macintosh 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503
  1. #------------------------------------------------------------------------------
  2. # $File: macintosh,v 1.30 2019/12/14 20:40:26 christos Exp $
  3. # macintosh description
  4. #
  5. # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
  6. # Daniel Quinlan, quinlan@yggdrasil.com
  7. # Update: Joerg Jenderek
  8. # URL: https://en.wikipedia.org/wiki/BinHex
  9. # Reference: http://fileformats.archiveteam.org/wiki/BinHex
  10. # Note: only tested with version 4.0 and hqx extension
  11. # Any text/binary before the characteristic comment sentence is to be ignored like in
  12. # http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx
  13. 0 search/1602 (This\ file\
  14. >&0 use binhex
  15. # http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx
  16. 0 search/2652/b (This\ file\
  17. >&0 use binhex
  18. 0 name binhex
  19. # keep splitted search string format similar like in version 5.37
  20. >0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version
  21. # http://www.macdisk.com/binhexen.php3
  22. !:apple BNHQTEXT
  23. # http://www.faqs.org/faqs/macintosh/comm-faq/part1/
  24. >>&0 string 1.0 1.0
  25. !:mime application/mac-binhex
  26. !:ext hex
  27. >>&0 string 2.0 2.0
  28. !:mime application/mac-binhex
  29. !:ext hcx
  30. # BinHex 3.0 never existed
  31. >>&0 string 4.0 4.0
  32. !:mime application/mac-binhex40
  33. !:ext hqx
  34. # BinHex 5.0 also MacBinary I
  35. >>&0 string 5.0 5.0
  36. !:mime application/mac-binhex40
  37. !:ext hqx
  38. # this should never happen
  39. >>&0 default x
  40. >>>&0 string x %.3s
  41. !:mime application/mac-binhex
  42. !:ext hqx
  43. # Stuffit archives are the de facto standard of compression for Macintosh
  44. # files obtained from most archives. (franklsm@tuns.ca)
  45. 0 string SIT! StuffIt Archive (data)
  46. !:mime application/x-stuffit
  47. !:apple SIT!SIT!
  48. >2 string x : %s
  49. 0 string SITD StuffIt Deluxe (data)
  50. >2 string x : %s
  51. 0 string Seg StuffIt Deluxe Segment (data)
  52. >2 string x : %s
  53. # Newer StuffIt archives (grant@netbsd.org)
  54. 0 string StuffIt StuffIt Archive
  55. !:mime application/x-stuffit
  56. !:apple SIT!SIT!
  57. #>162 string >0 : %s
  58. # Macintosh Applications and Installation binaries (franklsm@tuns.ca)
  59. # GRR: Too weak
  60. #0 string APPL Macintosh Application (data)
  61. #>2 string x \b: %s
  62. # Macintosh System files (franklsm@tuns.ca)
  63. # GRR: Too weak
  64. #0 string zsys Macintosh System File (data)
  65. #0 string FNDR Macintosh Finder (data)
  66. #0 string libr Macintosh Library (data)
  67. #>2 string x : %s
  68. #0 string shlb Macintosh Shared Library (data)
  69. #>2 string x : %s
  70. #0 string cdev Macintosh Control Panel (data)
  71. #>2 string x : %s
  72. #0 string INIT Macintosh Extension (data)
  73. #>2 string x : %s
  74. #0 string FFIL Macintosh Truetype Font (data)
  75. #>2 string x : %s
  76. #0 string LWFN Macintosh Postscript Font (data)
  77. #>2 string x : %s
  78. # Additional Macintosh Files (franklsm@tuns.ca)
  79. # GRR: Too weak
  80. #0 string PACT Macintosh Compact Pro Archive (data)
  81. #>2 string x : %s
  82. #0 string ttro Macintosh TeachText File (data)
  83. #>2 string x : %s
  84. #0 string TEXT Macintosh TeachText File (data)
  85. #>2 string x : %s
  86. #0 string PDF Macintosh PDF File (data)
  87. #>2 string x : %s
  88. # MacBinary format (Eric Fischer, enf@pobox.com)
  89. # Update: Joerg Jenderek
  90. # URL: https://en.wikipedia.org/wiki/MacBinary
  91. # Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt
  92. #
  93. # Unfortunately MacBinary doesn't really have a magic number prior
  94. # to the MacBinary III format.
  95. #
  96. # old version number, must be kept at zero for compatibility
  97. 0 byte 0
  98. # length of filename (must be in the range 1-63)
  99. >1 ubyte >0
  100. # skip T.PIC.LZ INSTRUMENT.7T INVENTORY
  101. >>1 ubyte <64
  102. # skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)"
  103. # by looking for printable characters at beginning of file name
  104. >>>2 ubelong >0x1F000000
  105. # zero fill, must be zero for compatibility
  106. >>>>74 byte 0
  107. # zero fill, must be zero for compatibility
  108. >>>>>82 byte 0
  109. # MacBinary I test for valid version numbers
  110. >>>>>>122 ubeshort 0
  111. # additional check for creation date after 1 Jan 1970 ~ 7C25B080h
  112. #>>>>>>>91 ubelong >0x7c25b07F
  113. # additional check for undefined header fields in MacBinary I
  114. #>>>>>>>101 ulong 0
  115. >>>>>>>0 use mac-bin
  116. # MacBinary II the newer versions begins at 129
  117. >>>>>>122 ubeshort 0x8181
  118. >>>>>>>0 use mac-bin
  119. # MacBinary III with MacBinary II to read
  120. >>>>>122 ubeshort 0x8281
  121. >>>>>>0 use mac-bin
  122. # display information of MacBinary file
  123. 0 name mac-bin
  124. >122 ubyte x MacBinary
  125. # versions for MacBinary II/III
  126. >122 ubyte 129 II
  127. >122 ubyte 130 III
  128. # only in MacBinary III
  129. >>102 string !mBIN with surprising version
  130. !:mime application/x-macbinary
  131. !:apple PSPTBINA
  132. !:ext bin/macbin
  133. # THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary
  134. #>1 ubyte >63 \b, name length %u too BIG!
  135. #>122 ubeshort x \b, version 0x%x
  136. # Finder flags if not 0
  137. # >73 byte !0 \b, flags 0x
  138. # >73 byte =0
  139. # >>101 byte !0 \b, flags 0x
  140. # # original Finder flags (Bits 8-15)
  141. # >73 byte !0 \b%x
  142. # # finder flags, bits 0-7
  143. # >101 byte !0 \b%x
  144. >73 byte &0x01 \b, inited
  145. >73 byte &0x02 \b, changed
  146. >73 byte &0x04 \b, busy
  147. >73 byte &0x08 \b, bozo
  148. >73 byte &0x10 \b, system
  149. >73 byte &0x20 \b, bundle
  150. >73 byte &0x40 \b, invisible
  151. >73 byte &0x80 \b, locked
  152. # 75 beshort # vertical posn in window
  153. #>75 beshort !0 \b, v.pos %u
  154. # 77 beshort # horiz posn in window
  155. #>77 beshort !0 \b, h.pos %u
  156. # 79 beshort # window or folder ID
  157. >79 ubeshort !0 \b, ID 0x%x
  158. # protected flag
  159. >81 byte !0 \b, protected 0x%x
  160. # length of comment after resource
  161. >99 ubeshort !0 \b, comment length %u
  162. # char. code of file name
  163. >106 ubyte !0 \b, char. code 0x%x
  164. # still more Finder flags
  165. >107 ubyte !0 \b, more flags 0x%x
  166. # length of total files when unpacked only used when pack and unpack on the fly
  167. >116 ubelong !0 \b, total length %u
  168. # 120 beshort # length of add'l header
  169. >120 ubeshort !0 \b, 2nd header length %u
  170. # 124 beshort # checksum
  171. #>124 ubeshort !0 \b, CRC 0x%x
  172. # creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080
  173. >91 beldate-0x7C25B080 x \b, %s
  174. # THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow
  175. >91 ubelong <0x7c25b080 INVALID date
  176. #>91 belong-0x7C25B080 x \b, DEBUG DATE %d
  177. # last modified date
  178. >95 beldate-0x7C25B080 x \b, modified %s
  179. # Apple creator+typ if not null
  180. # file creator (normally expressed as four characters)
  181. >69 ulong !0 \b, creator
  182. # instead 4 character code display full creator name
  183. >>69 use apple-creator
  184. # file type (normally expressed as four characters)
  185. >65 ulong !0 \b, type
  186. >>65 use apple-type
  187. # length of data segment
  188. >83 ubelong !0 \b, %u bytes
  189. # filename (in the range 1-63)
  190. >1 pstring x "%s"
  191. # print 1 space and then at offset 128 inspect data fork content if it has one
  192. >83 ubelong !0 \b
  193. >>128 indirect x
  194. # Afterwards resource fork if length of resource segment not zero
  195. >87 ubelong !0
  196. # calculate resource fork offset
  197. >>83 ubelong+128 x \b, at 0x%x
  198. # length of resource segment
  199. >>87 ubelong !0 %u bytes
  200. >>(83.S+128) ubequad x resource
  201. # further resource fork content inspection
  202. >>>&-8 indirect x
  203. # Apple Type/Creator Database
  204. # URL: https://en.wikipedia.org/wiki/Type_code
  205. # Reference: https://www.lacikam.co.il/tcdb/
  206. # https://www.macdisk.com/macsigen.php
  207. # Note: classic Mac OS files have two 4 character codes for type and creator.
  208. # Thereby the Finder attach documents types to applications.
  209. #>65 string x \b, type "%4.4s"
  210. # display information about apple type
  211. 0 name apple-type
  212. >0 string 8BIM PhotoShop
  213. >0 string ALB3 PageMaker 3
  214. >0 string ALB4 PageMaker 4
  215. >0 string ALT3 PageMaker 3
  216. >0 string APPL application
  217. >0 string AWWP AppleWorks word processor
  218. >0 string CIRC simulated circuit
  219. >0 string DRWG MacDraw
  220. >0 string EPSF Encapsulated PostScript
  221. >0 string FFIL font suitcase
  222. >0 string FKEY function key
  223. >0 string FNDR Macintosh Finder
  224. >0 string GIFf GIF image
  225. >0 string Gzip GNU gzip
  226. >0 string INIT system extension
  227. >0 string LIB\ library
  228. >0 string LWFN PostScript font
  229. >0 string MSBC Microsoft BASIC
  230. >0 string PACT Compact Pro archive
  231. >0 string PDF\ Portable Document Format
  232. >0 string PICT picture
  233. >0 string PNTG MacPaint picture
  234. >0 string PREF preferences
  235. >0 string PROJ Think C project
  236. >0 string QPRJ Think Pascal project
  237. >0 string SCFL Defender scores
  238. >0 string SCRN startup screen
  239. >0 string SITD StuffIt Deluxe
  240. >0 string SPn3 SuperPaint
  241. >0 string STAK HyperCard stack
  242. >0 string Seg\ StuffIt segment
  243. >0 string TARF Unix tar archive
  244. >0 string TEXT ASCII
  245. >0 string TIFF TIFF image
  246. >0 string TOVF Eudora table of contents
  247. >0 string WDBN Microsoft Word word processor
  248. >0 string WORD MacWrite word processor
  249. >0 string XLS\ Microsoft Excel
  250. >0 string ZIVM compress (.Z)
  251. >0 string ZSYS Pre-System 7 system file
  252. >0 string acf3 Aldus FreeHand
  253. >0 string cdev control panel
  254. >0 string dfil Desk Accessory suitcase
  255. >0 string libr library
  256. >0 string nX^d WriteNow word processor
  257. >0 string nX^w WriteNow dictionary
  258. >0 string rsrc resource
  259. >0 string scbk Scrapbook
  260. >0 string shlb shared library
  261. >0 string ttro SimpleText read-only
  262. >0 string zsys system file
  263. # additional types added in Dec 2017
  264. >0 string BINA binary file
  265. >0 string BMPp BMP image
  266. >0 string JPEG JPEG image
  267. #>0 string W4BN Microsoft Word x.y word processor?
  268. # if type name is not known display 4 character identifier
  269. >0 default x
  270. >>0 string x '%4.4s'
  271. #>69 string x \b, creator "%4.4s"
  272. # Now Apple has no repository of registered Creator IDs any more. These are
  273. # just the ones that I happened to have files from and was able to identify.
  274. # display information about apple creator
  275. 0 name apple-creator
  276. >0 string 8BIM Adobe Photoshop
  277. >0 string ALD3 PageMaker 3
  278. >0 string ALD4 PageMaker 4
  279. >0 string ALFA Alpha editor
  280. >0 string APLS Apple Scanner
  281. >0 string APSC Apple Scanner
  282. >0 string BRKL Brickles
  283. >0 string BTFT BitFont
  284. >0 string CCL2 Common Lisp 2
  285. >0 string CCL\ Common Lisp
  286. >0 string CDmo The Talking Moose
  287. >0 string CPCT Compact Pro
  288. >0 string CSOm Eudora
  289. >0 string DMOV Font/DA Mover
  290. >0 string DSIM DigSim
  291. >0 string EDIT Macintosh Edit
  292. >0 string ERIK Macintosh Finder
  293. >0 string EXTR self-extracting archive
  294. >0 string Gzip GNU gzip
  295. >0 string KAHL Think C
  296. >0 string LWFU LaserWriter Utility
  297. >0 string LZIV compress
  298. >0 string MACA MacWrite
  299. >0 string MACS Macintosh operating system
  300. >0 string MAcK MacKnowledge terminal emulator
  301. >0 string MLND Defender
  302. >0 string MPNT MacPaint
  303. >0 string MSBB Microsoft BASIC (binary)
  304. >0 string MSWD Microsoft Word
  305. >0 string NCSA NCSA Telnet
  306. >0 string PJMM Think Pascal
  307. >0 string PSAL Hunt the Wumpus
  308. #>0 string PSI2 Apple File Exchange
  309. >0 string R*ch BBEdit
  310. >0 string RMKR Resource Maker
  311. >0 string RSED Resource Editor
  312. >0 string Rich BBEdit
  313. >0 string SIT! StuffIt
  314. >0 string SPNT SuperPaint
  315. >0 string Unix NeXT Mac filesystem
  316. >0 string VIM! Vim editor
  317. >0 string WILD HyperCard
  318. >0 string XCEL Microsoft Excel
  319. >0 string aCa2 Fontographer
  320. >0 string aca3 Aldus FreeHand
  321. >0 string dosa Macintosh MS-DOS file system
  322. >0 string movr Font/DA Mover
  323. >0 string nX^n WriteNow
  324. >0 string pdos Apple ProDOS file system
  325. >0 string scbk Scrapbook
  326. >0 string ttxt SimpleText
  327. >0 string ufox Foreign File Access
  328. # additional creators added in Dec 2017
  329. # Claris/Apple Works
  330. >0 string BOBO Apple Works
  331. # CU-SeeMe_0.87b3_(68K).bin
  332. #>0 string CUce bar
  333. >0 string PSPT Apple File Exchange
  334. # Disk_Copy_4.2.sea.bin
  335. #>0 string NCse foo
  336. # probably StuffIt/Aladdin by Smith Micro Software, Inc.
  337. >0 string STi0 stuffit
  338. # MacGzip-1.1.3.sea.bin
  339. #>0 string aust bar
  340. # D-Disk_Copy_6.3.3.smi.bin
  341. >0 string oneb Disk Copy Self Mounting
  342. # if creator name is not known display 4 character identifier
  343. >0 default x
  344. >>0 string x '%4.4s'
  345. # sas magic from Bruce Foster (bef@nwu.edu)
  346. #
  347. #0 string SAS SAS
  348. #>8 string x %s
  349. 0 string SAS SAS
  350. >24 string DATA data file
  351. >24 string CATALOG catalog
  352. >24 string INDEX data file index
  353. >24 string VIEW data view
  354. # sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
  355. #
  356. 0x54 string SAS SAS 7+
  357. >0x9C string DATA data file
  358. >0x9C string CATALOG catalog
  359. >0x9C string INDEX data file index
  360. >0x9C string VIEW data view
  361. # spss magic for SPSS system and portable files,
  362. # from Bruce Foster (bef@nwu.edu).
  363. 0 long 0xc1e2c3c9 SPSS Portable File
  364. >40 string x %s
  365. 0 string $FL2 SPSS System File
  366. >24 string x %s
  367. 0 string $FL3 SPSS System File
  368. >24 string x %s
  369. # Macintosh filesystem data
  370. # From "Tom N Harris" <telliamed@mac.com>
  371. # Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
  372. # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
  373. # entries depend on the data arithmetic added after v.35
  374. # There's also some Pascal strings in here, ditto...
  375. # The boot block signature, according to IM:Files, is
  376. # "for HFS volumes, this field always contains the value 0x4C4B."
  377. # But if this is true for MFS or HFS+ volumes, I don't know.
  378. # Alternatively, the boot block is supposed to be zeroed if it's
  379. # unused, so a simply >0 should suffice.
  380. 0x400 beshort 0xD2D7 Macintosh MFS data
  381. >0 beshort 0x4C4B (bootable)
  382. >0x40a beshort &0x8000 (locked)
  383. >0x402 beldate-0x7C25B080 x created: %s,
  384. >0x406 beldate-0x7C25B080 >0 last backup: %s,
  385. >0x414 belong x block size: %d,
  386. >0x412 beshort x number of blocks: %d,
  387. >0x424 pstring x volume name: %s
  388. # *.hfs updated by Joerg Jenderek
  389. # https://en.wikipedia.org/wiki/Hierarchical_File_System
  390. # "BD" gives many false positives
  391. 0x400 beshort 0x4244
  392. # ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
  393. # first block of volume bit map (always 3)
  394. >0x40e ubeshort 0x0003
  395. # maximal length of volume name is 27
  396. >>0x424 ubyte <28 Macintosh HFS data
  397. !:mime application/x-apple-diskimage
  398. #!:apple hfsdINIT
  399. #!:apple MACSdisk
  400. # https://www.macdisk.com/macsigen.php
  401. #!:apple ddskdevi
  402. !:apple ????devi
  403. # https://en.wikipedia.org/wiki/Apple_Disk_Image
  404. !:ext hfs/dmg
  405. >>>0 beshort 0x4C4B (bootable)
  406. #>>>0 beshort 0x0000 (not bootable)
  407. >>>0x40a beshort &0x8000 (locked)
  408. >>>0x40a beshort ^0x0100 (mounted)
  409. >>>0x40a beshort &0x0200 (spared blocks)
  410. >>>0x40a beshort &0x0800 (unclean)
  411. >>>0x47C beshort 0x482B (Embedded HFS+ Volume)
  412. # https://www.epochconverter.com/
  413. # 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970
  414. # 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00
  415. # construct not working
  416. #>>>0x402 beldate-0x7C25B080 x created: %s,
  417. #>>>0x406 beldate-0x7C25B080 x last modified: %s,
  418. #>>>0x440 beldate-0x7C25B080 >0 last backup: %s,
  419. # found block sizes 200h,1200h,2800h
  420. >>>0x414 belong x block size: %d,
  421. >>>0x412 beshort x number of blocks: %d,
  422. >>>0x424 pstring x volume name: %s
  423. 0x400 beshort 0x482B Macintosh HFS Extended
  424. >&0 beshort x version %d data
  425. >0 beshort 0x4C4B (bootable)
  426. >0x404 belong ^0x00000100 (mounted)
  427. >&2 belong &0x00000200 (spared blocks)
  428. >&2 belong &0x00000800 (unclean)
  429. >&2 belong &0x00008000 (locked)
  430. >&6 string x last mounted by: '%.4s',
  431. # really, that should be treated as a belong and we print a string
  432. # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
  433. >&14 beldate-0x7C25B080 x created: %s,
  434. # only the creation date is local time, all other timestamps in HFS+ are UTC.
  435. >&18 bedate-0x7C25B080 x last modified: %s,
  436. >&22 bedate-0x7C25B080 >0 last backup: %s,
  437. >&26 bedate-0x7C25B080 >0 last checked: %s,
  438. >&38 belong x block size: %d,
  439. >&42 belong x number of blocks: %d,
  440. >&46 belong x free blocks: %d
  441. ## AFAIK, only the signature is different
  442. # same as Apple Partition Map
  443. # GRR: This magic is too weak, it is just "TS"
  444. #0x200 beshort 0x5453 Apple Old Partition data
  445. #>0x2 beshort x block size: %d,
  446. #>0x230 string x first type: %s,
  447. #>0x210 string x name: %s,
  448. #>0x254 belong x number of blocks: %d,
  449. #>0x400 beshort 0x504D
  450. #>>0x430 string x second type: %s,
  451. #>>0x410 string x name: %s,
  452. #>>0x454 belong x number of blocks: %d,
  453. #>>0x800 beshort 0x504D
  454. #>>>0x830 string x third type: %s,
  455. #>>>0x810 string x name: %s,
  456. #>>>0x854 belong x number of blocks: %d,
  457. #>>>0xa00 beshort 0x504D
  458. #>>>>0xa30 string x fourth type: %s,
  459. #>>>>0xa10 string x name: %s,
  460. #>>>>0xa54 belong x number of blocks: %d
  461. # From: Remi Mommsen <mommsen@slac.stanford.edu>
  462. 0 string BOMStore Mac OS X bill of materials (BOM) file
  463. # From: Adam Buchbinder <adam.buchbinder@gmail.com>
  464. # URL: https://en.wikipedia.org/wiki/Datafork_TrueType
  465. # Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
  466. # TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
  467. # don't know what they mean.
  468. 0 belong 0x100
  469. >(0x4.L+24) beshort x
  470. >>&4 belong 0x73666e74 Mac OSX datafork font, TrueType
  471. >>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT'
  472. >>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT'
  473. >>&4 belong 0x504f5354 Mac OSX datafork font, PostScript