ole2compounddocs 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673
  1. #------------------------------------------------------------------------------
  2. # $File: ole2compounddocs,v 1.19 2022/09/11 20:52:40 christos Exp $
  3. # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
  4. # storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
  5. # Additional tests for OLE 2 Compound Documents should be under this recipe.
  6. # reference: https://www.openoffice.org/sc/compdocfileformat.pdf
  7. 0 string \320\317\021\340\241\261\032\341
  8. # https://digital-preservation.github.io/droid/
  9. # skip droid skeleton like fmt-39-signature-id-128.doc by valid version
  10. >0x1A ushort !0xABAB OLE 2 Compound Document
  11. #>0x1C uleshort x \b, endnian %#4.4x
  12. # big endian not tested
  13. >>0x1C ubeshort =0xfffe \b, big-endian
  14. >>>546 string jbjb : Microsoft Word Document
  15. !:mime application/msword
  16. !:apple MSWDWDBN
  17. !:ext doc
  18. # Byte Order 0xFFFE means little-endian found in real world applications
  19. #>>0x1C uleshort =0xfffe \b, little-endian
  20. >>0x1C uleshort =0xfffe
  21. # From: Joerg Jenderek
  22. # Major Version 3 or 4
  23. >>>0x1A uleshort x \b, v%u
  24. # Minor Version 32h=50 3Bh=59 3Eh=62
  25. >>>0x18 uleshort x \b.%u
  26. # SecID of first sector of the directory stream is often 1 but high like 3144h
  27. >>>48 ulelong x \b, SecID %#x
  28. # Sector Shift Exponent in short-stream container stream: 6~64 bytes
  29. >>>32 uleshort !6 \b, exponent of short stream %u
  30. # total number of sectors used for the FAT
  31. >>>44 ulelong >1 \b, %u FAT sectors
  32. # SecID of first sector of the short-sector allocation table (Mini FAT)
  33. # or -2 (End Of ChainSecID) if not extant
  34. >>>60 ulelong !0xffFFffFE \b, Mini FAT start sector %#x
  35. # total number of sectors used for the short-sector allocation table
  36. >>>64 ulelong !1 \b, %u Mini FAT sector
  37. # plural s
  38. >>>>64 ulelong >1 \bs
  39. # SecID of first sector of the master sector allocation table (DIFAT)
  40. # or -2 (End Of Chain SecID) if no additional sectors used
  41. >>>68 ulelong !0xffFFffFE \b, DIFAT start sector %#x
  42. # total number of sectors used for the master sector allocation table (DIFAT)
  43. >>>72 ulelong >0 \b, %u DIFAT sectors
  44. # First part of the master sector allocation table (DIFAT) containing 109 SecIDs
  45. #>>>76 ubequad x \b, DIFAT=%#16.16llx
  46. #>>>84 ubequad x \b%16.16llx...
  47. # pointer to root entry only works with standard configuration for SecID ~< 800h
  48. # Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls
  49. # "ORLEN Factbook 2017.xls" XnView_metadata.doc
  50. # "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized
  51. >>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB
  52. # Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4
  53. >>>0x1E uleshort 0xc \b, blocksize 4096
  54. # jump to one block (4096 bytes per block) before root storage block
  55. >>>>(48.l*4096) ubyte x
  56. >>>>>&4095 use ole2-directory
  57. #>>>0x1E uleshort 9 \b, blocksize 512
  58. >>>0x1E uleshort 9
  59. # jump to one block (512 bytes per block) before root storage block
  60. # in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h
  61. >>>>(48.l*512) ubyte x
  62. >>>>>&511 use ole2-directory
  63. # check directory entry structure and display types by GUID
  64. 0 name ole2-directory
  65. # directory entry name like "Root Entry"
  66. #>0 lestring16 x \b, 1st %.10s
  67. # type of the entry; 5~Root storage
  68. #>66 ubyte x \b, type %x
  69. # node colour of the entry: 00H ~ Red 01H ~ Black
  70. #>67 ubyte x \b, color %x
  71. # the DirIDs of the child nodes. Should both be -1 in the root storage entry
  72. #>68 bequad !0xffffffffffffffff \b, DirIDs %llx
  73. # second directory entry name like VisioDocument Control000
  74. #>128 lestring16 x \b, 2nd %.20s
  75. # third directory entry like WordDocument
  76. #>256 lestring16 x \b, 3rd %.20s
  77. # forth
  78. #>384 lestring16 x \b, 4th %.10s
  79. # 5th
  80. #>512 lestring16 x \b, 5th %.10s
  81. # 6th
  82. #>640 lestring16 x \b, 6th %.10s
  83. # 7th
  84. #>768 lestring16 x \b, 7th %.10s
  85. # https://wikileaks.org/ciav7p1/cms/page_13762814.html
  86. # https://m.blog.naver.com/superman4u/40047693679
  87. # https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt
  88. # https://toolslick.com/conversion/data/guid
  89. #>80 ubequad !0 \b, clsid %#16.16llx
  90. #>>88 ubequad x \b%16.16llx
  91. # test for "Root Entry" inside directory by type 5 value
  92. >66 ubyte 5
  93. # look for CLSID GUID 0
  94. >>88 ubequad 0x0
  95. >>>80 ubequad 0x0
  96. # - Microstation V8 DGN files (www.bentley.com)
  97. # URL: https://en.wikipedia.org/wiki/MicroStation
  98. # Last update on 10/23/2006 by Lester Hightower
  99. # 07/24/2019 by Joerg Jenderek
  100. # Second directory entry name like Dgn~H Dgn~S
  101. >>>>128 lestring16 Dgn~ : Microstation V8 CAD
  102. #!:mime application/x-ole-storage
  103. !:mime application/x-bentley-dgn
  104. # http://www.q-cad.com/files/samples_cad_files/1344468165.dgn
  105. !:ext dgn
  106. #
  107. # URL: http://fileformats.archiveteam.org/wiki/WordPerfect
  108. # Second directory entry name PerfectOffice_
  109. >>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic
  110. !:mime application/vnd.wordperfect
  111. # https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
  112. !:apple ????WPC7
  113. !:ext mst/wpd/wpg
  114. #
  115. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
  116. # Second directory entry name MatOST_
  117. >>>>128 lestring16 MatOST : Microsoft Works 3.0 document
  118. !:mime application/vnd.ms-works
  119. !:apple ????AWWP
  120. !:ext wps
  121. #
  122. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet
  123. # 3rd directory entry name WksSSWorkBook
  124. >>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet
  125. !:mime application/vnd.ms-works
  126. !:apple ????AWSS
  127. !:ext xlr
  128. #
  129. # URL: http://fileformats.archiveteam.org/wiki/XLS
  130. # what is the difference to {00020820-0000-0000-c000-000000000046} ?
  131. # Second directory entry name Workbook
  132. >>>>128 lestring16 Workbook
  133. >>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid
  134. !:mime application/vnd.ms-excel
  135. # https://www.macdisk.com/macsigen.php XLS5 for Excel 5
  136. !:apple ????XLS9
  137. !:ext xls
  138. #
  139. # URL: http://fileformats.archiveteam.org/wiki/PPT
  140. # Second directory entry name Object1 Object12 Object35
  141. >>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation
  142. !:mime application/vnd.ms-powerpoint
  143. # https://www.macdisk.com/macsigen.php
  144. !:apple ????PPT3
  145. !:ext ppt
  146. #
  147. # URL: https://www.msoutlook.info/question/164
  148. # Second directory entry name __CollDataStm
  149. >>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings
  150. #!:mime application/vnd.ms-outlook
  151. !:mime application/x-ms-srs
  152. # %APPDATA%\Microsoft\Outlook\Outlook.srs
  153. !:ext srs
  154. #
  155. # URL: https://www.file-extensions.org/cag-file-extension
  156. # Second directory entry name Category
  157. >>>>128 lestring16 Category : Microsoft Clip Art Gallery
  158. #!:mime application/x-ole-storage
  159. !:mime application/x-ms-cag
  160. !:apple MScgCGdb
  161. !:ext cag/
  162. #
  163. # URL: https://www.filesuffix.com/de/extension/rra
  164. # 3rd directory entry name StrIndex_StringTable
  165. >>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer
  166. #!:mime application/x-ole-storage
  167. !:mime application/x-ms-rra
  168. !:ext rra
  169. #
  170. # URL: https://www.forensicswiki.org/wiki/Jump_Lists
  171. # 3rd directory entry name DestList
  172. >>>>256 lestring16 DestList : Windows jump list
  173. #!:mime application/x-ole-storage
  174. !:mime application/x-ms-jumplist
  175. # %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms
  176. !:ext automaticDestinations-ms
  177. #
  178. # URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache
  179. # Second directory entry name 256_
  180. >>>>128 lestring16 256_ : Windows thumbnail database 256
  181. #!:mime application/x-ole-storage
  182. !:mime application/x-ms-thumbnail
  183. # Thumbs.db
  184. !:ext db
  185. >>>>128 lestring16 96_ : Windows thumbnail database 96
  186. !:mime application/x-ms-thumbnail
  187. !:ext db
  188. # 3rd directory entry name Catalog_
  189. >>>>256 lestring16 Catalog : Windows thumbnail database
  190. !:mime application/x-ms-thumbnail
  191. !:ext db
  192. #
  193. # URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches
  194. # Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based
  195. # Second directory entry name Control000
  196. >>>>128 lestring16 Control000 : Microsoft old Systeminfo
  197. #!:mime application/x-ole-storage
  198. !:mime application/x-ms-info
  199. !:ext nfo
  200. #
  201. # From: Joerg Jenderek
  202. # URL: https://en.wikipedia.org/wiki/Microsoft_Access
  203. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mdz.trid.xml
  204. # http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
  205. # Note: only version foo tested and called "Microsoft Access Wizard template" by TrID
  206. # Fourth directory entry name TemplateID
  207. >>>>384 lestring16 TemplateID : Microsoft Access wizard template
  208. # Second directory entry name like \005SummaryInformation and 3rd name like \005DocumentSummaryInformation
  209. #!:mime application/x-ole-storage
  210. #!:mime application/vnd.ms-office
  211. #!:mime application/vnd.ms-access
  212. #!:mime application/msaccess
  213. !:mime application/x-ms-mdz
  214. # http://extension.nirsoft.net/mdz
  215. !:ext mdz
  216. #
  217. # URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House
  218. # Second directory entry name Thumbnail
  219. >>>>128 lestring16 Thumbnail : Corel PrintHouse image
  220. #!:mime application/x-ole-storage
  221. !:mime application/x-corel-cph
  222. !:ext cph
  223. # 3rd directory entry name Thumbnail
  224. >>>>256 lestring16 Thumbnail : Corel PrintHouse image
  225. !:mime application/x-corel-cph
  226. !:ext cph
  227. # URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery
  228. # Note: format since Gallery 2; sometimes called Corel Multimedia Manager Album
  229. # third directory entry name _INFO_
  230. >>>>256 lestring16 _INFO_ : Corel Gallery
  231. # second directory entry name _ITEM_ or _DATA_
  232. # later directory entry names: _ALBUM_ _THUMBNAIL_
  233. #!:mime application/x-ole-storage
  234. !:mime application/x-corel-gal
  235. !:ext gal
  236. #
  237. # From: Joerg Jenderek
  238. # URL: https://archive.org/details/iPhoto-Plus-4
  239. # https://filext.com/file-extension/TPL
  240. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/tpl-ulead.trid.xml
  241. # Note: found in Template sub directory in program directory of software iPhoto Plus version 4
  242. # second, third and fourth directory entry name like TplHeader TplMainImage TplPreview
  243. >>>>128 lestring16 TplHeader : Ulead iPhoto Template
  244. #!:mime application/x-ole-storage
  245. !:mime image/x-ulead-tpl
  246. # https://www.file-extensions.org/tpl-file-extension-ulead-photo-express-template
  247. !:ext tpl
  248. #
  249. # URL: https://en.wikipedia.org/wiki/Hangul_(word_processor)
  250. # Note: "HWP Document File" signature found in FileHeader
  251. # Second directory entry name FileHeader hint for Thinkfree Office document
  252. >>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor File
  253. #!:mime application/haansofthwp
  254. !:mime application/x-hwp
  255. # https://example-files.online-convert.com/document/hwp/example.hwp
  256. !:ext hwp
  257. #
  258. # URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/
  259. # Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083
  260. >>>>128 lestring16 dd2 : StarOffice Gallery view
  261. #!:mime application/x-ole-storage
  262. !:mime application/x-star-sdv
  263. !:ext sdv
  264. # URL: https://en.wikipedia.org/wiki/SoftMaker_Office
  265. # second directory entry name Current User
  266. >>>>128 lestring16 Current\ User : SoftMaker
  267. # third directory entry name SMNativeObjData
  268. >>>>>256 lestring16 SMNativeObjData
  269. # 5th directory entry name PowerPoint
  270. >>>>>>512 lestring16 PowerPoint PowerPoint presentation or template
  271. !:mime application/vnd.ms-powerpoint
  272. !:ext ppt/pps/pot
  273. # 4th directory entry name PowerPoint
  274. >>>>>384 lestring16 PowerPoint Presentations or template
  275. # http://extension.nirsoft.net/prv
  276. !:mime application/vnd.softmaker.presentations
  277. !:ext prd/prv
  278. # third directory entry name like Current User
  279. >>>>256 lestring16 Current\ User : SoftMaker
  280. # 5th directory entry name PowerPoint
  281. >>>>>512 lestring16 PowerPoint Presentations or template
  282. # http://extension.nirsoft.net/prd
  283. !:mime application/vnd.softmaker.presentations
  284. !:ext prd/prv
  285. # 2nd directory entry name Pictures
  286. >>>>>>128 lestring16 Pictures with pictures
  287. #
  288. # URL: http://fileformats.archiveteam.org/wiki/PageMaker
  289. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/p
  290. # pagemaker-generic.trid.xml
  291. # pagemaker-pm6.trid.xml
  292. # pagemaker-pm65.trid.xml
  293. # pmd-pm7.trid.xml
  294. # From: Joerg Jenderek
  295. # Note: since version 6 embedd as stream with PageMaker name the "old" format handled by ./wordprocessors
  296. # verified by Michal Mutl Structured Storage Viewer `SSView.exe brochus.pt6`
  297. # Second directory entry name PageMaker
  298. >>>>128 lestring16 PageMaker :
  299. # look for magic of "old" PageMaker like in 02TEMPLT.T65
  300. >>>>>0 search/0xa900/s \0\0\0\0\0\0\xff\x99
  301. # GRR: jump to PageMaker stream and inspect it by sub routine PageMaker of ./wordprocessors failed with wrong version!
  302. #>>>>>>&0 use PageMaker
  303. # THIS WORKS PARTLY!
  304. >>>>>>&0 indirect x
  305. # remaining null clsid
  306. >>>>128 default x : UNKNOWN
  307. # second directory entry name like VisioDocument Control000
  308. >>>>>128 lestring16 x with names %.20s
  309. # third directory entry like WordDocument
  310. >>>>>256 lestring16 x %.20s
  311. # forth
  312. >>>>>384 lestring16 x %.20s
  313. !:mime application/x-ole-storage
  314. # according to file version 5.41 with -e soft option
  315. #!:mime application/CDFV2
  316. #!:ext ???
  317. # look for known clsid GUID
  318. # - Visio documents
  319. # URL: http://fileformats.archiveteam.org/wiki/Visio
  320. # Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek
  321. >>88 ubequad 0xc000000000000046 : Microsoft
  322. >>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template
  323. !:mime application/vnd.visio
  324. # VSD~Drawing VSS~Stencil VST~Template
  325. !:ext vsd/vss/vst
  326. >>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template
  327. !:mime application/vnd.visio
  328. !:ext vsd/vss/vst
  329. #
  330. # URL: http://fileformats.archiveteam.org/wiki/Windows_Installer
  331. >>>80 ubequad 0x84100c0000000000 Windows Installer Package
  332. !:mime application/x-msi
  333. #!:mime application/x-ms-win-installer
  334. !:ext msi
  335. >>>80 ubequad 0x86100c0000000000 Windows Installer Patch
  336. # ??
  337. !:mime application/x-wine-extension-msp
  338. #!:mime application/x-ms-msp
  339. !:ext msp
  340. #
  341. # URL: http://fileformats.archiveteam.org/wiki/DOC
  342. >>>80 ubequad 0x0009020000000000 Word 6-95 document or template
  343. !:mime application/msword
  344. # for template MSWDW8TN
  345. !:apple MSWDWDBN
  346. !:ext doc/dot
  347. >>>80 ubequad 0x0609020000000000 Word 97-2003 document or template
  348. !:mime application/msword
  349. !:apple MSWDWDBN
  350. # dot for template; no extension on Macintosh
  351. !:ext doc/dot/
  352. #
  353. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
  354. >>>80 ubequad 0x0213020000000000 Works 3-4 document or template
  355. !:mime application/vnd.ms-works
  356. !:apple ????AWWP
  357. # ps for template https://filext.com/file-extension/PS bps for backup
  358. !:ext wps/ps/bps
  359. #
  360. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
  361. >>>80 ubequad 0x0313020000000000 Works 3-4 database or template
  362. !:mime application/vnd.ms-works-db
  363. # https://www.macdisk.com/macsigen.php
  364. !:apple ????AWDB
  365. # db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup
  366. !:ext wdb/db/bdb
  367. #
  368. # URL: https://en.wikipedia.org/wiki/Microsoft_Excel
  369. >>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template
  370. !:mime application/vnd.ms-excel
  371. # https://www.macdisk.com/macsigen.php
  372. !:apple ????XLS5
  373. # worksheet/addin/template/no extension on Macintosh
  374. !:ext xls/xla/xlt/
  375. #
  376. >>>80 ubequad 0x2008020000000000 Excel 97-2003
  377. !:mime application/vnd.ms-excel
  378. # https://www.macdisk.com/macsigen.php XLS5 for Excel 5
  379. !:apple ????XLS9
  380. # 3rd directory entry name
  381. >>>>256 lestring16 _VBA_PROJECT_CUR addin
  382. !:ext xla/
  383. # 4th directory entry name
  384. >>>>384 lestring16 _VBA_PROJECT_CUR addin
  385. !:ext xla
  386. #!:ext xla/
  387. >>>>256 default x worksheet or template
  388. !:ext xls/xlt
  389. #!:ext xls/xlt/
  390. #
  391. # URL: http://fileformats.archiveteam.org/wiki/OLE2
  392. >>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item
  393. #>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message
  394. #!:mime application/vnd.ms-outlook
  395. !:mime application/x-ms-msg
  396. !:ext msg
  397. # URL: https://wiki.fileformat.com/email/oft/
  398. >>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template
  399. #!:mime application/vnd.ms-outlook
  400. !:mime application/x-ms-oft
  401. !:ext oft
  402. #
  403. # URL: http://fileformats.archiveteam.org/wiki/PPT
  404. >>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation
  405. !:mime application/vnd.ms-powerpoint
  406. # https://www.macdisk.com/macsigen.php
  407. !:apple ????PPT3
  408. !:ext ppt
  409. #??
  410. # URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/
  411. >>88 ubequad 0xa29a00aa004a1a72 : Microsoft
  412. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
  413. >>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document
  414. !:mime application/vnd.ms-works
  415. !:apple ????AWWP
  416. !:ext wps
  417. #
  418. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
  419. >>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database
  420. !:mime application/vnd.ms-works-db
  421. !:apple ????AWDB
  422. !:ext wdb/bdb
  423. #??
  424. >>88 ubequad 0xa40700c04fb932ba : Microsoft
  425. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
  426. >>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document
  427. !:mime application/vnd.ms-works
  428. !:apple ????AWWP
  429. !:ext wps
  430. # From: Joerg Jenderek
  431. # URL: https://en.wikipedia.org/wiki/Microsoft_Works
  432. # Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
  433. # Note: probably version 6 and 7
  434. # organize pictures like JPFG images in streams __cf1 with names like
  435. # 001.JPG, 002.JPG ... in streams __fname
  436. >>88 ubequad 0xa1c800c04f612452 : Microsoft
  437. >>>80 ubequad 0xc0c7266eb98cd311 Works portfolio
  438. # 2nd directory entry name PfOrder, 3rd __LastID and 4th __SizeUsed
  439. #!:mime application/x-ole-storage
  440. # https://www.iana.org/assignments/media-types/application/vnd.ms-works
  441. !:mime application/vnd.ms-works
  442. # https://extension.nirsoft.net/wsb
  443. # like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb
  444. !:ext wsb
  445. #??
  446. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
  447. >>88 ubequad 0x00c0000000000046 : Microsoft
  448. >>>80 ubequad 0x0112020000000000 Publisher
  449. !:mime application/vnd.ms-publisher
  450. !:ext pub
  451. #
  452. # URL: http://fileformats.archiveteam.org/wiki/PPT
  453. #??
  454. >>88 ubequad 0xa90300aa00510ea3 : Microsoft
  455. >>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation
  456. !:mime application/vnd.ms-powerpoint
  457. # https://www.macdisk.com/macsigen.php
  458. !:apple ????PPT3
  459. !:ext ppt/pot
  460. #??
  461. >>88 ubequad 0x86ea00aa00b929e8 : Microsoft
  462. >>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template
  463. !:mime application/vnd.ms-powerpoint
  464. !:apple ????PPT3
  465. # /autostart/template
  466. !:ext ppt/pps/pot
  467. # From: Joerg Jenderek
  468. # URL: https://www.file-extensions.org/ppa-file-extension
  469. # https://en.wikipedia.org/wiki/Microsoft_PowerPoint#cite_note-231
  470. # Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
  471. >>88 ubequad 0x871800aa0060263b : Microsoft
  472. # only version 8 (97) tested; PowerPoint 4.0 to 11.0 (2004) (Wikipedia); 97 to 2003 (file-extensions.org)
  473. >>>80 ubequad 0xf04672810a72cf11 PowerPoint Addin or Wizard
  474. # second, third and fourth directory entry name like VBA PROJECT PROJECTwm
  475. # http://extension.nirsoft.net/pwz
  476. !:mime application/vnd.ms-powerpoint
  477. # like: BSHPPT97.PPA "AutoContent Wizard.pwz"
  478. !:ext ppa/pwz
  479. #
  480. # From: Joerg Jenderek
  481. # URL: http://fileformats.archiveteam.org/wiki/AWD_(At_Work_Document)
  482. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/awd-fax.trid.xml
  483. # Note: called "Microsoft At Work Fax document" by TrID
  484. >>88 ubequad 0xb29400dd010f2bf9 : Microsoft
  485. >>>80 ubequad 0x801cb0023de01a10 At Work fax Document
  486. #!:mime application/x-ole-storage
  487. !:mime image/x-ms-awd
  488. !:ext awd
  489. #
  490. # URL: https://en.wikipedia.org/wiki/Microsoft_Project
  491. #??
  492. >>88 ubequad 0xbe1100c04fb6faf1 : Microsoft
  493. >>>80 ubequad 0x3a8fb774c8c8d111 Project
  494. !:mime application/vnd.ms-project
  495. !:ext mpp
  496. # From: Joerg Jenderek
  497. # URL: https://en.wikipedia.org/wiki/Microsoft_Office_shared_tools#Binder
  498. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/o/obd.trid.xml
  499. # http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
  500. # Note: only version 8 tested and called "Office Binder Document" by TrID and
  501. # "Microsoft Office Binder File for Windows" version 97-2000 by DROID fmt/240
  502. >>88 ubequad 0xb21c00aa004ba90b : Microsoft
  503. >>>80 ubequad 0x0004855964661b10 Office Binder Document, Template or wizard
  504. # second directory entry name like Binder
  505. # https://www.file-extensions.org/obd-file-extension
  506. #!:mime application/vnd.ms-binder
  507. !:mime application/x-msbinder
  508. # obt for template; obz for Microsoft Office Binder wizard
  509. !:ext obd/obt/obz
  510. #
  511. # URL: http://fileformats.archiveteam.org/wiki/WordPerfect
  512. # Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
  513. # https://github.com/OneWingedShark/WordPerfect/
  514. # blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm
  515. # From: Joerg Jenderek
  516. # Note: internal version x.2 or 2.2 like in embedded ole6-PerfectOffice_MAIN.wpd
  517. # 3rd directory entry name PerfectOffice_OBJECT and 2nd PerfectOffice_MAIN,
  518. # which contains WordPerfect document \xffWPC signature handled by ./wordprocessors
  519. >>88 ubequad 0x19370000929679cd : WordPerfect 7
  520. >>>80 ubequad 0xff739851ad2d2002 Document
  521. !:mime application/vnd.wordperfect
  522. #!:apple ????WPC?
  523. # https://fossies.org/linux/wp2latex/test/ole6.wpd
  524. !:ext wpd
  525. #>>>>0 search/0xc01/s \xffWPC \b, WPC SIGNATURE
  526. # inspect embedded WordPerfect document by ./wordprocessors with 1 space at end
  527. #>>>>>&0 indirect x \b; contains
  528. # GRR: the above expression does not work correctly
  529. #
  530. # URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel)
  531. #???
  532. >>88 ubequad 0x99ae04021c007002 : WordPerfect
  533. >>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation
  534. !:mime application/x-corelpresentations
  535. #!:mime application/x-shw-viewer
  536. #!:mime image/x-presentations
  537. !:ext shw
  538. #
  539. # URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/
  540. >>>80 ubequad 0x60fe2e4099191b10 9 Graphic
  541. #!:mime application/x-wpg
  542. #!:mime image/x-wordperfect-graphics
  543. !:mime image/x-wpg
  544. # https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
  545. !:apple ????WPC9
  546. !:ext wpg
  547. #
  548. # URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats
  549. >>88 ubequad 0x996104021c007002 : StarOffice
  550. >>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template
  551. # https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html
  552. !:mime application/x-starwriter
  553. !:ext sdw/vor
  554. #
  555. >>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template
  556. !:mime application/x-starcalc
  557. !:ext sdc/vor
  558. #
  559. >>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template
  560. !:mime application/x-starimpress
  561. #!:mime application/x-stardraw
  562. # sda ??
  563. !:ext sdd/sda/vor
  564. #??
  565. >>88 ubequad 0x89cb008029e4b0b1 : StarOffice
  566. >>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template
  567. !:mime application/x-starcalc
  568. !:ext sdc/vor
  569. #
  570. >>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template
  571. !:mime application/vnd.stardivision.cal
  572. !:ext sdc/vor
  573. #
  574. >>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template
  575. !:mime application/x-starimpress
  576. !:ext sdd/vor
  577. #??
  578. >>88 ubequad 0xb12a04021c007002 : StarOffice
  579. >>>80 ubequad 0x600459d4fd351c10 StarMath 3.0
  580. !:mime application/x-starmath
  581. !:ext smf
  582. #??
  583. >>88 ubequad 0x8e2c00001b4cc711 : StarOffice
  584. >>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0
  585. !:mime application/x-starchart
  586. !:ext sds
  587. #??
  588. >>88 ubequad 0xa45e00a0249d57b1 : StarOffice
  589. >>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template
  590. !:mime application/x-starwriter
  591. !:ext sdw/vor
  592. #??
  593. >>88 ubequad 0x89ca008029e4b0b1 : StarOffice
  594. >>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0
  595. !:mime application/x-starmath
  596. !:ext smf
  597. #
  598. >>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0
  599. !:mime application/x-starchart
  600. !:ext sds
  601. #??
  602. >>88 ubequad 0xa53f00a0249d57b1 : StarOffice
  603. >>>80 ubequad 0x70c90a340de3d011 Master 4.0 document
  604. !:mime application/x-starwriter-global
  605. !:ext sgl
  606. #??
  607. >>88 ubequad 0x89d0008029e4b0b1 : StarOffice
  608. >>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0
  609. !:mime application/vnd.stardivision.math
  610. !:ext smf
  611. #
  612. >>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template
  613. !:mime application/vnd.stardivision.draw
  614. !:ext sda/vor
  615. #
  616. >>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template
  617. !:mime application/vnd.stardivision.impress
  618. # sda is used for what?
  619. !:ext sdd/vor/sda
  620. #
  621. >>>80 ubequad 0x214388bfdd85d111 StarChart 5.0
  622. !:mime application/vnd.stardivision.chart
  623. !:ext sds
  624. # ??
  625. >>88 ubequad 0xaab4006097da561a : StarOffice
  626. >>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template
  627. !:mime application/vnd.stardivision.writer
  628. !:ext sdw/vor
  629. #
  630. >>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document
  631. !:mime application/vnd.stardivision.writer-global
  632. !:ext sgl
  633. #??
  634. # URL: http://fileformats.archiveteam.org/wiki/FlashPix
  635. >>88 ubequad 0x855300aa00a1f95b : Kodak
  636. >>>80 ubequad 0x0067615654c1ce11 FlashPIX Image
  637. !:mime image/vnd.fpx
  638. !:apple ????FPix
  639. !:ext fpx
  640. # URL: https://en.wikipedia.org/wiki/SoftMaker_Office
  641. >>88 ubequad 0x95f600a0cc3cca14 : PlanMaker
  642. >>>80 ubequad 0x9174088a6452d411 document or template
  643. !:mime application/vnd.softmaker.planmaker
  644. # pmv for template https://www.file-extensions.org/pmv-file-extension
  645. !:ext pmd/pmv
  646. # URL: http://fileformats.archiveteam.org/wiki/MAX_(3ds_Max)
  647. # https://en.wikipedia.org/wiki/Autodesk_3ds_Max
  648. # Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
  649. # Note: called "3D Studio Max Scene" by TrID and "3DS Max" by DROID and
  650. # "3DSMax thumbnail" by XnView and verfied by `nconvert -info A380.max`
  651. # applies only to "newer" versions (about 2008-2020)
  652. >>88 ubequad 0x9fed04143144cc1e : Autodesk
  653. >>>80 ubequad 0x7b8cdd1cc081a045 3ds Max
  654. #!:mime application/x-ole-storage
  655. !:mime model/x-autodesk-max
  656. # like: https://static.free3d.com/models/dropbox/dropbox/sq/A380.7z/A380.max
  657. !:ext max
  658. # also chr for character file according to DROID https://www.nationalarchives.gov.uk/PRONOM/fmt/978
  659. #!:ext max/chr
  660. # remaining non null clsid
  661. >>88 default x
  662. # GRR: check again for non null clsid because wrong when called by indirect directive
  663. >>>88 ubequad !0 : UNKNOWN
  664. # https://reposcope.com/mimetype/application/x-ole-storage
  665. !:mime application/x-ole-storage
  666. # according to file version 5.41 with -e soft option
  667. #!:mime application/CDFV2
  668. #!:ext ???
  669. >>>>80 ubequad !0 \b, clsid %#16.16llx
  670. >>>>88 ubequad x \b%16.16llx