| blob | 669ab04dcc6fc9e9ce809d3ebf2b1761a178d42b |
1 #------------------------------------------------------------------------------
2 # apple: file(1) magic for Apple file formats
3 #
4 0 search/1 FiLeStArTfIlEsTaRt binscii (apple ][) text
5 0 string \x0aGL Binary II (apple ][) data
6 0 string \x76\xff Squeezed (apple ][) data
7 0 string NuFile NuFile archive (apple ][) data
8 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
9 0 belong 0x00051600 AppleSingle encoded Macintosh file
10 0 belong 0x00051607 AppleDouble encoded Macintosh file
12 # Type: Apple Emulator 2IMG format
13 # From: Radek Vokal <rvokal@redhat.com>
14 0 string 2IMG Apple ][ 2IMG Disk Image
15 >4 string XGS! \b, XGS
16 >4 string CTKG \b, Catakig
17 >4 string ShIm \b, Sheppy's ImageMaker
18 >4 string WOOF \b, Sweet 16
19 >4 string B2TR \b, Bernie ][ the Rescue
20 >4 string !nfc \b, ASIMOV2
21 >4 string x \b, Unknown Format
22 >0xc byte 00 \b, DOS 3.3 sector order
23 >>0x10 byte 00 \b, Volume 254
24 >>0x10 byte&0x7f x \b, Volume %u
25 >0xc byte 01 \b, ProDOS sector order
26 >>0x14 short x \b, %u Blocks
27 >0xc byte 02 \b, NIB data
29 # magic for Newton PDA package formats
30 # from Ruda Moura <ruda@helllabs.org>
31 0 string package0 Newton package, NOS 1.x,
32 >12 belong &0x80000000 AutoRemove,
33 >12 belong &0x40000000 CopyProtect,
34 >12 belong &0x10000000 NoCompression,
35 >12 belong &0x04000000 Relocation,
36 >12 belong &0x02000000 UseFasterCompression,
37 >16 belong x version %d
39 0 string package1 Newton package, NOS 2.x,
40 >12 belong &0x80000000 AutoRemove,
41 >12 belong &0x40000000 CopyProtect,
42 >12 belong &0x10000000 NoCompression,
43 >12 belong &0x04000000 Relocation,
44 >12 belong &0x02000000 UseFasterCompression,
45 >16 belong x version %d
47 0 string package4 Newton package,
48 >8 byte 8 NOS 1.x,
49 >8 byte 9 NOS 2.x,
50 >12 belong &0x80000000 AutoRemove,
51 >12 belong &0x40000000 CopyProtect,
52 >12 belong &0x10000000 NoCompression,
54 # The following entries for the Apple II are for files that have
55 # been transferred as raw binary data from an Apple, without having
56 # been encapsulated by any of the above archivers.
57 #
58 # In general, Apple II formats are hard to identify because Apple DOS
59 # and especially Apple ProDOS have strong typing in the file system and
60 # therefore programmers never felt much need to include type information
61 # in the files themselves.
62 #
63 # Eric Fischer <enf@pobox.com>
65 # AppleWorks word processor:
66 #
67 # This matches the standard tab stops for an AppleWorks file, but if
68 # a file has a tab stop set in the first four columns this will fail.
69 #
70 # The "O" is really the magic number, but that's so common that it's
71 # necessary to check the tab stops that follow it to avoid false positives.
73 4 string O==== AppleWorks word processor data
74 >85 byte&0x01 >0 \b, zoomed
75 >90 byte&0x01 >0 \b, paginated
76 >92 byte&0x01 >0 \b, with mail merge
77 #>91 byte x \b, left margin %d
79 # AppleWorks database:
80 #
81 # This isn't really a magic number, but it's the closest thing to one
82 # that I could find. The 1 and 2 really mean "order in which you defined
83 # categories" and "left to right, top to bottom," respectively; the D and R
84 # mean that the cursor should move either down or right when you press Return.
86 #30 string \x01D AppleWorks database data
87 #30 string \x02D AppleWorks database data
88 #30 string \x01R AppleWorks database data
89 #30 string \x02R AppleWorks database data
91 # AppleWorks spreadsheet:
92 #
93 # Likewise, this isn't really meant as a magic number. The R or C means
94 # row- or column-order recalculation; the A or M means automatic or manual
95 # recalculation.
97 #131 string RA AppleWorks spreadsheet data
98 #131 string RM AppleWorks spreadsheet data
99 #131 string CA AppleWorks spreadsheet data
100 #131 string CM AppleWorks spreadsheet data
102 # Applesoft BASIC:
103 #
104 # This is incredibly sloppy, but will be true if the program was
105 # written at its usual memory location of 2048 and its first line
106 # number is less than 256. Yuck.
108 0 belong&0xff00ff 0x80000 Applesoft BASIC program data
109 #>2 leshort x \b, first line number %d
111 # ORCA/EZ assembler:
112 #
113 # This will not identify ORCA/M source files, since those have
114 # some sort of date code instead of the two zero bytes at 6 and 7
115 # XXX Conflicts with ELF
116 #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
117 #>5 byte x \b, build number %d
119 # Broderbund Fantavision
120 #
121 # I don't know what these values really mean, but they seem to recur.
122 # Will they cause too many conflicts?
124 # Probably :-)
125 #2 belong&0xFF00FF 0x040008 Fantavision movie data
127 # Some attempts at images.
128 #
129 # These are actually just bit-for-bit dumps of the frame buffer, so
130 # there's really no reasonably way to distinguish them except for their
131 # address (if preserved) -- 8192 or 16384 -- and their length -- 8192
132 # or, occasionally, 8184.
133 #
134 # Nevertheless this will manage to catch a lot of images that happen
135 # to have a solid-colored line at the bottom of the screen.
137 # GRR: Magic too weak
138 #8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
139 #8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
140 #8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
141 #8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
142 #8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
144 # Beagle Bros. Apple Mechanic fonts
146 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
148 # Apple Universal Disk Image Format (UDIF) - dmg files.
149 # From Johan Gade.
150 # These entries are disabled for now until we fix the following issues.
151 #
152 # Note there might be some problems with the "VAX COFF executable"
153 # entry. Note this entry should be placed before the mac filesystem section,
154 # particularly the "Apple Partition data" entry.
155 #
156 # The intended meaning of these tests is, that the file is only of the
157 # specified type if both of the lines are correct - i.e. if the first
158 # line matches and the second doesn't then it is not of that type.
159 #
160 #0 long 0x7801730d
161 #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
162 #
163 # Note that this entry is recognized correctly by the "Apple Partition
164 # data" entry - however since this entry is more specific - this
165 # information seems to be more useful.
166 #0 long 0x45520200
167 #>0x410 string disk\ image UDIF read/write image (UDRW)
169 # From: Toby Peterson <toby@apple.com>
170 0 string bplist00 Apple binary property list
172 # Apple binary property list (bplist)
173 # Assumes version bytes are hex.
174 # Provides content hints for version 0 files. Assumes that the root
175 # object is the first object (true for CoreFoundation implementation).
176 # From: David Remahl <dremahl@apple.com>
177 0 string bplist
178 >6 byte x \bCoreFoundation binary property list data, version 0x%c
179 >>7 byte x \b%c
180 >6 string 00 \b
181 >>8 byte&0xF0 0x00 \b
182 >>>8 byte&0x0F 0x00 \b, root type: null
183 >>>8 byte&0x0F 0x08 \b, root type: false boolean
184 >>>8 byte&0x0F 0x09 \b, root type: true boolean
185 >>8 byte&0xF0 0x10 \b, root type: integer
186 >>8 byte&0xF0 0x20 \b, root type: real
187 >>8 byte&0xF0 0x30 \b, root type: date
188 >>8 byte&0xF0 0x40 \b, root type: data
189 >>8 byte&0xF0 0x50 \b, root type: ascii string
190 >>8 byte&0xF0 0x60 \b, root type: unicode string
191 >>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
192 >>8 byte&0xF0 0xa0 \b, root type: array
193 >>8 byte&0xF0 0xd0 \b, root type: dictionary
195 # Apple/NeXT typedstream data
196 # Serialization format used by NeXT and Apple for various
197 # purposes in YellowStep/Cocoa, including some nib files.
198 # From: David Remahl <dremahl@apple.com>
199 2 string typedstream NeXT/Apple typedstream data, big endian
200 >0 byte x \b, version %hhd
201 >0 byte <5 \b
202 >>13 byte 0x81 \b
203 >>>14 ubeshort x \b, system %hd
204 2 string streamtyped NeXT/Apple typedstream data, little endian
205 >0 byte x \b, version %hhd
206 >0 byte <5 \b
207 >>13 byte 0x81 \b
208 >>>14 uleshort x \b, system %hd
210 #------------------------------------------------------------------------------
211 # CAF: Apple CoreAudio File Format
212 #
213 # Container format for high-end audio purposes.
214 # From: David Remahl <dremahl@apple.com>
215 #
216 0 string caff CoreAudio Format audio file
217 >4 beshort <10 version %d
218 >6 beshort x
221 #------------------------------------------------------------------------------
222 # Keychain database files
223 0 string kych Mac OS X Keychain File
225 #------------------------------------------------------------------------------
226 # Code Signing related file types
227 0 belong 0xfade0c00 Mac OS X Code Requirement
228 >8 belong 1 (opExpr)
229 >4 belong x - %d bytes
231 0 belong 0xfade0c01 Mac OS X Code Requirement Set
232 >8 belong >1 containing %d items
233 >4 belong x - %d bytes
235 0 belong 0xfade0c02 Mac OS X Code Directory
236 >8 belong x version %x
237 >12 belong >0 flags 0x%x
238 >4 belong x - %d bytes
240 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
241 >4 belong x - %d bytes
243 0 belong 0xfade0cc1 Mac OS X Detached Code Signature
244 >8 belong >1 (%d elements)
245 >4 belong x - %d bytes
247 # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
248 # .vdi
249 4 string innotek\ VirtualBox\ Disk\ Image %s