macintosh 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470
  1. #------------------------------------------------------------------------------
  2. # $File: macintosh,v 1.28 2017/12/05 02:17:48 christos Exp $
  3. # macintosh description
  4. #
  5. # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
  6. # Daniel Quinlan, quinlan@yggdrasil.com
  7. 11 string must\ be\ converted\ with\ BinHex BinHex binary text
  8. !:mime application/mac-binhex40
  9. >41 string x \b, version %.3s
  10. # Stuffit archives are the de facto standard of compression for Macintosh
  11. # files obtained from most archives. (franklsm@tuns.ca)
  12. 0 string SIT! StuffIt Archive (data)
  13. !:mime application/x-stuffit
  14. !:apple SIT!SIT!
  15. >2 string x : %s
  16. 0 string SITD StuffIt Deluxe (data)
  17. >2 string x : %s
  18. 0 string Seg StuffIt Deluxe Segment (data)
  19. >2 string x : %s
  20. # Newer StuffIt archives (grant@netbsd.org)
  21. 0 string StuffIt StuffIt Archive
  22. !:mime application/x-stuffit
  23. !:apple SIT!SIT!
  24. #>162 string >0 : %s
  25. # Macintosh Applications and Installation binaries (franklsm@tuns.ca)
  26. # GRR: Too weak
  27. #0 string APPL Macintosh Application (data)
  28. #>2 string x \b: %s
  29. # Macintosh System files (franklsm@tuns.ca)
  30. # GRR: Too weak
  31. #0 string zsys Macintosh System File (data)
  32. #0 string FNDR Macintosh Finder (data)
  33. #0 string libr Macintosh Library (data)
  34. #>2 string x : %s
  35. #0 string shlb Macintosh Shared Library (data)
  36. #>2 string x : %s
  37. #0 string cdev Macintosh Control Panel (data)
  38. #>2 string x : %s
  39. #0 string INIT Macintosh Extension (data)
  40. #>2 string x : %s
  41. #0 string FFIL Macintosh Truetype Font (data)
  42. #>2 string x : %s
  43. #0 string LWFN Macintosh Postscript Font (data)
  44. #>2 string x : %s
  45. # Additional Macintosh Files (franklsm@tuns.ca)
  46. # GRR: Too weak
  47. #0 string PACT Macintosh Compact Pro Archive (data)
  48. #>2 string x : %s
  49. #0 string ttro Macintosh TeachText File (data)
  50. #>2 string x : %s
  51. #0 string TEXT Macintosh TeachText File (data)
  52. #>2 string x : %s
  53. #0 string PDF Macintosh PDF File (data)
  54. #>2 string x : %s
  55. # MacBinary format (Eric Fischer, enf@pobox.com)
  56. # Update: Joerg Jenderek
  57. # URL: https://en.wikipedia.org/wiki/MacBinary
  58. # Reference: http://files.stairways.com/other/macbinaryii-standard-info.txt
  59. #
  60. # Unfortunately MacBinary doesn't really have a magic number prior
  61. # to the MacBinary III format.
  62. #
  63. # old version number, must be kept at zero for compatibility
  64. 0 byte 0
  65. # length of filename (must be in the range 1-63)
  66. >1 ubyte >0
  67. # skip T.PIC.LZ INSTRUMENT.7T INVENTORY
  68. >>1 ubyte <64
  69. # skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)"
  70. # by looking for printable characters at beginning of file name
  71. >>>2 ubelong >0x1F000000
  72. # zero fill, must be zero for compatibility
  73. >>>>74 byte 0
  74. # zero fill, must be zero for compatibility
  75. >>>>>82 byte 0
  76. # MacBinary I test for valid version numbers
  77. >>>>>>122 ubeshort 0
  78. # additional check for creation date after 1 Jan 1970 ~ 7C25B080h
  79. #>>>>>>>91 ubelong >0x7c25b07F
  80. # additional check for undefined header fields in MacBinary I
  81. #>>>>>>>101 ulong 0
  82. >>>>>>>0 use mac-bin
  83. # MacBinary II the newer versions begins at 129
  84. >>>>>>122 ubeshort 0x8181
  85. >>>>>>>0 use mac-bin
  86. # MacBinary III with MacBinary II to read
  87. >>>>>122 ubeshort 0x8281
  88. >>>>>>0 use mac-bin
  89. # display information of MacBinary file
  90. 0 name mac-bin
  91. >122 ubyte x MacBinary
  92. # versions for MacBinary II/III
  93. >122 ubyte 129 II
  94. >122 ubyte 130 III
  95. # only in MacBinary III
  96. >>102 string !mBIN with surprising version
  97. !:mime application/x-macbinary
  98. !:apple PSPTBINA
  99. !:ext bin/macbin
  100. # THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary
  101. #>1 ubyte >63 \b, name length %u too BIG!
  102. #>122 ubeshort x \b, version 0x%x
  103. # Finder flags if not 0
  104. # >73 byte !0 \b, flags 0x
  105. # >73 byte =0
  106. # >>101 byte !0 \b, flags 0x
  107. # # original Finder flags (Bits 8-15)
  108. # >73 byte !0 \b%x
  109. # # finder flags, bits 0-7
  110. # >101 byte !0 \b%x
  111. >73 byte &0x01 \b, inited
  112. >73 byte &0x02 \b, changed
  113. >73 byte &0x04 \b, busy
  114. >73 byte &0x08 \b, bozo
  115. >73 byte &0x10 \b, system
  116. >73 byte &0x20 \b, bundle
  117. >73 byte &0x40 \b, invisible
  118. >73 byte &0x80 \b, locked
  119. # 75 beshort # vertical posn in window
  120. #>75 beshort !0 \b, v.pos %u
  121. # 77 beshort # horiz posn in window
  122. #>77 beshort !0 \b, h.pos %u
  123. # 79 beshort # window or folder ID
  124. >79 ubeshort !0 \b, ID 0x%x
  125. # protected flag
  126. >81 byte !0 \b, protected 0x%x
  127. # length of comment after resource
  128. >99 ubeshort !0 \b, comment length %u
  129. # char. code of file name
  130. >106 ubyte !0 \b, char. code 0x%x
  131. # still more Finder flags
  132. >107 ubyte !0 \b, more flags 0x%x
  133. # length of total files when unpacked only used when pack and unpack on the fly
  134. >116 ubelong !0 \b, total length %u
  135. # 120 beshort # length of add'l header
  136. >120 ubeshort !0 \b, 2nd header length %u
  137. # 124 beshort # checksum
  138. #>124 ubeshort !0 \b, CRC 0x%x
  139. # creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080
  140. >91 beldate-0x7C25B080 x \b, %s
  141. # THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow
  142. >91 ubelong <0x7c25b080 INVALID date
  143. #>91 belong-0x7C25B080 x \b, DEBUG DATE %d
  144. # last modified date
  145. >95 beldate-0x7C25B080 x \b, modified %s
  146. # Apple creator+typ if not null
  147. # file creator (normally expressed as four characters)
  148. >69 ulong !0 \b, creator
  149. # instead 4 character code display full creator name
  150. >>69 use apple-creator
  151. # file type (normally expressed as four characters)
  152. >65 ulong !0 \b, type
  153. >>65 use apple-type
  154. # length of data segment
  155. >83 ubelong !0 \b, %u bytes
  156. # filename (in the range 1-63)
  157. >1 pstring x "%s"
  158. # print 1 space and then at offset 128 inspect data fork content if it has one
  159. >83 ubelong !0 \b
  160. >>128 indirect x
  161. # Afterwards resource fork if length of resource segment not zero
  162. >87 ubelong !0
  163. # calculate resource fork offset
  164. >>83 ubelong+128 x \b, at 0x%x
  165. # length of resource segment
  166. >>87 ubelong !0 %u bytes
  167. >>(83.S+128) ubequad x resource
  168. # further resource fork content inspection
  169. >>>&-8 indirect x
  170. # Apple Type/Creator Database
  171. # URL: https://en.wikipedia.org/wiki/Type_code
  172. # Reference: http://www.lacikam.co.il/tcdb/
  173. # http://www.macdisk.com/macsigen.php
  174. # Note: classic Mac OS files have two 4 character codes for type and creator.
  175. # Thereby the Finder attach documents types to applications.
  176. #>65 string x \b, type "%4.4s"
  177. # display information about apple type
  178. 0 name apple-type
  179. >0 string 8BIM PhotoShop
  180. >0 string ALB3 PageMaker 3
  181. >0 string ALB4 PageMaker 4
  182. >0 string ALT3 PageMaker 3
  183. >0 string APPL application
  184. >0 string AWWP AppleWorks word processor
  185. >0 string CIRC simulated circuit
  186. >0 string DRWG MacDraw
  187. >0 string EPSF Encapsulated PostScript
  188. >0 string FFIL font suitcase
  189. >0 string FKEY function key
  190. >0 string FNDR Macintosh Finder
  191. >0 string GIFf GIF image
  192. >0 string Gzip GNU gzip
  193. >0 string INIT system extension
  194. >0 string LIB\ library
  195. >0 string LWFN PostScript font
  196. >0 string MSBC Microsoft BASIC
  197. >0 string PACT Compact Pro archive
  198. >0 string PDF\ Portable Document Format
  199. >0 string PICT picture
  200. >0 string PNTG MacPaint picture
  201. >0 string PREF preferences
  202. >0 string PROJ Think C project
  203. >0 string QPRJ Think Pascal project
  204. >0 string SCFL Defender scores
  205. >0 string SCRN startup screen
  206. >0 string SITD StuffIt Deluxe
  207. >0 string SPn3 SuperPaint
  208. >0 string STAK HyperCard stack
  209. >0 string Seg\ StuffIt segment
  210. >0 string TARF Unix tar archive
  211. >0 string TEXT ASCII
  212. >0 string TIFF TIFF image
  213. >0 string TOVF Eudora table of contents
  214. >0 string WDBN Microsoft Word word processor
  215. >0 string WORD MacWrite word processor
  216. >0 string XLS\ Microsoft Excel
  217. >0 string ZIVM compress (.Z)
  218. >0 string ZSYS Pre-System 7 system file
  219. >0 string acf3 Aldus FreeHand
  220. >0 string cdev control panel
  221. >0 string dfil Desk Accessory suitcase
  222. >0 string libr library
  223. >0 string nX^d WriteNow word processor
  224. >0 string nX^w WriteNow dictionary
  225. >0 string rsrc resource
  226. >0 string scbk Scrapbook
  227. >0 string shlb shared library
  228. >0 string ttro SimpleText read-only
  229. >0 string zsys system file
  230. # additional types added in Dec 2017
  231. >0 string BINA binary file
  232. >0 string BMPp BMP image
  233. >0 string JPEG JPEG image
  234. #>0 string W4BN Microsoft Word x.y word processor?
  235. # if type name is not known display 4 character identifier
  236. >0 default x
  237. >>0 string x '%4.4s'
  238. #>69 string x \b, creator "%4.4s"
  239. # Now Apple has no repository of registered Creator IDs any more. These are
  240. # just the ones that I happened to have files from and was able to identify.
  241. # display information about apple creator
  242. 0 name apple-creator
  243. >0 string 8BIM Adobe Photoshop
  244. >0 string ALD3 PageMaker 3
  245. >0 string ALD4 PageMaker 4
  246. >0 string ALFA Alpha editor
  247. >0 string APLS Apple Scanner
  248. >0 string APSC Apple Scanner
  249. >0 string BRKL Brickles
  250. >0 string BTFT BitFont
  251. >0 string CCL2 Common Lisp 2
  252. >0 string CCL\ Common Lisp
  253. >0 string CDmo The Talking Moose
  254. >0 string CPCT Compact Pro
  255. >0 string CSOm Eudora
  256. >0 string DMOV Font/DA Mover
  257. >0 string DSIM DigSim
  258. >0 string EDIT Macintosh Edit
  259. >0 string ERIK Macintosh Finder
  260. >0 string EXTR self-extracting archive
  261. >0 string Gzip GNU gzip
  262. >0 string KAHL Think C
  263. >0 string LWFU LaserWriter Utility
  264. >0 string LZIV compress
  265. >0 string MACA MacWrite
  266. >0 string MACS Macintosh operating system
  267. >0 string MAcK MacKnowledge terminal emulator
  268. >0 string MLND Defender
  269. >0 string MPNT MacPaint
  270. >0 string MSBB Microsoft BASIC (binary)
  271. >0 string MSWD Microsoft Word
  272. >0 string NCSA NCSA Telnet
  273. >0 string PJMM Think Pascal
  274. >0 string PSAL Hunt the Wumpus
  275. #>0 string PSI2 Apple File Exchange
  276. >0 string R*ch BBEdit
  277. >0 string RMKR Resource Maker
  278. >0 string RSED Resource Editor
  279. >0 string Rich BBEdit
  280. >0 string SIT! StuffIt
  281. >0 string SPNT SuperPaint
  282. >0 string Unix NeXT Mac filesystem
  283. >0 string VIM! Vim editor
  284. >0 string WILD HyperCard
  285. >0 string XCEL Microsoft Excel
  286. >0 string aCa2 Fontographer
  287. >0 string aca3 Aldus FreeHand
  288. >0 string dosa Macintosh MS-DOS file system
  289. >0 string movr Font/DA Mover
  290. >0 string nX^n WriteNow
  291. >0 string pdos Apple ProDOS file system
  292. >0 string scbk Scrapbook
  293. >0 string ttxt SimpleText
  294. >0 string ufox Foreign File Access
  295. # additional creators added in Dec 2017
  296. # Claris/Apple Works
  297. >0 string BOBO Apple Works
  298. # CU-SeeMe_0.87b3_(68K).bin
  299. #>0 string CUce bar
  300. >0 string PSPT Apple File Exchange
  301. # Disk_Copy_4.2.sea.bin
  302. #>0 string NCse foo
  303. # probably StuffIt/Aladdin by Smith Micro Software, Inc.
  304. >0 string STi0 stuffit
  305. # MacGzip-1.1.3.sea.bin
  306. #>0 string aust bar
  307. # D-Disk_Copy_6.3.3.smi.bin
  308. >0 string oneb Disk Copy Self Mounting
  309. # if creator name is not known display 4 character identifier
  310. >0 default x
  311. >>0 string x '%4.4s'
  312. # sas magic from Bruce Foster (bef@nwu.edu)
  313. #
  314. #0 string SAS SAS
  315. #>8 string x %s
  316. 0 string SAS SAS
  317. >24 string DATA data file
  318. >24 string CATALOG catalog
  319. >24 string INDEX data file index
  320. >24 string VIEW data view
  321. # sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
  322. #
  323. 0x54 string SAS SAS 7+
  324. >0x9C string DATA data file
  325. >0x9C string CATALOG catalog
  326. >0x9C string INDEX data file index
  327. >0x9C string VIEW data view
  328. # spss magic for SPSS system and portable files,
  329. # from Bruce Foster (bef@nwu.edu).
  330. 0 long 0xc1e2c3c9 SPSS Portable File
  331. >40 string x %s
  332. 0 string $FL2 SPSS System File
  333. >24 string x %s
  334. 0 string $FL3 SPSS System File
  335. >24 string x %s
  336. # Macintosh filesystem data
  337. # From "Tom N Harris" <telliamed@mac.com>
  338. # Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
  339. # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
  340. # entries depend on the data arithmetic added after v.35
  341. # There's also some Pascal strings in here, ditto...
  342. # The boot block signature, according to IM:Files, is
  343. # "for HFS volumes, this field always contains the value 0x4C4B."
  344. # But if this is true for MFS or HFS+ volumes, I don't know.
  345. # Alternatively, the boot block is supposed to be zeroed if it's
  346. # unused, so a simply >0 should suffice.
  347. 0x400 beshort 0xD2D7 Macintosh MFS data
  348. >0 beshort 0x4C4B (bootable)
  349. >0x40a beshort &0x8000 (locked)
  350. >0x402 beldate-0x7C25B080 x created: %s,
  351. >0x406 beldate-0x7C25B080 >0 last backup: %s,
  352. >0x414 belong x block size: %d,
  353. >0x412 beshort x number of blocks: %d,
  354. >0x424 pstring x volume name: %s
  355. # *.hfs updated by Joerg Jenderek
  356. # http://en.wikipedia.org/wiki/Hierarchical_File_System
  357. # "BD" gives many false positives
  358. 0x400 beshort 0x4244
  359. # ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
  360. # first block of volume bit map (always 3)
  361. >0x40e ubeshort 0x0003
  362. # maximal length of volume name is 27
  363. >>0x424 ubyte <28 Macintosh HFS data
  364. !:mime application/x-apple-diskimage
  365. #!:apple hfsdINIT
  366. #!:apple MACSdisk
  367. # http://www.macdisk.com/macsigen.php
  368. #!:apple ddskdevi
  369. !:apple ????devi
  370. # https://en.wikipedia.org/wiki/Apple_Disk_Image
  371. !:ext hfs/dmg
  372. >>>0 beshort 0x4C4B (bootable)
  373. #>>>0 beshort 0x0000 (not bootable)
  374. >>>0x40a beshort &0x8000 (locked)
  375. >>>0x40a beshort ^0x0100 (mounted)
  376. >>>0x40a beshort &0x0200 (spared blocks)
  377. >>>0x40a beshort &0x0800 (unclean)
  378. >>>0x47C beshort 0x482B (Embedded HFS+ Volume)
  379. # http://www.epochconverter.com/
  380. # 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970
  381. # 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00
  382. # construct not working
  383. #>>>0x402 beldate-0x7C25B080 x created: %s,
  384. #>>>0x406 beldate-0x7C25B080 x last modified: %s,
  385. #>>>0x440 beldate-0x7C25B080 >0 last backup: %s,
  386. # found block sizes 200h,1200h,2800h
  387. >>>0x414 belong x block size: %d,
  388. >>>0x412 beshort x number of blocks: %d,
  389. >>>0x424 pstring x volume name: %s
  390. 0x400 beshort 0x482B Macintosh HFS Extended
  391. >&0 beshort x version %d data
  392. >0 beshort 0x4C4B (bootable)
  393. >0x404 belong ^0x00000100 (mounted)
  394. >&2 belong &0x00000200 (spared blocks)
  395. >&2 belong &0x00000800 (unclean)
  396. >&2 belong &0x00008000 (locked)
  397. >&6 string x last mounted by: '%.4s',
  398. # really, that should be treated as a belong and we print a string
  399. # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
  400. >&14 beldate-0x7C25B080 x created: %s,
  401. # only the creation date is local time, all other timestamps in HFS+ are UTC.
  402. >&18 bedate-0x7C25B080 x last modified: %s,
  403. >&22 bedate-0x7C25B080 >0 last backup: %s,
  404. >&26 bedate-0x7C25B080 >0 last checked: %s,
  405. >&38 belong x block size: %d,
  406. >&42 belong x number of blocks: %d,
  407. >&46 belong x free blocks: %d
  408. ## AFAIK, only the signature is different
  409. # same as Apple Partition Map
  410. # GRR: This magic is too weak, it is just "TS"
  411. #0x200 beshort 0x5453 Apple Old Partition data
  412. #>0x2 beshort x block size: %d,
  413. #>0x230 string x first type: %s,
  414. #>0x210 string x name: %s,
  415. #>0x254 belong x number of blocks: %d,
  416. #>0x400 beshort 0x504D
  417. #>>0x430 string x second type: %s,
  418. #>>0x410 string x name: %s,
  419. #>>0x454 belong x number of blocks: %d,
  420. #>>0x800 beshort 0x504D
  421. #>>>0x830 string x third type: %s,
  422. #>>>0x810 string x name: %s,
  423. #>>>0x854 belong x number of blocks: %d,
  424. #>>>0xa00 beshort 0x504D
  425. #>>>>0xa30 string x fourth type: %s,
  426. #>>>>0xa10 string x name: %s,
  427. #>>>>0xa54 belong x number of blocks: %d
  428. # From: Remi Mommsen <mommsen@slac.stanford.edu>
  429. 0 string BOMStore Mac OS X bill of materials (BOM) file
  430. # From: Adam Buchbinder <adam.buchbinder@gmail.com>
  431. # URL: http://en.wikipedia.org/wiki/Datafork_TrueType
  432. # Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
  433. # TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
  434. # don't know what they mean.
  435. 0 belong 0x100
  436. >(0x4.L+24) beshort x
  437. >>&4 belong 0x73666e74 Mac OSX datafork font, TrueType
  438. >>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT'
  439. >>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT'
  440. >>&4 belong 0x504f5354 Mac OSX datafork font, PostScript