1 2#------------------------------------------------------------------------------ 3# $File: apple,v 1.51 2024/09/04 19:06:12 christos Exp $ 4# apple: file(1) magic for Apple file formats 5# 60 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 70 string \x0aGL Binary II (apple ][) data 80 string \x76\xff Squeezed (apple ][) data 90 string NuFile NuFile archive (apple ][) data 100 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 110 belong 0x00051600 AppleSingle encoded Macintosh file 120 belong 0x00051607 AppleDouble encoded Macintosh file 13 14# Type: Apple Emulator A2R format 15# From: Greg Wildman <greg@apple2.org.za> 16# Ref: https://applesaucefdc.com/a2r2-reference/ 17# Ref: https://applesaucefdc.com/a2r/ 180 string A2R 19>3 string \x31\xFF\x0A\x0D\x0A Applesauce A2R 1.x Disk Image 20>>0 use applesauce 21>3 string \x32\xFF\x0A\x0D\x0A Applesauce A2R 2.x Disk Image 22>>0 use applesauce 23>3 string \x33\xFF\x0A\x0D\x0A Applesauce A2R 3.x Disk Image 24>>0 use applesauce 25 260 name applesauce 27>8 string INFO 28>>49 byte 01 \b, 5.25″ SS 40trk 29>>49 byte 02 \b, 3.5″ DS 80trk 30>>49 byte 03 \b, 5.25″ DS 80trk 31>>49 byte 04 \b, 5.25″ DS 40trk 32>>49 byte 05 \b, 3.5″ DS 80trk 33>>49 byte 06 \b, 8″ DS 34>>50 byte 01 \b, write protected 35>>51 byte 01 \b, cross track synchronized 36>>17 string/T x \b, %.32s 37 38# Type: Apple Emulator WOZ format 39# From: Greg Wildman <greg@apple2.org.za> 40# Ref: https://applesaucefdc.com/woz/reference/ 41# Ref: https://applesaucefdc.com/woz/reference2/ 420 string WOZ 43>3 string \x31\xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image 44>>0 use applewoz 45>3 string \x32\xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image 46>>0 use applewoz 47 480 name applewoz 49>12 string INFO 50>>21 byte 01 \b, 5.25 inch 51>>21 byte 02 \b, 3.5 inch 52>>22 byte 01 \b, write protected 53>>23 byte 01 \b, cross track synchronized 54>>25 string/T x \b, %.32s 55 56# Type: Apple Macintosh Emulator MOOF format 57# From: Greg Wildman <greg@apple2.org.za> 58# Ref: https://applesaucefdc.com/moof-reference/ 590 string MOOF 60>4 string \xFF\x0A\x0D\x0A Apple Macintosh MOOF Disk Image 61>>12 string INFO 62>>>21 byte 01 \b, SSDD GCR (400K) 63>>>21 byte 02 \b, DSDD GCR (800K) 64>>>21 byte 03 \b, DSHD MFM (1.44M) 65>>>22 byte 01 \b, write protected 66>>>23 byte 01 \b, cross track synchronized 67>>>25 string/T x \b, %.32s 68 69# Type: Apple Emulator disk images 70# From: Greg Wildman <greg@apple2.org.za> 71# ProDOS boot loader? 720 string \x01\x38\xB0\x03\x4C Apple ProDOS Image 73# Detect Volume Directory block ($02) 74>0x400 string \x00\x00\x03\x00 75>>0x404 byte &0xF0 76>>>0x405 string x \b, Volume /%s 77>>>0x429 uleshort x \b, %u Blocks 78# ProDOS ordered ? 79>0xb00 string \x00\x00\x03\x00 80>>0xb04 byte &0xF0 81>>>0xb05 string x \b, Volume /%s 82>>>0xb29 uleshort x \b, %u Blocks 83# 84# Proboot HD 850 string \x01\x8A\x48\xD8\x2C\x82\xC0\x8D\x0E\xC0\x8D\x0C Apple ProDOS ProBoot Image 86>0x400 string \x00\x00\x03\x00 87>>0x404 byte &0xF0 88>>>0x405 string x \b, Volume /%s 89>>>0x429 uleshort x \b, %u Blocks 90>0xb00 string \x00\x00\x03\x00 91>>0xb04 byte &0xF0 92>>>0xb05 string x \b, Volume /%s 93>>>0xb29 uleshort x \b, %u Blocks 940 string \x01\xA8\x8A\x20\x7B\xF8\x29\x07\x09\xC0\x99\x30 Apple ProDOS ProBoot Image 95>0x400 string \x00\x00\x03\x00 96>>0x404 byte &0xF0 97>>>0x405 string x \b, Volume /%s 98>>>0x429 uleshort x \b, %u Blocks 99>0xb00 string \x00\x00\x03\x00 100>>0xb04 byte &0xF0 101>>>0xb05 string x \b, Volume /%s 102>>>0xb29 uleshort x \b, %u Blocks 1030 string \x01\x4A\xD0\x34\xE6\x3D\x8A\x20\x7B\xF8\x09\xC0 Apple ProDOS ProBoot Image 104>0x400 string \x00\x00\x03\x00 105>>0x404 byte &0xF0 106>>>0x405 string x \b, Volume /%s 107>>>0x429 uleshort x \b, %u Blocks 108>0xb00 string \x00\x00\x03\x00 109>>0xb04 byte &0xF0 110>>>0xb05 string x \b, Volume /%s 111>>>0xb29 uleshort x \b, %u Blocks 112# 113# ProDOS formatted 1140 string \x01\xBD\x88\xC0\x20\x2F\xFB\x20\x58\xFC\x20\x40 Apple ProDOS Unbootable Image 115>0x400 string \x00\x00\x03\x00 116>>0x404 byte &0xF0 117>>>0x405 string x \b, Volume /%s 118>>>0x429 uleshort x \b, %u Blocks 119>0xb00 string \x00\x00\x03\x00 120>>0xb04 byte &0xF0 121>>>0xb05 string x \b, Volume /%s 122>>>0xb29 uleshort x \b, %u Blocks 1230 string \x01\x38\xB0\x03\x4C\x1C\x09\x78\x86\x43\xC9\x03 Apple ProDOS Unbootable Image 124>0x400 string \x00\x00\x03\x00 125>>0x404 byte &0xF0 126>>>0x405 string x \b, Volume /%s 127>>>0x429 uleshort x \b, %u Blocks 128>0xb00 string \x00\x00\x03\x00 129>>0xb04 byte &0xF0 130>>>0xb05 string x \b, Volume /%s 131>>>0xb29 uleshort x \b, %u Blocks 132# 133# DOS3 boot loader 1340 string \x01\xA5\x27\xC9\x09\xD0 135>0x11001 byte 0x11 136>>0x11003 ubyte x Apple DOS 3.%u Image 137>>0x11006 ubyte x \b, Volume #%03u 138>>0x11034 ubyte x \b, %u Tracks 139>>0x11035 ubyte x \b, %u Sectors 140>>0x11036 uleshort x \b, %u bytes per sector 141# 142# DOS3 uninitialized disk 1430 string \x01\xA6\x2B\xBD\x88\xC0\x8A\x4A\x4A 144>0x11001 byte 0x11 145>>0x11003 ubyte x Apple DOS 3.%u Unbootable Image 146>>>0x11006 ubyte x \b, Volume #%03u 147>>>0x11034 ubyte x \b, %u Tracks 148>>>0x11035 ubyte x \b, %u Sectors 149>>>0x11036 uleshort x \b, %u bytes per sector 150# 151# Pascal boot loader? 1520 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD 153>0xd6 pstring SYSTEM.APPLE 154>>0xb00 leshort 0x0000 155>>>0xb04 leshort 0x0000 Apple Pascal Image 156>>>>0xb06 pstring x \b, Volume %s: 157>>>>0xb0e leshort x \b, %u Blocks 158>>>>0xb10 leshort x \b, %u Files 159# 160# Diversi Dos boot loader? 1610 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD 162>0x11001 string \x11\x0F\x03 Apple Diversi Dos Image 163>>0x11006 byte x \b, Volume %u 164>>0x11034 byte x \b, %u Tracks 165>>0x11035 byte x \b, %u Sectors 166>>0x11036 leshort x \b, %u bytes per sector 167 168# Type: Apple Emulator 2IMG format 169# From: Radek Vokal <rvokal@redhat.com> 170# Update: Greg Wildman <greg@apple2.org.za> 1710 string 2IMG Apple ][ 2IMG Disk Image 172>4 clear x 173>4 string XGS! \b, XGS 174>4 string CTKG \b, Catakig 175>4 string ShIm \b, Sheppy's ImageMaker 176>4 string SHEP \b, Sheppy's ImageMaker 177>4 string WOOF \b, Sweet 16 178>4 string B2TR \b, Bernie ][ the Rescue 179>4 string \!nfc \b, ASIMOV2 180>4 string \>BD\< \b, Brutal Deluxe's Cadius 181>4 string CdrP \b, CiderPress 182>4 string Vi][ \b, Virtual ][ 183>4 string PRFS \b, ProFUSE 184>4 string FISH \b, FishWings 185>4 string RVLW \b, Revival for Windows 186>4 default x 187>>4 string x \b, Creator tag "%-4.4s" 188>0xc byte 00 \b, DOS 3.3 sector order 189>>0x10 byte 00 \b, Volume 254 190>>0x10 byte&0x7f x \b, Volume %u 191>0xc byte 01 \b, ProDOS sector order 192# Detect Volume Directory block ($02) + 2mg header offset 193>>0x440 string \x00\x00\x03\x00 194>>>0x444 byte &0xF0 195>>>>0x445 string x \b, Volume /%s 196>>>>0x469 uleshort x \b, %u Blocks 197>0xc byte 02 \b, NIB data 198 199# Type: Peter Ferrie QBoot 200# From: Greg Wildman <greg@apple2.org.za> 201# Ref: https://github.com/peterferrie/qboot 2020 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9 203>8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ QBoot Image 204# Type: Peter Ferrie 0Boot 205# From: Greg Wildman <greg@apple2.org.za> 206# Ref: https://github.com/peterferrie/0boot 207>8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ 0Boot Image 208 209# Different proprietary boot sectors 2100 string \x01\x0F\x21\x74\x00\x01\x6B\x00\x02\x30\x81\x5D Apple ][ Disk Image 2110 string \x01\x20\x58\xFC\xA2\x00\x8E\x78\x04\x8E\xF4\x03 Apple ][ Disk Image 2120 string \x01\x20\x58\xFC\xAD\x51\xC0\xAD\x54\xC0\xA6\x2B Apple ][ Disk Image 2130 string \x01\x20\x89\xFE\x20\x93\xFE\xA6\x2B\xBD\x88\xC0 Apple ][ Disk Image 2140 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x25\x08\x68\x85 Apple ][ Disk Image 2150 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x2D\x08\x68\x85 Apple ][ Disk Image 2160 string \x01\x38\x90\x2A\xC9\x01\xF0\x33\xA8\xC8\xC0\x10 Apple ][ Disk Image 2170 string \x01\x38\xB0\x03\x4C\x32\xA1\x87\x43\xC9\x03\x08 Apple ][ Disk Image 2180 string \x01\x4C\x04\x08\xA9\x2A\x8D\x02\x08\x86\x2B\xEE Apple ][ Disk Image 2190 string \x01\x4C\x60\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image 2200 string \x01\x4C\x92\x08\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image 2210 string \x01\x4C\xB3\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image 2220 string \x01\x8D\xFB\x03\x8E\xFC\x03\x8C\xFD\x03\x8A\x29 Apple ][ Disk Image 2230 string \x01\xA2\xFF\x9A\xD8\x20\x20\x08\x20\x34\x08\xAD Apple ][ Disk Image 2240 string \x01\xA5\x27\xBD\x88\xC0\x2C\x10\xC0\xA2\x00\xA9 Apple ][ Disk Image 2250 string \x01\xA5\x2B\xAE\x51\xC0\xEA\xAA\xBD\x88\xC0\x20 Apple ][ Disk Image 2260 string \x01\xA6\x27\xBD\x0B\x08\x48\xBD\x0A\x08\x48\x85 Apple ][ Disk Image 2270 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x01\x85 Apple ][ Disk Image 2280 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x25\x85 Apple ][ Disk Image 2290 string \x01\xA8\xC0\x0F\x90\x16\xF0\x12\xA0\xFF\x18\xAD Apple ][ Disk Image 2300 string \x01\xA9\x00\x85\xF0\xA9\x04\x85\xF1\xA0\x00\xA9 Apple ][ Disk Image 2310 string \x01\xA9\x5C\x8D\xF2\x03\xA9\xC6\x8D\xF3\x03\x49 Apple ][ Disk Image 2320 string \x01\xA9\x60\x8D\x01\x08\x20\x2F\xFB\x20\x58\xFC Apple ][ Disk Image 2330 string \x01\xA9\x60\x8D\x01\x08\x20\x49\x08\xA9\x0A\x85 Apple ][ Disk Image 2340 string \x01\xA9\x60\x8D\x01\x08\x2C\x82\xC0\xBD\x88\xC0 Apple ][ Disk Image 2350 string \x01\xA9\x60\x8D\x01\x08\x86\x43\x8A\x4A\x4A\x4A Apple ][ Disk Image 2360 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\x86\xFF\xB5\x00 Apple ][ Disk Image 2370 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image 2380 string \x01\xA9\x60\x8D\x01\x08\xA9\xB2\x8D\xF2\x03\xA9 Apple ][ Disk Image 2390 string \x01\xA9\x60\x8D\x01\x08\xA9\xFF\x8D\xF3\x03\x8D Apple ][ Disk Image 2400 string \x01\xAC\x00\x08\xF0\x19\xB9\x30\x08\x85\x3D\xCE Apple ][ Disk Image 2410 string \x01\xAC\x23\x08\x30\x2E\xB9\x24\x08\x85\x3D\xCE Apple ][ Disk Image 2420 string \x01\xAD\x00\x08\xC9\x09\xB0\x20\x69\x02\x8D\x00 Apple ][ Disk Image 2430 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\x86\x2B\x8A\x4A Apple ][ Disk Image 2440 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\xA9\xF5\x8D\xF2 Apple ][ Disk Image 2450 string \x01\xB0\x00\xA9\x3F\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image 2460 string \x01\xB0\x00\xA9\x48\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image 2470 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x09\xC0\x8D Apple ][ Disk Image 2480 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x8D\x2F\x08 Apple ][ Disk Image 2490 string \x01\xD8\x2C\x81\xC0\xA9\x60\x4D\x58\xFF\xD0\xFE Apple ][ Disk Image 2500 string \x01\xD8\x78\xBD\x88\xC0\xA9\xFD\x85\x37\x85\x39 Apple ][ Disk Image 2510 string \x01\xE0\x60\xF0\x03\x4C\x16\x09\xAD\x00\x08\xC9 Apple ][ Disk Image 2520 string \x01\xE0\x60\xF0\x03\x4C\xCB\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 2530 string \x01\xE0\x60\xF0\x03\x4C\xEE\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 2540 string \x01\xE0\x60\xF0\x03\x4C\xEF\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 2550 string \x01\xE0\x70\xB0\x04\xE0\x40\xB0\x39\xBD\x88\xC0 Apple ][ Disk Image 2560 string \x01\xEA\x8D\xF4\x03\xA9\x60\x9D\x88\xC0\x8D\x51 Apple ][ Disk Image 257 258# magic for Newton PDA package formats 259# from Ruda Moura <ruda@helllabs.org> 2600 string package0 Newton package, NOS 1.x, 261>12 belong &0x80000000 AutoRemove, 262>12 belong &0x40000000 CopyProtect, 263>12 belong &0x10000000 NoCompression, 264>12 belong &0x04000000 Relocation, 265>12 belong &0x02000000 UseFasterCompression, 266>16 belong x version %d 267 2680 string package1 Newton package, NOS 2.x, 269>12 belong &0x80000000 AutoRemove, 270>12 belong &0x40000000 CopyProtect, 271>12 belong &0x10000000 NoCompression, 272>12 belong &0x04000000 Relocation, 273>12 belong &0x02000000 UseFasterCompression, 274>16 belong x version %d 275 2760 string package4 Newton package, 277>8 byte 8 NOS 1.x, 278>8 byte 9 NOS 2.x, 279>12 belong &0x80000000 AutoRemove, 280>12 belong &0x40000000 CopyProtect, 281>12 belong &0x10000000 NoCompression, 282 283# The following entries for the Apple II are for files that have 284# been transferred as raw binary data from an Apple, without having 285# been encapsulated by any of the above archivers. 286# 287# In general, Apple II formats are hard to identify because Apple DOS 288# and especially Apple ProDOS have strong typing in the file system and 289# therefore programmers never felt much need to include type information 290# in the files themselves. 291# 292# Eric Fischer <enf@pobox.com> 293 294# AppleWorks word processor: 295# URL: https://en.wikipedia.org/wiki/AppleWorks 296# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx 297# Update: Joerg Jenderek 298# NOTE: 299# The "O" is really the magic number, but that's so common that it's 300# necessary to check the tab stops that follow it to avoid false positives. 301# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge 302# the newer AppleWorks is from claris with extension CWK 3034 string O 304# test for unused bits of zoom- , paginated-boolean bytes 305>84 ubequad ^0x00Fe00000000Fe00 306# look for tabstop definitions "=" no tab, "|" no tab 307# "<" left tab,"^" center tab,">" right tab, "." decimal tab, 308# unofficial "!" other , "\x8a" other 309# official only if SFMinVers is nonzero 310>>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor 311# AppleWorks Word Processor File (Apple II) 312# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" 313# application/x-appleworks is mime type for claris version with cwk extension 314!:mime application/x-appleworks3 315# http://home.earthlink.net/~hughhood/appleiiworksenvoy/ 316# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') 317# $70 $1A $F8 $FF is this the apple type ? 318#:apple pdosp^Z\xf8\xff 319!:ext awp 320# minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) 321>>>183 ubyte 30 3.0 322>>>183 ubyte !30 323>>>>183 ubyte !0 %#x 324# usual tabstop start sequence "=====<" 325>>>5 string x \b, tabstop ruler "%6.6s" 326# tabstop ruler 327#>>>5 string >\0 \b, tabstops "%-79s" 328# zoom switch 329>>>85 byte&0x01 >0 \b, zoomed 330# whether paginated 331>>>90 byte&0x01 >0 \b, paginated 332# contains any mail-merge commands 333>>>92 byte&0x01 >0 \b, with mail merge 334# left margin in 1/10 inches ( normally 0 or 10 ) 335>>>91 ubyte >0 336>>>>91 ubyte x \b, %d/10 inch left margin 337 338# AppleWorks database: 339# 340# This isn't really a magic number, but it's the closest thing to one 341# that I could find. The 1 and 2 really mean "order in which you defined 342# categories" and "left to right, top to bottom," respectively; the D and R 343# mean that the cursor should move either down or right when you press Return. 344 345#30 string \x01D AppleWorks database data 346#30 string \x02D AppleWorks database data 347#30 string \x01R AppleWorks database data 348#30 string \x02R AppleWorks database data 349 350# AppleWorks spreadsheet: 351# 352# Likewise, this isn't really meant as a magic number. The R or C means 353# row- or column-order recalculation; the A or M means automatic or manual 354# recalculation. 355 356#131 string RA AppleWorks spreadsheet data 357#131 string RM AppleWorks spreadsheet data 358#131 string CA AppleWorks spreadsheet data 359#131 string CM AppleWorks spreadsheet data 360 361# Applesoft BASIC: 362# 363# This is incredibly sloppy, but will be true if the program was 364# written at its usual memory location of 2048 and its first line 365# number is less than 256. Yuck. 366# update by Joerg Jenderek at Feb 2013 367 368# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 369#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 3700 belong&0x00ff00ff 0x00080000 371# assuming that line number must be positive 372>2 leshort >0 Applesoft BASIC program data, first line number %d 373#>2 leshort x \b, first line number %d 374 375# ORCA/EZ assembler: 376# 377# This will not identify ORCA/M source files, since those have 378# some sort of date code instead of the two zero bytes at 6 and 7 379# XXX Conflicts with ELF 380#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 381#>5 byte x \b, build number %d 382 383# Broderbund Fantavision 384# 385# I don't know what these values really mean, but they seem to recur. 386# Will they cause too many conflicts? 387 388# Probably :-) 389#2 belong&0xFF00FF 0x040008 Fantavision movie data 390 391# Some attempts at images. 392# 393# These are actually just bit-for-bit dumps of the frame buffer, so 394# there's really no reasonably way to distinguish them except for their 395# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 396# or, occasionally, 8184. 397# 398# Nevertheless this will manage to catch a lot of images that happen 399# to have a solid-colored line at the bottom of the screen. 400 401# GRR: Magic too weak 402#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 403#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 404#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 405#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 406#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 407 408# Beagle Bros. Apple Mechanic fonts 409 4100 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 411 412# Apple Universal Disk Image Format (UDIF) - dmg files. 413# From Johan Gade. 414# These entries are disabled for now until we fix the following issues. 415# 416# Note there might be some problems with the "VAX COFF executable" 417# entry. Note this entry should be placed before the mac filesystem section, 418# particularly the "Apple Partition data" entry. 419# 420# The intended meaning of these tests is, that the file is only of the 421# specified type if both of the lines are correct - i.e. if the first 422# line matches and the second doesn't then it is not of that type. 423# 424#0 long 0x7801730d 425#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 426# 427# Note that this entry is recognized correctly by the "Apple Partition 428# data" entry - however since this entry is more specific - this 429# information seems to be more useful. 430#0 long 0x45520200 431#>0x410 string disk\ image UDIF read/write image (UDRW) 432 433# From: Toby Peterson <toby@apple.com> 434# From https://www.nationalarchives.gov.uk/pronom/fmt/866 4350 string bplist00 436>8 search/500 WebMainResource Apple Safari Webarchive 437!:mime application/x-webarchive 438!:strength +50 4390 string bplist00 Apple binary property list 440!:mime application/x-bplist 441 442# Apple binary property list (bplist) 443# Assumes version bytes are hex. 444# Provides content hints for version 0 files. Assumes that the root 445# object is the first object (true for CoreFoundation implementation). 446# From: David Remahl <dremahl@apple.com> 4470 string bplist 448>6 byte x CoreFoundation binary property list data, version %#c 449>>7 byte x \b%c 450>>6 string 00 \b 451>>>8 byte&0xF0 0x00 \b 452>>>>8 byte&0x0F 0x00 \b, root type: null 453>>>>8 byte&0x0F 0x08 \b, root type: false boolean 454>>>>8 byte&0x0F 0x09 \b, root type: true boolean 455>>>8 byte&0xF0 0x10 \b, root type: integer 456>>>8 byte&0xF0 0x20 \b, root type: real 457>>>8 byte&0xF0 0x30 \b, root type: date 458>>>8 byte&0xF0 0x40 \b, root type: data 459>>>8 byte&0xF0 0x50 \b, root type: ascii string 460>>>8 byte&0xF0 0x60 \b, root type: unicode string 461>>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 462>>>8 byte&0xF0 0xa0 \b, root type: array 463>>>8 byte&0xF0 0xd0 \b, root type: dictionary 464 465# Apple/NeXT typedstream data 466# Serialization format used by NeXT and Apple for various 467# purposes in YellowStep/Cocoa, including some nib files. 468# From: David Remahl <dremahl@apple.com> 4692 string typedstream NeXT/Apple typedstream data, big endian 470>0 byte x \b, version %d 471>0 byte <5 \b 472>>13 byte 0x81 \b 473>>>14 ubeshort x \b, system %d 4742 string streamtyped NeXT/Apple typedstream data, little endian 475>0 byte x \b, version %d 476>0 byte <5 \b 477>>13 byte 0x81 \b 478>>>14 uleshort x \b, system %d 479 480#------------------------------------------------------------------------------ 481# CAF: Apple CoreAudio File Format 482# 483# Container format for high-end audio purposes. 484# From: David Remahl <dremahl@apple.com> 485# 4860 string caff CoreAudio Format audio file 487>4 beshort <10 version %d 488 489 490#------------------------------------------------------------------------------ 491# Keychain database files 4920 string kych Mac OS X Keychain File 493 494#------------------------------------------------------------------------------ 495# Code Signing related file types 4960 belong 0xfade0c00 Mac OS X Code Requirement 497>8 belong 1 (opExpr) 498>4 belong x - %d bytes 499 5000 belong 0xfade0c01 Mac OS X Code Requirement Set 501>8 belong >1 containing %d items 502>4 belong x - %d bytes 503 5040 belong 0xfade0c02 Mac OS X Code Directory 505>8 belong x version %x 506>12 belong >0 flags %#x 507>4 belong x - %d bytes 508 5090 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 510>4 belong x - %d bytes 511 5120 belong 0xfade0cc1 Mac OS X Detached Code Signature 513>8 belong >1 (%d elements) 514>4 belong x - %d bytes 515 516# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 517# .vdi 5184 string innotek\ VirtualBox\ Disk\ Image %s 519 520# Apple disk partition stuff 521# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 522# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h 523# Update: Joerg Jenderek 524# "ER" is APPLE_DRVR_MAP_MAGIC signature 5250 beshort 0x4552 526# display Apple Driver Map (strength=50) after Syslinux bootloader (71) 527#!:strength +0 528# strengthen the magic by looking for used blocksizes 512 2048 529>2 ubeshort&0xf1FF 0 Apple Driver Map 530# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid 531#>>504 ubequad&0x0000FFffFFff0000 0 532!:mime application/x-apple-diskimage 533!:apple ????devr 534# https://en.wikipedia.org/wiki/Apple_Disk_Image 535!:ext dmg/iso 536# sbBlkSize for driver descriptor map 512 2048 537>>2 beshort x \b, blocksize %d 538# sbBlkCount sometimes garbish like 539# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg 540# 0xf2720100 for bunziped Firefox 48.0-2.dmg 541# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso 542# 0x00009090 by syslinux-6.03/utils/isohybrid.c 543>>4 ubelong x \b, blockcount %u 544# following device/driver information not very useful 545# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 546>>8 ubeshort x \b, devtype %u 547# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 548>>10 ubeshort x \b, devid %u 549# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) 550>>12 ubelong >0 551>>>12 ubelong x \b, driver data %u 552# number of driver descriptors sbDrvrCount <= 61 553# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 554>>16 ubeshort x \b, driver count %u 555# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map 556# >>18 use apple-driver-map 557# >>26 use apple-driver-map 558# # ... 559# >>500 use apple-driver-map 560# number of partitions is always same in every partition (map block count) 561#>>0x0204 ubelong x \b, %u partitions 562>>0x0204 ubelong >0 \b, contains[@0x200]: 563>>>0x0200 use apple-apm 564>>0x0204 ubelong >1 \b, contains[@0x400]: 565>>>0x0400 use apple-apm 566>>0x0204 ubelong >2 \b, contains[@0x600]: 567>>>0x0600 use apple-apm 568>>0x0204 ubelong >3 \b, contains[@0x800]: 569>>>0x0800 use apple-apm 570>>0x0204 ubelong >4 \b, contains[@0xA00]: 571>>>0x0A00 use apple-apm 572>>0x0204 ubelong >5 \b, contains[@0xC00]: 573>>>0x0C00 use apple-apm 574>>0x0204 ubelong >6 \b, contains[@0xE00]: 575>>>0x0E00 use apple-apm 576>>0x0204 ubelong >7 \b, contains[@0x1000]: 577>>>0x1000 use apple-apm 578# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 5790 name apple-driver-map 580>0 ubequad !0 581# descBlock first block of driver 582>>0 ubelong x \b, driver start block %u 583# descSize driver size in blocks 584>>4 ubeshort x \b, size %u 585# descType driver system type 1 701h F8FFh FFFFh 586>>6 ubeshort x \b, type %#x 587 588# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 589# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h 590# Update: Joerg Jenderek 591# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the 592# magic stronger. 593# for apple partition map stored as a single file 5940 belong 0x504d0000 595# to display Apple Partition Map (strength=70) after Syslinux bootloader (71) 596#!:strength +0 597>0 use apple-apm 598# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type 599# file: could not find any valid magic files! 600#!:ext bin 601# display apple partition map. Normally called after Apple driver map 6020 name apple-apm 603>0 belong 0x504d0000 Apple Partition Map 604# number of partitions 605>>4 ubelong x \b, map block count %u 606# logical block (512 bytes) start of partition 607>>8 ubelong x \b, start block %u 608>>12 ubelong x \b, block count %u 609>>16 string >0 \b, name %s 610>>48 string >0 \b, type %s 611# processor type dpme_process_id[16] e.g. "68000" "68020" 612>>120 string >0 \b, processor %s 613# A/UX boot arguments BootArgs[128] 614>>136 string >0 \b, boot arguments %s 615# status of partition dpme_flags 616>>88 belong & 1 \b, valid 617>>88 belong & 2 \b, allocated 618>>88 belong & 4 \b, in use 619>>88 belong & 8 \b, has boot info 620>>88 belong & 16 \b, readable 621>>88 belong & 32 \b, writable 622>>88 belong & 64 \b, pic boot code 623>>88 belong & 128 \b, chain compatible driver 624>>88 belong & 256 \b, real driver 625>>88 belong & 512 \b, chain driver 626# mount automatically at startup APPLE_PS_AUTO_MOUNT 627>>88 ubelong &0x40000000 \b, mount at startup 628# is the startup partition APPLE_PS_STARTUP 629>>88 ubelong &0x80000000 \b, is the startup partition 630 631#https://wiki.mozilla.org/DS_Store_File_Format 632#https://en.wikipedia.org/wiki/.DS_Store 6330 string \0\0\0\1Bud1\0 Apple Desktop Services Store 634 635# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) 636# Usually not in separate files, but have either filename rsrc with 637# no extension, or a filename corresponding to another file, with 638# extensions rsr/rsrc 639# URL: http://fileformats.archiveteam.org/wiki/Macintosh_resource_file 640# https://en.wikipedia.org/wiki/Resource_fork 641# Reference: https://github.com/kreativekorp/ksfl/wiki/Macintosh-Resource-File-Format 642# http://developer.apple.com/legacy/mac/library/documentation/mac/pdf/MoreMacintoshToolbox.pdf 643# https://formats.kaitai.io/resource_fork/ 644# Update: Joerg Jenderek 645# Note: verified often by command like `deark -m macrsrc Icon_.rsrc` 646# offset of resource data; usually starts at offset 0x0100 6470 string \000\000\001\000 648# skip NPETraceSession.etl with invalid "low" map offset 0 649>4 ubelong >0xFF 650# skip few Atari DEGAS Elite bitmap (eil2.pi1 nastro.pi1) with ivalid "high" 0x6550766 0x7510763 map length 651>>12 ubelong <0x8001 652# most examples with zeroed system reserved field 653>>>16 lelong =0 654>>>>0 use apple-rsr 655# few samples with not zeroed system reserved field like: Empty.rsrc.rsr OpenSans-CondBold.dfont 656>>>16 lelong !0 657# resource fork variant with not zeroed system reserved field and copy of header 658>>>>(4.L) ubelong 0x100 659# GRR: the line above only works if in ../../src/file.h FILE_BYTES_MAX is raised from 1 MiB above 0x6ab0f4 (HelveticaNeue.dfont) 660>>>>>0 use apple-rsr 661# data fork variant with not zeroed system reserved field and no copy of header 662>>>>(4.L) ubelong 0 663>>>>>0 use apple-rsr 664# Note: moved and merged from ./macintosh 665# From: Adam Buchbinder <adam.buchbinder@gmail.com> 666# URL: https://en.wikipedia.org/wiki/Datafork_TrueType 667# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 668# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 669# don't know what they mean. 670# display information about Mac OSX datafork font DFONT 6710 name apple-dfont 672>(4.L+30) ubelong x Mac OSX datafork font, 673# https://en.wikipedia.org/wiki/Datafork_TrueType 674!:mime application/x-dfont 675!:ext dfont 676# https://exiftool.org/TagNames/RSRC.html 677>(4.L+30) ubelong 0x73666e74 TrueType 678>(4.L+30) ubelong 0x464f4e54 'FONT' 679>(4.L+30) ubelong 0x4e464e54 'NFNT' 680>(4.L+30) ubelong 0x504f5354 PostScript 681>(4.L+30) ubelong 0x464f4e44 'FOND' 682>(4.L+30) ubelong 0x76657273 'vers' 683# display information about Macintosh resource 6840 name apple-rsr 685>(4.L+30) ubelong 0x73666e74 686>>0 use apple-dfont 687>(4.L+30) ubelong 0x464f4e54 688>>0 use apple-dfont 689>(4.L+30) ubelong 0x4e464e54 690>>0 use apple-dfont 691>(4.L+30) ubelong 0x504f5354 692>>0 use apple-dfont 693>(4.L+30) ubelong 0x464f4e44 694>>0 use apple-dfont 695>(4.L+30) ubelong 0x76657273 696>>0 use apple-dfont 697>(4.L+30) default x Apple HFS/HFS+ resource fork 698#!:mime application/octet-stream 699!:mime application/x-apple-rsr 700!:ext rsrc/rsr 701# offset to resource data; usually starts at offset 0x0100 702>0 ubelong !0x100 \b, data offset %#x 703# offset to resource map; positive but not nil like in NPETraceSession.etl 704>4 ubelong x \b, map offset %#x 705# length of resource map; positive with 32K limitation but not 706# nil like in NPETraceSession.etl or high like 0x7510763 in nastro.pi1 707>12 ubelong x \b, map length %#x 708# length of resource data; positive but not nil like in NPETraceSession.etl 709>8 ubelong x \b, data length %#x 710# reserved 112 bytes for system use; apparently often nil, but 8fd20000h in Empty.rsrc.rsr and 0x00768c2b in OpenSans-CondBold.dfont 711>16 ubelong !0 \b, at 16 %#8.8x 712# https://fontforge.org/docs/techref/macformats.html 713# jump to resource map 714# a copy of resource header or 16 bytes of zeros for data fork 715#>(4.L) ubelong x \b, DATA offset %#x 716#>(4.L+4) ubelong x \b, MAP offset %#x 717#>(4.L+8) ubelong x \b, DATA length %#x 718#>(4.L+12) ubelong x \b, MAP length %#x 719# nextResourceMap; handle to next resource map; used by the Resource Manager for internal bookkeeping; should be zero 720>(4.L+16) ubelong !0 \b, nextResourceMap %#x 721# fileRef; file reference number; used by the Resource Manager for internal bookkeeping; should be zero 722>(4.L+20) ubeshort !0 \b, fileRef %#x 723# attributes; Resource fork attributes (80h~read-only 40h~compression needed 20h~changed); other bits are reserved and should be zero 724>(4.L+22) ubeshort !0 \b, attributes %#x 725# typeListOffset; offset from resource map to start of type list like: 1Ch 726>(4.L+24) ubeshort x \b, list offset %#x 727# nameListOffset; offset from esource map to start of name list like: 32h 46h 56h (XLISP.RSR XLISPTIN.RSR) 13Eh (HelveticaNeue.dfont) 728>(4.L+26) ubeshort x \b, name offset %#x 729# typeCount; number of types in the map minus 1; If there are no resources, this is 0xFFFF 730>(4.L+28) beshort+1 >0 \b, %u type 731# plural s 732>>(4.L+28) beshort+1 >1 \bs 733# resource type list array; 1st resource type like: ALRT CODE FOND MPSR icns scsz 734>>(4.L+30) ubelong x \b, %#x 735>>(4.L+30) string x '%-.4s' 736# resourceCount; number of this type resources minus one. If there is one resource of this type, this is 0x0000 737>>(4.L+34) beshort+1 x * %d 738# resourceListOffset; offset from type list to resource list like: Ah 12h DAh 739>(4.L+36) ubeshort x resource offset %#x 740 741#https://en.wikipedia.org/wiki/AppleScript 7420 string FasdUAS AppleScript compiled 743 744# AppleWorks/ClarisWorks 745# https://github.com/joshenders/appleworks_format 746# http://fileformats.archiveteam.org/wiki/AppleWorks 7470 name appleworks 748>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document 749>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document 750>0 default x 751>>0 belong x AppleWorks/ClarisWorks CWK Document 752>0 byte x \b, version %d 753>30 beshort x \b, %d 754>32 beshort x \bx%d 755!:ext cwk 756 7574 string BOBO 758>0 byte >4 759>>12 belong 0 760>>>26 belong 0 761>>>>0 use appleworks 762>0 belong 0x0481ad00 763>>0 use appleworks 764 765# magic for Apple File System (APFS) 766# from Alex Myczko <alex@aiei.ch> 76732 string NXSB Apple File System (APFS) 768>36 ulelong x \b, blocksize %u 769 770# iTunes cover art (versions 1 and 2) 7714 string itch 772>24 string artw 773>>0x1e8 string data iTunes cover art 774>>>0x1ed string PNG (PNG) 775>>>0x1ec beshort 0xffd8 (JPEG) 776 777# MacPaint image 77865 string PNTGMPNT MacPaint image data 779#0 belong 2 MacPaint image data 780