filesystems 68 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822
  1. #------------------------------------------------------------------------------
  2. # $File: filesystems,v 1.69 2012/12/18 17:28:43 christos Exp $
  3. # filesystems: file(1) magic for different filesystems
  4. #
  5. 0 string \366\366\366\366 PC formatted floppy with no filesystem
  6. # Sun disk labels
  7. # From /usr/include/sun/dklabel.h:
  8. 0774 beshort 0xdabe
  9. # modified by Joerg Jenderek, because original test
  10. # succeeds for Cabinet archive dao360.dl_ with negative blocks
  11. >0770 long >0 Sun disk label
  12. >>0 string x '%s
  13. >>>31 string >\0 \b%s
  14. >>>>63 string >\0 \b%s
  15. >>>>>95 string >\0 \b%s
  16. >>0 string x \b'
  17. >>0734 short >0 %d rpm,
  18. >>0736 short >0 %d phys cys,
  19. >>0740 short >0 %d alts/cyl,
  20. >>0746 short >0 %d interleave,
  21. >>0750 short >0 %d data cyls,
  22. >>0752 short >0 %d alt cyls,
  23. >>0754 short >0 %d heads/partition,
  24. >>0756 short >0 %d sectors/track,
  25. >>0764 long >0 start cyl %ld,
  26. >>0770 long x %ld blocks
  27. # Is there a boot block written 1 sector in?
  28. >512 belong&077777777 0600407 \b, boot block present
  29. # Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
  30. # (http://btmgr.sourceforge.net/docs/user-guide-3.html)
  31. 0 string SBMBAKUP_ Smart Boot Manager backup file
  32. >9 string x \b, version %-5.5s
  33. >>14 string =_
  34. >>>15 string x %-.1s
  35. >>>>16 string =_ \b.
  36. >>>>>17 string x \b%-.1s
  37. >>>>>>18 string =_ \b.
  38. >>>>>>>19 string x \b%-.1s
  39. >>>22 ubyte 0
  40. >>>>21 ubyte x \b, from drive 0x%x
  41. >>>22 ubyte >0
  42. >>>>21 string x \b, from drive %s
  43. >>>535 search/17 \x55\xAA
  44. >>>>&-512 indirect x \b; contains
  45. # updated by Joerg Jenderek at Nov 2012
  46. # DOS Emulator image is 128 byte, null right padded header + harddisc image
  47. 0 string DOSEMU\0
  48. >0x27E leshort 0xAA55
  49. #offset is 128
  50. >>19 ubyte 128
  51. >>>(19.b-1) ubyte 0x0 DOS Emulator image
  52. >>>>7 ulelong >0 \b, %u heads
  53. >>>>11 ulelong >0 \b, %d sectors/track
  54. >>>>15 ulelong >0 \b, %d cylinders
  55. >>>>128 indirect x \b; contains
  56. # x86 boot sector updated by Joerg Jenderek at Sep 2007,May 2011
  57. # for any allowed sector sizes
  58. 30 search/481 \x55\xAA
  59. # to display x86 boot sector (40) before old one (strength=50), SYSLINUX MBR (?) and DOS BPB information (71) like in previous file version
  60. !:strength +40
  61. # for sector sizes < 512 Bytes
  62. >11 uleshort <512
  63. >>(11.s-2) uleshort 0xAA55 x86 boot sector
  64. # for sector sizes with 512 or more Bytes
  65. >0x1FE leshort 0xAA55 x86 boot sector
  66. # keep old x86 boot sector as dummy for mbr and bootloader displaying
  67. # only for sector sizes with 512 or more Bytes
  68. 0x1FE leshort 0xAA55
  69. # to display information (51) before DOS BPB (strength=71) and after DOS floppy (120) like in old file version
  70. !:strength +21
  71. >2 string OSBS \b, OS/BS MBR
  72. # J\xf6rg Jenderek <joerg dot jenderek at web dot de>
  73. >0x8C string Invalid\ partition\ table \b, MS-DOS MBR
  74. # dr-dos with some upper-, lowercase variants
  75. >0x9D string Invalid\ partition\ table$
  76. >>181 string No\ Operating\ System$
  77. >>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
  78. >0x9D string Invalid\ partition\ table$
  79. >>181 string No\ operating\ system$
  80. >>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
  81. >342 string Invalid\ partition\ table$
  82. >>366 string No\ operating\ system$
  83. >>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
  84. >295 string NEWLDR\0
  85. >>302 string Bad\ PT\ $
  86. >>>310 string No\ OS\ $
  87. >>>>317 string OS\ load\ err$
  88. >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
  89. >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
  90. >>>>>>>387 string Copyright\ (c)\ 1984,1998
  91. >>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
  92. >0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
  93. >>0x1B8 ubelong >0 \b, Serial 0x%-.4x
  94. >0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950
  95. >271 string Invalid\ partition\ table\0
  96. >>295 string Error\ loading\ operating\ system\0
  97. >>>326 string Missing\ operating\ system\0 \b, mbr
  98. #
  99. >139 string Invalid\ partition\ table\0
  100. >>163 string Error\ loading\ operating\ system\0
  101. >>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr
  102. # http://www.heise.de/ct/05/09/006/ page 184
  103. #HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes
  104. >>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x
  105. >300 string Invalid\ partition\ table\0
  106. >>324 string Error\ loading\ operating\ system\0
  107. >>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR
  108. #??>>>389 string Invalid\ system\ disk
  109. >>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
  110. >300 string Ung\201ltige\ Partitionstabelle
  111. #split string to avoid error: String too long
  112. >>328 string Fehler\ beim\ Laden\
  113. >>>346 string des\ Betriebssystems
  114. >>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german)
  115. >>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
  116. #>0x145 string Default:\ F \b, FREE-DOS MBR
  117. #>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR
  118. >0x145 search/7 Default:\ F \b, FREE-DOS MBR
  119. #>>313 string F0\ .\ .\ .
  120. #>>>322 string disk\ 1
  121. #>>>>382 string FAT3
  122. >64 string no\ active\ partition\ found
  123. >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
  124. # Ranish Partition Manager http://www.ranish.com/part/
  125. >387 search/4 \0\ Error!\r
  126. >>378 search/7 Virus!
  127. >>>397 search/4 Booting\
  128. >>>>408 search/4 HD1/\0 \b, Ranish MBR (
  129. >>>>>416 string Writing\ changes... \b2.37
  130. >>>>>>438 ubyte x \b,0x%x dots
  131. >>>>>>440 ubyte >0 \b,virus check
  132. >>>>>>441 ubyte >0 \b,partition %c
  133. #2.38,2.42,2.44
  134. >>>>>416 string !Writing\ changes... \b
  135. >>>>>>418 ubyte 1 \bvirus check,
  136. >>>>>>419 ubyte x \b0x%x seconds
  137. >>>>>>420 ubyte&0x0F >0 \b,partition
  138. >>>>>>>420 ubyte&0x0F <5 \b %x
  139. >>>>>>>420 ubyte&0x0F 0Xf \b ask
  140. >>>>>420 ubyte x \b)
  141. #
  142. # SYSLINUX MBR moved
  143. # http://www.acronis.de/
  144. >362 string MBR\ Error\ \0\r
  145. >>376 string ress\ any\ key\ to\
  146. >>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
  147. # added by Joerg Jenderek
  148. # http://www.visopsys.org/
  149. # http://partitionlogic.org.uk/
  150. >309 string No\ bootable\ partition\ found\r
  151. >>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
  152. >349 string No\ bootable\ partition\ found\r
  153. >>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
  154. # bootloader, bootmanager
  155. >0x40 string SBML
  156. # label with 11 characters of FAT 12 bit filesystem
  157. >>43 string SMART\ BTMGR
  158. >>>430 string SBMK\ Bad!\r \b, Smart Boot Manager
  159. # OEM-ID not always "SBM"
  160. #>>>>3 strings SBM
  161. >>>>6 string >\0 \b, version %s
  162. >382 string XOSLLOADXCF \b, eXtended Operating System Loader
  163. >6 string LILO \b, LInux i386 boot LOader
  164. >>120 string LILO \b, version 22.3.4 SuSe
  165. >>172 string LILO \b, version 22.5.8 Debian
  166. # updated by Joerg Jenderek at Oct 2008
  167. # variables according to grub-0.97/stage1/stage1.S or
  168. # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
  169. # usual values are marked with comments to get only informations of strange GRUB loaders
  170. >342 search/60 \0Geom\0
  171. #>0 ulelong x %x=0x009048EB , 0x2a9048EB 0
  172. >>0x41 ubyte <2
  173. >>>0x3E ubyte >2 \b; GRand Unified Bootloader
  174. # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
  175. >>>>0x3E ubyte x \b, stage1 version 0x%x
  176. #If it is 0xFF, use a drive passed by BIOS
  177. >>>>0x40 ubyte <0xFF \b, boot drive 0x%x
  178. # in most case 0,1,0x2e for GRUB 0.5.95
  179. >>>>0x41 ubyte >0 \b, LBA flag 0x%x
  180. >>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x
  181. #>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual)
  182. >>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x
  183. #>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default)
  184. >>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x
  185. >>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x
  186. #>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual)
  187. >>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x
  188. >>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
  189. >>>>>394 string stage1 \b, GRUB version 0.5.95
  190. >>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
  191. >>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94
  192. >>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
  193. >>>>>377 string GRUB\ \0 \b, GRUB version 0.94
  194. >>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0
  195. >>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
  196. >>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
  197. >>>>>385 string GRUB\ \0 \b, GRUB version 0.97
  198. #unkown version
  199. >>>343 string Geom\0Read\0\ Error\0
  200. >>>>321 string Loading\ stage1.5 \b, GRUB version x.y
  201. >>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
  202. >>>>374 string GRUB\ \0 \b, GRUB version n.m
  203. # SYSLINUX bootloader moved
  204. >395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
  205. # http://www.bcdwb.de/bcdw/index_e.htm
  206. >3 string BCDL
  207. >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
  208. # mbr partition table entries
  209. # OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs
  210. >3 string !MS
  211. >>3 string !SYSLINUX
  212. >>>3 string !MTOOL
  213. >>>>3 string !NEWLDR
  214. >>>>>5 string !DOS
  215. # not FAT (32 bit)
  216. >>>>>>82 string !FAT32
  217. #not Linux kernel
  218. >>>>>>>514 string !HdrS
  219. #not BeOS
  220. >>>>>>>>422 string !Be\ Boot\ Loader
  221. # active flag 0 or 0x80 and type > 0
  222. >>>>>>>>>446 ubyte <0x81
  223. >>>>>>>>>>446 ubyte&0x7F 0
  224. >>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x
  225. >>>>>>>>>>>>446 ubyte 0x80 \b, active
  226. >>>>>>>>>>>>447 ubyte x \b, starthead %u
  227. #>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x
  228. #>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d
  229. >>>>>>>>>>>>454 ulelong x \b, startsector %u
  230. >>>>>>>>>>>>458 ulelong x \b, %u sectors
  231. #
  232. >>>>>>>>>462 ubyte <0x81
  233. >>>>>>>>>>462 ubyte&0x7F 0
  234. >>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x
  235. >>>>>>>>>>>>462 ubyte 0x80 \b, active
  236. >>>>>>>>>>>>463 ubyte x \b, starthead %u
  237. #>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x
  238. #>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d
  239. >>>>>>>>>>>>470 ulelong x \b, startsector %u
  240. >>>>>>>>>>>>474 ulelong x \b, %u sectors
  241. #
  242. >>>>>>>>>478 ubyte <0x81
  243. >>>>>>>>>>478 ubyte&0x7F 0
  244. >>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x
  245. >>>>>>>>>>>>478 ubyte 0x80 \b, active
  246. >>>>>>>>>>>>479 ubyte x \b, starthead %u
  247. #>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x
  248. #>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x
  249. #>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d
  250. >>>>>>>>>>>>486 ulelong x \b, startsector %u
  251. >>>>>>>>>>>>490 ulelong x \b, %u sectors
  252. #
  253. >>>>>>>>>494 ubyte <0x81
  254. >>>>>>>>>>494 ubyte&0x7F 0
  255. >>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x
  256. >>>>>>>>>>>>494 ubyte 0x80 \b, active
  257. >>>>>>>>>>>>495 ubyte x \b, starthead %u
  258. #>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x
  259. #>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d
  260. >>>>>>>>>>>>502 ulelong x \b, startsector %u
  261. >>>>>>>>>>>>506 ulelong x \b, %u sectors
  262. # mbr partition table entries end
  263. # http://www.acronis.de/
  264. #FAT label=ACRONIS\ SZ
  265. #OEM-ID=BOOTWIZ0
  266. >442 string Non-system\ disk,\
  267. >>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
  268. # updated by Joerg Jenderek at Nov 2012
  269. # DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
  270. >>>477 ubyte&0xDF >0
  271. >>>>477 string x \b %-.3s
  272. >>>>>480 ubyte&0xDF >0
  273. >>>>>>480 string x \b%-.4s
  274. >>>>>>>484 ubyte&0xDF >0
  275. >>>>>>>>484 string x \b%-.1s
  276. >>>>485 ubyte&0xDF >0
  277. >>>>>485 string x \b.%-.3s
  278. #
  279. >185 string FDBOOT\ Version\
  280. >>204 string \rNo\ Systemdisk.\
  281. >>>220 string Booting\ from\ harddisk.\n\r
  282. >>>245 string Cannot\ load\ from\ harddisk.\n\r
  283. >>>>273 string Insert\ Systemdisk\
  284. >>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
  285. >>>>>>200 string >\0 \b, version %-3s
  286. >242 string Bootsector\ from\ C.H.\ Hochst\204
  287. # http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c
  288. # updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
  289. # skip name "C.H. Hochstätter" partly because it is sometimes written without umlaut
  290. >242 search/127 Bootsector\ from\ C.H.\ Hochst
  291. >>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk
  292. # followed by variants with point,CR-NL or NL-CR
  293. >>>208 search/261 Cannot\ load\ from\ harddisk.
  294. # followed by variants CR-NL or NL-CR
  295. >>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key.
  296. # followed by variants with point,CR-NL or NL-CR
  297. >>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader
  298. # followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
  299. >>>>>>&0 string x \b, version %-4.4s
  300. >(1.b+2) ubyte 0xe
  301. >>(1.b+3) ubyte 0x1f
  302. >>>(1.b+4) ubyte 0xbe
  303. # message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
  304. >>>>(1.b+5) ubyte&0xd3 0x53
  305. >>>>>(1.b+6) ubyte 0x7c
  306. # assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
  307. >>>>>>(1.b+7) ubyte 0xac
  308. >>>>>>>(1.b+8) ubyte 0x22
  309. >>>>>>>>(1.b+9) ubyte 0xc0
  310. >>>>>>>>>(1.b+10) ubyte 0x74
  311. >>>>>>>>>>(1.b+11) ubyte 0x0b
  312. >>>>>>>>>>>(1.b+12) ubyte 0x56
  313. >>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
  314. # FAT1X version
  315. >>>>>>>>>>>>>(1.b+5) ubyte 0x5b
  316. >>>>>>>>>>>>>>0x5b string >\0 "%-s"
  317. # FAT32 version
  318. >>>>>>>>>>>>>(1.b+5) ubyte 0x77
  319. >>>>>>>>>>>>>>0x77 string >\0 "%-s"
  320. >214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display
  321. #>>244 string from\ dosemu-freedos-*-bin.tgz\r
  322. #>>>170 string Sorry,\ could\ not\ load\ an\
  323. #>>>>195 string operating\ system.\r\n
  324. #
  325. >103 string This\ is\ not\ a\ bootable\ disk.\
  326. >>132 string Please\ insert\ a\ bootable\
  327. >>>157 string floppy\ and\r\n
  328. >>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
  329. #
  330. >66 string Solaris\ Boot\ Sector
  331. >>99 string Incomplete\ MDBoot\ load.
  332. >>>89 string Version \b, Sun Solaris Bootloader
  333. >>>>97 byte x version %c
  334. #
  335. >408 string OS/2\ !!\ SYS01475\r\0
  336. >>429 string OS/2\ !!\ SYS02025\r\0
  337. >>>450 string OS/2\ !!\ SYS02027\r\0
  338. >>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
  339. #
  340. >409 string OS/2\ !!\ SYS01475\r\0
  341. >>430 string OS/2\ !!\ SYS02025\r\0
  342. >>>451 string OS/2\ !!\ SYS02027\r\0
  343. >>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
  344. >112 string This\ disk\ is\ not\ bootable\r
  345. >>142 string If\ you\ wish\ to\ make\ it\ bootable
  346. >>>176 string run\ the\ DOS\ program\ SYS\
  347. >>>200 string after\ the\r
  348. >>>>216 string system\ has\ been\ loaded\r\n
  349. >>>>>242 string Please\ insert\ a\ DOS\ diskette\
  350. >>>>>271 string into\r\n\ the\ drive\ and\
  351. >>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
  352. # XP
  353. >430 string NTLDR\ is\ missing\xFF\r\n
  354. >>449 string Disk\ error\xFF\r\n
  355. >>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
  356. # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
  357. >>>>417 ubyte&0xDF >0
  358. >>>>>417 string x %-.5s
  359. >>>>>>422 ubyte&0xDF >0
  360. >>>>>>>422 string x \b%-.3s
  361. >>>>>425 ubyte&0xDF >0
  362. >>>>>>425 string >\ \b.%-.3s
  363. #
  364. >>>>371 ubyte >0x20
  365. >>>>>368 ubyte&0xDF >0
  366. >>>>>>368 string x %-.5s
  367. >>>>>>>373 ubyte&0xDF >0
  368. >>>>>>>>373 string x \b%-.3s
  369. >>>>>>376 ubyte&0xDF >0
  370. >>>>>>>376 string x \b.%-.3s
  371. #
  372. >430 string NTLDR\ nicht\ gefunden\xFF\r\n
  373. >>453 string Datentr\204gerfehler\xFF\r\n
  374. >>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
  375. >>>>417 ubyte&0xDF >0
  376. >>>>>417 string x %-.5s
  377. >>>>>>422 ubyte&0xDF >0
  378. >>>>>>>422 string x \b%-.3s
  379. >>>>>425 ubyte&0xDF >0
  380. >>>>>>425 string >\ \b.%-.3s
  381. # offset variant
  382. >>>>379 string \0
  383. >>>>>368 ubyte&0xDF >0
  384. >>>>>>368 string x %-.5s
  385. >>>>>>>373 ubyte&0xDF >0
  386. >>>>>>>>373 string x \b%-.3s
  387. #
  388. >430 string NTLDR\ fehlt\xFF\r\n
  389. >>444 string Datentr\204gerfehler\xFF\r\n
  390. >>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
  391. >>>>417 ubyte&0xDF >0
  392. >>>>>417 string x %-.5s
  393. >>>>>>422 ubyte&0xDF >0
  394. >>>>>>>422 string x \b%-.3s
  395. >>>>>425 ubyte&0xDF >0
  396. >>>>>>425 string >\ \b.%-.3s
  397. # variant
  398. >>>>371 ubyte >0x20
  399. >>>>>368 ubyte&0xDF >0
  400. >>>>>>368 string x %-.5s
  401. >>>>>>>373 ubyte&0xDF >0
  402. >>>>>>>>373 string x \b%-.3s
  403. >>>>>>376 ubyte&0xDF >0
  404. >>>>>>>376 string x \b.%-.3s
  405. #
  406. >430 string NTLDR\ fehlt\xFF\r\n
  407. >>444 string Medienfehler\xFF\r\n
  408. >>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
  409. >>>>371 ubyte >0x20
  410. >>>>>368 ubyte&0xDF >0
  411. >>>>>>368 string x %-.5s
  412. >>>>>>>373 ubyte&0xDF >0
  413. >>>>>>>>373 string x \b%-.3s
  414. >>>>>>376 ubyte&0xDF >0
  415. >>>>>>>376 string x \b.%-.3s
  416. # variant
  417. >>>>417 ubyte&0xDF >0
  418. >>>>>417 string x %-.5s
  419. >>>>>>422 ubyte&0xDF >0
  420. >>>>>>>422 string x \b%-.3s
  421. >>>>>425 ubyte&0xDF >0
  422. >>>>>>425 string >\ \b.%-.3s
  423. #
  424. >430 string Datentr\204ger\ entfernen\xFF\r\n
  425. >>454 string Medienfehler\xFF\r\n
  426. >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
  427. >>>>379 string \0
  428. >>>>>368 ubyte&0xDF >0
  429. >>>>>>368 string x %-.5s
  430. >>>>>>>373 ubyte&0xDF >0
  431. >>>>>>>>373 string x \b%-.3s
  432. >>>>>>376 ubyte&0xDF >0
  433. >>>>>>>376 string x \b.%-.3s
  434. # variant
  435. >>>>417 ubyte&0xDF >0
  436. >>>>>417 string x %-.5s
  437. >>>>>>422 ubyte&0xDF >0
  438. >>>>>>>422 string x \b%-.3s
  439. >>>>>425 ubyte&0xDF >0
  440. >>>>>>425 string >\ \b.%-.3s
  441. #
  442. #>3 string NTFS\ \ \ \
  443. >389 string Fehler\ beim\ Lesen\
  444. >>407 string des\ Datentr\204gers
  445. >>>426 string NTLDR\ fehlt
  446. >>>>440 string NTLDR\ ist\ komprimiert
  447. >>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
  448. #>3 string NTFS\ \ \ \
  449. >313 string A\ disk\ read\ error\ occurred.\r
  450. >>345 string A\ kernel\ file\ is\ missing\
  451. >>>370 string from\ the\ disk.\r
  452. >>>>484 string NTLDR\ is\ compressed
  453. >>>>>429 string Insert\ a\ system\ diskette\
  454. >>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
  455. # DOS loader variants different languages,offsets
  456. >472 ubyte&0xDF >0
  457. >>389 string Invalid\ system\ disk\xFF\r\n
  458. >>>411 string Disk\ I/O\ error
  459. >>>>428 string Replace\ the\ disk,\ and\
  460. >>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
  461. #IO.SYS
  462. >>>>>>472 ubyte&0xDF >0
  463. >>>>>>>472 string x \b %-.2s
  464. >>>>>>>>474 ubyte&0xDF >0
  465. >>>>>>>>>474 string x \b%-.5s
  466. >>>>>>>>>>479 ubyte&0xDF >0
  467. >>>>>>>>>>>479 string x \b%-.1s
  468. >>>>>>>480 ubyte&0xDF >0
  469. >>>>>>>>480 string x \b.%-.3s
  470. #MSDOS.SYS
  471. >>>>>>>483 ubyte&0xDF >0 \b+
  472. >>>>>>>>483 string x \b%-.5s
  473. >>>>>>>>>488 ubyte&0xDF >0
  474. >>>>>>>>>>488 string x \b%-.3s
  475. >>>>>>>>491 ubyte&0xDF >0
  476. >>>>>>>>>491 string x \b.%-.3s
  477. #
  478. >>390 string Invalid\ system\ disk\xFF\r\n
  479. >>>412 string Disk\ I/O\ error\xFF\r\n
  480. >>>>429 string Replace\ the\ disk,\ and\
  481. >>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
  482. >>388 string Ungueltiges\ System\ \xFF\r\n
  483. >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
  484. >>>>427 string Datentraeger\ wechseln\ und\
  485. >>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
  486. #WINBOOT.SYS only not spaces (0xDF)
  487. >>>>>>497 ubyte&0xDF >0
  488. >>>>>>>497 string x %-.5s
  489. >>>>>>>>502 ubyte&0xDF >0
  490. >>>>>>>>>502 string x \b%-.1s
  491. >>>>>>>>>>503 ubyte&0xDF >0
  492. >>>>>>>>>>>503 string x \b%-.1s
  493. >>>>>>>>>>>>504 ubyte&0xDF >0
  494. >>>>>>>>>>>>>504 string x \b%-.1s
  495. >>>>>>505 ubyte&0xDF >0
  496. >>>>>>>505 string x \b.%-.3s
  497. #IO.SYS
  498. >>>>>>472 ubyte&0xDF >0 or
  499. >>>>>>>472 string x \b %-.2s
  500. >>>>>>>>474 ubyte&0xDF >0
  501. >>>>>>>>>474 string x \b%-.5s
  502. >>>>>>>>>>479 ubyte&0xDF >0
  503. >>>>>>>>>>>479 string x \b%-.1s
  504. >>>>>>>480 ubyte&0xDF >0
  505. >>>>>>>>480 string x \b.%-.3s
  506. #MSDOS.SYS
  507. >>>>>>>483 ubyte&0xDF >0 \b+
  508. >>>>>>>>483 string x \b%-.5s
  509. >>>>>>>>>488 ubyte&0xDF >0
  510. >>>>>>>>>>488 string x \b%-.3s
  511. >>>>>>>>491 ubyte&0xDF >0
  512. >>>>>>>>>491 string x \b.%-.3s
  513. #
  514. >>390 string Ungueltiges\ System\ \xFF\r\n
  515. >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
  516. >>>>429 string Datentraeger\ wechseln\ und\
  517. >>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
  518. #WINBOOT.SYS only not spaces (0xDF)
  519. >>>>>>497 ubyte&0xDF >0
  520. >>>>>>>497 string x %-.7s
  521. >>>>>>>>504 ubyte&0xDF >0
  522. >>>>>>>>>504 string x \b%-.1s
  523. >>>>>>505 ubyte&0xDF >0
  524. >>>>>>>505 string x \b.%-.3s
  525. #IO.SYS
  526. >>>>>>472 ubyte&0xDF >0 or
  527. >>>>>>>472 string x \b %-.2s
  528. >>>>>>>>474 ubyte&0xDF >0
  529. >>>>>>>>>474 string x \b%-.6s
  530. >>>>>>>480 ubyte&0xDF >0
  531. >>>>>>>>480 string x \b.%-.3s
  532. #MSDOS.SYS
  533. >>>>>>>483 ubyte&0xDF >0 \b+
  534. >>>>>>>>483 string x \b%-.5s
  535. >>>>>>>>>488 ubyte&0xDF >0
  536. >>>>>>>>>>488 string x \b%-.3s
  537. >>>>>>>>491 ubyte&0xDF >0
  538. >>>>>>>>>491 string x \b.%-.3s
  539. #
  540. >>389 string Ungueltiges\ System\ \xFF\r\n
  541. >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
  542. >>>>428 string Datentraeger\ wechseln\ und\
  543. >>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
  544. # DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
  545. >>>>>>472 string x %-.2s
  546. >>>>>>>474 ubyte&0xDF >0
  547. >>>>>>>>474 string x \b%-.5s
  548. >>>>>>>>479 ubyte&0xDF >0
  549. >>>>>>>>>479 string x \b%-.1s
  550. >>>>>>480 ubyte&0xDF >0
  551. >>>>>>>480 string x \b.%-.3s
  552. >>>>>>483 ubyte&0xDF >0 \b+
  553. >>>>>>>483 string x \b%-.5s
  554. >>>>>>>488 ubyte&0xDF >0
  555. >>>>>>>>488 string x \b%-.2s
  556. >>>>>>>>490 ubyte&0xDF >0
  557. >>>>>>>>>490 string x \b%-.1s
  558. >>>>>>>491 ubyte&0xDF >0
  559. >>>>>>>>491 string x \b.%-.3s
  560. >479 ubyte&0xDF >0
  561. >>416 string Kein\ System\ oder\
  562. >>>433 string Laufwerksfehler
  563. >>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
  564. #IO.SYS
  565. >>>>>479 string x \b %-.2s
  566. >>>>>>481 ubyte&0xDF >0
  567. >>>>>>>481 string x \b%-.6s
  568. >>>>>487 ubyte&0xDF >0
  569. >>>>>>487 string x \b.%-.3s
  570. #MSDOS.SYS
  571. >>>>>>490 ubyte&0xDF >0 \b+
  572. >>>>>>>490 string x \b%-.5s
  573. >>>>>>>>495 ubyte&0xDF >0
  574. >>>>>>>>>495 string x \b%-.3s
  575. >>>>>>>498 ubyte&0xDF >0
  576. >>>>>>>>498 string x \b.%-.3s
  577. #
  578. >376 search/41 Non-System\ disk\ or\
  579. >>395 search/41 disk\ error\r
  580. >>>407 search/41 Replace\ and\
  581. >>>>419 search/41 press\ \b,
  582. >>>>419 search/41 strike\ \b, old
  583. >>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader
  584. #449 Disk\ Boot\ failure\r MS 3.21
  585. #466 Boot\ Failure\r MS 3.30
  586. >>>>>468 search/18 \0
  587. #IO.SYS,IBMBIO.COM
  588. >>>>>>&0 string x \b %-.2s
  589. >>>>>>>&-20 ubyte&0xDF >0
  590. >>>>>>>>&-1 string x \b%-.4s
  591. >>>>>>>>>&-16 ubyte&0xDF >0
  592. >>>>>>>>>>&-1 string x \b%-.2s
  593. >>>>>>&8 ubyte&0xDF >0 \b.
  594. >>>>>>>&-1 string x \b%-.3s
  595. #MSDOS.SYS,IBMDOS.COM
  596. >>>>>>&11 ubyte&0xDF >0 \b+
  597. >>>>>>>&-1 string x \b%-.5s
  598. >>>>>>>>&-6 ubyte&0xDF >0
  599. >>>>>>>>>&-1 string x \b%-.1s
  600. >>>>>>>>>>&-5 ubyte&0xDF >0
  601. >>>>>>>>>>>&-1 string x \b%-.2s
  602. >>>>>>>&7 ubyte&0xDF >0 \b.
  603. >>>>>>>>&-1 string x \b%-.3s
  604. >441 string Cannot\ load\ from\ harddisk.\n\r
  605. >>469 string Insert\ Systemdisk\
  606. >>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader
  607. #>43 string \224R-LOADER\ \ SYS =label
  608. >54 string SYS
  609. >>324 string VASKK
  610. >>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
  611. #
  612. >98 string Press\ a\ key\ to\ retry\0\r
  613. >>120 string Cannot\ find\ file\ \0\r
  614. >>>139 string Disk\ read\ error\0\r
  615. >>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader
  616. #DRBIOS.SYS
  617. >>>>>44 ubyte&0xDF >0
  618. >>>>>>44 string x \b %-.6s
  619. >>>>>>>50 ubyte&0xDF >0
  620. >>>>>>>>50 string x \b%-.2s
  621. >>>>>>52 ubyte&0xDF >0
  622. >>>>>>>52 string x \b.%-.3s
  623. #
  624. >70 string IBMBIO\ \ COM
  625. >>472 string Cannot\ load\ DOS!\
  626. >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
  627. >>471 string Cannot\ load\ DOS\
  628. >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
  629. #??
  630. >444 string KERNEL\ \ SYS
  631. >>314 string BOOT\ error! \b, FREE-DOS Bootloader
  632. >499 string KERNEL\ \ SYS
  633. >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
  634. >449 string KERNEL\ \ SYS
  635. >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
  636. #
  637. >449 string Loading\ FreeDOS
  638. >>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader
  639. >>>497 ubyte&0xDF >0
  640. >>>>497 string x \b %-.6s
  641. >>>>>503 ubyte&0xDF >0
  642. >>>>>>503 string x \b%-.1s
  643. >>>>>>>504 ubyte&0xDF >0
  644. >>>>>>>>504 string x \b%-.1s
  645. >>>>505 ubyte&0xDF >0
  646. >>>>>505 string x \b.%-.3s
  647. #
  648. >331 string Error!.0 \b, FREE-DOS 1.0 bootloader
  649. #
  650. >125 string Loading\ FreeDOS...\r
  651. >>311 string BOOT\ error!\r \b, FREE-DOS bootloader
  652. >>>441 ubyte&0xDF >0
  653. >>>>441 string x \b %-.6s
  654. >>>>>447 ubyte&0xDF >0
  655. >>>>>>447 string x \b%-.1s
  656. >>>>>>>448 ubyte&0xDF >0
  657. >>>>>>>>448 string x \b%-.1s
  658. >>>>449 ubyte&0xDF >0
  659. >>>>>449 string x \b.%-.3s
  660. >124 string FreeDOS\0
  661. >>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
  662. # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
  663. >>>497 ubyte&0xDF >0
  664. >>>>497 string x \b %-.6s
  665. >>>>>503 ubyte&0xDF >0
  666. >>>>>>503 string x \b%-.1s
  667. >>>>>>>504 ubyte&0xDF >0
  668. >>>>>>>>504 string x \b%-.1s
  669. >>>>505 ubyte&0xDF >0
  670. >>>>>505 string x \b.%-.3s
  671. >>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
  672. >>>497 ubyte&0xDF >0
  673. >>>>497 string x \b %-.6s
  674. >>>>>503 ubyte&0xDF >0
  675. >>>>>>503 string x \b%-.1s
  676. >>>>>>>504 ubyte&0xDF >0
  677. >>>>>>>>504 string x \b%-.1s
  678. >>>>505 ubyte&0xDF >0
  679. >>>>>505 string x \b.%-.3s
  680. >>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
  681. >>>497 ubyte&0xDF >0
  682. >>>>497 string x \b %-.6s
  683. >>>>>503 ubyte&0xDF >0
  684. >>>>>>503 string x \b%-.1s
  685. >>>>>>>504 ubyte&0xDF >0
  686. >>>>>>>>504 string x \b%-.1s
  687. >>>>505 ubyte&0xDF >0
  688. >>>>>505 string x \b.%-.3s
  689. >336 string Error!\
  690. >>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
  691. >>>497 ubyte&0xDF >0
  692. >>>>497 string x \b %-.6s
  693. >>>>>503 ubyte&0xDF >0
  694. >>>>>>503 string x \b%-.1s
  695. >>>>>>>504 ubyte&0xDF >0
  696. >>>>>>>>504 string x \b%-.1s
  697. >>>>505 ubyte&0xDF >0
  698. >>>>>505 string x \b.%-.3s
  699. # added by Joerg Jenderek
  700. # http://www.visopsys.org/
  701. # http://partitionlogic.org.uk/
  702. # OEM-ID=Visopsys
  703. >478 ulelong 0
  704. >>(1.b+326) string I/O\ Error\ reading\
  705. >>>(1.b+344) string Visopsys\ loader\r
  706. >>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
  707. # http://alexfru.chat.ru/epm.html#bootprog
  708. >494 ubyte >0x4D
  709. >>495 string >E
  710. >>>495 string <S
  711. #OEM-ID is not reliable
  712. >>>>3 string BootProg
  713. # It just looks for a program file name at the root directory
  714. # and loads corresponding file with following execution.
  715. # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
  716. >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
  717. >>>>>499 string x \b %-.1s
  718. >>>>>>500 ubyte&0xDF >0
  719. >>>>>>>500 string x \b%-.1s
  720. >>>>>>>>501 ubyte&0xDF >0
  721. >>>>>>>>>501 string x \b%-.1s
  722. >>>>>>>>>>502 ubyte&0xDF >0
  723. >>>>>>>>>>>502 string x \b%-.1s
  724. >>>>>>>>>>>>503 ubyte&0xDF >0
  725. >>>>>>>>>>>>>503 string x \b%-.1s
  726. >>>>>>>>>>>>>>504 ubyte&0xDF >0
  727. >>>>>>>>>>>>>>>504 string x \b%-.1s
  728. >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
  729. >>>>>>>>>>>>>>>>>505 string x \b%-.1s
  730. >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
  731. >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
  732. #name extension
  733. >>>>>507 ubyte&0xDF >0 \b.
  734. >>>>>>507 string x \b%-.1s
  735. >>>>>>>508 ubyte&0xDF >0
  736. >>>>>>>>508 string x \b%-.1s
  737. >>>>>>>>>509 ubyte&0xDF >0
  738. >>>>>>>>>>509 string x \b%-.1s
  739. #If the boot sector fails to read any other sector,
  740. #it prints a very short message ("RE") to the screen and hangs the computer.
  741. #If the boot sector fails to find needed program in the root directory,
  742. #it also hangs with another message ("NF").
  743. >>>>>492 string RENF \b, FAT (12 bit)
  744. >>>>>495 string RENF \b, FAT (16 bit)
  745. # http://alexfru.chat.ru/epm.html#bootprog
  746. >494 ubyte >0x4D
  747. >>495 string >E
  748. >>>495 string <S
  749. #OEM-ID is not reliable
  750. >>>>3 string BootProg
  751. # It just looks for a program file name at the root directory
  752. # and loads corresponding file with following execution.
  753. # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
  754. >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
  755. >>>>>499 string x \b %-.1s
  756. >>>>>>500 ubyte&0xDF >0
  757. >>>>>>>500 string x \b%-.1s
  758. >>>>>>>>501 ubyte&0xDF >0
  759. >>>>>>>>>501 string x \b%-.1s
  760. >>>>>>>>>>502 ubyte&0xDF >0
  761. >>>>>>>>>>>502 string x \b%-.1s
  762. >>>>>>>>>>>>503 ubyte&0xDF >0
  763. >>>>>>>>>>>>>503 string x \b%-.1s
  764. >>>>>>>>>>>>>>504 ubyte&0xDF >0
  765. >>>>>>>>>>>>>>>504 string x \b%-.1s
  766. >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
  767. >>>>>>>>>>>>>>>>>505 string x \b%-.1s
  768. >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
  769. >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
  770. #name extension
  771. >>>>>507 ubyte&0xDF >0 \b.
  772. >>>>>>507 string x \b%-.1s
  773. >>>>>>>508 ubyte&0xDF >0
  774. >>>>>>>>508 string x \b%-.1s
  775. >>>>>>>>>509 ubyte&0xDF >0
  776. >>>>>>>>>>509 string x \b%-.1s
  777. #If the boot sector fails to read any other sector,
  778. #it prints a very short message ("RE") to the screen and hangs the computer.
  779. #If the boot sector fails to find needed program in the root directory,
  780. #it also hangs with another message ("NF").
  781. >>>>>492 string RENF \b, FAT (12 bit)
  782. >>>>>495 string RENF \b, FAT (16 bit)
  783. # x86 bootloader end
  784. # added by Joerg Jenderek at Nov 2012
  785. # http://www.thenakedpc.com/articles/v04/08/0408-05.html
  786. # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
  787. 0 string PNCIHISK\0 Norton Utilities disc image data
  788. # real x86 boot sector with jump instruction
  789. >509 search/1026 \x55\xAA\xeb
  790. >>&-1 indirect x \b; contains
  791. # http://file-extension.net/seeker/file_extension_dat
  792. 0 string PNCIUNDO Norton Disk Doctor UnDo file
  793. #
  794. # updated by Joerg Jenderek at Sep 2007
  795. >3 ubyte 0
  796. #no active flag
  797. >>446 ubyte 0
  798. # partition 1 not empty
  799. >>>450 ubyte >0
  800. # partitions 3,4 empty
  801. >>>>482 ubyte 0
  802. >>>>>498 ubyte 0
  803. # partition 2 ID=0,5,15
  804. >>>>>>466 ubyte <0x10
  805. >>>>>>>466 ubyte 0x05 \b, extended partition table
  806. >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
  807. >>>>>>>466 ubyte 0x0 \b, extended partition table (last)
  808. # DOS x86 sector separated and moved from "x86 boot sector" by Joerg Jenderek at May 2011
  809. >0x200 lelong 0x82564557 \b, BSD disklabel
  810. # FATX
  811. 0 string FATX FATX filesystem data
  812. # romfs filesystems - Juan Cespedes <cespedes@debian.org>
  813. 0 string -rom1fs- romfs filesystem, version 1
  814. >8 belong x %d bytes,
  815. >16 string x named %s.
  816. # netboot image - Juan Cespedes <cespedes@debian.org>
  817. 0 lelong 0x1b031336L Netboot image,
  818. >4 lelong&0xFFFFFF00 0
  819. >>4 lelong&0x100 0x000 mode 2
  820. >>4 lelong&0x100 0x100 mode 3
  821. >4 lelong&0xFFFFFF00 !0 unknown mode
  822. 0x18b string OS/2 OS/2 Boot Manager
  823. # updated by Joerg Jenderek at Oct 2008 and Sep 2012
  824. # http://syslinux.zytor.com/iso.php
  825. # tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
  826. # assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
  827. 0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
  828. >631 search/689 ISOLINUX\ isolinux Loader
  829. >>&0 string x (version %-4.4s)
  830. # http://syslinux.zytor.com/pxe.php
  831. # assembler instructions: jmp 7C05
  832. 0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older)
  833. # assembler instructions: pushfd;pushad
  834. 0 ulelong 0x60669c66 pxelinux loader
  835. # assembler instructions: jmp 05
  836. 0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer)
  837. # http://syslinux.zytor.com/wiki/index.php/SYSLINUX
  838. 0 string LDLINUX\ SYS\ SYSLINUX loader
  839. >12 string x (older version %-4.4s)
  840. 0 string \r\nSYSLINUX\ SYSLINUX loader
  841. >11 string x (version %-4.4s)
  842. # syslinux updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012
  843. # assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
  844. 0 ulelong&0x80909bEB 0x009018EB
  845. # OEM-ID not always "SYSLINUX"
  846. >434 search/47 Boot\ failed
  847. # followed by \r\n\0 or :\
  848. >>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older)
  849. >>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9)
  850. >459 search/30 Boot\ error\r\n\0
  851. >>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer)
  852. # SYSLINUX MBR updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012
  853. # assembler instructions: mov di,0600h;mov cx,0100h
  854. 16 search/4 \xbf\x00\x06\xb9\x00\x01
  855. >94 search/249 Missing\ operating\ system
  856. # followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
  857. # skip Ranish MBR
  858. >>408 search/4 HD1/\0
  859. >>408 default x
  860. >>>250 search/118 \0Operating\ system\ load SYSLINUX MBR
  861. # followed by "ing " or space
  862. >>>>292 search/98 error
  863. >>>>>&0 string \r (version 3.35 or older)
  864. >>>>>&0 string .\r (version 3.52 or newer)
  865. >>>>>&0 default x (version 3.36-3.51 )
  866. >368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR
  867. >>156 search/10 \0Boot\ partition\ not\ found\r\n
  868. >>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older)
  869. >>174 search/10 \0Missing\ OS\r\n
  870. >>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer)
  871. # SYSLINUX END
  872. # NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
  873. # assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax,
  874. 0 ubequad 0x31c08ed0bc007c8e
  875. # mbr_bootsel magic before partition table not reliable with small ipl fragments
  876. #>444 uleshort 0xb5e1
  877. >0004 uleshort x
  878. # ERRorTeXT
  879. >>181 search/166 Error\ \0\r\n NetBSD mbr
  880. # NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
  881. >>>0x1B8 ubelong >0 \b,Serial 0x%-.8x
  882. # BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
  883. >>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector
  884. # BOOT_EXTENDED definitions contains assembler instructions:
  885. # xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
  886. >>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended
  887. # COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
  888. >>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO
  889. # not TERSE_ERROR
  890. >>>196 search/106 No\ active\ partition\0
  891. >>>>&0 string Disk\ read\ error\0
  892. >>>>>&0 string No\ operating\ system\0 \b,verbose
  893. # not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
  894. >>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS
  895. # not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13
  896. >>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check
  897. # assembler instructions: movw nametab,bx
  898. >>>0x26 search/21 \xBB\x94\x07
  899. # not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
  900. >>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94
  901. >>>>>181 search/166 Error\ \0
  902. # "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
  903. >>>>>>&3 string x \b,"%s"
  904. # Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
  905. # added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
  906. # assembler instructions: jmp short 0x58;nop;ASCII
  907. 0 ubequad&0xeb58908000000000 0xeb58900000000000
  908. # assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
  909. >(1.b+2) ubequad 0xfa31c08ed88ec08e
  910. # Error messages at end of code
  911. >>376 string No\ operating\ system\r\n\0
  912. >>>398 string Disk\ error\r\n\0FDD\0HDD\0
  913. >>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr
  914. # Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
  915. # added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
  916. # for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
  917. # or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
  918. 0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC
  919. # pointer to the data starting with Neil Turton signature string
  920. >(0x1BC.s) string NDTmbr
  921. >>&-14 string 1234F\0 Turton mbr (
  922. # parameters also viewed by install-mbr --list
  923. >>>(0x1BC.s+7) ubyte x \b%u<=
  924. >>>(0x1BC.s+9) ubyte x \bVersion<=%u
  925. #>>>(0x1BC.s+8) ubyte x asm_flag_%x
  926. >>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix
  927. # variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode
  928. >>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk
  929. #0x1~1,..,0x8~4,0x10~F,0x80~A enabled
  930. #>>>(0x1BC.s+10) ubyte x \b,flags 0x%x
  931. #0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
  932. #>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x
  933. # for older versions
  934. >>>(0x1BC.s+9) ubyte <2
  935. #>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds
  936. >>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
  937. # floppy A: or B:
  938. >>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x
  939. >>>>(0x1BC.s+13) ubyte >1
  940. # 1st hard disc
  941. #>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x
  942. # not 1st hard disc
  943. >>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x
  944. # for version >= 2 maximal timeout can be 65534
  945. >>>(0x1BC.s+9) ubyte >1
  946. #>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds
  947. >>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds
  948. # floppy A: or B:
  949. >>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x
  950. >>>>(0x1BC.s+14) ubyte >1
  951. # 1st hard disc
  952. #>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x
  953. # not 1st hard disc
  954. >>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x
  955. >>>0 ubyte x \b)
  956. # added by Joerg Jenderek
  957. # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
  958. # grub-1.94/kern/i386/pc/startup.S
  959. # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
  960. # usual values are marked with comments to get only informations of strange GRUB loaders
  961. 0x200 uleshort 0x70EA
  962. # found only version 3.{1,2}
  963. >0x206 ubeshort >0x0300
  964. # GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
  965. >>0x212 ubyte >0x29
  966. >>>0x213 ubyte >0x29
  967. # not iso9660_stage1_5
  968. #>>>0 ulelong&0x00BE5652 0x00BE5652
  969. >>>>0x213 ubyte >0x29 GRand Unified Bootloader
  970. # config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
  971. >>>>0x217 ubyte 0xFF stage1_5
  972. >>>>0x217 ubyte <0xFF stage2
  973. >>>>0x206 ubyte x \b version %u
  974. >>>>0x207 ubyte x \b.%u
  975. # module_size for 1.94
  976. >>>>0x208 ulelong <0xffffff \b, installed partition %u
  977. #>>>>0x208 ulelong =0xffffff \b, %u (default)
  978. >>>>0x208 ulelong >0xffffff \b, installed partition %u
  979. # GRUB 0.5.95 unofficial
  980. >>>>0x20C ulelong&0x2E300000 0x2E300000
  981. # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
  982. >>>>>0x20C ubyte x \b, identifier 0x%x
  983. #>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
  984. >>>>>0x20D ubyte >0 \b, LBA flag 0x%x
  985. # GRUB version as string
  986. >>>>>0x20E string >\0 \b, GRUB version %-s
  987. # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
  988. >>>>>>0x215 ulong 0xffffffff
  989. >>>>>>>0x219 string >\0 \b, configuration file %-s
  990. >>>>>>0x215 ulong !0xffffffff
  991. >>>>>>>0x215 string >\0 \b, configuration file %-s
  992. # newer GRUB versions
  993. >>>>0x20C ulelong&0x2E300000 !0x2E300000
  994. ##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
  995. >>>>>0x20C ulelong >0 \b, saved entry %d
  996. # for 1.94 contains kernel image size
  997. # for 0.93,0.94,0.96,0.97
  998. # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
  999. >>>>>0x210 ubyte x \b, identifier 0x%x
  1000. # The flag for LBA forcing is in most cases 0
  1001. #>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
  1002. >>>>>0x211 ubyte >0 \b, LBA flag 0x%x
  1003. # GRUB version as string
  1004. >>>>>0x212 string >\0 \b, GRUB version %-s
  1005. # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
  1006. >>>>>0x217 ulong 0xffffffff
  1007. >>>>>>0x21b string >\0 \b, configuration file %-s
  1008. >>>>>0x217 ulong !0xffffffff
  1009. >>>>>>0x217 string >\0 \b, configuration file %-s
  1010. # DOS x86 sector updated and separated from "x86 boot sector" by Joerg Jenderek at May 2011
  1011. # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
  1012. # over BIOS parameter block (BPB)
  1013. # http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
  1014. # older drives may use Near JuMP instruction E9 xx xx
  1015. # minimal short forward jump found 0x29 for bootloaders or 0x0
  1016. # maximal short forward jump is 0x7f
  1017. # OEM-ID is empty or contain readable bytes
  1018. 0 ulelong&0x804000E9 0x000000E9
  1019. # mtools-3.9.8/msdos.h
  1020. # usual values are marked with comments to get only informations of strange FAT systems
  1021. # valid sectorsize must be a power of 2 from 32 to 32768
  1022. >11 uleshort&0xf001f 0
  1023. >>11 uleshort <32769
  1024. >>>11 uleshort >31
  1025. >>>>21 ubyte&0xf0 0xF0
  1026. >>>>>0 ubyte 0xEB
  1027. >>>>>>1 ubyte x \b, code offset 0x%x+2
  1028. >>>>>0 ubyte 0xE9
  1029. >>>>>>1 uleshort x \b, code offset 0x%x+2
  1030. >>>>>3 string >\0 \b, OEM-ID "%-.8s"
  1031. #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
  1032. >>>>>>8 string IHC \b cached by Windows 9M
  1033. >>>>>11 uleshort >512 \b, Bytes/sector %u
  1034. #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
  1035. >>>>>11 uleshort <512 \b, Bytes/sector %u
  1036. >>>>>13 ubyte >1 \b, sectors/cluster %u
  1037. #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
  1038. >>>>>82 string FAT32
  1039. >>>>>>14 uleshort !32 \b, reserved sectors %u
  1040. #>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
  1041. >>>>>82 string !FAT32
  1042. >>>>>>14 uleshort >1 \b, reserved sectors %u
  1043. #>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
  1044. #>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS)
  1045. >>>>>16 ubyte >2 \b, FATs %u
  1046. #>>>>>16 ubyte =2 \b, FATs %u (usual)
  1047. >>>>>16 ubyte =1 \b, FAT %u
  1048. >>>>>16 ubyte >0
  1049. >>>>>17 uleshort >0 \b, root entries %u
  1050. #>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
  1051. >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
  1052. #>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
  1053. >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
  1054. #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
  1055. >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
  1056. >>>>>22 uleshort >0 \b, sectors/FAT %u
  1057. #>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
  1058. >>>>>24 uleshort x \b, sectors/track %u
  1059. >>>>>26 ubyte >2 \b, heads %u
  1060. #>>>>>26 ubyte =2 \b, heads %u (usual floppy)
  1061. >>>>>26 ubyte =1 \b, heads %u
  1062. # valid only for sector sizes with more then 32 Bytes
  1063. >>>>>11 uleshort >32
  1064. # skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
  1065. >>>>>>38 ubyte !0x70
  1066. >>>>>>>28 ulelong >0 \b, hidden sectors %u
  1067. #>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
  1068. >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
  1069. #>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
  1070. # FAT<32 bit specific
  1071. >>>>>>>82 string !FAT32
  1072. #>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
  1073. #>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
  1074. >>>>>>>>36 ubyte !0x80
  1075. >>>>>>>>>36 ubyte !0 \b, physical drive 0x%x
  1076. >>>>>>>>37 ubyte >0 \b, reserved 0x%x
  1077. #>>>>>>>>37 ubyte =0 \b, reserved 0x%x
  1078. # value is 0x80 for NTFS
  1079. >>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
  1080. >>>>>>>>38 ubyte =0x29
  1081. >>>>>>>>>39 ulelong x \b, serial number 0x%x
  1082. >>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
  1083. >>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
  1084. >>>>>>>>>43 string =NO\ NAME \b, unlabeled
  1085. # there exist some old floppies without word FAT at offset 54
  1086. # a word like "FATnm " is only a hint for a FAT size on nm-bits
  1087. # Normally the number of clusters is calculated by the values of BPP.
  1088. # if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
  1089. # otherwise FAT is 16 bit.
  1090. # http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
  1091. >>>>>>54 string FAT \b, FAT
  1092. >>>>>>>54 string FAT12 \b (12 bit)
  1093. >>>>>>>54 string FAT16 \b (16 bit)
  1094. # FAT32 bit specific
  1095. >>>>>82 string FAT32 \b, FAT (32 bit)
  1096. >>>>>>36 ulelong x \b, sectors/FAT %u
  1097. # http://technet.microsoft.com/en-us/library/cc977221.aspx
  1098. >>>>>>40 uleshort >0 \b, extension flags 0x%x
  1099. #>>>>>>40 uleshort =0 \b, extension flags %u
  1100. >>>>>>42 uleshort >0 \b, fsVersion %u
  1101. #>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
  1102. >>>>>>44 ulelong >2 \b, rootdir cluster %u
  1103. #>>>>>>44 ulelong =2 \b, rootdir cluster %u
  1104. #>>>>>>44 ulelong =1 \b, rootdir cluster %u
  1105. >>>>>>48 uleshort >1 \b, infoSector %u
  1106. #>>>>>>48 uleshort =1 \b, infoSector %u (usual)
  1107. >>>>>>48 uleshort <1 \b, infoSector %u
  1108. >>>>>>50 uleshort >6 \b, Backup boot sector %u
  1109. #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
  1110. >>>>>>50 uleshort <6 \b, Backup boot sector %u
  1111. # corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
  1112. >>>>>>52 ulelong >0 \b, reserved1 0x%x
  1113. >>>>>>56 ulelong >0 \b, reserved2 0x%x
  1114. >>>>>>60 ulelong >0 \b, reserved3 0x%x
  1115. # same structure as FAT1X
  1116. #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
  1117. #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
  1118. >>>>>>64 ubyte !0x80
  1119. >>>>>>>64 ubyte >0 \b, physical drive 0x%x
  1120. # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
  1121. >>>>>>65 ubyte >0 \b, reserved 0x%x
  1122. >>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
  1123. >>>>>>66 ubyte =0x29
  1124. >>>>>>>67 ulelong x \b, serial number 0x%x
  1125. >>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
  1126. >>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
  1127. >>>>>>>71 string =NO\ NAME \b, unlabeled
  1128. # additional tests for floppy image added by Joerg Jenderek
  1129. # no fixed disk
  1130. >>>>>21 ubyte !0xF8
  1131. # floppy media with 12 bit FAT
  1132. >>>>>>54 string !FAT16
  1133. # test for FAT after bootsector
  1134. >>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT
  1135. # floppy image
  1136. !:mime application/x-ima
  1137. # NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
  1138. # and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
  1139. # 0 FATs
  1140. >>>>>16 ubyte =0
  1141. # 0 root entries
  1142. >>>>>>17 uleshort =0
  1143. # 0 DOS sectors
  1144. >>>>>>>19 uleshort =0
  1145. # 0 sectors/FAT
  1146. # dos < 4.0 BootSector value found is 0x80
  1147. #38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x)
  1148. >>>>>>>>22 uleshort =0 \b; NTFS
  1149. >>>>>>>>>24 uleshort >0 \b, sectors/track %u
  1150. >>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x
  1151. >>>>>>>>>40 ulequad >0 \b, sectors %lld
  1152. >>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld
  1153. >>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld
  1154. # Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
  1155. # Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
  1156. >>>>>>>>>64 lelong <256
  1157. >>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d
  1158. >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi)
  1159. # Values 0 to 127 represent index block sizes of 0 to 127 clusters.
  1160. # Values 128 to 255 represent index block sizes of 2^(256-N) byte
  1161. >>>>>>>>>68 ulelong <256
  1162. >>>>>>>>>>68 ulelong <128 \b, clusters/index block %d
  1163. #>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d)
  1164. >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi)
  1165. >>>>>>>>>72 ulequad x \b, serial number 0%llx
  1166. >>>>>>>>>80 ulelong >0 \b, checksum 0x%x
  1167. #>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual)
  1168. >>>>>>>>>0x258 ulelong&0x00009090 =0x00009090
  1169. >>>>>>>>>>&-92 indirect x \b; contains
  1170. ### DOS boot sector end
  1171. 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
  1172. >8404 string x last mounted on %s,
  1173. #>9504 ledate x last checked at %s,
  1174. >8224 ledate x last written at %s,
  1175. >8401 byte x clean flag %d,
  1176. >8228 lelong x number of blocks %d,
  1177. >8232 lelong x number of data blocks %d,
  1178. >8236 lelong x number of cylinder groups %d,
  1179. >8240 lelong x block size %d,
  1180. >8244 lelong x fragment size %d,
  1181. >8252 lelong x minimum percentage of free blocks %d,
  1182. >8256 lelong x rotational delay %dms,
  1183. >8260 lelong x disk rotational speed %drps,
  1184. >8320 lelong 0 TIME optimization
  1185. >8320 lelong 1 SPACE optimization
  1186. 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  1187. >&-1164 string x last mounted on %s,
  1188. >&-696 string >\0 volume name %s,
  1189. >&-304 leqldate x last written at %s,
  1190. >&-1167 byte x clean flag %d,
  1191. >&-1168 byte x readonly flag %d,
  1192. >&-296 lequad x number of blocks %lld,
  1193. >&-288 lequad x number of data blocks %lld,
  1194. >&-1332 lelong x number of cylinder groups %d,
  1195. >&-1328 lelong x block size %d,
  1196. >&-1324 lelong x fragment size %d,
  1197. >&-180 lelong x average file size %d,
  1198. >&-176 lelong x average number of files in dir %d,
  1199. >&-272 lequad x pending blocks to free %lld,
  1200. >&-264 lelong x pending inodes to free %ld,
  1201. >&-664 lequad x system-wide uuid %0llx,
  1202. >&-1316 lelong x minimum percentage of free blocks %d,
  1203. >&-1248 lelong 0 TIME optimization
  1204. >&-1248 lelong 1 SPACE optimization
  1205. 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  1206. >&-1164 string x last mounted on %s,
  1207. >&-696 string >\0 volume name %s,
  1208. >&-304 leqldate x last written at %s,
  1209. >&-1167 byte x clean flag %d,
  1210. >&-1168 byte x readonly flag %d,
  1211. >&-296 lequad x number of blocks %lld,
  1212. >&-288 lequad x number of data blocks %lld,
  1213. >&-1332 lelong x number of cylinder groups %d,
  1214. >&-1328 lelong x block size %d,
  1215. >&-1324 lelong x fragment size %d,
  1216. >&-180 lelong x average file size %d,
  1217. >&-176 lelong x average number of files in dir %d,
  1218. >&-272 lequad x pending blocks to free %lld,
  1219. >&-264 lelong x pending inodes to free %ld,
  1220. >&-664 lequad x system-wide uuid %0llx,
  1221. >&-1316 lelong x minimum percentage of free blocks %d,
  1222. >&-1248 lelong 0 TIME optimization
  1223. >&-1248 lelong 1 SPACE optimization
  1224. 9564 belong 0x00011954 Unix Fast File system [v1] (big-endian),
  1225. >7168 belong 0x4c41424c Apple UFS Volume
  1226. >>7186 string x named %s,
  1227. >>7176 belong x volume label version %d,
  1228. >>7180 bedate x created on %s,
  1229. >8404 string x last mounted on %s,
  1230. #>9504 bedate x last checked at %s,
  1231. >8224 bedate x last written at %s,
  1232. >8401 byte x clean flag %d,
  1233. >8228 belong x number of blocks %d,
  1234. >8232 belong x number of data blocks %d,
  1235. >8236 belong x number of cylinder groups %d,
  1236. >8240 belong x block size %d,
  1237. >8244 belong x fragment size %d,
  1238. >8252 belong x minimum percentage of free blocks %d,
  1239. >8256 belong x rotational delay %dms,
  1240. >8260 belong x disk rotational speed %drps,
  1241. >8320 belong 0 TIME optimization
  1242. >8320 belong 1 SPACE optimization
  1243. 42332 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  1244. >&-1164 string x last mounted on %s,
  1245. >&-696 string >\0 volume name %s,
  1246. >&-304 beqldate x last written at %s,
  1247. >&-1167 byte x clean flag %d,
  1248. >&-1168 byte x readonly flag %d,
  1249. >&-296 bequad x number of blocks %lld,
  1250. >&-288 bequad x number of data blocks %lld,
  1251. >&-1332 belong x number of cylinder groups %d,
  1252. >&-1328 belong x block size %d,
  1253. >&-1324 belong x fragment size %d,
  1254. >&-180 belong x average file size %d,
  1255. >&-176 belong x average number of files in dir %d,
  1256. >&-272 bequad x pending blocks to free %lld,
  1257. >&-264 belong x pending inodes to free %ld,
  1258. >&-664 bequad x system-wide uuid %0llx,
  1259. >&-1316 belong x minimum percentage of free blocks %d,
  1260. >&-1248 belong 0 TIME optimization
  1261. >&-1248 belong 1 SPACE optimization
  1262. 66908 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  1263. >&-1164 string x last mounted on %s,
  1264. >&-696 string >\0 volume name %s,
  1265. >&-304 beqldate x last written at %s,
  1266. >&-1167 byte x clean flag %d,
  1267. >&-1168 byte x readonly flag %d,
  1268. >&-296 bequad x number of blocks %lld,
  1269. >&-288 bequad x number of data blocks %lld,
  1270. >&-1332 belong x number of cylinder groups %d,
  1271. >&-1328 belong x block size %d,
  1272. >&-1324 belong x fragment size %d,
  1273. >&-180 belong x average file size %d,
  1274. >&-176 belong x average number of files in dir %d,
  1275. >&-272 bequad x pending blocks to free %lld,
  1276. >&-264 belong x pending inodes to free %ld,
  1277. >&-664 bequad x system-wide uuid %0llx,
  1278. >&-1316 belong x minimum percentage of free blocks %d,
  1279. >&-1248 belong 0 TIME optimization
  1280. >&-1248 belong 1 SPACE optimization
  1281. # ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
  1282. # ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
  1283. # volume label and UUID Russell Coker
  1284. # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
  1285. 0x438 leshort 0xEF53 Linux
  1286. >0x44c lelong x rev %d
  1287. >0x43e leshort x \b.%d
  1288. # No journal? ext2
  1289. >0x45c lelong ^0x0000004 ext2 filesystem data
  1290. >>0x43a leshort ^0x0000001 (mounted or unclean)
  1291. # Has a journal? ext3 or ext4
  1292. >0x45c lelong &0x0000004
  1293. # and small INCOMPAT?
  1294. >>0x460 lelong <0x0000040
  1295. # and small RO_COMPAT?
  1296. >>>0x464 lelong <0x0000008 ext3 filesystem data
  1297. # else large RO_COMPAT?
  1298. >>>0x464 lelong >0x0000007 ext4 filesystem data
  1299. # else large INCOMPAT?
  1300. >>0x460 lelong >0x000003f ext4 filesystem data
  1301. >0x468 belong x \b, UUID=%08x
  1302. >0x46c beshort x \b-%04x
  1303. >0x46e beshort x \b-%04x
  1304. >0x470 beshort x \b-%04x
  1305. >0x472 belong x \b-%08x
  1306. >0x476 beshort x \b%04x
  1307. >0x478 string >0 \b, volume name "%s"
  1308. # General flags for any ext* fs
  1309. >0x460 lelong &0x0000004 (needs journal recovery)
  1310. >0x43a leshort &0x0000002 (errors)
  1311. # INCOMPAT flags
  1312. >0x460 lelong &0x0000001 (compressed)
  1313. #>0x460 lelong &0x0000002 (filetype)
  1314. #>0x460 lelong &0x0000010 (meta bg)
  1315. >0x460 lelong &0x0000040 (extents)
  1316. >0x460 lelong &0x0000080 (64bit)
  1317. #>0x460 lelong &0x0000100 (mmp)
  1318. #>0x460 lelong &0x0000200 (flex bg)
  1319. # RO_INCOMPAT flags
  1320. #>0x464 lelong &0x0000001 (sparse super)
  1321. >0x464 lelong &0x0000002 (large files)
  1322. >0x464 lelong &0x0000008 (huge files)
  1323. #>0x464 lelong &0x0000010 (gdt checksum)
  1324. #>0x464 lelong &0x0000020 (many subdirs)
  1325. #>0x463 lelong &0x0000040 (extra isize)
  1326. # Minix filesystems - Juan Cespedes <cespedes@debian.org>
  1327. 0x410 leshort 0x137f
  1328. !:strength / 2
  1329. >0x402 beshort < 100 Minix filesystem, V1, %d zones
  1330. >0x1e string minix \b, bootable
  1331. 0x410 beshort 0x137f
  1332. !:strength / 2
  1333. >0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones
  1334. >0x1e string minix \b, bootable
  1335. 0x410 leshort 0x138f
  1336. !:strength / 2
  1337. >0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones
  1338. >0x1e string minix \b, bootable
  1339. 0x410 beshort 0x138f
  1340. !:strength / 2
  1341. >0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones
  1342. >0x1e string minix \b, bootable
  1343. 0x410 leshort 0x2468
  1344. >0x402 beshort < 100 Minix filesystem, V2, %d zones
  1345. >0x1e string minix \b, bootable
  1346. 0x410 beshort 0x2468
  1347. >0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones
  1348. >0x1e string minix \b, bootable
  1349. 0x410 leshort 0x2478
  1350. >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones
  1351. >0x1e string minix \b, bootable
  1352. 0x410 leshort 0x2478
  1353. >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones
  1354. >0x1e string minix \b, bootable
  1355. 0x410 beshort 0x2478
  1356. >0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones
  1357. >0x1e string minix \b, bootable
  1358. 0x410 leshort 0x4d5a
  1359. >0x402 beshort !0 Minix filesystem, V3, %d zones
  1360. >0x1e string minix \b, bootable
  1361. # SGI disk labels - Nathan Scott <nathans@debian.org>
  1362. 0 belong 0x0BE5A941 SGI disk label (volume header)
  1363. # SGI XFS filesystem - Nathan Scott <nathans@debian.org>
  1364. 0 belong 0x58465342 SGI XFS filesystem data
  1365. >0x4 belong x (blksz %d,
  1366. >0x68 beshort x inosz %d,
  1367. >0x64 beshort ^0x2004 v1 dirs)
  1368. >0x64 beshort &0x2004 v2 dirs)
  1369. ############################################################################
  1370. # Minix-ST kernel floppy
  1371. 0x800 belong 0x46fc2700 Atari-ST Minix kernel image
  1372. >19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
  1373. >19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
  1374. ############################################################################
  1375. # Hmmm, is this a better way of detecting _standard_ floppy images ?
  1376. 19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
  1377. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  1378. 19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
  1379. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  1380. 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
  1381. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  1382. 19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
  1383. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  1384. 19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
  1385. >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  1386. 19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
  1387. 19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
  1388. # Valid media descriptor bytes for MS-DOS:
  1389. #
  1390. # Byte Capacity Media Size and Type
  1391. # -------------------------------------------------
  1392. #
  1393. # F0 2.88 MB 3.5-inch, 2-sided, 36-sector
  1394. # F0 1.44 MB 3.5-inch, 2-sided, 18-sector
  1395. # F9 720K 3.5-inch, 2-sided, 9-sector
  1396. # F9 1.2 MB 5.25-inch, 2-sided, 15-sector
  1397. # FD 360K 5.25-inch, 2-sided, 9-sector
  1398. # FF 320K 5.25-inch, 2-sided, 8-sector
  1399. # FC 180K 5.25-inch, 1-sided, 9-sector
  1400. # FE 160K 5.25-inch, 1-sided, 8-sector
  1401. # FE 250K 8-inch, 1-sided, single-density
  1402. # FD 500K 8-inch, 2-sided, single-density
  1403. # FE 1.2 MB 8-inch, 2-sided, double-density
  1404. # F8 ----- Fixed disk
  1405. #
  1406. # FC xxxK Apricot 70x1x9 boot disk.
  1407. #
  1408. # Originally a bitmap:
  1409. # xxxxxxx0 Not two sided
  1410. # xxxxxxx1 Double sided
  1411. # xxxxxx0x Not 8 SPT
  1412. # xxxxxx1x 8 SPT
  1413. # xxxxx0xx Not Removable drive
  1414. # xxxxx1xx Removable drive
  1415. # 11111xxx Must be one.
  1416. #
  1417. # But now it's rather random:
  1418. # 111111xx Low density disk
  1419. # 00 SS, Not 8 SPT
  1420. # 01 DS, Not 8 SPT
  1421. # 10 SS, 8 SPT
  1422. # 11 DS, 8 SPT
  1423. #
  1424. # 11111001 Double density 3½ floppy disk, high density 5¼
  1425. # 11110000 High density 3½ floppy disk
  1426. # 11111000 Hard disk any format
  1427. #
  1428. # CDROM Filesystems
  1429. # Modified for UDF by gerardo.cacciari@gmail.com
  1430. 32769 string CD001 #
  1431. !:mime application/x-iso9660-image
  1432. >38913 string !NSR0 ISO 9660 CD-ROM filesystem data
  1433. >38913 string NSR0 UDF filesystem data
  1434. >>38917 string 1 (version 1.0)
  1435. >>38917 string 2 (version 1.5)
  1436. >>38917 string 3 (version 2.0)
  1437. >>38917 byte >0x33 (unknown version, ID 0x%X)
  1438. >>38917 byte <0x31 (unknown version, ID 0x%X)
  1439. # "application id" which appears to be used as a volume label
  1440. >32808 string/T >\0 '%s'
  1441. >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
  1442. 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
  1443. !:mime application/x-iso9660-image
  1444. 32776 string CDROM High Sierra CD-ROM filesystem data
  1445. # .cso files
  1446. 0 string CISO Compressed ISO CD image
  1447. # cramfs filesystem - russell@coker.com.au
  1448. 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
  1449. >4 lelong x size %lu
  1450. >8 lelong &1 version #2
  1451. >8 lelong &2 sorted_dirs
  1452. >8 lelong &4 hole_support
  1453. >32 lelong x CRC 0x%x,
  1454. >36 lelong x edition %lu,
  1455. >40 lelong x %lu blocks,
  1456. >44 lelong x %lu files
  1457. 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
  1458. >4 belong x size %lu
  1459. >8 belong &1 version #2
  1460. >8 belong &2 sorted_dirs
  1461. >8 belong &4 hole_support
  1462. >32 belong x CRC 0x%x,
  1463. >36 belong x edition %lu,
  1464. >40 belong x %lu blocks,
  1465. >44 belong x %lu files
  1466. # reiserfs - russell@coker.com.au
  1467. 0x10034 string ReIsErFs ReiserFS V3.5
  1468. 0x10034 string ReIsEr2Fs ReiserFS V3.6
  1469. 0x10034 string ReIsEr3Fs ReiserFS V3.6.19
  1470. >0x1002c leshort x block size %d
  1471. >0x10032 leshort &2 (mounted or unclean)
  1472. >0x10000 lelong x num blocks %d
  1473. >0x10040 lelong 1 tea hash
  1474. >0x10040 lelong 2 yura hash
  1475. >0x10040 lelong 3 r5 hash
  1476. # JFFS - russell@coker.com.au
  1477. 0 lelong 0x34383931 Linux Journalled Flash File system, little endian
  1478. 0 belong 0x34383931 Linux Journalled Flash File system, big endian
  1479. # EST flat binary format (which isn't, but anyway)
  1480. # From: Mark Brown <broonie@sirena.org.uk>
  1481. 0 string ESTFBINR EST flat binary
  1482. # Aculab VoIP firmware
  1483. # From: Mark Brown <broonie@sirena.org.uk>
  1484. 0 string VoIP\ Startup\ and Aculab VoIP firmware
  1485. >35 string x format %s
  1486. # From: Mark Brown <broonie@sirena.org.uk> [old]
  1487. # From: Behan Webster <behanw@websterwood.com>
  1488. 0 belong 0x27051956 u-boot legacy uImage,
  1489. >32 string x %s,
  1490. >28 byte 0 Invalid os/
  1491. >28 byte 1 OpenBSD/
  1492. >28 byte 2 NetBSD/
  1493. >28 byte 3 FreeBSD/
  1494. >28 byte 4 4.4BSD/
  1495. >28 byte 5 Linux/
  1496. >28 byte 6 SVR4/
  1497. >28 byte 7 Esix/
  1498. >28 byte 8 Solaris/
  1499. >28 byte 9 Irix/
  1500. >28 byte 10 SCO/
  1501. >28 byte 11 Dell/
  1502. >28 byte 12 NCR/
  1503. >28 byte 13 LynxOS/
  1504. >28 byte 14 VxWorks/
  1505. >28 byte 15 pSOS/
  1506. >28 byte 16 QNX/
  1507. >28 byte 17 Firmware/
  1508. >28 byte 18 RTEMS/
  1509. >28 byte 19 ARTOS/
  1510. >28 byte 20 Unity OS/
  1511. >28 byte 21 INTEGRITY/
  1512. >29 byte 0 \bInvalid CPU,
  1513. >29 byte 1 \bAlpha,
  1514. >29 byte 2 \bARM,
  1515. >29 byte 3 \bIntel x86,
  1516. >29 byte 4 \bIA64,
  1517. >29 byte 5 \bMIPS,
  1518. >29 byte 6 \bMIPS 64-bit,
  1519. >29 byte 7 \bPowerPC,
  1520. >29 byte 8 \bIBM S390,
  1521. >29 byte 9 \bSuperH,
  1522. >29 byte 10 \bSparc,
  1523. >29 byte 11 \bSparc 64-bit,
  1524. >29 byte 12 \bM68K,
  1525. >29 byte 13 \bNios-32,
  1526. >29 byte 14 \bMicroBlaze,
  1527. >29 byte 15 \bNios-II,
  1528. >29 byte 16 \bBlackfin,
  1529. >29 byte 17 \bAVR32,
  1530. >29 byte 18 \bSTMicroelectronics ST200,
  1531. >30 byte 0 Invalid Image
  1532. >30 byte 1 Standalone Program
  1533. >30 byte 2 OS Kernel Image
  1534. >30 byte 3 RAMDisk Image
  1535. >30 byte 4 Multi-File Image
  1536. >30 byte 5 Firmware Image
  1537. >30 byte 6 Script File
  1538. >30 byte 7 Filesystem Image (any type)
  1539. >30 byte 8 Binary Flat Device Tree BLOB
  1540. >31 byte 0 (Not compressed),
  1541. >31 byte 1 (gzip),
  1542. >31 byte 2 (bzip2),
  1543. >31 byte 3 (lzma),
  1544. >12 belong x %d bytes,
  1545. >8 bedate x %s,
  1546. >16 belong x Load Address: 0x%08X,
  1547. >20 belong x Entry Point: 0x%08X,
  1548. >4 belong x Header CRC: 0x%08X,
  1549. >24 belong x Data CRC: 0x%08X
  1550. # JFFS2 file system
  1551. 0 leshort 0x1984 Linux old jffs2 filesystem data little endian
  1552. 0 leshort 0x1985 Linux jffs2 filesystem data little endian
  1553. # Squashfs
  1554. 0 string sqsh Squashfs filesystem, big endian,
  1555. >28 beshort x version %d.
  1556. >30 beshort x \b%d,
  1557. >28 beshort <3
  1558. >>8 belong x %d bytes,
  1559. >28 beshort >2
  1560. >>28 beshort <4
  1561. >>>63 bequad x %lld bytes,
  1562. >>28 beshort >3
  1563. >>>40 bequad x %lld bytes,
  1564. #>>67 belong x %d bytes,
  1565. >4 belong x %d inodes,
  1566. >28 beshort <2
  1567. >>32 beshort x blocksize: %d bytes,
  1568. >28 beshort >1
  1569. >>28 beshort <4
  1570. >>>51 belong x blocksize: %d bytes,
  1571. >>28 beshort >3
  1572. >>>12 belong x blocksize: %d bytes,
  1573. >28 beshort <4
  1574. >>39 bedate x created: %s
  1575. >28 beshort >3
  1576. >>8 bedate x created: %s
  1577. 0 string hsqs Squashfs filesystem, little endian,
  1578. >28 leshort x version %d.
  1579. >30 leshort x \b%d,
  1580. >28 leshort <3
  1581. >>8 lelong x %d bytes,
  1582. >28 leshort >2
  1583. >>28 leshort <4
  1584. >>>63 lequad x %lld bytes,
  1585. >>28 leshort >3
  1586. >>>40 lequad x %lld bytes,
  1587. #>>63 lelong x %d bytes,
  1588. >4 lelong x %d inodes,
  1589. >28 leshort <2
  1590. >>32 leshort x blocksize: %d bytes,
  1591. >28 leshort >1
  1592. >>28 leshort <4
  1593. >>>51 lelong x blocksize: %d bytes,
  1594. >>28 leshort >3
  1595. >>>12 lelong x blocksize: %d bytes,
  1596. >28 leshort <4
  1597. >>39 ledate x created: %s
  1598. >28 leshort >3
  1599. >>8 ledate x created: %s
  1600. 0 string td\000 floppy image data (TeleDisk)
  1601. # AFS Dump Magic
  1602. # From: Ty Sarna <tsarna@sarna.org>
  1603. 0 string \x01\xb3\xa1\x13\x22 AFS Dump
  1604. >&0 belong x (v%d)
  1605. >>&0 byte 0x76
  1606. >>>&0 belong x Vol %d,
  1607. >>>>&0 byte 0x6e
  1608. >>>>>&0 string x %s
  1609. >>>>>>&1 byte 0x74
  1610. >>>>>>>&0 beshort 2
  1611. >>>>>>>>&4 bedate x on: %s
  1612. >>>>>>>>&0 bedate =0 full dump
  1613. >>>>>>>>&0 bedate !0 incremental since: %s
  1614. #----------------------------------------------------------
  1615. #delta ISO Daniel Novotny (dnovotny@redhat.com)
  1616. 0 string DISO Delta ISO data
  1617. >4 belong x version %d
  1618. # VMS backup savesets - gerardo.cacciari@gmail.com
  1619. #
  1620. 4 string \x01\x00\x01\x00\x01\x00
  1621. >(0.s+16) string \x01\x01
  1622. >>&(&0.b+8) byte 0x42 OpenVMS backup saveset data
  1623. >>>40 lelong x (block size %d,
  1624. >>>49 string >\0 original name '%s',
  1625. >>>2 short 1024 VAX generated)
  1626. >>>2 short 2048 AXP generated)
  1627. >>>2 short 4096 I64 generated)
  1628. # Summary: Oracle Clustered Filesystem
  1629. # Created by: Aaron Botsis <redhat@digitalmafia.org>
  1630. 8 string OracleCFS Oracle Clustered Filesystem,
  1631. >4 long x rev %d
  1632. >0 long x \b.%d,
  1633. >560 string x label: %.64s,
  1634. >136 string x mountpoint: %.128s
  1635. # Summary: Oracle ASM tagged volume
  1636. # Created by: Aaron Botsis <redhat@digitalmafia.org>
  1637. 32 string ORCLDISK Oracle ASM Volume,
  1638. >40 string x Disk Name: %0.12s
  1639. 32 string ORCLCLRD Oracle ASM Volume (cleared),
  1640. >40 string x Disk Name: %0.12s
  1641. # Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
  1642. 8 string OracleCFS Oracle Clustered Filesystem,
  1643. >4 long x rev %d
  1644. >0 long x \b.%d,
  1645. >560 string x label: %.64s,
  1646. >136 string x mountpoint: %.128s
  1647. # Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
  1648. 32 string ORCLDISK Oracle ASM Volume,
  1649. >40 string x Disk Name: %0.12s
  1650. 32 string ORCLCLRD Oracle ASM Volume (cleared),
  1651. >40 string x Disk Name: %0.12s
  1652. # Compaq/HP RILOE floppy image
  1653. # From: Dirk Jagdmann <doj@cubic.org>
  1654. 0 string CPQRFBLO Compaq/HP RILOE floppy image
  1655. #------------------------------------------------------------------------------
  1656. # Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
  1657. # These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
  1658. # which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
  1659. #
  1660. 1008 string DECFILE11 Files-11 On-Disk Structure
  1661. >525 byte x Level %d
  1662. >525 byte x (ODS-%d);
  1663. >1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system;
  1664. >1017 string B
  1665. >>525 byte 2 VAX/VMS or OpenVMS file system;
  1666. >>525 byte 5 OpenVMS Alpha or Itanium file system;
  1667. >984 string x volume label is '%-12.12s'
  1668. # From: Thomas Klausner <wiz@NetBSD.org>
  1669. # http://filext.com/file-extension/DAA
  1670. # describes the daa file format. The magic would be:
  1671. 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive
  1672. # From Albert Cahalan <acahalan@gmail.com>
  1673. # really le32 operation,destination,payloadsize (but quite predictable)
  1674. # 01 00 00 00 00 00 00 c0 00 02 00 00
  1675. 0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware
  1676. # From Eric Sandeen
  1677. # GFS2
  1678. 0x10000 belong 0x01161970
  1679. >0x10018 belong 0x0000051d GFS1 Filesystem
  1680. >>0x10024 belong x (blocksize %d,
  1681. >>0x10060 string >\0 lockproto %s)
  1682. >0x10018 belong 0x00000709 GFS2 Filesystem
  1683. >>0x10024 belong x (blocksize %d,
  1684. >>0x10060 string >\0 lockproto %s)
  1685. # BTRFS
  1686. 0x10040 string _BHRfS_M BTRFS Filesystem
  1687. >0x1012b string >\0 (label "%s",
  1688. >0x10090 lelong x sectorsize %d,
  1689. >0x10094 lelong x nodesize %d,
  1690. >0x10098 lelong x leafsize %d)
  1691. # dvdisaster's .ecc
  1692. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  1693. 0 string *dvdisaster* dvdisaster error correction file
  1694. # xfs metadump image
  1695. # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
  1696. # but can we do the << ? For now it's always 512 (0x200) anyway.
  1697. 0 string XFSM
  1698. >0x200 string XFSB XFS filesystem metadump image
  1699. # Type: CROM filesystem
  1700. # From: Werner Fink <werner@suse.de>
  1701. 0 string CROMFS CROMFS
  1702. >6 string >\0 \b version %2.2s,
  1703. >8 ulequad >0 \b block data at %lld,
  1704. >16 ulequad >0 \b fblock table at %lld,
  1705. >24 ulequad >0 \b inode table at %lld,
  1706. >32 ulequad >0 \b root at %lld,
  1707. >40 ulelong >0 \b fblock size = %ld,
  1708. >44 ulelong >0 \b block size = %ld,
  1709. >48 ulequad >0 \b bytes = %lld
  1710. # Type: xfs metadump image
  1711. # From: Daniel Novotny <dnovotny@redhat.com>
  1712. # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
  1713. # but can we do the << ? For now it's always 512 (0x200) anyway.
  1714. 0 string XFSM
  1715. >0x200 string XFSB XFS filesystem metadump image
  1716. # Type: delta ISO
  1717. # From: Daniel Novotny <dnovotny@redhat.com>
  1718. 0 string DISO Delta ISO data,
  1719. >4 belong x version %d
  1720. # JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
  1721. # See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
  1722. # From: Adam Buchbinder <adam.buchbinder@gmail.com>
  1723. 0x8000 string JFS1
  1724. # Because it's text-only magic, check a binary value (version) to be sure.
  1725. # Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
  1726. # mountable.
  1727. >&0 lelong <3 JFS2 filesystem image
  1728. # Label is followed by a UUID; we have to limit string length to avoid
  1729. # appending the UUID in the case of a 16-byte label.
  1730. >>&144 regex [\x20-\x7E]{1,16} (label "%s")
  1731. >>&0 lequad x \b, %lld blocks
  1732. >>&8 lelong x \b, blocksize %d
  1733. >>&32 lelong&0x00000006 >0 (dirty)
  1734. >>&36 lelong >0 (compressed)
  1735. # LFS
  1736. 0 lelong 0x070162 LFS filesystem image
  1737. >4 lelong 1 version 1,
  1738. >>8 lelong x \b blocks %u,
  1739. >>12 lelong x \b blocks per segment %u,
  1740. >4 lelong 2 version 2,
  1741. >>8 lelong x \b fragments %u,
  1742. >>12 lelong x \b bytes per segment %u,
  1743. >16 lelong x \b disk blocks %u,
  1744. >20 lelong x \b block size %u,
  1745. >24 lelong x \b fragment size %u,
  1746. >28 lelong x \b fragments per block %u,
  1747. >32 lelong x \b start for free list %u,
  1748. >36 lelong x \b number of free blocks %d,
  1749. >40 lelong x \b number of files %u,
  1750. >44 lelong x \b blocks available for writing %d,
  1751. >48 lelong x \b inodes in cache %d,
  1752. >52 lelong x \b inode file disk address 0x%x,
  1753. >56 lelong x \b inode file inode number %u,
  1754. >60 lelong x \b address of last segment written 0x%x,
  1755. >64 lelong x \b address of next segment to write 0x%x,
  1756. >68 lelong x \b address of current segment written 0x%x