archive 53 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638
  1. #------------------------------------------------------------------------------
  2. # $File: archive,v 1.133 2019/11/15 21:03:14 christos Exp $
  3. # archive: file(1) magic for archive formats (see also "msdos" for self-
  4. # extracting compressed archives)
  5. #
  6. # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
  7. # pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c.
  8. # POSIX tar archives
  9. # URL: https://en.wikipedia.org/wiki/Tar_(computing)
  10. # Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current
  11. # header mainly padded with nul bytes
  12. 500 quad 0
  13. !:strength /2
  14. # filename or extended attribute printable strings in range space null til umlaut ue
  15. >0 ubeshort >0x1F00
  16. >>0 ubeshort <0xFCFD
  17. # last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad
  18. # at https://sourceforge.net/projects/s-tar/files/testscripts/
  19. >>>508 ubelong&0x8B9E8DFF 0
  20. # nul, space or ascii digit 0-7 at start of mode
  21. >>>>100 ubyte&0xC8 =0
  22. >>>>>101 ubyte&0xC8 =0
  23. # nul, space at end of check sum
  24. >>>>>>155 ubyte&0xDF =0
  25. # space or ascii digit 0 at start of check sum
  26. >>>>>>>148 ubyte&0xEF =0x20
  27. >>>>>>>>0 use tar-file
  28. # minimal check and then display tar archive information which can also be
  29. # embedded inside others like Android Backup, Clam AntiVirus database
  30. 0 name tar-file
  31. >257 string !ustar
  32. # header padded with nuls
  33. >>257 ulong =0
  34. # GNU tar version 1.29 with non pax format option without refusing
  35. # creates misleading V7 header for Long path, Multi-volume, Volume type
  36. >>>156 ubyte 0x4c GNU tar archive
  37. !:mime application/x-gtar
  38. !:ext tar/gtar
  39. >>>156 ubyte 0x4d GNU tar archive
  40. !:mime application/x-gtar
  41. !:ext tar/gtar
  42. >>>156 ubyte 0x56 GNU tar archive
  43. !:mime application/x-gtar
  44. !:ext tar/gtar
  45. >>>156 default x tar archive (V7)
  46. !:mime application/x-tar
  47. !:ext tar
  48. # other stuff in padding
  49. # some implementations add new fields to the blank area at the end of the header record
  50. # created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option
  51. >>257 ulong !0 tar archive (old)
  52. !:mime application/x-tar
  53. !:ext tar
  54. # magic in newer, GNU, posix variants
  55. >257 string =ustar
  56. # 2 last char of magic and UStar version because string expression does not work
  57. # 2 space characters followed by a null for GNU variant
  58. >>261 ubelong =0x72202000 POSIX tar archive (GNU)
  59. !:mime application/x-gtar
  60. !:ext tar/gtar
  61. # UStar version with ASCII "00"
  62. >>261 ubelong 0x72003030 POSIX
  63. # gLOBAL and ExTENSION type only found in POSIX.1-2001 format
  64. >>>156 ubyte 0x67 \b.1-2001
  65. >>>156 ubyte 0x78 \b.1-2001
  66. >>>156 ubyte x tar archive
  67. !:mime application/x-ustar
  68. !:ext tar/ustar
  69. # version with 2 binary nuls embedded in Android Backup like com.android.settings.ab
  70. >>261 ubelong 0x72000000 tar archive (ustar)
  71. !:mime application/x-ustar
  72. !:ext tar/ustar
  73. # not seen ustar variant with garbish version
  74. >>261 default x tar archive (unknown ustar)
  75. !:mime application/x-ustar
  76. !:ext tar/ustar
  77. # type flag of 1st tar archive member
  78. #>156 ubyte x \b, %c-type
  79. >156 ubyte x
  80. >>156 ubyte 0 \b, file
  81. >>156 ubyte 0x30 \b, file
  82. >>156 ubyte 0x31 \b, hard link
  83. >>156 ubyte 0x32 \b, symlink
  84. >>156 ubyte 0x33 \b, char device
  85. >>156 ubyte 0x34 \b, block device
  86. >>156 ubyte 0x35 \b, directory
  87. >>156 ubyte 0x36 \b, fifo
  88. >>156 ubyte 0x37 \b, reserved
  89. >>156 ubyte 0x4c \b, long path
  90. >>156 ubyte 0x4d \b, multi volume
  91. >>156 ubyte 0x56 \b, volume
  92. >>156 ubyte 0x67 \b, global
  93. >>156 ubyte 0x78 \b, extension
  94. >>156 default x \b, type
  95. >>>156 ubyte x '%c'
  96. # name[100]
  97. >0 string >\0 %-.60s
  98. # mode mainly stored as an octal number in ASCII null or space terminated
  99. >100 string >\0 \b, mode %-.7s
  100. # user id mainly as octal numbers in ASCII null or space terminated
  101. >108 string >\0 \b, uid %-.7s
  102. # group id mainly as octal numbers in ASCII null or space terminated
  103. >116 string >\0 \b, gid %-.7s
  104. # size mainly as octal number in ASCII
  105. >124 ubyte <0x38
  106. >>124 string >\0 \b, size %-.12s
  107. # coding indicated by setting the high-order bit of the leftmost byte
  108. >124 ubyte >0xEF \b, size 0x
  109. >>124 ubyte !0xff \b%2.2x
  110. >>125 ubyte !0xff \b%2.2x
  111. >>126 ubyte !0xff \b%2.2x
  112. >>127 ubyte !0xff \b%2.2x
  113. >>128 ubyte !0xff \b%2.2x
  114. >>129 ubyte !0xff \b%2.2x
  115. >>130 ubyte !0xff \b%2.2x
  116. >>131 ubyte !0xff \b%2.2x
  117. >>132 ubyte !0xff \b%2.2x
  118. >>133 ubyte !0xff \b%2.2x
  119. >>134 ubyte !0xff \b%2.2x
  120. >>135 ubyte !0xff \b%2.2x
  121. # seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated
  122. >136 string >\0 \b, seconds %-.11s
  123. # header checksum stored as an octal number in ASCII null or space terminated
  124. #>148 string x \b, cksum %.7s
  125. # linkname[100]
  126. >157 string >\0 \b, linkname %-.40s
  127. # additional fields for ustar
  128. >257 string =ustar
  129. # owner user name null terminated
  130. >>265 string >\0 \b, user %-.32s
  131. # group name null terminated
  132. >>297 string >\0 \b, group %-.32s
  133. # device major minor if not zero
  134. >>329 ubequad&0xCFCFCFCFcFcFcFdf !0
  135. >>>329 string x \b, devmaj %-.7s
  136. >>337 ubequad&0xCFCFCFCFcFcFcFdf !0
  137. >>>337 string x \b, devmin %-.7s
  138. # prefix[155]
  139. >>345 string >\0 \b, prefix %-.155s
  140. # old non ustar/POSIX tar
  141. >257 string !ustar
  142. >>508 string =tar\0
  143. # padding[255] in old star
  144. >>>257 string >\0 \b, padding: %-.40s
  145. >>508 default x
  146. # padding[255] in old tar sometimes comment field
  147. >>>257 string >\0 \b, comment: %-.40s
  148. # Incremental snapshot gnu-tar format from:
  149. # https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
  150. 0 string GNU\ tar- GNU tar incremental snapshot data
  151. >&0 regex [0-9]\.[0-9]+-[0-9]+ version %s
  152. # cpio archives
  153. #
  154. # Yes, the top two "cpio archive" formats *are* supposed to just be "short".
  155. # The idea is to indicate archives produced on machines with the same
  156. # byte order as the machine running "file" with "cpio archive", and
  157. # to indicate archives produced on machines with the opposite byte order
  158. # from the machine running "file" with "byte-swapped cpio archive".
  159. #
  160. # The SVR4 "cpio(4)" hints that there are additional formats, but they
  161. # are defined as "short"s; I think all the new formats are
  162. # character-header formats and thus are strings, not numbers.
  163. 0 short 070707 cpio archive
  164. !:mime application/x-cpio
  165. 0 short 0143561 byte-swapped cpio archive
  166. !:mime application/x-cpio # encoding: swapped
  167. 0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
  168. 0 string 070701 ASCII cpio archive (SVR4 with no CRC)
  169. 0 string 070702 ASCII cpio archive (SVR4 with CRC)
  170. #
  171. # Various archive formats used by various versions of the "ar"
  172. # command.
  173. #
  174. #
  175. # Original UNIX archive formats.
  176. # They were written with binary values in host byte order, and
  177. # the magic number was a host "int", which might have been 16 bits
  178. # or 32 bits. We don't say "PDP-11" or "VAX", as there might have
  179. # been ports to little-endian 16-bit-int or 32-bit-int platforms
  180. # (x86?) using some of those formats; if none existed, feel free
  181. # to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
  182. # 32-bit. There might have been big-endian ports of that sort as
  183. # well.
  184. #
  185. 0 leshort 0177555 very old 16-bit-int little-endian archive
  186. 0 beshort 0177555 very old 16-bit-int big-endian archive
  187. 0 lelong 0177555 very old 32-bit-int little-endian archive
  188. 0 belong 0177555 very old 32-bit-int big-endian archive
  189. 0 leshort 0177545 old 16-bit-int little-endian archive
  190. >2 string __.SYMDEF random library
  191. 0 beshort 0177545 old 16-bit-int big-endian archive
  192. >2 string __.SYMDEF random library
  193. 0 lelong 0177545 old 32-bit-int little-endian archive
  194. >4 string __.SYMDEF random library
  195. 0 belong 0177545 old 32-bit-int big-endian archive
  196. >4 string __.SYMDEF random library
  197. #
  198. # From "pdp" (but why a 4-byte quantity?)
  199. #
  200. 0 lelong 0x39bed PDP-11 old archive
  201. 0 lelong 0x39bee PDP-11 4.0 archive
  202. #
  203. # XXX - what flavor of APL used this, and was it a variant of
  204. # some ar archive format? It's similar to, but not the same
  205. # as, the APL workspace magic numbers in pdp.
  206. #
  207. 0 long 0100554 apl workspace
  208. #
  209. # System V Release 1 portable(?) archive format.
  210. #
  211. 0 string =<ar> System V Release 1 ar archive
  212. !:mime application/x-archive
  213. #
  214. # Debian package; it's in the portable archive format, and needs to go
  215. # before the entry for regular portable archives, as it's recognized as
  216. # a portable archive whose first member has a name beginning with
  217. # "debian".
  218. #
  219. # Update: Joerg Jenderek
  220. # URL: https://en.wikipedia.org/wiki/Deb_(file_format)
  221. 0 string =!<arch>\ndebian
  222. # https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html
  223. >14 string -split part of multipart Debian package
  224. !:mime application/vnd.debian.binary-package
  225. # udeb is used for stripped down deb file
  226. !:ext deb/udeb
  227. >14 string -binary Debian binary package
  228. !:mime application/vnd.debian.binary-package
  229. !:ext deb/udeb
  230. # This should not happen
  231. >14 default x Unknown Debian package
  232. # NL terminated version; for most Debian cases this is 2.0 or 2.1 for splitted
  233. >68 string >\0 (format %s)
  234. #>68 string !2.0\n
  235. #>>68 string x (format %.3s)
  236. >68 string =2.0\n
  237. # 2nd archive name=control archive name like control.tar.gz or control.tar.xz
  238. >>72 string >\0 \b, with %.14s
  239. # look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma}
  240. >>0 search/0x93e4f data.tar. \b, data compression
  241. # the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised
  242. # for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb
  243. >>>&0 string x %.4s
  244. # splitted debian package case
  245. >68 string =2.1\n
  246. # dpkg-1.18.25/dpkg-split/info.c
  247. # NL terminated ASCII package name like ckermit
  248. >>&0 string x \b, %s
  249. # NL terminated package version like 302-5.3
  250. >>>&1 string x %s
  251. # NL terminated MD5 checksum
  252. >>>>&1 string x \b, MD5 %s
  253. # NL terminated original package length
  254. >>>>>&1 string x \b, unsplitted size %s
  255. # NL terminated part length
  256. >>>>>>&1 string x \b, part length %s
  257. # NL terminated package part like n/m
  258. >>>>>>>&1 string x \b, part %s
  259. # NL terminated package architecture like armhf since dpkg 1.16.1 or later
  260. >>>>>>>>&1 string x \b, %s
  261. #
  262. # MIPS archive; they're in the portable archive format, and need to go
  263. # before the entry for regular portable archives, as it's recognized as
  264. # a portable archive whose first member has a name beginning with
  265. # "__________E".
  266. #
  267. 0 string =!<arch>\n__________E MIPS archive
  268. !:mime application/x-archive
  269. >20 string U with MIPS Ucode members
  270. >21 string L with MIPSEL members
  271. >21 string B with MIPSEB members
  272. >19 string L and an EL hash table
  273. >19 string B and an EB hash table
  274. >22 string X -- out of date
  275. #
  276. # BSD/SVR2-and-later portable archive formats.
  277. #
  278. # Update: Joerg Jenderek
  279. # URL: http://fileformats.archiveteam.org/wiki/AR
  280. # Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/
  281. # Note: Mach-O universal binary in ./cafebabe is dependent
  282. # TODO: unify current ar archive, MIPS archive, Debian package
  283. # distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR;
  284. # *.ar packages from *.a libraries. handle empty archive
  285. 0 string =!<arch>\n current ar archive
  286. # print first and possibly second ar_name[16] for debugging purpose
  287. #>8 string x \b, 1st "%.16s"
  288. #>68 string x \b, 2nd "%.16s"
  289. !:mime application/x-archive
  290. # a in most case for libraries; lib for Microsoft libraries; ar else cases
  291. !:ext a/lib/ar
  292. >8 string __.SYMDEF random library
  293. # first member with long marked name __.SYMDEF SORTED implies BSD library
  294. >68 string __.SYMDEF\ SORTED random library
  295. # Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf
  296. # "archive file" entry moved from ./hp
  297. # LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture
  298. # LST header a_magic 0619h~relocatable library
  299. >68 belong 0x020b0619 - PA-RISC1.0 relocatable library
  300. >68 belong 0x02100619 - PA-RISC1.1 relocatable library
  301. >68 belong 0x02110619 - PA-RISC1.2 relocatable library
  302. >68 belong 0x02140619 - PA-RISC2.0 relocatable library
  303. #EOF for common ar archives
  304. #
  305. # "Thin" archive, as can be produced by GNU ar.
  306. #
  307. 0 string =!<thin>\n thin archive with
  308. >68 belong 0 no symbol entries
  309. >68 belong 1 %d symbol entry
  310. >68 belong >1 %d symbol entries
  311. 0 search/1 -h- Software Tools format archive text
  312. # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
  313. #
  314. # The first byte is the magic (0x1a), byte 2 is the compression type for
  315. # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
  316. # filename of the first file (null terminated). Since some types collide
  317. # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
  318. # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
  319. 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
  320. !:mime application/x-arc
  321. 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
  322. !:mime application/x-arc
  323. 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
  324. !:mime application/x-arc
  325. 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
  326. !:mime application/x-arc
  327. 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
  328. !:mime application/x-arc
  329. 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
  330. !:mime application/x-arc
  331. # [JW] stuff taken from idarc, obviously ARC successors:
  332. 0 lelong&0x8080ffff 0x00000a1a PAK archive data
  333. !:mime application/x-arc
  334. 0 lelong&0x8080ffff 0x0000141a ARC+ archive data
  335. !:mime application/x-arc
  336. 0 lelong&0x8080ffff 0x0000481a HYP archive data
  337. !:mime application/x-arc
  338. # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
  339. # I can't create either SPARK or ArcFS archives so I have not tested this stuff
  340. # [GRR: the original entries collide with ARC, above; replaced with combined
  341. # version (not tested)]
  342. #0 byte 0x1a RISC OS archive (spark format)
  343. 0 string \032archive RISC OS archive (ArcFS format)
  344. 0 string Archive\000 RISC OS archive (ArcFS format)
  345. # All these were taken from idarc, many could not be verified. Unfortunately,
  346. # there were many low-quality sigs, i.e. easy to trigger false positives.
  347. # Please notify me of any real-world fishy/ambiguous signatures and I'll try
  348. # to get my hands on the actual archiver and see if I find something better. [JW]
  349. # probably many can be enhanced by finding some 0-byte or control char near the start
  350. # idarc calls this Crush/Uncompressed... *shrug*
  351. 0 string CRUSH Crush archive data
  352. # Squeeze It (.sqz)
  353. 0 string HLSQZ Squeeze It archive data
  354. # SQWEZ
  355. 0 string SQWEZ SQWEZ archive data
  356. # HPack (.hpk)
  357. 0 string HPAK HPack archive data
  358. # HAP
  359. 0 string \x91\x33HF HAP archive data
  360. # MD/MDCD
  361. 0 string MDmd MDCD archive data
  362. # LIM
  363. 0 string LIM\x1a LIM archive data
  364. # SAR
  365. 3 string LH5 SAR archive data
  366. # BSArc/BS2
  367. 0 string \212\3SB\020\0 BSArc/BS2 archive data
  368. # Bethesda Softworks Archive (Oblivion)
  369. 0 string BSA\0 BSArc archive data
  370. >4 lelong x version %d
  371. # MAR
  372. 2 string =-ah MAR archive data
  373. # ACB
  374. #0 belong&0x00f800ff 0x00800000 ACB archive data
  375. # CPZ
  376. # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
  377. # JRC
  378. 0 string JRchive JRC archive data
  379. # Quantum
  380. 0 string DS\0 Quantum archive data
  381. # ReSOF
  382. 0 string PK\3\6 ReSOF archive data
  383. # QuArk
  384. 0 string 7\4 QuArk archive data
  385. # YAC
  386. 14 string YC YAC archive data
  387. # X1
  388. 0 string X1 X1 archive data
  389. 0 string XhDr X1 archive data
  390. # CDC Codec (.dqt)
  391. 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
  392. # AMGC
  393. 0 string \xad6" AMGC archive data
  394. # NuLIB
  395. 0 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
  396. # PakLeo
  397. 0 string LEOLZW PAKLeo archive data
  398. # ChArc
  399. 0 string SChF ChArc archive data
  400. # PSA
  401. 0 string PSA PSA archive data
  402. # CrossePAC
  403. 0 string DSIGDCC CrossePAC archive data
  404. # Freeze
  405. 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
  406. # KBoom
  407. 0 string \xc2\xa8MP\xc2\xa8 KBoom archive data
  408. # NSQ, must go after CDC Codec
  409. 0 string \x76\xff NSQ archive data
  410. # DPA
  411. 0 string Dirk\ Paehl DPA archive data
  412. # BA
  413. # TODO: idarc says "bytes 0-2 == bytes 3-5"
  414. # TTComp
  415. # URL: http://fileformats.archiveteam.org/wiki/TTComp_archive
  416. # Update: Joerg Jenderek
  417. # GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others
  418. 0 string \0\6
  419. # look for first keyword of Panorama database *.pan
  420. >12 search/261 DESIGN
  421. # skip keyword with low entropy
  422. >12 default x TTComp archive, binary, 4K dictionary
  423. # (version 5.25) labeled the above entry as "TTComp archive data"
  424. # From: Joerg Jenderek
  425. # URL: https://wiki.68kmla.org/DiskCopy_4.2_format_specification
  426. # reference: http://nulib.com/library/FTN.e00005.htm
  427. 0x52 ubeshort 0x0100
  428. # test for disk size equal or above 400k
  429. >0x40 ubelong >409599 Apple DiskCopy 4.2 image
  430. #!:mime application/octet-stream
  431. !:apple dCpydImg
  432. !:ext image/dc42
  433. # image pascal name padded with NULs like Microsoft Mail
  434. >>00 pstring/B x %s
  435. # data size in bytes like 409600
  436. >>0x40 ubelong x \b, %u bytes
  437. # tag size in bytes
  438. >>0x44 ubelong >0 \b, 0x%x tag size
  439. # data checksum
  440. #>>0x48 ubelong x \b, 0x%x checksum
  441. # tag checksum
  442. #>>0x4c ubelong x \b, 0x%x tag checksum
  443. # disk encoding
  444. >>0x50 ubyte 0 \b, GCR CLV ssdd (400k)
  445. >>0x50 ubyte 1 \b, GCR CLV dsdd (800k)
  446. >>0x50 ubyte 2 \b, MFM CAV dsdd (720k)
  447. >>0x50 ubyte 3 \b, MFM CAV dshd (1440k)
  448. >>0x50 ubyte >3 \b, 0x%x encoding
  449. # format byte
  450. >>0x51 ubyte x \b, 0x%x format
  451. #>>0x54 ubequad x \b, data 0x%16.16llx
  452. # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
  453. 0 string ESP ESP archive data
  454. # ZPack
  455. 0 string \1ZPK\1 ZPack archive data
  456. # Sky
  457. 0 string \xbc\x40 Sky archive data
  458. # UFA
  459. 0 string UFA UFA archive data
  460. # Dry
  461. 0 string =-H2O DRY archive data
  462. # FoxSQZ
  463. 0 string FOXSQZ FoxSQZ archive data
  464. # AR7
  465. 0 string ,AR7 AR7 archive data
  466. # PPMZ
  467. 0 string PPMZ PPMZ archive data
  468. # MS Compress
  469. # Update: Joerg Jenderek
  470. # URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
  471. # Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html
  472. # Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z
  473. 4 string \x88\xf0\x27
  474. # KWAJ variant
  475. >0 string KWAJ MS Compress archive data, KWAJ variant
  476. !:mime application/x-ms-compress-kwaj
  477. # extension not working in version 5.32
  478. # magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?'
  479. # file: line 284: Bad magic entry ' ??_'
  480. !:ext ??_
  481. # compression method (0-4)
  482. >>8 uleshort x \b, %u method
  483. # offset of compressed data
  484. >>10 uleshort x \b, 0x%x offset
  485. #>>(10.s) uleshort x
  486. #>>>&-6 string x \b, TEST extension %-.3s
  487. # header flags to mark header extensions
  488. >>12 uleshort >0 \b, 0x%x flags
  489. # 4 bytes: decompressed length of file
  490. >>12 uleshort &0x01
  491. >>>14 ulelong x \b, original size: %u bytes
  492. # 2 bytes: unknown purpose
  493. # 2 bytes: length of unknown data + mentioned bytes
  494. # 1-9 bytes: null-terminated file name
  495. # 1-4 bytes: null-terminated file extension
  496. >>12 uleshort &0x08
  497. >>>12 uleshort ^0x01
  498. >>>>12 uleshort ^0x02
  499. >>>>>12 uleshort ^0x04
  500. >>>>>>12 uleshort ^0x10
  501. >>>>>>>14 string x \b, %-.8s
  502. >>>>>>12 uleshort &0x10
  503. >>>>>>>14 string x \b, %-.8s
  504. >>>>>>>>&1 string x \b.%-.3s
  505. >>>>>12 uleshort &0x04
  506. >>>>>>12 uleshort ^0x10
  507. >>>>>>>(14.s) uleshort x
  508. >>>>>>>>&14 string x \b, %-.8s
  509. >>>>>>12 uleshort &0x10
  510. >>>>>>>(14.s) uleshort x
  511. >>>>>>>>&14 string x \b, %-.8s
  512. >>>>>>>>>&1 string x \b.%-.3s
  513. >>>>12 uleshort &0x02
  514. >>>>>12 uleshort ^0x04
  515. >>>>>>12 uleshort ^0x10
  516. >>>>>>>16 string x \b, %-.8s
  517. >>>>>>12 uleshort &0x10
  518. >>>>>>>16 string x \b, %-.8s
  519. >>>>>>>>&1 string x \b.%-.3s
  520. >>>>>12 uleshort &0x04
  521. >>>>>>12 uleshort ^0x10
  522. >>>>>>>(16.s) uleshort x
  523. >>>>>>>>&16 string x \b, %-.8s
  524. >>>>>>12 uleshort &0x10
  525. >>>>>>>(16.s) uleshort x
  526. >>>>>>>&16 string x %-.8s
  527. >>>>>>>>&1 string x \b.%-.3s
  528. >>>12 uleshort &0x01
  529. >>>>12 uleshort ^0x02
  530. >>>>>12 uleshort ^0x04
  531. >>>>>>12 uleshort ^0x10
  532. >>>>>>>18 string x \b, %-.8s
  533. >>>>>>12 uleshort &0x10
  534. >>>>>>>18 string x \b, %-.8s
  535. >>>>>>>>&1 string x \b.%-.3s
  536. >>>>>12 uleshort &0x04
  537. >>>>>>12 uleshort ^0x10
  538. >>>>>>>(18.s) uleshort x
  539. >>>>>>>>&18 string x \b, %-.8s
  540. >>>>>>12 uleshort &0x10
  541. >>>>>>>(18.s) uleshort x
  542. >>>>>>>>&18 string x \b, %-.8s
  543. >>>>>>>>>&1 string x \b.%-.3s
  544. >>>>12 uleshort &0x02
  545. >>>>>12 uleshort ^0x04
  546. >>>>>>12 uleshort ^0x10
  547. >>>>>>>20 string x \b, %-.8s
  548. >>>>>>12 uleshort &0x10
  549. >>>>>>>20 string x \b, %-.8s
  550. >>>>>>>>&1 string x \b.%-.3s
  551. >>>>>12 uleshort &0x04
  552. >>>>>>12 uleshort ^0x10
  553. >>>>>>>(20.s) uleshort x
  554. >>>>>>>>&20 string x \b, %-.8s
  555. >>>>>>12 uleshort &0x10
  556. >>>>>>>(20.s) uleshort x
  557. >>>>>>>>&20 string x \b, %-.8s
  558. >>>>>>>>>&1 string x \b.%-.3s
  559. # 2 bytes: length of data + mentioned bytes
  560. #
  561. # SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ
  562. >0 string SZDD MS Compress archive data, SZDD variant
  563. !:mime application/x-ms-compress-szdd
  564. !:ext ??_
  565. # The character missing from the end of the filename (0=unknown)
  566. >>9 string >\0 \b, %-.1s is last character of original name
  567. # https://www.betaarchive.com/forum/viewtopic.php?t=26161
  568. # Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e
  569. >>8 string !A \b, %-.1s method
  570. >>10 ulelong >0 \b, original size: %u bytes
  571. # QBasic SZDD variant
  572. 3 string \x88\xf0\x27
  573. >0 string SZ\x20 MS Compress archive data, QBasic variant
  574. !:mime application/x-ms-compress-sz
  575. !:ext ??$
  576. >>8 ulelong >0 \b, original size: %u bytes
  577. # MP3 (archiver, not lossy audio compression)
  578. 0 string MP3\x1a MP3-Archiver archive data
  579. # ZET
  580. 0 string OZ\xc3\x9d ZET archive data
  581. # TSComp
  582. 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
  583. # ARQ
  584. 0 string gW\4\1 ARQ archive data
  585. # Squash
  586. 3 string OctSqu Squash archive data
  587. # Terse
  588. 0 string \5\1\1\0 Terse archive data
  589. # PUCrunch
  590. 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
  591. # UHarc
  592. 0 string UHA UHarc archive data
  593. # ABComp
  594. 0 string \2AB ABComp archive data
  595. 0 string \3AB2 ABComp archive data
  596. # CMP
  597. 0 string CO\0 CMP archive data
  598. # Splint
  599. 0 string \x93\xb9\x06 Splint archive data
  600. # InstallShield
  601. 0 string \x13\x5d\x65\x8c InstallShield Z archive Data
  602. # Gather
  603. 1 string GTH Gather archive data
  604. # BOA
  605. 0 string BOA BOA archive data
  606. # RAX
  607. 0 string ULEB\xa RAX archive data
  608. # Xtreme
  609. 0 string ULEB\0 Xtreme archive data
  610. # Pack Magic
  611. 0 string @\xc3\xa2\1\0 Pack Magic archive data
  612. # BTS
  613. 0 belong&0xfeffffff 0x1a034465 BTS archive data
  614. # ELI 5750
  615. 0 string Ora\ ELI 5750 archive data
  616. # QFC
  617. 0 string \x1aFC\x1a QFC archive data
  618. 0 string \x1aQF\x1a QFC archive data
  619. # PRO-PACK
  620. 0 string RNC PRO-PACK archive data
  621. # 777
  622. 0 string 777 777 archive data
  623. # LZS221
  624. 0 string sTaC LZS221 archive data
  625. # HPA
  626. 0 string HPA HPA archive data
  627. # Arhangel
  628. 0 string LG Arhangel archive data
  629. # EXP1, uses bzip2
  630. 0 string 0123456789012345BZh EXP1 archive data
  631. # IMP
  632. 0 string IMP\xa IMP archive data
  633. # NRV
  634. 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data
  635. # Squish
  636. 0 string \x73\xb2\x90\xf4 Squish archive data
  637. # Par
  638. 0 string PHILIPP Par archive data
  639. 0 string PAR Par archive data
  640. # HIT
  641. 0 string UB HIT archive data
  642. # SBX
  643. 0 belong&0xfffff000 0x53423000 SBX archive data
  644. # NaShrink
  645. 0 string NSK NaShrink archive data
  646. # SAPCAR
  647. 0 string #\ CAR\ archive\ header SAPCAR archive data
  648. 0 string CAR\ 2.00RG SAPCAR archive data
  649. # Disintegrator
  650. 0 string DST Disintegrator archive data
  651. # ASD
  652. 0 string ASD ASD archive data
  653. # InstallShield CAB
  654. 0 string ISc( InstallShield CAB
  655. # TOP4
  656. 0 string T4\x1a TOP4 archive data
  657. # BatComp left out: sig looks like COM executable
  658. # so TODO: get real 4dos batcomp file and find sig
  659. # BlakHole
  660. 0 string BH\5\7 BlakHole archive data
  661. # BIX
  662. 0 string BIX0 BIX archive data
  663. # ChiefLZA
  664. 0 string ChfLZ ChiefLZA archive data
  665. # Blink
  666. 0 string Blink Blink archive data
  667. # Logitech Compress
  668. 0 string \xda\xfa Logitech Compress archive data
  669. # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
  670. 1 string (C)\ STEPANYUK ARS-Sfx archive data
  671. # AKT/AKT32
  672. 0 string AKT32 AKT32 archive data
  673. 0 string AKT AKT archive data
  674. # NPack
  675. 0 string MSTSM NPack archive data
  676. # PFT
  677. 0 string \0\x50\0\x14 PFT archive data
  678. # SemOne
  679. 0 string SEM SemOne archive data
  680. # PPMD
  681. 0 string \x8f\xaf\xac\x84 PPMD archive data
  682. # FIZ
  683. 0 string FIZ FIZ archive data
  684. # MSXiE
  685. 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data
  686. # DeepFreezer
  687. 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data
  688. # DC
  689. 0 string =<DC- DC archive data
  690. # TPac
  691. 0 string \4TPAC\3 TPac archive data
  692. # Ai
  693. 0 string Ai\1\1\0 Ai archive data
  694. 0 string Ai\1\0\0 Ai archive data
  695. # Ai32
  696. 0 string Ai\2\0 Ai32 archive data
  697. 0 string Ai\2\1 Ai32 archive data
  698. # SBC
  699. 0 string SBC SBC archive data
  700. # Ybs
  701. 0 string YBS Ybs archive data
  702. # DitPack
  703. 0 string \x9e\0\0 DitPack archive data
  704. # DMS
  705. 0 string DMS! DMS archive data
  706. # EPC
  707. 0 string \x8f\xaf\xac\x8c EPC archive data
  708. # VSARC
  709. 0 string VS\x1a VSARC archive data
  710. # PDZ
  711. 0 string PDZ PDZ archive data
  712. # ReDuq
  713. 0 string rdqx ReDuq archive data
  714. # GCA
  715. 0 string GCAX GCA archive data
  716. # PPMN
  717. 0 string pN PPMN archive data
  718. # WinImage
  719. 3 string WINIMAGE WinImage archive data
  720. # Compressia
  721. 0 string CMP0CMP Compressia archive data
  722. # UHBC
  723. 0 string UHB UHBC archive data
  724. # WinHKI
  725. 0 string \x61\x5C\x04\x05 WinHKI archive data
  726. # WWPack data file
  727. 0 string WWP WWPack archive data
  728. # BSN (BSA, PTS-DOS)
  729. 0 string \xffBSG BSN archive data
  730. 1 string \xffBSG BSN archive data
  731. 3 string \xffBSG BSN archive data
  732. 1 string \0\xae\2 BSN archive data
  733. 1 string \0\xae\3 BSN archive data
  734. 1 string \0\xae\7 BSN archive data
  735. # AIN
  736. 0 string \x33\x18 AIN archive data
  737. 0 string \x33\x17 AIN archive data
  738. # XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015
  739. # SZip (TODO: doesn't catch all versions)
  740. 0 string SZ\x0a\4 SZip archive data
  741. # XPack DiskImage
  742. # *.XDI updated by Joerg Jenderek Sep 2015
  743. # ftp://ftp.sac.sk/pub/sac/pack/0index.txt
  744. # GRR: this test is still too general as it catches also text files starting with jm
  745. 0 string jm
  746. # only found examples with this additional characteristic 2 bytes
  747. >2 string \x2\x4 Xpack DiskImage archive data
  748. #!:ext xdi
  749. # XPack Data
  750. # *.xpa updated by Joerg Jenderek Sep 2015
  751. # ftp://ftp.elf.stuba.sk/pub/pc/pack/
  752. 0 string xpa XPA
  753. !:ext xpa
  754. # XPA32
  755. # ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip
  756. # created by XPA32.EXE version 1.0.2 for Windows
  757. >0 string xpa\0\1 \b32 archive data
  758. # created by XPACK.COM version 1.67m or 1.67r with short 0x1800
  759. >3 ubeshort !0x0001 \bck archive data
  760. # XPack Single Data
  761. # changed by Joerg Jenderek Sep 2015 back to like in version 5.12
  762. # letter 'I'+ acute accent is equivalent to \xcd
  763. 0 string \xcd\ jm Xpack single archive data
  764. #!:mime application/x-xpa-compressed
  765. !:ext xpa
  766. # TODO: missing due to unknown magic/magic at end of file:
  767. #DWC
  768. #ARG
  769. #ZAR
  770. #PC/3270
  771. #InstallIt
  772. #RKive
  773. #RK
  774. #XPack Diskimage
  775. # These were inspired by idarc, but actually verified
  776. # Dzip archiver (.dz)
  777. # Update: Joerg Jenderek
  778. # URL: http://speeddemosarchive.com/dzip/
  779. # reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c
  780. # GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt
  781. 0 string DZ
  782. # latest version is 2.9 dated 7 may 2003
  783. >2 byte <4 Dzip archive data
  784. !:mime application/x-dzip
  785. !:ext dz
  786. >>2 byte x \b, version %i
  787. >>3 byte x \b.%i
  788. >>4 ulelong x \b, offset 0x%x
  789. >>8 ulelong x \b, %u files
  790. # ZZip archiver (.zz)
  791. 0 string ZZ\ \0\0 ZZip archive data
  792. 0 string ZZ0 ZZip archive data
  793. # PAQ archiver (.paq)
  794. 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
  795. 0 string PAQ PAQ archive data
  796. >3 byte&0xf0 0x30
  797. >>3 byte x (v%c)
  798. # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
  799. 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
  800. 0 string JARCS JAR (ARJ Software, Inc.) archive data
  801. # ARJ archiver (jason@jarthur.Claremont.EDU)
  802. 0 leshort 0xea60 ARJ archive data
  803. !:mime application/x-arj
  804. >5 byte x \b, v%d,
  805. >8 byte &0x04 multi-volume,
  806. >8 byte &0x10 slash-switched,
  807. >8 byte &0x20 backup,
  808. >34 string x original name: %s,
  809. >7 byte 0 os: MS-DOS
  810. >7 byte 1 os: PRIMOS
  811. >7 byte 2 os: Unix
  812. >7 byte 3 os: Amiga
  813. >7 byte 4 os: Macintosh
  814. >7 byte 5 os: OS/2
  815. >7 byte 6 os: Apple ][ GS
  816. >7 byte 7 os: Atari ST
  817. >7 byte 8 os: NeXT
  818. >7 byte 9 os: VAX/VMS
  819. >3 byte >0 %d]
  820. # [JW] idarc says this is also possible
  821. 2 leshort 0xea60 ARJ archive data
  822. # HA archiver (Greg Roelofs, newt@uchicago.edu)
  823. # This is a really bad format. A file containing HAWAII will match this...
  824. #0 string HA HA archive data,
  825. #>2 leshort =1 1 file,
  826. #>2 leshort >1 %hu files,
  827. #>4 byte&0x0f =0 first is type CPY
  828. #>4 byte&0x0f =1 first is type ASC
  829. #>4 byte&0x0f =2 first is type HSC
  830. #>4 byte&0x0f =0x0e first is type DIR
  831. #>4 byte&0x0f =0x0f first is type SPECIAL
  832. # suggestion: at least identify small archives (<1024 files)
  833. 0 belong&0xffff00fc 0x48410000 HA archive data
  834. >2 leshort =1 1 file,
  835. >2 leshort >1 %u files,
  836. >4 byte&0x0f =0 first is type CPY
  837. >4 byte&0x0f =1 first is type ASC
  838. >4 byte&0x0f =2 first is type HSC
  839. >4 byte&0x0f =0x0e first is type DIR
  840. >4 byte&0x0f =0x0f first is type SPECIAL
  841. # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
  842. 0 string HPAK HPACK archive data
  843. # JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
  844. 0 string \351,\001JAM\ JAM archive,
  845. >7 string >\0 version %.4s
  846. >0x26 byte =0x27 -
  847. >>0x2b string >\0 label %.11s,
  848. >>0x27 lelong x serial %08x,
  849. >>0x36 string >\0 fstype %.8s
  850. # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
  851. # Update: Joerg Jenderek
  852. # URL: https://en.wikipedia.org/wiki/LHA_(file_format)
  853. # Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
  854. #
  855. # check and display information of lharc (LHa,PMarc) file
  856. 0 name lharc-file
  857. # check 1st character of method id like -lz4- -lh5- or -pm2-
  858. >2 string -
  859. # check 5th character of method id
  860. >>6 string -
  861. # check header level 0 1 2 3
  862. >>>20 ubyte <4
  863. # check 2nd, 3th and 4th character of method id
  864. >>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b
  865. !:mime application/x-lzh-compressed
  866. # creator type "LHA "
  867. !:apple ????LHA
  868. # display archive type name like "LHa/LZS archive data" or "LArc archive"
  869. >>>>>2 string -lz \b
  870. !:ext lzs
  871. # already known -lzs- -lz4- -lz5- with old names
  872. >>>>>>2 string -lzs LHa/LZS archive data
  873. >>>>>>3 regex \^lz[45] LHarc 1.x archive data
  874. # missing -lz?- with wikipedia names
  875. >>>>>>3 regex \^lz[2378] LArc archive
  876. # display archive type name like "LHa (2.x) archive data"
  877. >>>>>2 string -lh \b
  878. # already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
  879. >>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data
  880. # LHice archiver use ".ICE" as name extension instead usual one ".lzh"
  881. # FOOBAR archiver use ".foo" as name extension instead usual one
  882. # "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment
  883. >>>>>>>2 string -lh1 \b
  884. !:ext lha/lzh/ice
  885. >>>>>>3 regex \^lh[23d] LHa 2.x? archive data
  886. >>>>>>3 regex \^lh[7] LHa (2.x)/LHark archive data
  887. >>>>>>3 regex \^lh[456] LHa (2.x) archive data
  888. >>>>>>>2 string -lh5 \b
  889. # https://en.wikipedia.org/wiki/BIOS
  890. # Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like
  891. # bios.rom , kd7_v14.bin, 1010.004, ...
  892. !:ext lha/lzh/rom/bin
  893. # missing -lh?- variants (Joe Jared)
  894. >>>>>>3 regex \^lh[89a-ce] LHa (Joe Jared) archive
  895. # UNLHA32 2.67a
  896. >>>>>>2 string -lhx LHa (UNLHA32) archive
  897. # lha archives with standard file name extensions ".lha" ".lzh"
  898. >>>>>>3 regex !\^(lh1|lh5) \b
  899. !:ext lha/lzh
  900. # this should not happen if all -lh variants are described
  901. >>>>>>2 default x LHa (unknown) archive
  902. #!:ext lha
  903. # PMarc
  904. >>>>>3 regex \^pm[012] PMarc archive data
  905. !:ext pma
  906. # append method id without leading and trailing minus character
  907. >>>>>3 string x [%3.3s]
  908. >>>>>>0 use lharc-header
  909. #
  910. # check and display information of lharc header
  911. 0 name lharc-header
  912. # header size 0x4 , 0x1b-0x61
  913. >0 ubyte x
  914. # compressed data size != compressed file size
  915. #>7 ulelong x \b, data size %d
  916. # attribute: 0x2~?? 0x10~symlink|target 0x20~normal
  917. #>19 ubyte x \b, 19_0x%x
  918. # level identifier 0 1 2 3
  919. #>20 ubyte x \b, level %d
  920. # time stamp
  921. #>15 ubelong x DATE 0x%8.8x
  922. # OS ID for level 1
  923. >20 ubyte 1
  924. # 0x20 types find for *.rom files
  925. >>(21.b+24) ubyte <0x21 \b, 0x%x OS
  926. # ascii type like M for MSDOS
  927. >>(21.b+24) ubyte >0x20 \b, '%c' OS
  928. # OS ID for level 2
  929. >20 ubyte 2
  930. #>>23 ubyte x \b, OS ID 0x%x
  931. >>23 ubyte <0x21 \b, 0x%x OS
  932. >>23 ubyte >0x20 \b, '%c' OS
  933. # filename only for level 0 and 1
  934. >20 ubyte <2
  935. # length of filename
  936. >>21 ubyte >0 \b, with
  937. # filename
  938. >>>21 pstring x "%s"
  939. #
  940. #2 string -lh0- LHarc 1.x/ARX archive data [lh0]
  941. #!:mime application/x-lharc
  942. 2 string -lh0-
  943. >0 use lharc-file
  944. #2 string -lh1- LHarc 1.x/ARX archive data [lh1]
  945. #!:mime application/x-lharc
  946. 2 string -lh1-
  947. >0 use lharc-file
  948. # NEW -lz2- ... -lz8-
  949. 2 string -lz2-
  950. >0 use lharc-file
  951. 2 string -lz3-
  952. >0 use lharc-file
  953. 2 string -lz4-
  954. >0 use lharc-file
  955. 2 string -lz5-
  956. >0 use lharc-file
  957. 2 string -lz7-
  958. >0 use lharc-file
  959. 2 string -lz8-
  960. >0 use lharc-file
  961. # [never seen any but the last; -lh4- reported in comp.compression:]
  962. #2 string -lzs- LHa/LZS archive data [lzs]
  963. 2 string -lzs-
  964. >0 use lharc-file
  965. # According to wikipedia and others such a version does not exist
  966. #2 string -lh\40- LHa 2.x? archive data [lh ]
  967. #2 string -lhd- LHa 2.x? archive data [lhd]
  968. 2 string -lhd-
  969. >0 use lharc-file
  970. #2 string -lh2- LHa 2.x? archive data [lh2]
  971. 2 string -lh2-
  972. >0 use lharc-file
  973. #2 string -lh3- LHa 2.x? archive data [lh3]
  974. 2 string -lh3-
  975. >0 use lharc-file
  976. #2 string -lh4- LHa (2.x) archive data [lh4]
  977. 2 string -lh4-
  978. >0 use lharc-file
  979. #2 string -lh5- LHa (2.x) archive data [lh5]
  980. 2 string -lh5-
  981. >0 use lharc-file
  982. #2 string -lh6- LHa (2.x) archive data [lh6]
  983. 2 string -lh6-
  984. >0 use lharc-file
  985. #2 string -lh7- LHa (2.x)/LHark archive data [lh7]
  986. 2 string -lh7-
  987. # !:mime application/x-lha
  988. # >20 byte x - header level %d
  989. >0 use lharc-file
  990. # NEW -lh8- ... -lhe- , -lhx-
  991. 2 string -lh8-
  992. >0 use lharc-file
  993. 2 string -lh9-
  994. >0 use lharc-file
  995. 2 string -lha-
  996. >0 use lharc-file
  997. 2 string -lhb-
  998. >0 use lharc-file
  999. 2 string -lhc-
  1000. >0 use lharc-file
  1001. 2 string -lhe-
  1002. >0 use lharc-file
  1003. 2 string -lhx-
  1004. >0 use lharc-file
  1005. # taken from idarc [JW]
  1006. 2 string -lZ PUT archive data
  1007. # already done by LHarc magics
  1008. # this should never happen if all sub types of LZS archive are identified
  1009. #2 string -lz LZS archive data
  1010. 2 string -sw1- Swag archive data
  1011. 0 name rar-file-header
  1012. >24 byte 15 \b, v1.5
  1013. >24 byte 20 \b, v2.0
  1014. >24 byte 29 \b, v4
  1015. >15 byte 0 \b, os: MS-DOS
  1016. >15 byte 1 \b, os: OS/2
  1017. >15 byte 2 \b, os: Win32
  1018. >15 byte 3 \b, os: Unix
  1019. >15 byte 4 \b, os: Mac OS
  1020. >15 byte 5 \b, os: BeOS
  1021. 0 name rar-archive-header
  1022. >3 leshort&0x1ff >0 \b, flags:
  1023. >>3 leshort &0x01 ArchiveVolume
  1024. >>3 leshort &0x02 Commented
  1025. >>3 leshort &0x04 Locked
  1026. >>3 leshort &0x10 NewVolumeNaming
  1027. >>3 leshort &0x08 Solid
  1028. >>3 leshort &0x20 Authenticated
  1029. >>3 leshort &0x40 RecoveryRecordPresent
  1030. >>3 leshort &0x80 EncryptedBlockHeader
  1031. >>3 leshort &0x100 FirstVolume
  1032. # RAR (Roshal Archive) archive
  1033. 0 string Rar!\x1a\7\0 RAR archive data
  1034. !:mime application/x-rar
  1035. !:ext rar/cbr
  1036. # file header
  1037. >(0xc.l+9) byte 0x74
  1038. >>(0xc.l+7) use rar-file-header
  1039. # subblock seems to share information with file header
  1040. >(0xc.l+9) byte 0x7a
  1041. >>(0xc.l+7) use rar-file-header
  1042. >9 byte 0x73
  1043. >>7 use rar-archive-header
  1044. 0 string Rar!\x1a\7\1\0 RAR archive data, v5
  1045. !:mime application/x-rar
  1046. !:ext rar
  1047. # Very old RAR archive
  1048. # https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
  1049. 0 string RE\x7e\x5e RAR archive data (<v1.5)
  1050. !:mime application/x-rar
  1051. !:ext rar/cbr
  1052. # SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
  1053. 0 string SQSH squished archive data (Acorn RISCOS)
  1054. # UC2 archiver (Greg Roelofs, newt@uchicago.edu)
  1055. # [JW] see exe section for self-extracting version
  1056. 0 string UC2\x1a UC2 archive data
  1057. # PKZIP multi-volume archive
  1058. 0 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract
  1059. !:mime application/zip
  1060. !:ext zip/cbz
  1061. # Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
  1062. 0 string PK\005\006 Zip archive data (empty)
  1063. !:mime application/zip
  1064. !:ext zip/cbz
  1065. !:strength +1
  1066. 0 string PK\003\004
  1067. !:strength +1
  1068. # Specialised zip formats which start with a member named 'mimetype'
  1069. # (stored uncompressed, with no 'extra field') containing the file's MIME type.
  1070. # Check for have 8-byte name, 0-byte extra field, name "mimetype", and
  1071. # contents starting with "application/":
  1072. >26 string \x8\0\0\0mimetypeapplication/
  1073. # KOffice / OpenOffice & StarOffice / OpenDocument formats
  1074. # From: Abel Cheung <abel@oaka.org>
  1075. # KOffice (1.2 or above) formats
  1076. # (mimetype contains "application/vnd.kde.<SUBTYPE>")
  1077. >>50 string vnd.kde. KOffice (>=1.2)
  1078. >>>58 string karbon Karbon document
  1079. >>>58 string kchart KChart document
  1080. >>>58 string kformula KFormula document
  1081. >>>58 string kivio Kivio document
  1082. >>>58 string kontour Kontour document
  1083. >>>58 string kpresenter KPresenter document
  1084. >>>58 string kspread KSpread document
  1085. >>>58 string kword KWord document
  1086. # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
  1087. # (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
  1088. >>50 string vnd.sun.xml. OpenOffice.org 1.x
  1089. >>>62 string writer Writer
  1090. >>>>68 byte !0x2e document
  1091. >>>>68 string .template template
  1092. >>>>68 string .global global document
  1093. >>>62 string calc Calc
  1094. >>>>66 byte !0x2e spreadsheet
  1095. >>>>66 string .template template
  1096. >>>62 string draw Draw
  1097. >>>>66 byte !0x2e document
  1098. >>>>66 string .template template
  1099. >>>62 string impress Impress
  1100. >>>>69 byte !0x2e presentation
  1101. >>>>69 string .template template
  1102. >>>62 string math Math document
  1103. >>>62 string base Database file
  1104. # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
  1105. # https://lists.oasis-open.org/archives/office/200505/msg00006.html
  1106. # (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
  1107. >>50 string vnd.oasis.opendocument. OpenDocument
  1108. >>>73 string text
  1109. >>>>77 byte !0x2d Text
  1110. !:mime application/vnd.oasis.opendocument.text
  1111. >>>>77 string -template Text Template
  1112. !:mime application/vnd.oasis.opendocument.text-template
  1113. >>>>77 string -web HTML Document Template
  1114. !:mime application/vnd.oasis.opendocument.text-web
  1115. >>>>77 string -master Master Document
  1116. !:mime application/vnd.oasis.opendocument.text-master
  1117. >>>73 string graphics
  1118. >>>>81 byte !0x2d Drawing
  1119. !:mime application/vnd.oasis.opendocument.graphics
  1120. >>>>81 string -template Template
  1121. !:mime application/vnd.oasis.opendocument.graphics-template
  1122. >>>73 string presentation
  1123. >>>>85 byte !0x2d Presentation
  1124. !:mime application/vnd.oasis.opendocument.presentation
  1125. >>>>85 string -template Template
  1126. !:mime application/vnd.oasis.opendocument.presentation-template
  1127. >>>73 string spreadsheet
  1128. >>>>84 byte !0x2d Spreadsheet
  1129. !:mime application/vnd.oasis.opendocument.spreadsheet
  1130. >>>>84 string -template Template
  1131. !:mime application/vnd.oasis.opendocument.spreadsheet-template
  1132. >>>73 string chart
  1133. >>>>78 byte !0x2d Chart
  1134. !:mime application/vnd.oasis.opendocument.chart
  1135. >>>>78 string -template Template
  1136. !:mime application/vnd.oasis.opendocument.chart-template
  1137. >>>73 string formula
  1138. >>>>80 byte !0x2d Formula
  1139. !:mime application/vnd.oasis.opendocument.formula
  1140. >>>>80 string -template Template
  1141. !:mime application/vnd.oasis.opendocument.formula-template
  1142. >>>73 string database Database
  1143. !:mime application/vnd.oasis.opendocument.database
  1144. # Valid for LibreOffice Base 6.0.1.1 at least
  1145. >>>73 string base Database
  1146. !:mime application/vnd.oasis.opendocument.base
  1147. >>>73 string image
  1148. >>>>78 byte !0x2d Image
  1149. !:mime application/vnd.oasis.opendocument.image
  1150. >>>>78 string -template Template
  1151. !:mime application/vnd.oasis.opendocument.image-template
  1152. # EPUB (OEBPS) books using OCF (OEBPS Container Format)
  1153. # https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
  1154. # From: Ralf Brown <ralf.brown@gmail.com>
  1155. >>50 string epub+zip EPUB document
  1156. !:mime application/epub+zip
  1157. # From: Joerg Jenderek
  1158. # URL: http://en.wikipedia.org/wiki/CorelDRAW
  1159. # NOTE: version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based
  1160. >>50 string x-vnd.corel. Corel
  1161. >>>62 string draw.document+zip Draw drawing, version 14-16
  1162. !:mime application/x-vnd.corel.draw.document+zip
  1163. !:ext cdr
  1164. >>>62 string draw.template+zip Draw template, version 14-16
  1165. !:mime application/x-vnd.corel.draw.template+zip
  1166. !:ext cdrt
  1167. >>>62 string zcf.draw.document+zip Draw drawing, version 17-21
  1168. !:mime application/x-vnd.corel.zcf.draw.document+zip
  1169. !:ext cdr
  1170. >>>62 string zcf.draw.template+zip Draw template, version 17-21
  1171. !:mime application/x-vnd.corel.zcf.draw.template+zip
  1172. !:ext cdt/cdrt
  1173. # Catch other ZIP-with-mimetype formats
  1174. # In a ZIP file, the bytes immediately after a member's contents are
  1175. # always "PK". The 2 regex rules here print the "mimetype" member's
  1176. # contents up to the first 'P'. Luckily, most MIME types don't contain
  1177. # any capital 'P's. This is a kludge.
  1178. # (mimetype contains "application/<OTHER>")
  1179. >>50 default x Zip data
  1180. >>>38 regex [!-OQ-~]+ (MIME type "%s"?)
  1181. !:mime application/zip
  1182. # (mimetype contents other than "application/*")
  1183. >26 string \x8\0\0\0mimetype
  1184. >>38 string !application/
  1185. >>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
  1186. !:mime application/zip
  1187. # Java Jar files
  1188. >(26.s+30) leshort 0xcafe Java archive data (JAR)
  1189. !:mime application/java-archive
  1190. # iOS App
  1191. >(26.s+30) leshort !0xcafe
  1192. >>26 string !\x8\0\0\0mimetype
  1193. >>>30 string Payload/
  1194. >>>>38 search/64 .app/ iOS App
  1195. !:mime application/x-ios-app
  1196. # Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
  1197. # Next line excludes specialized formats:
  1198. >(26.s+30) leshort !0xcafe
  1199. >>26 string !\x8\0\0\0mimetype Zip archive data
  1200. !:mime application/zip
  1201. >>>4 beshort x \b, at least
  1202. >>>4 use zipversion
  1203. >>>4 beshort x to extract
  1204. >>>0x161 string WINZIP \b, WinZIP self-extracting
  1205. # StarView Metafile
  1206. # From Pierre Ducroquet <pinaraf@pinaraf.info>
  1207. 0 string VCLMTF StarView MetaFile
  1208. >6 beshort x \b, version %d
  1209. >8 belong x \b, size %d
  1210. # Zoo archiver
  1211. 20 lelong 0xfdc4a7dc Zoo archive data
  1212. !:mime application/x-zoo
  1213. >4 byte >48 \b, v%c.
  1214. >>6 byte >47 \b%c
  1215. >>>7 byte >47 \b%c
  1216. >32 byte >0 \b, modify: v%d
  1217. >>33 byte x \b.%d+
  1218. >42 lelong 0xfdc4a7dc \b,
  1219. >>70 byte >0 extract: v%d
  1220. >>>71 byte x \b.%d+
  1221. # Shell archives
  1222. 10 string #\ This\ is\ a\ shell\ archive shell archive text
  1223. !:mime application/octet-stream
  1224. #
  1225. # LBR. NB: May conflict with the questionable
  1226. # "binary Computer Graphics Metafile" format.
  1227. #
  1228. 0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
  1229. #
  1230. # PMA (CP/M derivative of LHA)
  1231. # Update: Joerg Jenderek
  1232. # URL: https://en.wikipedia.org/wiki/LHA_(file_format)
  1233. #
  1234. #2 string -pm0- PMarc archive data [pm0]
  1235. 2 string -pm0-
  1236. >0 use lharc-file
  1237. #2 string -pm1- PMarc archive data [pm1]
  1238. 2 string -pm1-
  1239. >0 use lharc-file
  1240. #2 string -pm2- PMarc archive data [pm2]
  1241. 2 string -pm2-
  1242. >0 use lharc-file
  1243. 2 string -pms- PMarc SFX archive (CP/M, DOS)
  1244. #!:mime application/x-foobar-exec
  1245. !:ext com
  1246. 5 string -pc1- PopCom compressed executable (CP/M)
  1247. #!:mime application/x-
  1248. #!:ext com
  1249. # From Rafael Laboissiere <rafael@laboissiere.net>
  1250. # The Project Revision Control System (see
  1251. # http://prcs.sourceforge.net) generates a packaged project
  1252. # file which is recognized by the following entry:
  1253. 0 leshort 0xeb81 PRCS packaged project
  1254. # Microsoft cabinets
  1255. # by David Necas (Yeti) <yeti@physics.muni.cz>
  1256. #0 string MSCF\0\0\0\0 Microsoft cabinet file data,
  1257. #>25 byte x v%d
  1258. #>24 byte x \b.%d
  1259. # MPi: All CABs have version 1.3, so this is pointless.
  1260. # Better magic in debian-additions.
  1261. # GTKtalog catalogs
  1262. # by David Necas (Yeti) <yeti@physics.muni.cz>
  1263. 4 string gtktalog\ GTKtalog catalog data,
  1264. >13 string 3 version 3
  1265. >>14 beshort 0x677a (gzipped)
  1266. >>14 beshort !0x677a (not gzipped)
  1267. >13 string >3 version %s
  1268. ############################################################################
  1269. # Parity archive reconstruction file, the 'par' file format now used on Usenet.
  1270. 0 string PAR\0 PARity archive data
  1271. >48 leshort =0 - Index file
  1272. >48 leshort >0 - file number %d
  1273. # Felix von Leitner <felix-file@fefe.de>
  1274. 0 string d8:announce BitTorrent file
  1275. !:mime application/x-bittorrent
  1276. # Durval Menezes, <jmgthbfile at durval dot com>
  1277. 0 string d13:announce-list BitTorrent file
  1278. !:mime application/x-bittorrent
  1279. 0 string d7:comment BitTorrent file
  1280. !:mime application/x-bittorrent
  1281. 0 string d4:info BitTorrent file
  1282. !:mime application/x-bittorrent
  1283. # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
  1284. 0 beshort 0x0e0f Atari MSA archive data
  1285. >2 beshort x \b, %d sectors per track
  1286. >4 beshort 0 \b, 1 sided
  1287. >4 beshort 1 \b, 2 sided
  1288. >6 beshort x \b, starting track: %d
  1289. >8 beshort x \b, ending track: %d
  1290. # Alternate ZIP string (amc@arwen.cs.berkeley.edu)
  1291. 0 string PK00PK\003\004 Zip archive data
  1292. !:mime application/zip
  1293. !:ext zip/cbz
  1294. # ACE archive (from http://www.wotsit.org/download.asp?f=ace)
  1295. # by Stefan `Sec` Zehl <sec@42.org>
  1296. 7 string **ACE** ACE archive data
  1297. >15 byte >0 version %d
  1298. >16 byte =0x00 \b, from MS-DOS
  1299. >16 byte =0x01 \b, from OS/2
  1300. >16 byte =0x02 \b, from Win/32
  1301. >16 byte =0x03 \b, from Unix
  1302. >16 byte =0x04 \b, from MacOS
  1303. >16 byte =0x05 \b, from WinNT
  1304. >16 byte =0x06 \b, from Primos
  1305. >16 byte =0x07 \b, from AppleGS
  1306. >16 byte =0x08 \b, from Atari
  1307. >16 byte =0x09 \b, from Vax/VMS
  1308. >16 byte =0x0A \b, from Amiga
  1309. >16 byte =0x0B \b, from Next
  1310. >14 byte x \b, version %d to extract
  1311. >5 leshort &0x0080 \b, multiple volumes,
  1312. >>17 byte x \b (part %d),
  1313. >5 leshort &0x0002 \b, contains comment
  1314. >5 leshort &0x0200 \b, sfx
  1315. >5 leshort &0x0400 \b, small dictionary
  1316. >5 leshort &0x0800 \b, multi-volume
  1317. >5 leshort &0x1000 \b, contains AV-String
  1318. >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered)
  1319. >5 leshort &0x2000 \b, with recovery record
  1320. >5 leshort &0x4000 \b, locked
  1321. >5 leshort &0x8000 \b, solid
  1322. # Date in MS-DOS format (whatever that is)
  1323. #>18 lelong x Created on
  1324. # sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
  1325. # <doj@cubic.org>
  1326. 0x1A string sfArk sfArk compressed Soundfont
  1327. >0x15 string 2
  1328. >>0x1 string >\0 Version %s
  1329. >>0x2A string >\0 : %s
  1330. # DR-DOS 7.03 Packed File *.??_
  1331. 0 string Packed\ File\ Personal NetWare Packed File
  1332. >12 string x \b, was "%.12s"
  1333. # EET archive
  1334. # From: Tilman Sauerbeck <tilman@code-monkey.de>
  1335. 0 belong 0x1ee7ff00 EET archive
  1336. !:mime application/x-eet
  1337. # rzip archives
  1338. 0 string RZIP rzip compressed data
  1339. >4 byte x - version %d
  1340. >5 byte x \b.%d
  1341. >6 belong x (%d bytes)
  1342. # From: Joerg Jenderek
  1343. # URL: https://help.foxitsoftware.com/kb/install-fzip-file.php
  1344. # reference: http://mark0.net/download/triddefs_xml.7z/
  1345. # defs/f/fzip.trid.xml
  1346. # Note: unknown compression; No "PK" zip magic; normally in directory like
  1347. # "%APPDATA%\Foxit Software\Addon\Foxit Reader\Install"
  1348. 0 ubequad 0x2506781901010000 Foxit add-on/update
  1349. !:mime application/x-fzip
  1350. !:ext fzip
  1351. # From: "Robert Dale" <robdale@gmail.com>
  1352. 0 belong 123 dar archive,
  1353. >4 belong x label "%.8x
  1354. >>8 belong x %.8x
  1355. >>>12 beshort x %.4x"
  1356. >14 byte 0x54 end slice
  1357. >14 beshort 0x4e4e multi-part
  1358. >14 beshort 0x4e53 multi-part, with -S
  1359. # Symbian installation files
  1360. # https://www.thouky.co.uk/software/psifs/sis.html
  1361. # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
  1362. 8 lelong 0x10000419 Symbian installation file
  1363. !:mime application/vnd.symbian.install
  1364. >4 lelong 0x1000006D (EPOC release 3/4/5)
  1365. >4 lelong 0x10003A12 (EPOC release 6)
  1366. 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x)
  1367. !:mime x-epoc/x-sisx-app
  1368. # From "Nelson A. de Oliveira" <naoliv@gmail.com>
  1369. 0 string MPQ\032 MoPaQ (MPQ) archive
  1370. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  1371. # .kgb
  1372. 0 string KGB_arch KGB Archiver file
  1373. >10 string x with compression level %.1s
  1374. # xar (eXtensible ARchiver) archive
  1375. # URL: https://en.wikipedia.org/wiki/Xar_(archiver)
  1376. # xar archive format: https://code.google.com/p/xar/
  1377. # From: "David Remahl" <dremahl@apple.com>
  1378. # Update: Joerg Jenderek
  1379. # TODO: lzma compression; X509Data for pkg and xip
  1380. # Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or
  1381. # 7z t -txar Xcode_10.2_beta_4.xip`
  1382. 0 string xar! xar archive
  1383. !:mime application/x-xar
  1384. # pkg for Mac OSX installer package like FullBundleUpdate.pkg
  1385. # xip for signed Apple software like Xcode_10.2_beta_4.xip
  1386. !:ext xar/pkg/xip
  1387. # always 28 in older archives
  1388. >4 ubeshort >28 \b, header size %u
  1389. # currently there exit only version 1 since about 2014
  1390. >6 ubeshort >1 version %u,
  1391. >8 ubequad x compressed TOC: %llu,
  1392. #>16 ubequad x uncompressed TOC: %llu,
  1393. # cksum_alg 0-2 in older and also 3-4 in newer
  1394. >24 belong 0 no checksum
  1395. >24 belong 1 SHA-1 checksum
  1396. >24 belong 2 MD5 checksum
  1397. >24 belong 3 SHA-256 checksum
  1398. >24 belong 4 SHA-512 checksum
  1399. >24 belong >4 unknown 0x%x checksum
  1400. #>24 belong >4 checksum
  1401. # For no compression jump 0 bytes
  1402. >24 belong 0
  1403. >>0 ubyte x
  1404. # jump more bytes forward by header size
  1405. >>>&(4.S) ubyte x
  1406. # jump more bytes forward by compressed table of contents size
  1407. #>>>>&(8.Q) ubequad x \b, heap data 0x%llx
  1408. >>>>&(8.Q) ubyte x
  1409. # look for data by ./compress after message with 1 space at end
  1410. >>>>>&-3 indirect x \b, contains
  1411. # For SHA-1 jump 20 minus 2 bytes
  1412. >24 belong 1
  1413. >>18 ubyte x
  1414. # jump more bytes forward by header size
  1415. >>>&(4.S) ubyte x
  1416. # jump more bytes forward by compressed table of contents size
  1417. >>>>&(8.Q) ubyte x
  1418. # data compressed by gzip, bzip, lzma or none
  1419. >>>>>&-1 indirect x \b, contains
  1420. # For SHA-256 jump 32 minus 2 bytes
  1421. >24 belong 3
  1422. >>30 ubyte x
  1423. # jump more bytes forward by header size
  1424. >>>&(4.S) ubyte x
  1425. # jump more bytes forward by compressed table of contents size
  1426. >>>>&(8.Q) ubyte x
  1427. >>>>>&-1 indirect x \b, contains
  1428. # For SHA-512 jump 64 minus 2 bytes
  1429. >24 belong 4
  1430. >>62 ubyte x
  1431. # jump more bytes forward by header size
  1432. >>>&(4.S) ubyte x
  1433. # jump more bytes forward by compressed table of contents size
  1434. >>>>&(8.Q) ubyte x
  1435. >>>>>&-1 indirect x \b, contains
  1436. # Type: Parity Archive
  1437. # From: Daniel van Eeden <daniel_e@dds.nl>
  1438. 0 string PAR2 Parity Archive Volume Set
  1439. # Bacula volume format. (Volumes always start with a block header.)
  1440. # URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
  1441. # From: Adam Buchbinder <adam.buchbinder@gmail.com>
  1442. 12 string BB02 Bacula volume
  1443. >20 bedate x \b, started %s
  1444. # ePub is XHTML + XML inside a ZIP archive. The first member of the
  1445. # archive must be an uncompressed file called 'mimetype' with contents
  1446. # 'application/epub+zip'
  1447. # From: "Michael Gorny" <mgorny@gentoo.org>
  1448. # ZPAQ: http://mattmahoney.net/dc/zpaq.html
  1449. 0 string zPQ ZPAQ stream
  1450. >3 byte x \b, level %d
  1451. # From: Barry Carter <carter.barry@gmail.com>
  1452. # https://encode.ru/threads/456-zpaq-updates/page32
  1453. 0 string 7kSt ZPAQ file
  1454. # BBeB ebook, unencrypted (LRF format)
  1455. # URL: https://www.sven.de/librie/Librie/LrfFormat
  1456. # From: Adam Buchbinder <adam.buchbinder@gmail.com>
  1457. 0 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted
  1458. >8 beshort x \b, version %d
  1459. >36 byte 1 \b, front-to-back
  1460. >36 byte 16 \b, back-to-front
  1461. >42 beshort x \b, (%dx,
  1462. >44 beshort x %d)
  1463. # Symantec GHOST image by Joerg Jenderek at May 2014
  1464. # https://us.norton.com/ghost/
  1465. # https://www.garykessler.net/library/file_sigs.html
  1466. 0 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image
  1467. # *.GHO
  1468. >2 ubyte&0x08 0x00 \b, first file
  1469. # *.GHS or *.[0-9] with cns program option
  1470. >2 ubyte&0x08 0x08 \b, split file
  1471. # part of split index interesting for *.ghs
  1472. >>4 ubyte x id=0x%x
  1473. # compression tag minus one equals numeric compression command line switch z[1-9]
  1474. >3 ubyte 0 \b, no compression
  1475. >3 ubyte 2 \b, fast compression (Z1)
  1476. >3 ubyte 3 \b, medium compression (Z2)
  1477. >3 ubyte >3
  1478. >>3 ubyte <11 \b, compression (Z%d-1)
  1479. >2 ubyte&0x08 0x00
  1480. # ~ 30 byte password field only for *.gho
  1481. >>12 ubequad !0 \b, password protected
  1482. >>44 ubyte !1
  1483. # 1~Image All, sector-by-sector only for *.gho
  1484. >>>10 ubyte 1 \b, sector copy
  1485. # 1~Image Boot track only for *.gho
  1486. >>>43 ubyte 1 \b, boot track
  1487. # 1~Image Disc only for *.gho implies Image Boot track and sector copy
  1488. >>44 ubyte 1 \b, disc sector copy
  1489. # optional image description only *.gho
  1490. >>0xff string >\0 "%-.254s"
  1491. # look for DOS sector end sequence
  1492. >0xE08 search/7776 \x55\xAA
  1493. >>&-512 indirect x \b; contains
  1494. # Google Chrome extensions
  1495. # https://developer.chrome.com/extensions/crx
  1496. # https://developer.chrome.com/extensions/hosting
  1497. 0 string Cr24 Google Chrome extension
  1498. !:mime application/x-chrome-extension
  1499. >4 ulong x \b, version %u
  1500. # SeqBox - Sequenced container
  1501. # ext: sbx, seqbox
  1502. # Marco Pontello marcopon@gmail.com
  1503. # reference: https://github.com/MarcoPon/SeqBox
  1504. 0 string SBx SeqBox,
  1505. >3 byte x version %d
  1506. # LyNX archive
  1507. 56 string USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE LyNX archive
  1508. # From: Joerg Jenderek
  1509. # URL: https://www.acronis.com/
  1510. # Reference: https://en.wikipedia.org/wiki/TIB_(file_format)
  1511. # Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110
  1512. 0 ubequad 0xce24b9a220000000 Acronis True Image backup
  1513. !:mime application/x-acronis-tib
  1514. !:ext tib
  1515. # 01000000
  1516. #>20 ubelong x \b, at 20 0x%x
  1517. # 20000000
  1518. #>28 ubelong x \b, at 28 0x%x
  1519. # strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0"
  1520. # ???
  1521. # strings like "\Device\0000011e" "\Device\0000015a"
  1522. #>0 search/0x6852300/cs \\Device\\
  1523. #>>&-1 pstring x \b, %s
  1524. # "\Device\HarddiskVolume30" "\Device\HarddiskVolume39"
  1525. #>>>&1 search/180/cs \\Device\\
  1526. #>>>>&-1 pstring x \b, %s
  1527. #>>>>>&0 search/29/cs \0\0\xc8\0
  1528. # disk label
  1529. #>>>>>>&10 lestring16 x \b, disk label %11.11s
  1530. #>>>>>>&9 plestring16 x \b, disk label "%11.11s"
  1531. #>>>>>>&10 ubequad x %16.16llx
  1532. # Gentoo XPAK binary package
  1533. # by Michal Gorny <mgorny@gentoo.org>
  1534. # https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5
  1535. -4 string STOP
  1536. >-16 string XPAKSTOP Gentoo binary package (XPAK)
  1537. # From: Joerg Jenderek
  1538. # URL: https://kodi.wiki/view/TexturePacker
  1539. # Reference: https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz
  1540. # /xbmc-Krypton/xbmc/guilib/XBTF.h
  1541. # /xbmc-Krypton/xbmc/guilib/XBTF.cpp
  1542. 0 string XBTF
  1543. # skip ASCII text by looking for terminating \0 of path
  1544. >264 ubyte 0 XBMC texture package
  1545. !:mime application/x-xbmc-xbt
  1546. !:ext xbt
  1547. # XBTF_VERSION 2
  1548. >>4 string !2 \b, version %-.1s
  1549. # nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp
  1550. >>5 ulelong x \b, %u file
  1551. # plural s
  1552. >>5 ulelong >1 \bs
  1553. # path[CXBTFFile[MaximumPathLength=256]
  1554. >>9 string x \b, 1st %s