Lines Matching +full:os +full:- +full:manifest +full:- +full:offset
1 #------------------------------------------------------------------------------
3 # archive: file(1) magic for archive formats (see also "msdos" for self-
7 # pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c.
11 # Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current
18 # last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad
19 # at https://sourceforge.net/projects/s-tar/files/testscripts/
21 # nul, space or ascii digit 0-7 at start of mode
32 >>>>>>>>>0 use tar-nvram
34 #>>>>>>>>0 regex \^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp) NAME "%s"
37 >>>>>>>>0 regex \^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp)
38 >>>>>>>>>0 use tar-cbt
41 >>>>>>>>>0 use tar-ova
44 >>>>>>>>>0 use tar-avm
47 # >>>>>>>>>>0 use tar-avm
49 # >>>>>>>>>>0 use tar-avm
51 # >>>>>>>>>>0 use tar-avm
53 # >>>>>>>>>>0 use tar-avm
56 >>>>>>>>>0 use tar-webmin
61 …upsd-0.81-2.wbm csavupdate.wbm cwmail.wbm dac960.wbm etcupdate.wbm logviewer.wbm memcached.wbm rin…
63 # authentic-theme-21.09.5.wbt Mozilla-Modern.wbt virtual-server-theme-2.7.wbt fkn-webmintheme.0.6.0…
65 >>>>>>>>>>0 use tar-webmin
68 >>>>>>>>>>0 use tar-file
69 # Note: called "TAR - Tape ARchive" by TrID, "Tape Archive Format" by DROID via PUID x-fmt/265
70 # and "Tar archive" by shared MIME-info database from freedesktop.org
73 0 name tar-file
78 # creates misleading V7 header for Long path, Multi-volume, Volume type
80 !:mime application/x-gtar
83 !:mime application/x-gtar
86 !:mime application/x-gtar
89 !:mime application/x-tar
93 # created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option
95 !:mime application/x-tar
102 !:mime application/x-gtar
106 # gLOBAL and ExTENSION type only found in POSIX.1-2001 format
107 >>>156 ubyte 0x67 \b.1-2001
108 >>>156 ubyte 0x78 \b.1-2001
110 !:mime application/x-ustar
114 !:mime application/x-ustar
118 !:mime application/x-ustar
121 >0 use tar-entry
123 0 name tar-entry
125 #>156 ubyte x \b, %c-type
144 >0 string >\0 %-.60s
146 >100 string >\0 \b, mode %-.7s
148 >108 string >\0 \b, uid %-.7s
150 >116 string >\0 \b, gid %-.7s
153 >>124 string >\0 \b, size %-.12s
154 # coding indicated by setting the high-order bit of the leftmost byte
169 >136 string >\0 \b, seconds %-.11s
173 >157 string >\0 \b, linkname %-.40s
177 >>265 string >\0 \b, user %-.32s
179 >>297 string >\0 \b, group %-.32s
182 >>>329 string x \b, devmaj %-.7s
184 >>>337 string x \b, devmin %-.7s
186 >>345 string >\0 \b, prefix %-.155s
191 >>>257 string >\0 \b, padding: %-.40s
194 >>>257 string >\0 \b, comment: %-.40s
196 # URL: hhttps://www.virtualbox.org/manual/ch08.html#vboxmanage-modifynvram
197 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/n/nvram-virtualbox-tar.trid.xml
199 # verified by 7-Zip `7z l -ttar Mint-21.1.nvram` and
200 # VirtualBox `VBoxManage modifynvram "Mint-21.1" listvars`
201 0 name tar-nvram
204 #!:mime application/x-gtar
205 !:mime application/x-virtualbox-nvram
208 >0 use tar-entry
211 >>&0 use tar-entry
218 0 name tar-cbt
220 #!:mime application/x-tar
226 #>0 string >\0 \b, 1st image %-.60s
227 >0 use tar-entry
235 0 name tar-ova
237 #!:mime application/x-ustar
239 !:mime application/x-virtualbox-ova
241 # assuming name[100] like: DOS-0.9.ovf FreeDOS_1.ovf Win98SE_DE.ovf
242 #>0 string >\0 \b, with %-.60s
243 >0 use tar-entry
244 # Summary: AVM firmware (FRITZ!OS) for the FRITZ!Box (router)
247 # https://www.redteam-pentesting.de/de/advisories/rt-sa-2014-010/-avm-fritz-box-firmware-signature…
248 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/image-avm.trid.xml
249 # Note: verified by 7-Zip `7z l -ttar FRITZ.Box_4040-07.57.image`
250 0 name tar-avm
252 #!:mime application/x-gtar
253 !:mime application/x-avm-image
261 … far behind (dozen MB) in many samples like: FRITZ.Box_4040-07.12.image FRITZ.Box_6820v3_LTE-07.57…
266 >0 use tar-entry
270 >>512 use tar-entry
274 # https://webmin.com/docs/development/creating-modules/
275 # https://webmin.com/docs/development/creating-themes/
278 # http://mark0.net/download/triddefs_xml.7z/defs/w/wbt-gif.trid.xml
280 # most verfied by 7-Zip `7z l -ttar *.wbm | grep "\module.info"` and
281 # `7z l -ttar *.wbt | grep "\theme.info"`
282 0 name tar-webmin
286 !:mime application/x-webmin-module
289 # old-blue-theme.wbm old-blue-theme-1.0.wbm old-mscstyle3.wbm virtual-server-mobile.wbm
293 !:mime application/x-webmin-theme
297 !:mime application/x-webmin
303 #!:mime application/x-gtar
306 #!:mime application/x-ustar
308 …ve member name[100] is directory like: dynbind/ ssh/ virtualmin-powerdns/ virtual-server-mobile/ v…
309 >>0 use tar-entry
315 >>>>&-257 use tar-entry
316 # look for characteristic WBT theme info name with "theme.info" like in: authentic-theme-21.09.5.wbt
320 >>>>&-257 use tar-entry
322 # Incremental snapshot gnu-tar format from:
323 # https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
324 0 string GNU\ tar- GNU tar incremental snapshot data
325 >&0 regex [0-9]\\.[0-9]+-[0-9]+ version %s
333 # from the machine running "file" with "byte-swapped cpio archive".
337 # character-header formats and thus are strings, not numbers.
343 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cpio-bin.trid.xml
344 # Note: called "CPIO archive (binary)" by TrID, "cpio/Binary LE" by 7-Zip and "CPIO" by DROID via …
346 # skip DROID fmt-635-signature-id-960.cpio by looking for pathname of 1st entry
348 !:mime application/x-cpio
349 # https://download.opensuse.org/distribution/leap/15.4/iso/openSUSE-Leap-15.4-NET-x86_64-Media.iso
353 >>0 use cpio-bin
354 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cpio-bin-sw.trid.xml
355 # Note: called "CPIO archive (byte swapped binary)" by TrID and "Cpio/Binary BE" by 7-Zip
356 0 short 0143561 byte-swapped cpio archive
357 !:mime application/x-cpio # encoding: swapped
360 >0 use cpio-bin-be
361 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cpio.trid.xml
362 # Note: called "CPIO archive (portable)" by TrID, "cpio/Portable ASCII" by 7-Zip and "cpio/odc" by…
363 0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
364 !:mime application/x-cpio
365 # https://telparia.com/fileFormatSamples/archive/cpio/ pthreads-1.60B5.osr5src.cpio cinema.cpi VOL.…
367 # Note: called "CPIO archive (portable)" by TrID, "cpio/New ASCII" by 7-Zip and "cpio/newc" by GNU…
369 !:mime application/x-cpio
370 # https://telparia.com/fileFormatSamples/archive/cpio/MainActor-2.06.3.cpio
372 # Note: called "CPIO archive (portable)" by TrID, "cpio/New CRC" by 7-Zip and "cpio/crc" by GNU cp…
374 !:mime application/x-cpio
375 # http://ftp.gnu.org/gnu/tar/tar-1.27.cpio.gz
379 # Note: verfied by 7-Zip `7z l -tcpio -slt *.cpio` and
380 # `cpio -ivt --numeric-uid-gid --file=clam.bin-le.cpio`
381 0 name cpio-bin
384 # c_ino; truncated inode number; use `ls --inode`
386 # c_mode; mode specifies permissions and file type like: ?622~?rw-r--r-- by `ls -l`
388 # c_uid; numeric user id; use `ls --numeric-uid-gid`
397 # c_mtime[2]; modification time in seconds since 1 January 1970; most-significant 16 bits first
399 # c_filesize[2]; size of pathname; most-significant 16 bits first like: 544
406 # Note: verfied by 7-Zip `7z l -tcpio -slt *.cpio` and
407 # `LANGUAGE=C cpio -ivt --numeric-uid-gid --file=clam.bin-be.cpio`
408 0 name cpio-bin-be
430 # or 32 bits. We don't say "PDP-11" or "VAX", as there might have
431 # been ports to little-endian 16-bit-int or 32-bit-int platforms
433 # to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
434 # 32-bit. There might have been big-endian ports of that sort as
437 0 leshort 0177555 very old 16-bit-int little-endian archive
438 0 beshort 0177555 very old 16-bit-int big-endian archive
439 0 lelong 0177555 very old 32-bit-int little-endian archive
440 0 belong 0177555 very old 32-bit-int big-endian archive
442 0 leshort 0177545 old 16-bit-int little-endian archive
444 0 beshort 0177545 old 16-bit-int big-endian archive
446 0 lelong 0177545 old 32-bit-int little-endian archive
448 0 belong 0177545 old 32-bit-int big-endian archive
452 # From "pdp" (but why a 4-byte quantity?)
454 0 lelong 0x39bed PDP-11 old archive
455 0 lelong 0x39bee PDP-11 4.0 archive
458 # XXX - what flavor of APL used this, and was it a variant of
468 !:mime application/x-archive
479 # https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html
480 >14 string -split part of multipart Debian package
481 !:mime application/vnd.debian.binary-package
484 >14 string -binary Debian binary package
485 !:mime application/vnd.debian.binary-package
501 # for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb
505 >>>>&-1 ubyte !0x2f
507 >>>>>&-1 ubyte x \b%c
509 >>>>>>>&-1 ubyte !0x2f
511 >>>>>>>>&-1 ubyte x \b%c
514 # dpkg-1.18.25/dpkg-split/info.c
517 # NL terminated package version like 302-5.3
537 !:mime application/x-archive
543 >22 string X -- out of date
546 # BSD/SVR2-and-later portable archive formats.
550 # Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/
551 # Note: Mach-O universal binary in ./cafebabe is dependent
553 # distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR;
559 !:mime application/x-archive
565 # Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf
567 # LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture
569 >68 belong 0x020b0619 - PA-RISC1.0 relocatable library
570 >68 belong 0x02100619 - PA-RISC1.1 relocatable library
571 >68 belong 0x02110619 - PA-RISC1.2 relocatable library
572 >68 belong 0x02140619 - PA-RISC2.0 relocatable library
583 0 search/1 -h- Software Tools format archive text
588 # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
593 !:mime application/x-arc
595 !:mime application/x-arc
597 !:mime application/x-arc
599 !:mime application/x-arc
601 !:mime application/x-arc
603 !:mime application/x-arc
606 !:mime application/x-arc
608 !:mime application/x-arc
610 !:mime application/x-arc
616 #0 byte 0x1a RISC OS archive (spark format)
617 0 string \032archive RISC OS archive (ArcFS format)
618 0 string Archive\000 RISC OS archive (ArcFS format)
621 # there were many low-quality sigs, i.e. easy to trigger false positives.
622 # Please notify me of any real-world fishy/ambiguous signatures and I'll try
624 # probably many can be enhanced by finding some 0-byte or control char near the start
648 2 string =-ah MAR archive data
689 # TODO: idarc says "bytes 0-2 == bytes 3-5"
693 # GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", othe…
702 # variant ASCII, 4K dictionary (strength=48=50-2). With strength=49 wrong order! WHY?
705 # skip VAX-order 68k Blit mpx/mux executable (strength=50) handled by ./blit
706 !:strength -2
714 # variant ASCII, 2K dictionary (strength=48=50-2). With strength=49 wrong order! WHY?
717 !:strength -2
726 # skip DOS 2.0-3.2 backed up sequence 4 with many nils like LOTUS5.RAR handled by ./msdos
733 !:strength -2
734 …ASIC programs (Mastermind.prg) with last 3 nil bytes (\0~end of line followed by 0000h line offset)
735 #>-4 ubelong x LAST_BYTES=%8.8x
736 >-4 ubelong&0x00FFffFF !0
742 !:mime application/x-compress-ttcomp
764 #>-3 ubyte x \b, last 3 bytes 0x%2.2x
765 #>-2 ubeshort x \b%4.4x
779 # 00064000 for 400k GCR disks dc42-400k-gcr.trid.xml
780 # 000c8000 for 800k GCR disks dc42-800k-gcr.trid.xml
781 # 000b4000 for 720k MFM disks dc42-720k-mfm.trid.xml
782 # 00168000 for 1440k MFM disks dc42-1440k-mfm.trid.xml
793 >>>>>0 use dc42-floppy
795 0 name dc42-floppy
800 # "-lisaem.sunder.net hd-" (dc42-lisaem.trid.xml) "-not a Macintosh disk" (dc42-nonmac.trid.xml)
802 #!:mime application/octet-stream
803 !:mime application/x-dc42-floppy-image
825 # 22h (double-sided MFM or Mac 800k "Disco 12.image" "IIe Installer Disk.image")
837 0 string =-H2O DRY archive data
846 # URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
852 !:mime application/x-ms-compress-kwaj
857 # compression method (0-4)
859 # offset of compressed data
860 >>10 uleshort x \b, %#x offset
862 #>>>&-6 string x \b, TEST extension %-.3s
870 # 1-9 bytes: null-terminated file name
871 # 1-4 bytes: null-terminated file extension
877 >>>>>>>14 string x \b, %-.8s
879 >>>>>>>14 string x \b, %-.8s
880 >>>>>>>>&1 string x \b.%-.3s
884 >>>>>>>>&14 string x \b, %-.8s
887 >>>>>>>>&14 string x \b, %-.8s
888 >>>>>>>>>&1 string x \b.%-.3s
892 >>>>>>>16 string x \b, %-.8s
894 >>>>>>>16 string x \b, %-.8s
895 >>>>>>>>&1 string x \b.%-.3s
899 >>>>>>>>&16 string x \b, %-.8s
902 >>>>>>>&16 string x %-.8s
903 >>>>>>>>&1 string x \b.%-.3s
908 >>>>>>>18 string x \b, %-.8s
910 >>>>>>>18 string x \b, %-.8s
911 >>>>>>>>&1 string x \b.%-.3s
915 >>>>>>>>&18 string x \b, %-.8s
918 >>>>>>>>&18 string x \b, %-.8s
919 >>>>>>>>>&1 string x \b.%-.3s
923 >>>>>>>20 string x \b, %-.8s
925 >>>>>>>20 string x \b, %-.8s
926 >>>>>>>>&1 string x \b.%-.3s
930 >>>>>>>>&20 string x \b, %-.8s
933 >>>>>>>>&20 string x \b, %-.8s
934 >>>>>>>>>&1 string x \b.%-.3s
938 # URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
942 # verfied by 7-Zip `7z l -tMsLZ -slt *.??_` as MsLZ
943 # `deark -l -m lzss_oku -d2 setup-1-41.bin` as "LZSS.C by Haruhiko Okumura"
947 !:mime application/x-ms-compress-szdd
950 >>9 string >\0 \b, %-.1s is last character of original name
953 >>8 string !A \b, %-.1s method
956 …: https://community.flexera.com/t5/InstallShield-Knowledge-Base/InstallShield-Redistributable-Fil…
959 #!:mime application/octet-stream
960 !:mime application/x-installshield-compress-szdd
976 !:mime application/x-ms-compress-sz
984 # command like `deark -l -m edi_pack -d2 BOOK01A.IC$` as "EDI Pack LZSS1"
993 >>>>0 use edi-lzs
1000 >>>>>0 use edi-pack
1006 >>>>>>0 use edi-pack
1011 >>>>>>>0 use edi-pack
1014 >>>>>>>0 use edi-lzs
1017 >>>>>>0 use edi-lzs
1020 >>>>>0 use edi-lzs
1023 >>>0 use edi-lzs
1024 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/e/edi-lzss2.trid.xml
1026 # command like `deark -l -m edi_pack -d2 4WAY.WA$` as "EDI Pack LZSS2"
1028 #!:mime application/octet-stream
1029 !:mime application/x-edi-pack-lzss
1032 # original filename, NUL-terminated, padded to 13 bytes like: mci.vbx 4way.wav skymap.exe cmdialog.…
1033 >>8 string x "%-0.13s"
1034 # original file size, as a 4-byte integer.
1038 0 name edi-pack
1039 # Note: verified by command like `deark -l -d2 SPELMATE.H$` as "EDI Pack LZSS1"
1040 # original filename, NUL-terminated, padded to 13 bytes like: ctl3d.dll spelmate.h filemenu.rc owl.…
1042 >8 string x EDI LZSS packed "%-.13s"
1043 #!:mime application/octet-stream
1044 !:mime application/x-edi-pack-lzss
1050 # Note: verified partly by command like `deark -l -m edi_pack -d2 GUNSHOT.LZS` as "EDI LZSSLib"
1051 0 name edi-lzs
1052 # Note: verified by command like `deark -l -d2 GUNSHOT.LZS` as "EDI LZSSLib"
1055 #!:mime application/octet-stream
1056 !:mime application/x-edi-pack-lzss
1068 #!:mime application/octet-stream
1069 !:mime application/x-compress-cazip
1076 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-ftcomp.trid.xml
1080 #!:mime application/octet-stream
1081 !:mime application/x-compress-ftcomp
1089 0 string MP3\x1a MP3-Archiver archive data
1096 # https://entropymine.com/deark/releases/deark-1.6.5.tar.gz
1097 # deark-1.6.5/modules/installshld.c
1099 # verified by command like `deark -m tscomp -l -d2 MAKERRES.DL$`
1102 #!:mime application/octet-stream
1103 !:mime application/x-tscomp-compressed
1111 # for single-file archives, often the last letter of the filename extension is changed to "$"; but …
1114 # for multi-file archives common extensions seem to be .lib and .cmp, but also names like: SAMPMIF$…
1118 # md->fi->timestamp
1127 # 2nd member offset
1128 #>0x12 ulelong x \b, next offset %#x
1166 # PRO-PACK https://www.segaretro.org/Rob_Northen_compression
1168 >3 byte 1 PRO-PACK archive data (compression 1)
1169 >3 byte 2 PRO-PACK archive data (compression 2)
1199 #!:mime application/octet-stream
1211 # http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cab-ishield.trid.xml
1214 #!:mime application/octet-stream
1215 !:mime application/x-installshield
1216 # http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cab-ishield-hdr.trid.xml
1230 >12 ulelong !0x200 \b, offset %#x
1248 # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
1249 1 string (C)\ STEPANYUK ARS-Sfx archive data
1268 0 string =<DC- DC archive data
1275 #!:mime application/octet-stream
1276 !:mime application/x-compress-ai
1279 #!:mime application/octet-stream
1280 !:mime application/x-compress-ai
1283 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-ai.trid.xml
1286 #!:mime application/octet-stream
1287 !:mime application/x-compress-ai
1298 #!:mime application/octet-stream
1299 !:mime application/x-compress-ai
1335 # BSN (BSA, PTS-DOS)
1371 #!:mime application/x-xpa-compressed
1393 !:mime application/x-dzip
1397 >>4 ulelong x \b, offset %#x
1410 # reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-jar.trid.xml
1414 #!:mime application/octet-stream
1415 !:mime application/x-compress-j
1420 # reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-jarcs.trid.xml
1423 #!:mime application/octet-stream
1424 !:mime application/x-compress-jar
1429 # reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-arj.trid.xml
1434 # verified by `7z l -tarj PHRACK1.ARJ` and
1435 # `arj.exe l TEST-hk9.ARJ`
1437 # skip DROID fmt-610-signature-id-946.arj by check for valid file type of main header
1439 >>0 use arj-archive
1440 0 name arj-archive
1442 !:mime application/x-arj
1443 # look for terminating 0-character of filename
1446 #>>&-5 string x extension %.4s
1447 >>&-5 string/c .arj data
1449 >>&-5 default x
1454 >>>8 byte ^0x04 data, SFX multi-volume
1469 >8 byte &0x01 \b, password-protected
1476 >8 byte &0x04 \b, multi-volume
1477 #>8 byte &0x08 \b, file-offset
1480 # arj protection factor; maximal 10; switch hky -> factor=y+1
1482 >8 byte &0x10 \b, slash-switched
1487 # ALTNAME_FLAG; indicates dual-name archive
1488 >8 byte &0x80 \b, dual-name
1492 # file type; 2 in main header; 0~binary 1~7-bitText 2~comment 3~directory 4~VolumeLabel 5=ChapterLa…
1494 # date+time when original archive was created in MS-DOS format via ./msdos
1496 >0xC use dos-date
1506 #>>0x10 use dos-date
1520 # filename (null-terminated string); sometimes at 0x26 when 4 bytes for extra data
1528 # host OS: 0~MSDOS ... 11~WIN32
1529 >7 byte 0 \b, os: MS-DOS
1530 >7 byte 1 \b, os: PRIMOS
1531 >7 byte 2 \b, os: Unix
1532 >7 byte 3 \b, os: Amiga
1533 >7 byte 4 \b, os: Macintosh
1534 >7 byte 5 \b, os: OS/2
1535 >7 byte 6 \b, os: Apple ][ GS
1536 >7 byte 7 \b, os: Atari ST
1537 >7 byte 8 \b, os: NeXT
1538 >7 byte 9 \b, os: VAX/VMS
1539 >7 byte 10 \b, os: WIN95
1540 >7 byte 11 \b, os: WIN32
1544 #>2 use arj-archive
1572 >0x26 byte =0x27 -
1583 0 name lharc-file
1584 # check 1st character of method id like -lz4- -lh5- or -pm2-
1585 >2 string -
1587 >>6 string -
1591 >>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b
1592 !:mime application/x-lzh-compressed
1596 >>>>>2 string -lz \b
1598 # already known -lzs- -lz4- -lz5- with old names
1599 >>>>>>2 string -lzs LHa/LZS archive data
1601 # missing -lz?- with wikipedia names
1604 >>>>>2 string -lh \b
1605 # already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
1610 >>>>>>>2 string -lh1 \b
1615 >>>>>>>2 string -lh5 \b
1620 # missing -lh?- variants (Joe Jared)
1621 >>>>>>3 regex \^lh[89a-ce] LHa (Joe Jared) archive
1623 >>>>>>2 string -lhx LHa (UNLHA32) archive
1627 # this should not happen if all -lh variants are described
1635 >>>>>>0 use lharc-header
1638 0 name lharc-header
1639 # header size 0x4 , 0x1b-0x61
1649 # OS ID for level 1
1652 >>(21.b+24) ubyte <0x21 \b, %#x OS
1654 >>(21.b+24) ubyte >0x20 \b, '%c' OS
1655 # OS ID for level 2
1657 #>>23 ubyte x \b, OS ID %#x
1658 >>23 ubyte <0x21 \b, %#x OS
1659 >>23 ubyte >0x20 \b, '%c' OS
1667 #2 string -lh0- LHarc 1.x/ARX archive data [lh0]
1668 #!:mime application/x-lharc
1669 2 string -lh0-
1670 >0 use lharc-file
1671 #2 string -lh1- LHarc 1.x/ARX archive data [lh1]
1672 #!:mime application/x-lharc
1673 2 string -lh1-
1674 >0 use lharc-file
1675 # NEW -lz2- ... -lz8-
1676 2 string -lz2-
1677 >0 use lharc-file
1678 2 string -lz3-
1679 >0 use lharc-file
1680 2 string -lz4-
1681 >0 use lharc-file
1682 2 string -lz5-
1683 >0 use lharc-file
1684 2 string -lz7-
1685 >0 use lharc-file
1686 2 string -lz8-
1687 >0 use lharc-file
1688 # [never seen any but the last; -lh4- reported in comp.compression:]
1689 #2 string -lzs- LHa/LZS archive data [lzs]
1690 2 string -lzs-
1691 >0 use lharc-file
1693 #2 string -lh\40- LHa 2.x? archive data [lh ]
1694 #2 string -lhd- LHa 2.x? archive data [lhd]
1695 2 string -lhd-
1696 >0 use lharc-file
1697 #2 string -lh2- LHa 2.x? archive data [lh2]
1698 2 string -lh2-
1699 >0 use lharc-file
1700 #2 string -lh3- LHa 2.x? archive data [lh3]
1701 2 string -lh3-
1702 >0 use lharc-file
1703 #2 string -lh4- LHa (2.x) archive data [lh4]
1704 2 string -lh4-
1705 >0 use lharc-file
1706 #2 string -lh5- LHa (2.x) archive data [lh5]
1707 2 string -lh5-
1708 >0 use lharc-file
1709 #2 string -lh6- LHa (2.x) archive data [lh6]
1710 2 string -lh6-
1711 >0 use lharc-file
1712 #2 string -lh7- LHa (2.x)/LHark archive data [lh7]
1713 2 string -lh7-
1714 # !:mime application/x-lha
1715 # >20 byte x - header level %d
1716 >0 use lharc-file
1717 # NEW -lh8- ... -lhe- , -lhx-
1718 2 string -lh8-
1719 >0 use lharc-file
1720 2 string -lh9-
1721 >0 use lharc-file
1722 2 string -lha-
1723 >0 use lharc-file
1724 2 string -lhb-
1725 >0 use lharc-file
1726 2 string -lhc-
1727 >0 use lharc-file
1728 2 string -lhe-
1729 >0 use lharc-file
1730 2 string -lhx-
1731 >0 use lharc-file
1733 2 string -lZ PUT archive data
1736 #2 string -lz LZS archive data
1737 2 string -sw1- Swag archive data
1739 0 name rar-file-header
1743 >15 byte 0 \b, os: MS-DOS
1744 >15 byte 1 \b, os: OS/2
1745 >15 byte 2 \b, os: Win32
1746 >15 byte 3 \b, os: Unix
1747 >15 byte 4 \b, os: Mac OS
1748 >15 byte 5 \b, os: BeOS
1750 0 name rar-archive-header
1768 >>(0xc.l+7) use rar-file-header
1771 >>(0xc.l+7) use rar-file-header
1773 >>7 use rar-archive-header
1780 # https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
1789 # [JW] see exe section for self-extracting version
1792 # PKZIP multi-volume archive
1793 0 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract
1806 !:mime application/x-ios-app
1813 !:mime application/vnd.android.package-archive
1815 >>>-22 string PK\005\006
1816 >>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1817 # Starts with META-INF/com/android/build/gradle/app-metadata.properties
1819 >>30 string META-INF/com/android/build/gradle/
1820 >>>&0 string app-metadata.properties Android package (APK), with gradle app-metadata.properties
1821 !:mime application/vnd.android.package-archive
1823 >>>>-22 string PK\005\006
1824 >>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1828 !:mime application/vnd.android.package-archive
1830 >>>-22 string PK\005\006
1831 >>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1832 # Starts with META-INF/MANIFEST.MF (file name length = 20)
1835 >>30 string META-INF/MANIFEST.MF
1837 >>>-512 search resources.arsc Android package (APK), with MANIFEST.MF and resources.arsc
1838 !:mime application/vnd.android.package-archive
1840 >>>>-22 string PK\005\006
1841 >>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1842 >>>-512 default x
1844 >>>>-512 search classes.dex Android package (APK), with MANIFEST.MF and classes.dex
1845 !:mime application/vnd.android.package-archive
1847 >>>>>-22 string PK\005\006
1848 >>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1849 >>>>-512 default x
1851 >>>>>-512 search lib/armeabi Android package (APK), with MANIFEST.MF and armeabi lib
1852 !:mime application/vnd.android.package-archive
1854 >>>>>>-22 string PK\005\006
1855 >>>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1856 >>>>>-512 default x
1858 >>>>>>-512 search res/drawable Android package (APK), with MANIFEST.MF and drawables
1859 !:mime application/vnd.android.package-archive
1861 >>>>>>>-22 string PK\005\006
1862 >>>>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1864 >>>>>>-512 default x Java archive data (JAR)
1865 !:mime application/java-archive
1873 !:mime application/vnd.android.package-archive
1875 >>>>>-22 string PK\005\006
1876 >>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1881 # Check for have 8-byte name, 0-byte extra field, name "mimetype", and
1950 # verified by `unzip -Zv *.oxt` or `7z l -slt *.oxt`
1955 # like: Gallery-Puzzle.2.1.0.1.oxt
1960 # https://lists.oasis-open.org/archives/office/200505/msg00006.html
1967 >>>>77 string -template Text Template
1968 !:mime application/vnd.oasis.opendocument.text-template
1970 >>>>77 string -web HTML Document Template
1971 !:mime application/vnd.oasis.opendocument.text-web
1973 >>>>77 string -master
1975 !:mime application/vnd.oasis.opendocument.text-master
1977 >>>>>84 string -template Master Template
1978 !:mime application/vnd.oasis.opendocument.text-master-template
1984 >>>>81 string -template Drawing Template
1985 !:mime application/vnd.oasis.opendocument.graphics-template
1991 >>>>85 string -template Presentation Template
1992 !:mime application/vnd.oasis.opendocument.presentation-template
1998 >>>>84 string -template Spreadsheet Template
1999 !:mime application/vnd.oasis.opendocument.spreadsheet-template
2005 >>>>78 string -template Chart Template
2006 !:mime application/vnd.oasis.opendocument.chart-template
2012 >>>>80 string -template Formula Template
2013 !:mime application/vnd.oasis.opendocument.formula-template
2028 >>>>78 string -template Image Template
2029 !:mime application/vnd.oasis.opendocument.image-template
2043 # https://e-ks.kr/streamdocs/view/sd;streamdocsId=72059197557727331
2045 !:mime application/x-hwp+zip
2050 # NOTE: version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based
2051 >>50 string x-vnd.corel. Corel
2052 >>>62 string draw.document+zip Draw drawing, version 14-16
2053 !:mime application/x-vnd.corel.draw.document+zip
2055 >>>62 string draw.template+zip Draw template, version 14-16
2056 !:mime application/x-vnd.corel.draw.template+zip
2058 >>>62 string zcf.draw.document+zip Draw drawing, version 17-22
2059 !:mime application/x-vnd.corel.zcf.draw.document+zip
2061 >>>62 string zcf.draw.template+zip Draw template, version 17-22
2062 !:mime application/x-vnd.corel.zcf.draw.template+zip
2064 # URL: http://product.corel.com/help/CorelDRAW/540240626/Main/EN/Doc/CorelDRAW-Other-file-formats.h…
2066 !:mime application/x-vnd.corel.zcf.pattern+zip
2071 >>>62 string designer.document+zip DESIGNER graphics, version 14-16
2072 !:mime application/x-vnd.corel.designer.document+zip
2074 >>>62 string zcf.designer.document+zip DESIGNER graphics, version 17-21
2075 !:mime application/x-vnd.corel.zcf.designer.document+zip
2078 # CorelDRAW-Corel-Symbol-Library-CSL.html
2079 >>>62 string symbol.library+zip Symbol Library, version 6-16.3
2080 !:mime application/x-vnd.corel.symbol.library+zip
2082 >>>62 string zcf.symbol.library+zip Symbol Library, version 17-22
2083 !:mime application/x-vnd.corel.zcf.symbol.library+zip
2086 # Catch other ZIP-with-mimetype formats
2093 >>>38 regex [!-OQ-~]+ (MIME type "%s"?)
2098 >>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
2103 !:mime application/java-archive
2111 !:mime application/x-ios-app
2121 >>>>-22 string PK\005\006
2122 >>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 Android package (APK), with APK Signing Block
2123 !:mime application/vnd.android.package-archive
2127 # https://help.keyman.com/developer/current-version/reference/file-types/kmp
2129 >>>>>(-6.l) string PK\001\002
2132 >>>>>>(-6.l) search/9000 kmp.json Keyman Compiled Package File
2136 # Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
2145 >>>>>0x161 string WINZIP \b, WinZIP self-extracting
2147 # Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
2163 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-zoo-strict.trid.xml
2164 # http://distcache.freebsd.org/ports-distfiles/zoo-2.10pl1.tar.gz/zoo.h
2165 …"ZOO compressed archive (strict)" by TrID and "ZOO Compressed Archive" by DROID via PUID x-fmt/269
2166 # verified by command like `deark -m zoo -l -d2 WHRCGA.ZOO`
2168 # skip DROID x-fmt-269-signature-id-621.zoo by looking for valid major version to manipulate archive
2170 !:mime application/x-zoo
2171 # bak is extension of backup-ed zoo
2206 # vdata; archive-level versioning byte like: 1 3
2210 # zoo_minus; zoo_start -1 for consistency checking
2218 >>>(24.l+5) ubyte 0 \bnot-compressed
2223 # offset; position of file data for this entry
2225 # file_crc; CRC-16 of file data
2232 >>>>(&-6.l) string x "%s"
2255 # lfname[256]; long file name \0-terminated
2257 …n jump before file name field and then jump this addtional length plus 2 (\0-terminator + dirlen f…
2260 # dirname[256]; directory name \0-terminated
2264 …; 7Fh~unknown 4~1.00hoursWestOfUTC 12 16 20~5.00hoursWestOfUTC -107~26.75hoursEastOfUTC -4~1.00hou…
2273 !:mime application/octet-stream
2285 #2 string -pm0- PMarc archive data [pm0]
2286 2 string -pm0-
2287 >0 use lharc-file
2288 #2 string -pm1- PMarc archive data [pm1]
2289 2 string -pm1-
2290 >0 use lharc-file
2291 #2 string -pm2- PMarc archive data [pm2]
2292 2 string -pm2-
2293 >0 use lharc-file
2294 2 string -pms- PMarc SFX archive (CP/M, DOS)
2295 #!:mime application/x-foobar-exec
2297 5 string -pc1- PopCom compressed executable (CP/M)
2298 #!:mime application/x-
2313 # Better magic in debian-additions.
2326 >48 leshort =0 - Index file
2327 >48 leshort >0 - file number %d
2329 # Felix von Leitner <felix-file@fefe.de>
2331 !:mime application/x-bittorrent
2334 0 string d13:announce-list BitTorrent file
2335 !:mime application/x-bittorrent
2338 !:mime application/x-bittorrent
2341 !:mime application/x-bittorrent
2344 # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
2346 # Reference: http://info-coach.fr/atari/documents/_mydoc/FD_Image_File_Format.pdf
2350 # command like `deark -l -m msa -d2 PDATS578.msa` as " Atari ST floppy disk image"
2355 #!:mime application/octet-stream
2356 !:mime application/x-atari-msa
2375 # Recognize ZIP archives with prepended data by end-of-central-directory record
2378 -2 uleshort 0
2379 >&-22 string PK\005\006
2386 >>>&-1 string/T x %s script executable (Zip archive)
2391 !:mime application/x-ace-compressed
2394 >16 byte =0x00 \b, from MS-DOS
2395 >16 byte =0x01 \b, from OS/2
2412 >5 leshort &0x0800 \b, multi-volume
2413 >5 leshort &0x1000 \b, contains AV-String
2418 # Date in MS-DOS format (whatever that is)
2428 # DR-DOS 7.03 Packed File *.??_
2429 # Reference: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm
2432 # by looking for Control-Z skip ASCII text starting with Packed File
2434 !:mime application/x-novell-compress
2442 # From: Tilman Sauerbeck <tilman@code-monkey.de>
2444 !:mime application/x-eet
2447 # URL: https://help.foxitsoftware.com/kb/install-fzip-file.php
2452 0 ubequad 0x2506781901010000 Foxit add-on/update
2453 !:mime application/x-fzip
2462 >14 beshort 0x4e4e multi-part
2463 >14 beshort 0x4e53 multi-part, with -S
2472 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x)
2473 !:mime x-epoc/x-sisx-app
2489 # Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or
2490 # 7z t -txar Xcode_10.2_beta_4.xip`
2492 !:mime application/x-xar
2502 # cksum_alg 0-2 in older and also 3-4 in newer
2504 >24 belong 1 SHA-1 checksum
2506 >24 belong 3 SHA-256 checksum
2507 >24 belong 4 SHA-512 checksum
2519 >>>>>&-3 indirect x \b, contains
2520 # For SHA-1 jump 20 minus 2 bytes
2528 >>>>>&-1 indirect x \b, contains
2529 # For SHA-256 jump 32 minus 2 bytes
2536 >>>>>&-1 indirect x \b, contains
2537 # For SHA-512 jump 64 minus 2 bytes
2544 >>>>>&-1 indirect x \b, contains
2551 # URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
2566 # https://encode.ru/threads/456-zpaq-updates/page32
2574 >36 byte 1 \b, front-to-back
2575 >36 byte 16 \b, back-to-front
2585 # *.GHS or *.[0-9] with cns program option
2589 # compression tag minus one equals numeric compression command line switch z[1-9]
2594 >>3 ubyte <11 \b, compression (Z%d-1)
2599 # 1~Image All, sector-by-sector only for *.gho
2606 >>0xff string >\0 "%-.254s"
2609 >>&-512 indirect x \b; contains
2615 !:mime application/x-chrome-extension
2618 # SeqBox - Sequenced container
2629 # http://mark0.net/download/triddefs_xml.7z/defs/a/ark-lnx.trid.xml
2635 #!:mime application/octet-stream
2636 !:mime application/x-commodore-lnx
2643 >>&0 regex [0-9]{1,5} %s directory blocks
2647 >>>>&1 regex [0-9]{1,3} \b, %s files
2654 !:mime application/x-acronis-tib
2660 # strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0"
2664 #>>&-1 pstring x \b, %s
2667 #>>>>&-1 pstring x \b, %s
2678 -4 string STOP
2679 >-16 string XPAKSTOP Gentoo binary package (XPAK)
2684 # Reference: https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz
2685 # /xbmc-Krypton/xbmc/guilib/XBTF.h
2686 # /xbmc-Krypton/xbmc/guilib/XBTF.cpp
2690 !:mime application/x-xbmc-xbt
2693 >>4 string !2 \b, version %-.1s
2694 # nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp
2704 # https://salsa.debian.org/l10n-korean-team/unalz
2708 # https://cf-aldn.altools.co.kr/setup/EGG_Specification.zip
2796 # URL: https://www.neowin.net/forum/topic/615151-anyone-know-what-program-opens-dsi-and-wsi-files/
2799 # bytes 3-4 are the checksum or the first 32 bytes of the file