Lines Matching +full:quad +full:- +full:se +full:- +full:mode

2 #------------------------------------------------------------------------------
23 # v1.0.4/libdbx_1.0.4.tar.gz/FILE-FORMAT
25 # and partly verified by `undbx --verbosity 4 Posteingang.dbx`
27 # skip DROID fmt-838-signature-id-1193.dbx fmt-839-signature-id-1194.dbx by check for valid file si…
29 #!:mime application/octet-stream
30 #!:mime application/vnd.ms-outlook
31 !:mime application/x-ms-dbx
43 # CLSID: 6F74FDC5-E366-11d1-9A4E-00C04FA309D4~Message 6F74FDC6-E366-11D1-9A4E-00C04FA309D4~Folder
44 # 26FE9D30-1A8F-11D2-AABF-006097D474C4~offline
66 # partly verfied by NK2Edit Raw Text Edit Mode
68 #!:mime application/octet-stream
69 #!:mime application/vnd.ms-outlook
70 !:mime application/x-ms-nickfile
72 # nick is used by "older" Outlook; dat is used by "newer" Outlook (probably 2010 - 2016); bak is us…
82 # value type/property tag: 001Fh~4 bytes for data size of UTF-16 LE string
90 # UTF-16
103 # https://gitlab.com/qemu-project/qemu/-/blob/master/include/qemu/win_dump_defs.h
105 # and verified by like Windows Kit `Dumpchk.exe 043022-18703-01.dmp`
106 # and partly by NirSoft `BlueScreenView.exe 043022-18703-01.dmp`
111 #!:mime application/octet-stream
112 !:mime application/x-ms-dmp
113 # like: Mini111013-01.dmp
171 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dmp-64.trid.xml113o
175 #!:mime application/octet-stream
176 !:mime application/x-ms-dmp
177 # like: c:\Windows\Minidump\020322-18890-01.dmp c:\Windows\MEMORY.DMP
236 # https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options
259 #!:mime application/octet-stream
260 !:mime application/x-ms-evtx
263 >0x24 ulelong =0x00030001 Vista-8.1 Event Log
264 >0x24 ulelong !0x00030001 10-11 Event Log, version
280 # verified by `tracerpt.EXE Wifi.etl -of EVTX`
281 # and by etl-parser `etl2xml --input AMSITrace.etl --output AMSITrace.xml`
284 # look for corresponding encoded as UTF-16 file name extension like in: boot_BASE+CSWITCH_1.etl
287 >>0 use trace-etl
289 0 name trace-etl
291 #!:mime application/x-ms-etl
298 >>&-2 lestring16 x "%s"
306 !:mime application/x-ms-sdi
307 #!:mime application/octet-stream
340 # BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK
341 >>0x400 string >\0 \b, type %-3.8s
342 # 0~non-filesystem 7~NTFS 6~BIGFAT
352 >>0x440 string >\0 \b, type %-3.8s
361 >>0x480 string >\0 \b, type %-3.8s
372 >>0 use bootstat-dat
374 0 name bootstat-dat
376 #!:mime application/octet-stream
377 !:mime application/x-ms-dat
391 >(0x4.l-1) ubyte x
392 >>&0 use bootstat-entry
394 >(0x4.l-1) ubyte x
396 >>&(&0x18.l-1) ubyte x
397 >>>&0 use bootstat-entry
399 # >(0x4.l-1) ubyte x
400 # >>&(&0x18.l-1) ubyte x
401 # >>>&(&0x18.l-1) ubyte x
402 # >>>>&0 use bootstat-entry
404 0 name bootstat-entry
434 >>0x2A uleshort x \b-%u
436 >>0x2C uleshort x \b-%u
447 # pathname of boot application, as null-terminated Unicode string; typically
476 0 name help-ver-date
486 !:mime application/x-winhelp
517 …ata in record; 1~help file title 2~COPYRIGHT 3~TOPICOFFSET Contents 4~Macro 5~*.ICO 6~HPJ-structure
527 # "WinHelp help file" by shared MIME-info database from freedesktop.org
536 !:mime application/x-winhelp
542 !:mime application/x-winhelp
552 >>>>>&0 use help-ver-date
555 >>>>>>&-2 search/0x1c4b6f0/s \x6c\x03
556 >>>>>>>&0 use help-ver-date
560 >>>>>>>>>&0 use help-ver-date
563 >>>>>>>>>>>&0 use help-ver-date
566 >>>>>>>>>>>>>&0 use help-ver-date
569 >>>>>>>>>>>>>>>&0 use help-ver-date
573 >>>>>>>>>>>>>>>>>&0 use help-ver-date
576 >>>>>>>>>>>>>>>>>>>&0 use help-ver-date
579 >>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date
582 >>>>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date
585 >>>>>>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date
588 >>>>>>>>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date
591 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date
595 !:mime application/x-winhelp
599 # remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 7 8.1 64-bi…
602 !:mime application/x-winhelp
621 #>>(4.l+15) string >\0 \b, Structure_"%-.16s"
639 # or DROID fmt-474-signature-id-748.hlp
640 # or for example run file command with higher --parameter bytes=30335189
642 #!:mime application/octet-stream
645 >>12 lelong x (damaged or use higher '-P bytes' option)
653 >>&0 use cnt-name
659 >>>&0 use cnt-name
662 0 name cnt-name
672 # Note: called "Windows Help Full-Text Search index" by TrID
675 !:mime application/x-winhelp-fts
680 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/ftg-winhelp.trid.xml
681 # Note: called "Windows Help Full-Text search Group" by TrID
683 !:mime application/x-winhelp-ftg
696 >14 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile
697 #!:mime application/octet-stream
698 !:mime application/x-ms-ht
707 # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/
708 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lnk-shortcut.trid.xml
709 # https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/%5bMS-SHLLINK%…
710 # Note: called "Windows Shortcut" by TrID, "Microsoft Windows Shortcut" by DROID via PUID x-fmt/42…
713 # HeaderSize + LinkCLSID 00021401-0000-0000-C000-000000000046
715 !:mime application/x-ms-shortcut
729 # IsUnicode; If set then StringData section contains Unicode-encoded strings
737 # TargetAnsi (260 bytes); NULL-terminated path to environment variable encoded with system default …
739 # TargetUnicode (520 bytes): optional NULL-terminated path to same environment variable Unicode enc…
742 # RunInSeparateProcess; run in a separate virtual machine when launching a 16-bit application; no e…
750 # DarwinDataAnsi (260 bytes); NULL-terminated application identifier encoded with system default co…
752 # DarwinDataUnicode (520 bytes); NULL-terminated application identifier Unicode encoded
760 # TargetAnsi (260 bytes); NULL-terminated path to environment icon variable encoded with system def…
762 # TargetUnicode (520 bytes); optional NULL-terminated path to same icon environment variable Unicod…
776 # MachineID (16 bytes); a NULL-terminated NetBIOS name encoded with system default code page of the…
795 # https://learn.microsoft.com/en-us/dotnet/desktop/winforms/controls/known-folder-guids-for-file-di…
797 # ProgramFiles 905E63B6-C1BF-494E-B29C-65B732D3D21A
798 # ProgramFilesX86 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E
811 >24 lelong&1 1 \b, Read-Only
865 >>78 use lnk-item
868 >>>(78.s+78) use lnk-item
870 >>>&(&-2.s-2) uleshort >0
871 >>>>&-2 use lnk-item
873 >>>>&(&-2.s-2) uleshort >0
874 >>>>>&-2 use lnk-item
879 >>>76 use lnk-info
883 #>>>>(76.s+78) use lnk-info
886 >>>>>&-8 ubelong x
890 0 name lnk-item
898 # like: "26EE0668-A00A-44D7-9371-BEB064C98683" Control Panel
899 # "20D04FE0-3AEA-1069-A2D8-08002B30309D" My Computer
900 # "871C5380-42A0-1069-A2EA-08002B30309D" Internet Explorer
908 0 name lnk-info
937 # Reference: https://interoperability.blob.core.windows.net/files/MS-PST/%5bMS-PST%5d.pdf
941 # skip DROID x-fmt-75-signature-id-472.pab x-fmt-248-signature-id-260.pst x-fmt-249-signature-id-26…
944 #!:mime application/octet-stream
946 !:mime application/vnd.ms-outlook
947 # dwCRCPartial; 32-bit cyclic redundancy check (CRC) value of followin 471 bytes; zero for 64-bit
953 # "Microsoft Outlook Personal Address Book" by DROID via x-fmt/75
955 #!:mime application/x-ms-pab
958 # http://mark0.net/download/triddefs_xml.7z/defs/p/pst-unicode.trid.xml
960 # by DROID via x-fmt/248 for ANSI and via x-fmt/249 for Unicode
964 #!:mime application/x-ms-pst
969 #!:mime application/x-ms-ost
987 # ANSI 32-bit variant Outlook 1997-2002
1007 # UNICODE 64-bit variant Outlook 2003-2007
1021 # dwCRC; 32-bit CRC of the of the previous 516 bytes
1049 # Windows 3-9X variant
1054 !:mime text/x-ms-regedit
1061 !:mime text/x-ms-regedit
1063 # Windows 2K UTF-16 variant
1065 >0x32 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above)
1067 #>&0 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above)
1068 !:mime text/x-ms-regedit
1072 # Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html
1078 !:mime text/x-wine-extension-reg
1087 >0 use ini-file
1093 # ADM with remark (by adm-rem.trid.xml) already done by generic ASCII variant
1096 >>0 use ini-file
1099 >0 use ini-file
1101 0 name ini-file
1105 # https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
1119 !:mime application/x-setupscript
1121 # https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx
1122 # version strings ASCII coded case-independent for Windows setup information script file
1124 !:mime application/x-setupscript
1125 #!:mime application/x-wine-extension-inf
1129 !:mime application/x-setupscript
1132 # https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
1133 # .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
1135 !:mime application/x-wine-extension-ini
1139 !:mime application/x-wine-extension-ini
1142 !:mime application/x-wine-extension-ini
1144 # https://technet.microsoft.com/en-us/library/cc722567.aspx
1147 !:mime application/x-wine-extension-ini
1151 !:mime application/x-wine-extension-ini
1155 !:mime application/x-wine-extension-ini
1159 !:mime application/x-wine-extension-ini
1162 >>&0 regex/c \^menu] MS-DOS CONFIG.SYS
1169 >>&0 regex/c \^Paths]\r\n MS-DOS MSDOS.SYS
1183 !:mime text/x-ms-cpx
1188 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-exp.trid.xml,scf-exp-old.trid.xml
1192 !:mime text/x-ms-scf
1200 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-via.trid.xml
1204 !:mime text/x-via-scf
1209 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lid-is.trid.xml
1213 !:mime text/x-installshield-lid
1217 # URL: https://www.file-extensions.org/tag-file-extension
1223 !:mime text/x-ms-tag
1237 # http://mark0.net/download/triddefs_xml.7z/defs/c/cdimage-clonecd-cue.trid.xml
1239 >>&0 string CloneCD] CloneCD CD-image Description
1241 !:mime text/x-ccd
1250 !:mime application/x-setupscript
1254 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/cfp-cdrtfe.trid.xml
1256 !:mime text/x-cfp
1263 >>>>>>&-1 regex/T \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s
1265 #!:mime application/x-setupscript
1266 !:mime application/x-wine-extension-ini
1273 # UTF-16 BOM
1275 # look for phrase of Windows policy ADMinistrative template (UTF-16 by adm-uni.trid.xml)
1278 >>0 use windows-adm
1281 # UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00
1285 # keyword without 1st letter which is maybe up-/down-case
1287 !:mime application/x-setupscript
1291 !:mime application/x-setupscript
1295 !:mime application/x-setupscript
1298 # netnwcli.inf start with ;---[ NetNWCli.INX ]
1304 !:mime application/x-setupscript
1315 >>0 use windows-adm
1317 >>0 use windows-adm
1319 0 name windows-adm Windows Policy Administrative Template
1320 !:mime text/x-ms-adm
1322 # UTF-16 BOM implies UTF-16 encoded ADM (by adm-uni.trid.xml)
1325 # look for UTF-16 encoded CarriageReturn LineFeed
1328 # no UTF-16 BOM implies "ASCII" encoded ADM (by adm.trid.xml)
1335 >>>>>&-2 string x "%s"
1338 >>>>&-2 string x "%s"
1345 # check for valid major and minor versions: 101h - 303h
1347 # GRR: line above (strength 50) is too general as it catches also "PDP-11 UNIX/RT ldp" ./pdp
1354 # skip few Adobe Photoshop Color swatch ("Mac OS.aco" TRUMATCH-Farben.aco Windows.aco) and some
1355 # Targa image (money-256.tga XING_B_UCM8.tga x-fmt-367-signature-id-604.tga) with "invalid low sect…
1360 !:mime application/x-pnf
1363 # 101h~95-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362-Windows11
1367 >>4 ulelong&0x00000001 !0x00000001 95-98)
1369 >0 uleshort =0x0301 (Windows Vista-8.1)
1371 >0 uleshort =0x0303 (Windows 10-11)
1372 # 1 ,2 (windows 98 SE)
1411 # FILETIME is number of 100-nanosecond intervals since 1 January 1601
1451 # https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0…
1482 # language string like: de-DE en-US
1498 # BIT4-BIT15, BIT18-BIT31 of block attributes are unused
1500 #!:mime application/x-ntbackup
1585 # Reference: https://www.cryer.co.uk/file-types/p/pal.htm
1588 0 string JASC-PAL\r\n PaintShop Pro color palette
1600 # Note: created by like "InnoSetup self-extracting archive" inside ./msdos
1604 !:mime application/x-innosetup
1607 # " 64-bit" variant
1612 # GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace
1614 >>0x40 string x %-.38s
1635 >>0x1db lestring16 x \b, %-.9s
1639 >>>&0 lestring16 x \b\%-.9s
1642 >>>>&0 lestring16 x \b, %-.42s
1649 >0x38 quad 0 InnoSetup messages
1650 !:mime application/x-innosetup-msg
1667 >>>0x1c search/2 (u) (UTF-16),
1678 # fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf
1679 # Note: verified by like `7z t boot.wim` `wiminfo install.esd --header`
1681 >0 use wim-archive
1684 >0 use wim-archive
1685 0 name wim-archive
1688 !:mime application/x-ms-wim
1702 # solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension
1722 # 1-based index of the bootable image of the WIM, or 0 if no image is bootable
1737 #define FLAG_HEADER_COMPRESS_XPRESS2 0x00100000 wimlib-1.13.0\include\wimlib\header.h
1775 #!:mime application/octet-stream
1776 !:mime application/x-ms-mig
1783 >>>&-1 indirect x
1791 >>&20 lestring16 x \b, 1st %-s
1807 #!:mime application/octet-stream
1808 # https://www.thoughtco.com/mime-types-by-content-type-3469108
1809 # https://filext.com/file-extension/PAM
1810 !:mime application/x-perfmon
1811 #!:mime application/x-ms-pma
1821 #!:mime application/octet-stream
1822 !:mime application/x-installshield-ins
1828 # copyright text like: "Stirling Technologies, Inc. (c) 1990-1994"
1829 # "InstallSHIELD Software Corporation (c) 1990-1997"
1834 >>&-4 leshort x #%u
1835 >>&-2 pstring/h x %s
1860 # URL: https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/rdp
1863 0 string screen\040mode\040id:i: Remote Desktop Protocol connection
1865 !:mime text/x-ms-rdp
1867 # Screen mode: 1~session appear in a window 2~session appear full screen
1868 >17 string 1 \b, window mode
1869 >17 string 2 \b, full screen mode
1871 0 guid 7B5C52E4-D88C-4DA7-AEB1-5378D02996D3 Microsoft OneNote
1874 0 guid 43FF2FA1-EFD9-4C76-9EE2-10EA5722765F Microsoft OneNote Revision Store File
1895 # URL: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/registry-policy-f…
1907 …ndows CreateTypeLib2 API: https://learn.microsoft.com/en-us/windows/win32/api/oleauto/nf-oleauto-c…
1908 …indows CreateTypeLib API: https://learn.microsoft.com/en-us/windows/win32/api/oleauto/nf-oleauto-c…
1914 >-36 string TYPELIB Type Library (legacy SLTG format)