Lines Matching +full:06 +full:- +full:inch
2 #------------------------------------------------------------------------------
4 # msdos: file(1) magic for MS-DOS files
11 !:mime text/x-msdos-batch
14 !:mime text/x-msdos-batch
17 !:mime text/x-msdos-batch
20 !:mime text/x-msdos-batch
45 0 leshort 0x290 MS Windows COFF PA-RISC object file
56 # FMX64:FileMaker Pro 64-bit plug-in https://en.wikipedia.org/wiki/FileMaker
57 # FMX: FileMaker Pro 32-bit plug-in https://en.wikipedia.org/wiki/FileMaker
63 # MLL: Maya plug-in (generic) http://en.wikipedia.org/wiki/Autodesk_Maya
65 # 8*: PhotoShop plug-in (generic) http://www.adobe.com/products/photoshop/main.html
71 # UPC: Ultimate Paint Graphics Editor plugin http://ultimatepaint.j-t-l.com
73 # XPL: X-Plane plugin http://www.xsquawkbox.net/xpsdk/
95 # https://web.archive.org/web/20171116024937/http://www.ctyme.com/intr/rb-2939.htm#table1593
103 # Most non-DOS MZ-executable extensions have the relocation table more than 0x40 bytes into the fil…
112 # ICL: Icons Library 16-bit http://fileformats.archiveteam.org/wiki/Icon_library
113 >>(0x3c.l) string NE Windows Icons Library 16-bit
114 !:mime image/x-ms-icl
118 >>>(0x3c.l) use lx-executable
124 >>(0x3c.l) default x MS-DOS executable, MZ for MS-DOS
125 !:mime application/x-dosexec
128 # like: EDIT.COM 4DOS.COM CMD8086.COM CMD-FR.COM SYSLINUX.COM
130 # Reference: https://mark0.net/download/triddefs_xml.7z/defs/e/exe-vlm-msg.trid.xml
140 # Reference: https://docs.microsoft.com/de-de/windows/win32/debug/pe-format
142 !:mime application/vnd.microsoft.portable-executable
143 # https://docs.microsoft.com/de-de/windows/win32/debug/pe-format#characteristics
148 # 0x2000~IMAGE_FILE_DLL The image file is a dynamic-link library (DLL)
150 # https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#windows-subsystem
165 # verified by command like `pelook.exe -d WINWORD.HXS & pelook.exe -h WINWORD.HXS`
207 #!:ext foo-exe-os2
221 #!:ext foo-exe-win98
247 #!:ext foo-xbox
278 >>(0x3c.l+4) leshort 0x1f2 PowerPC (big-endian)
282 >>(0x3c.l+4) leshort 0x290 PA-RISC
286 >>(0x3c.l+4) leshort 0x5032 RISC-V 32-bit
287 >>(0x3c.l+4) leshort 0x5064 RISC-V 64-bit
288 >>(0x3c.l+4) leshort 0x5128 RISC-V 128-bit
289 >>(0x3c.l+4) leshort 0x6232 LoongArch 32-bit
290 >>(0x3c.l+4) leshort 0x6264 LoongArch 64-bit
292 >>(0x3c.l+4) leshort 0x8664 x86-64
312 >>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
314 >>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
315 >>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive
316 >>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive
318 >>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive
319 >>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive
320 >>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive
321 >>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive
323 >>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive
326 >>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive
327 >>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive
328 >>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive
329 >>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip)
330 >>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
331 >>0x30 string Inno \b, InnoSetup self-extracting archive
344 >>(0x3c.l) string !PE\0\0 MS-DOS executable
345 #!:mime application/x-dosexec
348 #!:mime application/x-dosexec
349 !:mime application/x-ms-ne-executable
365 # https://www.fileformat.info/format/exe/corion-ne.htm
367 # Application type (bits 0-2); 1~Full screen (not aware of Windows/P.M. API)
394 # NoResNamesTabSiz; size in bytes of non-resident names table
408 # OffStartNonResTab; offset from start of file to non-resident names table
417 # targOS; Target OS; 0~unknown~OS/2 1.0 or MS Windows 1-2
419 # or Windows 1.03 - 2.1 like: MSDOSD.EXE KARTEI.EXE KALENDER.EXE
421 >>>(0x3c.l+0x36) byte 0 for OS/2 1.0 or MS Windows 1-2
424 >>>(0x3c.l+0x36) byte 3 for MS-DOS
427 # http://downloads.sourceforge.net/dfendreloaded/D-Fend-Reloaded-1.4.4.zip
428 # D-Fend Reloaded/VirtualHD/FREEDOS/DPMILD32.EXE
432 >>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender, OS/2
434 >>>(0x3c.l+0x36) byte 0x82 for MS-DOS, Phar Lap DOS extender, Windows
459 …osoft Word text conversion https://www.file-extensions.org/cnv-file-extension-microsoft-word-text-…
463 >>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive
464 >>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
467 !:mime application/x-dosexec
482 >>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive
487 #!:mime application/x-dosexec
488 !:mime application/x-ms-w3-executable
492 #!:mime application/x-dosexec
493 !:mime application/x-ms-w4-executable
498 !:mime application/x-dosexec
501 >>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
502 >>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
503 >>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
504 >>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender
505 >>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
506 >>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
507 >>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
514 # fails with DOS-Extenders.
524 >>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive
529 >>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS
530 !:mime application/x-dosexec
537 >>>>&(2.s-514) string !LE
538 >>>>>&-2 string !BW
545 # DOS examples seems to be already handled by e_lfarlc <0x40 like: CMD8086.COM CMD-FR.COM
546 >>>>>>>(0x3c.l) string !PE \b, MZ for MS-DOS
547 !:mime application/x-dosexec
548 >>>>&(2.s-514) string LE \b, LE
549 >>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
551 # calculations (next embedded executable would be at &(&2*512+&0-2)
552 # I suspect there are only LE executables in these multi-exe files
553 >>>>&(2.s-514) string BW
554 >>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded)
555 >>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS
559 !:mime application/x-dosexec
560 >>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
563 >>&(&0x42.l-3) byte x
573 # may be a self-uncompressing archive, so look for evidence of that and
579 >0xe7 string LH/2\ Self-Extract \b, %s
582 >0x1c string RJSX \b, ARJ self-extracting archive
587 >0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive
590 >0x1e string PKLITE\ Copr. Self-extracting PKZIP archive
593 >0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive
598 >0x24 string LHa's\ SFX \b, LHa self-extracting archive
599 !:mime application/x-lha
600 >0x24 string LHA's\ SFX \b, LHa self-extracting archive
601 !:mime application/x-lha
602 >0x24 string \ $ARX \b, ARX self-extracting archive
603 >0x24 string \ $LHarc \b, LHarc self-extracting archive
604 >0x20 string SFX\ by\ LARC \b, LARC self-extracting archive
605 >0x40 string aPKG \b, aPackage self-extracting archive
607 >0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive
609 >>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
610 >1638 string -lh5- \b, LHa self-extracting archive v2.13S
611 >0x17888 string Rar! \b, RAR self-extracting archive
617 >>&(2.s-517) byte x
618 >>>&0 string PK\3\4 \b, ZIP self-extracting archive
619 >>>&0 string Rar! \b, RAR self-extracting archive
620 >>>&0 string =!\x11 \b, AIN 2.x self-extracting archive
621 >>>&0 string =!\x12 \b, AIN 2.x self-extracting archive
622 >>>&0 string =!\x17 \b, AIN 1.x self-extracting archive
623 >>>&0 string =!\x18 \b, AIN 1.x self-extracting archive
624 >>>&7 search/400 **ACE** \b, ACE self-extracting archive
625 >>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive
629 >(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP)
630 # TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extr…
633 # TELVOX Teleinformatica CODEC self-extractor for OS/2:
642 # https://github.com/open-watcom/open-watcom-v2/blob/master/bld/watcom/h/exeflat.h
643 # Note: by dll-os2-no-dos-stub.trid.xml called "OS/2 Dynamic Link Library (no DOS stub)"
647 >>0 use lx-executable
650 >>0 use \^lx-executable
651 0 name lx-executable
652 # similar looking like variant with MS-DOS stub (MZ magic): "MS-DOS executable, LX"
658 #!:mime application/x-msdownload
659 !:mime application/x-lx-executable
661 # byte order: 00h~little-endian non-zero=1~big-endian
662 #>0x02 ubyte =0 (little-endian)
663 >0x02 ubyte !0 (big-endian)
665 # word order: 00h~little-endian non-zero=1~big-endian
666 #>0x03 ubyte =0 \b, little-endian word order
667 #>0x03 ubyte !0 \b, big-endian word order
676 # OSF_INIT_INSTANCE=00000004h ~Per-Process Library Initialization; setting this bit for EXE file i…
677 #>0x10 ulelong &0x00000004 \b, per-process library Initialization
688 # Per-process Library Termination; setting this bit for EXE file is invalid
689 #>0x10 ulelong&0x40000000 =0x40000000 \b, per-process library termination
693 # http://www.ctyme.com/intr/rb-2939.htm#Table1610
694 # library by module type mask 00038000h (bits 15-17);
706 # bits 8-10; OSF_PM_APP=300h in flags ~Uses PM windowing API; either it is GUI or console
729 >>7 string >\0 \b, author=%-.14s
731 #>>>&0 string x \b%-s
732 >>>&0 string x \b%-.15s
739 >>8 string x \b, name=%-.2s
741 >12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file
754 >>>0 use msdos-driver
755 0 name msdos-driver DOS executable (
756 #!:mime application/octet-stream
757 !:mime application/x-dosdriver
759 # and IBM Token-Ring adapter IBMTOK.DOS. Why and when DOS instead SYS is used?
785 # leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipp…
786 …ce driver name to get phrase like "device driver PROTMAN$" "device driver HP-150II" "device driver…
812 >>>>22 string >\056 %-.6s
815 >>4 uleshort&0x0002 0x0002 \b,32-bit sector-
817 >4 uleshort&0x0040 0x0040 \b,IOCTL-
819 >4 uleshort&0x0800 0x0800 \b,close media-
822 >>4 uleshort&0x2000 0x2000 \b,until busy-
824 >4 uleshort&0x4000 0x4000 \b,control strings-
833 >0 use msdos-driver
836 >0 use msdos-driver
838 >0 use msdos-driver
839 # https://www.uwe-sieber.de/files/cfg_echo.zip
841 >0 use msdos-driver
844 >0 use msdos-driver
846 >0 use msdos-driver
849 >0 use msdos-driver
852 >0 use msdos-driver
867 >>>>0 use msdos-com
878 0 name msdos-com
881 # DOS executable with JuMP 16-bit instruction
887 >>>24 regex =^[A-Z][A-Za-z\040]{5,21} \bLotus driver) %s
888 !:mime application/x-dosexec
891 # COM with nils like MODE.COM IBMDOS.COM (pcdos 3.31 ru Compaq) RSSTUB.COM (PC-DOS 2000 de) ACCESS.…
893 !:mime application/x-dosexec
895 # DOS executable with JuMP 16-bit and without nil padding
899 # look for unreliable Syslinux specific api call INTerrupt 22h for 16-bit COMBOOT program
900 >>>1 search/0xc088 \xcd\x22 \bCOM or COMBOOT 16-bit)
901 !:mime application/x-dosexec
905 !:mime application/x-dosexec
907 # DOS executable without JuMP 16-bit instruction
911 !:mime application/x-dosexec
913 # COM executable without JuMP 16-bit instruction and not SCREATE.SYS
915 !:mime application/x-dosexec
920 >4 string \ $ARX \b, ARX self-extracting archive
921 >4 string \ $LHarc \b, LHarc self-extracting archive
922 >0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
933 >1 byte >-1
947 # ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/
948 # skip unusual floppy image disk1.img of MS-DOS 1.25 (Corona Data Systems OEM)
951 # "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 4.0.rar"
955 # https://github.com/ventoy/Ventoy/releases/download/v1.0.78/ventoy-1.0.78-windows.zip
958 # "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/PC-DOS 1.0 (5.25).rar"
961 >>>>>>>>9 string !7-May-81
962 # "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 5.0 Personal (BA).rar"
967 >>>>>>>>>>0 use msdos-com
975 # skip unusual floppy image TK-DOS11.img IBMDOS11.img of IBM DOS 1.10
978 >>>>>>0 use msdos-com
979 # 8-bit jump with valid number of FAT implies FAT volume already handled by ./filesystems
983 # like: TDSK-64b.img
984 >>>>(11.s-2) uleshort !0xAA55
985 # skip unusual floppy image without boot signature like 360k-256.img (mtools 4.0.18)
988 # "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/Microsoft MS-DOS 3.31 (Compaq OEM) (3.5).rar…
990 # by check for characteristic OEM-ID text
993 >>>>>>>0 use msdos-com
996 # 16-bit offset; for DEBUGGING!; can be negative like: USBDRIVE.COM
999 >1 leshort >-1
1001 # with hexadecimal values like: 06 1e 0e 2e 60 8c 8d b4 ba be e8 fc
1006 >>>>0 use msdos-com
1010 >>>>0 use msdos-com
1016 >>>>>0 use msdos-com
1019 # invalid sectorsize not a power of 2 from 32-32768. Then it is not a disk image and it must be DOS…
1022 >>>>>>0 use msdos-com
1026 >1 leshort <-259
1028 # add 10000h to jump at end of 64 KiB segment, add 1 for jump instruction and 2 for 16-bit offset
1031 #>>>&-1 ubelong x \b, NEXT instruction %#8.8x
1032 >>>0 use msdos-com
1041 >>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT
1044 !:mime application/x-c32-comboot-syslinux-exec
1048 # (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
1058 # look for interrupt instruction like in rem.com (DJGPP) LOADER.COM (DR-DOS 7.x)
1067 # skip Gpt.com Mbr.com (edk2-UDK2018 bootsector) described as "DOS/MBR boot sector" by ./filesystems
1072 >>>>>>0 use msdos-com
1079 >>>>>>0 use msdos-com
1082 #>>>>>&-1 ubyte x \b, INTERUPT %#x
1084 >>>>>0 use msdos-com
1086 # or some EUC-KR text files or one Ulead Imaginfo thumbnail
1095 # skip some EUC-KR text files like: euckr_falsepositive.txt
1099 >>>>>>0 use msdos-com
1102 # Reference: https://github.com/upx/upx/archive/v3.96.zip/upx-3.96/
1103 # src/stub/src/i086-dos16.com.S
1115 >>&2 string UPX! FREE-DOS executable (COM), UPX
1116 !:mime application/x-dosexec
1126 252 string Must\ have\ DOS\ version DR-DOS executable (COM)
1127 !:mime application/x-dosexec
1130 #2 search/28 \xcd\x21 COM executable for MS-DOS
1133 !:mime application/x-dosexec
1137 !:mime application/x-dosexec
1141 !:mime application/x-dosexec
1146 !:mime application/x-dosexec
1151 !:mime application/x-dosexec
1155 !:mime application/x-dosexec
1162 >>17 default x COM executable for MS-DOS
1163 !:mime application/x-dosexec
1166 23 string \xcd\x21 COM executable for MS-DOS
1167 !:mime application/x-dosexec
1170 30 string \xcd\x21 COM executable for MS-DOS
1171 !:mime application/x-dosexec
1175 !:mime application/x-dosexec
1178 0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS
1179 !:mime application/x-dosexec
1182 !:mime application/x-dosexec
1185 0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed
1186 !:mime application/x-dosexec
1191 0 string/b LZ MS-DOS executable (built-in)
1192 #0 byte 0xf0 MS-DOS program library data
1209 # http://www.msxnet.org/word2rtf/formats/ffh-dosword5
1212 # skip droid skeleton like x-fmt-274-signature-id-488.doc
1219 >>>0x6E ulequad =0 1.0-4.0
1220 >>>0x6E ulequad !0 5.0-6.0
1224 !:mime application/x-mswrite
1237 >>>&-2 uleshort =0x0014
1251 >>>>>>>>>>&1 string x \b, %-.8s
1253 >>>>>>>>>>&9 string x created %-.8s
1255 >>0x1E string >0 \b, formatted by %-.66s
1259 >>0x62 string >0 \b, %-.8s printer
1301 0 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document
1317 !:mime application/vnd.ms-excel
1323 # URL: https://en.wikipedia.org/wiki/Lotus_1-2-3
1330 # Lotus Multi Byte Character Set (LMBCS=1-31)
1332 >>20 ubyte <32 Lotus 1-2-3
1333 #!:mime application/x-123
1334 !:mime application/vnd.lotus-1-2-3
1336 # (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data"
1339 # (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data"
1356 # (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data"
1357 # TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet"
1374 >>>>>11 ubyte x \b%d-
1391 # URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3
1392 # Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
1393 # Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
1397 # to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
1398 !:strength -1
1399 # skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
1403 # !:mime application/x-123
1404 !:mime application/vnd.lotus-1-2-3
1407 # undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3"
1408 >>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF)
1410 >>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J
1412 >>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1
1416 >>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2
1418 >>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4
1420 >>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x
1422 >>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x
1426 >>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1
1433 # (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data"
1435 >>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2
1439 >>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ
1442 #>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2
1445 >>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J
1447 # (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data"
1448 >>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x
1452 >>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0
1454 # (version 5.26) labeled the entry as "Lotus 1-2-3"
1459 >>>6 use lotus-cells
1461 >>>(8.s+10) use lotus-cells
1463 0 name lotus-cells
1469 >>>6 uleshort x \b%d-
1475 !:mime application/vnd.lotus-wordpro
1477 !:mime application/vnd.lotus-wordpro
1488 #0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media pl…
1494 # Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WM…
1497 # verified by ImageMagick `identify -verbose *.wmf` as WMF (Windows Meta File)
1500 # Note: called "Windows Metafile Image with Placeable File Header" by DROID via PUID x-fmt/119
1501 # and verified by XnView `nconvert -info abydos.wmf SPA_FLAG.wmf hardcopy-windows-meta.wmf` as "Wi…
1502 # skip failed libreoffice-7.3.2.2 ofz35149-1.wmf with invalid version 2020h and exttextout-2.wmf wi…
1503 # and x-fmt-119-signature-id-609.wmf without version instead of 0100h=METAVERSION100 or 0300h=METAV…
1506 # seems to be always true but in failed samples 2020h ofz35149-1.wmf 56f8h exttextout-2.wmf
1509 # sometimes useful like: hardcopy-windows-meta.wmf (0,0 / 1280,1024)
1510 # but garbage in x-fmt-119-signature-id-609.wmf (-21589,-21589 / -21589,-21589)
1512 # Left; x-coordinate of the upper-left corner of the rectangle
1514 # Top; y-coordinate upper-left corner
1516 # Right; x-coordinate lower-right corner
1518 # Bottom; y-coordinate lower-right corner
1520 # Inch; number of logical units per inch like: 72 96 575 576 1000 1200 1439 1440 2540
1522 # Reserved; field is not used and MUST be set to 0; but ababababh in x-fmt-119-signature-id-609.wmf
1527 >>22 use wmf-head
1530 >0 use wmf-head
1531 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/w/wmf-16.trid.xml
1533 # "Windows Metafile Image without Placeable File Header" by DROID via PUID x-fmt/119
1534 # verified by XnView `nconvert -info *.wmf` as Windows metafile
1537 # skip DROID x-fmt-119-signature-id-1228.wmf by looking for content after header (18 bytes=2*011)
1542 >>0 use wmf-head
1544 0 name wmf-head
1549 # MetafileVersion: 0100h=METAVERSION100~DIBs (device-independent bitmaps) not supported 0300h=METAV…
1550 # but in failed samples 2020h ofz35149-1.wmf 3a02h exttextout-2.wmf
1562 # NumberOfObjects: the number of graphics objects like: 0 hardcopy-windows-meta.wmf 1 2 3 4 5 6 7 8…
1566 … 13 TestPalette.wmf and in failed samples 4254 bitcount-1.wmf 8224 ofz5942-1.wmf 56832 exttextout-…
1570 0 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file
1571 0 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file
1572 0 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file
1593 >>0 use cur-ico-dir
1596 >>0 use cur-ico-dir
1598 0 name cur-ico-dir
1599 # skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
1605 # https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon
1607 #!:mime image/x-icon
1609 >>>>4 uleshort x - %d icon
1613 >>>>0x06 use ico-entry
1616 >>>>>0x16 use ico-entry
1618 #!:mime image/x-cur
1619 !:mime image/x-win-bitmap
1621 >>>>4 uleshort x - %d icon
1624 >>>>0x06 use cur-entry
1625 #>>>>0x16 use cur-entry
1627 0 name cur-entry
1628 >0 use cur-ico-entry
1632 0 name ico-entry
1633 >0 use cur-ico-entry
1639 0 name cur-ico-entry
1654 >>&-4 indirect x \b with
1657 #>>&-4 use dib-image
1659 # Windows non-animated cursors
1663 # GRR: line below is too general as it catches also Lotus 1-2-3 files
1666 >>0 use cur-ico-dir
1668 >>0 use cur-ico-dir
1692 >12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP)
1703 # Too simple - MPi
1717 1 string RDC-meg MegaDots
1724 !:mime application/x-dosexec
1735 >>>&-1 string <PIFMGR.DLL \b, icon=%s
1736 #>>>&-1 string PIFMGR.DLL \b, icon=%s
1737 >>>&-1 string >PIFMGR.DLL \b, icon=%s
1739 >>>&-1 string <Terminal \b, font=%.32s
1740 #>>>&-1 string =Terminal \b, font=%.32s
1741 >>>&-1 string >Terminal \b, font=%.32s
1743 >>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s
1744 #>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s
1745 >>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s
1746 #>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style
1747 #>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style
1748 >0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style
1749 #>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style
1751 #>>&06 string x \b:%s
1753 #>>&06 string x \b:%s
1756 # of http://www.davep.org/norton-guides/ng2h-105.tgz
1761 !:mime application/x-norton-guide
1765 >>8 string >\0 "%-.40s"
1768 >>48 string >\0 \b, %-.66s
1769 >>114 string >\0 %-.66s
1772 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/msg-nc-eng.trid.xml
1780 >6 search/7089 Non-DOS\ disk Norton Commander module message
1781 !:mime application/x-norton-msg
1784 # URL: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm
1785 # Reference: https://mark0.net/download/triddefs_xml.7z/defs/m/msg-netware-dos.trid.xml
1788 #!:mime application/octet-stream
1789 #!:mime application/x-novell-msg
1812 # followed by Ctrl-J Ctrl-Z
1815 # Ctrl-Z
1820 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dat-novell-msg.trid.xml
1821 # ftp://ftp.iitb.ac.in/LDP/en/NLM-HOWTO/NLM-HOWTO-single.html
1827 #!:mime application/octet-stream
1828 #!:mime application/x-novell-msg
1835 >4 string x \b, version %-4.4s
1837 # old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/f…
1842 !:mime application/vnd.ms-htmlhelp
1845 # GFA-BASIC (Wolfram Kleff)
1846 2 string/b GFA-BASIC3 GFA-BASIC 3 data
1848 #------------------------------------------------------------------------------
1852 # Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx
1857 # https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-su…
1863 !:mime application/vnd.ms-cab-compressed
1869 !:mime application/vnd.ms-cab-compressed
1873 !:mime application/vnd.ms-powerpoint
1877 # Reference: https://docs.microsoft.com/en-us/previous-versions/windows/desktop/sidebar/
1880 #!:mime application/vnd.ms-cab-compressed
1882 !:mime application/x-windows-gadget
1887 !:mime application/x-incredimail
1901 # http://file-extension.net/seeker/file_extension_ime
1909 # URL: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/building-device-metadata-…
1910 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/devicemetadata-ms.trid.xml
1911 >>>&-1 string PackageInfo.xml \b, Device Metadata Package
1912 !:mime application/vnd.ms-cab-compressed
1913 !:ext devicemetadata-ms
1915 >>>&-1 string/c _accrpt_.snp \b, Access report snapshot
1919 >>>&-1 string manifest.xsf \b, InfoPath Form Template
1920 !:mime application/vnd.ms-cab-compressed
1921 #!:mime application/vnd.ms-infopath
1926 !:mime application/vnd.ms-cab-compressed
1929 # https://support.microsoft.com/kb/934307/en-US
1932 >>>&-1 string/c wsusscan.cab \b, Microsoft Standalone Update
1933 !:mime application/vnd.ms-cab-compressed
1935 >>>&-1 default x
1938 >>>>&-1 search/255 .
1939 # http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm
1940 # PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002
1944 !:mime application/vnd.ms-powerpoint
1949 !:mime application/vnd.ms-cab-compressed
1951 # https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx
1955 !:mime application/x-windows-themepack
1956 # https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8
1957 # 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack
1967 # 1st member name like: "Class Notes.one" "test-onenote.one" "Open Notebook.onetoc2" "Editor �ffnen…
1974 # 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu
1976 !:mime application/vnd.ms-cab-compressed
1984 !:mime application/vnd.ms-cab-compressed
1992 !:mime application/vnd.ms-cab-compressed
1996 !:mime application/vnd.ms-cab-compressed
1999 >>>>&-1 default x
2001 !:mime application/vnd.ms-cab-compressed
2005 !:mime application/vnd.ms-cab-compressed
2019 >(16.l) use cab-file
2025 >>>>&0 use cab-file
2034 # Cabinet files have a 16-bit cabinet setID field that is designed for application use.
2035 # default is zero, however, the -i option of cabarc can be used to set this field
2042 # cbCFHeader optional size of per-cabinet reserved area 14h 1800h
2044 # cbCFFolder is optional size of per-folder reserved area
2046 # cbCFData is optional size of per-datablock reserved area
2048 # optional per-cabinet reserved area abReserve[cbCFHeader]
2051 >>>(36.s+40) use cab-folder
2056 >>>36 use cab-folder
2059 >>>36 use cab-anchor
2062 >>>36 use cab-anchor
2064 # can not use sub routine cab-anchor to display previous and next cabinet together
2065 #>>>36 use cab-anchor
2066 #>>>>&0 use cab-anchor
2074 >>>>>>>&1 use cab-folder
2076 0 name cab-anchor
2082 0 name cab-folder
2091 # optional per-folder reserved area
2094 0 name cab-file
2109 # define _A_RDONLY (0x01) file is read-only
2130 #>>&17 string >\0 \b, NEXT NAME %-.50s
2140 >20 lelong 0 \b, architecture-independent
2156 # See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
2187 !:mime application/x-ms-reader
2194 # if anything, produced files with version numbers 0-2.
2205 # URL: http://fileformats.archiveteam.org/wiki/BACKUP_(MS-DOS)
2206 # Reference: http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/dos/restore/brtecdoc.htm
2211 >0x5 ubyte-1 <31
2212 >>0x6 ubyte-1 <12
2216 #!:mime application/octet-stream
2222 # skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
2226 # FFh -127 = -1 -127 = -128
2227 # 00h -127 = 0 -127 = -127
2228 >0 byte-127 <-126
2230 >>0x53 ubyte-1 <78
2244 >>>>>>0 ubyte x DOS 2.0-3.2 backed up
2250 #!:mime application/octet-stream
2273 # URL: http://fileformats.archiveteam.org/wiki/MS-DOS_date/time
2274 # Reference: https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-dosdatetimetofil…
2277 0 name dos-date
2278 # HHHHHMMMMMMSSSSS bit encoded Hour (0-23) Minute (0-59) SecondPart (*2)
2282 # YYYYYMMMMDDDDD bit encoded YearPart (+1980) Month (1-12) Day (1-31)