Lines Matching +full:0 +full:x187
9 0 string/t @
26 100 search/0xffff rxfuncadd
27 >100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text
28 100 search/0xffff say
29 >100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text
37 0 string/b MZ
63 #>4 uleshort x \b, e_cp 0x%x
65 #>0x3c ulelong x \b, e_lfanew 0x%x
67 #>0x18 uleshort x \b, e_lfarlc=0x%x
69 #>0x1a uleshort !0 \b, e_ovno 0x%x
70 #>0x1C ubequad !0 \b, e_res 0x%16.16llx
71 # e_oemid; often 0
72 #>0x24 uleshort !0 \b, e_oemid 0x%x
75 #>0x26 uleshort !0 \b, e_oeminfo 0x%x
78 #>0x28 ubequad !0 \b, e_res2 0x%16.16llx
83 #>(0x3c.l) string x \b, at [0x3c] %.2s
84 #>(0x3c.l) ubelong x \b, at [0x3c] %#8.8x
85 #>(0x3c.l+4) ubelong x \b, at [0x3c+4] %#8.8x
87 # Most non-DOS MZ-executable extensions have the relocation table more than 0x40 bytes into the fil…
88 # http://www.mitec.cz/Downloads/EXE.zip/EXE64.exe e_lfarlc=0x8ead
89 # OS/2 ECS\INSTALL\DETECTEI\PCISCAN.EXE e_lfarlc=0x1c
90 # some EFI apps Shell_Full.efi ext4_x64_signed.efi e_lfarlc=0
91 # Icon library WORD60.ICL e_lfarlc=0
92 # Microsoft compiled help format 2.0 WINWORD.DEV.HXS e_lfarlc=0
93 >0x18 uleshort <0x40
97 >>(0x3c.l) string !PE\0\0 MS-DOS executable
102 >>(0x3c.l-0x02) string IMNE \b, NE
103 >>>(0x3c.l+0x02) ubyte x \b version %u
104 >>>(0x3c.l+0x36) byte 2 for MS Windows
105 >>>>(0x3c.l+0x3E) ushort !0
106 >>>>>(0x3c.l+0x3F) ubyte x %u
107 >>>>>(0x3c.l+0x3E) ubyte x \b.%02u
108 >>>(0x3c.l+0x02) ubyte x (Icon Library, Icon Manager by Impact Software)
111 >>(0x3c.l) string LX \b, LX
112 >>>(0x3c.l+0x2) uleshort =0x0000
113 >>>>(0x3c.l) use lx-executable
115 >>>(0x3c.l+0x2) uleshort =0x0101
116 >>>>(0x3c.l) use \^lx-executable
118 >>>(0x3c.l+0x2) uleshort =0x0100
121 >>>0 default x
127 >(0x3c.l) string PE\0\0 PE
131 #>>(0x3c.l+22) uleshort x \b, CHARACTERISTICS %#4.4x,
132 # 0x0200~IMAGE_FILE_DEBUG_STRIPPED Debugging information is removed from the image file
133 # 0x1000~IMAGE_FILE_SYSTEM The image file is a system file, not a user program.
134 # 0x2000~IMAGE_FILE_DLL The image file is a dynamic-link library (DLL)
135 >>(0x3c.l+24) leshort 0x010b \b32 executable
137 #>>>(0x3c.l+92) leshort x \b, SUBSYSTEM %u
138 >>(0x3c.l+24) leshort 0x020b \b32+ executable
139 #>>>(0x3c.l+92) leshort x \b, SUBSYSTEM %u
140 # ROM image is without DOS MZ header and without PE\0\0 signature
141 #>>(0x3c.l+24) leshort 0x0107 ROM image
142 >>(0x3c.l+24) default x with unknown signature
143 >>>&0 leshort x %#x
146 >>(0x3c.l+92) clear x
148 # 0~IMAGE_SUBSYSTEM_UNKNOWN An unknown subsystem
149 >>(0x3c.l+92) leshort 0
154 >>>0x40 string Wine\ placeholder\ DLL for WINE stub (DLL)
156 >>>0x40 string Wine\ builtin\ DLL for WINE (DLL)
158 >>>0 default x
170 >>>>(0x3c.l+6) uleshort =2
173 >>>>>(0x3c.l+288) string/b .its\0\0\0\0
177 # Fallback for any unrecognized binary with Unknown subsystem 0
178 >>>>>>0 default x for Unknown subsystem 0
179 >>>>>0 default x for Unknown subsystem 0
180 >>>>0 default x for Unknown subsystem 0
183 >>(0x3c.l+92) leshort 1
185 >>>0x40 string Wine\ placeholder\ DLL for WINE stub
186 >>>0x40 string Wine\ builtin\ DLL for WINE
187 >>>0 default x for MS Windows
188 >>>>(0x3c.l+72) leshort x %u
189 >>>>(0x3c.l+74) leshort x \b.%02u
198 >>>(0x3c.l+22) leshort&0x2000 >0 (native)
200 >>>(0x3c.l+22) leshort&0x2000 0 (native)
204 >>(0x3c.l+92) leshort 2
206 >>>0x40 string Wine\ placeholder\ DLL for WINE stub
207 >>>0x40 string Wine\ builtin\ DLL for WINE
208 >>>0 default x for MS Windows
209 >>>>(0x3c.l+72) leshort x %u
210 >>>>(0x3c.l+74) leshort x \b.%02u
211 >>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
221 >>>(0x3c.l+22) leshort&0x2000 0 (GUI)
227 >>(0x3c.l+92) leshort 3
229 >>>0x40 string Wine\ placeholder\ DLL for WINE stub
230 >>>0x40 string Wine\ builtin\ DLL for WINE
231 >>>0 default x for MS Windows
232 >>>>(0x3c.l+72) leshort x %u
233 >>>>(0x3c.l+74) leshort x \b.%02u
234 >>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
236 >>>(0x3c.l+22) leshort&0x2000 0 (console)
240 #>>(0x3c.l+92) leshort 4 for MS Windows CE OLD
244 #>>(0x3c.l+92) leshort 5 for OS/2
247 #>>(0x3c.l+92) leshort 6 for Unknown subsystem 6
250 >>(0x3c.l+92) leshort 7 for POSIX
251 >>>(0x3c.l+72) leshort x %u
252 >>>(0x3c.l+74) leshort x \b.%02u
253 >>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
256 >>>(0x3c.l+22) leshort&0x2000 0 (EXE)
265 #>>(0x3c.l+92) leshort 8 for Win9x/MMOSA
269 >>(0x3c.l+92) leshort 9
271 >>>0x40 string Wine\ placeholder\ DLL for WINE stub
272 >>>0x40 string Wine\ builtin\ DLL for WINE
273 >>>0 default x for MS Windows CE
274 >>>>(0x3c.l+72) leshort x %u
275 >>>>(0x3c.l+74) leshort x \b.%02u
276 >>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
279 >>>(0x3c.l+22) leshort&0x2000 0 (EXE)
284 >>(0x3c.l+92) leshort 10 for EFI (application)
289 >>(0x3c.l+92) leshort 11 for EFI (boot service driver)
294 >>(0x3c.l+92) leshort 12 for EFI (runtime driver)
299 >>(0x3c.l+92) leshort 13 for EFI (ROM)
304 >>(0x3c.l+92) leshort 14 for XBOX
308 #>>(0x3c.l+92) leshort 15 for Unknown subsystem 15
311 >>(0x3c.l+92) leshort 16 for MS Windows
312 >>>(0x3c.l+72) leshort x %u
313 >>>(0x3c.l+74) leshort x \b.%02u
314 >>>(0x3c.l+22) leshort&0x2000 >0 (boot DLL)
317 >>>(0x3c.l+22) leshort&0x2000 0 (boot application)
321 >>(0x3c.l+92) default x
322 >>>&0 leshort x for Unknown subsystem %#x
325 >>(0x3c.l+4) clear x \b,
326 >>(0x3c.l+4) use display-coff-processor
328 >>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB)
329 >>(0x3c.l+22) leshort&0x1000 >0 system file
332 >>(0x3c.l+24) leshort 0x010b
333 >>>(0x3c.l+116) leshort >14
334 >>>>(0x3c.l+232) lelong >0 Mono/.Net assembly
335 >>(0x3c.l+24) leshort 0x020b
336 >>>(0x3c.l+132) leshort >14
337 >>>>(0x3c.l+248) lelong >0 Mono/.Net assembly
354 >>>(8.s*16) search/0x50 32rtm-stub\ for\ PE\ files \b, Borland 32rtm DOS extender (stub)
356 >>(8.s*16) search/0x50 Phar\ Lap\ Software,\ Inc. \b, Phar Lap TNT DOS extender
358 >>(8.s*16) search/0x200 Can't\ find\ DOSWIN32.RTM \b, DosWin32 DOS extender (stub)
359 >>(8.s*16) search/0x4000 Stub\ failed\ to\ find\ DOS/4G\ extender. \b, DOS/4G DOS extender (stub)
361 # x86 jmp near relative (0xe9 0x?? 0x??) + string "MI" (0x4d 0x49)
362 >>(8.s*16) ulequad&0xffff0000ff =0x494d0000e9 \b, HX DOS extender (embedded with DPMI host)
363 >>(8.s*16) ulequad&0xffff0000ff !0x494d0000e9
365 >>>(8.s*16) search/0x200 cannot\ find\ loader\ DPMILD32.EXE \b, HX DOS extender (stub)
367 >>>(8.s*16) search/0x600 PATH=HDPMI32.EXE \b, HX DOS extender (embedded without DPMI host)
369 >>>(8.s*16) search/0x4000 DPMILD32: \b, HX DOS extender (embedded without DPMI host)
371 >>(0x3c.l+0xf8) string UPX0 \b, UPX compressed
372 >>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed
373 >>(0x3c.l+0xf8) search/0x140 UPX2
374 >>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
375 >>(0x3c.l+0xf8) search/0x140 .idata
376 >>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
377 >>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive
378 >>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive
379 >>(0x3c.l+0xf8) search/0x140 .rsrc
380 >>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive
381 >>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive
382 >>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive
383 >>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive
384 >>(0x3c.l+0xf8) search/0x140 .data
385 >>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive
386 >>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed
387 >>>(0x3c.l+0xf7) byte x
388 >>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive
389 >>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive
390 >>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive
391 >>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip)
392 >>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
393 >>0x30 string Inno \b, InnoSetup self-extracting archive
396 >>(0x3c.l+6) leshort >1 \b, %u sections
398 #>>(0x3c.l+6) leshort =1 \b, %u section
400 # If the relocation table is 0x40 or more bytes into the file, it's definitely
402 >0x18 uleshort >0x3f
406 >>(0x3c.l) string !PE\0\0 MS-DOS executable
409 >>(0x3c.l) string NE \b, NE
412 >>>(0x3c.l+0x02) ubyte x \b version %u
413 >>>(0x3c.l+0x02) ubyte >5
414 >>>>(0x3c.l+0x03) ubyte x \b.%02u
418 #>>>(0x3c.l+0x02) ubyte <5
419 #>>>>(0x3c.l+0x08) ulelong !0 \b, Created at
420 #>>>>>(0x3c.l+0x0a) lemsdosdate x %s
421 #>>>>>(0x3c.l+0x08) lemsdostime x %s
423 #>>>(0x3c.l+0x0C) ubyte x \b, ProgFlags 0x%2.2x
424 # >>>(0x3c.l+0x0c) ubyte&0x03 =0 \b, no automatic data segment
425 # >>>(0x3c.l+0x0c) ubyte&0x03 =1 \b, single shared
426 # >>>(0x3c.l+0x0c) ubyte&0x03 =2 \b, multiple
427 # >>>(0x3c.l+0x0c) ubyte&0x03 =3 \b, (null)
428 # >>>(0x3c.l+0x0c) ubyte &0x04 \b, Per-Process Library Initialization OR real mode only
429 # >>>(0x3c.l+0x0c) ubyte &0x08 \b, Protected mode only
430 # >>>(0x3c.l+0x0c) ubyte &0x10 \b, 8086 instructions in OS/2 app OR LIM 3.2 EMS API in Win app
431 # >>>(0x3c.l+0x0c) ubyte &0x20 \b, i286 instructions in OS/2 app OR each instance in separate EMS …
432 # >>>(0x3c.l+0x0c) ubyte &0x40 \b, i386 instructions in OS/2 app OR private GlobalAlloc above the …
433 # >>>(0x3c.l+0x0c) ubyte &0x80 \b, x87 floating point instructions
436 #>>>(0x3c.l+0x0D) ubyte x \b, ApplFlags 0x%2.2x
437 # Application type (bits 0-2); 1~Full screen (not aware of Windows/P.M. API)
439 #>>>(0x3c.l+0x0D) ubyte&0x07 =1 \b, Not compatiblr with Windows/P.M. API (full screen)
440 #>>>(0x3c.l+0x0D) ubyte&0x07 =2 \b, Compatible with Windows/P.M. API (console mode)
441 #>>>(0x3c.l+0x0D) ubyte&0x07 =3 \b, use Windows/P.M. API (window mode)
442 #>>>(0x3c.l+0x0D) ubyte &0x08 \b, Bound OS/2 app OR application specific loader in Win app
443 #>>>(0x3c.l+0x0D) ubyte &0x20 \b, Errors in image
444 #>>>(0x3c.l+0x0D) ubyte &0x40 \b, Non-conforming OS/2 app OR private Win library above EMS line
446 #>>>(0x3c.l+0x0D) ubyte &0x80 \b, DLL or driver
447 # AutoDataSegIndex; automatic data segment index like: 0 2 3 22
449 #>>>(0x3c.l+0x0e) uleshort x \b, AutoDataSegIndex %u
450 # InitHeapSize; intial local heap size like; 0 400h 1400h
452 #>>>(0x3c.l+0x10) uleshort !0 \b, InitHeapSize 0x%x
453 # InitStackSize; inital stack size like: 0 10h A00h 7D0h A8Ch FA0h 1000h 1388h
457 #>>>(0x3c.l+0x12) uleshort !0 \b, InitStackSize 0x%x
458 # EntryPoint; segment offset value of CS:IP like: 0 10000h 18A84h 11C1Ah 307F1h
459 #>>>(0x3c.l+0x14) ulelong !0 \b, EntryPoint 0x%x
461 # like: 0 20000h 160000h
462 #>>>(0x3c.l+0x18) ulelong !0 \b, InitStack 0x%x
463 # SegCount; number of segments in segment table like: 0 1 2 3 16h
464 #>>>(0x3c.l+0x1C) uleshort x \b, SegCount 0x%x
465 # ModRefs; number of module references (DLLs) like; 0 1 3
466 #>>>(0x3c.l+0x1E) uleshort !0 \b, ModRefs %u
469 #>>>(0x3c.l+0x20) uleshort x \b, NoResNamesTabSiz 0x%x
471 #>>>(0x3c.l+0x22) uleshort !0x40 \b, SegTableOffset 0x%x
474 #>>>(0x3c.l+0x24) uleshort x \b, ResTableOffset 0x%x
477 #>>>(0x3c.l+0x26) uleshort x \b, ResidNamTable 0x%x
480 #>>>(0x3c.l+0x2a) uleshort x \b, ImportNameTable 0x%x
483 #>>>(0x3c.l+0x2c) ulelong x \b, OffStartNonResTab 0x%x
484 # MovEntryCount; number of movable entry points like: 0 4 5 6 16 17 24 312 355 446
485 #>>>(0x3c.l+0x30) uleshort !0 \b, MovEntryCount %u
486 # FileAlnSzShftCnt; log2 of the segment sector size; 4~16 0~9~512 (default)
487 #>>>(0x3c.l+0x32) uleshort !9 \b, FileAlnSzShftCnt %u
488 # nResTabEntries; number of resource table entries like: 0 2
489 #>>>(0x3c.l+0x34) uleshort !0 \b, nResTabEntries %u
491 >>>(0x3c.l+0x02) ubyte >4
492 # targOS; Target OS; 0~unspecified (OS/2 or Windows); detect it based on Windows-only flags and OS/…
493 #>>>(0x3c.l+0x36) byte x TARGOS %x
494 >>>>(0x3c.l+0x36) byte 0
496 >>>>>(0x3c.l+0x3E) ushort !0 for MS Windows
497 >>>>>>(0x3c.l+0x3F) ubyte x %u
498 >>>>>>(0x3c.l+0x3E) ubyte x \b.%02u
499 >>>>>>(0x3c.l+0x3F) ubyte <3
500 >>>>>>>(0x3c.l+0x37) byte&0x04 0 (real mode only)
501 >>>>>>>(0x3c.l+0x37) byte&0x04 !0 (real+protected mode)
502 >>>>>>(0x3c.l+0x3E) ushort =0x0300
503 >>>>>>>(0x3c.l+0x0c) ubyte&0x08 0 (real+protected mode)
504 >>>>>>>(0x3c.l+0x0c) ubyte&0x08 !0 (protected mode only)
505 >>>>>(0x3c.l+0x3E) ushort 0
506 >>>>>>(0x3c.l+0x2a) leshort 0 for OS/2 1.x or MS Windows 1.x/2.x
507 >>>>>>(0x3c.l+0x2a) default x
509 >>>>>>>&(&0.s-0x29) search/512/C \x08DOSCALLS for OS/2 1.x
510 >>>>>>>(0x3c.l+0x2a) default x
513 >>>>>>>>&(&0.s-0x29) regex/512/C KERNEL|USER|GDI for MS Windows 1.x/2.x
514 >>>>>>>>>(0x3c.l+0x37) byte&0x04 0 (real mode only)
515 >>>>>>>>>(0x3c.l+0x37) byte&0x04 !0 (real+protected mode)
517 >>>>>>>>(0x3c.l+0x2a) default x for OS/2 1.x or MS Windows 1.x/2.x
518 >>>>(0x3c.l+0x36) byte 1 for OS/2 1.x
519 >>>>(0x3c.l+0x36) byte 2 for MS Windows
522 >>>>>(0x3c.l+0x3E) ushort !0
523 >>>>>>(0x3c.l+0x3F) ubyte x %u
524 >>>>>>(0x3c.l+0x3E) ubyte x \b.%02u
526 >>>>>(0x3c.l+0x3E) ushort 0 1.x/2.x
527 >>>>>(0x3c.l+0x3F) ubyte <3
528 >>>>>>(0x3c.l+0x37) byte&0x04 0 (real mode only)
529 >>>>>>(0x3c.l+0x37) byte&0x04 !0 (real+protected mode)
530 >>>>>(0x3c.l+0x3E) ushort =0x0300
531 >>>>>>(0x3c.l+0x0c) ubyte&0x08 0 (real+protected mode)
532 >>>>>>(0x3c.l+0x0c) ubyte&0x08 !0 (protected mode only)
541 >>>>>(0x3c.l+0x3E) ushort >0x0300
542 >>>>>>(0x3c.l+0x37) ubyte&0x80 0
543 >>>>>>>0x20 ubyte&0x04 !0 \b, P-code application
549 >>>>>(0x3c.l+0x3E) ushort >0x0300
550 >>>>>>0x38 ulong !0
551 >>>>>>>(0x38.l) string MQ \b, Watcom Win386 extender
553 #>>>>(0x3c.l+0x36) byte 3 for Multitasking MS-DOS
555 #>>>>(0x3c.l+0x36) byte 4 for MS Windows/386 device driver
557 >>>>(0x3c.l+0x36) byte 5 for MS-DOS
559 # x86 jmp near relative (0xe9 0x?? 0x??) + string "MI" (0x4d 0x49)
560 >>>>>(8.s*16) ulequad&0xffff0000ff =0x494d0000e9 \b, HX DOS extender 16-bit (embedded with DPMI ho…
561 >>>>>(8.s*16) ulequad&0xffff0000ff !0x494d0000e9
563 >>>>>>(8.s*16) search/0x200 cannot\ find\ loader\ DPMILD16.EXE \b, HX DOS extender 16-bit (stub)
565 >>>>>>(8.s*16) search/0x4000 DPMILD16: \b, HX DOS extender 16-bit (embedded without DPMI host)
568 >>>>>>>(8.s*16) search/0x1000 rtm.exe\0dpmi16bi.ovl \b, Borland rtm DOS extender (stub)
571 >>>>>>>(8.s*16) search/0x1000 BOSS\ Stub\ Version \b, Borland BOSS DOS extender (stub)
576 >>>>(0x3c.l+0x36) byte 6 for MS-DOS
578 # x86 jmp near relative (0xe9 0x?? 0x??) + string "MI" (0x4d 0x49)
579 >>>>>(8.s*16) ulequad&0xffff0000ff =0x494d0000e9 \b, HX DOS extender 32-bit (embedded with DPMI ho…
580 >>>>>(8.s*16) ulequad&0xffff0000ff !0x494d0000e9
582 >>>>>>(8.s*16) search/0x200 cannot\ find\ loader\ DPMILD32.EXE \b, HX DOS extender 32-bit (stub)
584 >>>>>>(8.s*16) search/0x4000 DPMILD32: \b, HX DOS extender 32-bit (embedded without DPMI host)
588 >>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap 286 DOS extender, emulating OS/2 1.x
591 >>>>(0x3c.l+0x36) byte 0x82 for MS-DOS, Phar Lap 286 DOS extender, emulating MS Windows
592 >>>>>(0x3c.l+0x3E) ushort 0 1.x/2.x
593 >>>>>(0x3c.l+0x3E) ushort !0
594 >>>>>>(0x3c.l+0x3F) ubyte x %u
595 >>>>>>(0x3c.l+0x3E) ubyte x \b.%02u
596 >>>>(0x3c.l+0x36) default x
597 >>>>>(0x3c.l+0x36) ubyte x for unknown OS %#x
600 #>>>>(0x3c.l+0x37) byte !0 \b, OS2EXEFlags 0x%x
601 # gangstart; offset to start of gangload area like: 0 34h 58h 246h
602 #>>>>(0x3c.l+0x38) uleshort !0 \b, gangstart 0x%x
604 # like: 0 33Eh 39Ah AEEh
605 #>>>>(0x3c.l+0x3A) uleshort !0 \b, ganglength 0x%x
606 # mincodeswap; minimum code swap area size like 0 620Ch
607 #>>>>(0x3c.l+0x3C) uleshort !0 \b, mincodeswap 0x%x
608 >>>>(0x3c.l+0x3F) ubyte =3
609 >>>>>0x3c ulelong >0x800
610 >>>>>>(0x3c.l+0x37) ubyte &0x80 with OS/2 WLO loader
611 # Detection for NE versions <5 which do not have OS type byte 0x36
613 # WINE binaries have special signature after the dos header (at fixed offset 0x40)
616 # 16-bit indirect offset 0x2a relative to the beginning of NE header, and consist
618 >>>(0x3c.l+0x02) ubyte <5
620 >>>>0x40 string Wine\ placeholder\ DLL for WINE stub
621 >>>>(0x3c.l+0x2a) default x
623 >>>>>&(&0.s-0x29) search/512/C \x08DOSCALLS for Multitasking MS-DOS
624 >>>>>(0x3c.l+0x2a) default x for MS Windows 1.x/2.x
626 # - os type if is 0 or 2
630 # So if os type is correct (0 or 2; matched mask 0xfd) and at least one
631 # of those bits is set and others are cleared (matched mask 0xf9) then
633 >>>>>>(0x3c.l+0x36) leshort&0xf9fd 0
634 >>>>>>>(0x3c.l+0x37) byte&0x06 !0
635 >>>>>>>>(0x3c.l+0x37) byte&0x04 0 (real mode only)
636 >>>>>>>>(0x3c.l+0x37) byte&0x04 !0 (real+protected mode)
637 >>>>>>>(0x3c.l+0x37) default x (real mode only)
638 >>>>>>(0x3c.l+0x36) default x (real mode only)
647 >>>(0x3c.l+0x0c) leshort &0x8000
648 # Check segment count, if 0 then this is resource-only DLL
649 >>>>(0x3c.l+0x1c) leshort 0
650 >>>>>(0x3c.l+0x2c) lelong !0
655 >>>>>(0x3c.l+0x2c) lelong 0 (DLL, resource-only)
657 >>>>(0x3c.l+0x1c) leshort !0
659 >>>>>(0x3c.l+0x2c) lelong !0
664 >>>>>(0x3c.l+0x2c) lelong 0 (DLL)
666 >>>(0x3c.l+0x0c) leshort&0x8000 0 (EXE)
668 >>>>(0x3c.l+0x0d) ubyte&0x07 =1 (full screen)
669 >>>>(0x3c.l+0x0d) ubyte&0x07 =2 (console)
670 >>>>(0x3c.l+0x0d) ubyte&0x07 =3 (GUI)
671 >>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive
672 >>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
674 >>(0x3c.l) string LX \b, LX
676 >>>(0x3c.l+0x2) uleshort =0x0000
677 >>>>(0x3c.l) use lx-executable
679 >>>(0x3c.l+0x2) uleshort =0x0101
680 >>>>(0x3c.l) use \^lx-executable
682 >>>(0x3c.l+0x2) uleshort =0x0100
685 >>>0 default x
689 >>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive
693 >>(0x3c.l) string W3 \b, W3 for MS Windows
696 >>>(0x3c.l+0x3) ubyte <4 %u
699 >>>(0x3c.l+0x3) ubyte >3 %u
702 >>>(0x3c.l+0x2) ubyte x \b.%02u
705 >>(0x3c.l) string W4 \b, W4 for MS Windows
710 >>>(0x3c.l+0x3) ubyte x %u
711 >>>(0x3c.l+0x2) ubyte x \b.%02u
713 # Linear Executable (LE) in Little Endian (\0\0)
714 >>(0x3c.l) string LE\0\0 \b, LE
716 >>>(0x3c.l+0x0a) leshort 1
718 >>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS/4G DOS extender
719 >>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS/4GW DOS extender
720 >>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
721 >>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender
722 >>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
723 >>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
724 >>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
727 >>>>0 default x
729 >>>>>(0x3c.l+0x10) lelong&0x38000 =0x18000 for MS-DOS (DLL)
733 # EXE module (&0x38000=0x00000) with zero application type (&0x700=0x000) and
734 # with no external fixups (&0x20=0x20) is .386 32-bit driver module for OS/2 1.x
735 >>>>>(0x3c.l+0x10) lelong&0x38720 =0x00020 for OS/2 1.x (driver)
737 >>>>>0 default x for unknown OS 0x1
739 >>>>&0x24 lelong <0x50
740 >>>>>(&0x4c.l) string \xfc\xb8WATCOM
741 >>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed
743 #>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2
746 #>>>(0x3c.l+0x0a) leshort 2 for MS Windows 16-bit
748 #>>>(0x3c.l+0x0a) leshort 3 for Multitasking MS-DOS
749 >>>(0x3c.l+0x0a) leshort 4 for MS Windows
750 >>>>(0x3c.l+0xc3) ubyte x %u
751 >>>>(0x3c.l+0xc2) ubyte x \b.%02u
752 >>>>(0x3c.l+0x10) lelong&0x38000 =0x08000
753 # DLL module (0x08000) with no external fixups (0x20) for i386 CPU (2) is .386 VxD file for MS Wind…
754 >>>>>(0x3c.l+0x10) lelong&0x20 !0
755 >>>>>>(0x3c.l+0x08) leshort 2 (VxD 386)
757 >>>>(0x3c.l+0x10) lelong&0x38000 =0x28000 (VxD static)
762 >>>>(0x3c.l+0x10) lelong&0x38000 =0x38000 (VxD dynamic)
764 >>>(0x3c.l+0x0a) default x
765 >>>>(0x3c.l+0x0a) leshort x for unknown OS %#x
766 >>>(&0x7c.l+0x26) string UPX \b, UPX compressed
767 >>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive
770 >>(0x3c.l) string LC\0\0 \b, LC for MS-DOS
771 >>>0x40 search/0x40 STUB/32A \b, DOS/32A DOS extender (stub)
772 >>>0x40 search/0x80 STUB/32C \b, DOS/32A DOS extender (configurable stub)
773 >>>0x40 search/0x80 DOS/32A \b, DOS/32A DOS extender (embedded)
775 # PX\0\0 signature for 32bit DOS Applications in DOS-PE Format (https://www.japheth.de/HX.html)
777 >(0x3c.l) string PX\0\0 \b, PE32
778 >>(0x3c.l+24) leshort 0x020b \b+
779 >>0 clear x
780 >>0 default x executable for MS-DOS
782 # x86 jmp near relative (0xe9 0x?? 0x??) + string "MI" (0x4d 0x49)
783 >>(8.s*16) ulequad&0xffff0000ff =0x494d0000e9 \b, HX DOS extender (embedded with DPMI host)
784 >>(8.s*16) ulequad&0xffff0000ff !0x494d0000e9
786 >>>(8.s*16) search/0x200 cannot\ find\ loader\ DPMILD32.EXE \b, HX DOS extender (stub)
788 >>>(8.s*16) search/0x600 PATH=HDPMI32.EXE \b, HX DOS extender (embedded without DPMI host)
790 >>>(8.s*16) search/0x4000 DPMILD32: \b, HX DOS extender (embedded without DPMI host)
792 >0 clear x
795 >(0x3c.l) string PE\0\0
796 >(0x3c.l) string PX\0\0
797 >(0x3c.l) string LX
798 >(0x3c.l) string NE
799 >>(0x3c.l-0x02) string !IMNE
800 >>>0x18 uleshort <0x40
801 >>>>0 use mz-unrecognized
802 >(0x3c.l) string W3
803 >>0x18 uleshort <0x40
804 >>>0 use mz-unrecognized
805 >(0x3c.l) string W4
806 >>0x18 uleshort <0x40
807 >>>0 use mz-unrecognized
808 >(0x3c.l) string LE\0\0
809 >>0x18 uleshort <0x40
810 >>>0 use mz-unrecognized
811 >(0x3c.l) string LC
812 >>0x18 uleshort <0x40
813 >>>0 use mz-unrecognized
814 >0 default x
816 >>2 leshort !0
822 >>>>>>0 use mz-bw-collection
824 >>>>>>0 use mz-3p
825 >>>>0 default x
826 >>>>>0 use mz-unrecognized
827 >>>0 default x
828 >>>>0 use mz-unrecognized
829 >>2 leshort 0
833 >>>>>0 use mz-bw-collection
835 >>>>>0 use mz-3p
836 >>>0 default x
837 >>>>0 use mz-unrecognized
840 >(4.s*512) leshort 0x014c
844 >>(&-6.l) string/b StubInfoMagic!!\0 for MS-DOS
849 >>&(&0x42.l-3) byte x
850 >>>&0x26 string UPX \b, UPX compressed
852 >>&0x2c search/0xa0 .text
853 >>>&0x0b lelong <0x2000
854 >>>>&0 lelong >0x6000 \b, 32lite compressed
857 >(4.s*512) leshort 0x010b
859 >>(&-6.l) string/b StubInfoMagic!!\0 for MS-DOS
865 >>(&-4.l) string/b StubInfoMagic!!\0
866 >>>&0 lelong >39
870 >>>&0 lelong <40 \b, DJGPP go32 v1 DOS extender (stub)
871 >>>&0 lelong >35
872 >>>>&0 byte !0
874 >>>&0 lelong >62
875 >>>>&28 byte !0
882 >>&0 string ,\ v\
883 >>>&0 string/4 x \b, DJGPP go32 v%s DOS extender
884 >>&0 default x
885 >>>&0 string/8 x \b, DJGPP go32 %s DOS extender
887 >>>&24 byte 0
889 >>>>0x1c string PMODSTUB.EXE (embedded PMODE/DJ)
890 >>>>0x1c string !PMODSTUB.EXE
891 >>>>>0x18 leshort 0
893 >>>>>>0x40 search/0x80 The\ STUB.EXE\ stub\ loader (stub)
896 >>>>>>>>>&56 byte !0
899 >>>>>(0x18.s) default x
900 >>>>>>&(0x6.s*4) default x
902 >>>>>>>&0 search/16 CWSDPMI
905 >>>>>>>&0 search/16 D3X
907 >>>&24 byte !0
919 >0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, a…
920 >0xe7 string LH/2\ Self-Extract \b, %s
921 >0x1c string UC2X \b, UCEXE compressed
922 >0x1c string WWP\ \b, WWPACK compressed
923 >0x1c string RJSX \b, ARJ self-extracting archive
924 >0x1c string diet \b, diet compressed
925 >0x1c string LZ09 \b, LZEXE v0.90 compressed
926 >0x1c string LZ91 \b, LZEXE v0.91 compressed
927 >0x1c string tz \b, TinyProg compressed
928 >0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. \b, Self-extracting PKZIP archive
931 >0x1e string PKLITE\ Copr. \b, Self-extracting PKZIP archive
934 >0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive
935 >0x20 string AIN
936 >>0x23 string 2 \b, AIN 2.x compressed
937 >>0x23 string <2 \b, AIN 1.x compressed
938 >>0x23 string >2 \b, AIN 1.x compressed
939 >0x24 string LHa's\ SFX \b, LHa self-extracting archive
941 >0x24 string LHA's\ SFX \b, LHa self-extracting archive
943 >0x24 string \ $ARX \b, ARX self-extracting archive
944 >0x24 string \ $LHarc \b, LHarc self-extracting archive
945 >0x20 string SFX\ by\ LARC \b, LARC self-extracting archive
946 >0x40 string aPKG \b, aPackage self-extracting archive
947 >0x64 string W\ Collis\0\0 \b, Compack compressed
948 >0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive
949 >>&0xf4 search/0x140 \x0\x40\x1\x0
950 >>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
952 >0x17888 string Rar! \b, RAR self-extracting archive
959 >>>&0 string PK\3\4 \b, ZIP self-extracting archive
960 >>>&0 string Rar! \b, RAR self-extracting archive
961 >>>&0 string =!\x11 \b, AIN 2.x self-extracting archive
962 >>>&0 string =!\x12 \b, AIN 2.x self-extracting archive
963 >>>&0 string =!\x17 \b, AIN 1.x self-extracting archive
964 >>>&0 string =!\x18 \b, AIN 1.x self-extracting archive
966 >>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive
970 >(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP)
981 0 name mz-next-overlay
982 >0 string P2 \b, EXP (P2) for MS-DOS, Phar Lap 286 DOS extender
983 >0 string P3 \b, EXP (P3) for MS-DOS, Phar Lap 386 DOS extender
984 >0 string MT \b, MT for MS-DOS, IGC XMLOD i386 DOS extender
985 >0 string 3P \b, 3P for MS-DOS
987 >>32 lelong&0x00000001 !0 \b, 16-bit
988 >>32 lelong&0x00000001 0
990 >>>32 lelong&0x00010000 0 \b, 32-bit
992 >>>32 lelong&0x00010000 !0 \b, Dual mode
993 >>32 lelong&0x80000000 !0 \b, Compressed
994 >0 string D3X1 \b, D3X1 for MS-DOS, D3X DOS extender
996 >0 string BW \b, BW collection for MS-DOS
998 >0 leshort 0x010b \b, a.out
1000 >0 leshort 0x014c \b, COFF
1001 >0 default x
1002 # now make offset aligned to 0x10
1003 >>0 offset%0x10 0x0
1005 >>>0x0 use mz-next-overlay-aligned
1006 >>0 offset%0x10 0x1
1007 >>>0xf use mz-next-overlay-aligned
1008 >>0 offset%0x10 0x2
1009 >>>0xe use mz-next-overlay-aligned
1010 >>0 offset%0x10 0x3
1011 >>>0xd use mz-next-overlay-aligned
1012 >>0 offset%0x10 0x4
1013 >>>0xc use mz-next-overlay-aligned
1014 >>0 offset%0x10 0x5
1015 >>>0xb use mz-next-overlay-aligned
1016 >>0 offset%0x10 0x6
1017 >>>0xa use mz-next-overlay-aligned
1018 >>0 offset%0x10 0x7
1019 >>>0x9 use mz-next-overlay-aligned
1020 >>0 offset%0x10 0x8
1021 >>>0x8 use mz-next-overlay-aligned
1022 >>0 offset%0x10 0x9
1023 >>>0x7 use mz-next-overlay-aligned
1024 >>0 offset%0x10 0xa
1025 >>>0x6 use mz-next-overlay-aligned
1026 >>0 offset%0x10 0xb
1027 >>>0x5 use mz-next-overlay-aligned
1028 >>0 offset%0x10 0xc
1029 >>>0x4 use mz-next-overlay-aligned
1030 >>0 offset%0x10 0xd
1031 >>>0x3 use mz-next-overlay-aligned
1032 >>0 offset%0x10 0xe
1033 >>>0x2 use mz-next-overlay-aligned
1034 >>0 offset%0x10 0xf
1035 >>>0x1 use mz-next-overlay-aligned
1036 0 name mz-next-overlay-aligned
1037 >0 string MP \b, EXP (MP) for MS-DOS, Phar Lap 386 DOS extender
1038 >0 default x
1039 >>0 use mz-unrecognized
1043 0 name mz-unrecognized
1044 >0 default x \b, MZ for MS-DOS
1056 0 name mz-bw-collection
1058 >>&(&0x30.s) default x
1059 >>>&0 string DOS/16M \b, DOS/16M DOS extender (embedded)
1062 >>>0 default x
1063 >>>>(8.s*16) search/0x4000 Stub\ failed\ to\ find\ DOS/4G\ extender. \b, DOS/4G DOS extender (stub)
1067 0 name mz-3p
1069 >0x440 search/0x100 CauseWay\ DOS\ Extender \b, CauseWay DOS extender
1071 >0x200 search/0x100 CauseWay\ dynamic\ link\ library \b, CauseWay DLL
1083 0 string/b LX LX executable
1086 >2 uleshort =0x0000
1087 >>0 use lx-executable
1089 >2 uleshort =0x0101
1090 >>0 use \^lx-executable
1092 >2 uleshort =0x0100
1095 >>0 default x
1098 0 name lx-executable
1101 #>0x02 ubyte =0 \b, little-endian byte order
1102 #>0x02 ubyte =1 \b, big-endian word order
1104 #>0x03 ubyte =0 \b, little-endian word order
1105 #>0x03 ubyte =1 \b, big-endian word order
1107 #>0x08 uleshort x \b, CPU %u
1108 # os_type; target operating system like: 0~unknown 1~OS/2 2~Windows 16-bit 3~Multitasking MS-DOS 4.…
1109 #>0x0A leshort x \b, OS %u
1111 #>0x10 ulelong x \b, FLAGS %#8.8x
1113 #>0x10 ulelong &0x00000002 \b, 2h reserved
1115 #>0x10 ulelong &0x00000004 \b, per-process library Initialization
1116 #>0x10 ulelong &0x00000008 \b, system dll
1118 #>0x10 ulelong &0x00000010 \b, int. fixup
1120 #>0x10 ulelong &0x00000020 \b, ext. fixup
1122 #>0x10 ulelong&0x00000700 =0x00000100 \b, incompatible with PM windowing
1124 #>0x10 ulelong&0x00000700 =0x00000200 \b, compatible with PM windowing
1125 #>0x10 ulelong&0x00000700 =0x00000300 \b, uses PM windowing API
1126 #>0x10 ulelong &0x00002000 \b, not loadable
1127 #>0x10 ulelong &0x00008000 \b, library module
1129 #>0x10 ulelong &0x00020000 \b, device driver
1130 #>0x10 ulelong &0x00080000 \b, multiple-processor unsafe
1132 #>0x10 ulelong &0x40000000 \b, per-process library termination
1134 >0x0a clear x
1135 >0x0a leshort 1 for OS/2
1137 #>0x0a leshort 2 for MS Windows 16-bit
1139 #>0x0a leshort 3 for Multitasking MS-DOS
1141 #>0x0a leshort 4 for MS Windows
1143 #>0x0a leshort 5 for IBM Microkernel Personality Neutral
1144 >0x0a default x
1145 >>0x0a leshort x for unknown OS %#x
1148 # 0h ~executable Program module
1149 >0x10 ulelong&0x00038000 =0x00000000 (EXE)
1152 >>0x10 ulelong&0x00000700 =0x00000100 (full screen)
1153 >>0x10 ulelong&0x00000700 =0x00000200 (console)
1154 >>0x10 ulelong&0x00000700 =0x00000300 (GUI)
1155 >0x10 ulelong&0x00038000 =0x00008000 (DLL)
1157 >0x10 ulelong&0x00038000 =0x00010000 (unknown)
1158 >0x10 ulelong&0x00038000 =0x00018000 (PMDLL)
1159 >0x10 ulelong&0x00038000 =0x00020000 (PDD)
1161 >0x10 ulelong&0x00038000 =0x00028000 (VDD)
1163 >0x10 ulelong&0x00038000 =0x00030000 (DLD)
1164 >0x10 ulelong&0x00038000 =0x00038000 (unknown)
1166 >0x08 clear x
1167 >0x08 uleshort 1 \b, Intel i286
1169 >0x08 uleshort 2 \b, Intel i386
1170 >0x08 uleshort 3 \b, Intel i486
1171 >0x08 uleshort 4 \b, Intel i586
1177 >0x08 default x
1178 >>0x08 uleshort x \b, unknown CPU %#x
1180 #>0x02 clear x
1181 #>0x02 uleshort =0x0000 (little-endian)
1182 #>0x02 uleshort =0x0101 (big-endian)
1183 #>0x02 uleshort =0x0100 (PDP-11-endian)
1184 #>0x02 default x (unknown-endian)
1189 0 string/b KCF FreeDOS KEYBoard Layout collection
1190 # only version=0x100 found
1193 >6 ubyte >0
1195 >>7 string >\0 \b, author=%-.14s
1197 #>>>&0 string x \b%-s
1198 >>>&0 string x \b%-.15s
1200 0 string/b KLF FreeDOS KEYBoard Layout file
1201 # only version=0x100 or 0x101 found
1204 >5 ubyte >0
1206 0 string \xffKEYB\ \ \ \0\0\0\0
1207 >12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file
1213 0 ulequad&0x07a0ffffffff 0xffffffff
1215 >4 ubelong !0x14000000
1219 >>10 ubequad !0
1220 >>>0 use msdos-driver
1221 0 name msdos-driver DOS executable (
1231 >4 uleshort&0x8000 0x0000 \bblock device driver
1233 >4 uleshort&0x8000 0x8000 \b
1235 >>4 uleshort&0x0008 0x0008 \bclock
1238 >>4 uleshort&0x0010 0x0010 \bfast
1241 >>4 uleshort&0x0003 >0 \bstandard
1242 >>>4 uleshort&0x0001 0x0001 \binput
1243 >>>4 uleshort&0x0003 0x0003 \b/
1245 >>>4 uleshort&0x0002 0x0002 \boutput
1246 >>4 uleshort&0x8000 0x8000 \bcharacter device driver
1247 >0 ubyte x
1253 >>>12 ubyte >0x23 \b
1254 >>>>10 ubyte >0x20
1255 >>>>>10 ubyte !0x2E
1256 >>>>>>10 ubyte !0x2A \b%c
1257 >>>>11 ubyte >0x20
1258 >>>>>11 ubyte !0x2E \b%c
1259 >>>>12 ubyte >0x20
1260 >>>>>12 ubyte !0x39
1261 >>>>>>12 ubyte !0x2E \b%c
1262 >>>13 ubyte >0x20
1263 >>>>13 ubyte !0x2E \b%c
1264 >>>>14 ubyte >0x20
1265 >>>>>14 ubyte !0x2E \b%c
1266 >>>>15 ubyte >0x20
1267 >>>>>15 ubyte !0x2E \b%c
1268 >>>>16 ubyte >0x20
1269 >>>>>16 ubyte !0x2E
1270 >>>>>>16 ubyte <0xCB \b%c
1271 >>>>17 ubyte >0x20
1272 >>>>>17 ubyte !0x2E
1273 >>>>>>17 ubyte <0x90 \b%c
1275 >>>12 ubyte <0x2F
1279 >4 uleshort&0x8000 0x0000
1281 >>4 uleshort&0x0002 0x0002 \b,32-bit sector-
1283 >4 uleshort&0x0040 0x0040 \b,IOCTL-
1284 # open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
1285 >4 uleshort&0x0800 0x0800 \b,close media-
1287 >4 uleshort&0x8000 0x8000
1288 >>4 uleshort&0x2000 0x2000 \b,until busy-
1289 # direct read/write support by driver functions 03h,0Ch
1290 >4 uleshort&0x4000 0x4000 \b,control strings-
1291 >4 uleshort&0x8000 0x8000
1292 >>4 uleshort&0x6840 >0 \bsupport
1293 >4 uleshort&0x8000 0x0000
1294 >>4 uleshort&0x4842 >0 \bsupport
1295 >0 ubyte x \b)
1296 >0 ulelong !0xffffffff with pointer %#x
1297 # DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
1298 0 ulequad 0x0513c00000000012
1299 >0 use msdos-driver
1300 # DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
1301 0 ulequad 0x32f28000ffff0016
1302 >0 use msdos-driver
1303 0 ulequad 0x007f00000000ffff
1304 >0 use msdos-driver
1306 0 ulequad 0x001600000000ffff
1307 >0 use msdos-driver
1309 0 ulequad 0x0bf708c2ffffffff
1310 >0 use msdos-driver
1311 0 ulequad 0x07bd08c2ffffffff
1312 >0 use msdos-driver
1314 0 ulequad 0x027ac0c0ffffffff
1315 >0 use msdos-driver
1317 0 ulequad 0x00228880ffffffff
1318 >0 use msdos-driver
1324 0 ubyte 0x8c
1333 >>>>0 use msdos-com
1344 0 name msdos-com
1346 >0 byte x DOS executable (
1348 >0 byte =0xE9
1350 >>56 quad =0
1362 >>56 quad !0
1366 >>>1 search/0xc088 \xcd\x22 \bCOM or COMBOOT 16-bit)
1374 >0 byte !0xE9
1384 >0x1FE leshort 0xAA55 \b, boot code
1388 >0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
1390 >1 search/0xc088 \xcd\x22 \b, maybe with interrupt 22h
1391 >0 ubelong x \b, start instruction %#8.8x
1396 0 byte 0xeb
1397 # byte 0xeb conflicts with magic leshort 0xn2eb of "SYMMETRY i386" handled by ./sequent
1401 # with hexadecimal values like: 0e 2e 50 8c 8d ba bc bd be e8 fb fc
1433 >>>>>>>>>>0 use msdos-com
1436 >>>16 ubyte =0
1438 >>>>0x1FE leshort =0xAA55
1439 >>>>0x1FE default x
1444 >>>>>>0 use msdos-com
1450 >>>>(11.s-2) uleshort !0xAA55
1459 >>>>>>>0 use msdos-com
1461 0 byte 0xe9
1462 … executable (COM or COMBOOT 16-bit strength=40=40-0) after ESP-IDF application image (strength=40=…
1463 #!:strength -0
1471 # with hexadecimal values like: 06 1e 0e 2e 60 8c 8d b4 ba be e8 fc
1476 >>>>0 use msdos-com
1480 >>>16 ubyte =0
1482 >>>>32 ulelong !0xABCD5432
1483 >>>>>0 use msdos-com
1488 >>>>21 ubyte <0xE5
1489 >>>>>0 use msdos-com
1491 >>>>21 ubyte >0xE4
1494 >>>>>11 uleshort&0x001f !0
1495 >>>>>>0 use msdos-com
1505 >>>0 use msdos-com
1509 0 ubyte 0xb8
1511 >0 string !\xb8\xc0\x07\x8e
1514 >>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT
1523 >>>1 lelong 0x21CD4CFf \b)
1529 >>>1 lelong 0x21CD4CFe \b, relocatable)
1535 #>>>>&0 ubyte x \b, INTERUPT %#x
1536 # few examples with interrupt 0x13 instruction
1537 >>>>&0 ubyte =0x13
1542 >>>>>3 ubequad !0x8ec0b8c0078ed88d
1543 # few COM executables with interrupt 0x13 instruction like: Bootable CD Wizard executables bcdw_cl.…
1545 >>>>>>0 use msdos-com
1546 # few examples with interrupt 0x16 instruction like flashimg.img
1547 >>>>&0 ubyte =0x16
1549 # by check for assembler instructions: cmp ax 0xE4E4 (magic); jnz
1550 >>>>>8 ubelong !0x3DE4E475
1551 # no DOS executable with interrupt 0x16 found
1552 >>>>>>0 use msdos-com
1553 # most examples with interrupt instruction unequal 0x13 and 0x16
1554 >>>>&0 default x
1557 >>>>>0 use msdos-com
1561 # FOR DEBUGGING; 2nd instruction like 0x50 (RESTART.COM) 0x8e (REBOOT.COM)
1562 # or random like: 0x0 (IMAGINFO.PE3 sky_snow) 0xb1 (euckr_.txt)
1567 >>>>3 ubyte !0x0
1570 >>>>>3 ubyte !0xb1
1572 >>>>>>0 use msdos-com
1579 0 string/b \x81\xfc
1581 # assembler instructions: jump above +2; int 0x20; mov cx, offset bytes_to_copy
1585 >0x1e search/3 \x57\xe9
1586 #>>&0 uleshort x \b, decomp_start_n2b=%#x
1618 >0 byte !0xb8 COM executable for DOS
1651 0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS
1654 0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS
1657 >0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed
1658 0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed
1664 0 string/b LZ MS-DOS executable (built-in)
1665 #0 byte 0xf0 MS-DOS program library data
1670 0 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF leg…
1673 0 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002…
1684 0 belong 0x31be0000
1686 >128 ubyte >0 Microsoft
1687 >>96 uleshort =0 Word
1692 >>>0x6E ulequad =0 1.0-4.0
1693 >>>0x6E ulequad !0 5.0-6.0
1694 >>>0x6E ulequad x (DOS) Document
1696 >>96 uleshort !0 Write 3.0 (Windows) Document
1702 #>>4 uleshort !0xAB00 \b, wTool %o
1704 #>>6 ulelong !0 \b, reserved %u
1706 #>>0x1C uleshort x \b, at %#x info block
1708 >>(0x1C.s*128) uleshort x
1710 >>>&-2 uleshort =0x0014
1712 >>>>&0x12 string x %s
1728 >>0x1E string >0 \b, formatted by %-.66s
1730 >>96 uleshort >0 \b, %u pages
1732 >>0x62 string >0 \b, %-.8s printer
1733 # number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0
1734 >>0x6A uleshort >0 \b, %u blocks
1736 #>>0x6C uleshort x \b, %#x bit field
1739 >>>128 ubyte >0x1F
1741 >>>128 ubyte <0x20
1742 >>>>129 ubyte >0x1F
1744 >>>>129 ubyte <0x20
1745 >>>>>130 ubyte >0x1F
1747 >>>>>130 ubyte <0x20
1748 >>>>>>131 ubyte >0x1F
1750 >>>>>>131 ubyte <0x20
1751 >>>>>>>132 ubyte >0x1F
1753 >>>>>>>132 ubyte <0x20
1754 >>>>>>>>133 ubyte >0x1F
1757 0 string/b PO^Q` Microsoft Word 6.0 Document
1760 4 long 0
1761 >0 belong 0xfe320000 Microsoft Word for Macintosh 1.0
1764 >0 belong 0xfe340000 Microsoft Word for Macintosh 3.0
1767 >0 belong 0xfe37001c Microsoft Word for Macintosh 4.0
1770 >0 belong 0xfe370023 Microsoft Word for Macintosh 5.0
1774 0 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document
1782 0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document
1786 0 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
1797 0 belong 0x00001a00
1798 # reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for…
1799 #>18 uleshort&0x73E0 0
1801 >20 ubyte >0
1807 >>>4 uleshort 0x1000 WorKsheet, version 3
1810 >>>4 uleshort 0x1002 WorKsheet, version 4
1814 #>>4 uleshort 0x???? WorKsheet, version 4
1817 >>>4 uleshort 0x1003 WorKsheet, version 97
1821 >>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium
1824 >>>4 uleshort 0x8001 FoRMatting data
1828 >>>4 uleshort 0x8007 ForMatting data, version 3
1832 >>>>6 uleshort =0x0004 worksheet
1834 >>>>6 uleshort !0x0004 formatting data
1838 >>>6 uleshort =0x0004 \b, cell range
1840 # start values normally 0~1st sheet A1
1841 >>>>8 ulelong !0
1842 >>>>>10 ubyte >0 \b%d*
1845 # end page mostly 0
1846 >>>>14 ubyte >0 \b%d*
1847 # end raw, column normally not 0
1854 >>>6 uleshort !0x0004
1856 >>>>30 search/29 \0\xAE
1858 >>>>>&4 string >\0 \b, 1st font "%s"
1865 0 belong 0x00000200
1870 >7 ubyte 0
1872 >>6 ubyte >0 Lotus
1878 >>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF)
1880 >>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J
1882 >>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1
1884 >>>4 uleshort 0x0802 Symphony CoNFiguration
1886 >>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2
1888 >>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4
1890 >>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x
1892 >>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x
1896 >>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1
1901 >>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0
1905 >>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2
1909 >>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ
1912 #>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2
1915 >>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J
1918 >>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x
1922 >>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0
1933 0 name lotus-cells
1935 >0 ubelong 0x06000800 \b, cell range
1936 # cell range (start column, row, end column, row) start values normally 0,0~A1 cell
1937 >>4 ulong !0
1944 0 string/b WordPro\0 Lotus WordPro
1946 0 string/b WordPro\r\373 Lotus WordPro
1954 0 string \x71\xa8\x00\x00\x01\x02
1958 #0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media pl…
1959 0 string/b Nullsoft\ AVS\ Preset\ Winamp plug in
1969 0 string/b \327\315\306\232
1974 >26 uleshort&0xFDff =0x0100 Windows metafile
1975 # HWmf; resource handle to the metafile; When the metafile is on disk, this field MUST contain 0
1977 >>4 uleshort !0 \b, resource handle %#x
1979 # sometimes useful like: hardcopy-windows-meta.wmf (0,0 / 1280,1024)
1992 # Reserved; field is not used and MUST be set to 0; but ababababh in x-fmt-119-signature-id-609.wmf
1993 >>16 ulelong !0 \b, reserved %#x
1999 0 string/b \002\000\011\000 Windows metafile
2000 >0 use wmf-head
2006 0 string/b \001\000\011\000
2008 >18 ulelong >0 Windows metafile
2010 #>18 ulelong !0 THIS_SHOULD_NOT_HAPPEN
2011 #>18 long !0 THIS_SHOULD_NOT_HAPPEN
2012 >>0 use wmf-head
2014 0 name wmf-head
2016 >0 uleshort !0x0001 \b, type %#x
2021 >4 uleshort =0x0100 \b, DIBs not supported
2022 >4 uleshort =0x0300
2023 #>4 uleshort =0x0300 \b, DIBs supported
2032 # NumberOfObjects: the number of graphics objects like: 0 hardcopy-windows-meta.wmf 1 2 3 4 5 6 7 8…
2036 # NumberOfMembers: It SHOULD be 0x0000, but 5 TestBitBltStretchBlt.wmf 13 TestPalette.wmf and in fa…
2037 >16 uleshort !0 \b, %u members
2040 0 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file
2041 0 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file
2042 0 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file
2045 #0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP…
2046 0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
2047 0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
2048 0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
2049 0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
2050 0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
2051 0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
2054 0 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special …
2060 0 belong 0x00000100
2061 >9 byte 0
2062 >>0 byte x
2063 >>0 use cur-ico-dir
2064 >9 ubyte 0xff
2065 >>0 byte x
2066 >>0 use cur-ico-dir
2068 0 name cur-ico-dir
2071 >18 ulelong &0x00000006
2074 >>>0 ubelong 0x00000100 icon resource
2083 >>>>0x06 use ico-entry
2086 >>>>>0x16 use ico-entry
2087 >>>0 ubelong 0x00000200 cursor resource
2094 >>>>0x06 use cur-entry
2095 #>>>>0x16 use cur-entry
2097 0 name cur-entry
2098 >0 use cur-ico-entry
2102 0 name ico-entry
2103 >0 use cur-ico-entry
2104 # normally 0 1 but also found 14
2106 # normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256
2109 0 name cur-ico-entry
2110 >0 byte =0 \b, 256x
2111 >0 byte !0 \b, %dx
2112 >1 byte =0 \b256
2113 >1 byte !0 \b%d
2115 >2 ubyte !0 \b, %d colors
2116 # reserved 0 FFh
2122 >(12.l) ubelong =0x89504e47
2126 >(12.l) ubelong !0x89504e47
2134 0 belong 0x00000200
2135 >9 byte 0
2136 >>0 use cur-ico-dir
2137 >9 ubyte 0xff
2138 >>0 use cur-ico-dir
2141 0 string/b PK\010\010BGI Borland font
2142 >4 string >\0 %s
2147 0 string/b pk\010\010BGI Borland device
2148 >4 string >\0 %s
2154 # Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
2158 0 lelong 0x00000004
2159 >12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below)
2161 0 lelong 0x00000005
2162 >12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP)
2168 0 string GERBIL First Choice device file
2170 0 string DCU1 Borland Delphi .DCU file
2171 0 string =!<spell> MKS Spell hash list (old format)
2172 0 string =!<spell2> MKS Spell hash list
2174 #0 string AH Halo(TM) bitmapped font file
2175 0 lelong 0x08086b70 TurboC BGI file
2176 0 lelong 0x08084b50 TurboC Font file
2181 0 string TPF0
2182 >4 pstring >\0 Delphi compiled form '%s'
2186 0 string PMCC Windows 3.x .GRP file
2188 >8 byte >0x2F version %c
2189 >9 byte >0x2F \b.%c file
2193 0x171 string MICROSOFT\ PIFEX\0 Windows Program Information File
2196 #>2 string >\0 \b, Title:%.30s
2197 >0x24 string >\0 \b for %.63s
2198 >0x65 string >\0 \b, directory=%.64s
2199 >0xA5 string >\0 \b, parameters=%.64s
2200 #>0x181 leshort x \b, offset %x
2201 #>0x183 leshort x \b, offsetdata %x
2202 #>0x185 leshort x \b, section length %x
2203 >0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0
2204 >>&0x5e ubyte >0
2208 >>&0xF0 ubyte >0
2212 >>&0x110 ubyte >0
2216 #>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style
2217 #>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style
2218 >0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style
2219 #>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style
2220 >0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS
2222 >0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT
2228 0 string NG\0\001
2229 # only value 0x100 found at offset 2
2230 >2 ulelong 0x00000100 Norton Guide
2235 >>8 string >\0 "%-.40s"
2238 >>48 string >\0 \b, %-.66s
2239 >>114 string >\0 %-.66s
2246 0 string Abort
2247 # \0 or i
2257 0 string DOS\ Client\ Message\ File: Novell DOS client message
2262 >26 ubyte >0x20
2264 >>25 ubyte !0x20 %c
2265 >>>26 ubyte !0x20 \b%c
2266 >>>>27 ubyte !0x20 \b%c
2267 >>>>>28 ubyte !0x20 \b%c
2268 >>>>>>29 ubyte !0x20 \b%c
2269 >>>>>>>30 ubyte !0x20 \b%c
2270 >>>>>>>>31 ubyte !0x20 \b%c
2271 >>>>>>>>>32 ubyte !0x20 \b%c
2272 >>>>>>>>>>33 ubyte !0x20 \b%c
2273 >>>>>>>>>>>34 ubyte !0x20 \b%c
2274 >>>>>>>>>>>>35 ubyte !0x20 \b%c
2275 >>>>>>>>>>>>>36 ubyte !0x20 \b%c
2276 # followed by string like: 0 v.10 V1.20
2280 # probably translated version string like: 0 v1.00
2281 >>&0 string x \b, tran version %s
2283 >>>&0 ubyte !0xa \b, terminated by %#2.2x
2284 >>>>&0 ubyte x \b%2.2x
2286 >0x65 ubyte !0x1A \b, at 0x65 %#x
2288 >0x66 ubyte !0x01 \b, at 0x66 %#x
2293 0 string Novell\ Message\ Librarian\ Data\ File Novell message librarian data
2307 0 string TPH2 Turbo Pascal help, version 2
2315 0 string ALIAS\r\nASSIGN\r\n
2323 0 string 4DH4 4DOS help file, version 4.x
2333 0 ubequad&0xF1ffFFffF0000000 0x0034444830000000 4DOS help file
2338 #>0 ubyte x PLENGHT=%x
2343 >>0 ubyte 8 \b.
2349 >>0 ubyte 6 \b.
2352 #>>0 default x \b.
2355 >4 ubeshort >0x3535
2364 # NameSize; Size of largest name, 0 for none
2366 # PickSize; size of each entry in pick table, 0 for none
2370 # FirstTopic; topic to show first (0 = index)
2378 # XlateArray = array[0..29] of Byte; {Most common characters in help text}
2387 0 ulequad&0xFFffFFfeFFffFFff 0x003a000000024e4c MS Advisor help file
2393 0 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data
2407 0 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data
2414 >0x2c search/980/c .diag \b, Diagnostic
2420 >0x2c search/300/c png.pub\0 \b, Publisher Packed and Go
2424 >0x2c search/17/c ppview32.exe\0 \b, PowerPoint Viewer Packed and Go
2431 >0x2c search/968/c gadget.xml \b, Windows Desktop Gadget
2438 >0x2c search/3369/c content.ini\0 \b, IncrediMail
2441 >>0x2c search/83/c Flavor.htm\0 ecard
2444 >>0x2c search/211/c .swf\0 skin
2447 >>0x2c search/92/c anim.im3\0 animation
2450 >>0x2c default x
2451 >>>0x2c search/116/c thumb ecard, image, notifier or skin
2454 >>>0x2c default x emoticons or sound
2457 >0x2c default x
2494 >>>>>&0 string/c ppt\0
2506 >>>>>&0 string/c theme \b, Windows
2520 >>>>>&0 string/c one \b, OneNote Package
2523 >>>>>&0 default x
2525 >>>>>>&0 search/255 \0
2541 >>>>>>>>>30 uleshort =0x0000 \b, Windows 2000/XP setup
2547 >>>>>>>>>30 uleshort !0x0000 \b, single
2567 #>4 belong !0 \b, reserved1 %x
2568 #>12 belong !0 \b, reserved2 %x
2575 >>>&0 search/255 \0
2577 >>>>&0 use cab-file
2578 #>20 belong !0 \b, reserved %x
2580 >24 ubeshort !0x0301 \b version %#x
2584 # only found for flags 0 1 2 3 4 not 7
2585 >30 uleshort >0 \b, flags %#x
2588 >32 uleshort >0 \b, ID %u
2589 # iCabinet is number of this cabinet file in a set, where 0 for the first cabinet
2593 >30 uleshort &0x0004 \b, extra bytes
2595 >>36 uleshort >0 %u in head
2597 >>38 ubyte >0 %u in folder
2599 >>39 ubyte >0 %u in data block
2601 >>36 uleshort >0
2605 >30 uleshort ^0x0004
2607 >>30 uleshort =0x0000
2610 >>30 uleshort =0x0001 \b, previous
2613 >>30 uleshort =0x0002 \b, next
2618 #>>>>&0 use cab-anchor
2619 >>30 uleshort =0x0003 \b, previous
2628 0 name cab-anchor
2630 >&0 string x %s
2634 0 name cab-folder
2636 #>0 ulelong x \b, coffCabStart %#x
2641 # compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15
2646 0 name cab-file
2648 #>0 ulelong x \b, cbFile %u
2650 #>4 ulelong >0 \b, uoffFolderStart %#x
2651 # iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet
2652 # define ifoldCONTINUED_FROM_PREV (0xFFFD)
2653 # define ifoldCONTINUED_TO_NEXT (0xFFFE)
2654 # define ifoldCONTINUED_PREV_AND_NEXT (0xFFFF)
2655 >8 uleshort >0 \b, iFolder %#x
2661 # define _A_RDONLY (0x01) file is read-only
2662 # define _A_HIDDEN (0x02) file is hidden
2663 # define _A_SYSTEM (0x04) file is a system file
2664 # define _A_ARCH (0x20) file modified since last backup
2666 # define _A_EXEC (0x40) run after extraction
2667 # define _A_NAME_IS_UTF (0x80) szName[] contains UTF
2668 # define UNKNOWN (0x0100) undocumented or accident
2670 >14 uleshort >0 +
2671 >>14 uleshort &0x0001 \bR
2672 >>14 uleshort &0x0002 \bH
2673 >>14 uleshort &0x0004 \bS
2674 >>14 uleshort &0x0020 \bA
2675 >>14 uleshort &0x0040 \bX
2676 >>14 uleshort &0x0080 \bUtf
2677 # unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB
2678 >>14 uleshort &0x0100 \b?
2682 #>>&17 string >\0 \b, NEXT NAME %-.50s
2685 0 string/b ISc( InstallShield Cabinet archive data
2686 >5 byte&0xf0 =0x60 version 6,
2687 >5 byte&0xf0 !0x60 version 4/5,
2691 0 string/b MSCE\0\0\0\0 Microsoft WinCE install header
2692 >20 lelong 0 \b, architecture-independent
2695 >20 lelong 0xA11 \b, StrongARM
2710 0 ulelong 1
2715 0 string/b \224\246\056 Microsoft Word Document
2721 0 string/b $RBU
2734 #0 short 0x5045 Microsoft Document Imaging Format
2737 0 string/b ITOLITLS Microsoft Reader eBook Data
2743 0 string/b B000FF\n Windows Embedded CE binary image
2746 # if anything, produced files with version numbers 0-2.
2748 0 string \xfc\x03\x00 Mallard BASIC program data (v1.11)
2749 0 string \xfc\x04\x00 Mallard BASIC program data (v1.29+)
2750 0 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11)
2751 0 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+)
2753 0 string MIOPEN Mallard BASIC Jetsam data
2754 0 string Jetsam0 Mallard BASIC Jetsam index data
2762 0x3 ushort >1979
2763 >0x5 ubyte-1 <31
2764 >>0x6 ubyte-1 <12
2766 >>>0x7 string \0\0\0\0\0\0\0\0
2767 >>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d
2770 >>>>0x0 ubyte 0xff \b, last disk
2776 0x52 ubyte 0
2779 # 00h -127 = 0 -127 = -127
2780 >0 byte-127 <-126
2782 >>0x53 ubyte-1 <78
2784 >>>(0x53.b+4) ubyte 0
2786 >>>>(0x53.b+3) ubyte >0x1F
2789 #>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
2792 >>>>>5 ubyte&0x8C 0x0C
2796 >>>>>>0 ubyte x DOS 2.0-3.2 backed up
2797 #>>>>>>0 ubyte 0xff complete
2798 >>>>>>0 ubyte 0
2800 # full file name with path but without drive letter and colon stored from 0x05 til 0x52
2801 >>>>>>0x5 string x file %s
2815 0 string \x8bBACKUP\x20
2817 >0xa string \0\0\0\0\0\0\0\0
2818 >>0x9 ubyte x DOS 3.3 backup control file, sequence %d
2819 >>0x8a ubyte 0xff \b, last disk
2829 0 name dos-date
2830 # HHHHHMMMMMMSSSSS bit encoded Hour (0-23) Minute (0-59) SecondPart (*2)
2831 #>0 uleshort x RAW TIME [%#4.4x]
2833 #>0 uleshort/2048 x hour [%u]
2837 >2 uleshort&0x001F x %u
2840 #>2 uleshort/16 &0x000F MONTH [%u]
2841 #>2 uleshort&0x01E0 x MONTH PART [%#4.4x]
2842 >2 uleshort&0x01E0 =0x0020 jan
2843 >2 uleshort&0x01E0 =0x0040 feb
2844 >2 uleshort&0x01E0 =0x0060 mar
2845 >2 uleshort&0x01E0 =0x0080 apr
2846 >2 uleshort&0x01E0 =0x00A0 may
2847 >2 uleshort&0x01E0 =0x00C0 jun
2848 >2 uleshort&0x01E0 =0x00E0 jul
2849 >2 uleshort&0x01E0 =0x0100 aug
2850 >2 uleshort&0x01E0 =0x0120 sep
2851 >2 uleshort&0x01E0 =0x0140 oct
2852 >2 uleshort&0x01E0 =0x0160 nov
2853 >2 uleshort&0x01E0 =0x0180 dec
2915 # 0 2 BIFF version (not used)
2919 # e.g. 0x0009 BOF len 4 version 2 content 0x0010 Sheet
2920 0 uleshort =0x0009 Excel 2 BIFF 2
2923 >>4 uleshort =0
2925 >>>6 uleshort =0x0010 Sheet
2926 >>>6 uleshort =0x0020 Chart
2927 >>>6 uleshort =0x0040 Macros
2932 # 0 2 BIFF version (not used)
2939 0 uleshort =0x0209 Excel 3 BIFF 3
2942 >>4 uleshort =0
2944 >>>6 uleshort =0x0010 Sheet
2945 >>>6 uleshort =0x0020 Chart
2946 >>>6 uleshort =0x0040 Macros
2948 >>>6 uleshort =0x0100 Workspace
2950 0 uleshort =0x0409 Excel 4 BIFF 4
2953 >>4 uleshort =0
2955 >>>6 uleshort =0x0010 Sheet
2956 >>>6 uleshort =0x0020 Chart
2957 >>>6 uleshort =0x0040 Macros
2959 >>>6 uleshort =0x0100 Workspace
2963 # 0 2 BIFF version (always 0500H for BIFF5).
2974 # 4 2 Build identifier, must not be 0
2976 0 uleshort =0x0809 Excel 5 BIFF 5
2979 >>4 uleshort =0x0500
2981 >>4 uleshort =0
2982 >>>6 uleshort =0x0005 Workbook Globals
2983 >>>6 uleshort =0x0006 VB Module
2984 >>>6 uleshort =0x0010 Sheet
2985 >>>6 uleshort =0x0020 Chart
2986 >>>6 uleshort =0x0040 Macros
2988 >>>6 uleshort =0x0100 Workspace
2989 >>>>8 uleshort >0 Build %d
2994 # 0 2 BIFF version (always 0600 H for BIFF8)
3003 # 4 2 Build identifier, must not be 0
3004 # 6 2 Build year, must not be 0
3008 0 uleshort =0x0809 Excel 8 BIFF 8
3011 >>4 uleshort =0x0600
3013 >>4 uleshort =0
3014 >>>6 uleshort =0x0005 Workbook Globals
3015 >>>6 uleshort =0x0006 VB Module
3016 >>>6 uleshort =0x0010 Sheet
3017 >>>6 uleshort =0x0020 Chart
3018 >>>6 uleshort =0x0040 Macros
3020 >>>6 uleshort =0x0100 Workspace
3021 >>>>8 uleshort >0 Build %d
3023 >>>>>>12 ulelong !0 File history %d
3024 >>>>>>16 ulelong >0 Excel version needed %d
3034 # 0 2 BIFF version: 0000H = BIFF5
3050 0 uleshort =0x0809
3053 >>4 uleshort =0 Excel 5 BIFF 5
3054 >>4 uleshort =0x0200 Excel 2 BIFF 2
3056 >>4 uleshort =0x0300 Excel 3 BIFF 3
3058 >>4 uleshort =0x0400 Excel 4 BIFF 4
3060 >>4 uleshort =0x0500 Excel 5 BIFF 5
3062 >>4 uleshort =0x0600 Excel 8 BIFF 8
3064 >>4 uleshort =0x0800 Excel 8 BIFF 8
3066 >>>6 uleshort =0x0005 Workbook Globals
3067 >>>6 uleshort =0x0006 VB Module
3068 >>>6 uleshort =0x0010 Sheet/Dialogue
3069 >>>6 uleshort =0x0020 Chart
3070 >>>6 uleshort =0x0040 Macros
3072 >>>6 uleshort =0x0100 Workspace