| blob | 9175aac9c5c0dffaff6610fdf392caa58ad50ae9 |
1 #------------------------------------------------------------------------------
2 # archive: file(1) magic for archive formats (see also "msdos" for self-
3 # extracting compressed archives)
4 #
5 # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
6 # pre-POSIX "tar" archives are handled in the C code.
8 # POSIX tar archives
9 257 string ustar\0 POSIX tar archive
10 !:mime application/x-tar # encoding: posix
11 257 string ustar\040\040\0 GNU tar archive
12 !:mime application/x-tar # encoding: gnu
14 # cpio archives
15 #
16 # Yes, the top two "cpio archive" formats *are* supposed to just be "short".
17 # The idea is to indicate archives produced on machines with the same
18 # byte order as the machine running "file" with "cpio archive", and
19 # to indicate archives produced on machines with the opposite byte order
20 # from the machine running "file" with "byte-swapped cpio archive".
21 #
22 # The SVR4 "cpio(4)" hints that there are additional formats, but they
23 # are defined as "short"s; I think all the new formats are
24 # character-header formats and thus are strings, not numbers.
25 0 short 070707 cpio archive
26 !:mime application/x-cpio
27 0 short 0143561 byte-swapped cpio archive
28 !:mime application/x-cpio # encoding: swapped
29 0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
30 0 string 070701 ASCII cpio archive (SVR4 with no CRC)
31 0 string 070702 ASCII cpio archive (SVR4 with CRC)
33 # Debian package (needs to go before regular portable archives)
34 #
35 0 string =!<arch>\ndebian
36 !:mime application/x-debian-package
37 >8 string debian-split part of multipart Debian package
38 >8 string debian-binary Debian binary package
39 >8 string !debian
40 >68 string >\0 (format %s)
41 # These next two lines do not work, because a bzip2 Debian archive
42 # still uses gzip for the control.tar (first in the archive). Only
43 # data.tar varies, and the location of its filename varies too.
44 # file/libmagic does not current have support for ascii-string based
45 # (offsets) as of 2005-09-15.
46 #>81 string bz2 \b, uses bzip2 compression
47 #>84 string gz \b, uses gzip compression
48 #>136 ledate x created: %s
50 # other archives
51 0 long 0177555 very old archive
52 0 short 0177555 very old PDP-11 archive
53 0 long 0177545 old archive
54 0 short 0177545 old PDP-11 archive
55 0 long 0100554 apl workspace
56 0 string =<ar> archive
57 !:mime application/x-archive
59 # MIPS archive (needs to go before regular portable archives)
60 #
61 0 string =!<arch>\n__________E MIPS archive
62 >20 string U with MIPS Ucode members
63 >21 string L with MIPSEL members
64 >21 string B with MIPSEB members
65 >19 string L and an EL hash table
66 >19 string B and an EB hash table
67 >22 string X -- out of date
69 0 search/1 -h- Software Tools format archive text
71 #
72 # XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
73 # "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
74 #
75 # 0 string =!<arch> current ar archive
76 # 0 long 0x213c6172 archive file
77 #
78 # and for SVR1 archives, we have:
79 #
80 # 0 string \<ar> System V Release 1 ar archive
81 # 0 string =<ar> archive
82 #
83 # XXX - did Aegis really store shared libraries, breakpointed modules,
84 # and absolute code program modules in the same format as new-style
85 # "ar" archives?
86 #
87 0 string =!<arch> current ar archive
88 !:mime application/x-archive
89 >8 string __.SYMDEF random library
90 >0 belong =65538 - pre SR9.5
91 >0 belong =65539 - post SR9.5
92 >0 beshort 2 - object archive
93 >0 beshort 3 - shared library module
94 >0 beshort 4 - debug break-pointed module
95 >0 beshort 5 - absolute code program module
96 0 string \<ar> System V Release 1 ar archive
97 0 string =<ar> archive
98 #
99 # XXX - from "vax", which appears to collect a bunch of byte-swapped
100 # thingies, to help you recognize VAX files on big-endian machines;
101 # with "leshort", "lelong", and "string", that's no longer necessary....
102 #
103 0 belong 0x65ff0000 VAX 3.0 archive
104 0 belong 0x3c61723e VAX 5.0 archive
105 #
106 0 long 0x213c6172 archive file
107 0 lelong 0177555 very old VAX archive
108 0 leshort 0177555 very old PDP-11 archive
109 #
110 # XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
111 # be a random library (it said 0xff65 rather than 0177545).
112 #
113 0 lelong 0177545 old VAX archive
114 >8 string __.SYMDEF random library
115 0 leshort 0177545 old PDP-11 archive
116 >8 string __.SYMDEF random library
117 #
118 # From "pdp" (but why a 4-byte quantity?)
119 #
120 0 lelong 0x39bed PDP-11 old archive
121 0 lelong 0x39bee PDP-11 4.0 archive
123 # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
124 #
125 # The first byte is the magic (0x1a), byte 2 is the compression type for
126 # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
127 # filename of the first file (null terminated). Since some types collide
128 # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
129 # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
130 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
131 !:mime application/x-arc
132 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
133 !:mime application/x-arc
134 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
135 !:mime application/x-arc
136 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
137 !:mime application/x-arc
138 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
139 !:mime application/x-arc
140 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
141 !:mime application/x-arc
142 # [JW] stuff taken from idarc, obviously ARC successors:
143 0 lelong&0x8080ffff 0x00000a1a PAK archive data
144 !:mime application/x-arc
145 0 lelong&0x8080ffff 0x0000141a ARC+ archive data
146 !:mime application/x-arc
147 0 lelong&0x8080ffff 0x0000481a HYP archive data
148 !:mime application/x-arc
150 # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
151 # I can't create either SPARK or ArcFS archives so I have not tested this stuff
152 # [GRR: the original entries collide with ARC, above; replaced with combined
153 # version (not tested)]
154 #0 byte 0x1a RISC OS archive (spark format)
155 0 string \032archive RISC OS archive (ArcFS format)
156 0 string Archive\000 RISC OS archive (ArcFS format)
158 # All these were taken from idarc, many could not be verified. Unfortunately,
159 # there were many low-quality sigs, i.e. easy to trigger false positives.
160 # Please notify me of any real-world fishy/ambiguous signatures and I'll try
161 # to get my hands on the actual archiver and see if I find something better. [JW]
162 # probably many can be enhanced by finding some 0-byte or control char near the start
164 # idarc calls this Crush/Uncompressed... *shrug*
165 0 string CRUSH Crush archive data
166 # Squeeze It (.sqz)
167 0 string HLSQZ Squeeze It archive data
168 # SQWEZ
169 0 string SQWEZ SQWEZ archive data
170 # HPack (.hpk)
171 0 string HPAK HPack archive data
172 # HAP
173 0 string \x91\x33HF HAP archive data
174 # MD/MDCD
175 0 string MDmd MDCD archive data
176 # LIM
177 0 string LIM\x1a LIM archive data
178 # SAR
179 3 string LH5 SAR archive data
180 # BSArc/BS2
181 0 string \212\3SB \0 BSArc/BS2 archive data
182 # MAR
183 2 string =-ah MAR archive data
184 # ACB
185 0 belong&0x00f800ff 0x00800000 ACB archive data
186 # CPZ
187 # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
188 # JRC
189 0 string JRchive JRC archive data
190 # Quantum
191 0 string DS\0 Quantum archive data
192 # ReSOF
193 0 string PK\3\6 ReSOF archive data
194 # QuArk
195 0 string 7\4 QuArk archive data
196 # YAC
197 14 string YC YAC archive data
198 # X1
199 0 string X1 X1 archive data
200 0 string XhDr X1 archive data
201 # CDC Codec (.dqt)
202 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
203 # AMGC
204 0 string \xad6" AMGC archive data
205 # NuLIB
206 0 string NõFélå NuLIB archive data
207 # PakLeo
208 0 string LEOLZW PAKLeo archive data
209 # ChArc
210 0 string SChF ChArc archive data
211 # PSA
212 0 string PSA PSA archive data
213 # CrossePAC
214 0 string DSIGDCC CrossePAC archive data
215 # Freeze
216 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
217 # KBoom
218 0 string ¨MP¨ KBoom archive data
219 # NSQ, must go after CDC Codec
220 0 string \x76\xff NSQ archive data
221 # DPA
222 0 string Dirk\ Paehl DPA archive data
223 # BA
224 # TODO: idarc says "bytes 0-2 == bytes 3-5"
225 # TTComp
226 0 string \0\6 TTComp archive data
227 # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
228 0 string ESP ESP archive data
229 # ZPack
230 0 string \1ZPK\1 ZPack archive data
231 # Sky
232 0 string \xbc\x40 Sky archive data
233 # UFA
234 0 string UFA UFA archive data
235 # Dry
236 0 string =-H2O DRY archive data
237 # FoxSQZ
238 0 string FOXSQZ FoxSQZ archive data
239 # AR7
240 0 string ,AR7 AR7 archive data
241 # PPMZ
242 0 string PPMZ PPMZ archive data
243 # MS Compress
244 4 string \x88\xf0\x27 MS Compress archive data
245 # updated by Joerg Jenderek
246 >9 string \0
247 >>0 string KWAJ
248 >>>7 string \321\003 MS Compress archive data
249 >>>>14 ulong >0 \b, original size: %ld bytes
250 >>>>18 ubyte >0x65
251 >>>>>18 string x \b, was %.8s
252 >>>>>(10.b-4) string x \b.%.3s
253 # MP3 (archiver, not lossy audio compression)
254 0 string MP3\x1a MP3-Archiver archive data
255 # ZET
256 0 string OZÝ ZET archive data
257 # TSComp
258 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
259 # ARQ
260 0 string gW\4\1 ARQ archive data
261 # Squash
262 3 string OctSqu Squash archive data
263 # Terse
264 0 string \5\1\1\0 Terse archive data
265 # PUCrunch
266 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
267 # UHarc
268 0 string UHA UHarc archive data
269 # ABComp
270 0 string \2AB ABComp archive data
271 0 string \3AB2 ABComp archive data
272 # CMP
273 0 string CO\0 CMP archive data
274 # Splint
275 0 string \x93\xb9\x06 Splint archive data
276 # InstallShield
277 0 string \x13\x5d\x65\x8c InstallShield Z archive Data
278 # Gather
279 1 string GTH Gather archive data
280 # BOA
281 0 string BOA BOA archive data
282 # RAX
283 0 string ULEB\xa RAX archive data
284 # Xtreme
285 0 string ULEB\0 Xtreme archive data
286 # Pack Magic
287 0 string @â\1\0 Pack Magic archive data
288 # BTS
289 0 belong&0xfeffffff 0x1a034465 BTS archive data
290 # ELI 5750
291 0 string Ora\ ELI 5750 archive data
292 # QFC
293 0 string \x1aFC\x1a QFC archive data
294 0 string \x1aQF\x1a QFC archive data
295 # PRO-PACK
296 0 string RNC PRO-PACK archive data
297 # 777
298 0 string 777 777 archive data
299 # LZS221
300 0 string sTaC LZS221 archive data
301 # HPA
302 0 string HPA HPA archive data
303 # Arhangel
304 0 string LG Arhangel archive data
305 # EXP1, uses bzip2
306 0 string 0123456789012345BZh EXP1 archive data
307 # IMP
308 0 string IMP\xa IMP archive data
309 # NRV
310 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data
311 # Squish
312 0 string \x73\xb2\x90\xf4 Squish archive data
313 # Par
314 0 string PHILIPP Par archive data
315 0 string PAR Par archive data
316 # HIT
317 0 string UB HIT archive data
318 # SBX
319 0 belong&0xfffff000 0x53423000 SBX archive data
320 # NaShrink
321 0 string NSK NaShrink archive data
322 # SAPCAR
323 0 string #\ CAR\ archive\ header SAPCAR archive data
324 0 string CAR\ 2.00RG SAPCAR archive data
325 # Disintegrator
326 0 string DST Disintegrator archive data
327 # ASD
328 0 string ASD ASD archive data
329 # InstallShield CAB
330 0 string ISc( InstallShield CAB
331 # TOP4
332 0 string T4\x1a TOP4 archive data
333 # BatComp left out: sig looks like COM executable
334 # so TODO: get real 4dos batcomp file and find sig
335 # BlakHole
336 0 string BH\5\7 BlakHole archive data
337 # BIX
338 0 string BIX0 BIX archive data
339 # ChiefLZA
340 0 string ChfLZ ChiefLZA archive data
341 # Blink
342 0 string Blink Blink archive data
343 # Logitech Compress
344 0 string \xda\xfa Logitech Compress archive data
345 # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
346 1 string (C)\ STEPANYUK ARS-Sfx archive data
347 # AKT/AKT32
348 0 string AKT32 AKT32 archive data
349 0 string AKT AKT archive data
350 # NPack
351 0 string MSTSM NPack archive data
352 # PFT
353 0 string \0\x50\0\x14 PFT archive data
354 # SemOne
355 0 string SEM SemOne archive data
356 # PPMD
357 0 string \x8f\xaf\xac\x84 PPMD archive data
358 # FIZ
359 0 string FIZ FIZ archive data
360 # MSXiE
361 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data
362 # DeepFreezer
363 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data
364 # DC
365 0 string =<DC- DC archive data
366 # TPac
367 0 string \4TPAC\3 TPac archive data
368 # Ai
369 0 string Ai\1\1\0 Ai archive data
370 0 string Ai\1\0\0 Ai archive data
371 # Ai32
372 0 string Ai\2\0 Ai32 archive data
373 0 string Ai\2\1 Ai32 archive data
374 # SBC
375 0 string SBC SBC archive data
376 # Ybs
377 0 string YBS Ybs archive data
378 # DitPack
379 0 string \x9e\0\0 DitPack archive data
380 # DMS
381 0 string DMS! DMS archive data
382 # EPC
383 0 string \x8f\xaf\xac\x8c EPC archive data
384 # VSARC
385 0 string VS\x1a VSARC archive data
386 # PDZ
387 0 string PDZ PDZ archive data
388 # ReDuq
389 0 string rdqx ReDuq archive data
390 # GCA
391 0 string GCAX GCA archive data
392 # PPMN
393 0 string pN PPMN archive data
394 # WinImage
395 3 string WINIMAGE WinImage archive data
396 # Compressia
397 0 string CMP0CMP Compressia archive data
398 # UHBC
399 0 string UHB UHBC archive data
400 # WinHKI
401 0 string \x61\x5C\x04\x05 WinHKI archive data
402 # WWPack data file
403 0 string WWP WWPack archive data
404 # BSN (BSA, PTS-DOS)
405 0 string \xffBSG BSN archive data
406 1 string \xffBSG BSN archive data
407 3 string \xffBSG BSN archive data
408 1 string \0\xae\2 BSN archive data
409 1 string \0\xae\3 BSN archive data
410 1 string \0\xae\7 BSN archive data
411 # AIN
412 0 string \x33\x18 AIN archive data
413 0 string \x33\x17 AIN archive data
414 # XPA32
415 0 string xpa\0\1 XPA32 archive data
416 # SZip (TODO: doesn't catch all versions)
417 0 string SZ\x0a\4 SZip archive data
418 # XPack DiskImage
419 0 string jm XPack DiskImage archive data
420 # XPack Data
421 0 string xpa XPack archive data
422 # XPack Single Data
423 0 string Í\ jm XPack single archive data
425 # TODO: missing due to unknown magic/magic at end of file:
426 #DWC
427 #ARG
428 #ZAR
429 #PC/3270
430 #InstallIt
431 #RKive
432 #RK
433 #XPack Diskimage
435 # These were inspired by idarc, but actually verified
436 # Dzip archiver (.dz)
437 0 string DZ Dzip archive data
438 >2 byte x \b, version %i
439 >3 byte x \b.%i
440 # ZZip archiver (.zz)
441 0 string ZZ\ \0\0 ZZip archive data
442 0 string ZZ0 ZZip archive data
443 # PAQ archiver (.paq)
444 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
445 0 string PAQ PAQ archive data
446 >3 byte&0xf0 0x30
447 >>3 byte x (v%c)
448 # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
449 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
450 0 string JARCS JAR (ARJ Software, Inc.) archive data
452 # ARJ archiver (jason@jarthur.Claremont.EDU)
453 0 leshort 0xea60 ARJ archive data
454 !:mime application/x-arj
455 >5 byte x \b, v%d,
456 >8 byte &0x04 multi-volume,
457 >8 byte &0x10 slash-switched,
458 >8 byte &0x20 backup,
459 >34 string x original name: %s,
460 >7 byte 0 os: MS-DOS
461 >7 byte 1 os: PRIMOS
462 >7 byte 2 os: Unix
463 >7 byte 3 os: Amiga
464 >7 byte 4 os: Macintosh
465 >7 byte 5 os: OS/2
466 >7 byte 6 os: Apple ][ GS
467 >7 byte 7 os: Atari ST
468 >7 byte 8 os: NeXT
469 >7 byte 9 os: VAX/VMS
470 >3 byte >0 %d]
471 # [JW] idarc says this is also possible
472 2 leshort 0xea60 ARJ archive data
474 # HA archiver (Greg Roelofs, newt@uchicago.edu)
475 # This is a really bad format. A file containing HAWAII will match this...
476 #0 string HA HA archive data,
477 #>2 leshort =1 1 file,
478 #>2 leshort >1 %u files,
479 #>4 byte&0x0f =0 first is type CPY
480 #>4 byte&0x0f =1 first is type ASC
481 #>4 byte&0x0f =2 first is type HSC
482 #>4 byte&0x0f =0x0e first is type DIR
483 #>4 byte&0x0f =0x0f first is type SPECIAL
484 # suggestion: at least identify small archives (<1024 files)
485 0 belong&0xffff00fc 0x48410000 HA archive data
486 >2 leshort =1 1 file,
487 >2 leshort >1 %u files,
488 >4 byte&0x0f =0 first is type CPY
489 >4 byte&0x0f =1 first is type ASC
490 >4 byte&0x0f =2 first is type HSC
491 >4 byte&0x0f =0x0e first is type DIR
492 >4 byte&0x0f =0x0f first is type SPECIAL
494 # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
495 0 string HPAK HPACK archive data
497 # JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
498 0 string \351,\001JAM\ JAM archive,
499 >7 string >\0 version %.4s
500 >0x26 byte =0x27 -
501 >>0x2b string >\0 label %.11s,
502 >>0x27 lelong x serial %08x,
503 >>0x36 string >\0 fstype %.8s
505 # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
506 2 string -lh0- LHarc 1.x/ARX archive data [lh0]
507 !:mime application/x-lharc
508 2 string -lh1- LHarc 1.x/ARX archive data [lh1]
509 !:mime application/x-lharc
510 2 string -lz4- LHarc 1.x archive data [lz4]
511 !:mime application/x-lharc
512 2 string -lz5- LHarc 1.x archive data [lz5]
513 !:mime application/x-lharc
514 # [never seen any but the last; -lh4- reported in comp.compression:]
515 2 string -lzs- LHa/LZS archive data [lzs]
516 !:mime application/x-lha
517 2 string -lh\40- LHa 2.x? archive data [lh ]
518 !:mime application/x-lha
519 2 string -lhd- LHa 2.x? archive data [lhd]
520 !:mime application/x-lha
521 2 string -lh2- LHa 2.x? archive data [lh2]
522 !:mime application/x-lha
523 2 string -lh3- LHa 2.x? archive data [lh3]
524 !:mime application/x-lha
525 2 string -lh4- LHa (2.x) archive data [lh4]
526 !:mime application/x-lha
527 2 string -lh5- LHa (2.x) archive data [lh5]
528 !:mime application/x-lha
529 2 string -lh6- LHa (2.x) archive data [lh6]
530 !:mime application/x-lha
531 2 string -lh7- LHa (2.x)/LHark archive data [lh7]
532 !:mime application/x-lha
533 >20 byte x - header level %d
534 # taken from idarc [JW]
535 2 string -lZ PUT archive data
536 2 string -lz LZS archive data
537 2 string -sw1- Swag archive data
539 # RAR archiver (Greg Roelofs, newt@uchicago.edu)
540 0 string Rar! RAR archive data,
541 !:mime application/x-rar
542 >44 byte x v%0x,
543 >10 byte >0 flags:
544 >>10 byte &0x01 Archive volume,
545 >>10 byte &0x02 Commented,
546 >>10 byte &0x04 Locked,
547 >>10 byte &0x08 Solid,
548 >>10 byte &0x20 Authenticated,
549 >35 byte 0 os: MS-DOS
550 >35 byte 1 os: OS/2
551 >35 byte 2 os: Win32
552 >35 byte 3 os: Unix
553 # some old version? idarc says:
554 0 string RE\x7e\x5e RAR archive data
556 # SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
557 0 string SQSH squished archive data (Acorn RISCOS)
559 # UC2 archiver (Greg Roelofs, newt@uchicago.edu)
560 # [JW] see exe section for self-extracting version
561 0 string UC2\x1a UC2 archive data
563 # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
564 0 string PK\003\004
565 >4 byte 0x00 Zip archive data
566 !:mime application/zip
567 >4 byte 0x09 Zip archive data, at least v0.9 to extract
568 !:mime application/zip
569 >4 byte 0x0a Zip archive data, at least v1.0 to extract
570 !:mime application/zip
571 >4 byte 0x0b Zip archive data, at least v1.1 to extract
572 !:mime application/zip
573 >0x161 string WINZIP Zip archive data, WinZIP self-extracting
574 !:mime application/zip
575 >4 byte 0x14
576 >>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract
577 >0x161 string WINZIP Zip archive data, WinZIP self-extracting
578 !:mime application/zip
580 # OpenOffice.org / KOffice / StarOffice documents
581 # Listed here because they ARE zip files
582 #
583 # From: Abel Cheung <abel@oaka.org>
584 >4 byte 0x14
585 >>30 string mimetype
587 # KOffice (1.2 or above) formats
588 >>>50 string vnd.kde. KOffice (>=1.2)
589 >>>>58 string karbon Karbon document
590 >>>>58 string kchart KChart document
591 >>>>58 string kformula KFormula document
592 >>>>58 string kivio Kivio document
593 >>>>58 string kontour Kontour document
594 >>>>58 string kpresenter KPresenter document
595 >>>>58 string kspread KSpread document
596 >>>>58 string kword KWord document
598 # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
599 >>>50 string vnd.sun.xml. OpenOffice.org 1.x
600 >>>>62 string writer Writer
601 >>>>>68 byte !0x2e document
602 >>>>>68 string .template template
603 >>>>>68 string .global global document
604 >>>>62 string calc Calc
605 >>>>>66 byte !0x2e spreadsheet
606 >>>>>66 string .template template
607 >>>>62 string draw Draw
608 >>>>>66 byte !0x2e document
609 >>>>>66 string .template template
610 >>>>62 string impress Impress
611 >>>>>69 byte !0x2e presentation
612 >>>>>69 string .template template
613 >>>>62 string math Math document
614 >>>>62 string base Database file
616 # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
617 # http://lists.oasis-open.org/archives/office/200505/msg00006.html
618 >>>50 string vnd.oasis.opendocument. OpenDocument
619 >>>>73 string text
620 >>>>>77 byte !0x2d Text
621 !:mime application/vnd.oasis.opendocument.text
622 >>>>>77 string -template Text Template
623 >>>>>77 string -web HTML Document Template
624 >>>>>77 string -master Master Document
625 >>>>73 string graphics Drawing
626 >>>>>81 string -template Template
627 >>>>73 string presentation Presentation
628 >>>>>85 string -template Template
629 >>>>73 string spreadsheet Spreadsheet
630 >>>>>84 string -template Template
631 >>>>73 string chart Chart
632 >>>>>78 string -template Template
633 >>>>73 string formula Formula
634 >>>>>80 string -template Template
635 >>>>73 string database Database
636 >>>>73 string image Image
638 # Zoo archiver
639 20 lelong 0xfdc4a7dc Zoo archive data
640 !:mime application/x-zoo
641 >4 byte >48 \b, v%c.
642 >>6 byte >47 \b%c
643 >>>7 byte >47 \b%c
644 >32 byte >0 \b, modify: v%d
645 >>33 byte x \b.%d+
646 >42 lelong 0xfdc4a7dc \b,
647 >>70 byte >0 extract: v%d
648 >>>71 byte x \b.%d+
650 # Shell archives
651 10 string #\ This\ is\ a\ shell\ archive shell archive text
652 !:mime application/octet-stream
654 #
655 # LBR. NB: May conflict with the questionable
656 # "binary Computer Graphics Metafile" format.
657 #
658 0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
659 #
660 # PMA (CP/M derivative of LHA)
661 #
662 2 string -pm0- PMarc archive data [pm0]
663 2 string -pm1- PMarc archive data [pm1]
664 2 string -pm2- PMarc archive data [pm2]
665 2 string -pms- PMarc SFX archive (CP/M, DOS)
666 5 string -pc1- PopCom compressed executable (CP/M)
668 # From Rafael Laboissiere <rafael@laboissiere.net>
669 # The Project Revision Control System (see
670 # http://prcs.sourceforge.net) generates a packaged project
671 # file which is recognized by the following entry:
672 0 leshort 0xeb81 PRCS packaged project
674 # Microsoft cabinets
675 # by David Necas (Yeti) <yeti@physics.muni.cz>
676 #0 string MSCF\0\0\0\0 Microsoft cabinet file data,
677 #>25 byte x v%d
678 #>24 byte x \b.%d
679 # MPi: All CABs have version 1.3, so this is pointless.
680 # Better magic in debian-additions.
682 # GTKtalog catalogs
683 # by David Necas (Yeti) <yeti@physics.muni.cz>
684 4 string gtktalog\ GTKtalog catalog data,
685 >13 string 3 version 3
686 >>14 beshort 0x677a (gzipped)
687 >>14 beshort !0x677a (not gzipped)
688 >13 string >3 version %s
690 ############################################################################
691 # Parity archive reconstruction file, the 'par' file format now used on Usenet.
692 0 string PAR\0 PARity archive data
693 >48 leshort =0 - Index file
694 >48 leshort >0 - file number %d
696 # Felix von Leitner <felix-file@fefe.de>
697 0 string d8:announce BitTorrent file
698 !:mime application/x-bittorrent
700 # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
701 0 beshort 0x0e0f Atari MSA archive data
702 >2 beshort x \b, %d sectors per track
703 >4 beshort 0 \b, 1 sided
704 >4 beshort 1 \b, 2 sided
705 >6 beshort x \b, starting track: %d
706 >8 beshort x \b, ending track: %d
708 # Alternate ZIP string (amc@arwen.cs.berkeley.edu)
709 0 string PK00PK\003\004 Zip archive data
711 # ACE archive (from http://www.wotsit.org/download.asp?f=ace)
712 # by Stefan `Sec` Zehl <sec@42.org>
713 7 string **ACE** ACE archive data
714 >15 byte >0 version %d
715 >16 byte =0x00 \b, from MS-DOS
716 >16 byte =0x01 \b, from OS/2
717 >16 byte =0x02 \b, from Win/32
718 >16 byte =0x03 \b, from Unix
719 >16 byte =0x04 \b, from MacOS
720 >16 byte =0x05 \b, from WinNT
721 >16 byte =0x06 \b, from Primos
722 >16 byte =0x07 \b, from AppleGS
723 >16 byte =0x08 \b, from Atari
724 >16 byte =0x09 \b, from Vax/VMS
725 >16 byte =0x0A \b, from Amiga
726 >16 byte =0x0B \b, from Next
727 >14 byte x \b, version %d to extract
728 >5 leshort &0x0080 \b, multiple volumes,
729 >>17 byte x \b (part %d),
730 >5 leshort &0x0002 \b, contains comment
731 >5 leshort &0x0200 \b, sfx
732 >5 leshort &0x0400 \b, small dictionary
733 >5 leshort &0x0800 \b, multi-volume
734 >5 leshort &0x1000 \b, contains AV-String
735 >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered)
736 >5 leshort &0x2000 \b, with recovery record
737 >5 leshort &0x4000 \b, locked
738 >5 leshort &0x8000 \b, solid
739 # Date in MS-DOS format (whatever that is)
740 #>18 lelong x Created on
742 # sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
743 # <doj@cubic.org>
744 0x1A string sfArk sfArk compressed Soundfont
745 >0x15 string 2
746 >>0x1 string >\0 Version %s
747 >>0x2A string >\0 : %s
749 # DR-DOS 7.03 Packed File *.??_
750 0 string Packed\ File\ Personal NetWare Packed File
751 >12 string x \b, was "%.12s"
753 # EET archive
754 # From: Tilman Sauerbeck <tilman@code-monkey.de>
755 0 belong 0x1ee7ff00 EET archive
756 !:mime application/x-eet
758 # rzip archives
759 0 string RZIP rzip compressed data
760 >4 byte x - version %d
761 >5 byte x \b.%d
762 >6 belong x (%d bytes)
764 # From: "Robert Dale" <robdale@gmail.com>
765 0 belong 123 dar archive,
766 >4 belong x label "%.8x
767 >>8 belong x %.8x
768 >>>12 beshort x %.4x"
769 >14 byte 0x54 end slice
770 >14 beshort 0x4e4e multi-part
771 >14 beshort 0x4e53 multi-part, with -S
773 # Symbian installation files
774 # http://www.thouky.co.uk/software/psifs/sis.html
775 # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
776 8 lelong 0x10000419 Symbian installation file
777 !:mime application/vnd.symbian.install
778 >4 lelong 0x1000006D (EPOC release 3/4/5)
779 >4 lelong 0x10003A12 (EPOC release 6)
780 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x)
781 !:mime x-epoc/x-sisx-app
783 # From "Nelson A. de Oliveira" <naoliv@gmail.com>
784 0 string MPQ\032 MoPaQ (MPQ) archive
786 # From: Dirk Jagdmann <doj@cubic.org>
787 # xar archive format: http://code.google.com/p/xar/
788 0 string xar! xar archive
789 >6 beshort x - version %ld
791 # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
792 # .kgb
793 0 string KGB_arch KGB Archiver file
794 >10 string x with compression level %.1s
796 # xar (eXtensible ARchiver) archive
797 # From: "David Remahl" <dremahl@apple.com>
798 0 string xar! xar archive
799 #>4 beshort x header size %d
800 >6 beshort x version %d,
801 #>8 quad x compressed TOC: %d,
802 #>16 quad x uncompressed TOC: %d,
803 >24 belong 0 no checksum
804 >24 belong 1 SHA-1 checksum
805 >24 belong 2 MD5 checksum