte <0x10
  930. >>>>>>>466 ubyte 0x05 \b, extended partition table
  931. >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
  932. >>>>>>>466 ubyte 0x0 \b, extended partition table (last)
  933. # DOS x86 sector separated and moved from "x86 boot sector" by Joerg Jenderek at May 2011
  934. >0x200 lelong 0x82564557 \b, BSD disklabel
  935. # FATX
  936. 0 string FATX FATX filesystem data
  937. # romfs filesystems - Juan Cespedes <cespedes@debian.org>
  938. 0 string -rom1fs- romfs filesystem, version 1
  939. >8 belong x %d bytes,
  940. >16 string x named %s.
  941. # netboot image - Juan Cespedes <cespedes@debian.org>
  942. 0 lelong 0x1b031336L Netboot image,
  943. >4 lelong&0xFFFFFF00 0
  944. >>4 lelong&0x100 0x000 mode 2
  945. >>4 lelong&0x100 0x100 mode 3
  946. >4 lelong&0xFFFFFF00 !0 unknown mode
  947. 0x18b string OS/2 OS/2 Boot Manager
  948. # updated by Joerg Jenderek at Oct 2008 and Sep 2012
  949. # http://syslinux.zytor.com/iso.php
  950. # tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
  951. # assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
  952. 0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
  953. >631 search/689 ISOLINUX\ isolinux Loader
  954. >>&0 string x (version %-4.4s)
  955. # http://syslinux.zytor.com/pxe.php
  956. # assembler instructions: jmp 7C05
  957. 0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older)
  958. # assembler instructions: pushfd;pushad
  959. 0 ulelong 0x60669c66 pxelinux loader
  960. # assembler instructions: jmp 05
  961. 0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer)
  962. # http://syslinux.zytor.com/wiki/index.php/SYSLINUX
  963. 0 string LDLINUX\ SYS\ SYSLINUX loader
  964. >12 string x (older version %-4.4s)
  965. 0 string \r\nSYSLINUX\ SYSLINUX loader
  966. >11 string x (version %-4.4s)
  967. # syslinux updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012
  968. # assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
  969. 0 ulelong&0x80909bEB 0x009018EB
  970. # OEM-ID not always "SYSLINUX"
  971. >434 search/47 Boot\ failed
  972. # followed by \r\n\0 or :\
  973. >>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older)
  974. >>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9)
  975. >459 search/30 Boot\ error\r\n\0
  976. >>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer)
  977. # SYSLINUX MBR updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012
  978. # assembler instructions: mov di,0600h;mov cx,0100h
  979. 16 search/4 \xbf\x00\x06\xb9\x00\x01
  980. >94 search/249 Missing\ operating\ system
  981. # followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
  982. # skip Ranish MBR
  983. >>408 search/4 HD1/\0
  984. >>408 default x
  985. >>>250 search/118 \0Operating\ system\ load SYSLINUX MBR
  986. # followed by "ing " or space
  987. >>>>292 search/98 error
  988. >>>>>&0 string \r (version 3.35 or older)
  989. >>>>>&0 string .\r (version 3.52 or newer)
  990. >>>>>&0 default x (version 3.36-3.51 )
  991. >368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR
  992. >>156 search/10 \0Boot\ partition\ not\ found\r\n
  993. >>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older)
  994. >>174 search/10 \0Missing\ OS\r\n
  995. >>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer)
  996. # SYSLINUX END
  997. # NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
  998. # assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax,
  999. 0 ubequad 0x31c08ed0bc007c8e
  1000. # mbr_bootsel magic before partition table not reliable with small ipl fragments
  1001. #>444 uleshort 0xb5e1
  1002. >0004 uleshort x
  1003. # ERRorTeXT
  1004. >>181 search/166 Error\ \0\r\n NetBSD mbr
  1005. # NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
  1006. >>>0x1B8 ubelong >0 \b,Serial 0x%-.8x
  1007. # BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
  1008. >>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector
  1009. # BOOT_EXTENDED definitions contains assembler instructions:
  1010. # xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
  1011. >>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended
  1012. # COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
  1013. >>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO
  1014. # not TERSE_ERROR
  1015. >>>196 search/106 No\ active\ partition\0
  1016. >>>>&0 string Disk\ read\ error\0
  1017. >>>>>&0 string No\ operating\ system\0 \b,verbose
  1018. # not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
  1019. >>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS
  1020. # not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13
  1021. >>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check
  1022. # assembler instructions: movw nametab,bx
  1023. >>>0x26 search/21 \xBB\x94\x07
  1024. # not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
  1025. >>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94
  1026. >>>>>181 search/166 Error\ \0
  1027. # "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
  1028. >>>>>>&3 string x \b,"%s"
  1029. # Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
  1030. # added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
  1031. # assembler instructions: jmp short 0x58;nop;ASCII
  1032. 0 ubequad&0xeb58908000000000 0xeb58900000000000
  1033. # assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
  1034. >(1.b+2) ubequad 0xfa31c08ed88ec08e
  1035. # Error messages at end of code
  1036. >>376 string No\ operating\ system\r\n\0
  1037. >>>398 string Disk\ error\r\n\0FDD\0HDD\0
  1038. >>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr
  1039. # Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
  1040. # added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
  1041. # for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
  1042. # or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
  1043. 0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC
  1044. # pointer to the data starting with Neil Turton signature string
  1045. >(0x1BC.s) string NDTmbr
  1046. >>&-14 string 1234F\0 Turton mbr (
  1047. # parameters also viewed by install-mbr --list
  1048. >>>(0x1BC.s+7) ubyte x \b%u<=
  1049. >>>(0x1BC.s+9) ubyte x \bVersion<=%u
  1050. #>>>(0x1BC.s+8) ubyte x asm_flag_%x
  1051. >>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix
  1052. # variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode
  1053. >>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk
  1054. #0x1~1,..,0x8~4,0x10~F,0x80~A enabled
  1055. #>>>(0x1BC.s+10) ubyte x \b,flags 0x%x
  1056. #0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
  1057. #>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x
  1058. # for older versions
  1059. >>>(0x1BC.s+9) ubyte <2
  1060. #>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds
  1061. >>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
  1062. # floppy A: or B:
  1063. >>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x
  1064. >>>>(0x1BC.s+13) ubyte >1
  1065. # 1st hard disc
  1066. #>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x
  1067. # not 1st hard disc
  1068. >>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x
  1069. # for version >= 2 maximal timeout can be 65534
  1070. >>>(0x1BC.s+9) ubyte >1
  1071. #>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds
  1072. >>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds
  1073. # floppy A: or B:
  1074. >>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x
  1075. >>>>(0x1BC.s+14) ubyte >1
  1076. # 1st hard disc
  1077. #>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x
  1078. # not 1st hard disc
  1079. >>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x
  1080. >>>0 ubyte x \b)
  1081. # added by Joerg Jenderek
  1082. # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
  1083. # grub-1.94/kern/i386/pc/startup.S
  1084. # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
  1085. # usual values are marked with comments to get only informations of strange GRUB loaders
  1086. 0x200 uleshort 0x70EA
  1087. # found only version 3.{1,2}
  1088. >0x206 ubeshort >0x0300
  1089. # GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
  1090. >>0x212 ubyte >0x29
  1091. >>>0x213 ubyte >0x29
  1092. # not iso9660_stage1_5
  1093. #>>>0 ulelong&0x00BE5652 0x00BE5652
  1094. >>>>0x213 ubyte >0x29 GRand Unified Bootloader
  1095. # config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
  1096. >>>>0x217 ubyte 0xFF stage1_5
  1097. >>>>0x217 ubyte <0xFF stage2
  1098. >>>>0x206 ubyte x \b version %u
  1099. >>>>0x207 ubyte x \b.%u
  1100. # module_size for 1.94
  1101. >>>>0x208 ulelong <0xffffff \b, installed partition %u
  1102. #>>>>0x208 ulelong =0xffffff \b, %u (default)
  1103. >>>>0x208 ulelong >0xffffff \b, installed partition %u
  1104. # GRUB 0.5.95 unofficial
  1105. >>>>0x20C ulelong&0x2E300000 0x2E300000
  1106. # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
  1107. >>>>>0x20C ubyte x \b, identifier 0x%x
  1108. #>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
  1109. >>>>>0x20D ubyte >0 \b, LBA flag 0x%x
  1110. # GRUB version as string
  1111. >>>>>0x20E string >\0 \b, GRUB version %-s
  1112. # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
  1113. >>>>>>0x215 ulong 0xffffffff
  1114. >>>>>>>0x219 string >\0 \b, configuration file %-s
  1115. >>>>>>0x215 ulong !0xffffffff
  1116. >>>>>>>0x215 string >\0 \b, configuration file %-s
  1117. # newer GRUB versions
  1118. >>>>0x20C ulelong&0x2E300000 !0x2E300000
  1119. ##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
  1120. >>>>>0x20C ulelong >0 \b, saved entry %d
  1121. # for 1.94 contains kernel image size
  1122. # for 0.93,0.94,0.96,0.97
  1123. # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
  1124. >>>>>0x210 ubyte x \b, identifier 0x%x
  1125. # The flag for LBA forcing is in most cases 0
  1126. #>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
  1127. >>>>>0x211 ubyte >0 \b, LBA flag 0x%x
  1128. # GRUB version as string
  1129. >>>>>0x212 string >\0 \b, GRUB version %-s
  1130. # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
  1131. >>>>>0x217 ulong 0xffffffff
  1132. >>>>>>0x21b string >\0 \b, configuration file %-s
  1133. >>>>>0x217 ulong !0xffffffff
  1134. >>>>>>0x217 string >\0 \b, configuration file %-s
  1135. # DOS x86 sector updated and separated from "x86 boot sector" by Joerg Jenderek at May 2011
  1136. # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
  1137. # over BIOS parameter block (BPB)
  1138. # http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
  1139. # older drives may use Near JuMP instruction E9 xx xx
  1140. # minimal short forward jump found 0x29 for bootloaders or 0x0
  1141. # maximal short forward jump is 0x7f
  1142. # OEM-ID is empty or contain readable bytes
  1143. 0 ulelong&0x804000E9 0x000000E9
  1144. # mtools-3.9.8/msdos.h
  1145. # usual values are marked with comments to get only informations of strange FAT systems
  1146. # valid sectorsize must be a power of 2 from 32 to 32768
  1147. >11 uleshort&0xf001f 0
  1148. >>11 uleshort <32769
  1149. >>>11 uleshort >31
  1150. >>>>21 ubyte&0xf0 0xF0
  1151. >>>>>0 ubyte 0xEB
  1152. >>>>>>1 ubyte x \b, code offset 0x%x+2
  1153. >>>>>0 ubyte 0xE9
  1154. >>>>>>1 uleshort x \b, code offset 0x%x+2
  1155. >>>>>3 string >\0 \b, OEM-ID "%-.8s"
  1156. #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
  1157. >>>>>>8 string IHC \b cached by Windows 9M
  1158. >>>>>11 uleshort >512 \b, Bytes/sector %u
  1159. #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
  1160. >>>>>11 uleshort <512 \b, Bytes/sector %u
  1161. >>>>>13 ubyte >1 \b, sectors/cluster %u
  1162. #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
  1163. >>>>>82 string FAT32
  1164. >>>>>>14 uleshort !32 \b, reserved sectors %u
  1165. #>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
  1166. >>>>>82 string !FAT32
  1167. >>>>>>14 uleshort >1 \b, reserved sectors %u
  1168. #>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
  1169. #>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS)
  1170. >>>>>16 ubyte >2 \b, FATs %u
  1171. #>>>>>16 ubyte =2 \b, FATs %u (usual)
  1172. >>>>>16 ubyte =1 \b, FAT %u
  1173. >>>>>16 ubyte >0
  1174. >>>>>17 uleshort >0 \b, root entries %u
  1175. #>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
  1176. >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
  1177. #>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
  1178. >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
  1179. #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
  1180. >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
  1181. >>>>>22 uleshort >0 \b, sectors/FAT %u
  1182. #>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
  1183. >>>>>24 uleshort x \b, sectors/track %u
  1184. >>>>>26 ubyte >2 \b, heads %u
  1185. #>>>>>26 ubyte =2 \b, heads %u (usual floppy)
  1186. >>>>>26 ubyte =1 \b, heads %u
  1187. # valid only for sector sizes with more then 32 Bytes
  1188. >>>>>11 uleshort >32
  1189. # skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
  1190. >>>>>>38 ubyte !0x70
  1191. >>>>>>>28 ulelong >0 \b, hidden sectors %u
  1192. #>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
  1193. >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
  1194. #>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
  1195. # FAT<32 bit specific
  1196. >>>>>>>82 string !FAT32
  1197. #>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
  1198. #>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
  1199. >>>>>>>>36 ubyte !0x80
  1200. >>>>>>>>>36 ubyte !0 \b, physical drive 0x%x
  1201. >>>>>>>>37 ubyte >0 \b, reserved 0x%x
  1202. #>>>>>>>>37 ubyte =0 \b, reserved 0x%x
  1203. # value is 0x80 for NTFS
  1204. >>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
  1205. >>>>>>>>38 ubyte =0x29
  1206. >>>>>>>>>39 ulelong x \b, serial number 0x%x
  1207. >>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
  1208. >>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
  1209. >>>>>>>>>43 string =NO\ NAME \b, unlabeled
  1210. # there exist some old floppies without word FAT at offset 54
  1211. # a word like "FATnm " is only a hint for a FAT size on nm-bits
  1212. # Normally the number of clusters is calculated by the values of BPP.
  1213. # if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
  1214. # otherwise FAT is 16 bit.
  1215. # http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
  1216. >>>>>>54 string FAT \b, FAT
  1217. >>>>>>>54 string FAT12 \b (12 bit)
  1218. >>>>>>>54 string FAT16 \b (16 bit)
  1219. # FAT32 bit specific
  1220. >>>>>82 string FAT32 \b, FAT (32 bit)
  1221. >>>>>>36 ulelong x \b, sectors/FAT %u
  1222. # http://technet.microsoft.com/en-us/library/cc977221.aspx
  1223. >>>>>>40 uleshort >0 \b, extension flags 0x%x
  1224. #>>>>>>40 uleshort =0 \b, extension flags %u
  1225. >>>>>>42 uleshort >0 \b, fsVersion %u
  1226. #>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
  1227. >>>>>>44 ulelong >2 \b, rootdir cluster %u
  1228. #>>>>>>44 ulelong =2 \b, rootdir cluster %u
  1229. #>>>>>>44 ulelong =1 \b, rootdir cluster %u
  1230. >>>>>>48 uleshort >1 \b, infoSector %u
  1231. #>>>>>>48 uleshort =1 \b, infoSector %u (usual)
  1232. >>>>>>48 uleshort <1 \b, infoSector %u
  1233. >>>>>>50 uleshort >6 \b, Backup boot sector %u
  1234. #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
  1235. >>>>>>50 uleshort <6 \b, Backup boot sector %u
  1236. # corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
  1237. >>>>>>52 ulelong >0 \b, reserved1 0x%x
  1238. >>>>>>56 ulelong >0 \b, reserved2 0x%x
  1239. >>>>>>60 ulelong >0 \b, reserved3 0x%x
  1240. # same structure as FAT1X
  1241. #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
  1242. #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
  1243. >>>>>>64 ubyte !0x80
  1244. >>>>>>>64 ubyte >0 \b, physical drive 0x%x
  1245. # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
  1246. >>>>>>65 ubyte >0 \b, reserved 0x%x
  1247. >>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
  1248. >>>>>>66 ubyte =0x29
  1249. >>>>>>>67 ulelong x \b, serial number 0x%x
  1250. >>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
  1251. >>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
  1252. >>>>>>>71 string =NO\ NAME \b, unlabeled
  1253. # additional tests for floppy image added by Joerg Jenderek
  1254. # no fixed disk
  1255. >>>>>21 ubyte !0xF8
  1256. # floppy media with 12 bit FAT
  1257. >>>>>>54 string !FAT16
  1258. # test for FAT after bootsector
  1259. >>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT
  1260. # floppy image
  1261. !:mime application/x-ima
  1262. # NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
  1263. # and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
  1264. # 0 FATs
  1265. >>>>>16 ubyte =0
  1266. # 0 root entries
  1267. >>>>>>17 uleshort =0
  1268. # 0 DOS sectors
  1269. >>>>>>>19 uleshort =0
  1270. # 0 sectors/FAT
  1271. # dos < 4.0 BootSector value found is 0x80
  1272. #38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x)
  1273. >>>>>>>>22 uleshort =0 \b; NTFS
  1274. >>>>>>>>>24 uleshort >0 \b, sectors/track %u
  1275. >>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x
  1276. >>>>>>>>>40 ulequad >0 \b, sectors %lld
  1277. >>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld
  1278. >>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld
  1279. # Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
  1280. # Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
  1281. >>>>>>>>>64 lelong <256
  1282. >>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d
  1283. >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi)
  1284. # Values 0 to 127 represent index block sizes of 0 to 127 clusters.
  1285. # Values 128 to 255 represent index block sizes of 2^(256-N) byte
  1286. >>>>>>>>>68 ulelong <256
  1287. >>>>>>>>>>68 ulelong <128 \b, clusters/index block %d
  1288. #>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d)
  1289. >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi)
  1290. >>>>>>>>>72 ulequad x \b, serial number 0%llx
  1291. >>>>>>>>>80 ulelong >0 \b, checksum 0x%x
  1292. #>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual)
  1293. >>>>>>>>>0x258 ulelong&0x00009090 =0x00009090
  1294. >>>>>>>>>>&-92 indirect x \b; contains
  1295. # For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
  1296. # http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
  1297. # unused assembler instructions JMP y2;NOP;NOP
  1298. 0x056 ulelong&0xFFFF0FFF 0x909002EB
  1299. # unicode loadername terminated by CTRL-D
  1300. >(0.s*2) ulelong&0xFFFFFF00 0x00040000
  1301. # loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
  1302. >>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s
  1303. >>0x12 string $
  1304. >>>0x0c lestring16 x \b%-2.2s
  1305. ### DOS,NTFS boot sectors end
  1306. 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
  1307. >8404 string x last mounted on %s,
  1308. #>9504 ledate x last checked at %s,
  1309. >8224 ledate x last written at %s,
  1310. >8401 byte x clean flag %d,
  1311. >8228 lelong x number of blocks %d,
  1312. >8232 lelong x number of data blocks %d,
  1313. >8236 lelong x number of cylinder groups %d,
  1314. >8240 lelong x block size %d,
  1315. >8244 lelong x fragment size %d,
  1316. >8252 lelong x minimum percentage of free blocks %d,
  1317. >8256 lelong x rotational delay %dms,
  1318. >8260 lelong x disk rotational speed %drps,
  1319. >8320 lelong 0 TIME optimization
  1320. >8320 lelong 1 SPACE optimization
  1321. 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  1322. >&-1164 string x last mounted on %s,
  1323. >&-696 string >\0 volume name %s,
  1324. >&-304 leqldate x last written at %s,
  1325. >&-1167 byte x clean flag %d,
  1326. >&-1168 byte x readonly flag %d,
  1327. >&-296 lequad x number of blocks %lld,
  1328. >&-288 lequad x number of data blocks %lld,
  1329. >&-1332 lelong x number of cylinder groups %d,
  1330. >&-1328 lelong x block size %d,
  1331. >&-1324 lelong x fragment size %d,
  1332. >&-180 lelong x average file size %d,
  1333. >&-176 lelong x average number of files in dir %d,
  1334. >&-272 lequad x pending blocks to free %lld,
  1335. >&-264 lelong x pending inodes to free %ld,
  1336. >&-664 lequad x system-wide uuid %0llx,
  1337. >&-1316 lelong x minimum percentage of free blocks %d,
  1338. >&-1248 lelong 0 TIME optimization
  1339. >&-1248 lelong 1 SPACE optimization
  1340. 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  1341. >&-1164 string x last mounted on %s,
  1342. >&-696 string >\0 volume name %s,
  1343. >&-304 leqldate x last written at %s,
  1344. >&-1167 byte x clean flag %d,
  1345. >&-1168 byte x readonly flag %d,
  1346. >&-296 lequad x number of blocks %lld,
  1347. >&-288 lequad x number of data blocks %lld,
  1348. >&-1332 lelong x number of cylinder groups %d,
  1349. >&-1328 lelong x block size %d,
  1350. >&-1324 lelong x fragment size %d,
  1351. >&-180 lelong x average file size %d,
  1352. >&-176 lelong x average number of files in dir %d,
  1353. >&-272 lequad x pending blocks to free %lld,
  1354. >&-264 lelong x pending inodes to free %ld,
  1355. >&-664 lequad x system-wide uuid %0llx,
  1356. >&-1316 lelong x minimum percentage of free blocks %d,
  1357. >&-1248 lelong 0 TIME optimization
  1358. >&-1248 lelong 1 SPACE optimization
  1359. 9564 belong 0x00011954 Unix Fast File system [v1] (big-endian),
  1360. >7168 belong 0x4c41424c Apple UFS Volume
  1361. >>7186 string x named %s,
  1362. >>7176 belong x volume label version %d,
  1363. >>7180 bedate x created on %s,
  1364. >8404 string x last mounted on %s,
  1365. #>9504 bedate x last checked at %s,
  1366. >8224 bedate x last written at %s,
  1367. >8401 byte x clean flag %d,
  1368. >8228 belong x number of blocks %d,
  1369. >8232 belong x number of data blocks %d,
  1370. >8236 belong x number of cylinder groups %d,
  1371. >8240 belong x block size %d,
  1372. >8244 belong x fragment size %d,
  1373. >8252 belong x minimum percentage of free blocks %d,
  1374. >8256 belong x rotational delay %dms,
  1375. >8260 belong x disk rotational speed %drps,
  1376. >8320 belong 0 TIME optimization
  1377. >8320 belong 1 SPACE optimization
  1378. 42332 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  1379. >&-1164 string x last mounted on %s,
  1380. >&-696 string >\0 volume name %s,
  1381. >&-304 beqldate x last written at %s,
  1382. >&-1167 byte x clean flag %d,
  1383. >&-1168 byte x readonly flag %d,
  1384. >&-296 bequad x number of blocks %lld,
  1385. >&-288 bequad x number of data blocks %lld,
  1386. >&-1332 belong x number of cylinder groups %d,
  1387. >&-1328 belong x block size %d,
  1388. >&-1324 belong x fragment size %d,
  1389. >&-180 belong x average file size %d,
  1390. >&-176 belong x average number of files in dir %d,
  1391. >&-272 bequad x pending blocks to free %lld,
  1392. >&-264 belong x pending inodes to free %ld,
  1393. >&-664 bequad x system-wide uuid %0llx,
  1394. >&-1316 belong x minimum percentage of free blocks %d,
  1395. >&-1248 belong 0 TIME optimization
  1396. >&-1248 belong 1 SPACE optimization
  1397. 66908 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  1398. >&-1164 string x last mounted on %s,
  1399. >&-696 string >\0 volume name %s,
  1400. >&-304 beqldate x last written at %s,
  1401. >&-1167 byte x clean flag %d,
  1402. >&-1168 byte x readonly flag %d,
  1403. >&-296 bequad x number of blocks %lld,
  1404. >&-288 bequad x number of data blocks %lld,
  1405. >&-1332 belong x number of cylinder groups %d,
  1406. >&-1328 belong x block size %d,
  1407. >&-1324 belong x fragment size %d,
  1408. >&-180 belong x average file size %d,
  1409. >&-176 belong x average number of files in dir %d,
  1410. >&-272 bequad x pending blocks to free %lld,
  1411. >&-264 belong x pending inodes to free %ld,
  1412. >&-664 bequad x system-wide uuid %0llx,
  1413. >&-1316 belong x minimum percentage of free blocks %d,
  1414. >&-1248 belong 0 TIME optimization
  1415. >&-1248 belong 1 SPACE optimization
  1416. # ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
  1417. # ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
  1418. # volume label and UUID Russell Coker
  1419. # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
  1420. 0x438 leshort 0xEF53 Linux
  1421. >0x44c lelong x rev %d
  1422. >0x43e leshort x \b.%d
  1423. # No journal? ext2
  1424. >0x45c lelong ^0x0000004 ext2 filesystem data
  1425. >>0x43a leshort ^0x0000001 (mounted or unclean)
  1426. # Has a journal? ext3 or ext4
  1427. >0x45c lelong &0x0000004
  1428. # and small INCOMPAT?
  1429. >>0x460 lelong <0x0000040
  1430. # and small RO_COMPAT?
  1431. >>>0x464 lelong <0x0000008 ext3 filesystem data
  1432. # else large RO_COMPAT?
  1433. >>>0x464 lelong >0x0000007 ext4 filesystem data
  1434. # else large INCOMPAT?
  1435. >>0x460 lelong >0x000003f ext4 filesystem data
  1436. >0x468 belong x \b, UUID=%08x
  1437. >0x46c beshort x \b-%04x
  1438. >0x46e beshort x \b-%04x
  1439. >0x470 beshort x \b-%04x
  1440. >0x472 belong x \b-%08x
  1441. >0x476 beshort x \b%04x
  1442. >0x478 string >0 \b, volume name "%s"
  1443. # General flags for any ext* fs
  1444. >0x460 lelong &0x0000004 (needs journal recovery)
  1445. >0x43a leshort &0x0000002 (errors)
  1446. # INCOMPAT flags
  1447. >0x460 lelong &0x0000001 (compressed)
  1448. #>0x460 lelong &0x0000002 (filetype)
  1449. #>0x460 lelong &0x0000010 (meta bg)
  1450. >0x460 lelong &0x0000040 (extents)
  1451. >0x460 lelong &0x0000080 (64bit)
  1452. #>0x460 lelong &0x0000100 (mmp)
  1453. #>0x460 lelong &0x0000200 (flex bg)
  1454. # RO_INCOMPAT flags
  1455. #>0x464 lelong &0x0000001 (sparse super)
  1456. >0x464 lelong &0x0000002 (large files)
  1457. >0x464 lelong &0x0000008 (huge files)
  1458. #>0x464 lelong &0x0000010 (gdt checksum)
  1459. #>0x464 lelong &0x0000020 (many subdirs)
  1460. #>0x463 lelong &0x0000040 (extra isize)
  1461. # Minix filesystems - Juan Cespedes <cespedes@debian.org>
  1462. 0x410 leshort 0x137f
  1463. !:strength / 2
  1464. >0x402 beshort < 100
  1465. >0x402 beshort > -1 Minix filesystem, V1, %d zones
  1466. >0x1e string minix \b, bootable
  1467. 0x410 beshort 0x137f
  1468. !:strength / 2
  1469. >0x402 beshort < 100
  1470. >0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones
  1471. >0x1e string minix \b, bootable
  1472. 0x410 leshort 0x138f
  1473. !:strength / 2
  1474. >0x402 beshort < 100
  1475. >0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones
  1476. >0x1e string minix \b, bootable
  1477. 0x410 beshort 0x138f
  1478. !:strength / 2
  1479. >0x402 beshort < 100
  1480. >0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones
  1481. >0x1e string minix \b, bootable
  1482. 0x410 leshort 0x2468
  1483. >0x402 beshort < 100
  1484. >>0x402 beshort > -1 Minix filesystem, V2, %d zones
  1485. >0x1e string minix \b, bootable
  1486. 0x410 beshort 0x2468
  1487. >0x402 beshort < 100
  1488. >0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones
  1489. >0x1e string minix \b, bootable
  1490. 0x410 leshort 0x2478
  1491. >0x402 beshort < 100
  1492. >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones
  1493. >0x1e string minix \b, bootable
  1494. 0x410 leshort 0x2478
  1495. >0x402 beshort < 100
  1496. >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones
  1497. >0x1e string minix \b, bootable
  1498. 0x410 beshort 0x2478
  1499. >0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones
  1500. >0x1e string minix \b, bootable
  1501. 0x410 leshort 0x4d5a
  1502. >0x402 beshort !0 Minix filesystem, V3, %d zones
  1503. >0x1e string minix \b, bootable
  1504. # SGI disk labels - Nathan Scott <nathans@debian.org>
  1505. 0 belong 0x0BE5A941 SGI disk label (volume header)
  1506. # SGI XFS filesystem - Nathan Scott <nathans@debian.org>
  1507. 0 belong 0x58465342 SGI XFS filesystem data
  1508. >0x4 belong x (blksz %d,
  1509. >0x68 beshort x inosz %d,
  1510. >0x64 beshort ^0x2004 v1 dirs)
  1511. >0x64 beshort &0x2004 v2 dirs)
  1512. ############################################################################
  1513. # Minix-ST kernel floppy
  1514. 0x800 belong 0x46fc2700 Atari-ST Minix kernel image
  1515. >19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
  1516. >19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
  1517. ############################################################################
  1518. # Hmmm, is this a better way of detecting _standard_ floppy images ?
  1519. 19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
  1520. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  1521. 19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
  1522. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  1523. 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
  1524. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  1525. 19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
  1526. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  1527. 19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
  1528. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  1529. 19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
  1530. 19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
  1531. # Valid media descriptor bytes for MS-DOS:
  1532. #
  1533. # Byte Capacity Media Size and Type
  1534. # -------------------------------------------------
  1535. #
  1536. # F0 2.88 MB 3.5-inch, 2-sided, 36-sector
  1537. # F0 1.44 MB 3.5-inch, 2-sided, 18-sector
  1538. # F9 720K 3.5-inch, 2-sided, 9-sector
  1539. # F9 1.2 MB 5.25-inch, 2-sided, 15-sector
  1540. # FD 360K 5.25-inch, 2-sided, 9-sector
  1541. # FF 320K 5.25-inch, 2-sided, 8-sector
  1542. # FC 180K 5.25-inch, 1-sided, 9-sector
  1543. # FE 160K 5.25-inch, 1-sided, 8-sector
  1544. # FE 250K 8-inch, 1-sided, single-density
  1545. # FD 500K 8-inch, 2-sided, single-density
  1546. # FE 1.2 MB 8-inch, 2-sided, double-density
  1547. # F8 ----- Fixed disk
  1548. #
  1549. # FC xxxK Apricot 70x1x9 boot disk.
  1550. #
  1551. # Originally a bitmap:
  1552. # xxxxxxx0 Not two sided
  1553. # xxxxxxx1 Double sided
  1554. # xxxxxx0x Not 8 SPT
  1555. # xxxxxx1x 8 SPT
  1556. # xxxxx0xx Not Removable drive
  1557. # xxxxx1xx Removable drive
  1558. # 11111xxx Must be one.
  1559. #
  1560. # But now it's rather random:
  1561. # 111111xx Low density disk
  1562. # 00 SS, Not 8 SPT
  1563. # 01 DS, Not 8 SPT
  1564. # 10 SS, 8 SPT
  1565. # 11 DS, 8 SPT
  1566. #
  1567. # 11111001 Double density 3 1/2 floppy disk, high density 5 1/4
  1568. # 11110000 High density 3 1/2 floppy disk
  1569. # 11111000 Hard disk any format
  1570. #
  1571. # CDROM Filesystems
  1572. # Modified for UDF by gerardo.cacciari@gmail.com
  1573. 32769 string CD001 #
  1574. !:mime application/x-iso9660-image
  1575. >38913 string !NSR0 ISO 9660 CD-ROM filesystem data
  1576. >38913 string NSR0 UDF filesystem data
  1577. >>38917 string 1 (version 1.0)
  1578. >>38917 string 2 (version 1.5)
  1579. >>38917 string 3 (version 2.0)
  1580. >>38917 byte >0x33 (unknown version, ID 0x%X)
  1581. >>38917 byte <0x31 (unknown version, ID 0x%X)
  1582. # "application id" which appears to be used as a volume label
  1583. >32808 string/T >\0 '%s'
  1584. >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
  1585. 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
  1586. !:mime application/x-iso9660-image
  1587. 32776 string CDROM High Sierra CD-ROM filesystem data
  1588. # .cso files
  1589. 0 string CISO Compressed ISO CD image
  1590. # cramfs filesystem - russell@coker.com.au
  1591. 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
  1592. >4 lelong x size %lu
  1593. >8 lelong &1 version #2
  1594. >8 lelong &2 sorted_dirs
  1595. >8 lelong &4 hole_support
  1596. >32 lelong x CRC 0x%x,
  1597. >36 lelong x edition %lu,
  1598. >40 lelong x %lu blocks,
  1599. >44 lelong x %lu files
  1600. 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
  1601. >4 belong x size %lu
  1602. >8 belong &1 version #2
  1603. >8 belong &2 sorted_dirs
  1604. >8 belong &4 hole_support
  1605. >32 belong x CRC 0x%x,
  1606. >36 belong x edition %lu,
  1607. >40 belong x %lu blocks,
  1608. >44 belong x %lu files
  1609. # reiserfs - russell@coker.com.au
  1610. 0x10034 string ReIsErFs ReiserFS V3.5
  1611. 0x10034 string ReIsEr2Fs ReiserFS V3.6
  1612. 0x10034 string ReIsEr3Fs ReiserFS V3.6.19
  1613. >0x1002c leshort x block size %d
  1614. >0x10032 leshort &2 (mounted or unclean)
  1615. >0x10000 lelong x num blocks %d
  1616. >0x10040 lelong 1 tea hash
  1617. >0x10040 lelong 2 yura hash
  1618. >0x10040 lelong 3 r5 hash
  1619. # JFFS - russell@coker.com.au
  1620. 0 lelong 0x34383931 Linux Journalled Flash File system, little endian
  1621. 0 belong 0x34383931 Linux Journalled Flash File system, big endian
  1622. # EST flat binary format (which isn't, but anyway)
  1623. # From: Mark Brown <broonie@sirena.org.uk>
  1624. 0 string ESTFBINR EST flat binary
  1625. # Aculab VoIP firmware
  1626. # From: Mark Brown <broonie@sirena.org.uk>
  1627. 0 string VoIP\ Startup\ and Aculab VoIP firmware
  1628. >35 string x format %s
  1629. # From: Mark Brown <broonie@sirena.org.uk> [old]
  1630. # From: Behan Webster <behanw@websterwood.com>
  1631. 0 belong 0x27051956 u-boot legacy uImage,
  1632. >32 string x %s,
  1633. >28 byte 0 Invalid os/
  1634. >28 byte 1 OpenBSD/
  1635. >28 byte 2 NetBSD/
  1636. >28 byte 3 FreeBSD/
  1637. >28 byte 4 4.4BSD/
  1638. >28 byte 5 Linux/
  1639. >28 byte 6 SVR4/
  1640. >28 byte 7 Esix/
  1641. >28 byte 8 Solaris/
  1642. >28 byte 9 Irix/
  1643. >28 byte 10 SCO/
  1644. >28 byte 11 Dell/
  1645. >28 byte 12 NCR/
  1646. >28 byte 13 LynxOS/
  1647. >28 byte 14 VxWorks/
  1648. >28 byte 15 pSOS/
  1649. >28 byte 16 QNX/
  1650. >28 byte 17 Firmware/
  1651. >28 byte 18 RTEMS/
  1652. >28 byte 19 ARTOS/
  1653. >28 byte 20 Unity OS/
  1654. >28 byte 21 INTEGRITY/
  1655. >29 byte 0 \bInvalid CPU,
  1656. >29 byte 1 \bAlpha,
  1657. >29 byte 2 \bARM,
  1658. >29 byte 3 \bIntel x86,
  1659. >29 byte 4 \bIA64,
  1660. >29 byte 5 \bMIPS,
  1661. >29 byte 6 \bMIPS 64-bit,
  1662. >29 byte 7 \bPowerPC,
  1663. >29 byte 8 \bIBM S390,
  1664. >29 byte 9 \bSuperH,
  1665. >29 byte 10 \bSparc,
  1666. >29 byte 11 \bSparc 64-bit,
  1667. >29 byte 12 \bM68K,
  1668. >29 byte 13 \bNios-32,
  1669. >29 byte 14 \bMicroBlaze,
  1670. >29 byte 15 \bNios-II,
  1671. >29 byte 16 \bBlackfin,
  1672. >29 byte 17 \bAVR32,
  1673. >29 byte 18 \bSTMicroelectronics ST200,
  1674. >30 byte 0 Invalid Image
  1675. >30 byte 1 Standalone Program
  1676. >30 byte 2 OS Kernel Image
  1677. >30 byte 3 RAMDisk Image
  1678. >30 byte 4 Multi-File Image
  1679. >30 byte 5 Firmware Image
  1680. >30 byte 6 Script File
  1681. >30 byte 7 Filesystem Image (any type)
  1682. >30 byte 8 Binary Flat Device Tree BLOB
  1683. >31 byte 0 (Not compressed),
  1684. >31 byte 1 (gzip),
  1685. >31 byte 2 (bzip2),
  1686. >31 byte 3 (lzma),
  1687. >12 belong x %d bytes,
  1688. >8 bedate x %s,
  1689. >16 belong x Load Address: 0x%08X,
  1690. >20 belong x Entry Point: 0x%08X,
  1691. >4 belong x Header CRC: 0x%08X,
  1692. >24 belong x Data CRC: 0x%08X
  1693. # JFFS2 file system
  1694. 0 leshort 0x1984 Linux old jffs2 filesystem data little endian
  1695. 0 leshort 0x1985 Linux jffs2 filesystem data little endian
  1696. # Squashfs
  1697. 0 string sqsh Squashfs filesystem, big endian,
  1698. >28 beshort x version %d.
  1699. >30 beshort x \b%d,
  1700. >28 beshort <3
  1701. >>8 belong x %d bytes,
  1702. >28 beshort >2
  1703. >>28 beshort <4
  1704. >>>63 bequad x %lld bytes,
  1705. >>28 beshort >3
  1706. >>>40 bequad x %lld bytes,
  1707. #>>67 belong x %d bytes,
  1708. >4 belong x %d inodes,
  1709. >28 beshort <2
  1710. >>32 beshort x blocksize: %d bytes,
  1711. >28 beshort >1
  1712. >>28 beshort <4
  1713. >>>51 belong x blocksize: %d bytes,
  1714. >>28 beshort >3
  1715. >>>12 belong x blocksize: %d bytes,
  1716. >28 beshort <4
  1717. >>39 bedate x created: %s
  1718. >28 beshort >3
  1719. >>8 bedate x created: %s
  1720. 0 string hsqs Squashfs filesystem, little endian,
  1721. >28 leshort x version %d.
  1722. >30 leshort x \b%d,
  1723. >28 leshort <3
  1724. >>8 lelong x %d bytes,
  1725. >28 leshort >2
  1726. >>28 leshort <4
  1727. >>>63 lequad x %lld bytes,
  1728. >>28 leshort >3
  1729. >>>40 lequad x %lld bytes,
  1730. #>>63 lelong x %d bytes,
  1731. >4 lelong x %d inodes,
  1732. >28 leshort <2
  1733. >>32 leshort x blocksize: %d bytes,
  1734. >28 leshort >1
  1735. >>28 leshort <4
  1736. >>>51 lelong x blocksize: %d bytes,
  1737. >>28 leshort >3
  1738. >>>12 lelong x blocksize: %d bytes,
  1739. >28 leshort <4
  1740. >>39 ledate x created: %s
  1741. >28 leshort >3
  1742. >>8 ledate x created: %s
  1743. # AFS Dump Magic
  1744. # From: Ty Sarna <tsarna@sarna.org>
  1745. 0 string \x01\xb3\xa1\x13\x22 AFS Dump
  1746. >&0 belong x (v%d)
  1747. >>&0 byte 0x76
  1748. >>>&0 belong x Vol %d,
  1749. >>>>&0 byte 0x6e
  1750. >>>>>&0 string x %s
  1751. >>>>>>&1 byte 0x74
  1752. >>>>>>>&0 beshort 2
  1753. >>>>>>>>&4 bedate x on: %s
  1754. >>>>>>>>&0 bedate =0 full dump
  1755. >>>>>>>>&0 bedate !0 incremental since: %s
  1756. #----------------------------------------------------------
  1757. #delta ISO Daniel Novotny (dnovotny@redhat.com)
  1758. 0 string DISO Delta ISO data
  1759. >4 belong x version %d
  1760. # VMS backup savesets - gerardo.cacciari@gmail.com
  1761. #
  1762. 4 string \x01\x00\x01\x00\x01\x00
  1763. >(0.s+16) string \x01\x01
  1764. >>&(&0.b+8) byte 0x42 OpenVMS backup saveset data
  1765. >>>40 lelong x (block size %d,
  1766. >>>49 string >\0 original name '%s',
  1767. >>>2 short 1024 VAX generated)
  1768. >>>2 short 2048 AXP generated)
  1769. >>>2 short 4096 I64 generated)
  1770. # Summary: Oracle Clustered Filesystem
  1771. # Created by: Aaron Botsis <redhat@digitalmafia.org>
  1772. 8 string OracleCFS Oracle Clustered Filesystem,
  1773. >4 long x rev %d
  1774. >0 long x \b.%d,
  1775. >560 string x label: %.64s,
  1776. >136 string x mountpoint: %.128s
  1777. # Summary: Oracle ASM tagged volume
  1778. # Created by: Aaron Botsis <redhat@digitalmafia.org>
  1779. 32 string ORCLDISK Oracle ASM Volume,
  1780. >40 string x Disk Name: %0.12s
  1781. 32 string ORCLCLRD Oracle ASM Volume (cleared),
  1782. >40 string x Disk Name: %0.12s
  1783. # Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
  1784. 8 string OracleCFS Oracle Clustered Filesystem,
  1785. >4 long x rev %d
  1786. >0 long x \b.%d,
  1787. >560 string x label: %.64s,
  1788. >136 string x mountpoint: %.128s
  1789. # Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
  1790. 32 string ORCLDISK Oracle ASM Volume,
  1791. >40 string x Disk Name: %0.12s
  1792. 32 string ORCLCLRD Oracle ASM Volume (cleared),
  1793. >40 string x Disk Name: %0.12s
  1794. # Compaq/HP RILOE floppy image
  1795. # From: Dirk Jagdmann <doj@cubic.org>
  1796. 0 string CPQRFBLO Compaq/HP RILOE floppy image
  1797. #------------------------------------------------------------------------------
  1798. # Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
  1799. # These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
  1800. # which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
  1801. #
  1802. 1008 string DECFILE11 Files-11 On-Disk Structure
  1803. >525 byte x Level %d
  1804. >525 byte x (ODS-%d);
  1805. >1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system;
  1806. >1017 string B
  1807. >>525 byte 2 VAX/VMS or OpenVMS file system;
  1808. >>525 byte 5 OpenVMS Alpha or Itanium file system;
  1809. >984 string x volume label is '%-12.12s'
  1810. # From: Thomas Klausner <wiz@NetBSD.org>
  1811. # http://filext.com/file-extension/DAA
  1812. # describes the daa file format. The magic would be:
  1813. 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive
  1814. # From Albert Cahalan <acahalan@gmail.com>
  1815. # really le32 operation,destination,payloadsize (but quite predictable)
  1816. # 01 00 00 00 00 00 00 c0 00 02 00 00
  1817. 0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware
  1818. # From Eric Sandeen
  1819. # GFS2
  1820. 0x10000 belong 0x01161970
  1821. >0x10018 belong 0x0000051d GFS1 Filesystem
  1822. >>0x10024 belong x (blocksize %d,
  1823. >>0x10060 string >\0 lockproto %s)
  1824. >0x10018 belong 0x00000709 GFS2 Filesystem
  1825. >>0x10024 belong x (blocksize %d,
  1826. >>0x10060 string >\0 lockproto %s)
  1827. # BTRFS
  1828. 0x10040 string _BHRfS_M BTRFS Filesystem
  1829. >0x1012b string >\0 (label "%s",
  1830. >0x10090 lelong x sectorsize %d,
  1831. >0x10094 lelong x nodesize %d,
  1832. >0x10098 lelong x leafsize %d)
  1833. # dvdisaster's .ecc
  1834. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  1835. 0 string *dvdisaster* dvdisaster error correction file
  1836. # xfs metadump image
  1837. # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
  1838. # but can we do the << ? For now it's always 512 (0x200) anyway.
  1839. 0 string XFSM
  1840. >0x200 string XFSB XFS filesystem metadump image
  1841. # Type: CROM filesystem
  1842. # From: Werner Fink <werner@suse.de>
  1843. 0 string CROMFS CROMFS
  1844. >6 string >\0 \b version %2.2s,
  1845. >8 ulequad >0 \b block data at %lld,
  1846. >16 ulequad >0 \b fblock table at %lld,
  1847. >24 ulequad >0 \b inode table at %lld,
  1848. >32 ulequad >0 \b root at %lld,
  1849. >40 ulelong >0 \b fblock size = %ld,
  1850. >44 ulelong >0 \b block size = %ld,
  1851. >48 ulequad >0 \b bytes = %lld
  1852. # Type: xfs metadump image
  1853. # From: Daniel Novotny <dnovotny@redhat.com>
  1854. # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
  1855. # but can we do the << ? For now it's always 512 (0x200) anyway.
  1856. 0 string XFSM
  1857. >0x200 string XFSB XFS filesystem metadump image
  1858. # Type: delta ISO
  1859. # From: Daniel Novotny <dnovotny@redhat.com>
  1860. 0 string DISO Delta ISO data,
  1861. >4 belong x version %d
  1862. # JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
  1863. # See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
  1864. # From: Adam Buchbinder <adam.buchbinder@gmail.com>
  1865. 0x8000 string JFS1
  1866. # Because it's text-only magic, check a binary value (version) to be sure.
  1867. # Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
  1868. # mountable.
  1869. >&0 lelong <3 JFS2 filesystem image
  1870. # Label is followed by a UUID; we have to limit string length to avoid
  1871. # appending the UUID in the case of a 16-byte label.
  1872. >>&144 regex [\x20-\x7E]{1,16} (label "%s")
  1873. >>&0 lequad x \b, %lld blocks
  1874. >>&8 lelong x \b, blocksize %d
  1875. >>&32 lelong&0x00000006 >0 (dirty)
  1876. >>&36 lelong >0 (compressed)
  1877. # LFS
  1878. 0 lelong 0x070162 LFS filesystem image
  1879. >4 lelong 1 version 1,
  1880. >>8 lelong x \b blocks %u,
  1881. >>12 lelong x \b blocks per segment %u,
  1882. >4 lelong 2 version 2,
  1883. >>8 lelong x \b fragments %u,
  1884. >>12 lelong x \b bytes per segment %u,
  1885. >16 lelong x \b disk blocks %u,
  1886. >20 lelong x \b block size %u,
  1887. >24 lelong x \b fragment size %u,
  1888. >28 lelong x \b fragments per block %u,
  1889. >32 lelong x \b start for free list %u,
  1890. >36 lelong x \b number of free blocks %d,
  1891. >40 lelong x \b number of files %u,
  1892. >44 lelong x \b blocks available for writing %d,
  1893. >48 lelong x \b inodes in cache %d,
  1894. >52 lelong x \b inode file disk address 0x%x,
  1895. >56 lelong x \b inode file inode number %u,
  1896. >60 lelong x \b address of last segment written 0x%x,
  1897. >64 lelong x \b address of next segment to write 0x%x,
  1898. >68 lelong x \b address of current segment written 0x%x
  1899. 0 string td\000 floppy image data (TeleDisk, compressed)
  1900. 0 string TD\000 floppy image data (TeleDisk)
  1901. 0 string CQ\024 floppy image data (CopyQM,
  1902. >16 leshort x %d sectors,
  1903. >18 leshort x %d heads.)
  1904. 0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk)
  1905. 0 beshort 0xAA58 floppy image data (IBM SaveDskF, old)
  1906. 0 beshort 0xAA59 floppy image data (IBM SaveDskF)
  1907. 0 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed)
  1908. 0 string \074CPM_Disk\076 disk image data (YAZE)