1 2#------------------------------------------------------------------------------ 3# $File: apple,v 1.48 2023/05/01 14:20:21 christos Exp $ 4# apple: file(1) magic for Apple file formats 5# 60 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 70 string \x0aGL Binary II (apple ][) data 80 string \x76\xff Squeezed (apple ][) data 90 string NuFile NuFile archive (apple ][) data 100 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 110 belong 0x00051600 AppleSingle encoded Macintosh file 120 belong 0x00051607 AppleDouble encoded Macintosh file 13 14# Type: Apple Emulator A2R format 15# From: Greg Wildman <greg@apple2.org.za> 16# Ref: https://applesaucefdc.com/a2r2-reference/ 17# Ref: https://applesaucefdc.com/a2r/ 180 string A2R 19>3 string \x31\xFF\x0A\x0D\x0A Applesauce A2R 1.x Disk Image 20>3 string \x32\xFF\x0A\x0D\x0A Applesauce A2R 2.x Disk Image 21>3 string \x33\xFF\x0A\x0D\x0A Applesauce A2R 3.x Disk Image 22>8 string INFO 23>>49 byte 01 \b, 5.25″ SS 40trk 24>>49 byte 02 \b, 3.5″ DS 80trk 25>>49 byte 03 \b, 5.25″ DS 80trk 26>>49 byte 04 \b, 5.25″ DS 40trk 27>>49 byte 05 \b, 3.5″ DS 80trk 28>>49 byte 06 \b, 8″ DS 29>>50 byte 01 \b, write protected 30>>51 byte 01 \b, cross track synchronized 31>>17 string/T x \b, %.32s 32 33# Type: Apple Emulator WOZ format 34# From: Greg Wildman <greg@apple2.org.za> 35# Ref: https://applesaucefdc.com/woz/reference/ 36# Ref: https://applesaucefdc.com/woz/reference2/ 370 string WOZ 38>3 string \x31\xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image 39>3 string \x32\xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image 40>12 string INFO 41>>21 byte 01 \b, 5.25 inch 42>>21 byte 02 \b, 3.5 inch 43>>22 byte 01 \b, write protected 44>>23 byte 01 \b, cross track synchronized 45>>25 string/T x \b, %.32s 46 47# Type: Apple Macintosh Emulator MOOF format 48# From: Greg Wildman <greg@apple2.org.za> 49# Ref: https://applesaucefdc.com/moof-reference/ 500 string MOOF 51>4 string \xFF\x0A\x0D\x0A Apple Macintosh MOOF Disk Image 52>12 string INFO 53>>21 byte 01 \b, SSDD GCR (400K) 54>>21 byte 02 \b, DSDD GCR (800K) 55>>21 byte 03 \b, DSHD MFM (1.44M) 56>>22 byte 01 \b, write protected 57>>23 byte 01 \b, cross track synchronized 58>>25 string/T x \b, %.32s 59 60# Type: Apple Emulator disk images 61# From: Greg Wildman <greg@apple2.org.za> 62# ProDOS boot loader? 630 string \x01\x38\xB0\x03\x4C Apple ProDOS Image 64# Detect Volume Directory block ($02) 65>0x400 string \x00\x00\x03\x00 66>>0x404 byte &0xF0 67>>>0x405 string x \b, Volume /%s 68>>>0x429 uleshort x \b, %u Blocks 69# ProDOS ordered ? 70>0xb00 string \x00\x00\x03\x00 71>>0xb04 byte &0xF0 72>>>0xb05 string x \b, Volume /%s 73>>>0xb29 uleshort x \b, %u Blocks 74# 75# Proboot HD 760 string \x01\x8A\x48\xD8\x2C\x82\xC0\x8D\x0E\xC0\x8D\x0C Apple ProDOS ProBoot Image 77>0x400 string \x00\x00\x03\x00 78>>0x404 byte &0xF0 79>>>0x405 string x \b, Volume /%s 80>>>0x429 uleshort x \b, %u Blocks 81>0xb00 string \x00\x00\x03\x00 82>>0xb04 byte &0xF0 83>>>0xb05 string x \b, Volume /%s 84>>>0xb29 uleshort x \b, %u Blocks 850 string \x01\xA8\x8A\x20\x7B\xF8\x29\x07\x09\xC0\x99\x30 Apple ProDOS ProBoot Image 86>0x400 string \x00\x00\x03\x00 87>>0x404 byte &0xF0 88>>>0x405 string x \b, Volume /%s 89>>>0x429 uleshort x \b, %u Blocks 90>0xb00 string \x00\x00\x03\x00 91>>0xb04 byte &0xF0 92>>>0xb05 string x \b, Volume /%s 93>>>0xb29 uleshort x \b, %u Blocks 940 string \x01\x4A\xD0\x34\xE6\x3D\x8A\x20\x7B\xF8\x09\xC0 Apple ProDOS ProBoot Image 95>0x400 string \x00\x00\x03\x00 96>>0x404 byte &0xF0 97>>>0x405 string x \b, Volume /%s 98>>>0x429 uleshort x \b, %u Blocks 99>0xb00 string \x00\x00\x03\x00 100>>0xb04 byte &0xF0 101>>>0xb05 string x \b, Volume /%s 102>>>0xb29 uleshort x \b, %u Blocks 103# 104# ProDOS formatted 1050 string \x01\xBD\x88\xC0\x20\x2F\xFB\x20\x58\xFC\x20\x40 Apple ProDOS Unbootable Image 106>0x400 string \x00\x00\x03\x00 107>>0x404 byte &0xF0 108>>>0x405 string x \b, Volume /%s 109>>>0x429 uleshort x \b, %u Blocks 110>0xb00 string \x00\x00\x03\x00 111>>0xb04 byte &0xF0 112>>>0xb05 string x \b, Volume /%s 113>>>0xb29 uleshort x \b, %u Blocks 1140 string \x01\x38\xB0\x03\x4C\x1C\x09\x78\x86\x43\xC9\x03 Apple ProDOS Unbootable Image 115>0x400 string \x00\x00\x03\x00 116>>0x404 byte &0xF0 117>>>0x405 string x \b, Volume /%s 118>>>0x429 uleshort x \b, %u Blocks 119>0xb00 string \x00\x00\x03\x00 120>>0xb04 byte &0xF0 121>>>0xb05 string x \b, Volume /%s 122>>>0xb29 uleshort x \b, %u Blocks 123# 124# DOS3 boot loader 1250 string \x01\xA5\x27\xC9\x09\xD0 126>0x11001 byte 0x11 127>>0x11003 ubyte x Apple DOS 3.%u Image 128>>0x11006 ubyte x \b, Volume #%03u 129>>0x11034 ubyte x \b, %u Tracks 130>>0x11035 ubyte x \b, %u Sectors 131>>0x11036 uleshort x \b, %u bytes per sector 132# 133# DOS3 uninitialized disk 1340 string \x01\xA6\x2B\xBD\x88\xC0\x8A\x4A\x4A 135>0x11001 byte 0x11 136>>0x11003 ubyte x Apple DOS 3.%u Unbootable Image 137>>>0x11006 ubyte x \b, Volume #%03u 138>>>0x11034 ubyte x \b, %u Tracks 139>>>0x11035 ubyte x \b, %u Sectors 140>>>0x11036 uleshort x \b, %u bytes per sector 141# 142# Pascal boot loader? 1430 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD 144>0xd6 pstring SYSTEM.APPLE 145>>0xb00 leshort 0x0000 146>>>0xb04 leshort 0x0000 Apple Pascal Image 147>>>>0xb06 pstring x \b, Volume %s: 148>>>>0xb0e leshort x \b, %u Blocks 149>>>>0xb10 leshort x \b, %u Files 150# 151# Diversi Dos boot loader? 1520 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD 153>0x11001 string \x11\x0F\x03 Apple Diversi Dos Image 154>>0x11006 byte x \b, Volume %u 155>>0x11034 byte x \b, %u Tracks 156>>0x11035 byte x \b, %u Sectors 157>>0x11036 leshort x \b, %u bytes per sector 158 159# Type: Apple Emulator 2IMG format 160# From: Radek Vokal <rvokal@redhat.com> 161# Update: Greg Wildman <greg@apple2.org.za> 1620 string 2IMG Apple ][ 2IMG Disk Image 163>4 clear x 164>4 string XGS! \b, XGS 165>4 string CTKG \b, Catakig 166>4 string ShIm \b, Sheppy's ImageMaker 167>4 string SHEP \b, Sheppy's ImageMaker 168>4 string WOOF \b, Sweet 16 169>4 string B2TR \b, Bernie ][ the Rescue 170>4 string \!nfc \b, ASIMOV2 171>4 string \>BD\< \b, Brutal Deluxe's Cadius 172>4 string CdrP \b, CiderPress 173>4 string Vi][ \b, Virtual ][ 174>4 string PRFS \b, ProFUSE 175>4 string FISH \b, FishWings 176>4 string RVLW \b, Revival for Windows 177>4 default x 178>>4 string x \b, Creator tag "%-4.4s" 179>0xc byte 00 \b, DOS 3.3 sector order 180>>0x10 byte 00 \b, Volume 254 181>>0x10 byte&0x7f x \b, Volume %u 182>0xc byte 01 \b, ProDOS sector order 183# Detect Volume Directory block ($02) + 2mg header offset 184>>0x440 string \x00\x00\x03\x00 185>>>0x444 byte &0xF0 186>>>>0x445 string x \b, Volume /%s 187>>>>0x469 uleshort x \b, %u Blocks 188>0xc byte 02 \b, NIB data 189 190# Type: Peter Ferrie QBoot 191# From: Greg Wildman <greg@apple2.org.za> 192# Ref: https://github.com/peterferrie/qboot 1930 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9 194>8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ QBoot Image 195 196# Type: Peter Ferrie 0Boot 197# From: Greg Wildman <greg@apple2.org.za> 198# Ref: https://github.com/peterferrie/0boot 1990 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9 200>8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ 0Boot Image 201 202# Different proprietary boot sectors 2030 string \x01\x0F\x21\x74\x00\x01\x6B\x00\x02\x30\x81\x5D Apple ][ Disk Image 2040 string \x01\x20\x58\xFC\xA2\x00\x8E\x78\x04\x8E\xF4\x03 Apple ][ Disk Image 2050 string \x01\x20\x58\xFC\xAD\x51\xC0\xAD\x54\xC0\xA6\x2B Apple ][ Disk Image 2060 string \x01\x20\x89\xFE\x20\x93\xFE\xA6\x2B\xBD\x88\xC0 Apple ][ Disk Image 2070 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x25\x08\x68\x85 Apple ][ Disk Image 2080 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x2D\x08\x68\x85 Apple ][ Disk Image 2090 string \x01\x38\x90\x2A\xC9\x01\xF0\x33\xA8\xC8\xC0\x10 Apple ][ Disk Image 2100 string \x01\x38\xB0\x03\x4C\x32\xA1\x87\x43\xC9\x03\x08 Apple ][ Disk Image 2110 string \x01\x4C\x04\x08\xA9\x2A\x8D\x02\x08\x86\x2B\xEE Apple ][ Disk Image 2120 string \x01\x4C\x60\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image 2130 string \x01\x4C\x92\x08\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image 2140 string \x01\x4C\xB3\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image 2150 string \x01\x8D\xFB\x03\x8E\xFC\x03\x8C\xFD\x03\x8A\x29 Apple ][ Disk Image 2160 string \x01\xA2\xFF\x9A\xD8\x20\x20\x08\x20\x34\x08\xAD Apple ][ Disk Image 2170 string \x01\xA5\x27\xBD\x88\xC0\x2C\x10\xC0\xA2\x00\xA9 Apple ][ Disk Image 2180 string \x01\xA5\x2B\xAE\x51\xC0\xEA\xAA\xBD\x88\xC0\x20 Apple ][ Disk Image 2190 string \x01\xA6\x27\xBD\x0B\x08\x48\xBD\x0A\x08\x48\x85 Apple ][ Disk Image 2200 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x01\x85 Apple ][ Disk Image 2210 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x25\x85 Apple ][ Disk Image 2220 string \x01\xA8\xC0\x0F\x90\x16\xF0\x12\xA0\xFF\x18\xAD Apple ][ Disk Image 2230 string \x01\xA9\x00\x85\xF0\xA9\x04\x85\xF1\xA0\x00\xA9 Apple ][ Disk Image 2240 string \x01\xA9\x5C\x8D\xF2\x03\xA9\xC6\x8D\xF3\x03\x49 Apple ][ Disk Image 2250 string \x01\xA9\x60\x8D\x01\x08\x20\x2F\xFB\x20\x58\xFC Apple ][ Disk Image 2260 string \x01\xA9\x60\x8D\x01\x08\x20\x49\x08\xA9\x0A\x85 Apple ][ Disk Image 2270 string \x01\xA9\x60\x8D\x01\x08\x2C\x82\xC0\xBD\x88\xC0 Apple ][ Disk Image 2280 string \x01\xA9\x60\x8D\x01\x08\x86\x43\x8A\x4A\x4A\x4A Apple ][ Disk Image 2290 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\x86\xFF\xB5\x00 Apple ][ Disk Image 2300 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image 2310 string \x01\xA9\x60\x8D\x01\x08\xA9\xB2\x8D\xF2\x03\xA9 Apple ][ Disk Image 2320 string \x01\xA9\x60\x8D\x01\x08\xA9\xFF\x8D\xF3\x03\x8D Apple ][ Disk Image 2330 string \x01\xAC\x00\x08\xF0\x19\xB9\x30\x08\x85\x3D\xCE Apple ][ Disk Image 2340 string \x01\xAC\x23\x08\x30\x2E\xB9\x24\x08\x85\x3D\xCE Apple ][ Disk Image 2350 string \x01\xAD\x00\x08\xC9\x09\xB0\x20\x69\x02\x8D\x00 Apple ][ Disk Image 2360 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\x86\x2B\x8A\x4A Apple ][ Disk Image 2370 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\xA9\xF5\x8D\xF2 Apple ][ Disk Image 2380 string \x01\xB0\x00\xA9\x3F\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image 2390 string \x01\xB0\x00\xA9\x48\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image 2400 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x09\xC0\x8D Apple ][ Disk Image 2410 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x8D\x2F\x08 Apple ][ Disk Image 2420 string \x01\xD8\x2C\x81\xC0\xA9\x60\x4D\x58\xFF\xD0\xFE Apple ][ Disk Image 2430 string \x01\xD8\x78\xBD\x88\xC0\xA9\xFD\x85\x37\x85\x39 Apple ][ Disk Image 2440 string \x01\xE0\x60\xF0\x03\x4C\x16\x09\xAD\x00\x08\xC9 Apple ][ Disk Image 2450 string \x01\xE0\x60\xF0\x03\x4C\xCB\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 2460 string \x01\xE0\x60\xF0\x03\x4C\xEE\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 2470 string \x01\xE0\x60\xF0\x03\x4C\xEF\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 2480 string \x01\xE0\x70\xB0\x04\xE0\x40\xB0\x39\xBD\x88\xC0 Apple ][ Disk Image 2490 string \x01\xEA\x8D\xF4\x03\xA9\x60\x9D\x88\xC0\x8D\x51 Apple ][ Disk Image 250 251# magic for Newton PDA package formats 252# from Ruda Moura <ruda@helllabs.org> 2530 string package0 Newton package, NOS 1.x, 254>12 belong &0x80000000 AutoRemove, 255>12 belong &0x40000000 CopyProtect, 256>12 belong &0x10000000 NoCompression, 257>12 belong &0x04000000 Relocation, 258>12 belong &0x02000000 UseFasterCompression, 259>16 belong x version %d 260 2610 string package1 Newton package, NOS 2.x, 262>12 belong &0x80000000 AutoRemove, 263>12 belong &0x40000000 CopyProtect, 264>12 belong &0x10000000 NoCompression, 265>12 belong &0x04000000 Relocation, 266>12 belong &0x02000000 UseFasterCompression, 267>16 belong x version %d 268 2690 string package4 Newton package, 270>8 byte 8 NOS 1.x, 271>8 byte 9 NOS 2.x, 272>12 belong &0x80000000 AutoRemove, 273>12 belong &0x40000000 CopyProtect, 274>12 belong &0x10000000 NoCompression, 275 276# The following entries for the Apple II are for files that have 277# been transferred as raw binary data from an Apple, without having 278# been encapsulated by any of the above archivers. 279# 280# In general, Apple II formats are hard to identify because Apple DOS 281# and especially Apple ProDOS have strong typing in the file system and 282# therefore programmers never felt much need to include type information 283# in the files themselves. 284# 285# Eric Fischer <enf@pobox.com> 286 287# AppleWorks word processor: 288# URL: https://en.wikipedia.org/wiki/AppleWorks 289# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx 290# Update: Joerg Jenderek 291# NOTE: 292# The "O" is really the magic number, but that's so common that it's 293# necessary to check the tab stops that follow it to avoid false positives. 294# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge 295# the newer AppleWorks is from claris with extension CWK 2964 string O 297# test for unused bits of zoom- , paginated-boolean bytes 298>84 ubequad ^0x00Fe00000000Fe00 299# look for tabstop definitions "=" no tab, "|" no tab 300# "<" left tab,"^" center tab,">" right tab, "." decimal tab, 301# unofficial "!" other , "\x8a" other 302# official only if SFMinVers is nonzero 303>>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor 304# AppleWorks Word Processor File (Apple II) 305# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" 306# application/x-appleworks is mime type for claris version with cwk extension 307!:mime application/x-appleworks3 308# http://home.earthlink.net/~hughhood/appleiiworksenvoy/ 309# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') 310# $70 $1A $F8 $FF is this the apple type ? 311#:apple pdosp^Z\xf8\xff 312!:ext awp 313# minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) 314>>>183 ubyte 30 3.0 315>>>183 ubyte !30 316>>>>183 ubyte !0 %#x 317# usual tabstop start sequence "=====<" 318>>>5 string x \b, tabstop ruler "%6.6s" 319# tabstop ruler 320#>>>5 string >\0 \b, tabstops "%-79s" 321# zoom switch 322>>>85 byte&0x01 >0 \b, zoomed 323# whether paginated 324>>>90 byte&0x01 >0 \b, paginated 325# contains any mail-merge commands 326>>>92 byte&0x01 >0 \b, with mail merge 327# left margin in 1/10 inches ( normally 0 or 10 ) 328>>>91 ubyte >0 329>>>>91 ubyte x \b, %d/10 inch left margin 330 331# AppleWorks database: 332# 333# This isn't really a magic number, but it's the closest thing to one 334# that I could find. The 1 and 2 really mean "order in which you defined 335# categories" and "left to right, top to bottom," respectively; the D and R 336# mean that the cursor should move either down or right when you press Return. 337 338#30 string \x01D AppleWorks database data 339#30 string \x02D AppleWorks database data 340#30 string \x01R AppleWorks database data 341#30 string \x02R AppleWorks database data 342 343# AppleWorks spreadsheet: 344# 345# Likewise, this isn't really meant as a magic number. The R or C means 346# row- or column-order recalculation; the A or M means automatic or manual 347# recalculation. 348 349#131 string RA AppleWorks spreadsheet data 350#131 string RM AppleWorks spreadsheet data 351#131 string CA AppleWorks spreadsheet data 352#131 string CM AppleWorks spreadsheet data 353 354# Applesoft BASIC: 355# 356# This is incredibly sloppy, but will be true if the program was 357# written at its usual memory location of 2048 and its first line 358# number is less than 256. Yuck. 359# update by Joerg Jenderek at Feb 2013 360 361# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 362#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 3630 belong&0x00ff00ff 0x00080000 364# assuming that line number must be positive 365>2 leshort >0 Applesoft BASIC program data, first line number %d 366#>2 leshort x \b, first line number %d 367 368# ORCA/EZ assembler: 369# 370# This will not identify ORCA/M source files, since those have 371# some sort of date code instead of the two zero bytes at 6 and 7 372# XXX Conflicts with ELF 373#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 374#>5 byte x \b, build number %d 375 376# Broderbund Fantavision 377# 378# I don't know what these values really mean, but they seem to recur. 379# Will they cause too many conflicts? 380 381# Probably :-) 382#2 belong&0xFF00FF 0x040008 Fantavision movie data 383 384# Some attempts at images. 385# 386# These are actually just bit-for-bit dumps of the frame buffer, so 387# there's really no reasonably way to distinguish them except for their 388# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 389# or, occasionally, 8184. 390# 391# Nevertheless this will manage to catch a lot of images that happen 392# to have a solid-colored line at the bottom of the screen. 393 394# GRR: Magic too weak 395#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 396#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 397#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 398#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 399#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 400 401# Beagle Bros. Apple Mechanic fonts 402 4030 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 404 405# Apple Universal Disk Image Format (UDIF) - dmg files. 406# From Johan Gade. 407# These entries are disabled for now until we fix the following issues. 408# 409# Note there might be some problems with the "VAX COFF executable" 410# entry. Note this entry should be placed before the mac filesystem section, 411# particularly the "Apple Partition data" entry. 412# 413# The intended meaning of these tests is, that the file is only of the 414# specified type if both of the lines are correct - i.e. if the first 415# line matches and the second doesn't then it is not of that type. 416# 417#0 long 0x7801730d 418#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 419# 420# Note that this entry is recognized correctly by the "Apple Partition 421# data" entry - however since this entry is more specific - this 422# information seems to be more useful. 423#0 long 0x45520200 424#>0x410 string disk\ image UDIF read/write image (UDRW) 425 426# From: Toby Peterson <toby@apple.com> 427# From https://www.nationalarchives.gov.uk/pronom/fmt/866 4280 string bplist00 429>8 search/500 WebMainResource Apple Safari Webarchive 430!:mime application/x-webarchive 431!:strength +50 4320 string bplist00 Apple binary property list 433!:mime application/x-bplist 434 435# Apple binary property list (bplist) 436# Assumes version bytes are hex. 437# Provides content hints for version 0 files. Assumes that the root 438# object is the first object (true for CoreFoundation implementation). 439# From: David Remahl <dremahl@apple.com> 4400 string bplist 441>6 byte x \bCoreFoundation binary property list data, version %#c 442>>7 byte x \b%c 443>6 string 00 \b 444>>8 byte&0xF0 0x00 \b 445>>>8 byte&0x0F 0x00 \b, root type: null 446>>>8 byte&0x0F 0x08 \b, root type: false boolean 447>>>8 byte&0x0F 0x09 \b, root type: true boolean 448>>8 byte&0xF0 0x10 \b, root type: integer 449>>8 byte&0xF0 0x20 \b, root type: real 450>>8 byte&0xF0 0x30 \b, root type: date 451>>8 byte&0xF0 0x40 \b, root type: data 452>>8 byte&0xF0 0x50 \b, root type: ascii string 453>>8 byte&0xF0 0x60 \b, root type: unicode string 454>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 455>>8 byte&0xF0 0xa0 \b, root type: array 456>>8 byte&0xF0 0xd0 \b, root type: dictionary 457 458# Apple/NeXT typedstream data 459# Serialization format used by NeXT and Apple for various 460# purposes in YellowStep/Cocoa, including some nib files. 461# From: David Remahl <dremahl@apple.com> 4622 string typedstream NeXT/Apple typedstream data, big endian 463>0 byte x \b, version %d 464>0 byte <5 \b 465>>13 byte 0x81 \b 466>>>14 ubeshort x \b, system %d 4672 string streamtyped NeXT/Apple typedstream data, little endian 468>0 byte x \b, version %d 469>0 byte <5 \b 470>>13 byte 0x81 \b 471>>>14 uleshort x \b, system %d 472 473#------------------------------------------------------------------------------ 474# CAF: Apple CoreAudio File Format 475# 476# Container format for high-end audio purposes. 477# From: David Remahl <dremahl@apple.com> 478# 4790 string caff CoreAudio Format audio file 480>4 beshort <10 version %d 481>6 beshort x 482 483 484#------------------------------------------------------------------------------ 485# Keychain database files 4860 string kych Mac OS X Keychain File 487 488#------------------------------------------------------------------------------ 489# Code Signing related file types 4900 belong 0xfade0c00 Mac OS X Code Requirement 491>8 belong 1 (opExpr) 492>4 belong x - %d bytes 493 4940 belong 0xfade0c01 Mac OS X Code Requirement Set 495>8 belong >1 containing %d items 496>4 belong x - %d bytes 497 4980 belong 0xfade0c02 Mac OS X Code Directory 499>8 belong x version %x 500>12 belong >0 flags %#x 501>4 belong x - %d bytes 502 5030 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 504>4 belong x - %d bytes 505 5060 belong 0xfade0cc1 Mac OS X Detached Code Signature 507>8 belong >1 (%d elements) 508>4 belong x - %d bytes 509 510# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 511# .vdi 5124 string innotek\ VirtualBox\ Disk\ Image %s 513 514# Apple disk partition stuff 515# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 516# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h 517# Update: Joerg Jenderek 518# "ER" is APPLE_DRVR_MAP_MAGIC signature 5190 beshort 0x4552 520# display Apple Driver Map (strength=50) after Syslinux bootloader (71) 521#!:strength +0 522# strengthen the magic by looking for used blocksizes 512 2048 523>2 ubeshort&0xf1FF 0 Apple Driver Map 524# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid 525#>>504 ubequad&0x0000FFffFFff0000 0 526!:mime application/x-apple-diskimage 527!:apple ????devr 528# https://en.wikipedia.org/wiki/Apple_Disk_Image 529!:ext dmg/iso 530# sbBlkSize for driver descriptor map 512 2048 531>>2 beshort x \b, blocksize %d 532# sbBlkCount sometimes garbish like 533# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg 534# 0xf2720100 for bunziped Firefox 48.0-2.dmg 535# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso 536# 0x00009090 by syslinux-6.03/utils/isohybrid.c 537>>4 ubelong x \b, blockcount %u 538# following device/driver information not very useful 539# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 540>>8 ubeshort x \b, devtype %u 541# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 542>>10 ubeshort x \b, devid %u 543# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) 544>>12 ubelong >0 545>>>12 ubelong x \b, driver data %u 546# number of driver descriptors sbDrvrCount <= 61 547# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 548>>16 ubeshort x \b, driver count %u 549# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map 550# >>18 use apple-driver-map 551# >>26 use apple-driver-map 552# # ... 553# >>500 use apple-driver-map 554# number of partitions is always same in every partition (map block count) 555#>>0x0204 ubelong x \b, %u partitions 556>>0x0204 ubelong >0 \b, contains[@0x200]: 557>>>0x0200 use apple-apm 558>>0x0204 ubelong >1 \b, contains[@0x400]: 559>>>0x0400 use apple-apm 560>>0x0204 ubelong >2 \b, contains[@0x600]: 561>>>0x0600 use apple-apm 562>>0x0204 ubelong >3 \b, contains[@0x800]: 563>>>0x0800 use apple-apm 564>>0x0204 ubelong >4 \b, contains[@0xA00]: 565>>>0x0A00 use apple-apm 566>>0x0204 ubelong >5 \b, contains[@0xC00]: 567>>>0x0C00 use apple-apm 568>>0x0204 ubelong >6 \b, contains[@0xE00]: 569>>>0x0E00 use apple-apm 570>>0x0204 ubelong >7 \b, contains[@0x1000]: 571>>>0x1000 use apple-apm 572# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 5730 name apple-driver-map 574>0 ubequad !0 575# descBlock first block of driver 576>>0 ubelong x \b, driver start block %u 577# descSize driver size in blocks 578>>4 ubeshort x \b, size %u 579# descType driver system type 1 701h F8FFh FFFFh 580>>6 ubeshort x \b, type %#x 581 582# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 583# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h 584# Update: Joerg Jenderek 585# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the 586# magic stronger. 587# for apple partition map stored as a single file 5880 belong 0x504d0000 589# to display Apple Partition Map (strength=70) after Syslinux bootloader (71) 590#!:strength +0 591>0 use apple-apm 592# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type 593# file: could not find any valid magic files! 594#!:ext bin 595# display apple partition map. Normally called after Apple driver map 5960 name apple-apm 597>0 belong 0x504d0000 Apple Partition Map 598# number of partitions 599>>4 ubelong x \b, map block count %u 600# logical block (512 bytes) start of partition 601>>8 ubelong x \b, start block %u 602>>12 ubelong x \b, block count %u 603>>16 string >0 \b, name %s 604>>48 string >0 \b, type %s 605# processor type dpme_process_id[16] e.g. "68000" "68020" 606>>120 string >0 \b, processor %s 607# A/UX boot arguments BootArgs[128] 608>>136 string >0 \b, boot arguments %s 609# status of partition dpme_flags 610>>88 belong & 1 \b, valid 611>>88 belong & 2 \b, allocated 612>>88 belong & 4 \b, in use 613>>88 belong & 8 \b, has boot info 614>>88 belong & 16 \b, readable 615>>88 belong & 32 \b, writable 616>>88 belong & 64 \b, pic boot code 617>>88 belong & 128 \b, chain compatible driver 618>>88 belong & 256 \b, real driver 619>>88 belong & 512 \b, chain driver 620# mount automatically at startup APPLE_PS_AUTO_MOUNT 621>>88 ubelong &0x40000000 \b, mount at startup 622# is the startup partition APPLE_PS_STARTUP 623>>88 ubelong &0x80000000 \b, is the startup partition 624 625#https://wiki.mozilla.org/DS_Store_File_Format 626#https://en.wikipedia.org/wiki/.DS_Store 6270 string \0\0\0\1Bud1\0 Apple Desktop Services Store 628 629# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) 630# Usually not in separate files, but have either filename rsrc with 631# no extension, or a filename corresponding to another file, with 632# extensions rsr/rsrc 633# URL: http://fileformats.archiveteam.org/wiki/Macintosh_resource_file 634# https://en.wikipedia.org/wiki/Resource_fork 635# Reference: https://github.com/kreativekorp/ksfl/wiki/Macintosh-Resource-File-Format 636# http://developer.apple.com/legacy/mac/library/documentation/mac/pdf/MoreMacintoshToolbox.pdf 637# https://formats.kaitai.io/resource_fork/ 638# Update: Joerg Jenderek 639# Note: verified often by command like `deark -m macrsrc Icon_.rsrc` 640# offset of resource data; usually starts at offset 0x0100 6410 string \000\000\001\000 642# skip NPETraceSession.etl with invalid "low" map offset 0 643>4 ubelong >0xFF 644# skip few Atari DEGAS Elite bitmap (eil2.pi1 nastro.pi1) with ivalid "high" 0x6550766 0x7510763 map length 645>>12 ubelong <0x8001 646# most examples with zeroed system reserved field 647>>>16 lelong =0 648>>>>0 use apple-rsr 649# few samples with not zeroed system reserved field like: Empty.rsrc.rsr OpenSans-CondBold.dfont 650>>>16 lelong !0 651# resource fork variant with not zeroed system reserved field and copy of header 652>>>>(4.L) ubelong 0x100 653# GRR: the line above only works if in ../../src/file.h FILE_BYTES_MAX is raised from 1 MiB above 0x6ab0f4 (HelveticaNeue.dfont) 654>>>>>0 use apple-rsr 655# data fork variant with not zeroed system reserved field and no copy of header 656>>>>(4.L) ubelong 0 657>>>>>0 use apple-rsr 658# Note: moved and merged from ./macintosh 659# From: Adam Buchbinder <adam.buchbinder@gmail.com> 660# URL: https://en.wikipedia.org/wiki/Datafork_TrueType 661# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 662# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 663# don't know what they mean. 664# display information about Mac OSX datafork font DFONT 6650 name apple-dfont 666>(4.L+30) ubelong x Mac OSX datafork font, 667# https://en.wikipedia.org/wiki/Datafork_TrueType 668!:mime application/x-dfont 669!:ext dfont 670# https://exiftool.org/TagNames/RSRC.html 671>(4.L+30) ubelong 0x73666e74 TrueType 672>(4.L+30) ubelong 0x464f4e54 'FONT' 673>(4.L+30) ubelong 0x4e464e54 'NFNT' 674>(4.L+30) ubelong 0x504f5354 PostScript 675>(4.L+30) ubelong 0x464f4e44 'FOND' 676>(4.L+30) ubelong 0x76657273 'vers' 677# display information about Macintosh resource 6780 name apple-rsr 679>(4.L+30) ubelong 0x73666e74 680>>0 use apple-dfont 681>(4.L+30) ubelong 0x464f4e54 682>>0 use apple-dfont 683>(4.L+30) ubelong 0x4e464e54 684>>0 use apple-dfont 685>(4.L+30) ubelong 0x504f5354 686>>0 use apple-dfont 687>(4.L+30) ubelong 0x464f4e44 688>>0 use apple-dfont 689>(4.L+30) ubelong 0x76657273 690>>0 use apple-dfont 691>(4.L+30) default x Apple HFS/HFS+ resource fork 692#!:mime application/octet-stream 693!:mime application/x-apple-rsr 694!:ext rsrc/rsr 695# offset to resource data; usually starts at offset 0x0100 696>0 ubelong !0x100 \b, data offset %#x 697# offset to resource map; positive but not nil like in NPETraceSession.etl 698>4 ubelong x \b, map offset %#x 699# length of resource map; positive with 32K limitation but not 700# nil like in NPETraceSession.etl or high like 0x7510763 in nastro.pi1 701>12 ubelong x \b, map length %#x 702# length of resource data; positive but not nil like in NPETraceSession.etl 703>8 ubelong x \b, data length %#x 704# reserved 112 bytes for system use; apparently often nil, but 8fd20000h in Empty.rsrc.rsr and 0x00768c2b in OpenSans-CondBold.dfont 705>16 ubelong !0 \b, at 16 %#8.8x 706# https://fontforge.org/docs/techref/macformats.html 707# jump to resource map 708# a copy of resource header or 16 bytes of zeros for data fork 709#>(4.L) ubelong x \b, DATA offset %#x 710#>(4.L+4) ubelong x \b, MAP offset %#x 711#>(4.L+8) ubelong x \b, DATA length %#x 712#>(4.L+12) ubelong x \b, MAP length %#x 713# nextResourceMap; handle to next resource map; used by the Resource Manager for internal bookkeeping; should be zero 714>(4.L+16) ubelong !0 \b, nextResourceMap %#x 715# fileRef; file reference number; used by the Resource Manager for internal bookkeeping; should be zero 716>(4.L+20) ubeshort !0 \b, fileRef %#x 717# attributes; Resource fork attributes (80h~read-only 40h~compression needed 20h~changed); other bits are reserved and should be zero 718>(4.L+22) ubeshort !0 \b, attributes %#x 719# typeListOffset; offset from resource map to start of type list like: 1Ch 720>(4.L+24) ubeshort x \b, list offset %#x 721# nameListOffset; offset from esource map to start of name list like: 32h 46h 56h (XLISP.RSR XLISPTIN.RSR) 13Eh (HelveticaNeue.dfont) 722>(4.L+26) ubeshort x \b, name offset %#x 723# typeCount; number of types in the map minus 1; If there are no resources, this is 0xFFFF 724>(4.L+28) beshort+1 >0 \b, %u type 725# plural s 726>>(4.L+28) beshort+1 >1 \bs 727# resource type list array; 1st resource type like: ALRT CODE FOND MPSR icns scsz 728>>(4.L+30) ubelong x \b, %#x 729>>(4.L+30) string x '%-.4s' 730# resourceCount; number of this type resources minus one. If there is one resource of this type, this is 0x0000 731>>(4.L+34) beshort+1 x * %d 732# resourceListOffset; offset from type list to resource list like: Ah 12h DAh 733>(4.L+36) ubeshort x resource offset %#x 734 735#https://en.wikipedia.org/wiki/AppleScript 7360 string FasdUAS AppleScript compiled 737 738# AppleWorks/ClarisWorks 739# https://github.com/joshenders/appleworks_format 740# http://fileformats.archiveteam.org/wiki/AppleWorks 7410 name appleworks 742>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document 743>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document 744>0 default x 745>>0 belong x AppleWorks/ClarisWorks CWK Document 746>0 byte x \b, version %d 747>30 beshort x \b, %d 748>32 beshort x \bx%d 749!:ext cwk 750 7514 string BOBO 752>0 byte >4 753>>12 belong 0 754>>>26 belong 0 755>>>>0 use appleworks 756>0 belong 0x0481ad00 757>>0 use appleworks 758 759# magic for Apple File System (APFS) 760# from Alex Myczko <alex@aiei.ch> 76132 string NXSB Apple File System (APFS) 762>36 ulelong x \b, blocksize %u 763 764# iTunes cover art (versions 1 and 2) 7654 string itch 766>24 string artw 767>>0x1e8 string data iTunes cover art 768>>>0x1ed string PNG (PNG) 769>>>0x1ec beshort 0xffd8 (JPEG) 770 771# MacPaint image 77265 string PNTGMPNT MacPaint image data 773#0 belong 2 MacPaint image data 774