apple 8.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232
  1. #------------------------------------------------------------------------------
  2. # apple: file(1) magic for Apple file formats
  3. #
  4. 0 string FiLeStArTfIlEsTaRt binscii (apple ][) text
  5. 0 string \x0aGL Binary II (apple ][) data
  6. 0 string \x76\xff Squeezed (apple ][) data
  7. 0 string NuFile NuFile archive (apple ][) data
  8. 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
  9. 0 belong 0x00051600 AppleSingle encoded Macintosh file
  10. 0 belong 0x00051607 AppleDouble encoded Macintosh file
  11. # magic for Newton PDA package formats
  12. # from Ruda Moura <ruda@helllabs.org>
  13. 0 string package0 Newton package, NOS 1.x,
  14. >12 belong &0x80000000 AutoRemove,
  15. >12 belong &0x40000000 CopyProtect,
  16. >12 belong &0x10000000 NoCompression,
  17. >12 belong &0x04000000 Relocation,
  18. >12 belong &0x02000000 UseFasterCompression,
  19. >16 belong x version %d
  20. 0 string package1 Newton package, NOS 2.x,
  21. >12 belong &0x80000000 AutoRemove,
  22. >12 belong &0x40000000 CopyProtect,
  23. >12 belong &0x10000000 NoCompression,
  24. >12 belong &0x04000000 Relocation,
  25. >12 belong &0x02000000 UseFasterCompression,
  26. >16 belong x version %d
  27. 0 string package4 Newton package,
  28. >8 byte 8 NOS 1.x,
  29. >8 byte 9 NOS 2.x,
  30. >12 belong &0x80000000 AutoRemove,
  31. >12 belong &0x40000000 CopyProtect,
  32. >12 belong &0x10000000 NoCompression,
  33. # The following entries for the Apple II are for files that have
  34. # been transferred as raw binary data from an Apple, without having
  35. # been encapsulated by any of the above archivers.
  36. #
  37. # In general, Apple II formats are hard to identify because Apple DOS
  38. # and especially Apple ProDOS have strong typing in the file system and
  39. # therefore programmers never felt much need to include type information
  40. # in the files themselves.
  41. #
  42. # Eric Fischer <enf@pobox.com>
  43. # AppleWorks word processor:
  44. #
  45. # This matches the standard tab stops for an AppleWorks file, but if
  46. # a file has a tab stop set in the first four columns this will fail.
  47. #
  48. # The "O" is really the magic number, but that's so common that it's
  49. # necessary to check the tab stops that follow it to avoid false positives.
  50. 4 string O==== AppleWorks word processor data
  51. >85 byte&0x01 >0 \b, zoomed
  52. >90 byte&0x01 >0 \b, paginated
  53. >92 byte&0x01 >0 \b, with mail merge
  54. #>91 byte x \b, left margin %d
  55. # AppleWorks database:
  56. #
  57. # This isn't really a magic number, but it's the closest thing to one
  58. # that I could find. The 1 and 2 really mean "order in which you defined
  59. # categories" and "left to right, top to bottom," respectively; the D and R
  60. # mean that the cursor should move either down or right when you press Return.
  61. #30 string \x01D AppleWorks database data
  62. #30 string \x02D AppleWorks database data
  63. #30 string \x01R AppleWorks database data
  64. #30 string \x02R AppleWorks database data
  65. # AppleWorks spreadsheet:
  66. #
  67. # Likewise, this isn't really meant as a magic number. The R or C means
  68. # row- or column-order recalculation; the A or M means automatic or manual
  69. # recalculation.
  70. #131 string RA AppleWorks spreadsheet data
  71. #131 string RM AppleWorks spreadsheet data
  72. #131 string CA AppleWorks spreadsheet data
  73. #131 string CM AppleWorks spreadsheet data
  74. # Applesoft BASIC:
  75. #
  76. # This is incredibly sloppy, but will be true if the program was
  77. # written at its usual memory location of 2048 and its first line
  78. # number is less than 256. Yuck.
  79. 0 belong&0xff00ff 0x80000 Applesoft BASIC program data
  80. #>2 leshort x \b, first line number %d
  81. # ORCA/EZ assembler:
  82. #
  83. # This will not identify ORCA/M source files, since those have
  84. # some sort of date code instead of the two zero bytes at 6 and 7
  85. # XXX Conflicts with ELF
  86. #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
  87. #>5 byte x \b, build number %d
  88. # Broderbund Fantavision
  89. #
  90. # I don't know what these values really mean, but they seem to recur.
  91. # Will they cause too many conflicts?
  92. # Probably :-)
  93. #2 belong&0xFF00FF 0x040008 Fantavision movie data
  94. # Some attempts at images.
  95. #
  96. # These are actually just bit-for-bit dumps of the frame buffer, so
  97. # there's really no reasonably way to distinguish them except for their
  98. # address (if preserved) -- 8192 or 16384 -- and their length -- 8192
  99. # or, occasionally, 8184.
  100. #
  101. # Nevertheless this will manage to catch a lot of images that happen
  102. # to have a solid-colored line at the bottom of the screen.
  103. 8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
  104. 8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
  105. 8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
  106. 8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
  107. 8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
  108. # Beagle Bros. Apple Mechanic fonts
  109. 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
  110. # Apple Universal Disk Image Format (UDIF) - dmg files.
  111. # From Johan Gade.
  112. # These entries are disabled for now until we fix the following issues.
  113. #
  114. # Note there might be some problems with the "VAX COFF executable"
  115. # entry. Note this entry should be placed before the mac filesystem section,
  116. # particularly the "Apple Partition data" entry.
  117. #
  118. # The intended meaning of these tests is, that the file is only of the
  119. # specified type if both of the lines are correct - i.e. if the first
  120. # line matches and the second doesn't then it is not of that type.
  121. #
  122. #0 long 0x7801730d
  123. #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
  124. #
  125. # Note that this entry is recognized correctly by the "Apple Partition
  126. # data" entry - however since this entry is more specific - this
  127. # information seems to be more useful.
  128. #0 long 0x45520200
  129. #>0x410 string disk\ image UDIF read/write image (UDRW)
  130. # From: Toby Peterson <toby@apple.com>
  131. 0 string bplist00 Apple binary property list
  132. # Apple binary property list (bplist)
  133. # Assumes version bytes are hex.
  134. # Provides content hints for version 0 files. Assumes that the root
  135. # object is the first object (true for CoreFoundation implementation).
  136. # From: David Remahl <dremahl@apple.com>
  137. 0 string bplist
  138. >6 byte x \bCoreFoundation binary property list data, version 0x%c
  139. >>7 byte x \b%c
  140. >6 string 00 \b
  141. >>8 byte&0xF0 0x00 \b
  142. >>>8 byte&0x0F 0x00 \b, root type: null
  143. >>>8 byte&0x0F 0x08 \b, root type: false boolean
  144. >>>8 byte&0x0F 0x09 \b, root type: true boolean
  145. >>8 byte&0xF0 0x10 \b, root type: integer
  146. >>8 byte&0xF0 0x20 \b, root type: real
  147. >>8 byte&0xF0 0x30 \b, root type: date
  148. >>8 byte&0xF0 0x40 \b, root type: data
  149. >>8 byte&0xF0 0x50 \b, root type: ascii string
  150. >>8 byte&0xF0 0x60 \b, root type: unicode string
  151. >>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
  152. >>8 byte&0xF0 0xa0 \b, root type: array
  153. >>8 byte&0xF0 0xd0 \b, root type: dictionary
  154. # Apple/NeXT typedstream data
  155. # Serialization format used by NeXT and Apple for various
  156. # purposes in YellowStep/Cocoa, including some nib files.
  157. # From: David Remahl <dremahl@apple.com>
  158. 2 string typedstream NeXT/Apple typedstream data, big endian
  159. >0 byte x \b, version %hhd
  160. >0 byte <5 \b
  161. >>13 byte 0x81 \b
  162. >>>14 ubeshort x \b, system %hd
  163. 2 string streamtyped NeXT/Apple typedstream data, little endian
  164. >0 byte x \b, version %hhd
  165. >0 byte <5 \b
  166. >>13 byte 0x81 \b
  167. >>>14 uleshort x \b, system %hd
  168. #------------------------------------------------------------------------------
  169. # CAF: Apple CoreAudio File Format
  170. #
  171. # Container format for high-end audio purposes.
  172. # From: David Remahl <dremahl@apple.com>
  173. #
  174. 0 string caff CoreAudio Format audio file
  175. >4 beshort <10 version %d
  176. >6 beshort x
  177. #------------------------------------------------------------------------------
  178. # Keychain database files
  179. 0 string kych Mac OS X Keychain File
  180. #------------------------------------------------------------------------------
  181. # Code Signing related file types
  182. 0 belong 0xfade0c00 Mac OS X Code Requirement
  183. >8 belong 1 (opExpr)
  184. >4 belong x - %d bytes
  185. 0 belong 0xfade0c01 Mac OS X Code Requirement Set
  186. >8 belong >1 containing %d items
  187. >4 belong x - %d bytes
  188. 0 belong 0xfade0c02 Mac OS X Code Directory
  189. >8 belong x version %x
  190. >12 belong >0 flags 0x%x
  191. >4 belong x - %d bytes
  192. 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
  193. >4 belong x - %d bytes
  194. 0 belong 0xfade0cc1 Mac OS X Detached Code Signature
  195. >8 belong >1 (%d elements)
  196. >4 belong x - %d bytes
  197. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  198. # .vdi
  199. 4 string innotek\ VirtualBox\ Disk\ Image %s