apple 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536
  1. #------------------------------------------------------------------------------
  2. # $File: apple,v 1.44 2019/10/18 15:21:02 christos Exp $
  3. # apple: file(1) magic for Apple file formats
  4. #
  5. 0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
  6. 0 string \x0aGL Binary II (apple ][) data
  7. 0 string \x76\xff Squeezed (apple ][) data
  8. 0 string NuFile NuFile archive (apple ][) data
  9. 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
  10. 0 belong 0x00051600 AppleSingle encoded Macintosh file
  11. 0 belong 0x00051607 AppleDouble encoded Macintosh file
  12. # Type: Apple Emulator WOZ format
  13. # From: Greg Wildman <greg@apple2.org.za>
  14. # Ref: https://applesaucefdc.com/woz/reference/
  15. # Ref: https://applesaucefdc.com/woz/reference2/
  16. #
  17. # Note: The following test are mostly identical. I would rather not
  18. # use a regex to identify the WOZ format number.
  19. 0 string WOZ1
  20. >4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image
  21. >12 string INFO
  22. >>21 byte 01 \b, 5.25 inch
  23. >>21 byte 02 \b, 3.5 inch
  24. >>22 byte 01 \b, write protected
  25. >>23 byte 01 \b, cross track synchronized
  26. >>25 string/T x \b, %.32s
  27. 0 string WOZ2
  28. >4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image
  29. >12 string INFO
  30. >>21 byte 01 \b, 5.25 inch
  31. >>21 byte 02 \b, 3.5 inch
  32. >>22 byte 01 \b, write protected
  33. >>23 byte 01 \b, cross track synchronized
  34. >>25 string/T x \b, %.32s
  35. # Type: Apple Emulator disk images
  36. # From: Greg Wildman <greg@apple2.org.za>
  37. # ProDOS boot loader?
  38. 0 string \x01\x38\xB0\x03\x4C Apple ProDOS Image
  39. # Detect Volume Directory block ($02)
  40. >0x400 string \x00\x00\x03\x00
  41. >>0x404 byte &0xF0
  42. >>>0x405 string x \b, Volume /%s
  43. >>>0x429 leshort x \b, %u Blocks
  44. # ProDOS ordered ?
  45. >0xb00 string \x00\x00\x03\x00
  46. >>0xb04 byte &0xF0
  47. >>>0xb05 string x \b, Volume /%s
  48. >>>0xb29 leshort x \b, %u Blocks
  49. #
  50. # DOS3.3 boot loader?
  51. 0 string \x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B
  52. >0x11001 string \x11\x0F\x03 Apple DOS 3.3 Image
  53. >>0x11006 byte x \b, Volume %u
  54. >>0x11034 byte x \b, %u Tracks
  55. >>0x11035 byte x \b, %u Sectors
  56. >>0x11036 leshort x \b, %u bytes per sector
  57. # DOS3.2 ?
  58. >0x11001 string \x11\x0C\x02 Apple DOS 3.2 Image
  59. >>0x11006 byte x \b, Volume %u
  60. >>0x11034 byte x \b, %u Tracks
  61. >>0x11035 byte x \b, %u Sectors
  62. >>0x11036 leshort x \b, %u bytes per sector
  63. # DOS3.1 ?
  64. >0x11001 string \x11\x0C\x01
  65. >>0x11c00 string \x00\x11\x0B Apple DOS 3.1 Image
  66. #
  67. # Pascal boot loader?
  68. 0 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD
  69. >0xd6 pstring SYSTEM.APPLE
  70. >>0xb00 leshort 0x0000
  71. >>>0xb04 leshort 0x0000 Apple Pascal Image
  72. >>>>0xb06 pstring x \b, Volume %s:
  73. >>>>0xb0e leshort x \b, %u Blocks
  74. >>>>0xb10 leshort x \b, %u Files
  75. #
  76. # Diversi Dos boot loader?
  77. 0 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD
  78. >0x11001 string \x11\x0F\x03 Apple Diversi Dos Image
  79. >>0x11006 byte x \b, Volume %u
  80. >>0x11034 byte x \b, %u Tracks
  81. >>0x11035 byte x \b, %u Sectors
  82. >>0x11036 leshort x \b, %u bytes per sector
  83. # Type: Apple Emulator 2IMG format
  84. # From: Radek Vokal <rvokal@redhat.com>
  85. # Update: Greg Wildman <greg@apple2.org.za>
  86. 0 string 2IMG Apple ][ 2IMG Disk Image
  87. >4 clear x
  88. >4 string XGS! \b, XGS
  89. >4 string CTKG \b, Catakig
  90. >4 string ShIm \b, Sheppy's ImageMaker
  91. >4 string SHEP \b, Sheppy's ImageMaker
  92. >4 string WOOF \b, Sweet 16
  93. >4 string B2TR \b, Bernie ][ the Rescue
  94. >4 string \!nfc \b, ASIMOV2
  95. >4 string \>BD\< \b, Brutal Deluxe's Cadius
  96. >4 string CdrP \b, CiderPress
  97. >4 string Vi][ \b, Virtual ][
  98. >4 string PRFS \b, ProFUSE
  99. >4 string FISH \b, FishWings
  100. >4 string RVLW \b, Revival for Windows
  101. >4 default x
  102. >>4 string x \b, Creator tag "%-4.4s"
  103. >0xc byte 00 \b, DOS 3.3 sector order
  104. >>0x10 byte 00 \b, Volume 254
  105. >>0x10 byte&0x7f x \b, Volume %u
  106. >0xc byte 01 \b, ProDOS sector order
  107. # Detect Volume Directory block ($02) + 2mg header offset
  108. >>0x440 string \x00\x00\x03\x00
  109. >>>0x444 byte &0xF0
  110. >>>>0x445 string x \b, Volume /%s
  111. >>>>0x469 leshort x \b, %u Blocks
  112. >0xc byte 02 \b, NIB data
  113. # magic for Newton PDA package formats
  114. # from Ruda Moura <ruda@helllabs.org>
  115. 0 string package0 Newton package, NOS 1.x,
  116. >12 belong &0x80000000 AutoRemove,
  117. >12 belong &0x40000000 CopyProtect,
  118. >12 belong &0x10000000 NoCompression,
  119. >12 belong &0x04000000 Relocation,
  120. >12 belong &0x02000000 UseFasterCompression,
  121. >16 belong x version %d
  122. 0 string package1 Newton package, NOS 2.x,
  123. >12 belong &0x80000000 AutoRemove,
  124. >12 belong &0x40000000 CopyProtect,
  125. >12 belong &0x10000000 NoCompression,
  126. >12 belong &0x04000000 Relocation,
  127. >12 belong &0x02000000 UseFasterCompression,
  128. >16 belong x version %d
  129. 0 string package4 Newton package,
  130. >8 byte 8 NOS 1.x,
  131. >8 byte 9 NOS 2.x,
  132. >12 belong &0x80000000 AutoRemove,
  133. >12 belong &0x40000000 CopyProtect,
  134. >12 belong &0x10000000 NoCompression,
  135. # The following entries for the Apple II are for files that have
  136. # been transferred as raw binary data from an Apple, without having
  137. # been encapsulated by any of the above archivers.
  138. #
  139. # In general, Apple II formats are hard to identify because Apple DOS
  140. # and especially Apple ProDOS have strong typing in the file system and
  141. # therefore programmers never felt much need to include type information
  142. # in the files themselves.
  143. #
  144. # Eric Fischer <enf@pobox.com>
  145. # AppleWorks word processor:
  146. # URL: https://en.wikipedia.org/wiki/AppleWorks
  147. # Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
  148. # Update: Joerg Jenderek
  149. # NOTE:
  150. # The "O" is really the magic number, but that's so common that it's
  151. # necessary to check the tab stops that follow it to avoid false positives.
  152. # and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
  153. # the newer AppleWorks is from claris with extension CWK
  154. 4 string O
  155. # test for unused bits of zoom- , paginated-boolean bytes
  156. >84 ubequad ^0x00Fe00000000Fe00
  157. # look for tabstop definitions "=" no tab, "|" no tab
  158. # "<" left tab,"^" center tab,">" right tab, "." decimal tab,
  159. # unofficial "!" other , "\x8a" other
  160. # official only if SFMinVers is nonzero
  161. >>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor
  162. # AppleWorks Word Processor File (Apple II)
  163. # ./apple (version 5.25) labeled the entry as "AppleWorks word processor data"
  164. # application/x-appleworks is mime type for claris version with cwk extension
  165. !:mime application/x-appleworks3
  166. # http://home.earthlink.net/~hughhood/appleiiworksenvoy/
  167. # ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
  168. # $70 $1A $F8 $FF is this the apple type ?
  169. #:apple pdosp^Z\xf8\xff
  170. !:ext awp
  171. # minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
  172. >>>183 ubyte 30 3.0
  173. >>>183 ubyte !30
  174. >>>>183 ubyte !0 0x%x
  175. # usual tabstop start sequence "=====<"
  176. >>>5 string x \b, tabstop ruler "%6.6s"
  177. # tabstop ruler
  178. #>>>5 string >\0 \b, tabstops "%-79s"
  179. # zoom switch
  180. >>>85 byte&0x01 >0 \b, zoomed
  181. # whether paginated
  182. >>>90 byte&0x01 >0 \b, paginated
  183. # contains any mail-merge commands
  184. >>>92 byte&0x01 >0 \b, with mail merge
  185. # left margin in 1/10 inches ( normally 0 or 10 )
  186. >>>91 ubyte >0
  187. >>>>91 ubyte x \b, %d/10 inch left margin
  188. # AppleWorks database:
  189. #
  190. # This isn't really a magic number, but it's the closest thing to one
  191. # that I could find. The 1 and 2 really mean "order in which you defined
  192. # categories" and "left to right, top to bottom," respectively; the D and R
  193. # mean that the cursor should move either down or right when you press Return.
  194. #30 string \x01D AppleWorks database data
  195. #30 string \x02D AppleWorks database data
  196. #30 string \x01R AppleWorks database data
  197. #30 string \x02R AppleWorks database data
  198. # AppleWorks spreadsheet:
  199. #
  200. # Likewise, this isn't really meant as a magic number. The R or C means
  201. # row- or column-order recalculation; the A or M means automatic or manual
  202. # recalculation.
  203. #131 string RA AppleWorks spreadsheet data
  204. #131 string RM AppleWorks spreadsheet data
  205. #131 string CA AppleWorks spreadsheet data
  206. #131 string CM AppleWorks spreadsheet data
  207. # Applesoft BASIC:
  208. #
  209. # This is incredibly sloppy, but will be true if the program was
  210. # written at its usual memory location of 2048 and its first line
  211. # number is less than 256. Yuck.
  212. # update by Joerg Jenderek at Feb 2013
  213. # GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
  214. #0 belong&0xff00ff 0x80000 Applesoft BASIC program data
  215. 0 belong&0x00ff00ff 0x00080000
  216. # assuming that line number must be positive
  217. >2 leshort >0 Applesoft BASIC program data, first line number %d
  218. #>2 leshort x \b, first line number %d
  219. # ORCA/EZ assembler:
  220. #
  221. # This will not identify ORCA/M source files, since those have
  222. # some sort of date code instead of the two zero bytes at 6 and 7
  223. # XXX Conflicts with ELF
  224. #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
  225. #>5 byte x \b, build number %d
  226. # Broderbund Fantavision
  227. #
  228. # I don't know what these values really mean, but they seem to recur.
  229. # Will they cause too many conflicts?
  230. # Probably :-)
  231. #2 belong&0xFF00FF 0x040008 Fantavision movie data
  232. # Some attempts at images.
  233. #
  234. # These are actually just bit-for-bit dumps of the frame buffer, so
  235. # there's really no reasonably way to distinguish them except for their
  236. # address (if preserved) -- 8192 or 16384 -- and their length -- 8192
  237. # or, occasionally, 8184.
  238. #
  239. # Nevertheless this will manage to catch a lot of images that happen
  240. # to have a solid-colored line at the bottom of the screen.
  241. # GRR: Magic too weak
  242. #8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
  243. #8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
  244. #8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
  245. #8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
  246. #8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
  247. # Beagle Bros. Apple Mechanic fonts
  248. 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
  249. # Apple Universal Disk Image Format (UDIF) - dmg files.
  250. # From Johan Gade.
  251. # These entries are disabled for now until we fix the following issues.
  252. #
  253. # Note there might be some problems with the "VAX COFF executable"
  254. # entry. Note this entry should be placed before the mac filesystem section,
  255. # particularly the "Apple Partition data" entry.
  256. #
  257. # The intended meaning of these tests is, that the file is only of the
  258. # specified type if both of the lines are correct - i.e. if the first
  259. # line matches and the second doesn't then it is not of that type.
  260. #
  261. #0 long 0x7801730d
  262. #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
  263. #
  264. # Note that this entry is recognized correctly by the "Apple Partition
  265. # data" entry - however since this entry is more specific - this
  266. # information seems to be more useful.
  267. #0 long 0x45520200
  268. #>0x410 string disk\ image UDIF read/write image (UDRW)
  269. # From: Toby Peterson <toby@apple.com>
  270. 0 string bplist00 Apple binary property list
  271. # Apple binary property list (bplist)
  272. # Assumes version bytes are hex.
  273. # Provides content hints for version 0 files. Assumes that the root
  274. # object is the first object (true for CoreFoundation implementation).
  275. # From: David Remahl <dremahl@apple.com>
  276. 0 string bplist
  277. >6 byte x \bCoreFoundation binary property list data, version 0x%c
  278. >>7 byte x \b%c
  279. >6 string 00 \b
  280. >>8 byte&0xF0 0x00 \b
  281. >>>8 byte&0x0F 0x00 \b, root type: null
  282. >>>8 byte&0x0F 0x08 \b, root type: false boolean
  283. >>>8 byte&0x0F 0x09 \b, root type: true boolean
  284. >>8 byte&0xF0 0x10 \b, root type: integer
  285. >>8 byte&0xF0 0x20 \b, root type: real
  286. >>8 byte&0xF0 0x30 \b, root type: date
  287. >>8 byte&0xF0 0x40 \b, root type: data
  288. >>8 byte&0xF0 0x50 \b, root type: ascii string
  289. >>8 byte&0xF0 0x60 \b, root type: unicode string
  290. >>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
  291. >>8 byte&0xF0 0xa0 \b, root type: array
  292. >>8 byte&0xF0 0xd0 \b, root type: dictionary
  293. # Apple/NeXT typedstream data
  294. # Serialization format used by NeXT and Apple for various
  295. # purposes in YellowStep/Cocoa, including some nib files.
  296. # From: David Remahl <dremahl@apple.com>
  297. 2 string typedstream NeXT/Apple typedstream data, big endian
  298. >0 byte x \b, version %d
  299. >0 byte <5 \b
  300. >>13 byte 0x81 \b
  301. >>>14 ubeshort x \b, system %d
  302. 2 string streamtyped NeXT/Apple typedstream data, little endian
  303. >0 byte x \b, version %d
  304. >0 byte <5 \b
  305. >>13 byte 0x81 \b
  306. >>>14 uleshort x \b, system %d
  307. #------------------------------------------------------------------------------
  308. # CAF: Apple CoreAudio File Format
  309. #
  310. # Container format for high-end audio purposes.
  311. # From: David Remahl <dremahl@apple.com>
  312. #
  313. 0 string caff CoreAudio Format audio file
  314. >4 beshort <10 version %d
  315. >6 beshort x
  316. #------------------------------------------------------------------------------
  317. # Keychain database files
  318. 0 string kych Mac OS X Keychain File
  319. #------------------------------------------------------------------------------
  320. # Code Signing related file types
  321. 0 belong 0xfade0c00 Mac OS X Code Requirement
  322. >8 belong 1 (opExpr)
  323. >4 belong x - %d bytes
  324. 0 belong 0xfade0c01 Mac OS X Code Requirement Set
  325. >8 belong >1 containing %d items
  326. >4 belong x - %d bytes
  327. 0 belong 0xfade0c02 Mac OS X Code Directory
  328. >8 belong x version %x
  329. >12 belong >0 flags 0x%x
  330. >4 belong x - %d bytes
  331. 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
  332. >4 belong x - %d bytes
  333. 0 belong 0xfade0cc1 Mac OS X Detached Code Signature
  334. >8 belong >1 (%d elements)
  335. >4 belong x - %d bytes
  336. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  337. # .vdi
  338. 4 string innotek\ VirtualBox\ Disk\ Image %s
  339. # Apple disk partition stuff
  340. # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
  341. # Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
  342. # Update: Joerg Jenderek
  343. # "ER" is APPLE_DRVR_MAP_MAGIC signature
  344. 0 beshort 0x4552
  345. # display Apple Driver Map (strength=50) after Syslinux bootloader (71)
  346. #!:strength +0
  347. # strengthen the magic by looking for used blocksizes 512 2048
  348. >2 ubeshort&0xf1FF 0 Apple Driver Map
  349. # last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
  350. #>>504 ubequad&0x0000FFffFFff0000 0
  351. !:mime application/x-apple-diskimage
  352. !:apple ????devr
  353. # https://en.wikipedia.org/wiki/Apple_Disk_Image
  354. !:ext dmg/iso
  355. # sbBlkSize for driver descriptor map 512 2048
  356. >>2 beshort x \b, blocksize %d
  357. # sbBlkCount sometimes garbish like
  358. # 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
  359. # 0xf2720100 for bunziped Firefox 48.0-2.dmg
  360. # 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
  361. # 0x00009090 by syslinux-6.03/utils/isohybrid.c
  362. >>4 ubelong x \b, blockcount %u
  363. # following device/driver information not very useful
  364. # device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
  365. >>8 ubeshort x \b, devtype %u
  366. # device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
  367. >>10 ubeshort x \b, devid %u
  368. # driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
  369. >>12 ubelong >0
  370. >>>12 ubelong x \b, driver data %u
  371. # number of driver descriptors sbDrvrCount <= 61
  372. # (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
  373. >>16 ubeshort x \b, driver count %u
  374. # 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
  375. # >>18 use apple-driver-map
  376. # >>26 use apple-driver-map
  377. # # ...
  378. # >>500 use apple-driver-map
  379. # number of partitions is always same in every partition (map block count)
  380. #>>0x0204 ubelong x \b, %u partitions
  381. >>0x0204 ubelong >0 \b, contains[@0x200]:
  382. >>>0x0200 use apple-apm
  383. >>0x0204 ubelong >1 \b, contains[@0x400]:
  384. >>>0x0400 use apple-apm
  385. >>0x0204 ubelong >2 \b, contains[@0x600]:
  386. >>>0x0600 use apple-apm
  387. >>0x0204 ubelong >3 \b, contains[@0x800]:
  388. >>>0x0800 use apple-apm
  389. >>0x0204 ubelong >4 \b, contains[@0xA00]:
  390. >>>0x0A00 use apple-apm
  391. >>0x0204 ubelong >5 \b, contains[@0xC00]:
  392. >>>0x0C00 use apple-apm
  393. >>0x0204 ubelong >6 \b, contains[@0xE00]:
  394. >>>0x0E00 use apple-apm
  395. >>0x0204 ubelong >7 \b, contains[@0x1000]:
  396. >>>0x1000 use apple-apm
  397. # display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
  398. 0 name apple-driver-map
  399. >0 ubequad !0
  400. # descBlock first block of driver
  401. >>0 ubelong x \b, driver start block %u
  402. # descSize driver size in blocks
  403. >>4 ubeshort x \b, size %u
  404. # descType driver system type 1 701h F8FFh FFFFh
  405. >>6 ubeshort x \b, type 0x%x
  406. # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
  407. # Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
  408. # Update: Joerg Jenderek
  409. # Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
  410. # magic stronger.
  411. # for apple partition map stored as a single file
  412. 0 belong 0x504d0000
  413. # to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
  414. #!:strength +0
  415. >0 use apple-apm
  416. # magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
  417. # file: could not find any valid magic files!
  418. #!:ext bin
  419. # display apple partition map. Normally called after Apple driver map
  420. 0 name apple-apm
  421. >0 belong 0x504d0000 Apple Partition Map
  422. # number of partitions
  423. >>4 ubelong x \b, map block count %u
  424. # logical block (512 bytes) start of partition
  425. >>8 ubelong x \b, start block %u
  426. >>12 ubelong x \b, block count %u
  427. >>16 string >0 \b, name %s
  428. >>48 string >0 \b, type %s
  429. # processor type dpme_process_id[16] e.g. "68000" "68020"
  430. >>120 string >0 \b, processor %s
  431. # A/UX boot arguments BootArgs[128]
  432. >>136 string >0 \b, boot arguments %s
  433. # status of partition dpme_flags
  434. >>88 belong & 1 \b, valid
  435. >>88 belong & 2 \b, allocated
  436. >>88 belong & 4 \b, in use
  437. >>88 belong & 8 \b, has boot info
  438. >>88 belong & 16 \b, readable
  439. >>88 belong & 32 \b, writable
  440. >>88 belong & 64 \b, pic boot code
  441. >>88 belong & 128 \b, chain compatible driver
  442. >>88 belong & 256 \b, real driver
  443. >>88 belong & 512 \b, chain driver
  444. # mount automatically at startup APPLE_PS_AUTO_MOUNT
  445. >>88 ubelong &0x40000000 \b, mount at startup
  446. # is the startup partition APPLE_PS_STARTUP
  447. >>88 ubelong &0x80000000 \b, is the startup partition
  448. #https://wiki.mozilla.org/DS_Store_File_Format
  449. #https://en.wikipedia.org/wiki/.DS_Store
  450. 0 string \0\0\0\1Bud1\0 Apple Desktop Services Store
  451. # HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
  452. # Usually not in separate files, but have either filename rsrc with
  453. # no extension, or a filename corresponding to another file, with
  454. # extensions rsr/rsrc
  455. 0 string \000\000\001\000
  456. >4 leshort 0
  457. >>16 lelong 0 Apple HFS/HFS+ resource fork
  458. #https://en.wikipedia.org/wiki/AppleScript
  459. 0 string FasdUAS AppleScript compiled
  460. # AppleWorks/ClarisWorks
  461. # https://github.com/joshenders/appleworks_format
  462. # http://fileformats.archiveteam.org/wiki/AppleWorks
  463. 0 name appleworks
  464. >0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document
  465. >0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document
  466. >0 default x
  467. >>0 belong x AppleWorks/ClarisWorks CWK Document
  468. >0 byte x \b, version %d
  469. >30 beshort x \b, %d
  470. >32 beshort x \bx%d
  471. !:ext cwk
  472. 4 string BOBO
  473. >0 byte >4
  474. >>12 belong 0
  475. >>>26 belong 0
  476. >>>>0 use appleworks
  477. >0 belong 0x0481ad00
  478. >>0 use appleworks
  479. # magic for Apple File System (APFS)
  480. # from Alex Myczko <alex@aiei.ch>
  481. 32 string NXSB Apple File System (APFS)
  482. >36 ulelong x \b, blocksize %u
  483. # iTunes cover art (versions 1 and 2)
  484. 4 string itch
  485. >24 string artw
  486. >>0x1e8 string data iTunes cover art
  487. >>>0x1ed string PNG (PNG)
  488. >>>0x1ec beshort 0xffd8 (JPEG)
  489. # MacPaint image
  490. 65 string PNTGMPNT MacPaint image data
  491. #0 belong 2 MacPaint image data