apple 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311
  1. #------------------------------------------------------------------------------
  2. # $File: apple,v 1.31 2015/08/29 07:10:35 christos Exp $
  3. # apple: file(1) magic for Apple file formats
  4. #
  5. 0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
  6. 0 string \x0aGL Binary II (apple ][) data
  7. 0 string \x76\xff Squeezed (apple ][) data
  8. 0 string NuFile NuFile archive (apple ][) data
  9. 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
  10. 0 belong 0x00051600 AppleSingle encoded Macintosh file
  11. 0 belong 0x00051607 AppleDouble encoded Macintosh file
  12. # Type: Apple Emulator 2IMG format
  13. # From: Radek Vokal <rvokal@redhat.com>
  14. 0 string 2IMG Apple ][ 2IMG Disk Image
  15. >4 string XGS! \b, XGS
  16. >4 string CTKG \b, Catakig
  17. >4 string ShIm \b, Sheppy's ImageMaker
  18. >4 string WOOF \b, Sweet 16
  19. >4 string B2TR \b, Bernie ][ the Rescue
  20. >4 string !nfc \b, ASIMOV2
  21. >4 string x \b, Unknown Format
  22. >0xc byte 00 \b, DOS 3.3 sector order
  23. >>0x10 byte 00 \b, Volume 254
  24. >>0x10 byte&0x7f x \b, Volume %u
  25. >0xc byte 01 \b, ProDOS sector order
  26. >>0x14 short x \b, %u Blocks
  27. >0xc byte 02 \b, NIB data
  28. # magic for Newton PDA package formats
  29. # from Ruda Moura <ruda@helllabs.org>
  30. 0 string package0 Newton package, NOS 1.x,
  31. >12 belong &0x80000000 AutoRemove,
  32. >12 belong &0x40000000 CopyProtect,
  33. >12 belong &0x10000000 NoCompression,
  34. >12 belong &0x04000000 Relocation,
  35. >12 belong &0x02000000 UseFasterCompression,
  36. >16 belong x version %d
  37. 0 string package1 Newton package, NOS 2.x,
  38. >12 belong &0x80000000 AutoRemove,
  39. >12 belong &0x40000000 CopyProtect,
  40. >12 belong &0x10000000 NoCompression,
  41. >12 belong &0x04000000 Relocation,
  42. >12 belong &0x02000000 UseFasterCompression,
  43. >16 belong x version %d
  44. 0 string package4 Newton package,
  45. >8 byte 8 NOS 1.x,
  46. >8 byte 9 NOS 2.x,
  47. >12 belong &0x80000000 AutoRemove,
  48. >12 belong &0x40000000 CopyProtect,
  49. >12 belong &0x10000000 NoCompression,
  50. # The following entries for the Apple II are for files that have
  51. # been transferred as raw binary data from an Apple, without having
  52. # been encapsulated by any of the above archivers.
  53. #
  54. # In general, Apple II formats are hard to identify because Apple DOS
  55. # and especially Apple ProDOS have strong typing in the file system and
  56. # therefore programmers never felt much need to include type information
  57. # in the files themselves.
  58. #
  59. # Eric Fischer <enf@pobox.com>
  60. # AppleWorks word processor:
  61. #
  62. # This matches the standard tab stops for an AppleWorks file, but if
  63. # a file has a tab stop set in the first four columns this will fail.
  64. #
  65. # The "O" is really the magic number, but that's so common that it's
  66. # necessary to check the tab stops that follow it to avoid false positives.
  67. 4 string O==== AppleWorks word processor data
  68. >85 byte&0x01 >0 \b, zoomed
  69. >90 byte&0x01 >0 \b, paginated
  70. >92 byte&0x01 >0 \b, with mail merge
  71. #>91 byte x \b, left margin %d
  72. # AppleWorks database:
  73. #
  74. # This isn't really a magic number, but it's the closest thing to one
  75. # that I could find. The 1 and 2 really mean "order in which you defined
  76. # categories" and "left to right, top to bottom," respectively; the D and R
  77. # mean that the cursor should move either down or right when you press Return.
  78. #30 string \x01D AppleWorks database data
  79. #30 string \x02D AppleWorks database data
  80. #30 string \x01R AppleWorks database data
  81. #30 string \x02R AppleWorks database data
  82. # AppleWorks spreadsheet:
  83. #
  84. # Likewise, this isn't really meant as a magic number. The R or C means
  85. # row- or column-order recalculation; the A or M means automatic or manual
  86. # recalculation.
  87. #131 string RA AppleWorks spreadsheet data
  88. #131 string RM AppleWorks spreadsheet data
  89. #131 string CA AppleWorks spreadsheet data
  90. #131 string CM AppleWorks spreadsheet data
  91. # Applesoft BASIC:
  92. #
  93. # This is incredibly sloppy, but will be true if the program was
  94. # written at its usual memory location of 2048 and its first line
  95. # number is less than 256. Yuck.
  96. # update by Joerg Jenderek at Feb 2013
  97. # GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
  98. #0 belong&0xff00ff 0x80000 Applesoft BASIC program data
  99. 0 belong&0x00ff00ff 0x00080000
  100. # assuming that line number must be positive
  101. >2 leshort >0 Applesoft BASIC program data, first line number %d
  102. #>2 leshort x \b, first line number %d
  103. # ORCA/EZ assembler:
  104. #
  105. # This will not identify ORCA/M source files, since those have
  106. # some sort of date code instead of the two zero bytes at 6 and 7
  107. # XXX Conflicts with ELF
  108. #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
  109. #>5 byte x \b, build number %d
  110. # Broderbund Fantavision
  111. #
  112. # I don't know what these values really mean, but they seem to recur.
  113. # Will they cause too many conflicts?
  114. # Probably :-)
  115. #2 belong&0xFF00FF 0x040008 Fantavision movie data
  116. # Some attempts at images.
  117. #
  118. # These are actually just bit-for-bit dumps of the frame buffer, so
  119. # there's really no reasonably way to distinguish them except for their
  120. # address (if preserved) -- 8192 or 16384 -- and their length -- 8192
  121. # or, occasionally, 8184.
  122. #
  123. # Nevertheless this will manage to catch a lot of images that happen
  124. # to have a solid-colored line at the bottom of the screen.
  125. # GRR: Magic too weak
  126. #8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
  127. #8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
  128. #8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
  129. #8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
  130. #8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
  131. # Beagle Bros. Apple Mechanic fonts
  132. 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
  133. # Apple Universal Disk Image Format (UDIF) - dmg files.
  134. # From Johan Gade.
  135. # These entries are disabled for now until we fix the following issues.
  136. #
  137. # Note there might be some problems with the "VAX COFF executable"
  138. # entry. Note this entry should be placed before the mac filesystem section,
  139. # particularly the "Apple Partition data" entry.
  140. #
  141. # The intended meaning of these tests is, that the file is only of the
  142. # specified type if both of the lines are correct - i.e. if the first
  143. # line matches and the second doesn't then it is not of that type.
  144. #
  145. #0 long 0x7801730d
  146. #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
  147. #
  148. # Note that this entry is recognized correctly by the "Apple Partition
  149. # data" entry - however since this entry is more specific - this
  150. # information seems to be more useful.
  151. #0 long 0x45520200
  152. #>0x410 string disk\ image UDIF read/write image (UDRW)
  153. # From: Toby Peterson <toby@apple.com>
  154. 0 string bplist00 Apple binary property list
  155. # Apple binary property list (bplist)
  156. # Assumes version bytes are hex.
  157. # Provides content hints for version 0 files. Assumes that the root
  158. # object is the first object (true for CoreFoundation implementation).
  159. # From: David Remahl <dremahl@apple.com>
  160. 0 string bplist
  161. >6 byte x \bCoreFoundation binary property list data, version 0x%c
  162. >>7 byte x \b%c
  163. >6 string 00 \b
  164. >>8 byte&0xF0 0x00 \b
  165. >>>8 byte&0x0F 0x00 \b, root type: null
  166. >>>8 byte&0x0F 0x08 \b, root type: false boolean
  167. >>>8 byte&0x0F 0x09 \b, root type: true boolean
  168. >>8 byte&0xF0 0x10 \b, root type: integer
  169. >>8 byte&0xF0 0x20 \b, root type: real
  170. >>8 byte&0xF0 0x30 \b, root type: date
  171. >>8 byte&0xF0 0x40 \b, root type: data
  172. >>8 byte&0xF0 0x50 \b, root type: ascii string
  173. >>8 byte&0xF0 0x60 \b, root type: unicode string
  174. >>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
  175. >>8 byte&0xF0 0xa0 \b, root type: array
  176. >>8 byte&0xF0 0xd0 \b, root type: dictionary
  177. # Apple/NeXT typedstream data
  178. # Serialization format used by NeXT and Apple for various
  179. # purposes in YellowStep/Cocoa, including some nib files.
  180. # From: David Remahl <dremahl@apple.com>
  181. 2 string typedstream NeXT/Apple typedstream data, big endian
  182. >0 byte x \b, version %d
  183. >0 byte <5 \b
  184. >>13 byte 0x81 \b
  185. >>>14 ubeshort x \b, system %d
  186. 2 string streamtyped NeXT/Apple typedstream data, little endian
  187. >0 byte x \b, version %d
  188. >0 byte <5 \b
  189. >>13 byte 0x81 \b
  190. >>>14 uleshort x \b, system %d
  191. #------------------------------------------------------------------------------
  192. # CAF: Apple CoreAudio File Format
  193. #
  194. # Container format for high-end audio purposes.
  195. # From: David Remahl <dremahl@apple.com>
  196. #
  197. 0 string caff CoreAudio Format audio file
  198. >4 beshort <10 version %d
  199. >6 beshort x
  200. #------------------------------------------------------------------------------
  201. # Keychain database files
  202. 0 string kych Mac OS X Keychain File
  203. #------------------------------------------------------------------------------
  204. # Code Signing related file types
  205. 0 belong 0xfade0c00 Mac OS X Code Requirement
  206. >8 belong 1 (opExpr)
  207. >4 belong x - %d bytes
  208. 0 belong 0xfade0c01 Mac OS X Code Requirement Set
  209. >8 belong >1 containing %d items
  210. >4 belong x - %d bytes
  211. 0 belong 0xfade0c02 Mac OS X Code Directory
  212. >8 belong x version %x
  213. >12 belong >0 flags 0x%x
  214. >4 belong x - %d bytes
  215. 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
  216. >4 belong x - %d bytes
  217. 0 belong 0xfade0cc1 Mac OS X Detached Code Signature
  218. >8 belong >1 (%d elements)
  219. >4 belong x - %d bytes
  220. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  221. # .vdi
  222. 4 string innotek\ VirtualBox\ Disk\ Image %s
  223. # Apple disk partition stuff, strengthen the magic using byte 4
  224. 0 beshort 0x4552
  225. >4 byte 0 Apple Driver Map
  226. >>2 beshort x \b, blocksize %d
  227. >>4 belong x \b, blockcount %d
  228. >>10 beshort x \b, devtype %d
  229. >>12 beshort x \b, devid %d
  230. >>20 beshort x \b, descriptors %d
  231. # Assume 8 partitions each at a multiple of the sector size.
  232. # We could glean this from the partition descriptors, but they are empty!?!?
  233. >>(2.S*1) indirect x \b, contains[@0x%x]:
  234. >>(2.S*2) indirect x \b, contains[@0x%x]:
  235. >>(2.S*3) indirect x \b, contains[@0x%x]:
  236. >>(2.S*4) indirect x \b, contains[@0x%x]:
  237. >>(2.S*5) indirect x \b, contains[@0x%x]:
  238. >>(2.S*6) indirect x \b, contains[@0x%x]:
  239. >>(2.S*7) indirect x \b, contains[@0x%x]:
  240. >>(2.S*8) indirect x \b, contains[@0x%x]:
  241. # Yes, the 3rd and 4th bytes are reserved, but we use them to make the
  242. # magic stronger.
  243. 0 belong 0x504d0000 Apple Partition Map
  244. >4 belong x \b, map block count %d
  245. >8 belong x \b, start block %d
  246. >12 belong x \b, block count %d
  247. >16 string >0 \b, name %s
  248. >48 string >0 \b, type %s
  249. >124 string >0 \b, processor %s
  250. >140 string >0 \b, boot arguments %s
  251. >92 belong & 1 \b, valid
  252. >92 belong & 2 \b, allocated
  253. >92 belong & 4 \b, in use
  254. >92 belong & 8 \b, has boot info
  255. >92 belong & 16 \b, readable
  256. >92 belong & 32 \b, writable
  257. >92 belong & 64 \b, pic boot code
  258. >92 belong & 128 \b, chain compatible driver
  259. >92 belong & 256 \b, real driver
  260. >92 belong & 512 \b, chain driver
  261. >92 belong & 1024 \b, mount at startup
  262. >92 belong & 2048 \b, is the startup partition
  263. #http://wiki.mozilla.org/DS_Store_File_Format`
  264. #http://en.wikipedia.org/wiki/.DS_Store
  265. 0 string \0\0\0\1Bud1\0 Apple Desktop Services Store
  266. # HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
  267. # Usually not in separate files, but have either filename rsrc with
  268. # no extension, or a filename corresponding to another file, with
  269. # extensions rsr/rsrc
  270. 0 string \000\000\001\000
  271. >4 leshort 0
  272. >>16 lelong 0 Apple HFS/HFS+ resource fork