filesystems 101 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694
  1. #------------------------------------------------------------------------------
  2. # $File: filesystems,v 1.158 2023/05/21 17:19:08 christos Exp $
  3. # filesystems: file(1) magic for different filesystems
  4. #
  5. 0 name partid
  6. >0 ubyte 0x00 Unused
  7. >0 ubyte 0x01 12-bit FAT
  8. >0 ubyte 0x02 XENIX /
  9. >0 ubyte 0x03 XENIX /usr
  10. >0 ubyte 0x04 16-bit FAT, less than 32M
  11. >0 ubyte 0x05 extended partition
  12. >0 ubyte 0x06 16-bit FAT, more than 32M
  13. >0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX
  14. >0 ubyte 0x08 AIX or os, or etc.
  15. >0 ubyte 0x09 AIX boot partition or Coherent
  16. >0 ubyte 0x0a O/2 boot manager or Coherent swap
  17. >0 ubyte 0x0b 32-bit FAT
  18. >0 ubyte 0x0c 32-bit FAT, LBA-mapped
  19. >0 ubyte 0x0d 7XXX, LBA-mapped
  20. >0 ubyte 0x0e 16-bit FAT, LBA-mapped
  21. >0 ubyte 0x0f extended partition, LBA-mapped
  22. >0 ubyte 0x10 OPUS
  23. >0 ubyte 0x11 OS/2 DOS 12-bit FAT
  24. >0 ubyte 0x12 Compaq diagnostics
  25. >0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M
  26. >0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M
  27. >0 ubyte 0x17 OS/2 hidden IFS
  28. >0 ubyte 0x18 AST Windows swapfile
  29. >0 ubyte 0x19 Willowtech Photon coS
  30. >0 ubyte 0x1b hidden win95 fat 32
  31. >0 ubyte 0x1c hidden win95 fat 32 lba
  32. >0 ubyte 0x1d hidden win95 fat 16 lba
  33. >0 ubyte 0x20 Willowsoft OFS1
  34. >0 ubyte 0x21 reserved
  35. >0 ubyte 0x23 reserved
  36. >0 ubyte 0x24 NEC DOS
  37. >0 ubyte 0x26 reserved
  38. >0 ubyte 0x31 reserved
  39. >0 ubyte 0x32 Alien Internet Services NOS
  40. >0 ubyte 0x33 reserved
  41. >0 ubyte 0x34 reserved
  42. >0 ubyte 0x35 JFS on OS2
  43. >0 ubyte 0x36 reserved
  44. >0 ubyte 0x38 Theos
  45. >0 ubyte 0x39 Plan 9, or Theos spanned
  46. >0 ubyte 0x3a Theos ver 4 4gb partition
  47. >0 ubyte 0x3b Theos ve 4 extended partition
  48. >0 ubyte 0x3c PartitionMagic recovery
  49. >0 ubyte 0x3d Hidden Netware
  50. >0 ubyte 0x40 VENIX 286 or LynxOS
  51. >0 ubyte 0x41 PReP
  52. >0 ubyte 0x42 linux swap sharing DRDOS disk
  53. >0 ubyte 0x43 linux sharing DRDOS disk
  54. >0 ubyte 0x44 GoBack change utility
  55. >0 ubyte 0x45 Boot US Boot manager
  56. >0 ubyte 0x46 EUMEL/Elan or Ergos 3
  57. >0 ubyte 0x47 EUMEL/Elan or Ergos 3
  58. >0 ubyte 0x48 EUMEL/Elan or Ergos 3
  59. >0 ubyte 0x4a ALFX/THIN filesystem for DOS
  60. >0 ubyte 0x4c Oberon partition
  61. >0 ubyte 0x4d QNX4.x
  62. >0 ubyte 0x4e QNX4.x 2nd part
  63. >0 ubyte 0x4f QNX4.x 3rd part
  64. >0 ubyte 0x50 DM (disk manager)
  65. >0 ubyte 0x51 DM6 Aux1 (or Novell)
  66. >0 ubyte 0x52 CP/M or Microport SysV/AT
  67. >0 ubyte 0x53 DM6 Aux3
  68. >0 ubyte 0x54 DM6 DDO
  69. >0 ubyte 0x55 EZ-Drive (disk manager)
  70. >0 ubyte 0x56 Golden Bow (disk manager)
  71. >0 ubyte 0x57 Drive PRO
  72. >0 ubyte 0x5c Priam Edisk (disk manager)
  73. >0 ubyte 0x61 SpeedStor
  74. >0 ubyte 0x63 GNU HURD or Mach or Sys V/386
  75. >0 ubyte 0x64 Novell Netware 2.xx or Speedstore
  76. >0 ubyte 0x65 Novell Netware 3.xx
  77. >0 ubyte 0x66 Novell 386 Netware
  78. >0 ubyte 0x67 Novell
  79. >0 ubyte 0x68 Novell
  80. >0 ubyte 0x69 Novell
  81. >0 ubyte 0x70 DiskSecure Multi-Boot
  82. >0 ubyte 0x71 reserved
  83. >0 ubyte 0x73 reserved
  84. >0 ubyte 0x74 reserved
  85. >0 ubyte 0x75 PC/IX
  86. >0 ubyte 0x76 reserved
  87. >0 ubyte 0x77 M2FS/M2CS partition
  88. >0 ubyte 0x78 XOSL boot loader filesystem
  89. >0 ubyte 0x80 MINIX until 1.4a
  90. >0 ubyte 0x81 MINIX since 1.4b
  91. >0 ubyte 0x82 Linux swap or Solaris
  92. >0 ubyte 0x83 Linux native
  93. >0 ubyte 0x84 OS/2 hidden C: drive
  94. >0 ubyte 0x85 Linux extended partition
  95. >0 ubyte 0x86 NT FAT volume set
  96. >0 ubyte 0x87 NTFS volume set or HPFS mirrored
  97. >0 ubyte 0x8a Linux Kernel AiR-BOOT partition
  98. >0 ubyte 0x8b Legacy Fault tolerant FAT32
  99. >0 ubyte 0x8c Legacy Fault tolerant FAT32 ext
  100. >0 ubyte 0x8d Hidden free FDISK FAT12
  101. >0 ubyte 0x8e Linux Logical Volume Manager
  102. >0 ubyte 0x90 Hidden free FDISK FAT16
  103. >0 ubyte 0x91 Hidden free FDISK DOS EXT
  104. >0 ubyte 0x92 Hidden free FDISK FAT16 Big
  105. >0 ubyte 0x93 Amoeba filesystem
  106. >0 ubyte 0x94 Amoeba bad block table
  107. >0 ubyte 0x95 MIT EXOPC native partitions
  108. >0 ubyte 0x97 Hidden free FDISK FAT32
  109. >0 ubyte 0x98 Datalight ROM-DOS Super-Boot
  110. >0 ubyte 0x99 Mylex EISA SCSI
  111. >0 ubyte 0x9a Hidden free FDISK FAT16 LBA
  112. >0 ubyte 0x9b Hidden free FDISK EXT LBA
  113. >0 ubyte 0x9f BSDI?
  114. >0 ubyte 0xa0 IBM Thinkpad hibernation
  115. >0 ubyte 0xa1 HP Volume expansion (SpeedStor)
  116. >0 ubyte 0xa3 HP Volume expansion (SpeedStor)
  117. >0 ubyte 0xa4 HP Volume expansion (SpeedStor)
  118. >0 ubyte 0xa5 386BSD partition type
  119. >0 ubyte 0xa6 OpenBSD partition type
  120. >0 ubyte 0xa7 NeXTSTEP 486
  121. >0 ubyte 0xa8 Apple UFS
  122. >0 ubyte 0xa9 NetBSD partition type
  123. >0 ubyte 0xaa Olivetty Fat12 1.44MB Service part
  124. >0 ubyte 0xab Apple Boot
  125. >0 ubyte 0xae SHAG OS filesystem
  126. >0 ubyte 0xaf Apple HFS
  127. >0 ubyte 0xb0 BootStar Dummy
  128. >0 ubyte 0xb1 reserved
  129. >0 ubyte 0xb3 reserved
  130. >0 ubyte 0xb4 reserved
  131. >0 ubyte 0xb6 reserved
  132. >0 ubyte 0xb7 BSDI BSD/386 filesystem
  133. >0 ubyte 0xb8 BSDI BSD/386 swap
  134. >0 ubyte 0xbb Boot Wizard Hidden
  135. >0 ubyte 0xbe Solaris 8 partition type
  136. >0 ubyte 0xbf Solaris partition type
  137. >0 ubyte 0xc0 CTOS
  138. >0 ubyte 0xc1 DRDOS/sec (FAT-12)
  139. >0 ubyte 0xc2 Hidden Linux
  140. >0 ubyte 0xc3 Hidden Linux swap
  141. >0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M)
  142. >0 ubyte 0xc5 DRDOS/sec (EXT)
  143. >0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M)
  144. >0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled
  145. >0 ubyte 0xc8 Reserved for DR-DOS 8.0+
  146. >0 ubyte 0xc9 Reserved for DR-DOS 8.0+
  147. >0 ubyte 0xca Reserved for DR-DOS 8.0+
  148. >0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS
  149. >0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA
  150. >0 ubyte 0xcd CTOS Memdump
  151. >0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA
  152. >0 ubyte 0xcf DR-DOS 7.04+ EXT LBA
  153. >0 ubyte 0xd0 REAL/32 secure big partition
  154. >0 ubyte 0xd1 Old Multiuser DOS FAT12
  155. >0 ubyte 0xd4 Old Multiuser DOS FAT16 Small
  156. >0 ubyte 0xd5 Old Multiuser DOS Extended
  157. >0 ubyte 0xd6 Old Multiuser DOS FAT16 Big
  158. >0 ubyte 0xd8 CP/M 86
  159. >0 ubyte 0xdb CP/M or Concurrent CP/M
  160. >0 ubyte 0xdd Hidden CTOS Memdump
  161. >0 ubyte 0xde Dell PowerEdge Server utilities
  162. >0 ubyte 0xdf DG/UX virtual disk manager
  163. >0 ubyte 0xe0 STMicroelectronics ST AVFS
  164. >0 ubyte 0xe1 DOS access or SpeedStor 12-bit
  165. >0 ubyte 0xe3 DOS R/O or Storage Dimensions
  166. >0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl.
  167. >0 ubyte 0xe5 reserved
  168. >0 ubyte 0xe6 reserved
  169. >0 ubyte 0xeb BeOS
  170. >0 ubyte 0xee GPT Protective MBR
  171. >0 ubyte 0xef EFI system partition
  172. >0 ubyte 0xf0 Linux PA-RISC boot loader
  173. >0 ubyte 0xf1 SpeedStor or Storage Dimensions
  174. >0 ubyte 0xf2 DOS 3.3+ Secondary
  175. >0 ubyte 0xf3 reserved
  176. >0 ubyte 0xf4 SpeedStor large partition
  177. >0 ubyte 0xf5 Prologue multi-volumen partition
  178. >0 ubyte 0xf6 reserved
  179. >0 ubyte 0xf9 pCache: ext2/ext3 persistent cache
  180. >0 ubyte 0xfa Bochs x86 emulator
  181. >0 ubyte 0xfb VMware File System
  182. >0 ubyte 0xfc VMware Swap
  183. >0 ubyte 0xfd Linux RAID partition persistent sb
  184. >0 ubyte 0xfe LANstep or IBM PS/2 IML
  185. >0 ubyte 0xff Xenix Bad Block Table
  186. 0 string \366\366\366\366 PC formatted floppy with no filesystem
  187. # Sun disk labels
  188. # From /usr/include/sun/dklabel.h:
  189. 0774 beshort 0xdabe
  190. # modified by Joerg Jenderek, because original test
  191. # succeeds for Cabinet archive dao360.dl_ with negative blocks
  192. >0770 long >0 Sun disk label
  193. >>0 string x '%s
  194. >>>31 string >\0 \b%s
  195. >>>>63 string >\0 \b%s
  196. >>>>>95 string >\0 \b%s
  197. >>0 string x \b'
  198. >>0734 short >0 %d rpm,
  199. >>0736 short >0 %d phys cys,
  200. >>0740 short >0 %d alts/cyl,
  201. >>0746 short >0 %d interleave,
  202. >>0750 short >0 %d data cyls,
  203. >>0752 short >0 %d alt cyls,
  204. >>0754 short >0 %d heads/partition,
  205. >>0756 short >0 %d sectors/track,
  206. >>0764 long >0 start cyl %d,
  207. >>0770 long x %d blocks
  208. # Is there a boot block written 1 sector in?
  209. >512 belong&077777777 0600407 \b, boot block present
  210. # Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
  211. # (http://btmgr.sourceforge.net/docs/user-guide-3.html)
  212. 0 string SBMBAKUP_ Smart Boot Manager backup file
  213. >9 string x \b, version %-5.5s
  214. >>14 string =_
  215. >>>15 string x %-.1s
  216. >>>>16 string =_ \b.
  217. >>>>>17 string x \b%-.1s
  218. >>>>>>18 string =_ \b.
  219. >>>>>>>19 string x \b%-.1s
  220. >>>22 ubyte 0
  221. >>>>21 ubyte x \b, from drive %#x
  222. >>>22 ubyte >0
  223. >>>>21 string x \b, from drive %s
  224. >>>535 search/17 \x55\xAA
  225. >>>>&-512 indirect x \b; contains
  226. # updated by Joerg Jenderek at Nov 2012
  227. # DOS Emulator image is 128 byte, null right padded header + harddisc image
  228. 0 string DOSEMU\0
  229. >0x27E leshort 0xAA55
  230. #offset is 128
  231. >>19 ubyte 128
  232. >>>(19.b-1) ubyte 0x0 DOS Emulator image
  233. >>>>7 ulelong >0 \b, %u heads
  234. >>>>11 ulelong >0 \b, %d sectors/track
  235. >>>>15 ulelong >0 \b, %d cylinders
  236. >>>>128 indirect x \b; contains
  237. # added by Joerg Jenderek at Nov 2012
  238. # http://www.thenakedpc.com/articles/v04/08/0408-05.html
  239. # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
  240. 0 string PNCIHISK\0 Norton Utilities disc image data
  241. # real x86 boot sector with jump instruction
  242. >509 search/1026 \x55\xAA\xeb
  243. >>&-1 indirect x \b; contains
  244. # http://file-extension.net/seeker/file_extension_dat
  245. 0 string PNCIUNDO Norton Disk Doctor UnDo file
  246. #
  247. # DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
  248. # for any allowed sector sizes
  249. 30 search/481 \x55\xAA
  250. # to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
  251. # DOS BPB information (70) and after DOS floppy (120) like in previous file version
  252. !:strength +65
  253. # for sector sizes < 512 Bytes
  254. >11 uleshort <512
  255. >>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector
  256. # for sector sizes with 512 or more Bytes
  257. >0x1FE leshort 0xAA55 DOS/MBR boot sector
  258. # ExFAT
  259. 3 string/w =EXFAT
  260. >0x1FE leshort 0xAA55
  261. >>0x6E ubyte 1
  262. >>>0x6F ubyte 0x80
  263. >>>0 ubyte 0xEB DOS/MBR boot sector,
  264. >>>0x69 ubyte x ExFAT Filesystem version %d.
  265. >>>0x68 ubyte x \b%d
  266. >>>0x6d ubyte x \b, (1<<%d) sectors per cluster
  267. >>>0x48 ulequad x \b, sectors %lld
  268. >>>0x64 ulelong x \b, serial number %#x
  269. # keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
  270. # only for sector sizes with 512 or more Bytes
  271. 0x1FE leshort 0xAA55 DOS/MBR boot sector
  272. #
  273. # to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
  274. !:strength +65
  275. >2 string OSBS OS/BS MBR
  276. # added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/
  277. # and https://en.wikipedia.org/wiki/Master_Boot_Record
  278. # test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
  279. # characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
  280. >0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR
  281. # Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
  282. # assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
  283. >>8 ubequad 0x8bf45007501ffbfc
  284. # https://thestarman.pcministry.com/asm/mbr/200MBR.htm
  285. >>>0x16 ubyte 0xF3 \b,DOS 2
  286. >>>>219 regex Author\ -\ Author:
  287. # found "David Litton" , "A Pehrsson "
  288. >>>>>&0 string x "%s"
  289. >>>0x16 ubyte 0xF2
  290. # NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
  291. # assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
  292. >>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3
  293. # version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
  294. >>>>0x22 default x \b,D0S version 3.3-7.0
  295. # error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
  296. # where nn is string offset varying for different languages
  297. # "Invalid partition table" nn=0x8b for english version
  298. >>>>>(0x49.b) string Invalid\ partition\ table english
  299. >>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german
  300. >>>>>(0x49.b) string Table\ de\ partition\ invalide french
  301. >>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese
  302. >>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish
  303. >>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian
  304. >>>>>0x49 ubyte >0 at offset %#x
  305. >>>>>>(0x49.b) string >\0 "%s"
  306. # "Error loading operating system" nn=0xa3 for english version
  307. # "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version
  308. # "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version
  309. # "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version
  310. # "Error al cargar sistema operativo" nn=0xa8 for spanish version
  311. # "Errore durante il caricamento del sistema operativo" nn=0xae for italian version
  312. >>>>>0x74 ubyte >0 at offset %#x
  313. >>>>>>(0x74.b) string >\0 "%s"
  314. # "Missing operating system" nn=0xc2 for english version
  315. # "Betriebssystem fehlt" nn=0xcd for german version
  316. # "Syst\212me d'exploitation absent" nn=0xd2 for french version
  317. # "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version
  318. # "Falta sistema operativo" nn=0xca for spanish version
  319. # "Sistema operativo mancante" nn=0xe2 for italian version
  320. >>>>>0x79 ubyte >0 at offset %#x
  321. >>>>>>(0x79.b) string >\0 "%s"
  322. # Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
  323. # assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b
  324. >>8 ubequad 0x5007501ffcbe1b7c
  325. # assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
  326. >>>24 ubequad 0xf3a4cbbebe07b104 9M
  327. # "Invalid partition table" nn=0x10F for english version
  328. # "Ung\201ltige Partitionstabelle" nn=0x10F for german version
  329. # "Table de partition erron\202e" nn=0x10F for french version
  330. # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version
  331. >>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english
  332. >>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german
  333. >>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french
  334. >>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian
  335. >>>>0x3C ubyte x at offset %#x+0xFF
  336. >>>>(0x3C.b+0x0FF) string >\0 "%s"
  337. # "Error loading operating system" nn=0x127 for english version
  338. # "Fehler beim Laden des Betriebssystems" nn=0x12b for german version
  339. # "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version
  340. # "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version
  341. >>>>0xBD ubyte x at offset 0x1%x
  342. >>>>(0xBD.b+0x100) string >\0 "%s"
  343. # "Missing operating system" nn=0x146 for english version
  344. # "Betriebssystem fehlt" nn=0x151 for german version
  345. # "Syst\212me d'exploitation manquant" nn=0x15e for french version
  346. # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version
  347. >>>>0xA9 ubyte x at offset 0x1%x
  348. >>>>(0xA9.b+0x100) string >\0 "%s"
  349. # https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
  350. # assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
  351. >>>24 ubequad 0xf3a4cbbdbe07b104 XP
  352. # where xxyyzz are lower bits from offsets of error messages varying for different languages
  353. >>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english
  354. >>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german
  355. # "Invalid partition table" xx=0x12C for english version
  356. # "Ung\201ltige Partitionstabelle" xx=0x12C for german version
  357. >>>>0x1b5 ubyte >0 at offset 0x1%x
  358. >>>>(0x1b5.b+0x100) string >\0 "%s"
  359. # "Error loading operating system" yy=0x144 for english version
  360. # "Fehler beim Laden des Betriebssystems" yy=0x148 for german version
  361. >>>>0x1b6 ubyte >0 at offset 0x1%x
  362. >>>>(0x1b6.b+0x100) string >\0 "%s"
  363. # "Missing operating system" zz=0x163 for english version
  364. # "Betriebssystem nicht vorhanden" zz=0x16e for german version
  365. >>>>0x1b7 ubyte >0 at offset 0x1%x
  366. >>>>(0x1b7.b+0x100) string >\0 "%s"
  367. # Microsoft Windows Vista or 7
  368. # assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
  369. >>8 ubequad 0xc08ed8be007cbf00
  370. # Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
  371. # assembler instructions: jnz 0729;cmp ebx,"TCPA"
  372. >>>0xEC ubequad 0x753b6681fb544350 Vista
  373. # where xxyyzz are lower bits from offsets of error messages varying for different languages
  374. >>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english
  375. #>>>>0x1B4 ubelong&0x00FFFFFF ? german
  376. # "Invalid partition table" xx=0x162 for english version
  377. # "Ung\201ltige Partitionstabelle" xx=0x1?? for german version
  378. >>>>0x1b5 ubyte >0 at offset 0x1%x
  379. >>>>(0x1b5.b+0x100) string >\0 "%s"
  380. # "Error loading operating system" yy=0x17a for english version
  381. # "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version
  382. >>>>0x1b6 ubyte >0 at offset 0x1%x
  383. >>>>(0x1b6.b+0x100) string >\0 "%s"
  384. # "Missing operating system" zz=0x199 for english version
  385. # "Betriebssystem nicht vorhanden" zz=0x1?? for german version
  386. >>>>0x1b7 ubyte >0 at offset 0x1%x
  387. >>>>(0x1b7.b+0x100) string >\0 "%s"
  388. # Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
  389. # assembler instructions: cmp ebx,"TCPA";cmp
  390. >>>0xEC ubequad 0x6681fb5443504175 Windows 7
  391. # where xxyyzz are lower bits from offsets of error messages varying for different languages
  392. >>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english
  393. #>>>>0x1B4 ubelong&0x00FFFFFF ? german
  394. # "Invalid partition table" xx=0x163 for english version
  395. # "Ung\201ltige Partitionstabelle" xx=0x1?? for german version
  396. >>>>0x1b5 ubyte >0 at offset 0x1%x
  397. >>>>(0x1b5.b+0x100) string >\0 "%s"
  398. # "Error loading operating system" yy=0x17b for english version
  399. # "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version
  400. >>>>0x1b6 ubyte >0 at offset 0x1%x
  401. >>>>(0x1b6.b+0x100) string >\0 "%s"
  402. # "Missing operating system" zz=0x19a for english version
  403. # "Betriebssystem nicht vorhanden" zz=0x1?? for german version
  404. >>>>0x1b7 ubyte >0 at offset 0x1%x
  405. >>>>(0x1b7.b+0x100) string >\0 "%s"
  406. # https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
  407. # https://en.wikipedia.org/wiki/MBR_disk_signature#ID
  408. >>0x1b8 ulelong >0 \b, disk signature %#-.4x
  409. # driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm
  410. >>0xDA uleshort 0
  411. >>>0xDC ulelong >0 \b, created
  412. # physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
  413. >>>>0xDC ubyte x with driveID %#x
  414. # hours, minutes and seconds
  415. >>>>0xDf ubyte x at %x
  416. >>>>0xDe ubyte x \b:%x
  417. >>>>0xDd ubyte x \b:%x
  418. # special case for Microsoft MS-DOS 3.21 spanish
  419. # assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
  420. >0 ubequad 0xfab830008ed0bc00
  421. # assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
  422. >>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish
  423. # Microsoft MBR IPL end
  424. # dr-dos with some upper-, lowercase variants
  425. >0x9D string Invalid\ partition\ table$
  426. >>181 string No\ Operating\ System$
  427. >>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
  428. >0x9D string Invalid\ partition\ table$
  429. >>181 string No\ operating\ system$
  430. >>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
  431. >342 string Invalid\ partition\ table$
  432. >>366 string No\ operating\ system$
  433. >>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
  434. >295 string NEWLDR\0
  435. >>302 string Bad\ PT\ $
  436. >>>310 string No\ OS\ $
  437. >>>>317 string OS\ load\ err$
  438. >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
  439. >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
  440. >>>>>>>387 string Copyright\ (c)\ 1984,1998
  441. >>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
  442. #
  443. # tests for different MS-DOS Master Boot Records (MBR) moved and merged
  444. #
  445. #>0x145 string Default:\ F \b, FREE-DOS MBR
  446. #>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR
  447. >0x145 search/7 Default:\ F \b, FREE-DOS MBR
  448. #>>313 string F0\ .\ .\ .
  449. #>>>322 string disk\ 1
  450. #>>>>382 string FAT3
  451. >64 string no\ active\ partition\ found
  452. >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
  453. # Ranish Partition Manager http://www.ranish.com/part/
  454. >387 search/4 \0\ Error!\r
  455. >>378 search/7 Virus!
  456. >>>397 search/4 Booting\040
  457. >>>>408 search/4 HD1/\0 \b, Ranish MBR (
  458. >>>>>416 string Writing\ changes... \b2.37
  459. >>>>>>438 ubyte x \b,%#x dots
  460. >>>>>>440 ubyte >0 \b,virus check
  461. >>>>>>441 ubyte >0 \b,partition %c
  462. #2.38,2.42,2.44
  463. >>>>>416 string !Writing\ changes... \b
  464. >>>>>>418 ubyte 1 \bvirus check,
  465. >>>>>>419 ubyte x \b%#x seconds
  466. >>>>>>420 ubyte&0x0F >0 \b,partition
  467. >>>>>>>420 ubyte&0x0F <5 \b %x
  468. >>>>>>>420 ubyte&0x0F 0Xf \b ask
  469. >>>>>420 ubyte x \b)
  470. #
  471. # SYSLINUX MBR moved
  472. # https://www.acronis.de/
  473. >362 string MBR\ Error\ \0\r
  474. >>376 string ress\ any\ key\ to\040
  475. >>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
  476. # added by Joerg Jenderek
  477. # https://www.visopsys.org/
  478. # https://partitionlogic.org.uk/
  479. >309 string No\ bootable\ partition\ found\r
  480. >>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
  481. >349 string No\ bootable\ partition\ found\r
  482. >>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
  483. # bootloader, bootmanager
  484. >0x40 string SBML
  485. # label with 11 characters of FAT 12 bit filesystem
  486. >>43 string SMART\ BTMGR
  487. >>>430 string SBMK\ Bad!\r \b, Smart Boot Manager
  488. # OEM-ID not always "SBM"
  489. #>>>>3 strings SBM
  490. >>>>6 string >\0 \b, version %s
  491. >382 string XOSLLOADXCF \b, eXtended Operating System Loader
  492. >6 string LILO \b, LInux i386 boot LOader
  493. >>120 string LILO \b, version 22.3.4 SuSe
  494. >>172 string LILO \b, version 22.5.8 Debian
  495. # updated by Joerg Jenderek at Oct 2008
  496. # variables according to grub-0.97/stage1/stage1.S or
  497. # https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
  498. # usual values are marked with comments to get only information of strange GRUB loaders
  499. >342 search/60 \0Geom\0
  500. #>0 ulelong x %x=0x009048EB , 0x2a9048EB 0
  501. >>0x41 ubyte <2
  502. >>>0x3E ubyte >2 \b; GRand Unified Bootloader
  503. # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
  504. >>>>0x3E ubyte x \b, stage1 version %#x
  505. #If it is 0xFF, use a drive passed by BIOS
  506. >>>>0x40 ubyte <0xFF \b, boot drive %#x
  507. # in most case 0,1,0x2e for GRUB 0.5.95
  508. >>>>0x41 ubyte >0 \b, LBA flag %#x
  509. >>>>0x42 uleshort <0x8000 \b, stage2 address %#x
  510. #>>>>0x42 uleshort =0x8000 \b, stage2 address %#x (usual)
  511. >>>>0x42 uleshort >0x8000 \b, stage2 address %#x
  512. #>>>>0x44 ulelong =1 \b, 1st sector stage2 %#x (default)
  513. >>>>0x44 ulelong >1 \b, 1st sector stage2 %#x
  514. >>>>0x48 uleshort <0x800 \b, stage2 segment %#x
  515. #>>>>0x48 uleshort =0x800 \b, stage2 segment %#x (usual)
  516. >>>>0x48 uleshort >0x800 \b, stage2 segment %#x
  517. >>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
  518. >>>>>394 string stage1 \b, GRUB version 0.5.95
  519. >>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
  520. >>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94
  521. >>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
  522. >>>>>377 string GRUB\ \0 \b, GRUB version 0.94
  523. >>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0
  524. >>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
  525. >>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
  526. >>>>>385 string GRUB\ \0 \b, GRUB version 0.97
  527. # unknown version
  528. >>>343 string Geom\0Read\0\ Error\0
  529. >>>>321 string Loading\ stage1.5 \b, GRUB version x.y
  530. >>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
  531. >>>>374 string GRUB\ \0 \b, GRUB version n.m
  532. # SYSLINUX bootloader moved
  533. >395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
  534. # http://www.bcdwb.de/bcdw/index_e.htm
  535. >3 string BCDL
  536. >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
  537. # mbr partition table entries updated by Joerg Jenderek at Sep 2013
  538. # skip Norton Utilities disc image data
  539. >3 string !IHISK
  540. # skip Linux style boot sector starting with assembler instructions mov 0x7c0,ax;
  541. >>0 belong !0xb8c0078e
  542. # not Linux kernel
  543. >>>514 string !HdrS
  544. # not BeOS
  545. >>>>422 string !Be\ Boot\ Loader
  546. # jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
  547. >>>>>0 ubelong&0xFD000000 =0xE9000000
  548. # AdvanceMAME mbr
  549. >>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e
  550. >>>>>>>446 use partition-table
  551. # mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
  552. >>>>>0 ubelong&0xFD000000 !0xE9000000
  553. # skip FSInfosector
  554. >>>>>>0 string !RRaA
  555. # skip 3rd sector of MS x86 bootloader with assembler instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
  556. # https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
  557. >>>>>>>0 ubequad !0xfa660fb64610668b
  558. # skip 13rd sector of MS x86 bootloader
  559. >>>>>>>>0 ubequad !0x660fb64610668b4e
  560. # skip sector starting with DOS new line
  561. >>>>>>>>>0 string !\r\n
  562. # allowed active flag 0,80h-FFh
  563. >>>>>>>>>>446 ubyte 0
  564. >>>>>>>>>>>446 use partition-table
  565. >>>>>>>>>>446 ubyte >0x7F
  566. >>>>>>>>>>>446 use partition-table
  567. # TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
  568. # mbr partition table entries end
  569. # https://www.acronis.de/
  570. #FAT label=ACRONIS\ SZ
  571. #OEM-ID=BOOTWIZ0
  572. >442 string Non-system\ disk,\040
  573. >>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
  574. # updated by Joerg Jenderek at Nov 2012, Sep 2013
  575. # DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
  576. # display 1 space
  577. >>>447 ubyte x \b
  578. >>>477 use DOS-filename
  579. #
  580. >185 string FDBOOT\ Version\040
  581. >>204 string \rNo\ Systemdisk.\040
  582. >>>220 string Booting\ from\ harddisk.\n\r
  583. >>>245 string Cannot\ load\ from\ harddisk.\n\r
  584. >>>>273 string Insert\ Systemdisk\040
  585. >>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
  586. >>>>>>200 string >\0 \b, version %-3s
  587. >242 string Bootsector\ from\ C.H.\ Hochst\204
  588. # http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c
  589. # updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
  590. # skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
  591. >242 search/127 Bootsector\ from\ C.H.\ Hochst
  592. >>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk
  593. # followed by variants with point,CR-NL or NL-CR
  594. >>>208 search/261 Cannot\ load\ from\ harddisk.
  595. # followed by variants CR-NL or NL-CR
  596. >>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key.
  597. # followed by variants with point,CR-NL or NL-CR
  598. >>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader
  599. # followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
  600. >>>>>>&0 string x \b, version %-4.4s
  601. >(1.b+2) ubyte 0xe
  602. >>(1.b+3) ubyte 0x1f
  603. >>>(1.b+4) ubyte 0xbe
  604. # message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
  605. >>>>(1.b+5) ubyte&0xd3 0x53
  606. >>>>>(1.b+6) ubyte 0x7c
  607. # assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
  608. >>>>>>(1.b+7) ubyte 0xac
  609. >>>>>>>(1.b+8) ubyte 0x22
  610. >>>>>>>>(1.b+9) ubyte 0xc0
  611. >>>>>>>>>(1.b+10) ubyte 0x74
  612. >>>>>>>>>>(1.b+11) ubyte 0x0b
  613. >>>>>>>>>>>(1.b+12) ubyte 0x56
  614. >>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
  615. # FAT1X version
  616. >>>>>>>>>>>>>(1.b+5) ubyte 0x5b
  617. >>>>>>>>>>>>>>0x5b string >\0 "%-s"
  618. # FAT32 version
  619. >>>>>>>>>>>>>(1.b+5) ubyte 0x77
  620. >>>>>>>>>>>>>>0x77 string >\0 "%-s"
  621. >214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display
  622. #>>244 string from\ dosemu-freedos-*-bin.tgz\r
  623. #>>>170 string Sorry,\ could\ not\ load\ an\040
  624. #>>>>195 string operating\ system.\r\n
  625. #
  626. >103 string This\ is\ not\ a\ bootable\ disk.\040
  627. >>132 string Please\ insert\ a\ bootable\040
  628. >>>157 string floppy\ and\r\n
  629. >>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
  630. #
  631. >66 string Solaris\ Boot\ Sector
  632. >>99 string Incomplete\ MDBoot\ load.
  633. >>>89 string Version \b, Sun Solaris Bootloader
  634. >>>>97 byte x version %c
  635. #
  636. >408 string OS/2\ !!\ SYS01475\r\0
  637. >>429 string OS/2\ !!\ SYS02025\r\0
  638. >>>450 string OS/2\ !!\ SYS02027\r\0
  639. >>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
  640. #
  641. >409 string OS/2\ !!\ SYS01475\r\0
  642. >>430 string OS/2\ !!\ SYS02025\r\0
  643. >>>451 string OS/2\ !!\ SYS02027\r\0
  644. >>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
  645. >112 string This\ disk\ is\ not\ bootable\r
  646. >>142 string If\ you\ wish\ to\ make\ it\ bootable
  647. >>>176 string run\ the\ DOS\ program\ SYS\040
  648. >>>200 string after\ the\r
  649. >>>>216 string system\ has\ been\ loaded\r\n
  650. >>>>>242 string Please\ insert\ a\ DOS\ diskette\040
  651. >>>>>271 string into\r\n\ the\ drive\ and\040
  652. >>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
  653. # XP
  654. >430 string NTLDR\ is\ missing\xFF\r\n
  655. >>449 string Disk\ error\xFF\r\n
  656. >>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
  657. # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
  658. >>>>417 ubyte&0xDF >0
  659. >>>>>417 string x %-.5s
  660. >>>>>>422 ubyte&0xDF >0
  661. >>>>>>>422 string x \b%-.3s
  662. >>>>>425 ubyte&0xDF >0
  663. >>>>>>425 string >\ \b.%-.3s
  664. #
  665. >>>>371 ubyte >0x20
  666. >>>>>368 ubyte&0xDF >0
  667. >>>>>>368 string x %-.5s
  668. >>>>>>>373 ubyte&0xDF >0
  669. >>>>>>>>373 string x \b%-.3s
  670. >>>>>>376 ubyte&0xDF >0
  671. >>>>>>>376 string x \b.%-.3s
  672. #
  673. >430 string NTLDR\ nicht\ gefunden\xFF\r\n
  674. >>453 string Datentr\204gerfehler\xFF\r\n
  675. >>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
  676. >>>>417 ubyte&0xDF >0
  677. >>>>>417 string x %-.5s
  678. >>>>>>422 ubyte&0xDF >0
  679. >>>>>>>422 string x \b%-.3s
  680. >>>>>425 ubyte&0xDF >0
  681. >>>>>>425 string >\ \b.%-.3s
  682. # offset variant
  683. >>>>379 string \0
  684. >>>>>368 ubyte&0xDF >0
  685. >>>>>>368 string x %-.5s
  686. >>>>>>>373 ubyte&0xDF >0
  687. >>>>>>>>373 string x \b%-.3s
  688. #
  689. >430 string NTLDR\ fehlt\xFF\r\n
  690. >>444 string Datentr\204gerfehler\xFF\r\n
  691. >>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
  692. >>>>417 ubyte&0xDF >0
  693. >>>>>417 string x %-.5s
  694. >>>>>>422 ubyte&0xDF >0
  695. >>>>>>>422 string x \b%-.3s
  696. >>>>>425 ubyte&0xDF >0
  697. >>>>>>425 string >\ \b.%-.3s
  698. # variant
  699. >>>>371 ubyte >0x20
  700. >>>>>368 ubyte&0xDF >0
  701. >>>>>>368 string x %-.5s
  702. >>>>>>>373 ubyte&0xDF >0
  703. >>>>>>>>373 string x \b%-.3s
  704. >>>>>>376 ubyte&0xDF >0
  705. >>>>>>>376 string x \b.%-.3s
  706. #
  707. >430 string NTLDR\ fehlt\xFF\r\n
  708. >>444 string Medienfehler\xFF\r\n
  709. >>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
  710. >>>>371 ubyte >0x20
  711. >>>>>368 ubyte&0xDF >0
  712. >>>>>>368 string x %-.5s
  713. >>>>>>>373 ubyte&0xDF >0
  714. >>>>>>>>373 string x \b%-.3s
  715. >>>>>>376 ubyte&0xDF >0
  716. >>>>>>>376 string x \b.%-.3s
  717. # variant
  718. >>>>417 ubyte&0xDF >0
  719. >>>>>417 string x %-.5s
  720. >>>>>>422 ubyte&0xDF >0
  721. >>>>>>>422 string x \b%-.3s
  722. >>>>>425 ubyte&0xDF >0
  723. >>>>>>425 string >\ \b.%-.3s
  724. #
  725. >430 string Datentr\204ger\ entfernen\xFF\r\n
  726. >>454 string Medienfehler\xFF\r\n
  727. >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
  728. >>>>379 string \0
  729. >>>>>368 ubyte&0xDF >0
  730. >>>>>>368 string x %-.5s
  731. >>>>>>>373 ubyte&0xDF >0
  732. >>>>>>>>373 string x \b%-.3s
  733. >>>>>>376 ubyte&0xDF >0
  734. >>>>>>>376 string x \b.%-.3s
  735. # variant
  736. >>>>417 ubyte&0xDF >0
  737. >>>>>417 string x %-.5s
  738. >>>>>>422 ubyte&0xDF >0
  739. >>>>>>>422 string x \b%-.3s
  740. >>>>>425 ubyte&0xDF >0
  741. >>>>>>425 string >\ \b.%-.3s
  742. #
  743. #>3 string NTFS\ \ \ \040
  744. >389 string Fehler\ beim\ Lesen\040
  745. >>407 string des\ Datentr\204gers
  746. >>>426 string NTLDR\ fehlt
  747. >>>>440 string NTLDR\ ist\ komprimiert
  748. >>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
  749. #>3 string NTFS\ \ \ \040
  750. >313 string A\ disk\ read\ error\ occurred.\r
  751. >>345 string A\ kernel\ file\ is\ missing\040
  752. >>>370 string from\ the\ disk.\r
  753. >>>>484 string NTLDR\ is\ compressed
  754. >>>>>429 string Insert\ a\ system\ diskette\040
  755. >>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
  756. # DOS loader variants different languages,offsets
  757. >472 ubyte&0xDF >0
  758. >>389 string Invalid\ system\ disk\xFF\r\n
  759. >>>411 string Disk\ I/O\ error
  760. >>>>428 string Replace\ the\ disk,\ and\040
  761. >>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
  762. #IO.SYS
  763. >>>>>>472 ubyte&0xDF >0
  764. >>>>>>>472 string x \b %-.2s
  765. >>>>>>>>474 ubyte&0xDF >0
  766. >>>>>>>>>474 string x \b%-.5s
  767. >>>>>>>>>>479 ubyte&0xDF >0
  768. >>>>>>>>>>>479 string x \b%-.1s
  769. >>>>>>>480 ubyte&0xDF >0
  770. >>>>>>>>480 string x \b.%-.3s
  771. #MSDOS.SYS
  772. >>>>>>>483 ubyte&0xDF >0 \b+
  773. >>>>>>>>483 string x \b%-.5s
  774. >>>>>>>>>488 ubyte&0xDF >0
  775. >>>>>>>>>>488 string x \b%-.3s
  776. >>>>>>>>491 ubyte&0xDF >0
  777. >>>>>>>>>491 string x \b.%-.3s
  778. #
  779. >>390 string Invalid\ system\ disk\xFF\r\n
  780. >>>412 string Disk\ I/O\ error\xFF\r\n
  781. >>>>429 string Replace\ the\ disk,\ and\040
  782. >>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
  783. >>388 string Ungueltiges\ System\ \xFF\r\n
  784. >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
  785. >>>>427 string Datentraeger\ wechseln\ und\040
  786. >>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
  787. #WINBOOT.SYS only not spaces (0xDF)
  788. >>>>>>497 ubyte&0xDF >0
  789. >>>>>>>497 string x %-.5s
  790. >>>>>>>>502 ubyte&0xDF >0
  791. >>>>>>>>>502 string x \b%-.1s
  792. >>>>>>>>>>503 ubyte&0xDF >0
  793. >>>>>>>>>>>503 string x \b%-.1s
  794. >>>>>>>>>>>>504 ubyte&0xDF >0
  795. >>>>>>>>>>>>>504 string x \b%-.1s
  796. >>>>>>505 ubyte&0xDF >0
  797. >>>>>>>505 string x \b.%-.3s
  798. #IO.SYS
  799. >>>>>>472 ubyte&0xDF >0 or
  800. >>>>>>>472 string x \b %-.2s
  801. >>>>>>>>474 ubyte&0xDF >0
  802. >>>>>>>>>474 string x \b%-.5s
  803. >>>>>>>>>>479 ubyte&0xDF >0
  804. >>>>>>>>>>>479 string x \b%-.1s
  805. >>>>>>>480 ubyte&0xDF >0
  806. >>>>>>>>480 string x \b.%-.3s
  807. #MSDOS.SYS
  808. >>>>>>>483 ubyte&0xDF >0 \b+
  809. >>>>>>>>483 string x \b%-.5s
  810. >>>>>>>>>488 ubyte&0xDF >0
  811. >>>>>>>>>>488 string x \b%-.3s
  812. >>>>>>>>491 ubyte&0xDF >0
  813. >>>>>>>>>491 string x \b.%-.3s
  814. #
  815. >>390 string Ungueltiges\ System\ \xFF\r\n
  816. >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
  817. >>>>429 string Datentraeger\ wechseln\ und\040
  818. >>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
  819. #WINBOOT.SYS only not spaces (0xDF)
  820. >>>>>>497 ubyte&0xDF >0
  821. >>>>>>>497 string x %-.7s
  822. >>>>>>>>504 ubyte&0xDF >0
  823. >>>>>>>>>504 string x \b%-.1s
  824. >>>>>>505 ubyte&0xDF >0
  825. >>>>>>>505 string x \b.%-.3s
  826. #IO.SYS
  827. >>>>>>472 ubyte&0xDF >0 or
  828. >>>>>>>472 string x \b %-.2s
  829. >>>>>>>>474 ubyte&0xDF >0
  830. >>>>>>>>>474 string x \b%-.6s
  831. >>>>>>>480 ubyte&0xDF >0
  832. >>>>>>>>480 string x \b.%-.3s
  833. #MSDOS.SYS
  834. >>>>>>>483 ubyte&0xDF >0 \b+
  835. >>>>>>>>483 string x \b%-.5s
  836. >>>>>>>>>488 ubyte&0xDF >0
  837. >>>>>>>>>>488 string x \b%-.3s
  838. >>>>>>>>491 ubyte&0xDF >0
  839. >>>>>>>>>491 string x \b.%-.3s
  840. #
  841. >>389 string Ungueltiges\ System\ \xFF\r\n
  842. >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
  843. >>>>428 string Datentraeger\ wechseln\ und\040
  844. >>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
  845. # DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
  846. >>>>>>472 string x %-.2s
  847. >>>>>>>474 ubyte&0xDF >0
  848. >>>>>>>>474 string x \b%-.5s
  849. >>>>>>>>479 ubyte&0xDF >0
  850. >>>>>>>>>479 string x \b%-.1s
  851. >>>>>>480 ubyte&0xDF >0
  852. >>>>>>>480 string x \b.%-.3s
  853. >>>>>>483 ubyte&0xDF >0 \b+
  854. >>>>>>>483 string x \b%-.5s
  855. >>>>>>>488 ubyte&0xDF >0
  856. >>>>>>>>488 string x \b%-.2s
  857. >>>>>>>>490 ubyte&0xDF >0
  858. >>>>>>>>>490 string x \b%-.1s
  859. >>>>>>>491 ubyte&0xDF >0
  860. >>>>>>>>491 string x \b.%-.3s
  861. >479 ubyte&0xDF >0
  862. >>416 string Kein\ System\ oder\040
  863. >>>433 string Laufwerksfehler
  864. >>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
  865. #IO.SYS
  866. >>>>>479 string x \b %-.2s
  867. >>>>>>481 ubyte&0xDF >0
  868. >>>>>>>481 string x \b%-.6s
  869. >>>>>487 ubyte&0xDF >0
  870. >>>>>>487 string x \b.%-.3s
  871. #MSDOS.SYS
  872. >>>>>>490 ubyte&0xDF >0 \b+
  873. >>>>>>>490 string x \b%-.5s
  874. >>>>>>>>495 ubyte&0xDF >0
  875. >>>>>>>>>495 string x \b%-.3s
  876. >>>>>>>498 ubyte&0xDF >0
  877. >>>>>>>>498 string x \b.%-.3s
  878. #
  879. >376 search/41 Non-System\ disk\ or\040
  880. >>395 search/41 disk\ error\r
  881. >>>407 search/41 Replace\ and\040
  882. >>>>419 search/41 press\ \b,
  883. >>>>419 search/41 strike\ \b, old
  884. >>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader
  885. #449 Disk\ Boot\ failure\r MS 3.21
  886. #466 Boot\ Failure\r MS 3.30
  887. >>>>>468 search/18 \0
  888. #IO.SYS,IBMBIO.COM
  889. >>>>>>&0 string x \b %-.2s
  890. >>>>>>>&-20 ubyte&0xDF >0
  891. >>>>>>>>&-1 string x \b%-.4s
  892. >>>>>>>>>&-16 ubyte&0xDF >0
  893. >>>>>>>>>>&-1 string x \b%-.2s
  894. >>>>>>&8 ubyte&0xDF >0 \b.
  895. >>>>>>>&-1 string x \b%-.3s
  896. #MSDOS.SYS,IBMDOS.COM
  897. >>>>>>&11 ubyte&0xDF >0 \b+
  898. >>>>>>>&-1 string x \b%-.5s
  899. >>>>>>>>&-6 ubyte&0xDF >0
  900. >>>>>>>>>&-1 string x \b%-.1s
  901. >>>>>>>>>>&-5 ubyte&0xDF >0
  902. >>>>>>>>>>>&-1 string x \b%-.2s
  903. >>>>>>>&7 ubyte&0xDF >0 \b.
  904. >>>>>>>>&-1 string x \b%-.3s
  905. >441 string Cannot\ load\ from\ harddisk.\n\r
  906. >>469 string Insert\ Systemdisk\040
  907. >>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader
  908. #>43 string \224R-LOADER\ \ SYS =label
  909. >54 string SYS
  910. >>324 string VASKK
  911. >>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
  912. #
  913. >98 string Press\ a\ key\ to\ retry\0\r
  914. >>120 string Cannot\ find\ file\ \0\r
  915. >>>139 string Disk\ read\ error\0\r
  916. >>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader
  917. #DRBIOS.SYS
  918. >>>>>44 ubyte&0xDF >0
  919. >>>>>>44 string x \b %-.6s
  920. >>>>>>>50 ubyte&0xDF >0
  921. >>>>>>>>50 string x \b%-.2s
  922. >>>>>>52 ubyte&0xDF >0
  923. >>>>>>>52 string x \b.%-.3s
  924. #
  925. >70 string IBMBIO\ \ COM
  926. >>472 string Cannot\ load\ DOS!\040
  927. >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
  928. >>471 string Cannot\ load\ DOS\040
  929. >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
  930. #??
  931. >444 string KERNEL\ \ SYS
  932. >>314 string BOOT\ error! \b, FREE-DOS Bootloader
  933. >499 string KERNEL\ \ SYS
  934. >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
  935. >449 string KERNEL\ \ SYS
  936. >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
  937. #
  938. >449 string Loading\ FreeDOS
  939. >>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader
  940. >>>497 ubyte&0xDF >0
  941. >>>>497 string x \b %-.6s
  942. >>>>>503 ubyte&0xDF >0
  943. >>>>>>503 string x \b%-.1s
  944. >>>>>>>504 ubyte&0xDF >0
  945. >>>>>>>>504 string x \b%-.1s
  946. >>>>505 ubyte&0xDF >0
  947. >>>>>505 string x \b.%-.3s
  948. #
  949. >331 string Error!.0 \b, FREE-DOS 1.0 bootloader
  950. #
  951. >125 string Loading\ FreeDOS...\r
  952. >>311 string BOOT\ error!\r \b, FREE-DOS bootloader
  953. >>>441 ubyte&0xDF >0
  954. >>>>441 string x \b %-.6s
  955. >>>>>447 ubyte&0xDF >0
  956. >>>>>>447 string x \b%-.1s
  957. >>>>>>>448 ubyte&0xDF >0
  958. >>>>>>>>448 string x \b%-.1s
  959. >>>>449 ubyte&0xDF >0
  960. >>>>>449 string x \b.%-.3s
  961. >124 string FreeDOS\0
  962. >>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
  963. # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
  964. >>>497 ubyte&0xDF >0
  965. >>>>497 string x \b %-.6s
  966. >>>>>503 ubyte&0xDF >0
  967. >>>>>>503 string x \b%-.1s
  968. >>>>>>>504 ubyte&0xDF >0
  969. >>>>>>>>504 string x \b%-.1s
  970. >>>>505 ubyte&0xDF >0
  971. >>>>>505 string x \b.%-.3s
  972. >>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
  973. >>>497 ubyte&0xDF >0
  974. >>>>497 string x \b %-.6s
  975. >>>>>503 ubyte&0xDF >0
  976. >>>>>>503 string x \b%-.1s
  977. >>>>>>>504 ubyte&0xDF >0
  978. >>>>>>>>504 string x \b%-.1s
  979. >>>>505 ubyte&0xDF >0
  980. >>>>>505 string x \b.%-.3s
  981. >>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
  982. >>>497 ubyte&0xDF >0
  983. >>>>497 string x \b %-.6s
  984. >>>>>503 ubyte&0xDF >0
  985. >>>>>>503 string x \b%-.1s
  986. >>>>>>>504 ubyte&0xDF >0
  987. >>>>>>>>504 string x \b%-.1s
  988. >>>>505 ubyte&0xDF >0
  989. >>>>>505 string x \b.%-.3s
  990. >336 string Error!\040
  991. >>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
  992. >>>497 ubyte&0xDF >0
  993. >>>>497 string x \b %-.6s
  994. >>>>>503 ubyte&0xDF >0
  995. >>>>>>503 string x \b%-.1s
  996. >>>>>>>504 ubyte&0xDF >0
  997. >>>>>>>>504 string x \b%-.1s
  998. >>>>505 ubyte&0xDF >0
  999. >>>>>505 string x \b.%-.3s
  1000. # added by Joerg Jenderek
  1001. # https://www.visopsys.org/
  1002. # https://partitionlogic.org.uk/
  1003. # OEM-ID=Visopsys
  1004. >478 ulelong 0
  1005. >>(1.b+326) string I/O\ Error\ reading\040
  1006. >>>(1.b+344) string Visopsys\ loader\r
  1007. >>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
  1008. # http://alexfru.chat.ru/epm.html#bootprog
  1009. >494 ubyte >0x4D
  1010. >>495 string >E
  1011. >>>495 string <S
  1012. #OEM-ID is not reliable
  1013. >>>>3 string BootProg
  1014. # It just looks for a program file name at the root directory
  1015. # and loads corresponding file with following execution.
  1016. # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
  1017. >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
  1018. >>>>>499 use DOS-filename
  1019. #If the boot sector fails to read any other sector,
  1020. #it prints a very short message ("RE") to the screen and hangs the computer.
  1021. #If the boot sector fails to find needed program in the root directory,
  1022. #it also hangs with another message ("NF").
  1023. >>>>>492 string RENF \b, FAT (12 bit)
  1024. >>>>>495 string RENF \b, FAT (16 bit)
  1025. #If the boot sector fails to read any other sector,
  1026. #it prints a very short message ("RE") to the screen and hangs the computer.
  1027. # x86 bootloader end
  1028. # added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
  1029. # and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
  1030. >0 string RRaA
  1031. >>0x1E4 string rrAa \b, FSInfosector
  1032. #>>0x1FC uleshort =0 SHOULD BE ZERO
  1033. >>>0x1E8 ulelong <0xffffffff \b, %u free clusters
  1034. >>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u
  1035. # updated by Joerg Jenderek at Sep 2007
  1036. >3 ubyte 0
  1037. #no active flag
  1038. >>446 ubyte 0
  1039. # partition 1 not empty
  1040. >>>450 ubyte >0
  1041. # partitions 3,4 empty
  1042. >>>>482 ubyte 0
  1043. >>>>>498 ubyte 0
  1044. # partition 2 ID=0,5,15
  1045. >>>>>>466 ubyte <0x10
  1046. >>>>>>>466 ubyte 0x05 \b, extended partition table
  1047. >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
  1048. >>>>>>>466 ubyte 0x0 \b, extended partition table (last)
  1049. # DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
  1050. >0x200 lelong 0x82564557 \b, BSD disklabel
  1051. # by Joerg Jenderek at Apr 2013
  1052. # Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
  1053. # like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
  1054. 0 name DOS-filename
  1055. # space=0x20 (00100000b) means empty
  1056. >0 ubyte&0xDF >0
  1057. >>0 ubyte x \b%c
  1058. >>>1 ubyte&0xDF >0
  1059. >>>>1 ubyte x \b%c
  1060. >>>>>2 ubyte&0xDF >0
  1061. >>>>>>2 ubyte x \b%c
  1062. >>>>>>>3 ubyte&0xDF >0
  1063. >>>>>>>>3 ubyte x \b%c
  1064. >>>>>>>>>4 ubyte&0xDF >0
  1065. >>>>>>>>>>4 ubyte x \b%c
  1066. >>>>>>>>>>>5 ubyte&0xDF >0
  1067. >>>>>>>>>>>>5 ubyte x \b%c
  1068. >>>>>>>>>>>>>6 ubyte&0xDF >0
  1069. >>>>>>>>>>>>>>6 ubyte x \b%c
  1070. >>>>>>>>>>>>>>>7 ubyte&0xDF >0
  1071. >>>>>>>>>>>>>>>>7 ubyte x \b%c
  1072. # DOS filename extension
  1073. >>8 ubyte&0xDF >0 \b.
  1074. >>>8 ubyte x \b%c
  1075. >>>>9 ubyte&0xDF >0
  1076. >>>>>9 ubyte x \b%c
  1077. >>>>>>10 ubyte&0xDF >0
  1078. >>>>>>>10 ubyte x \b%c
  1079. # Print 2 following DOS filenames from directory entry form
  1080. # like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
  1081. 0 name 2xDOS-filename
  1082. # display 1 space
  1083. >0 ubyte x \b
  1084. >0 use DOS-filename
  1085. >11 ubyte x \b+
  1086. >11 use DOS-filename
  1087. # https://en.wikipedia.org/wiki/Master_boot_record#PTE
  1088. # display standard partition table
  1089. 0 name partition-table
  1090. #>0 ubyte x PARTITION-TABLE
  1091. # test and display 1st til 4th partition table entry
  1092. >0 use partition-entry-test
  1093. >16 use partition-entry-test
  1094. >32 use partition-entry-test
  1095. >48 use partition-entry-test
  1096. # test for entry of partition table
  1097. 0 name partition-entry-test
  1098. # partition type ID > 0
  1099. >4 ubyte >0
  1100. # active flag 0
  1101. >>0 ubyte 0
  1102. >>>0 use partition-entry
  1103. # active flag 0x80, 0x81, ...
  1104. >>0 ubyte >0x7F
  1105. >>>0 use partition-entry
  1106. # Print entry of partition table
  1107. 0 name partition-entry
  1108. # partition type ID > 0
  1109. >4 ubyte >0 \b; partition
  1110. >>64 leshort 0xAA55 1
  1111. >>48 leshort 0xAA55 2
  1112. >>32 leshort 0xAA55 3
  1113. >>16 leshort 0xAA55 4
  1114. >>4 ubyte x : ID=%#x
  1115. >>0 ubyte&0x80 0x80 \b, active
  1116. >>0 ubyte >0x80 %#x
  1117. >>1 ubyte x \b, start-CHS (
  1118. >>1 use partition-chs
  1119. >>5 ubyte x \b), end-CHS (
  1120. >>5 use partition-chs
  1121. >>8 ulelong x \b), startsector %u
  1122. >>12 ulelong x \b, %u sectors
  1123. # Print cylinder,head,sector (CHS) of partition entry
  1124. 0 name partition-chs
  1125. # cylinder
  1126. >1 ubyte x \b0x
  1127. >1 ubyte&0xC0 0x40 \b1
  1128. >1 ubyte&0xC0 0x80 \b2
  1129. >1 ubyte&0xC0 0xC0 \b3
  1130. >2 ubyte x \b%x
  1131. # head
  1132. >0 ubyte x \b,%u
  1133. # sector
  1134. >1 ubyte&0x3F x \b,%u
  1135. # FATX
  1136. 0 string FATX FATX filesystem data
  1137. # romfs filesystems - Juan Cespedes <cespedes@debian.org>
  1138. 0 string -rom1fs- romfs filesystem, version 1
  1139. >8 belong x %d bytes,
  1140. >16 string x named %s.
  1141. # netboot image - Juan Cespedes <cespedes@debian.org>
  1142. 0 lelong 0x1b031336L Netboot image,
  1143. >4 lelong&0xFFFFFF00 0
  1144. >>4 lelong&0x100 0x000 mode 2
  1145. >>4 lelong&0x100 0x100 mode 3
  1146. >4 lelong&0xFFFFFF00 !0 unknown mode
  1147. 0x18b string OS/2 OS/2 Boot Manager
  1148. # updated by Joerg Jenderek at Oct 2008 and Sep 2012
  1149. # https://syslinux.zytor.com/iso.php
  1150. # tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
  1151. # assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
  1152. 0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
  1153. >631 search/689 ISOLINUX\ isolinux Loader
  1154. >>&0 string x (version %-4.4s)
  1155. # https://syslinux.zytor.com/pxe.php
  1156. # assembler instructions: jmp 7C05
  1157. 0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older)
  1158. # assembler instructions: pushfd;pushad
  1159. 0 ulelong 0x60669c66 pxelinux loader
  1160. # assembler instructions: jmp 05
  1161. 0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer)
  1162. # https://syslinux.zytor.com/wiki/index.php/SYSLINUX
  1163. 0 string LDLINUX\ SYS\ SYSLINUX loader
  1164. >12 string x (older version %-4.4s)
  1165. 0 string \r\nSYSLINUX\ SYSLINUX loader
  1166. >11 string x (version %-4.4s)
  1167. # syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
  1168. # assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
  1169. 0 ulelong&0x80909bEB 0x009018EB
  1170. # OEM-ID not always "SYSLINUX"
  1171. >434 search/47 Boot\ failed
  1172. # followed by \r\n\0 or :\
  1173. >>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older)
  1174. >>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9)
  1175. >459 search/30 Boot\ error\r\n\0
  1176. >>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer)
  1177. # SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
  1178. # assembler instructions: mov di,0600h;mov cx,0100h
  1179. 16 search/4 \xbf\x00\x06\xb9\x00\x01
  1180. # to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
  1181. !:strength +36
  1182. >94 search/249 Missing\ operating\ system
  1183. # followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
  1184. # skip Ranish MBR
  1185. >>408 search/4 HD1/\0
  1186. >>408 default x
  1187. >>>250 search/118 \0Operating\ system\ load SYSLINUX MBR
  1188. # followed by "ing " or space
  1189. >>>>292 search/98 error
  1190. >>>>>&0 string \r (version 3.35 or older)
  1191. >>>>>&0 string .\r (version 3.52 or newer)
  1192. >>>>>&0 default x (version 3.36-3.51 )
  1193. >368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR
  1194. >>156 search/10 \0Boot\ partition\ not\ found\r\n
  1195. >>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older)
  1196. >>174 search/10 \0Missing\ OS\r\n
  1197. >>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer)
  1198. # SYSLINUX END
  1199. # NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
  1200. # assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax,
  1201. 0 ubequad 0x31c08ed0bc007c8e
  1202. # mbr_bootsel magic before partition table not reliable with small ipl fragments
  1203. #>444 uleshort 0xb5e1
  1204. >0004 uleshort x
  1205. # ERRorTeXT
  1206. >>181 search/166 Error\ \0\r\n NetBSD mbr
  1207. # NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
  1208. >>>0x1B8 ubelong >0 \b,Serial %#-.8x
  1209. # BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
  1210. >>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector
  1211. # BOOT_EXTENDED definitions contains assembler instructions:
  1212. # xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
  1213. >>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended
  1214. # COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
  1215. >>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO
  1216. # not TERSE_ERROR
  1217. >>>196 search/106 No\ active\ partition\0
  1218. >>>>&0 string Disk\ read\ error\0
  1219. >>>>>&0 string No\ operating\ system\0 \b,verbose
  1220. # not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
  1221. >>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS
  1222. # not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13
  1223. >>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check
  1224. # assembler instructions: movw nametab,bx
  1225. >>>0x26 search/21 \xBB\x94\x07
  1226. # not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
  1227. >>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94
  1228. >>>>>181 search/166 Error\ \0
  1229. # "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
  1230. >>>>>>&3 string x \b,"%s"
  1231. >>>446 use partition-table
  1232. # Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
  1233. # added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
  1234. # assembler instructions: jmp short 0x58;nop;ASCII
  1235. 0 ubequad&0xeb58908000000000 0xeb58900000000000
  1236. # assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
  1237. >(1.b+2) ubequad 0xfa31c08ed88ec08e
  1238. # Error messages at end of code
  1239. >>376 string No\ operating\ system\r\n\0
  1240. >>>398 string Disk\ error\r\n\0FDD\0HDD\0
  1241. >>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr
  1242. # Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/
  1243. # added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
  1244. # for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
  1245. # or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
  1246. 0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC
  1247. # pointer to the data starting with Neil Turton signature string
  1248. >(0x1BC.s) string NDTmbr
  1249. >>&-14 string 1234F\0 Turton mbr (
  1250. # parameters also viewed by install-mbr --list
  1251. >>>(0x1BC.s+7) ubyte x \b%u<=
  1252. >>>(0x1BC.s+9) ubyte x \bVersion<=%u
  1253. #>>>(0x1BC.s+8) ubyte x asm_flag_%x
  1254. >>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix
  1255. # variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode
  1256. >>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk
  1257. #0x1~1,..,0x8~4,0x10~F,0x80~A enabled
  1258. #>>>(0x1BC.s+10) ubyte x \b,flags %#x
  1259. #0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
  1260. #>>>(0x1BC.s+11) ubyte x \b,cfg_def %#x
  1261. # for older versions
  1262. >>>(0x1BC.s+9) ubyte <2
  1263. #>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds
  1264. >>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
  1265. # floppy A: or B:
  1266. >>>>(0x1BC.s+13) ubyte <2 \b,floppy %#x
  1267. >>>>(0x1BC.s+13) ubyte >1
  1268. # 1st hard disc
  1269. #>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive %#x
  1270. # not 1st hard disc
  1271. >>>>>(0x1BC.s+13) ubyte !0x80 \b,drive %#x
  1272. # for version >= 2 maximal timeout can be 65534
  1273. >>>(0x1BC.s+9) ubyte >1
  1274. #>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds
  1275. >>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds
  1276. # floppy A: or B:
  1277. >>>>(0x1BC.s+14) ubyte <2 \b,floppy %#x
  1278. >>>>(0x1BC.s+14) ubyte >1
  1279. # 1st hard disc
  1280. #>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive %#x
  1281. # not 1st hard disc
  1282. >>>>>(0x1BC.s+14) ubyte !0x80 \b,drive %#x
  1283. >>>0 ubyte x \b)
  1284. # added by Joerg Jenderek
  1285. # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
  1286. # grub-1.94/kern/i386/pc/startup.S
  1287. # https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
  1288. # usual values are marked with comments to get only information of strange GRUB loaders
  1289. 0x200 uleshort 0x70EA
  1290. # found only version 3.{1,2}
  1291. >0x206 ubeshort >0x0300
  1292. # GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
  1293. >>0x212 ubyte >0x29
  1294. >>>0x213 ubyte >0x29
  1295. # not iso9660_stage1_5
  1296. #>>>0 ulelong&0x00BE5652 0x00BE5652
  1297. >>>>0x213 ubyte >0x29 GRand Unified Bootloader
  1298. # config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
  1299. >>>>0x217 ubyte 0xFF stage1_5
  1300. >>>>0x217 ubyte <0xFF stage2
  1301. >>>>0x206 ubyte x \b version %u
  1302. >>>>0x207 ubyte x \b.%u
  1303. # module_size for 1.94
  1304. >>>>0x208 ulelong <0xffffff \b, installed partition %u
  1305. #>>>>0x208 ulelong =0xffffff \b, %lu (default)
  1306. >>>>0x208 ulelong >0xffffff \b, installed partition %u
  1307. # GRUB 0.5.95 unofficial
  1308. >>>>0x20C ulelong&0x2E300000 0x2E300000
  1309. # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
  1310. >>>>>0x20C ubyte x \b, identifier %#x
  1311. #>>>>>0x20D ubyte =0 \b, LBA flag %#x (default)
  1312. >>>>>0x20D ubyte >0 \b, LBA flag %#x
  1313. # GRUB version as string
  1314. >>>>>0x20E string >\0 \b, GRUB version %-s
  1315. # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
  1316. >>>>>>0x215 ulong 0xffffffff
  1317. >>>>>>>0x219 string >\0 \b, configuration file %-s
  1318. >>>>>>0x215 ulong !0xffffffff
  1319. >>>>>>>0x215 string >\0 \b, configuration file %-s
  1320. # newer GRUB versions
  1321. >>>>0x20C ulelong&0x2E300000 !0x2E300000
  1322. ##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
  1323. >>>>>0x20C ulelong >0 \b, saved entry %d
  1324. # for 1.94 contains kernel image size
  1325. # for 0.93,0.94,0.96,0.97
  1326. # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
  1327. >>>>>0x210 ubyte x \b, identifier %#x
  1328. # The flag for LBA forcing is in most cases 0
  1329. #>>>>>0x211 ubyte =0 \b, LBA flag %#x (default)
  1330. >>>>>0x211 ubyte >0 \b, LBA flag %#x
  1331. # GRUB version as string
  1332. >>>>>0x212 string >\0 \b, GRUB version %-s
  1333. # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
  1334. >>>>>0x217 ulong 0xffffffff
  1335. >>>>>>0x21b string >\0 \b, configuration file %-s
  1336. >>>>>0x217 ulong !0xffffffff
  1337. >>>>>>0x217 string >\0 \b, configuration file %-s
  1338. # DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
  1339. # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
  1340. # over BIOS parameter block (BPB)
  1341. # https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
  1342. # older drives may use Near JuMP instruction E9 xx xx
  1343. # minimal short forward jump found 0x29 for bootloaders or 0x0
  1344. # maximal short forward jump is 0x7f
  1345. # OEM-ID is empty or contain readable bytes
  1346. 0 ulelong&0x804000E9 0x000000E9
  1347. !:strength +60
  1348. # mtools-3.9.8/msdos.h
  1349. # usual values are marked with comments to get only information of strange FAT systems
  1350. # valid sectorsize must be a power of 2 from 32 to 32768
  1351. >11 uleshort&0x001f 0
  1352. >>11 uleshort <32769
  1353. >>>11 uleshort >31
  1354. >>>>21 ubyte&0xf0 0xF0
  1355. >>>>>0 ubyte 0xEB DOS/MBR boot sector
  1356. >>>>>>1 ubyte x \b, code offset %#x+2
  1357. >>>>>0 ubyte 0xE9
  1358. >>>>>>1 uleshort x \b, code offset %#x+3
  1359. >>>>>3 string >\0 \b, OEM-ID "%-.8s"
  1360. #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
  1361. >>>>>>8 string IHC \b cached by Windows 9M
  1362. >>>>>11 uleshort >512 \b, Bytes/sector %u
  1363. #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
  1364. >>>>>11 uleshort <512 \b, Bytes/sector %u
  1365. >>>>>13 ubyte >1 \b, sectors/cluster %u
  1366. #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
  1367. # for lazy FAT32 implementation like Transcend digital photo frame PF830
  1368. >>>>>82 string/c fat32
  1369. >>>>>>14 uleshort !32 \b, reserved sectors %u
  1370. #>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
  1371. >>>>>82 string/c !fat32
  1372. >>>>>>14 uleshort >1 \b, reserved sectors %u
  1373. #>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
  1374. #>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS)
  1375. >>>>>16 ubyte >2 \b, FATs %u
  1376. #>>>>>16 ubyte =2 \b, FATs %u (usual)
  1377. >>>>>16 ubyte =1 \b, FAT %u
  1378. >>>>>16 ubyte >0
  1379. >>>>>17 uleshort >0 \b, root entries %u
  1380. #>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32)
  1381. >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
  1382. #>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32)
  1383. >>>>>21 ubyte >0xF0 \b, Media descriptor %#x
  1384. #>>>>>21 ubyte =0xF0 \b, Media descriptor %#x (usual floppy)
  1385. >>>>>21 ubyte <0xF0 \b, Media descriptor %#x
  1386. >>>>>22 uleshort >0 \b, sectors/FAT %u
  1387. #>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32)
  1388. >>>>>24 uleshort x \b, sectors/track %u
  1389. >>>>>26 ubyte >2 \b, heads %u
  1390. #>>>>>26 ubyte =2 \b, heads %u (usual floppy)
  1391. >>>>>26 ubyte =1 \b, heads %u
  1392. # valid only for sector sizes with more then 32 Bytes
  1393. >>>>>11 uleshort >32
  1394. # https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
  1395. # skip for values 2,2Ah,70h,73h,DFh
  1396. # and continue for extended boot signature values 0,28h,29h,80h
  1397. >>>>>>38 ubyte&0x56 =0
  1398. >>>>>>>28 ulelong >0 \b, hidden sectors %u
  1399. #>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
  1400. >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
  1401. #>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
  1402. # FAT<32 bit specific
  1403. >>>>>>>82 string/c !fat32
  1404. #>>>>>>>>36 ubyte 0x80 \b, physical drive %#x=0x80 (usual harddisk)
  1405. #>>>>>>>>36 ubyte 0 \b, physical drive %#x=0 (usual floppy)
  1406. >>>>>>>>36 ubyte !0x80
  1407. >>>>>>>>>36 ubyte !0 \b, physical drive %#x
  1408. # VGA-copy CRC or
  1409. # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
  1410. >>>>>>>>37 ubyte >0 \b, reserved %#x
  1411. #>>>>>>>>37 ubyte =0 \b, reserved %#x
  1412. # extended boot signature value is 0x80 for NTFS, 0x28 or 0x29 for others
  1413. >>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (%#x)
  1414. >>>>>>>>38 ubyte&0xFE =0x28
  1415. >>>>>>>>>39 ulelong x \b, serial number %#x
  1416. >>>>>>>>38 ubyte =0x29
  1417. >>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
  1418. >>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
  1419. >>>>>>>>>43 string =NO\ NAME \b, unlabeled
  1420. # there exist some old floppies without word FAT at offset 54
  1421. # a word like "FATnm " is only a hint for a FAT size on nm-bits
  1422. # Normally the number of clusters is calculated by the values of BPP.
  1423. # if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
  1424. # otherwise FAT is 16 bit.
  1425. # http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
  1426. >>>>>82 string/c !fat32
  1427. >>>>>>54 string FAT12 \b, FAT (12 bit)
  1428. >>>>>>54 string FAT16 \b, FAT (16 bit)
  1429. >>>>>>54 default x
  1430. # determinate FAT bit size by media descriptor
  1431. # small floppies implies FAT12
  1432. >>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor)
  1433. # with media descriptor F0h floppy or maybe superfloppy with FAT16
  1434. >>>>>>>21 ubyte =0xF0
  1435. # superfloppy (many sectors) implies FAT16
  1436. >>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors)
  1437. # no superfloppy with media descriptor F0h implies FAT12
  1438. >>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors)
  1439. # with media descriptor F8h floppy or hard disc with FAT12 or FAT16
  1440. >>>>>>>21 ubyte =0xF8
  1441. # 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
  1442. >>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry)
  1443. # hard disc with FAT12 or FAT16
  1444. >>>>>>>>19 default x \b, FAT (1Y bit by descriptor)
  1445. # with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
  1446. >>>>>>>21 ubyte =0xFA
  1447. # 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
  1448. >>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry)
  1449. # RAM disc with FAT12 or FAT16 or Tandy hard disc
  1450. >>>>>>>>19 default x \b, FAT (1Y bit by descriptor)
  1451. # others are floppy
  1452. >>>>>>>21 default x \b, FAT (12 bit by descriptor)
  1453. # FAT32 bit specific
  1454. >>>>>82 string/c fat32 \b, FAT (32 bit)
  1455. >>>>>>36 ulelong x \b, sectors/FAT %u
  1456. # https://technet.microsoft.com/en-us/library/cc977221.aspx
  1457. >>>>>>40 uleshort >0 \b, extension flags %#x
  1458. #>>>>>>40 uleshort =0 \b, extension flags %hu
  1459. >>>>>>42 uleshort >0 \b, fsVersion %u
  1460. #>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
  1461. >>>>>>44 ulelong >2 \b, rootdir cluster %u
  1462. #>>>>>>44 ulelong =2 \b, rootdir cluster %u
  1463. #>>>>>>44 ulelong =1 \b, rootdir cluster %u
  1464. >>>>>>48 uleshort >1 \b, infoSector %u
  1465. #>>>>>>48 uleshort =1 \b, infoSector %u (usual)
  1466. >>>>>>48 uleshort <1 \b, infoSector %u
  1467. # 0 or 0xFFFF instead of usual 6 means no backup sector
  1468. >>>>>>50 uleshort =0xFFFF \b, no Backup boot sector
  1469. >>>>>>50 uleshort =0 \b, no Backup boot sector
  1470. #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
  1471. >>>>>>50 default x
  1472. >>>>>>>50 uleshort x \b, Backup boot sector %u
  1473. # corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
  1474. >>>>>>52 ulelong >0 \b, reserved1 %#x
  1475. >>>>>>56 ulelong >0 \b, reserved2 %#x
  1476. >>>>>>60 ulelong >0 \b, reserved3 %#x
  1477. # same structure as FAT1X
  1478. #>>>>>>64 ubyte =0x80 \b, physical drive %#x=80 (usual harddisk)
  1479. #>>>>>>64 ubyte =0 \b, physical drive %#x=0 (usual floppy)
  1480. >>>>>>64 ubyte !0x80
  1481. >>>>>>>64 ubyte >0 \b, physical drive %#x
  1482. # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
  1483. >>>>>>65 ubyte >0 \b, reserved %#x
  1484. >>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (%#x)
  1485. >>>>>>66 ubyte =0x29
  1486. >>>>>>>67 ulelong x \b, serial number %#x
  1487. >>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
  1488. >>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
  1489. >>>>>>>71 string =NO\ NAME \b, unlabeled
  1490. # additional tests for floppy image added by Joerg Jenderek
  1491. # no fixed disk
  1492. >>>>>21 ubyte !0xF8
  1493. # floppy media with 12 bit FAT
  1494. >>>>>>54 string !FAT16
  1495. # test for FAT after bootsector
  1496. >>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT
  1497. # floppy image
  1498. !:mime application/x-ima
  1499. # NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
  1500. # and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
  1501. # 0 FATs
  1502. >>>>>16 ubyte =0
  1503. # 0 root entries
  1504. >>>>>>17 uleshort =0
  1505. # 0 DOS sectors
  1506. >>>>>>>19 uleshort =0
  1507. # 0 sectors/FAT
  1508. # dos < 4.0 BootSector value found is 0x80
  1509. #38 ubyte =0x80 \b, dos < 4.0 BootSector (%#x)
  1510. >>>>>>>>22 uleshort =0 \b; NTFS
  1511. >>>>>>>>>24 uleshort >0 \b, sectors/track %u
  1512. >>>>>>>>>36 ulelong !0x800080 \b, physical drive %#x
  1513. >>>>>>>>>40 ulequad >0 \b, sectors %lld
  1514. >>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld
  1515. >>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld
  1516. # Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
  1517. # Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
  1518. >>>>>>>>>64 lelong <256
  1519. >>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d
  1520. >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i)
  1521. # Values 0 to 127 represent index block sizes of 0 to 127 clusters.
  1522. # Values 128 to 255 represent index block sizes of 2^(256-N) byte
  1523. >>>>>>>>>68 ulelong <256
  1524. >>>>>>>>>>68 ulelong <128 \b, clusters/index block %d
  1525. #>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d)
  1526. >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i)
  1527. >>>>>>>>>72 ulequad x \b, serial number 0%llx
  1528. >>>>>>>>>80 ulelong >0 \b, checksum %#x
  1529. #>>>>>>>>>80 ulelong =0 \b, checksum %#x=0 (usual)
  1530. # unicode loadername size jump
  1531. >>>>>>>>>(0x200.s*2) ubyte x
  1532. # in next sector loadername terminated by unicode CTRL-D and $
  1533. >>>>>>>>>>&0x1FF ulequad&0x0000FFffFFffFF00 0x0000002400040000 \b; contains
  1534. # if 2nd NTFS sectors is found then assume whole filesystem
  1535. #!:mime application/x-raw-disk-image
  1536. !:ext img/bin/ntfs
  1537. >>>>>>>>>>>0x200 use ntfs-sector2
  1538. # For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019
  1539. # https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
  1540. # unused assembler instructions short JMP y2;NOP;NOP
  1541. 0x056 ulelong&0xFFFF0FFF 0x909002EB NTFS
  1542. #!:mime application/octet-stream
  1543. !:ext bin
  1544. >0 use ntfs-sector2
  1545. # https://memory.dataram.com/products-and-services/software/ramdisk
  1546. # assembler instructions JMP C000;NOP
  1547. 0x056 ulelong 0x9000c0e9 NTFS
  1548. #!:mime application/octet-stream
  1549. !:ext bin
  1550. >0 use ntfs-sector2
  1551. # check for characteristics of second NTFS sector and then display loader name
  1552. 0 name ntfs-sector2
  1553. # number of utf16 characters of loadername
  1554. >0 uleshort <8
  1555. # unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP
  1556. >>0x056 ulelong&0xFF0000FD 0x900000E9
  1557. # loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
  1558. >>>0x002 lestring16 x bootstrap %-5.5s
  1559. # check for 7 character length of loader name like BOOTMGR
  1560. >>>0 uleshort 7
  1561. >>>>0x0c lestring16 x \b%-2.2s
  1562. ### DOS,NTFS boot sectors end
  1563. # ntfsclone-image is a special save format for NTFS volumes,
  1564. # created and restored by the ntfsclone program
  1565. 0 string \0ntfsclone-image ntfsclone image,
  1566. >0x10 byte x version %d.
  1567. >0x11 byte x \b%d,
  1568. >0x12 lelong x cluster size %d,
  1569. >0x16 lequad x device size %lld,
  1570. >0x1e lequad x %lld total clusters,
  1571. >0x26 lequad x %lld clusters in use
  1572. 0 name ffsv1
  1573. >8404 string x last mounted on %s,
  1574. #>9504 ledate x last checked at %s,
  1575. >8224 ledate x last written at %s,
  1576. >8401 byte x clean flag %d,
  1577. >8228 lelong x number of blocks %d,
  1578. >8232 lelong x number of data blocks %d,
  1579. >8236 lelong x number of cylinder groups %d,
  1580. >8240 lelong x block size %d,
  1581. >8244 lelong x fragment size %d,
  1582. >8252 lelong x minimum percentage of free blocks %d,
  1583. >8256 lelong x rotational delay %dms,
  1584. >8260 lelong x disk rotational speed %drps,
  1585. >8320 lelong 0 TIME optimization
  1586. >8320 lelong 1 SPACE optimization
  1587. 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
  1588. >0 use ffsv1
  1589. 9564 belong 0x00011954 Unix Fast File system [v1] (big-endian),
  1590. >7168 belong 0x4c41424c Apple UFS Volume
  1591. >>7186 string x named %s,
  1592. >>7176 belong x volume label version %d,
  1593. >>7180 bedate x created on %s,
  1594. >0 use \^ffsv1
  1595. 0 name ffsv2
  1596. >212 string x last mounted on %s,
  1597. >680 string >\0 volume name %s,
  1598. >1072 leqldate x last written at %s,
  1599. >209 byte x clean flag %d,
  1600. >210 byte x readonly flag %d,
  1601. >1080 lequad x number of blocks %lld,
  1602. >1088 lequad x number of data blocks %lld,
  1603. >44 lelong x number of cylinder groups %d,
  1604. >48 lelong x block size %d,
  1605. >52 lelong x fragment size %d,
  1606. >1196 lelong x average file size %d,
  1607. >1200 lelong x average number of files in dir %d,
  1608. >1104 lequad x pending blocks to free %lld,
  1609. >1112 lelong x pending inodes to free %d,
  1610. >712 lequad x system-wide uuid %0llx,
  1611. >60 lelong x minimum percentage of free blocks %d,
  1612. >128 lelong 0 TIME optimization
  1613. >128 lelong 1 SPACE optimization
  1614. 42332 lelong 0x19012038 Unix Fast File system [v2ea] (little-endian)
  1615. >40960 use ffsv2
  1616. 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  1617. >40960 use ffsv2
  1618. 42332 belong 0x19012038 Unix Fast File system [v2ea] (little-endian)
  1619. >40960 use \^ffsv2
  1620. 42332 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  1621. >40960 use \^ffsv2
  1622. 66908 lelong 0x19012038 Unix Fast File system [v2ea] (little-endian)
  1623. >65536 use ffsv2
  1624. 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  1625. >65536 use ffsv2
  1626. 66908 belong 0x19012038 Unix Fast File system [v2ea] (little-endian)
  1627. >65536 use \^ffsv2
  1628. 66908 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  1629. >65536 use \^ffsv2
  1630. 0 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian),
  1631. >0x90 lelong+1 x volume %d
  1632. >0x94 lelong x (of %d),
  1633. >0x50 string x name %s,
  1634. >0x98 ulelong x version %u,
  1635. >0xa0 ulelong x flags %#x
  1636. 0 ulequad 0x48414d3205172011 HAMMER2 filesystem (little-endian),
  1637. >0x3b byte x volume %d,
  1638. >0x28 ulequad/1073741824 x size %lluGB,
  1639. >0x30 ulelong x version %u,
  1640. >0x34 ulelong x flags %#x
  1641. # ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
  1642. # ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
  1643. # volume label and UUID Russell Coker
  1644. # https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
  1645. 0x438 leshort 0xEF53 Linux
  1646. >0x44c lelong x rev %d
  1647. >0x43e leshort x \b.%d
  1648. # No journal? ext2
  1649. >0x45c lelong ^0x0000004 ext2 filesystem data
  1650. >>0x43a leshort ^0x0000001 (mounted or unclean)
  1651. # Has a journal? ext3 or ext4
  1652. >0x45c lelong &0x0000004
  1653. # and small INCOMPAT?
  1654. >>0x460 lelong <0x0000040
  1655. # and small RO_COMPAT?
  1656. >>>0x464 lelong <0x0000008 ext3 filesystem data
  1657. # else large RO_COMPAT?
  1658. >>>0x464 lelong >0x0000007 ext4 filesystem data
  1659. # else large INCOMPAT?
  1660. >>0x460 lelong >0x000003f ext4 filesystem data
  1661. >0x468 ubelong x \b, UUID=%08x
  1662. >0x46c ubeshort x \b-%04x
  1663. >0x46e ubeshort x \b-%04x
  1664. >0x470 ubeshort x \b-%04x
  1665. >0x472 ubelong x \b-%08x
  1666. >0x476 ubeshort x \b%04x
  1667. >0x478 string >0 \b, volume name "%s"
  1668. # General flags for any ext* fs
  1669. >0x460 lelong &0x0000004 (needs journal recovery)
  1670. >0x43a leshort &0x0000002 (errors)
  1671. # INCOMPAT flags
  1672. >0x460 lelong &0x0000001 (compressed)
  1673. #>0x460 lelong &0x0000002 (filetype)
  1674. #>0x460 lelong &0x0000010 (meta bg)
  1675. >0x460 lelong &0x0000040 (extents)
  1676. >0x460 lelong &0x0000080 (64bit)
  1677. #>0x460 lelong &0x0000100 (mmp)
  1678. #>0x460 lelong &0x0000200 (flex bg)
  1679. # RO_INCOMPAT flags
  1680. #>0x464 lelong &0x0000001 (sparse super)
  1681. >0x464 lelong &0x0000002 (large files)
  1682. >0x464 lelong &0x0000008 (huge files)
  1683. #>0x464 lelong &0x0000010 (gdt checksum)
  1684. #>0x464 lelong &0x0000020 (many subdirs)
  1685. #>0x463 lelong &0x0000040 (extra isize)
  1686. # f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
  1687. 0x400 lelong 0xF2F52010 F2FS filesystem
  1688. >0x46c ubelong x \b, UUID=%08x
  1689. >0x470 ubeshort x \b-%04x
  1690. >0x472 ubeshort x \b-%04x
  1691. >0x474 ubeshort x \b-%04x
  1692. >0x476 ubelong x \b-%08x
  1693. >0x47a ubeshort x \b%04x
  1694. >0x147c lestring16 x \b, volume name "%s"
  1695. # Minix filesystems - Juan Cespedes <cespedes@debian.org>
  1696. 0x410 leshort 0x137f
  1697. !:strength / 2
  1698. >0x402 beshort < 100
  1699. >0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones
  1700. >0x1e string minix \b, bootable
  1701. 0x410 beshort 0x137f
  1702. !:strength / 2
  1703. >0x402 beshort < 100
  1704. >0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones
  1705. >0x1e string minix \b, bootable
  1706. 0x410 leshort 0x138f
  1707. !:strength / 2
  1708. >0x402 beshort < 100
  1709. >0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones
  1710. >0x1e string minix \b, bootable
  1711. 0x410 beshort 0x138f
  1712. !:strength / 2
  1713. >0x402 beshort < 100
  1714. >0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones
  1715. >0x1e string minix \b, bootable
  1716. # Weak Magic: this is $x
  1717. #0x410 leshort 0x2468
  1718. #>0x402 beshort < 100
  1719. #>>0x402 beshort > -1 Minix filesystem, V2, 14 char names
  1720. #>0x1e string minix \b, bootable
  1721. #0x410 beshort 0x2468
  1722. #>0x402 beshort < 100
  1723. #>0x402 beshort > -1 Minix filesystem, V2 (big endian)
  1724. #>0x1e string minix \b, bootable
  1725. #0x410 leshort 0x2478
  1726. #>0x402 beshort < 100
  1727. #>0x402 beshort > -1 Minix filesystem, V2, 30 char names
  1728. #>0x1e string minix \b, bootable
  1729. #0x410 leshort 0x2478
  1730. #>0x402 beshort < 100
  1731. #>0x402 beshort > -1 Minix filesystem, V2, 30 char names
  1732. #>0x1e string minix \b, bootable
  1733. #0x410 beshort 0x2478
  1734. #>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian)
  1735. #>0x1e string minix \b, bootable
  1736. # Weak Magic! this is MD
  1737. #0x418 leshort 0x4d5a
  1738. #>0x402 beshort <100
  1739. #>>0x402 beshort > -1 Minix filesystem, V3, 60 char names
  1740. # SGI disk labels - Nathan Scott <nathans@debian.org>
  1741. 0 belong 0x0BE5A941 SGI disk label (volume header)
  1742. # SGI XFS filesystem - Nathan Scott <nathans@debian.org>
  1743. 0 belong 0x58465342 SGI XFS filesystem data
  1744. >0x4 belong x (blksz %d,
  1745. >0x68 beshort x inosz %d,
  1746. >0x64 beshort ^0x2004 v1 dirs)
  1747. >0x64 beshort &0x2004 v2 dirs)
  1748. ############################################################################
  1749. # Minix-ST kernel floppy
  1750. 0x800 belong 0x46fc2700 Atari-ST Minix kernel image
  1751. # https://en.wikipedia.org/wiki/BIOS_parameter_block
  1752. # floppies with valid BPB and any instruction at beginning
  1753. >19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy
  1754. >19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy
  1755. ############################################################################
  1756. # Hmmm, is this a better way of detecting _standard_ floppy images ?
  1757. 19 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k
  1758. >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
  1759. 19 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k
  1760. >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
  1761. 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
  1762. >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
  1763. 19 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM
  1764. >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
  1765. 19 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs
  1766. >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
  1767. 19 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k
  1768. 19 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k
  1769. # | | | | |
  1770. # | | | | heads
  1771. # | | | sectors/track
  1772. # | | sectors/FAT
  1773. # | media descriptor
  1774. # BPB: sectors
  1775. # Valid media descriptor bytes for MS-DOS:
  1776. #
  1777. # Byte Capacity Media Size and Type
  1778. # -------------------------------------------------
  1779. #
  1780. # F0 2.88 MB 3.5-inch, 2-sided, 36-sector
  1781. # F0 1.44 MB 3.5-inch, 2-sided, 18-sector
  1782. # F9 720K 3.5-inch, 2-sided, 9-sector
  1783. # F9 1.2 MB 5.25-inch, 2-sided, 15-sector
  1784. # FD 360K 5.25-inch, 2-sided, 9-sector
  1785. # FF 320K 5.25-inch, 2-sided, 8-sector
  1786. # FC 180K 5.25-inch, 1-sided, 9-sector
  1787. # FE 160K 5.25-inch, 1-sided, 8-sector
  1788. # FE 250K 8-inch, 1-sided, single-density
  1789. # FD 500K 8-inch, 2-sided, single-density
  1790. # FE 1.2 MB 8-inch, 2-sided, double-density
  1791. # F8 ----- Fixed disk
  1792. #
  1793. # FC xxxK Apricot 70x1x9 boot disk.
  1794. #
  1795. # Originally a bitmap:
  1796. # xxxxxxx0 Not two sided
  1797. # xxxxxxx1 Double sided
  1798. # xxxxxx0x Not 8 SPT
  1799. # xxxxxx1x 8 SPT
  1800. # xxxxx0xx Not Removable drive
  1801. # xxxxx1xx Removable drive
  1802. # 11111xxx Must be one.
  1803. #
  1804. # But now it's rather random:
  1805. # 111111xx Low density disk
  1806. # 00 SS, Not 8 SPT
  1807. # 01 DS, Not 8 SPT
  1808. # 10 SS, 8 SPT
  1809. # 11 DS, 8 SPT
  1810. #
  1811. # 11111001 Double density 3 1/2 floppy disk, high density 5 1/4
  1812. # 11110000 High density 3 1/2 floppy disk
  1813. # 11111000 Hard disk any format
  1814. #
  1815. # all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
  1816. # https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
  1817. # Too Weak.
  1818. #512 ubelong&0xE0ffff00 0xE0ffff00
  1819. # without valid Media descriptor in place of BPB, cases with are done at other places
  1820. #>21 ubyte <0xE5 floppy with old FAT filesystem
  1821. # but valid Media descriptor at begin of FAT
  1822. #>>512 ubyte =0xed 720k
  1823. #>>512 ubyte =0xf0 1440k
  1824. #>>512 ubyte =0xf8 720k
  1825. #>>512 ubyte =0xf9 1220k
  1826. #>>512 ubyte =0xfa 320k
  1827. #>>512 ubyte =0xfb 640k
  1828. #>>512 ubyte =0xfc 180k
  1829. # look like an old DOS directory entry
  1830. #>>>0xA0E ubequad 0
  1831. #>>>>0xA00 ubequad !0
  1832. #!:mime application/x-ima
  1833. #>>512 ubyte =0xfd
  1834. # look for 2nd FAT at different location to distinguish between 360k and 500k
  1835. #>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k
  1836. #>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k
  1837. #>>>0xA0E ubequad 0
  1838. #!:mime application/x-ima
  1839. #>>512 ubyte =0xfe
  1840. #>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k
  1841. #>>>>0x60E ubequad 0
  1842. #>>>>>0x600 ubequad !0
  1843. #!:mime application/x-ima
  1844. #>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k
  1845. #>>512 ubyte =0xff 320k
  1846. #>>>0x60E ubequad 0
  1847. #>>>>0x600 ubequad !0
  1848. #!:mime application/x-ima
  1849. #>>512 ubyte x \b, Media descriptor %#x
  1850. # without x86 jump instruction
  1851. #>>0 ulelong&0x804000E9 !0x000000E9
  1852. # assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
  1853. #>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader
  1854. # IOSYS.COM+MSDOS.COM
  1855. #>>>>0xc4 use 2xDOS-filename
  1856. #>>0 ulelong&0x804000E9 =0x000000E9
  1857. # only x86 short jump instruction found
  1858. #>>>0 ubyte =0xEB
  1859. #>>>>1 ubyte x \b, code offset %#x+2
  1860. # https://thestarman.pcministry.com/DOS/ibm100/Boot.htm
  1861. # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
  1862. #>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader
  1863. # ibmbio.com+ibmdos.com
  1864. #>>>>>0x176 use DOS-filename
  1865. #>>>>>0x181 ubyte x \b+
  1866. #>>>>>0x182 use DOS-filename
  1867. # https://thestarman.pcministry.com/DOS/ibm110/Boot.htm
  1868. # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
  1869. #>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader
  1870. # ibmbio.com+ibmdos.com
  1871. #>>>>>0x18b use DOS-filename
  1872. #>>>>>0x196 ubyte x \b+
  1873. #>>>>>0x197 use DOS-filename
  1874. # https://en.wikipedia.org/wiki/Zenith_Data_Systems
  1875. # assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
  1876. #>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader
  1877. # IO.SYS+MSDOS.SYS
  1878. #>>>>>0x20 use 2xDOS-filename
  1879. # https://en.wikipedia.org/wiki/Corona_Data_Systems
  1880. # assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
  1881. #>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader
  1882. # IO.SYS+MSDOS.SYS
  1883. #>>>>>0x69 use 2xDOS-filename
  1884. # assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
  1885. #>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader
  1886. # defect IO.SYS+MSDOS.SYS ?
  1887. #>>>>>0x162 use 2xDOS-filename
  1888. 0 name cdrom
  1889. >38913 string !NSR0 ISO 9660 CD-ROM filesystem data
  1890. !:mime application/x-iso9660-image
  1891. !:ext iso/iso9660
  1892. >38913 string NSR0 UDF filesystem data
  1893. !:mime application/x-iso9660-image
  1894. !:ext iso/udf
  1895. >>38917 string 1 (version 1.0)
  1896. >>38917 string 2 (version 1.5)
  1897. >>38917 string 3 (version 2.0)
  1898. >>38917 byte >0x33 (unknown version, ID %#X)
  1899. >>38917 byte <0x31 (unknown version, ID %#X)
  1900. # The next line is not necessary because the MBR staff is done looking for boot signature
  1901. >0x1FE leshort 0xAA55 (DOS/MBR boot sector)
  1902. # "application id" which appears to be used as a volume label
  1903. >32808 string/T >\0 '%.32s'
  1904. >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
  1905. 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
  1906. !:mime application/x-iso9660-image
  1907. 32777 string CDROM High Sierra CD-ROM filesystem data
  1908. # "application id" which appears to be used as a volume label
  1909. >32816 string/T >\0 '%.32s'
  1910. # CDROM Filesystems
  1911. # https://en.wikipedia.org/wiki/ISO_9660
  1912. # Modified for UDF by gerardo.cacciari@gmail.com
  1913. 32769 string CD001
  1914. # mime line at that position does not work
  1915. # to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
  1916. #!:strength -11
  1917. # to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
  1918. !:strength +35
  1919. >0 use cdrom
  1920. # URL: https://en.wikipedia.org/wiki/NRG_(file_format)
  1921. # Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/
  1922. # 11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh
  1923. # From: Joerg Jenderek
  1924. # Note: Only for nero disc with once (DAO) type after 300 KB header
  1925. 339969 string CD001 Nero CD image at 0x4B000
  1926. !:mime application/x-nrg
  1927. !:ext nrg
  1928. >307200 use cdrom
  1929. # .cso files
  1930. # Reference: https://pismotec.com/ciso/ciso.h
  1931. # NOTE: There are two other formats with the same magic but
  1932. # completely incompatible specifications:
  1933. # - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
  1934. # - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
  1935. 0 string CISO
  1936. # Other fields are used to determine what type of CISO this is:
  1937. # - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
  1938. # - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
  1939. # - 0x10 == 0x00004000: For >2GB files using maxcso...
  1940. # https://github.com/unknownbrackets/maxcso/issues/26
  1941. # - None of the above: Compact ISO.
  1942. >4 lelong !0
  1943. >>4 lelong !0x200000
  1944. >>>16 lelong !0x800
  1945. >>>>16 lelong !0x4000 Compressed ISO CD image
  1946. # cramfs filesystem - russell@coker.com.au
  1947. 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
  1948. >4 lelong x size %u
  1949. >8 lelong &1 version #2
  1950. >8 lelong &2 sorted_dirs
  1951. >8 lelong &4 hole_support
  1952. >32 lelong x CRC %#x,
  1953. >36 lelong x edition %u,
  1954. >40 lelong x %u blocks,
  1955. >44 lelong x %u files
  1956. 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
  1957. >4 belong x size %u
  1958. >8 belong &1 version #2
  1959. >8 belong &2 sorted_dirs
  1960. >8 belong &4 hole_support
  1961. >32 belong x CRC %#x,
  1962. >36 belong x edition %u,
  1963. >40 belong x %u blocks,
  1964. >44 belong x %u files
  1965. # reiserfs - russell@coker.com.au
  1966. 0x10034 string ReIsErFs ReiserFS V3.5
  1967. 0x10034 string ReIsEr2Fs ReiserFS V3.6
  1968. 0x10034 string ReIsEr3Fs ReiserFS V3.6.19
  1969. >0x1002c leshort x block size %d
  1970. >0x10032 leshort &2 (mounted or unclean)
  1971. >0x10000 lelong x num blocks %d
  1972. >0x10040 lelong 1 tea hash
  1973. >0x10040 lelong 2 yura hash
  1974. >0x10040 lelong 3 r5 hash
  1975. # EST flat binary format (which isn't, but anyway)
  1976. # From: Mark Brown <broonie@sirena.org.uk>
  1977. 0 string ESTFBINR EST flat binary
  1978. # Aculab VoIP firmware
  1979. # From: Mark Brown <broonie@sirena.org.uk>
  1980. 0 string VoIP\ Startup\ and Aculab VoIP firmware
  1981. >35 string x format %s
  1982. # From: Mark Brown <broonie@sirena.org.uk> [old]
  1983. # From: Behan Webster <behanw@websterwood.com>
  1984. 0 belong 0x27051956 u-boot legacy uImage,
  1985. >32 string x %s,
  1986. >28 byte 0 Invalid os/
  1987. >28 byte 1 OpenBSD/
  1988. >28 byte 2 NetBSD/
  1989. >28 byte 3 FreeBSD/
  1990. >28 byte 4 4.4BSD/
  1991. >28 byte 5 Linux/
  1992. >28 byte 6 SVR4/
  1993. >28 byte 7 Esix/
  1994. >28 byte 8 Solaris/
  1995. >28 byte 9 Irix/
  1996. >28 byte 10 SCO/
  1997. >28 byte 11 Dell/
  1998. >28 byte 12 NCR/
  1999. >28 byte 13 LynxOS/
  2000. >28 byte 14 VxWorks/
  2001. >28 byte 15 pSOS/
  2002. >28 byte 16 QNX/
  2003. >28 byte 17 Firmware/
  2004. >28 byte 18 RTEMS/
  2005. >28 byte 19 ARTOS/
  2006. >28 byte 20 Unity OS/
  2007. >28 byte 21 INTEGRITY/
  2008. >29 byte 0 \bInvalid CPU,
  2009. >29 byte 1 \bAlpha,
  2010. >29 byte 2 \bARM,
  2011. >29 byte 3 \bIntel x86,
  2012. >29 byte 4 \bIA64,
  2013. >29 byte 5 \bMIPS,
  2014. >29 byte 6 \bMIPS 64-bit,
  2015. >29 byte 7 \bPowerPC,
  2016. >29 byte 8 \bIBM S390,
  2017. >29 byte 9 \bSuperH,
  2018. >29 byte 10 \bSparc,
  2019. >29 byte 11 \bSparc 64-bit,
  2020. >29 byte 12 \bM68K,
  2021. >29 byte 13 \bNios-32,
  2022. >29 byte 14 \bMicroBlaze,
  2023. >29 byte 15 \bNios-II,
  2024. >29 byte 16 \bBlackfin,
  2025. >29 byte 17 \bAVR32,
  2026. >29 byte 18 \bSTMicroelectronics ST200,
  2027. >29 byte 19 \bSandbox architecture,
  2028. >29 byte 20 \bANDES Technology NDS32,
  2029. >29 byte 21 \bOpenRISC 1000,
  2030. >29 byte 22 \bARM 64-bit,
  2031. >29 byte 23 \bDesignWare ARC,
  2032. >29 byte 24 \bx86_64,
  2033. >29 byte 25 \bXtensa,
  2034. >29 byte 26 \bRISC-V,
  2035. >30 byte 0 Invalid Image
  2036. >30 byte 1 Standalone Program
  2037. >30 byte 2 OS Kernel Image
  2038. >30 byte 3 RAMDisk Image
  2039. >30 byte 4 Multi-File Image
  2040. >30 byte 5 Firmware Image
  2041. >30 byte 6 Script File
  2042. >30 byte 7 Filesystem Image (any type)
  2043. >30 byte 8 Binary Flat Device Tree BLOB
  2044. >31 byte 0 (Not compressed),
  2045. >31 byte 1 (gzip),
  2046. >31 byte 2 (bzip2),
  2047. >31 byte 3 (lzma),
  2048. >12 belong x %d bytes,
  2049. >8 bedate x %s,
  2050. >16 belong x Load Address: %#08X,
  2051. >20 belong x Entry Point: %#08X,
  2052. >4 belong x Header CRC: %#08X,
  2053. >24 belong x Data CRC: %#08X
  2054. # JFFS2 file system
  2055. 0 leshort 0x1984 Linux old jffs2 filesystem data little endian
  2056. 0 beshort 0x1984 Linux old jffs2 filesystem data big endian
  2057. 0 leshort 0x1985 Linux jffs2 filesystem data little endian
  2058. 0 beshort 0x1985 Linux jffs2 filesystem data big endian
  2059. # Squashfs
  2060. 0 name squashfs
  2061. >28 beshort x version %d.
  2062. >30 beshort x \b%d,
  2063. >20 beshort 0 uncompressed,
  2064. >20 beshort 1 zlib
  2065. >20 beshort 2 lzma
  2066. >20 beshort 3 lzo
  2067. >20 beshort 4 xz
  2068. >20 beshort 5 lz4
  2069. >20 beshort 6 zstd
  2070. >20 beshort >0 compressed,
  2071. >28 beshort <3
  2072. >>8 belong x %d bytes,
  2073. >28 beshort >2
  2074. >>28 beshort <4
  2075. >>>63 bequad x %lld bytes,
  2076. >>28 beshort >3
  2077. >>>40 bequad x %lld bytes,
  2078. #>>67 belong x %d bytes,
  2079. >4 belong x %d inodes,
  2080. >28 beshort <2
  2081. >>32 beshort x blocksize: %d bytes,
  2082. >28 beshort >1
  2083. >>28 beshort <4
  2084. >>>51 belong x blocksize: %d bytes,
  2085. >>28 beshort >3
  2086. >>>12 belong x blocksize: %d bytes,
  2087. >28 beshort <4
  2088. >>39 bedate x created: %s
  2089. >28 beshort >3
  2090. >>8 bedate x created: %s
  2091. 0 string sqsh Squashfs filesystem, big endian,
  2092. >0 use squashfs
  2093. 0 string hsqs Squashfs filesystem, little endian,
  2094. >0 use \^squashfs
  2095. # AFS Dump Magic
  2096. # From: Ty Sarna <tsarna@sarna.org>
  2097. 0 string \x01\xb3\xa1\x13\x22 AFS Dump
  2098. >&0 belong x (v%d)
  2099. >>&0 byte 0x76
  2100. >>>&0 belong x Vol %d,
  2101. >>>>&0 byte 0x6e
  2102. >>>>>&0 string x %s
  2103. >>>>>>&1 byte 0x74
  2104. >>>>>>>&0 beshort 2
  2105. >>>>>>>>&4 bedate x on: %s
  2106. >>>>>>>>&0 bedate =0 full dump
  2107. >>>>>>>>&0 bedate !0 incremental since: %s
  2108. #----------------------------------------------------------
  2109. #delta ISO Daniel Novotny (dnovotny@redhat.com)
  2110. 0 string DISO Delta ISO data
  2111. !:strength +50
  2112. >4 belong x version %d
  2113. # VMS backup savesets - gerardo.cacciari@gmail.com
  2114. #
  2115. 4 string \x01\x00\x01\x00\x01\x00
  2116. >(0.s+16) string \x01\x01
  2117. >>&(&0.b+8) byte 0x42 OpenVMS backup saveset data
  2118. >>>40 lelong x (block size %d,
  2119. >>>49 string >\0 original name '%s',
  2120. >>>2 short 1024 VAX generated)
  2121. >>>2 short 2048 AXP generated)
  2122. >>>2 short 4096 I64 generated)
  2123. # Summary: Oracle Clustered Filesystem
  2124. # Created by: Aaron Botsis <redhat@digitalmafia.org>
  2125. 8 string OracleCFS Oracle Clustered Filesystem,
  2126. >4 long x rev %d
  2127. >0 long x \b.%d,
  2128. >560 string x label: %.64s,
  2129. >136 string x mountpoint: %.128s
  2130. # Summary: Oracle ASM tagged volume
  2131. # Created by: Aaron Botsis <redhat@digitalmafia.org>
  2132. 32 string ORCLDISK Oracle ASM Volume,
  2133. >40 string x Disk Name: %0.12s
  2134. 32 string ORCLCLRD Oracle ASM Volume (cleared),
  2135. >40 string x Disk Name: %0.12s
  2136. # Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
  2137. 8 string OracleCFS Oracle Clustered Filesystem,
  2138. >4 long x rev %d
  2139. >0 long x \b.%d,
  2140. >560 string x label: %.64s,
  2141. >136 string x mountpoint: %.128s
  2142. # Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
  2143. 32 string ORCLDISK Oracle ASM Volume,
  2144. >40 string x Disk Name: %0.12s
  2145. 32 string ORCLCLRD Oracle ASM Volume (cleared),
  2146. >40 string x Disk Name: %0.12s
  2147. # Compaq/HP RILOE floppy image
  2148. # From: Dirk Jagdmann <doj@cubic.org>
  2149. 0 string CPQRFBLO Compaq/HP RILOE floppy image
  2150. #------------------------------------------------------------------------------
  2151. # Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
  2152. # These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
  2153. # which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
  2154. #
  2155. 1008 string DECFILE11 Files-11 On-Disk Structure
  2156. >525 byte x (ODS-%d);
  2157. >1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system;
  2158. >1017 string B
  2159. >>525 byte 2 VAX/VMS or OpenVMS file system;
  2160. >>525 byte 5 OpenVMS Alpha or Itanium file system;
  2161. >984 string x volume label is '%-12.12s'
  2162. # From: Thomas Klausner <wiz@NetBSD.org>
  2163. # https://filext.com/file-extension/DAA
  2164. # describes the daa file format. The magic would be:
  2165. 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive
  2166. # From Albert Cahalan <acahalan@gmail.com>
  2167. # really le32 operation,destination,payloadsize (but quite predictable)
  2168. # 01 00 00 00 00 00 00 c0 00 02 00 00
  2169. 0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware
  2170. # From Eric Sandeen
  2171. # GFS2
  2172. 0x10000 belong 0x01161970
  2173. >0x10018 belong 0x0000051d GFS1 Filesystem
  2174. >>0x10024 belong x (blocksize %d,
  2175. >>0x10060 string >\0 lockproto %s)
  2176. >0x10018 belong 0x00000709 GFS2 Filesystem
  2177. >>0x10024 belong x (blocksize %d,
  2178. >>0x10060 string >\0 lockproto %s)
  2179. # Russell Coker <russell@coker.com.au>
  2180. 0x10040 string _BHRfS_M BTRFS Filesystem
  2181. >0x1012b string >\0 label "%s",
  2182. >0x10090 lelong x sectorsize %d,
  2183. >0x10094 lelong x nodesize %d,
  2184. >0x10098 lelong x leafsize %d,
  2185. >0x10020 ubelong x UUID=%08x-
  2186. >0x10024 ubeshort x \b%04x-
  2187. >0x10026 ubeshort x \b%04x-
  2188. >0x10028 ubeshort x \b%04x-
  2189. >0x1002a ubeshort x \b%04x
  2190. >0x1002c ubelong x \b%08x,
  2191. >0x10078 lequad x %lld/
  2192. >0x10070 lequad x \b%lld bytes used,
  2193. >0x10088 lequad x %lld devices
  2194. 0 string btrfs-stream BTRFS stream file
  2195. # dvdisaster's .ecc
  2196. # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
  2197. 0 string *dvdisaster* dvdisaster error correction file
  2198. # xfs metadump image
  2199. # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
  2200. # but can we do the << ? For now it's always 512 (0x200) anyway.
  2201. 0 string XFSM
  2202. >0x200 string XFSB XFS filesystem metadump image
  2203. # Type: CROM filesystem
  2204. # From: Werner Fink <werner@suse.de>
  2205. 0 string CROMFS CROMFS
  2206. >6 string >\0 \b version %2.2s,
  2207. >8 ulequad >0 \b block data at %lld,
  2208. >16 ulequad >0 \b fblock table at %lld,
  2209. >24 ulequad >0 \b inode table at %lld,
  2210. >32 ulequad >0 \b root at %lld,
  2211. >40 ulelong >0 \b fblock size = %d,
  2212. >44 ulelong >0 \b block size = %d,
  2213. >48 ulequad >0 \b bytes = %lld
  2214. # Type: xfs metadump image
  2215. # From: Daniel Novotny <dnovotny@redhat.com>
  2216. # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
  2217. # but can we do the << ? For now it's always 512 (0x200) anyway.
  2218. 0 string XFSM
  2219. >0x200 string XFSB XFS filesystem metadump image
  2220. # Type: delta ISO
  2221. # From: Daniel Novotny <dnovotny@redhat.com>
  2222. 0 string DISO Delta ISO data,
  2223. >4 belong x version %d
  2224. # JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
  2225. # See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
  2226. # From: Adam Buchbinder <adam.buchbinder@gmail.com>
  2227. 0x8000 string JFS1
  2228. # Because it's text-only magic, check a binary value (version) to be sure.
  2229. # Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
  2230. # mountable.
  2231. >&0 lelong <3 JFS2 filesystem image
  2232. # Label is followed by a UUID; we have to limit string length to avoid
  2233. # appending the UUID in the case of a 16-byte label.
  2234. >>&144 regex [\x20-\x7E]{1,16} (label "%s")
  2235. >>&0 lequad x \b, %lld blocks
  2236. >>&8 lelong x \b, blocksize %d
  2237. >>&32 lelong&0x00000006 >0 (dirty)
  2238. >>&36 lelong >0 (compressed)
  2239. # LFS
  2240. 0 lelong 0x070162 LFS filesystem image
  2241. >4 lelong 1 version 1,
  2242. >>8 lelong x \b blocks %u,
  2243. >>12 lelong x \b blocks per segment %u,
  2244. >4 lelong 2 version 2,
  2245. >>8 lelong x \b fragments %u,
  2246. >>12 lelong x \b bytes per segment %u,
  2247. >16 lelong x \b disk blocks %u,
  2248. >20 lelong x \b block size %u,
  2249. >24 lelong x \b fragment size %u,
  2250. >28 lelong x \b fragments per block %u,
  2251. >32 lelong x \b start for free list %u,
  2252. >36 lelong x \b number of free blocks %d,
  2253. >40 lelong x \b number of files %u,
  2254. >44 lelong x \b blocks available for writing %d,
  2255. >48 lelong x \b inodes in cache %d,
  2256. >52 lelong x \b inode file disk address %#x,
  2257. >56 lelong x \b inode file inode number %u,
  2258. >60 lelong x \b address of last segment written %#x,
  2259. >64 lelong x \b address of next segment to write %#x,
  2260. >68 lelong x \b address of current segment written %#x
  2261. 0 string td\000 floppy image data (TeleDisk, compressed)
  2262. 0 string TD\000 floppy image data (TeleDisk)
  2263. 0 string CQ\024 floppy image data (CopyQM,
  2264. >16 leshort x %d sectors,
  2265. >18 leshort x %d heads.)
  2266. 0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk)
  2267. # URL: http://fileformats.archiveteam.org/wiki/LoadDskF/SaveDskF
  2268. # Update: Joerg Jenderek
  2269. # Note: called "IBM SKF disk image" by TrID
  2270. # verfied by 7-Zip `7z l -tFAT -slt *.dsk` and
  2271. # `deark -l -m loaddskf 06200D19.DSK`
  2272. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf-old.trid.xml
  2273. 0 beshort 0xAA58
  2274. >0 use SaveDskF
  2275. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf.trid.xml
  2276. 0 beshort 0xAA59
  2277. >0 use SaveDskF
  2278. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf-comp.trid.xml
  2279. 0 beshort 0xAA5A
  2280. # skip foo by additional check for unused upper byte of media type in SaveDskF header
  2281. #>3 ubyte =0
  2282. # skip bar by additional check for valid "low" number of heads in SaveDskF header
  2283. #>>26 uleshort <3
  2284. # skip foo by additional check for unused double word field in SaveDskF header
  2285. #>>>30 long =0
  2286. #>>>>0 use SaveDskF
  2287. >0 use SaveDskF
  2288. # display information about IBM SaveDskF floppy disk images
  2289. 0 name SaveDskF
  2290. # SaveDskF magic
  2291. >0 beshort x floppy image data (IBM SaveDskF
  2292. #!:mime application/octet-stream
  2293. !:mime application/x-ibm-dsk
  2294. !:ext dsk
  2295. # also suffix with digit (1dk .2dk ...); NO example FOUND!
  2296. #!:ext dsk/1dk/2dk
  2297. >1 ubyte =0x58 \b, old)
  2298. >1 ubyte =0x59 \b)
  2299. >1 ubyte =0x5A \b, compressed)
  2300. # media type; the first byte of the FAT like: 0xF0 (usual floppy) 0xF9 0xFE
  2301. # https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system
  2302. >2 ubyte !0xF0 \b, Media descriptor %#x
  2303. # upper byte of media type is not used; so this seems to be nil
  2304. >3 ubyte !0 \b, upper byte of media type %#x
  2305. # sector size in bytes as in the BIOS parameter block like: 512 ; SAVEDSKF.EXE with other sizes produce garbage images
  2306. >4 uleshort !512 \b, Bytes/sector %u
  2307. # cluster mask; number of sectors per cluster, minus 1
  2308. >6 uleshort+1 >1 \b, sectors/cluster %u
  2309. #>6 uleshort+1 x \b, sectors/cluster %u
  2310. # cluster shift; log2(cluster size / sector size) like: 0~1=ClusterSize/SectorSize
  2311. >7 ubyte >0 \b, cluster shift %u
  2312. #>7 ubyte x \b, cluster shift %u
  2313. # reserved sectors; as in the BIOS parameter block like: 1 256 (2M256R-K.DSK)
  2314. >8 uleshort >1 \b, reserved sectors %u
  2315. #>8 uleshort x \b, reserved sectors %u
  2316. # FAT copies; as in the BIOS parameter block like: 2 (usual) 1 (2-NK.DSK)
  2317. >10 ubyte !2 \b, FAT
  2318. # plural s
  2319. >>10 ubyte >1 \bs
  2320. >>10 ubyte x %u
  2321. # root directory entries; as in the BIOS parameter block like: 224 (usual) 64 (H1-NK.DSK) 4096 (2-NK.DSK)
  2322. >11 uleshort !224 \b, root entries %u
  2323. # sector number of first cluster (count sectors used by boot sector, FATs and root directory) like: 7 10 29 33 288
  2324. >13 uleshort !33 \b, 1st cluster at sector %u
  2325. # number of clusters in image; empty clusters at the end are not saved and counted like: 2372 2848
  2326. >15 uleshort x \b, %u clusters
  2327. # sectors/FAT; as in the BIOS parameter block like: 1 (H1-NK.DSK) 7 9
  2328. >17 ubyte !9 \b, sectors/FAT %u
  2329. # sector number of root directory (ie, count of sectors used by boot sector and FATs) like: 3 (H1-NK.DSK) 9 10 15 19 274 (2M256R-K.DSK)
  2330. >18 uleshort !19 \b, root directory at sector %u
  2331. # checksum; sum of all bytes in the file
  2332. >20 ulelong x \b, checksum %#8.8x
  2333. # cylinders; number of cylinders like: 40 80
  2334. >24 uleshort !80 \b, %u cylinders
  2335. #>24 uleshort x \b, %u cylinders
  2336. # heads; number of heads as in the BIOS parameter block like: 1 (H1-NK.DSK) 2
  2337. >26 uleshort !2 \b, heads %u
  2338. #>26 uleshort x \b, heads %u
  2339. # sectors/track; number of sectors per track as in the BIOS parameter block like: 8 15 18 36
  2340. >28 uleshort !18 \b, sectors/track %u
  2341. #>28 uleshort x \b, sectors/track %u
  2342. # unused double word field seems to be always like: 0
  2343. >30 ulelong !0 \b, at 0x1E %#x
  2344. # number of sectors in images like: 1017 2786 2880
  2345. >34 uleshort x \b, sectors %u
  2346. # if string is "printable" it can be a real comment
  2347. >(36.s) ubyte !0x00
  2348. # if 1st sector is far enough away (> 0x29) then there is space for comment part
  2349. >>38 uleshort >41
  2350. # offset to comment string like: 28h=40
  2351. >>>36 uleshort x \b, at %#x
  2352. # comment string terminated with \r\n\0
  2353. >>>(36.s) string x "%s"
  2354. # offset to the first sector like: 0 (If this is 0, assume it is 0x200) 29h=41 (DISPLAY3.DSK) 31h 43h 45h 46h 48h 50h 200h=512
  2355. >38 uleshort !0 \b, 1st sector at %#x
  2356. # FOR DEBUGGING!
  2357. #>(38.s) ubelong x SECTOR CONTENT %x
  2358. # not compressed floppy image implies readable DOS boot sector inside image
  2359. >>1 ubyte !0x5A
  2360. # when not compressed it is readable as DOS boot sector via ./filesystems
  2361. #>>>(38.s) indirect x \b; contains
  2362. >38 uleshort =0 \b, 1st sector at 0x200 (0)
  2363. # maybe standard DOS boot sector; NO example FOUND HERE!
  2364. #>>0x200 indirect x \b; contains
  2365. 0 string \074CPM_Disk\076 disk image data (YAZE)
  2366. # From: Joerg Jenderek
  2367. # URL: https://en.wikipedia.org/wiki/Central_Point_Software#cite_note-6
  2368. # Reference: https://www.robcraig.com/download/transcopy-5-x-file-format
  2369. # https://www.robcraig.com/download/transcopy-file-format-by-gene-thompson
  2370. # http://mark0.net/download/triddefs_xml.7z/defs/t/tc-transcopy.trid.xml
  2371. # TransCopy signature
  2372. 0 beshort 0x5AA5
  2373. # skip Intel serial flash ROM with invalid 0 disk sides handled by ./intel
  2374. >0x103 ubyte !0
  2375. # skip Intel serial flash ROM with unlikely "high" start cylinder 100 handled by ./intel
  2376. #>>0x101 ubyte <100 VALID_START_CYLINDER
  2377. # skip Intel serial flash ROM with unlikely description handled by ./intel
  2378. #>>>2 beshort !0xF00f VALID_DESCRIPTION
  2379. # skip Intel serial flash ROM with invalid disk types 89h 88h handled by ./intel
  2380. #>>>>0x100 byte !0x89 VALID_DISK_TYPE
  2381. >>0 use tc-floppy
  2382. # display information of Central Point Software (CPS) Option Board TransCopy floppy image
  2383. 0 name tc-floppy
  2384. >0 beshort x TransCopy disk image
  2385. #!:mime application/octet-stream
  2386. !:mime application/x-floppy-image-tc
  2387. # like: disk04.tc VOCALC2.TC WIZ5_A.tc WIZ2_720.IMG
  2388. !:ext tc/img
  2389. # 1st description (optional 0-terminated maximal 32) like:
  2390. # "Project Workbench 2.20" "Visi On Calc" "Wizardry V Disk 1 of 3"
  2391. >2 string >\0 %.32s
  2392. # 2nd desc. (optional 0-terminated maximal 32) like:
  2393. # "(1988)." "Advanced - Utility" 'Program Disk 2"
  2394. >0x22 string >\0 "%.32s"
  2395. # Looks like ascii (like MESSAGES) formatted with attribute bytes (190)?
  2396. # not needed for disk copy
  2397. #>>0x42 string x '%.190s'
  2398. #>>0x88 lestring16 x "%.8s"
  2399. # disktype: 2~MFM High Density 3~MFM Double Density 4~Apple II GCR 5~FM Single Density
  2400. # 6~Commodore GCR 7~MFM Double Density 8~Commodore Amiga Ch~Atari FM FFh~Unknown
  2401. >0x100 ubyte !0xFF \b, disk type %u
  2402. # StartingCylinder like: 0
  2403. >0x101 ubyte x \b, cylinder
  2404. >0x101 ubyte !0 start=%u
  2405. # EndingCylinder like: 40 (often) 41 79
  2406. >0x102 ubyte x end=%u
  2407. # NumberOfSides like: 2
  2408. >0x103 ubyte !2 \b, %u sides
  2409. # TrackIncrement like: 1
  2410. >0x104 ubyte !1 \b, track increment %u
  2411. # TrackPosTbl Track skew
  2412. #>0x105 ubequad x \b, Track skew %#16.16llx
  2413. # TrackOffsTbl
  2414. #>0x305 ubequad x \b, TrackOffsTbl %#16.16llx
  2415. # TrackLngthTbl
  2416. #>0x505 ubequad x \b, TrackLngthTbl %#16.16llx
  2417. # TrackTypeTable
  2418. #>0x705 ubequad x \b, TrackTypeTable %#16.16llx
  2419. # Address mark timing
  2420. #>0x905 ubequad x \b, Address mark timing %#16.16llx
  2421. # Track fragment
  2422. #>0x2905 ubequad !0 \b, Track fragment %#16.16llx
  2423. # Track data
  2424. #>0x4000 ubequad !0 \b, Track data %#16.16llx
  2425. # ReFS
  2426. # Richard W.M. Jones <rjones@redhat.com>
  2427. 0 string \0\0\0ReFS\0 ReFS filesystem image
  2428. # EFW encase image file format:
  2429. # Gregoire Passault
  2430. # http://www.forensicswiki.org/wiki/Encase_image_file_format
  2431. 0 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format
  2432. # UBIfs
  2433. # Linux kernel sources: fs/ubifs/ubifs-media.h
  2434. 0 lelong 0x06101831
  2435. >0x16 leshort 0 UBIfs image
  2436. >0x08 lequad x \b, sequence number %llu
  2437. >0x10 leshort x \b, length %u
  2438. >0x04 lelong x \b, CRC %#08x
  2439. 0 lelong 0x23494255
  2440. >0x04 leshort <2
  2441. >0x05 string \0\0\0
  2442. >0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
  2443. >0x04 leshort x UBI image, version %u
  2444. # NEC PC-88 2D disk image
  2445. # From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
  2446. 0x20 ulelong&0xFFFFFEFF 0x2A0
  2447. >0x10 string \0\0\0\0\0\0\0\0\0\0
  2448. >>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
  2449. >>>0x1A ubyte&0xEF 0
  2450. >>>>0x1B ubyte&0x8F 0
  2451. >>>>>0x1B ubyte&70 <0x40
  2452. >>>>>>0x1C ulelong >0x21
  2453. >>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s
  2454. >>>>>>>>0x1B ubyte 0 \b, media=2D
  2455. >>>>>>>>0x1B ubyte 0x10 \b, media=2DD
  2456. >>>>>>>>0x1B ubyte 0x20 \b, media=2HD
  2457. >>>>>>>>0x1B ubyte 0x30 \b, media=1D
  2458. >>>>>>>>0x1B ubyte 0x40 \b, media=1DD
  2459. >>>>>>>>0x1A ubyte 0x10 \b, write-protected
  2460. # HDD Raw Copy Tool disk image, file extension: .imgc
  2461. # From Benjamin Vanheuverzwijn <bvanheu@gmail.com>
  2462. 0 pstring HDD\ Raw\ Copy\ Tool %s
  2463. >0x100 pstring x %s
  2464. >0x200 pstring x - HD model: %s
  2465. #>0x300 pstring x unknown %s
  2466. >0x400 pstring x serial: %s
  2467. #>0x500 pstring x unknown: %s
  2468. !:ext imgc
  2469. # http://martin.hinner.info/fs/bfs/bfs-structure.html
  2470. 0 lelong 0x1BADFACE SCO UnixWare BFS filesystem
  2471. # https://arstechnica.com/information-technology/2018/07/the-beos-filesystem/
  2472. 32 lelong 0x42465331 BE/OS BFS1 filesystem
  2473. >36 lelong x \b, byte order %d
  2474. >40 lelong x \b, block size %d
  2475. >44 lelong x \b, block shift %d
  2476. >48 lequad x \b, total blocks %lld
  2477. >56 lequad x \b, used blocks %lld
  2478. 0 name next
  2479. >0 lelong x \b, size %d
  2480. >4 string x \b, label %s
  2481. # https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-44.3\
  2482. # /IONeXTPartitionScheme.h
  2483. 0 string NeXT NeXT version 1 disklabel
  2484. >12 use next
  2485. 0 string dlV1 NeXT version 2 disklabel
  2486. >12 use next
  2487. 0 string dlV2 NeXT version 3 disklabel
  2488. >12 use next
  2489. # bcachefs
  2490. # From: Thomas Weißschuh <thomas@t-8ch.de>
  2491. 0 name bcachefs-uuid
  2492. >0 ubelong x \b%08x
  2493. >4 ubeshort x \b-%04x
  2494. >6 ubeshort x \b-%04x
  2495. >8 ubeshort x \b-%04x
  2496. >10 ubelong x \b-%08x
  2497. >14 ubeshort x \b%04x
  2498. 0 name bcachefs bcachefs
  2499. >0x68 lequad 8 \b, UUID=
  2500. >>0x38 use bcachefs-uuid
  2501. >>0x48 string >0 \b, label "%.32s"
  2502. >>0x10 uleshort x \b, version %u
  2503. >>0x12 uleshort x \b, min version %u
  2504. >>0x7a byte x \b, device %d
  2505. # assumes the first field is the members field
  2506. >>0x2f4 ulelong 0x01 \b/UUID=
  2507. >>>0x2f0 default x
  2508. >>>&(0x07a.b*56) use bcachefs-uuid
  2509. >>0x07b byte x \b, %d devices
  2510. >>0x090 byte ^0x02 \b (unclean)
  2511. 0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81
  2512. >0x1000 use bcachefs
  2513. 0x1018 string \xc6\x85\x73\xf6\x66\xce\x90\xa9\xd9\x6a\x60\xcf\x80\x3d\xf7\xef
  2514. >0x1000 use bcachefs
  2515. # EROFS
  2516. # https://kernel.googlesource.com/pub/scm/linux/kernel/git/xiang/erofs-utils/\
  2517. # +/refs/heads/experimental/include/erofs_fs.h#12
  2518. 1024 lelong 0xE0F5E1E2 EROFS filesystem
  2519. #>1028 lelong x \b, checksum=%#x
  2520. >1032 lelong >0 \b, compat:
  2521. >>1032 lelong &1 SB_CHKSUM
  2522. >>1032 lelong &2 MTIME
  2523. >1036 byte x \b, blocksize=%u
  2524. >1037 byte x \b, exslots=%u
  2525. #>1038 leshort x \b, root_nid=%d
  2526. #>1040 lequad x \b, inodes=%ld
  2527. #>1048 leldate x \b, build_time=%s
  2528. #>1056 lelong x \b.%d
  2529. #>1060 lelong x \b, blocks=%d
  2530. #>1064 lelong x \b, metadata@%#x
  2531. #>1068 lelong x \b, xattr@%#x
  2532. >1072 guid x \b, uuid=%s
  2533. >1088 string >0 \b, name=%s
  2534. >1104 lelong >0 \b, incompat:
  2535. >>1104 lelong &1 LZ4_0PADDING
  2536. >>1104 lelong &2 BIG_PCLUSTER
  2537. >>1104 lelong &4 CHUNKED_FILE
  2538. >>1104 lelong &8 DEVICE_TABLE
  2539. >>1104 lelong &16 ZTAILPACKING
  2540. # YAFFS
  2541. # The layout itself is undocumented, determined by the memory layout of the
  2542. # reference implementation. This signature is derived from the
  2543. # reference implementation code and generated test cases
  2544. # We recognize the start of an object header defined by yaffs_obj_hdr:
  2545. # (Note the values being encoded depending on platform endianess)
  2546. # u32 type /* enum yaffs_obj_type, valid 1-5 */
  2547. # u32 parent_obj_id; /* 1 for root objects we recognize */
  2548. # u16 sum_no_longer_used; /* checksum of name. Not used by YAFFS and memset to 0xFF */
  2549. # YCHAR name[YAFFS_MAX_NAME_LENGTH + 1];
  2550. # mkyaffsimage always writes a root directory with empty name, then processing the target directory contents
  2551. # mkyaffs2image directly proceeds to writing entries with the appropriate u32 YAFFS_OBJECT_TYPE (1-5 valid), each with parent id 1
  2552. 0 name yaffs
  2553. >0 ulelong 1 \b, type file
  2554. >0 ulelong 2 \b, type symlink
  2555. >0 ulelong 3 \b, type root or directory
  2556. >0 ulelong 4 \b, type hardlink
  2557. >0 ulelong 5 \b, type special
  2558. >0xA byte 0 \b, v1 root directory
  2559. >0xA byte !0 \b, object entry
  2560. >>0xA string x (name: "%s")
  2561. # Little Endian: XX 00 00 00 01 00 00 00 FF FF YY
  2562. # XX: 01 - 05 (object type)
  2563. # YY: 00 for version 1 root directory, > 00 for version 2 (name data)
  2564. 0x1 string \x00\x00\x00\x01\x00\x00\x00\xFF\xFF
  2565. >0 ulelong 0
  2566. >0 ulelong >5
  2567. >0 default x YAFFS filesystem root entry (little endian)
  2568. >>0 use yaffs
  2569. # Big Endian: 00 00 00 XX 00 00 00 01 FF FF YY
  2570. # XX: 01 - 05 (object type)
  2571. # YY: 00 for version 1 root directory, > 00 for version 2 (name data)
  2572. 0x4 string \x00\x00\x00\x01\xFF\xFF
  2573. >0 string \x00\x00\x00
  2574. >>0 ubelong 0
  2575. >>0 ubelong >5
  2576. >>0 default x YAFFS filesystem root entry (big endian)
  2577. >>>0 use \^yaffs