| blob | b9933b1b49765d33ebd6e2fd52caac5570223cca |
2 #------------------------------------------------------------------------------
3 # $File: macintosh,v 1.22 2011/05/17 17:40:31 rrt Exp $
4 # macintosh description
5 #
6 # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
7 # Daniel Quinlan, quinlan@yggdrasil.com
8 11 string must\ be\ converted\ with\ BinHex BinHex binary text
9 !:mime application/mac-binhex40
10 >41 string x \b, version %.3s
12 # Stuffit archives are the de facto standard of compression for Macintosh
13 # files obtained from most archives. (franklsm@tuns.ca)
14 0 string SIT! StuffIt Archive (data)
15 !:mime application/x-stuffit
16 !:apple SIT!SIT!
17 >2 string x : %s
18 0 string SITD StuffIt Deluxe (data)
19 >2 string x : %s
20 0 string Seg StuffIt Deluxe Segment (data)
21 >2 string x : %s
23 # Newer StuffIt archives (grant@netbsd.org)
24 0 string StuffIt StuffIt Archive
25 !:mime application/x-stuffit
26 !:apple SIT!SIT!
27 #>162 string >0 : %s
29 # Macintosh Applications and Installation binaries (franklsm@tuns.ca)
30 # GRR: Too weak
31 #0 string APPL Macintosh Application (data)
32 #>2 string x \b: %s
34 # Macintosh System files (franklsm@tuns.ca)
35 # GRR: Too weak
36 #0 string zsys Macintosh System File (data)
37 #0 string FNDR Macintosh Finder (data)
38 #0 string libr Macintosh Library (data)
39 #>2 string x : %s
40 #0 string shlb Macintosh Shared Library (data)
41 #>2 string x : %s
42 #0 string cdev Macintosh Control Panel (data)
43 #>2 string x : %s
44 #0 string INIT Macintosh Extension (data)
45 #>2 string x : %s
46 #0 string FFIL Macintosh Truetype Font (data)
47 #>2 string x : %s
48 #0 string LWFN Macintosh Postscript Font (data)
49 #>2 string x : %s
51 # Additional Macintosh Files (franklsm@tuns.ca)
52 # GRR: Too weak
53 #0 string PACT Macintosh Compact Pro Archive (data)
54 #>2 string x : %s
55 #0 string ttro Macintosh TeachText File (data)
56 #>2 string x : %s
57 #0 string TEXT Macintosh TeachText File (data)
58 #>2 string x : %s
59 #0 string PDF Macintosh PDF File (data)
60 #>2 string x : %s
62 # MacBinary format (Eric Fischer, enf@pobox.com)
63 #
64 # Unfortunately MacBinary doesn't really have a magic number prior
65 # to the MacBinary III format. The checksum is really the way to
66 # do it, but the magic file format isn't up to the challenge.
67 #
68 # 0 byte 0
69 # 1 byte # filename length
70 # 2 string # filename
71 # 65 string # file type
72 # 69 string # file creator
73 # 73 byte # Finder flags
74 # 74 byte 0
75 # 75 beshort # vertical posn in window
76 # 77 beshort # horiz posn in window
77 # 79 beshort # window or folder ID
78 # 81 byte # protected?
79 # 82 byte 0
80 # 83 belong # length of data segment
81 # 87 belong # length of resource segment
82 # 91 belong # file creation date
83 # 95 belong # file modification date
84 # 99 beshort # length of comment after resource
85 # 101 byte # new Finder flags
86 # 102 string mBIN # (only in MacBinary III)
87 # 106 byte # char. code of file name
88 # 107 byte # still more Finder flags
89 # 116 belong # total file length
90 # 120 beshort # length of add'l header
91 # 122 byte 129 # for MacBinary II
92 # 122 byte 130 # for MacBinary III
93 # 123 byte 129 # minimum version that can read fmt
94 # 124 beshort # checksum
95 #
96 # This attempts to use the version numbers as a magic number, requiring
97 # that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
98 # be 0x81. This works for the files I have, but maybe not for everyone's.
100 # Unfortunately, this magic is quite weak - MPi
101 #122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
103 # MacBinary I doesn't have the version number field at all, but MacBinary II
104 # has been in use since 1987 so I hope there aren't many really old files
105 # floating around that this will miss. The original spec calls for using
106 # the nulls in 0, 74, and 82 as the magic number.
107 #
108 # Another possibility, that would also work for MacBinary I, is to use
109 # the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
110 # have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
111 # and that 74 will be 0. So something like
112 #
113 # 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
114 #
115 # >73 byte&0x01 0x01 \b, inited
116 # >73 byte&0x02 0x02 \b, changed
117 # >73 byte&0x04 0x04 \b, busy
118 # >73 byte&0x08 0x08 \b, bozo
119 # >73 byte&0x10 0x10 \b, system
120 # >73 byte&0x10 0x20 \b, bundle
121 # >73 byte&0x10 0x40 \b, invisible
122 # >73 byte&0x10 0x80 \b, locked
124 #>65 string x \b, type "%4.4s"
126 #>65 string 8BIM (PhotoShop)
127 #>65 string ALB3 (PageMaker 3)
128 #>65 string ALB4 (PageMaker 4)
129 #>65 string ALT3 (PageMaker 3)
130 #>65 string APPL (application)
131 #>65 string AWWP (AppleWorks word processor)
132 #>65 string CIRC (simulated circuit)
133 #>65 string DRWG (MacDraw)
134 #>65 string EPSF (Encapsulated PostScript)
135 #>65 string FFIL (font suitcase)
136 #>65 string FKEY (function key)
137 #>65 string FNDR (Macintosh Finder)
138 #>65 string GIFf (GIF image)
139 #>65 string Gzip (GNU gzip)
140 #>65 string INIT (system extension)
141 #>65 string LIB\ (library)
142 #>65 string LWFN (PostScript font)
143 #>65 string MSBC (Microsoft BASIC)
144 #>65 string PACT (Compact Pro archive)
145 #>65 string PDF\ (Portable Document Format)
146 #>65 string PICT (picture)
147 #>65 string PNTG (MacPaint picture)
148 #>65 string PREF (preferences)
149 #>65 string PROJ (Think C project)
150 #>65 string QPRJ (Think Pascal project)
151 #>65 string SCFL (Defender scores)
152 #>65 string SCRN (startup screen)
153 #>65 string SITD (StuffIt Deluxe)
154 #>65 string SPn3 (SuperPaint)
155 #>65 string STAK (HyperCard stack)
156 #>65 string Seg\ (StuffIt segment)
157 #>65 string TARF (Unix tar archive)
158 #>65 string TEXT (ASCII)
159 #>65 string TIFF (TIFF image)
160 #>65 string TOVF (Eudora table of contents)
161 #>65 string WDBN (Microsoft Word word processor)
162 #>65 string WORD (MacWrite word processor)
163 #>65 string XLS\ (Microsoft Excel)
164 #>65 string ZIVM (compress (.Z))
165 #>65 string ZSYS (Pre-System 7 system file)
166 #>65 string acf3 (Aldus FreeHand)
167 #>65 string cdev (control panel)
168 #>65 string dfil (Desk Acessory suitcase)
169 #>65 string libr (library)
170 #>65 string nX^d (WriteNow word processor)
171 #>65 string nX^w (WriteNow dictionary)
172 #>65 string rsrc (resource)
173 #>65 string scbk (Scrapbook)
174 #>65 string shlb (shared library)
175 #>65 string ttro (SimpleText read-only)
176 #>65 string zsys (system file)
178 #>69 string x \b, creator "%4.4s"
180 # Somewhere, Apple has a repository of registered Creator IDs. These are
181 # just the ones that I happened to have files from and was able to identify.
183 #>69 string 8BIM (Adobe Photoshop)
184 #>69 string ALD3 (PageMaker 3)
185 #>69 string ALD4 (PageMaker 4)
186 #>69 string ALFA (Alpha editor)
187 #>69 string APLS (Apple Scanner)
188 #>69 string APSC (Apple Scanner)
189 #>69 string BRKL (Brickles)
190 #>69 string BTFT (BitFont)
191 #>69 string CCL2 (Common Lisp 2)
192 #>69 string CCL\ (Common Lisp)
193 #>69 string CDmo (The Talking Moose)
194 #>69 string CPCT (Compact Pro)
195 #>69 string CSOm (Eudora)
196 #>69 string DMOV (Font/DA Mover)
197 #>69 string DSIM (DigSim)
198 #>69 string EDIT (Macintosh Edit)
199 #>69 string ERIK (Macintosh Finder)
200 #>69 string EXTR (self-extracting archive)
201 #>69 string Gzip (GNU gzip)
202 #>69 string KAHL (Think C)
203 #>69 string LWFU (LaserWriter Utility)
204 #>69 string LZIV (compress)
205 #>69 string MACA (MacWrite)
206 #>69 string MACS (Macintosh operating system)
207 #>69 string MAcK (MacKnowledge terminal emulator)
208 #>69 string MLND (Defender)
209 #>69 string MPNT (MacPaint)
210 #>69 string MSBB (Microsoft BASIC (binary))
211 #>69 string MSWD (Microsoft Word)
212 #>69 string NCSA (NCSA Telnet)
213 #>69 string PJMM (Think Pascal)
214 #>69 string PSAL (Hunt the Wumpus)
215 #>69 string PSI2 (Apple File Exchange)
216 #>69 string R*ch (BBEdit)
217 #>69 string RMKR (Resource Maker)
218 #>69 string RSED (Resource Editor)
219 #>69 string Rich (BBEdit)
220 #>69 string SIT! (StuffIt)
221 #>69 string SPNT (SuperPaint)
222 #>69 string Unix (NeXT Mac filesystem)
223 #>69 string VIM! (Vim editor)
224 #>69 string WILD (HyperCard)
225 #>69 string XCEL (Microsoft Excel)
226 #>69 string aCa2 (Fontographer)
227 #>69 string aca3 (Aldus FreeHand)
228 #>69 string dosa (Macintosh MS-DOS file system)
229 #>69 string movr (Font/DA Mover)
230 #>69 string nX^n (WriteNow)
231 #>69 string pdos (Apple ProDOS file system)
232 #>69 string scbk (Scrapbook)
233 #>69 string ttxt (SimpleText)
234 #>69 string ufox (Foreign File Access)
236 # Just in case...
238 102 string mBIN MacBinary III data with surprising version number
240 # sas magic from Bruce Foster (bef@nwu.edu)
241 #
242 #0 string SAS SAS
243 #>8 string x %s
244 0 string SAS SAS
245 >24 string DATA data file
246 >24 string CATALOG catalog
247 >24 string INDEX data file index
248 >24 string VIEW data view
249 # sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
250 #
251 0x54 string SAS SAS 7+
252 >0x9C string DATA data file
253 >0x9C string CATALOG catalog
254 >0x9C string INDEX data file index
255 >0x9C string VIEW data view
257 # spss magic for SPSS system and portable files,
258 # from Bruce Foster (bef@nwu.edu).
260 0 long 0xc1e2c3c9 SPSS Portable File
261 >40 string x %s
263 0 string $FL2 SPSS System File
264 >24 string x %s
266 # Macintosh filesystem data
267 # From "Tom N Harris" <telliamed@mac.com>
268 # Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
269 # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
270 # entries depend on the data arithmetic added after v.35
271 # There's also some Pascal strings in here, ditto...
273 # The boot block signature, according to IM:Files, is
274 # "for HFS volumes, this field always contains the value 0x4C4B."
275 # But if this is true for MFS or HFS+ volumes, I don't know.
276 # Alternatively, the boot block is supposed to be zeroed if it's
277 # unused, so a simply >0 should suffice.
279 0x400 beshort 0xD2D7 Macintosh MFS data
280 >0 beshort 0x4C4B (bootable)
281 >0x40a beshort &0x8000 (locked)
282 >0x402 beldate-0x7C25B080 x created: %s,
283 >0x406 beldate-0x7C25B080 >0 last backup: %s,
284 >0x414 belong x block size: %d,
285 >0x412 beshort x number of blocks: %d,
286 >0x424 pstring x volume name: %s
288 # "BD" gives many false positives
289 #0x400 beshort 0x4244 Macintosh HFS data
290 #>0 beshort 0x4C4B (bootable)
291 #>0x40a beshort &0x8000 (locked)
292 #>0x40a beshort ^0x0100 (mounted)
293 #>0x40a beshort &0x0200 (spared blocks)
294 #>0x40a beshort &0x0800 (unclean)
295 #>0x47C beshort 0x482B (Embedded HFS+ Volume)
296 #>0x402 beldate-0x7C25B080 x created: %s,
297 #>0x406 beldate-0x7C25B080 x last modified: %s,
298 #>0x440 beldate-0x7C25B080 >0 last backup: %s,
299 #>0x414 belong x block size: %d,
300 #>0x412 beshort x number of blocks: %d,
301 #>0x424 pstring x volume name: %s
303 0x400 beshort 0x482B Macintosh HFS Extended
304 >&0 beshort x version %d data
305 >0 beshort 0x4C4B (bootable)
306 >0x404 belong ^0x00000100 (mounted)
307 >&2 belong &0x00000200 (spared blocks)
308 >&2 belong &0x00000800 (unclean)
309 >&2 belong &0x00008000 (locked)
310 >&6 string x last mounted by: '%.4s',
311 # really, that should be treated as a belong and we print a string
312 # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
313 >&14 beldate-0x7C25B080 x created: %s,
314 # only the creation date is local time, all other timestamps in HFS+ are UTC.
315 >&18 bedate-0x7C25B080 x last modified: %s,
316 >&22 bedate-0x7C25B080 >0 last backup: %s,
317 >&26 bedate-0x7C25B080 >0 last checked: %s,
318 >&38 belong x block size: %d,
319 >&42 belong x number of blocks: %d,
320 >&46 belong x free blocks: %d
322 # I don't think this is really necessary since it doesn't do much and
323 # anything with a valid driver descriptor will also have a valid
324 # partition map
325 #0 beshort 0x4552 Apple Device Driver data
326 #>&24 beshort =1 \b, MacOS
328 # Is that the partition type a cstring or a pstring? Well, IM says "strings
329 # shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
330 # cstring. Of course, partitions can contain more than four entries, but
331 # what're you gonna do?
332 # GRR: This magic is too weak, it is just "PM"
333 #0x200 beshort 0x504D Apple Partition data
334 #>0x2 beshort x (block size: %d):
335 #>0x230 string x first type: %s,
336 #>0x210 string x name: %s,
337 #>0x254 belong x number of blocks: %d,
338 #>0x400 beshort 0x504D
339 #>>0x430 string x second type: %s,
340 #>>0x410 string x name: %s,
341 #>>0x454 belong x number of blocks: %d,
342 #>>0x600 beshort 0x504D
343 #>>>0x630 string x third type: %s,
344 #>>>0x610 string x name: %s,
345 #>>>0x654 belong x number of blocks: %d,
346 #>>0x800 beshort 0x504D
347 #>>>0x830 string x fourth type: %s,
348 #>>>0x810 string x name: %s,
349 #>>>0x854 belong x number of blocks: %d,
350 #>>>0xa00 beshort 0x504D
351 #>>>>0xa30 string x fifth type: %s,
352 #>>>>0xa10 string x name: %s,
353 #>>>>0xa54 belong x number of blocks: %d
354 #>>>0xc00 beshort 0x504D
355 #>>>>0xc30 string x sixth type: %s,
356 #>>>>0xc10 string x name: %s,
357 #>>>>0xc54 belong x number of blocks: %d
358 ## AFAIK, only the signature is different
359 #0x200 beshort 0x5453 Apple Old Partition data
360 #>0x2 beshort x block size: %d,
361 #>0x230 string x first type: %s,
362 #>0x210 string x name: %s,
363 #>0x254 belong x number of blocks: %d,
364 #>0x400 beshort 0x504D
365 #>>0x430 string x second type: %s,
366 #>>0x410 string x name: %s,
367 #>>0x454 belong x number of blocks: %d,
368 #>>0x800 beshort 0x504D
369 #>>>0x830 string x third type: %s,
370 #>>>0x810 string x name: %s,
371 #>>>0x854 belong x number of blocks: %d,
372 #>>>0xa00 beshort 0x504D
373 #>>>>0xa30 string x fourth type: %s,
374 #>>>>0xa10 string x name: %s,
375 #>>>>0xa54 belong x number of blocks: %d
377 # From: Remi Mommsen <mommsen@slac.stanford.edu>
378 0 string BOMStore Mac OS X bill of materials (BOM) file
380 # From: Adam Buchbinder <adam.buchbinder@gmail.com>
381 # URL: http://en.wikipedia.org/wiki/Datafork_TrueType
382 # Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
383 # TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
384 # don't know what they mean.
385 0 belong 0x100
386 >(0x4.L+24) beshort x
387 >>&4 belong 0x73666e74 Mac OSX datafork font, TrueType
388 >>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT'
389 >>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT'
390 >>&4 belong 0x504f5354 Mac OSX datafork font, PostScript