apple 30 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767
  1. #------------------------------------------------------------------------------
  2. # $File: apple,v 1.47 2022/12/09 15:48:14 christos Exp $
  3. # apple: file(1) magic for Apple file formats
  4. #
  5. 0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
  6. 0 string \x0aGL Binary II (apple ][) data
  7. 0 string \x76\xff Squeezed (apple ][) data
  8. 0 string NuFile NuFile archive (apple ][) data
  9. 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
  10. 0 belong 0x00051600 AppleSingle encoded Macintosh file
  11. 0 belong 0x00051607 AppleDouble encoded Macintosh file
  12. # Type: Apple Emulator A2R format
  13. # From: Greg Wildman <greg@apple2.org.za>
  14. # Ref: https://applesaucefdc.com/a2r2-reference/
  15. # Ref: https://applesaucefdc.com/a2r/
  16. 0 string A2R
  17. >3 string \x31\xFF\x0A\x0D\x0A Applesauce A2R 1.x Disk Image
  18. >3 string \x32\xFF\x0A\x0D\x0A Applesauce A2R 2.x Disk Image
  19. >3 string \x33\xFF\x0A\x0D\x0A Applesauce A2R 3.x Disk Image
  20. >8 string INFO
  21. >>49 byte 01 \b, 5.25″ SS 40trk
  22. >>49 byte 02 \b, 3.5″ DS 80trk
  23. >>49 byte 03 \b, 5.25″ DS 80trk
  24. >>49 byte 04 \b, 5.25″ DS 40trk
  25. >>49 byte 05 \b, 3.5″ DS 80trk
  26. >>49 byte 06 \b, 8″ DS
  27. >>50 byte 01 \b, write protected
  28. >>51 byte 01 \b, cross track synchronized
  29. >>17 string/T x \b, %.32s
  30. # Type: Apple Emulator WOZ format
  31. # From: Greg Wildman <greg@apple2.org.za>
  32. # Ref: https://applesaucefdc.com/woz/reference/
  33. # Ref: https://applesaucefdc.com/woz/reference2/
  34. 0 string WOZ
  35. >3 string \x31\xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image
  36. >3 string \x32\xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image
  37. >12 string INFO
  38. >>21 byte 01 \b, 5.25 inch
  39. >>21 byte 02 \b, 3.5 inch
  40. >>22 byte 01 \b, write protected
  41. >>23 byte 01 \b, cross track synchronized
  42. >>25 string/T x \b, %.32s
  43. # Type: Apple Macintosh Emulator MOOF format
  44. # From: Greg Wildman <greg@apple2.org.za>
  45. # Ref: https://applesaucefdc.com/moof-reference/
  46. 0 string MOOF
  47. >4 string \xFF\x0A\x0D\x0A Apple Macintosh MOOF Disk Image
  48. >12 string INFO
  49. >>21 byte 01 \b, SSDD GCR (400K)
  50. >>21 byte 02 \b, DSDD GCR (800K)
  51. >>21 byte 03 \b, DSHD MFM (1.44M)
  52. >>22 byte 01 \b, write protected
  53. >>23 byte 01 \b, cross track synchronized
  54. >>25 string/T x \b, %.32s
  55. # Type: Apple Emulator disk images
  56. # From: Greg Wildman <greg@apple2.org.za>
  57. # ProDOS boot loader?
  58. 0 string \x01\x38\xB0\x03\x4C Apple ProDOS Image
  59. # Detect Volume Directory block ($02)
  60. >0x400 string \x00\x00\x03\x00
  61. >>0x404 byte &0xF0
  62. >>>0x405 string x \b, Volume /%s
  63. >>>0x429 uleshort x \b, %u Blocks
  64. # ProDOS ordered ?
  65. >0xb00 string \x00\x00\x03\x00
  66. >>0xb04 byte &0xF0
  67. >>>0xb05 string x \b, Volume /%s
  68. >>>0xb29 uleshort x \b, %u Blocks
  69. #
  70. # Proboot HD
  71. 0 string \x01\x8A\x48\xD8\x2C\x82\xC0\x8D\x0E\xC0\x8D\x0C Apple ProDOS ProBoot Image
  72. >0x400 string \x00\x00\x03\x00
  73. >>0x404 byte &0xF0
  74. >>>0x405 string x \b, Volume /%s
  75. >>>0x429 uleshort x \b, %u Blocks
  76. >0xb00 string \x00\x00\x03\x00
  77. >>0xb04 byte &0xF0
  78. >>>0xb05 string x \b, Volume /%s
  79. >>>0xb29 uleshort x \b, %u Blocks
  80. 0 string \x01\xA8\x8A\x20\x7B\xF8\x29\x07\x09\xC0\x99\x30 Apple ProDOS ProBoot Image
  81. >0x400 string \x00\x00\x03\x00
  82. >>0x404 byte &0xF0
  83. >>>0x405 string x \b, Volume /%s
  84. >>>0x429 uleshort x \b, %u Blocks
  85. >0xb00 string \x00\x00\x03\x00
  86. >>0xb04 byte &0xF0
  87. >>>0xb05 string x \b, Volume /%s
  88. >>>0xb29 uleshort x \b, %u Blocks
  89. 0 string \x01\x4A\xD0\x34\xE6\x3D\x8A\x20\x7B\xF8\x09\xC0 Apple ProDOS ProBoot Image
  90. >0x400 string \x00\x00\x03\x00
  91. >>0x404 byte &0xF0
  92. >>>0x405 string x \b, Volume /%s
  93. >>>0x429 uleshort x \b, %u Blocks
  94. >0xb00 string \x00\x00\x03\x00
  95. >>0xb04 byte &0xF0
  96. >>>0xb05 string x \b, Volume /%s
  97. >>>0xb29 uleshort x \b, %u Blocks
  98. #
  99. # ProDOS formatted
  100. 0 string \x01\xBD\x88\xC0\x20\x2F\xFB\x20\x58\xFC\x20\x40 Apple ProDOS Unbootable Image
  101. >0x400 string \x00\x00\x03\x00
  102. >>0x404 byte &0xF0
  103. >>>0x405 string x \b, Volume /%s
  104. >>>0x429 uleshort x \b, %u Blocks
  105. >0xb00 string \x00\x00\x03\x00
  106. >>0xb04 byte &0xF0
  107. >>>0xb05 string x \b, Volume /%s
  108. >>>0xb29 uleshort x \b, %u Blocks
  109. 0 string \x01\x38\xB0\x03\x4C\x1C\x09\x78\x86\x43\xC9\x03 Apple ProDOS Unbootable Image
  110. >0x400 string \x00\x00\x03\x00
  111. >>0x404 byte &0xF0
  112. >>>0x405 string x \b, Volume /%s
  113. >>>0x429 uleshort x \b, %u Blocks
  114. >0xb00 string \x00\x00\x03\x00
  115. >>0xb04 byte &0xF0
  116. >>>0xb05 string x \b, Volume /%s
  117. >>>0xb29 uleshort x \b, %u Blocks
  118. #
  119. # DOS3 boot loader
  120. 0 string \x01\xA5\x27\xC9\x09\xD0
  121. >0x11001 byte 0x11
  122. >>0x11003 ubyte x Apple DOS 3.%u Image
  123. >>0x11006 ubyte x \b, Volume #%03u
  124. >>0x11034 ubyte x \b, %u Tracks
  125. >>0x11035 ubyte x \b, %u Sectors
  126. >>0x11036 uleshort x \b, %u bytes per sector
  127. #
  128. # DOS3 uninitialized disk
  129. 0 string \x01\xA6\x2B\xBD\x88\xC0\x8A\x4A\x4A
  130. >0x11001 byte 0x11
  131. >>0x11003 ubyte x Apple DOS 3.%u Unbootable Image
  132. >>>0x11006 ubyte x \b, Volume #%03u
  133. >>>0x11034 ubyte x \b, %u Tracks
  134. >>>0x11035 ubyte x \b, %u Sectors
  135. >>>0x11036 uleshort x \b, %u bytes per sector
  136. #
  137. # Pascal boot loader?
  138. 0 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD
  139. >0xd6 pstring SYSTEM.APPLE
  140. >>0xb00 leshort 0x0000
  141. >>>0xb04 leshort 0x0000 Apple Pascal Image
  142. >>>>0xb06 pstring x \b, Volume %s:
  143. >>>>0xb0e leshort x \b, %u Blocks
  144. >>>>0xb10 leshort x \b, %u Files
  145. #
  146. # Diversi Dos boot loader?
  147. 0 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD
  148. >0x11001 string \x11\x0F\x03 Apple Diversi Dos Image
  149. >>0x11006 byte x \b, Volume %u
  150. >>0x11034 byte x \b, %u Tracks
  151. >>0x11035 byte x \b, %u Sectors
  152. >>0x11036 leshort x \b, %u bytes per sector
  153. # Type: Apple Emulator 2IMG format
  154. # From: Radek Vokal <rvokal@redhat.com>
  155. # Update: Greg Wildman <greg@apple2.org.za>
  156. 0 string 2IMG Apple ][ 2IMG Disk Image
  157. >4 clear x
  158. >4 string XGS! \b, XGS
  159. >4 string CTKG \b, Catakig
  160. >4 string ShIm \b, Sheppy's ImageMaker
  161. >4 string SHEP \b, Sheppy's ImageMaker
  162. >4 string WOOF \b, Sweet 16
  163. >4 string B2TR \b, Bernie ][ the Rescue
  164. >4 string \!nfc \b, ASIMOV2
  165. >4 string \>BD\< \b, Brutal Deluxe's Cadius
  166. >4 string CdrP \b, CiderPress
  167. >4 string Vi][ \b, Virtual ][
  168. >4 string PRFS \b, ProFUSE
  169. >4 string FISH \b, FishWings
  170. >4 string RVLW \b, Revival for Windows
  171. >4 default x
  172. >>4 string x \b, Creator tag "%-4.4s"
  173. >0xc byte 00 \b, DOS 3.3 sector order
  174. >>0x10 byte 00 \b, Volume 254
  175. >>0x10 byte&0x7f x \b, Volume %u
  176. >0xc byte 01 \b, ProDOS sector order
  177. # Detect Volume Directory block ($02) + 2mg header offset
  178. >>0x440 string \x00\x00\x03\x00
  179. >>>0x444 byte &0xF0
  180. >>>>0x445 string x \b, Volume /%s
  181. >>>>0x469 uleshort x \b, %u Blocks
  182. >0xc byte 02 \b, NIB data
  183. # Type: Peter Ferrie QBoot
  184. # From: Greg Wildman <greg@apple2.org.za>
  185. # Ref: https://github.com/peterferrie/qboot
  186. 0 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9
  187. >8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ QBoot Image
  188. # Type: Peter Ferrie 0Boot
  189. # From: Greg Wildman <greg@apple2.org.za>
  190. # Ref: https://github.com/peterferrie/0boot
  191. 0 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9
  192. >8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ 0Boot Image
  193. # Different proprietary boot sectors
  194. 0 string \x01\x0F\x21\x74\x00\x01\x6B\x00\x02\x30\x81\x5D Apple ][ Disk Image
  195. 0 string \x01\x20\x58\xFC\xA2\x00\x8E\x78\x04\x8E\xF4\x03 Apple ][ Disk Image
  196. 0 string \x01\x20\x58\xFC\xAD\x51\xC0\xAD\x54\xC0\xA6\x2B Apple ][ Disk Image
  197. 0 string \x01\x20\x89\xFE\x20\x93\xFE\xA6\x2B\xBD\x88\xC0 Apple ][ Disk Image
  198. 0 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x25\x08\x68\x85 Apple ][ Disk Image
  199. 0 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x2D\x08\x68\x85 Apple ][ Disk Image
  200. 0 string \x01\x38\x90\x2A\xC9\x01\xF0\x33\xA8\xC8\xC0\x10 Apple ][ Disk Image
  201. 0 string \x01\x38\xB0\x03\x4C\x32\xA1\x87\x43\xC9\x03\x08 Apple ][ Disk Image
  202. 0 string \x01\x4C\x04\x08\xA9\x2A\x8D\x02\x08\x86\x2B\xEE Apple ][ Disk Image
  203. 0 string \x01\x4C\x60\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image
  204. 0 string \x01\x4C\x92\x08\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image
  205. 0 string \x01\x4C\xB3\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image
  206. 0 string \x01\x8D\xFB\x03\x8E\xFC\x03\x8C\xFD\x03\x8A\x29 Apple ][ Disk Image
  207. 0 string \x01\xA2\xFF\x9A\xD8\x20\x20\x08\x20\x34\x08\xAD Apple ][ Disk Image
  208. 0 string \x01\xA5\x27\xBD\x88\xC0\x2C\x10\xC0\xA2\x00\xA9 Apple ][ Disk Image
  209. 0 string \x01\xA5\x2B\xAE\x51\xC0\xEA\xAA\xBD\x88\xC0\x20 Apple ][ Disk Image
  210. 0 string \x01\xA6\x27\xBD\x0B\x08\x48\xBD\x0A\x08\x48\x85 Apple ][ Disk Image
  211. 0 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x01\x85 Apple ][ Disk Image
  212. 0 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x25\x85 Apple ][ Disk Image
  213. 0 string \x01\xA8\xC0\x0F\x90\x16\xF0\x12\xA0\xFF\x18\xAD Apple ][ Disk Image
  214. 0 string \x01\xA9\x00\x85\xF0\xA9\x04\x85\xF1\xA0\x00\xA9 Apple ][ Disk Image
  215. 0 string \x01\xA9\x5C\x8D\xF2\x03\xA9\xC6\x8D\xF3\x03\x49 Apple ][ Disk Image
  216. 0 string \x01\xA9\x60\x8D\x01\x08\x20\x2F\xFB\x20\x58\xFC Apple ][ Disk Image
  217. 0 string \x01\xA9\x60\x8D\x01\x08\x20\x49\x08\xA9\x0A\x85 Apple ][ Disk Image
  218. 0 string \x01\xA9\x60\x8D\x01\x08\x2C\x82\xC0\xBD\x88\xC0 Apple ][ Disk Image
  219. 0 string \x01\xA9\x60\x8D\x01\x08\x86\x43\x8A\x4A\x4A\x4A Apple ][ Disk Image
  220. 0 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\x86\xFF\xB5\x00 Apple ][ Disk Image
  221. 0 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image
  222. 0 string \x01\xA9\x60\x8D\x01\x08\xA9\xB2\x8D\xF2\x03\xA9 Apple ][ Disk Image
  223. 0 string \x01\xA9\x60\x8D\x01\x08\xA9\xFF\x8D\xF3\x03\x8D Apple ][ Disk Image
  224. 0 string \x01\xAC\x00\x08\xF0\x19\xB9\x30\x08\x85\x3D\xCE Apple ][ Disk Image
  225. 0 string \x01\xAC\x23\x08\x30\x2E\xB9\x24\x08\x85\x3D\xCE Apple ][ Disk Image
  226. 0 string \x01\xAD\x00\x08\xC9\x09\xB0\x20\x69\x02\x8D\x00 Apple ][ Disk Image
  227. 0 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\x86\x2B\x8A\x4A Apple ][ Disk Image
  228. 0 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\xA9\xF5\x8D\xF2 Apple ][ Disk Image
  229. 0 string \x01\xB0\x00\xA9\x3F\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image
  230. 0 string \x01\xB0\x00\xA9\x48\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image
  231. 0 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x09\xC0\x8D Apple ][ Disk Image
  232. 0 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x8D\x2F\x08 Apple ][ Disk Image
  233. 0 string \x01\xD8\x2C\x81\xC0\xA9\x60\x4D\x58\xFF\xD0\xFE Apple ][ Disk Image
  234. 0 string \x01\xD8\x78\xBD\x88\xC0\xA9\xFD\x85\x37\x85\x39 Apple ][ Disk Image
  235. 0 string \x01\xE0\x60\xF0\x03\x4C\x16\x09\xAD\x00\x08\xC9 Apple ][ Disk Image
  236. 0 string \x01\xE0\x60\xF0\x03\x4C\xCB\x08\xAD\x00\x08\xC9 Apple ][ Disk Image
  237. 0 string \x01\xE0\x60\xF0\x03\x4C\xEE\x08\xAD\x00\x08\xC9 Apple ][ Disk Image
  238. 0 string \x01\xE0\x60\xF0\x03\x4C\xEF\x08\xAD\x00\x08\xC9 Apple ][ Disk Image
  239. 0 string \x01\xE0\x70\xB0\x04\xE0\x40\xB0\x39\xBD\x88\xC0 Apple ][ Disk Image
  240. 0 string \x01\xEA\x8D\xF4\x03\xA9\x60\x9D\x88\xC0\x8D\x51 Apple ][ Disk Image
  241. # magic for Newton PDA package formats
  242. # from Ruda Moura <ruda@helllabs.org>
  243. 0 string package0 Newton package, NOS 1.x,
  244. >12 belong &0x80000000 AutoRemove,
  245. >12 belong &0x40000000 CopyProtect,
  246. >12 belong &0x10000000 NoCompression,
  247. >12 belong &0x04000000 Relocation,
  248. >12 belong &0x02000000 UseFasterCompression,
  249. >16 belong x version %d
  250. 0 string package1 Newton package, NOS 2.x,
  251. >12 belong &0x80000000 AutoRemove,
  252. >12 belong &0x40000000 CopyProtect,
  253. >12 belong &0x10000000 NoCompression,
  254. >12 belong &0x04000000 Relocation,
  255. >12 belong &0x02000000 UseFasterCompression,
  256. >16 belong x version %d
  257. 0 string package4 Newton package,
  258. >8 byte 8 NOS 1.x,
  259. >8 byte 9 NOS 2.x,
  260. >12 belong &0x80000000 AutoRemove,
  261. >12 belong &0x40000000 CopyProtect,
  262. >12 belong &0x10000000 NoCompression,
  263. # The following entries for the Apple II are for files that have
  264. # been transferred as raw binary data from an Apple, without having
  265. # been encapsulated by any of the above archivers.
  266. #
  267. # In general, Apple II formats are hard to identify because Apple DOS
  268. # and especially Apple ProDOS have strong typing in the file system and
  269. # therefore programmers never felt much need to include type information
  270. # in the files themselves.
  271. #
  272. # Eric Fischer <enf@pobox.com>
  273. # AppleWorks word processor:
  274. # URL: https://en.wikipedia.org/wiki/AppleWorks
  275. # Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
  276. # Update: Joerg Jenderek
  277. # NOTE:
  278. # The "O" is really the magic number, but that's so common that it's
  279. # necessary to check the tab stops that follow it to avoid false positives.
  280. # and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
  281. # the newer AppleWorks is from claris with extension CWK
  282. 4 string O
  283. # test for unused bits of zoom- , paginated-boolean bytes
  284. >84 ubequad ^0x00Fe00000000Fe00
  285. # look for tabstop definitions "=" no tab, "|" no tab
  286. # "<" left tab,"^" center tab,">" right tab, "." decimal tab,
  287. # unofficial "!" other , "\x8a" other
  288. # official only if SFMinVers is nonzero
  289. >>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor
  290. # AppleWorks Word Processor File (Apple II)
  291. # ./apple (version 5.25) labeled the entry as "AppleWorks word processor data"
  292. # application/x-appleworks is mime type for claris version with cwk extension
  293. !:mime application/x-appleworks3
  294. # http://home.earthlink.net/~hughhood/appleiiworksenvoy/
  295. # ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
  296. # $70 $1A $F8 $FF is this the apple type ?
  297. #:apple pdosp^Z\xf8\xff
  298. !:ext awp
  299. # minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
  300. >>>183 ubyte 30 3.0
  301. >>>183 ubyte !30
  302. >>>>183 ubyte !0 %#x
  303. # usual tabstop start sequence "=====<"
  304. >>>5 string x \b, tabstop ruler "%6.6s"
  305. # tabstop ruler
  306. #>>>5 string >\0 \b, tabstops "%-79s"
  307. # zoom switch
  308. >>>85 byte&0x01 >0 \b, zoomed
  309. # whether paginated
  310. >>>90 byte&0x01 >0 \b, paginated
  311. # contains any mail-merge commands
  312. >>>92 byte&0x01 >0 \b, with mail merge
  313. # left margin in 1/10 inches ( normally 0 or 10 )
  314. >>>91 ubyte >0
  315. >>>>91 ubyte x \b, %d/10 inch left margin
  316. # AppleWorks database:
  317. #
  318. # This isn't really a magic number, but it's the closest thing to one
  319. # that I could find. The 1 and 2 really mean "order in which you defined
  320. # categories" and "left to right, top to bottom," respectively; the D and R
  321. # mean that the cursor should move either down or right when you press Return.
  322. #30 string \x01D AppleWorks database data
  323. #30 string \x02D AppleWorks database data
  324. #30 string \x01R AppleWorks database data
  325. #30 string \x02R AppleWorks database data
  326. # AppleWorks spreadsheet:
  327. #
  328. # Likewise, this isn't really meant as a magic number. The R or C means
  329. # row- or column-order recalculation; the A or M means automatic or manual
  330. # recalculation.
  331. #131 string RA AppleWorks spreadsheet data
  332. #131 string RM AppleWorks spreadsheet data
  333. #131 string CA AppleWorks spreadsheet data
  334. #131 string CM AppleWorks spreadsheet data
  335. # Applesoft BASIC:
  336. #
  337. # This is incredibly sloppy, but will be true if the program was
  338. # written at its usual memory location of 2048 and its first line
  339. # number is less than 256. Yuck.
  340. # update by Joerg Jenderek at Feb 2013
  341. # GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
  342. #0 belong&0xff00ff 0x80000 Applesoft BASIC program data
  343. 0 belong&0x00ff00ff 0x00080000
  344. # assuming that line number must be positive
  345. >2 leshort >0 Applesoft BASIC program data, first line number %d
  346. #>2 leshort x \b, first line number %d
  347. # ORCA/EZ assembler:
  348. #
  349. # This will not identify ORCA/M source files, since those have
  350. # some sort of date code instead of the two zero bytes at 6 and 7
  351. # XXX Conflicts with ELF
  352. #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
  353. #>5 byte x \b, build number %d
  354. # Broderbund Fantavision
  355. #
  356. # I don't know what these values really mean, but they seem to recur.
  357. # Will they cause too many conflicts?
  358. # Probably :-)
  359. #2 belong&0xFF00FF 0x040008 Fantavision movie data
  360. # Some attempts at images.
  361. #
  362. # These are actually just bit-for-bit dumps of the frame buffer, so
  363. # there's really no reasonably way to distinguish them except for their
  364. # address (if preserved) -- 8192 or 16384 -- and their length -- 8192
  365. # or, occasionally, 8184.
  366. #
  367. # Nevertheless this will manage to catch a lot of images that happen
  368. # to have a solid-colored line at the bottom of the screen.
  369. # GRR: Magic too weak
  370. #8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
  371. #8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
  372. #8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
  373. #8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
  374. #8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
  375. # Beagle Bros. Apple Mechanic fonts
  376. 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
  377. # Apple Universal Disk Image Format (UDIF) - dmg files.
  378. # From Johan Gade.
  379. # These entries are disabled for now until we fix the following issues.
  380. #
  381. # Note there might be some problems with the "VAX COFF executable"
  382. # entry. Note this entry should be placed before the mac filesystem section,
  383. # particularly the "Apple Partition data" entry.
  384. #
  385. # The intended meaning of these tests is, that the file is only of the
  386. # specified type if both of the lines are correct - i.e. if the first
  387. # line matches and the second doesn't then it is not of that type.
  388. #
  389. #0 long 0x7801730d
  390. #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
  391. #
  392. # Note that this entry is recognized correctly by the "Apple Partition
  393. # data" entry - however since this entry is more specific - this
  394. # information seems to be more useful.
  395. #0 long 0x45520200
  396. #>0x410 string disk\ image UDIF read/write image (UDRW)
  397. # From: Toby Peterson <toby@apple.com>
  398. 0 string bplist00 Apple binary property list
  399. # Apple binary property list (bplist)
  400. # Assumes version bytes are hex.
  401. # Provides content hints for version 0 files. Assumes that the root
  402. # object is the first object (true for CoreFoundation implementation).
  403. # From: David Remahl <dremahl@apple.com>
  404. 0 string bplist
  405. >6 byte x \bCoreFoundation binary property list data, version %#c
  406. >>7 byte x \b%c
  407. >6 string 00 \b
  408. >>8 byte&0xF0 0x00 \b
  409. >>>8 byte&0x0F 0x00 \b, root type: null
  410. >>>8 byte&0x0F 0x08 \b, root type: false boolean
  411. >>>8 byte&0x0F 0x09 \b, root type: true boolean
  412. >>8 byte&0xF0 0x10 \b, root type: integer
  413. >>8 byte&0xF0 0x20 \b, root type: real
  414. >>8 byte&0xF0 0x30 \b, root type: date
  415. >>8 byte&0xF0 0x40 \b, root type: data
  416. >>8 byte&0xF0 0x50 \b, root type: ascii string
  417. >>8 byte&0xF0 0x60 \b, root type: unicode string
  418. >>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
  419. >>8 byte&0xF0 0xa0 \b, root type: array
  420. >>8 byte&0xF0 0xd0 \b, root type: dictionary
  421. # Apple/NeXT typedstream data
  422. # Serialization format used by NeXT and Apple for various
  423. # purposes in YellowStep/Cocoa, including some nib files.
  424. # From: David Remahl <dremahl@apple.com>
  425. 2 string typedstream NeXT/Apple typedstream data, big endian
  426. >0 byte x \b, version %d
  427. >0 byte <5 \b
  428. >>13 byte 0x81 \b
  429. >>>14 ubeshort x \b, system %d
  430. 2 string streamtyped NeXT/Apple typedstream data, little endian
  431. >0 byte x \b, version %d
  432. >0 byte <5 \b
  433. >>13 byte 0x81 \b
  434. >>>14 uleshort x \b, system %d
  435. #------------------------------------------------------------------------------
  436. # CAF: Apple CoreAudio File Format
  437. #
  438. # Container format for high-end audio purposes.
  439. # From: David Remahl <dremahl@apple.com>
  440. #
  441. 0 string caff CoreAudio Format audio file
  442. >4 beshort <10 version %d
  443. >6 beshort x
  444. #------------------------------------------------------------------------------
  445. # Keychain database files
  446. 0 string kych Mac OS X Keychain File
  447. #------------------------------------------------------------------------------
  448. # Code Signing related file types
  449. 0 belong 0xfade0c00 Mac OS X Code Requirement
  450. >8 belong 1 (opExpr)
  451. >4 belong x - %d bytes
  452. 0 belong 0xfade0c01 Mac OS X Code Requirement Set
  453. >8 belong >1 containing %d items
  454. >4 belong x - %d bytes
  455. 0 belong 0xfade0c02 Mac OS X Code Directory
  456. >8 belong x version %x
  457. >12 belong >0 flags %#x
  458. >4 belong x - %d bytes
  459. 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
  460. >4 belong x - %d bytes
  461. 0 belong 0xfade0cc1 Mac OS X Detached Code Signature
  462. >8 belong >1 (%d elements)
  463. >4 belong x - %d bytes
  464. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  465. # .vdi
  466. 4 string innotek\ VirtualBox\ Disk\ Image %s
  467. # Apple disk partition stuff
  468. # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
  469. # Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
  470. # Update: Joerg Jenderek
  471. # "ER" is APPLE_DRVR_MAP_MAGIC signature
  472. 0 beshort 0x4552
  473. # display Apple Driver Map (strength=50) after Syslinux bootloader (71)
  474. #!:strength +0
  475. # strengthen the magic by looking for used blocksizes 512 2048
  476. >2 ubeshort&0xf1FF 0 Apple Driver Map
  477. # last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
  478. #>>504 ubequad&0x0000FFffFFff0000 0
  479. !:mime application/x-apple-diskimage
  480. !:apple ????devr
  481. # https://en.wikipedia.org/wiki/Apple_Disk_Image
  482. !:ext dmg/iso
  483. # sbBlkSize for driver descriptor map 512 2048
  484. >>2 beshort x \b, blocksize %d
  485. # sbBlkCount sometimes garbish like
  486. # 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
  487. # 0xf2720100 for bunziped Firefox 48.0-2.dmg
  488. # 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
  489. # 0x00009090 by syslinux-6.03/utils/isohybrid.c
  490. >>4 ubelong x \b, blockcount %u
  491. # following device/driver information not very useful
  492. # device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
  493. >>8 ubeshort x \b, devtype %u
  494. # device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
  495. >>10 ubeshort x \b, devid %u
  496. # driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
  497. >>12 ubelong >0
  498. >>>12 ubelong x \b, driver data %u
  499. # number of driver descriptors sbDrvrCount <= 61
  500. # (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
  501. >>16 ubeshort x \b, driver count %u
  502. # 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
  503. # >>18 use apple-driver-map
  504. # >>26 use apple-driver-map
  505. # # ...
  506. # >>500 use apple-driver-map
  507. # number of partitions is always same in every partition (map block count)
  508. #>>0x0204 ubelong x \b, %u partitions
  509. >>0x0204 ubelong >0 \b, contains[@0x200]:
  510. >>>0x0200 use apple-apm
  511. >>0x0204 ubelong >1 \b, contains[@0x400]:
  512. >>>0x0400 use apple-apm
  513. >>0x0204 ubelong >2 \b, contains[@0x600]:
  514. >>>0x0600 use apple-apm
  515. >>0x0204 ubelong >3 \b, contains[@0x800]:
  516. >>>0x0800 use apple-apm
  517. >>0x0204 ubelong >4 \b, contains[@0xA00]:
  518. >>>0x0A00 use apple-apm
  519. >>0x0204 ubelong >5 \b, contains[@0xC00]:
  520. >>>0x0C00 use apple-apm
  521. >>0x0204 ubelong >6 \b, contains[@0xE00]:
  522. >>>0x0E00 use apple-apm
  523. >>0x0204 ubelong >7 \b, contains[@0x1000]:
  524. >>>0x1000 use apple-apm
  525. # display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
  526. 0 name apple-driver-map
  527. >0 ubequad !0
  528. # descBlock first block of driver
  529. >>0 ubelong x \b, driver start block %u
  530. # descSize driver size in blocks
  531. >>4 ubeshort x \b, size %u
  532. # descType driver system type 1 701h F8FFh FFFFh
  533. >>6 ubeshort x \b, type %#x
  534. # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
  535. # Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
  536. # Update: Joerg Jenderek
  537. # Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
  538. # magic stronger.
  539. # for apple partition map stored as a single file
  540. 0 belong 0x504d0000
  541. # to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
  542. #!:strength +0
  543. >0 use apple-apm
  544. # magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
  545. # file: could not find any valid magic files!
  546. #!:ext bin
  547. # display apple partition map. Normally called after Apple driver map
  548. 0 name apple-apm
  549. >0 belong 0x504d0000 Apple Partition Map
  550. # number of partitions
  551. >>4 ubelong x \b, map block count %u
  552. # logical block (512 bytes) start of partition
  553. >>8 ubelong x \b, start block %u
  554. >>12 ubelong x \b, block count %u
  555. >>16 string >0 \b, name %s
  556. >>48 string >0 \b, type %s
  557. # processor type dpme_process_id[16] e.g. "68000" "68020"
  558. >>120 string >0 \b, processor %s
  559. # A/UX boot arguments BootArgs[128]
  560. >>136 string >0 \b, boot arguments %s
  561. # status of partition dpme_flags
  562. >>88 belong & 1 \b, valid
  563. >>88 belong & 2 \b, allocated
  564. >>88 belong & 4 \b, in use
  565. >>88 belong & 8 \b, has boot info
  566. >>88 belong & 16 \b, readable
  567. >>88 belong & 32 \b, writable
  568. >>88 belong & 64 \b, pic boot code
  569. >>88 belong & 128 \b, chain compatible driver
  570. >>88 belong & 256 \b, real driver
  571. >>88 belong & 512 \b, chain driver
  572. # mount automatically at startup APPLE_PS_AUTO_MOUNT
  573. >>88 ubelong &0x40000000 \b, mount at startup
  574. # is the startup partition APPLE_PS_STARTUP
  575. >>88 ubelong &0x80000000 \b, is the startup partition
  576. #https://wiki.mozilla.org/DS_Store_File_Format
  577. #https://en.wikipedia.org/wiki/.DS_Store
  578. 0 string \0\0\0\1Bud1\0 Apple Desktop Services Store
  579. # HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
  580. # Usually not in separate files, but have either filename rsrc with
  581. # no extension, or a filename corresponding to another file, with
  582. # extensions rsr/rsrc
  583. # URL: http://fileformats.archiveteam.org/wiki/Macintosh_resource_file
  584. # https://en.wikipedia.org/wiki/Resource_fork
  585. # Reference: https://github.com/kreativekorp/ksfl/wiki/Macintosh-Resource-File-Format
  586. # http://developer.apple.com/legacy/mac/library/documentation/mac/pdf/MoreMacintoshToolbox.pdf
  587. # https://formats.kaitai.io/resource_fork/
  588. # Update: Joerg Jenderek
  589. # Note: verified often by command like `deark -m macrsrc Icon_.rsrc`
  590. # offset of resource data; usually starts at offset 0x0100
  591. 0 string \000\000\001\000
  592. # skip NPETraceSession.etl with invalid "low" map offset 0
  593. >4 ubelong >0xFF
  594. # skip few Atari DEGAS Elite bitmap (eil2.pi1 nastro.pi1) with ivalid "high" 0x6550766 0x7510763 map length
  595. >>12 ubelong <0x8001
  596. # most examples with zeroed system reserved field
  597. >>>16 lelong =0
  598. >>>>0 use apple-rsr
  599. # few samples with not zeroed system reserved field like: Empty.rsrc.rsr OpenSans-CondBold.dfont
  600. >>>16 lelong !0
  601. # resource fork variant with not zeroed system reserved field and copy of header
  602. >>>>(4.L) ubelong 0x100
  603. # GRR: the line above only works if in ../../src/file.h FILE_BYTES_MAX is raised from 1 MiB above 0x6ab0f4 (HelveticaNeue.dfont)
  604. >>>>>0 use apple-rsr
  605. # data fork variant with not zeroed system reserved field and no copy of header
  606. >>>>(4.L) ubelong 0
  607. >>>>>0 use apple-rsr
  608. # Note: moved and merged from ./macintosh
  609. # From: Adam Buchbinder <adam.buchbinder@gmail.com>
  610. # URL: https://en.wikipedia.org/wiki/Datafork_TrueType
  611. # Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
  612. # TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
  613. # don't know what they mean.
  614. # display information about Mac OSX datafork font DFONT
  615. 0 name apple-dfont
  616. >(4.L+30) ubelong x Mac OSX datafork font,
  617. # https://en.wikipedia.org/wiki/Datafork_TrueType
  618. !:mime application/x-dfont
  619. !:ext dfont
  620. # https://exiftool.org/TagNames/RSRC.html
  621. >(4.L+30) ubelong 0x73666e74 TrueType
  622. >(4.L+30) ubelong 0x464f4e54 'FONT'
  623. >(4.L+30) ubelong 0x4e464e54 'NFNT'
  624. >(4.L+30) ubelong 0x504f5354 PostScript
  625. >(4.L+30) ubelong 0x464f4e44 'FOND'
  626. >(4.L+30) ubelong 0x76657273 'vers'
  627. # display information about Macintosh resource
  628. 0 name apple-rsr
  629. >(4.L+30) ubelong 0x73666e74
  630. >>0 use apple-dfont
  631. >(4.L+30) ubelong 0x464f4e54
  632. >>0 use apple-dfont
  633. >(4.L+30) ubelong 0x4e464e54
  634. >>0 use apple-dfont
  635. >(4.L+30) ubelong 0x504f5354
  636. >>0 use apple-dfont
  637. >(4.L+30) ubelong 0x464f4e44
  638. >>0 use apple-dfont
  639. >(4.L+30) ubelong 0x76657273
  640. >>0 use apple-dfont
  641. >(4.L+30) default x Apple HFS/HFS+ resource fork
  642. #!:mime application/octet-stream
  643. !:mime application/x-apple-rsr
  644. !:ext rsrc/rsr
  645. # offset to resource data; usually starts at offset 0x0100
  646. >0 ubelong !0x100 \b, data offset %#x
  647. # offset to resource map; positive but not nil like in NPETraceSession.etl
  648. >4 ubelong x \b, map offset %#x
  649. # length of resource map; positive with 32K limitation but not
  650. # nil like in NPETraceSession.etl or high like 0x7510763 in nastro.pi1
  651. >12 ubelong x \b, map length %#x
  652. # length of resource data; positive but not nil like in NPETraceSession.etl
  653. >8 ubelong x \b, data length %#x
  654. # reserved 112 bytes for system use; apparently often nil, but 8fd20000h in Empty.rsrc.rsr and 0x00768c2b in OpenSans-CondBold.dfont
  655. >16 ubelong !0 \b, at 16 %#8.8x
  656. # https://fontforge.org/docs/techref/macformats.html
  657. # jump to resource map
  658. # a copy of resource header or 16 bytes of zeros for data fork
  659. #>(4.L) ubelong x \b, DATA offset %#x
  660. #>(4.L+4) ubelong x \b, MAP offset %#x
  661. #>(4.L+8) ubelong x \b, DATA length %#x
  662. #>(4.L+12) ubelong x \b, MAP length %#x
  663. # nextResourceMap; handle to next resource map; used by the Resource Manager for internal bookkeeping; should be zero
  664. >(4.L+16) ubelong !0 \b, nextResourceMap %#x
  665. # fileRef; file reference number; used by the Resource Manager for internal bookkeeping; should be zero
  666. >(4.L+20) ubeshort !0 \b, fileRef %#x
  667. # attributes; Resource fork attributes (80h~read-only 40h~compression needed 20h~changed); other bits are reserved and should be zero
  668. >(4.L+22) ubeshort !0 \b, attributes %#x
  669. # typeListOffset; offset from resource map to start of type list like: 1Ch
  670. >(4.L+24) ubeshort x \b, list offset %#x
  671. # nameListOffset; offset from esource map to start of name list like: 32h 46h 56h (XLISP.RSR XLISPTIN.RSR) 13Eh (HelveticaNeue.dfont)
  672. >(4.L+26) ubeshort x \b, name offset %#x
  673. # typeCount; number of types in the map minus 1; If there are no resources, this is 0xFFFF
  674. >(4.L+28) beshort+1 >0 \b, %u type
  675. # plural s
  676. >>(4.L+28) beshort+1 >1 \bs
  677. # resource type list array; 1st resource type like: ALRT CODE FOND MPSR icns scsz
  678. >>(4.L+30) ubelong x \b, %#x
  679. >>(4.L+30) string x '%-.4s'
  680. # resourceCount; number of this type resources minus one. If there is one resource of this type, this is 0x0000
  681. >>(4.L+34) beshort+1 x * %d
  682. # resourceListOffset; offset from type list to resource list like: Ah 12h DAh
  683. >(4.L+36) ubeshort x resource offset %#x
  684. #https://en.wikipedia.org/wiki/AppleScript
  685. 0 string FasdUAS AppleScript compiled
  686. # AppleWorks/ClarisWorks
  687. # https://github.com/joshenders/appleworks_format
  688. # http://fileformats.archiveteam.org/wiki/AppleWorks
  689. 0 name appleworks
  690. >0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document
  691. >0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document
  692. >0 default x
  693. >>0 belong x AppleWorks/ClarisWorks CWK Document
  694. >0 byte x \b, version %d
  695. >30 beshort x \b, %d
  696. >32 beshort x \bx%d
  697. !:ext cwk
  698. 4 string BOBO
  699. >0 byte >4
  700. >>12 belong 0
  701. >>>26 belong 0
  702. >>>>0 use appleworks
  703. >0 belong 0x0481ad00
  704. >>0 use appleworks
  705. # magic for Apple File System (APFS)
  706. # from Alex Myczko <alex@aiei.ch>
  707. 32 string NXSB Apple File System (APFS)
  708. >36 ulelong x \b, blocksize %u
  709. # iTunes cover art (versions 1 and 2)
  710. 4 string itch
  711. >24 string artw
  712. >>0x1e8 string data iTunes cover art
  713. >>>0x1ed string PNG (PNG)
  714. >>>0x1ec beshort 0xffd8 (JPEG)
  715. # MacPaint image
  716. 65 string PNTGMPNT MacPaint image data
  717. #0 belong 2 MacPaint image data