1#------------------------------------------------------------------------------ 2# $File: archive,v 1.151 2021/08/16 10:19:56 christos Exp $ 3# archive: file(1) magic for archive formats (see also "msdos" for self- 4# extracting compressed archives) 5# 6# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 7# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c. 8 9# POSIX tar archives 10# URL: https://en.wikipedia.org/wiki/Tar_(computing) 11# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current 12# header mainly padded with nul bytes 13500 quad 0 14!:strength /2 15# filename or extended attribute printable strings in range space null til umlaut ue 16>0 ubeshort >0x1F00 17>>0 ubeshort <0xFCFD 18# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad 19# at https://sourceforge.net/projects/s-tar/files/testscripts/ 20>>>508 ubelong&0x8B9E8DFF 0 21# nul, space or ascii digit 0-7 at start of mode 22>>>>100 ubyte&0xC8 =0 23>>>>>101 ubyte&0xC8 =0 24# nul, space at end of check sum 25>>>>>>155 ubyte&0xDF =0 26# space or ascii digit 0 at start of check sum 27>>>>>>>148 ubyte&0xEF =0x20 28>>>>>>>>0 use tar-file 29# minimal check and then display tar archive information which can also be 30# embedded inside others like Android Backup, Clam AntiVirus database 310 name tar-file 32>257 string !ustar 33# header padded with nuls 34>>257 ulong =0 35# GNU tar version 1.29 with non pax format option without refusing 36# creates misleading V7 header for Long path, Multi-volume, Volume type 37>>>156 ubyte 0x4c GNU tar archive 38!:mime application/x-gtar 39!:ext tar/gtar 40>>>156 ubyte 0x4d GNU tar archive 41!:mime application/x-gtar 42!:ext tar/gtar 43>>>156 ubyte 0x56 GNU tar archive 44!:mime application/x-gtar 45!:ext tar/gtar 46>>>156 default x tar archive (V7) 47!:mime application/x-tar 48!:ext tar 49# other stuff in padding 50# some implementations add new fields to the blank area at the end of the header record 51# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option 52>>257 ulong !0 tar archive (old) 53!:mime application/x-tar 54!:ext tar 55# magic in newer, GNU, posix variants 56>257 string =ustar 57# 2 last char of magic and UStar version because string expression does not work 58# 2 space characters followed by a null for GNU variant 59>>261 ubelong =0x72202000 POSIX tar archive (GNU) 60!:mime application/x-gtar 61!:ext tar/gtar 62# UStar version with ASCII "00" 63>>261 ubelong 0x72003030 POSIX 64# gLOBAL and ExTENSION type only found in POSIX.1-2001 format 65>>>156 ubyte 0x67 \b.1-2001 66>>>156 ubyte 0x78 \b.1-2001 67>>>156 ubyte x tar archive 68!:mime application/x-ustar 69!:ext tar/ustar 70# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab 71>>261 ubelong 0x72000000 tar archive (ustar) 72!:mime application/x-ustar 73!:ext tar/ustar 74# not seen ustar variant with garbish version 75>>261 default x tar archive (unknown ustar) 76!:mime application/x-ustar 77!:ext tar/ustar 78# type flag of 1st tar archive member 79#>156 ubyte x \b, %c-type 80>156 ubyte x 81>>156 ubyte 0 \b, file 82>>156 ubyte 0x30 \b, file 83>>156 ubyte 0x31 \b, hard link 84>>156 ubyte 0x32 \b, symlink 85>>156 ubyte 0x33 \b, char device 86>>156 ubyte 0x34 \b, block device 87>>156 ubyte 0x35 \b, directory 88>>156 ubyte 0x36 \b, fifo 89>>156 ubyte 0x37 \b, reserved 90>>156 ubyte 0x4c \b, long path 91>>156 ubyte 0x4d \b, multi volume 92>>156 ubyte 0x56 \b, volume 93>>156 ubyte 0x67 \b, global 94>>156 ubyte 0x78 \b, extension 95>>156 default x \b, type 96>>>156 ubyte x '%c' 97# name[100] 98>0 string >\0 %-.60s 99# mode mainly stored as an octal number in ASCII null or space terminated 100>100 string >\0 \b, mode %-.7s 101# user id mainly as octal numbers in ASCII null or space terminated 102>108 string >\0 \b, uid %-.7s 103# group id mainly as octal numbers in ASCII null or space terminated 104>116 string >\0 \b, gid %-.7s 105# size mainly as octal number in ASCII 106>124 ubyte <0x38 107>>124 string >\0 \b, size %-.12s 108# coding indicated by setting the high-order bit of the leftmost byte 109>124 ubyte >0xEF \b, size 0x 110>>124 ubyte !0xff \b%2.2x 111>>125 ubyte !0xff \b%2.2x 112>>126 ubyte !0xff \b%2.2x 113>>127 ubyte !0xff \b%2.2x 114>>128 ubyte !0xff \b%2.2x 115>>129 ubyte !0xff \b%2.2x 116>>130 ubyte !0xff \b%2.2x 117>>131 ubyte !0xff \b%2.2x 118>>132 ubyte !0xff \b%2.2x 119>>133 ubyte !0xff \b%2.2x 120>>134 ubyte !0xff \b%2.2x 121>>135 ubyte !0xff \b%2.2x 122# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated 123>136 string >\0 \b, seconds %-.11s 124# header checksum stored as an octal number in ASCII null or space terminated 125#>148 string x \b, cksum %.7s 126# linkname[100] 127>157 string >\0 \b, linkname %-.40s 128# additional fields for ustar 129>257 string =ustar 130# owner user name null terminated 131>>265 string >\0 \b, user %-.32s 132# group name null terminated 133>>297 string >\0 \b, group %-.32s 134# device major minor if not zero 135>>329 ubequad&0xCFCFCFCFcFcFcFdf !0 136>>>329 string x \b, devmaj %-.7s 137>>337 ubequad&0xCFCFCFCFcFcFcFdf !0 138>>>337 string x \b, devmin %-.7s 139# prefix[155] 140>>345 string >\0 \b, prefix %-.155s 141# old non ustar/POSIX tar 142>257 string !ustar 143>>508 string =tar\0 144# padding[255] in old star 145>>>257 string >\0 \b, padding: %-.40s 146>>508 default x 147# padding[255] in old tar sometimes comment field 148>>>257 string >\0 \b, comment: %-.40s 149 150# Incremental snapshot gnu-tar format from: 151# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 1520 string GNU\ tar- GNU tar incremental snapshot data 153>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 154 155# cpio archives 156# 157# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 158# The idea is to indicate archives produced on machines with the same 159# byte order as the machine running "file" with "cpio archive", and 160# to indicate archives produced on machines with the opposite byte order 161# from the machine running "file" with "byte-swapped cpio archive". 162# 163# The SVR4 "cpio(4)" hints that there are additional formats, but they 164# are defined as "short"s; I think all the new formats are 165# character-header formats and thus are strings, not numbers. 1660 short 070707 cpio archive 167!:mime application/x-cpio 1680 short 0143561 byte-swapped cpio archive 169!:mime application/x-cpio # encoding: swapped 1700 string 070707 ASCII cpio archive (pre-SVR4 or odc) 171!:mime application/x-cpio 1720 string 070701 ASCII cpio archive (SVR4 with no CRC) 173!:mime application/x-cpio 1740 string 070702 ASCII cpio archive (SVR4 with CRC) 175!:mime application/x-cpio 176 177# 178# Various archive formats used by various versions of the "ar" 179# command. 180# 181 182# 183# Original UNIX archive formats. 184# They were written with binary values in host byte order, and 185# the magic number was a host "int", which might have been 16 bits 186# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 187# been ports to little-endian 16-bit-int or 32-bit-int platforms 188# (x86?) using some of those formats; if none existed, feel free 189# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 190# 32-bit. There might have been big-endian ports of that sort as 191# well. 192# 1930 leshort 0177555 very old 16-bit-int little-endian archive 1940 beshort 0177555 very old 16-bit-int big-endian archive 1950 lelong 0177555 very old 32-bit-int little-endian archive 1960 belong 0177555 very old 32-bit-int big-endian archive 197 1980 leshort 0177545 old 16-bit-int little-endian archive 199>2 string __.SYMDEF random library 2000 beshort 0177545 old 16-bit-int big-endian archive 201>2 string __.SYMDEF random library 2020 lelong 0177545 old 32-bit-int little-endian archive 203>4 string __.SYMDEF random library 2040 belong 0177545 old 32-bit-int big-endian archive 205>4 string __.SYMDEF random library 206 207# 208# From "pdp" (but why a 4-byte quantity?) 209# 2100 lelong 0x39bed PDP-11 old archive 2110 lelong 0x39bee PDP-11 4.0 archive 212 213# 214# XXX - what flavor of APL used this, and was it a variant of 215# some ar archive format? It's similar to, but not the same 216# as, the APL workspace magic numbers in pdp. 217# 2180 long 0100554 apl workspace 219 220# 221# System V Release 1 portable(?) archive format. 222# 2230 string =<ar> System V Release 1 ar archive 224!:mime application/x-archive 225 226# 227# Debian package; it's in the portable archive format, and needs to go 228# before the entry for regular portable archives, as it's recognized as 229# a portable archive whose first member has a name beginning with 230# "debian". 231# 232# Update: Joerg Jenderek 233# URL: https://en.wikipedia.org/wiki/Deb_(file_format) 2340 string =!<arch>\ndebian 235# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html 236>14 string -split part of multipart Debian package 237!:mime application/vnd.debian.binary-package 238# udeb is used for stripped down deb file 239!:ext deb/udeb 240>14 string -binary Debian binary package 241!:mime application/vnd.debian.binary-package 242# For ipk packager see also https://en.wikipedia.org/wiki/Opkg 243!:ext deb/udeb/ipk 244# This should not happen 245>14 default x Unknown Debian package 246# NL terminated version; for most Debian cases this is 2.0 or 2.1 for split 247>68 string >\0 (format %s) 248#>68 string !2.0\n 249#>>68 string x (format %.3s) 250>68 string =2.0\n 251# 2nd archive name=control archive name like control.tar.gz or control.tar.xz 252>>72 string >\0 \b, with %.14s 253# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma} 254>>0 search/0x93e4f data.tar. \b, data compression 255# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised 256# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb 257>>>&0 string x %.2s 258# skip space (0x20 BSD) and slash (0x2f System V) character marking end of name 259>>>&2 ubyte !0x20 260>>>>&-1 ubyte !0x2f 261# display 3rd character of file name extension like 2 of bz2 or m of lzma 262>>>>>&-1 ubyte x \b%c 263>>>>>>&0 ubyte !0x20 264>>>>>>>&-1 ubyte !0x2f 265# display 4th character of file name extension like a of lzma 266>>>>>>>>&-1 ubyte x \b%c 267# split debian package case 268>68 string =2.1\n 269# dpkg-1.18.25/dpkg-split/info.c 270# NL terminated ASCII package name like ckermit 271>>&0 string x \b, %s 272# NL terminated package version like 302-5.3 273>>>&1 string x %s 274# NL terminated MD5 checksum 275>>>>&1 string x \b, MD5 %s 276# NL terminated original package length 277>>>>>&1 string x \b, unsplitted size %s 278# NL terminated part length 279>>>>>>&1 string x \b, part length %s 280# NL terminated package part like n/m 281>>>>>>>&1 string x \b, part %s 282# NL terminated package architecture like armhf since dpkg 1.16.1 or later 283>>>>>>>>&1 string x \b, %s 284 285# 286# MIPS archive; they're in the portable archive format, and need to go 287# before the entry for regular portable archives, as it's recognized as 288# a portable archive whose first member has a name beginning with 289# "__________E". 290# 2910 string =!<arch>\n__________E MIPS archive 292!:mime application/x-archive 293>20 string U with MIPS Ucode members 294>21 string L with MIPSEL members 295>21 string B with MIPSEB members 296>19 string L and an EL hash table 297>19 string B and an EB hash table 298>22 string X -- out of date 299 300# 301# BSD/SVR2-and-later portable archive formats. 302# 303# Update: Joerg Jenderek 304# URL: http://fileformats.archiveteam.org/wiki/AR 305# Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/ 306# Note: Mach-O universal binary in ./cafebabe is dependent 307# TODO: unify current ar archive, MIPS archive, Debian package 308# distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR; 309# *.ar packages from *.a libraries. handle empty archive 3100 string =!<arch>\n current ar archive 311# print first and possibly second ar_name[16] for debugging purpose 312#>8 string x \b, 1st "%.16s" 313#>68 string x \b, 2nd "%.16s" 314!:mime application/x-archive 315# a in most case for libraries; lib for Microsoft libraries; ar else cases 316!:ext a/lib/ar 317>8 string __.SYMDEF random library 318# first member with long marked name __.SYMDEF SORTED implies BSD library 319>68 string __.SYMDEF\ SORTED random library 320# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf 321# "archive file" entry moved from ./hp 322# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture 323# LST header a_magic 0619h~relocatable library 324>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 325>68 belong 0x02100619 - PA-RISC1.1 relocatable library 326>68 belong 0x02110619 - PA-RISC1.2 relocatable library 327>68 belong 0x02140619 - PA-RISC2.0 relocatable library 328#EOF for common ar archives 329 330# 331# "Thin" archive, as can be produced by GNU ar. 332# 3330 string =!<thin>\n thin archive with 334>68 belong 0 no symbol entries 335>68 belong 1 %d symbol entry 336>68 belong >1 %d symbol entries 337 3380 search/1 -h- Software Tools format archive text 339 340# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 341# 342# The first byte is the magic (0x1a), byte 2 is the compression type for 343# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 344# filename of the first file (null terminated). Since some types collide 345# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 346# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 3470 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 348!:mime application/x-arc 3490 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 350!:mime application/x-arc 3510 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 352!:mime application/x-arc 3530 lelong&0x8080ffff 0x0000031a ARC archive data, packed 354!:mime application/x-arc 3550 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 356!:mime application/x-arc 3570 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 358!:mime application/x-arc 359# [JW] stuff taken from idarc, obviously ARC successors: 3600 lelong&0x8080ffff 0x00000a1a PAK archive data 361!:mime application/x-arc 3620 lelong&0x8080ffff 0x0000141a ARC+ archive data 363!:mime application/x-arc 3640 lelong&0x8080ffff 0x0000481a HYP archive data 365!:mime application/x-arc 366 367# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 368# I can't create either SPARK or ArcFS archives so I have not tested this stuff 369# [GRR: the original entries collide with ARC, above; replaced with combined 370# version (not tested)] 371#0 byte 0x1a RISC OS archive (spark format) 3720 string \032archive RISC OS archive (ArcFS format) 3730 string Archive\000 RISC OS archive (ArcFS format) 374 375# All these were taken from idarc, many could not be verified. Unfortunately, 376# there were many low-quality sigs, i.e. easy to trigger false positives. 377# Please notify me of any real-world fishy/ambiguous signatures and I'll try 378# to get my hands on the actual archiver and see if I find something better. [JW] 379# probably many can be enhanced by finding some 0-byte or control char near the start 380 381# idarc calls this Crush/Uncompressed... *shrug* 3820 string CRUSH Crush archive data 383# Squeeze It (.sqz) 3840 string HLSQZ Squeeze It archive data 385# SQWEZ 3860 string SQWEZ SQWEZ archive data 387# HPack (.hpk) 3880 string HPAK HPack archive data 389# HAP 3900 string \x91\x33HF HAP archive data 391# MD/MDCD 3920 string MDmd MDCD archive data 393# LIM 3940 string LIM\x1a LIM archive data 395# SAR 3963 string LH5 SAR archive data 397# BSArc/BS2 3980 string \212\3SB\020\0 BSArc/BS2 archive data 399# Bethesda Softworks Archive (Oblivion) 4000 string BSA\0 BSArc archive data 401>4 lelong x version %d 402# MAR 4032 string =-ah MAR archive data 404# ACB 405#0 belong&0x00f800ff 0x00800000 ACB archive data 406# CPZ 407# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 408# JRC 4090 string JRchive JRC archive data 410# Quantum 4110 string DS\0 Quantum archive data 412# ReSOF 4130 string PK\3\6 ReSOF archive data 414# QuArk 4150 string 7\4 QuArk archive data 416# YAC 41714 string YC YAC archive data 418# X1 4190 string X1 X1 archive data 4200 string XhDr X1 archive data 421# CDC Codec (.dqt) 4220 belong&0xffffe000 0x76ff2000 CDC Codec archive data 423# AMGC 4240 string \xad6" AMGC archive data 425# NuLIB 4260 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 427# PakLeo 4280 string LEOLZW PAKLeo archive data 429# ChArc 4300 string SChF ChArc archive data 431# PSA 4320 string PSA PSA archive data 433# CrossePAC 4340 string DSIGDCC CrossePAC archive data 435# Freeze 4360 string \x1f\x9f\x4a\x10\x0a Freeze archive data 437# KBoom 4380 string \xc2\xa8MP\xc2\xa8 KBoom archive data 439# NSQ, must go after CDC Codec 4400 string \x76\xff NSQ archive data 441# DPA 4420 string Dirk\ Paehl DPA archive data 443# BA 444# TODO: idarc says "bytes 0-2 == bytes 3-5" 445# TTComp 446# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive 447# Update: Joerg Jenderek 448# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others 4490 string \0\6 450# look for first keyword of Panorama database *.pan 451>12 search/261 DESIGN 452# skip keyword with low entropy 453>12 default x 454# skip DOS 2.0 backup id file, sequence 6 with many nils like BACKUPID_xx6.@@@ handled by ./msdos 455>>8 quad !0 456>>>0 use ttcomp 457# variant ASCII, 4K dictionary (strength=48=50-2). With strength=49 wrong order! WHY? 4580 string \1\6 459# TODO: 460# skip VAX-order 68k Blit mpx/mux executable (strength=50) handled by ./blit 461!:strength -2 462>0 use ttcomp 4630 string \0\5 464# skip some DOS 2.0 backup id file, sequence 5 with many nils like BACKUPID_075.@@@ handled by ./msdos 465>8 quad !0 466>>0 use ttcomp 4670 string \1\5 468# TODO: 469# variant ASCII, 2K dictionary (strength=48=50-2). With strength=49 wrong order! WHY? 470# skip ctab data (strength=50) handled by ./ibm6000 471# skip locale data table (strength=50) handled by ./digital 472!:strength -2 473>0 use ttcomp 4740 string \0\4 475# skip many Maple help database *.hdb with version tag handled by ./maple 476>1028 string !version 477# skip veclib maple.hdb by looking for Mable keyword 478>>4 search/1091 Maple\040 479#>4 search/34090 Maple\040 480>>4 default x 481# skip DOS 2.0-3.2 backed up sequence 4 with many nils like LOTUS5.RAR handled by ./msdos 482# skip xBASE Compound Index file *.CDX with many nils 483>>>0x54 quad !0 484>>>>0 use ttcomp 4850 string \1\4 486# TODO: 487# skip Commodore PET BASIC 4.0 program *.prg 488# variant ASCII, 1K dictionary (strength=48=50-2). With strength=49 wrong order! WHY? 489# skip shared library (strength=50) handled by ./ibm6000 490!:strength -2 491>0 use ttcomp 492# display information of TTComp archive 4930 name ttcomp 494# (version 5.25) labeled the entry as "TTComp archive data" 495>0 ubyte x TTComp archive data 496!:mime application/x-compress-ttcomp 497# PBACKSCR.PI1 498!:ext $xe/$ts/pi1/__d 499# compression type: 0~binary compression 1~ASCII compression 500>0 ubyte 0 \b, binary 501>0 ubyte 1 \b, ASCII 502# size of the dictionary: 4~1024 bytes 5~2048 bytes 6~4096 bytes 503>1 ubyte 4 \b, 1K 504>1 ubyte 5 \b, 2K 505>1 ubyte 6 \b, 4K 506>1 ubyte x dictionary 507# https://mark0.net/forum/index.php?topic=848 508# last 3 bytes probably have only 8 possible bit sequences 509# xxxxxxxx 0000000x 11111111 ____FFh 510# xxxxxxxx 10000000 01111111 __807Fh 511# 0xxxxxxx 11000000 00111111 __C03Fh 512# 00xxxxxx 11100000 00011111 __E01Fh 513# 000xxxxx 11110000 00001111 __F00Fh 514# 0000xxxx 11111000 00000111 __F807h 515# 00000xxx 11111100 00000011 __FC03h 516# 000000xx 11111110 00000001 __FE01h 517# but for quickgif.__d 0A7DD4h 518#>-3 ubyte x \b, last 3 bytes 0x%2.2x 519#>-2 ubeshort x \b%4.4x 520# From: Joerg Jenderek 521# URL: https://wiki.68kmla.org/DiskCopy_4.2_format_specification 522# reference: http://nulib.com/library/FTN.e00005.htm 5230x52 ubeshort 0x0100 524# test for disk image size equal or above 400k 525>0x40 ubelong >409599 526# test also for disk image size equal or below 1440k to skip 527# windows7en.mbr UNICODE.DAT 528>>0x40 ubelong <1474561 529# To skip Flags$StringJoiner.class with size 00106A61h test also for only 4 disk image sizes 530# 00064000 for 400k GCR disks 531# 000c8000 for 800k GCR disks 532# 000b4000 for 720k MFM disks 533# 00168000 for 1440k MFM disks 534>>>0x40 ubelong&0xffE03fFF 0 535>>>>0 use dc42-floppy 536# display information of Apple DiskCopy 4.2 floppy image 5370 name dc42-floppy 538# image pascal name padded with NULs like Microsoft Mail 539>00 pstring/B x Apple DiskCopy 4.2 image %s 540#!:mime application/octet-stream 541!:mime application/x-dc42-floppy-image 542!:apple dCpydImg 543!:ext image/dc42 544# data size in bytes like 409600 545>0x40 ubelong x \b, %u bytes 546# for debugging purpose size in hexadecimal 547#>0x40 ubelong x (%#8.8x) 548# tag size in bytes 549>0x44 ubelong >0 \b, %#x tag size 550# data checksum 551#>0x48 ubelong x \b, %#x checksum 552# tag checksum 553#>0x4c ubelong x \b, %#x tag checksum 554# disk encoding 555>0x50 ubyte 0 \b, GCR CLV ssdd (400k) 556>0x50 ubyte 1 \b, GCR CLV dsdd (800k) 557>0x50 ubyte 2 \b, MFM CAV dsdd (720k) 558>0x50 ubyte 3 \b, MFM CAV dshd (1440k) 559>0x50 ubyte >3 \b, %#x encoding 560# format byte 561>0x51 ubyte x \b, %#x format 562#>0x54 ubequad x \b, data %#16.16llx 563# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 5640 string ESP ESP archive data 565# ZPack 5660 string \1ZPK\1 ZPack archive data 567# Sky 5680 string \xbc\x40 Sky archive data 569# UFA 5700 string UFA UFA archive data 571# Dry 5720 string =-H2O DRY archive data 573# FoxSQZ 5740 string FOXSQZ FoxSQZ archive data 575# AR7 5760 string ,AR7 AR7 archive data 577# PPMZ 5780 string PPMZ PPMZ archive data 579# MS Compress 580# Update: Joerg Jenderek 581# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression 582# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html 583# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z 5844 string \x88\xf0\x27 585# KWAJ variant 586>0 string KWAJ MS Compress archive data, KWAJ variant 587!:mime application/x-ms-compress-kwaj 588# extension not working in version 5.32 589# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?' 590# file: line 284: Bad magic entry ' ??_' 591!:ext ??_ 592# compression method (0-4) 593>>8 uleshort x \b, %u method 594# offset of compressed data 595>>10 uleshort x \b, %#x offset 596#>>(10.s) uleshort x 597#>>>&-6 string x \b, TEST extension %-.3s 598# header flags to mark header extensions 599>>12 uleshort >0 \b, %#x flags 600# 4 bytes: decompressed length of file 601>>12 uleshort &0x01 602>>>14 ulelong x \b, original size: %u bytes 603# 2 bytes: unknown purpose 604# 2 bytes: length of unknown data + mentioned bytes 605# 1-9 bytes: null-terminated file name 606# 1-4 bytes: null-terminated file extension 607>>12 uleshort &0x08 608>>>12 uleshort ^0x01 609>>>>12 uleshort ^0x02 610>>>>>12 uleshort ^0x04 611>>>>>>12 uleshort ^0x10 612>>>>>>>14 string x \b, %-.8s 613>>>>>>12 uleshort &0x10 614>>>>>>>14 string x \b, %-.8s 615>>>>>>>>&1 string x \b.%-.3s 616>>>>>12 uleshort &0x04 617>>>>>>12 uleshort ^0x10 618>>>>>>>(14.s) uleshort x 619>>>>>>>>&14 string x \b, %-.8s 620>>>>>>12 uleshort &0x10 621>>>>>>>(14.s) uleshort x 622>>>>>>>>&14 string x \b, %-.8s 623>>>>>>>>>&1 string x \b.%-.3s 624>>>>12 uleshort &0x02 625>>>>>12 uleshort ^0x04 626>>>>>>12 uleshort ^0x10 627>>>>>>>16 string x \b, %-.8s 628>>>>>>12 uleshort &0x10 629>>>>>>>16 string x \b, %-.8s 630>>>>>>>>&1 string x \b.%-.3s 631>>>>>12 uleshort &0x04 632>>>>>>12 uleshort ^0x10 633>>>>>>>(16.s) uleshort x 634>>>>>>>>&16 string x \b, %-.8s 635>>>>>>12 uleshort &0x10 636>>>>>>>(16.s) uleshort x 637>>>>>>>&16 string x %-.8s 638>>>>>>>>&1 string x \b.%-.3s 639>>>12 uleshort &0x01 640>>>>12 uleshort ^0x02 641>>>>>12 uleshort ^0x04 642>>>>>>12 uleshort ^0x10 643>>>>>>>18 string x \b, %-.8s 644>>>>>>12 uleshort &0x10 645>>>>>>>18 string x \b, %-.8s 646>>>>>>>>&1 string x \b.%-.3s 647>>>>>12 uleshort &0x04 648>>>>>>12 uleshort ^0x10 649>>>>>>>(18.s) uleshort x 650>>>>>>>>&18 string x \b, %-.8s 651>>>>>>12 uleshort &0x10 652>>>>>>>(18.s) uleshort x 653>>>>>>>>&18 string x \b, %-.8s 654>>>>>>>>>&1 string x \b.%-.3s 655>>>>12 uleshort &0x02 656>>>>>12 uleshort ^0x04 657>>>>>>12 uleshort ^0x10 658>>>>>>>20 string x \b, %-.8s 659>>>>>>12 uleshort &0x10 660>>>>>>>20 string x \b, %-.8s 661>>>>>>>>&1 string x \b.%-.3s 662>>>>>12 uleshort &0x04 663>>>>>>12 uleshort ^0x10 664>>>>>>>(20.s) uleshort x 665>>>>>>>>&20 string x \b, %-.8s 666>>>>>>12 uleshort &0x10 667>>>>>>>(20.s) uleshort x 668>>>>>>>>&20 string x \b, %-.8s 669>>>>>>>>>&1 string x \b.%-.3s 670# 2 bytes: length of data + mentioned bytes 671# 672# SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ 673>0 string SZDD MS Compress archive data, SZDD variant 674!:mime application/x-ms-compress-szdd 675!:ext ??_ 676# The character missing from the end of the filename (0=unknown) 677>>9 string >\0 \b, %-.1s is last character of original name 678# https://www.betaarchive.com/forum/viewtopic.php?t=26161 679# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e 680>>8 string !A \b, %-.1s method 681>>10 ulelong >0 \b, original size: %u bytes 682# QBasic SZDD variant 6833 string \x88\xf0\x27 684>0 string SZ\x20 MS Compress archive data, QBasic variant 685!:mime application/x-ms-compress-sz 686!:ext ??$ 687>>8 ulelong >0 \b, original size: %u bytes 688 689# Summary: FTCOMP compressed archive 690# From: Joerg Jenderek 691# URL: http://fileformats.archiveteam.org/wiki/FTCOMP 692# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-ftcomp.trid.xml 693# Note: called by TrID "FTCOMP compressed archive" 694# extracted by `unpack seahelp.hl_` 69524 string/b FTCOMP FTCOMP compressed archive 696#!:mime application/octet-stream 697!:mime application/x-compress-ftcomp 698!:ext ??_/??@/dll/drv/pk2/ 699# probably A596FDFF magic at the beginning 700>0 ubelong !0xA596FDFF \b, at beginning %#x 701# probably original file name with directory like: \OS2\unpack.exe \SYSTEM\8514.DRV MAHJONGG.EXE 702>41 string x "%s" 703 704# MP3 (archiver, not lossy audio compression) 7050 string MP3\x1a MP3-Archiver archive data 706# ZET 7070 string OZ\xc3\x9d ZET archive data 708# TSComp 7090 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 710# ARQ 7110 string gW\4\1 ARQ archive data 712# Squash 7133 string OctSqu Squash archive data 714# Terse 7150 string \5\1\1\0 Terse archive data 716# PUCrunch 7170 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 718# UHarc 7190 string UHA UHarc archive data 720# ABComp 7210 string \2AB ABComp archive data 7220 string \3AB2 ABComp archive data 723# CMP 7240 string CO\0 CMP archive data 725# Splint 7260 string \x93\xb9\x06 Splint archive data 727# InstallShield 7280 string \x13\x5d\x65\x8c InstallShield Z archive Data 729# Gather 7301 string GTH Gather archive data 731# BOA 7320 string BOA BOA archive data 733# RAX 7340 string ULEB\xa RAX archive data 735# Xtreme 7360 string ULEB\0 Xtreme archive data 737# Pack Magic 7380 string @\xc3\xa2\1\0 Pack Magic archive data 739# BTS 7400 belong&0xfeffffff 0x1a034465 BTS archive data 741# ELI 5750 7420 string Ora\ ELI 5750 archive data 743# QFC 7440 string \x1aFC\x1a QFC archive data 7450 string \x1aQF\x1a QFC archive data 746# PRO-PACK 7470 string RNC PRO-PACK archive data 748# 777 7490 string 777 777 archive data 750# LZS221 7510 string sTaC LZS221 archive data 752# HPA 7530 string HPA HPA archive data 754# Arhangel 7550 string LG Arhangel archive data 756# EXP1, uses bzip2 7570 string 0123456789012345BZh EXP1 archive data 758# IMP 7590 string IMP\xa IMP archive data 760# NRV 7610 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 762# Squish 7630 string \x73\xb2\x90\xf4 Squish archive data 764# Par 7650 string PHILIPP Par archive data 7660 string PAR Par archive data 767# HIT 7680 string UB HIT archive data 769# SBX 7700 belong&0xfffff000 0x53423000 SBX archive data 771# NaShrink 7720 string NSK NaShrink archive data 773# SAPCAR 7740 string #\ CAR\ archive\ header SAPCAR archive data 7750 string CAR\ 2.00RG SAPCAR archive data 776# Disintegrator 7770 string DST Disintegrator archive data 778# ASD 7790 string ASD ASD archive data 780# InstallShield CAB 7810 string ISc( InstallShield CAB 782# TOP4 7830 string T4\x1a TOP4 archive data 784# BatComp left out: sig looks like COM executable 785# so TODO: get real 4dos batcomp file and find sig 786# BlakHole 7870 string BH\5\7 BlakHole archive data 788# BIX 7890 string BIX0 BIX archive data 790# ChiefLZA 7910 string ChfLZ ChiefLZA archive data 792# Blink 7930 string Blink Blink archive data 794# Logitech Compress 7950 string \xda\xfa Logitech Compress archive data 796# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 7971 string (C)\ STEPANYUK ARS-Sfx archive data 798# AKT/AKT32 7990 string AKT32 AKT32 archive data 8000 string AKT AKT archive data 801# NPack 8020 string MSTSM NPack archive data 803# PFT 8040 string \0\x50\0\x14 PFT archive data 805# SemOne 8060 string SEM SemOne archive data 807# PPMD 8080 string \x8f\xaf\xac\x84 PPMD archive data 809# FIZ 8100 string FIZ FIZ archive data 811# MSXiE 8120 belong&0xfffff0f0 0x4d530000 MSXiE archive data 813# DeepFreezer 8140 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 815# DC 8160 string =<DC- DC archive data 817# TPac 8180 string \4TPAC\3 TPac archive data 819# Ai 8200 string Ai\1\1\0 Ai archive data 8210 string Ai\1\0\0 Ai archive data 822# Ai32 8230 string Ai\2\0 Ai32 archive data 8240 string Ai\2\1 Ai32 archive data 825# SBC 8260 string SBC SBC archive data 827# Ybs 8280 string YBS Ybs archive data 829# DitPack 8300 string \x9e\0\0 DitPack archive data 831# DMS 8320 string DMS! DMS archive data 833# EPC 8340 string \x8f\xaf\xac\x8c EPC archive data 835# VSARC 8360 string VS\x1a VSARC archive data 837# PDZ 8380 string PDZ PDZ archive data 839# ReDuq 8400 string rdqx ReDuq archive data 841# GCA 8420 string GCAX GCA archive data 843# PPMN 8440 string pN PPMN archive data 845# WinImage 8463 string WINIMAGE WinImage archive data 847# Compressia 8480 string CMP0CMP Compressia archive data 849# UHBC 8500 string UHB UHBC archive data 851# WinHKI 8520 string \x61\x5C\x04\x05 WinHKI archive data 853# WWPack data file 8540 string WWP WWPack archive data 855# BSN (BSA, PTS-DOS) 8560 string \xffBSG BSN archive data 8571 string \xffBSG BSN archive data 8583 string \xffBSG BSN archive data 8591 string \0\xae\2 BSN archive data 8601 string \0\xae\3 BSN archive data 8611 string \0\xae\7 BSN archive data 862# AIN 8630 string \x33\x18 AIN archive data 8640 string \x33\x17 AIN archive data 865# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015 866# SZip (TODO: doesn't catch all versions) 8670 string SZ\x0a\4 SZip archive data 868# XPack DiskImage 869# *.XDI updated by Joerg Jenderek Sep 2015 870# ftp://ftp.sac.sk/pub/sac/pack/0index.txt 871# GRR: this test is still too general as it catches also text files starting with jm 8720 string jm 873# only found examples with this additional characteristic 2 bytes 874>2 string \x2\x4 Xpack DiskImage archive data 875#!:ext xdi 876# XPack Data 877# *.xpa updated by Joerg Jenderek Sep 2015 878# ftp://ftp.elf.stuba.sk/pub/pc/pack/ 8790 string xpa XPA 880!:ext xpa 881# XPA32 882# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip 883# created by XPA32.EXE version 1.0.2 for Windows 884>0 string xpa\0\1 \b32 archive data 885# created by XPACK.COM version 1.67m or 1.67r with short 0x1800 886>3 ubeshort !0x0001 \bck archive data 887# XPack Single Data 888# changed by Joerg Jenderek Sep 2015 back to like in version 5.12 889# letter 'I'+ acute accent is equivalent to \xcd 8900 string \xcd\ jm Xpack single archive data 891#!:mime application/x-xpa-compressed 892!:ext xpa 893 894# TODO: missing due to unknown magic/magic at end of file: 895#DWC 896#ARG 897#ZAR 898#PC/3270 899#InstallIt 900#RKive 901#RK 902#XPack Diskimage 903 904# These were inspired by idarc, but actually verified 905# Dzip archiver (.dz) 906# Update: Joerg Jenderek 907# URL: http://speeddemosarchive.com/dzip/ 908# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c 909# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt 9100 string DZ 911# latest version is 2.9 dated 7 may 2003 912>2 byte <4 Dzip archive data 913!:mime application/x-dzip 914!:ext dz 915>>2 byte x \b, version %i 916>>3 byte x \b.%i 917>>4 ulelong x \b, offset %#x 918>>8 ulelong x \b, %u files 919# ZZip archiver (.zz) 9200 string ZZ\ \0\0 ZZip archive data 9210 string ZZ0 ZZip archive data 922# PAQ archiver (.paq) 9230 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 9240 string PAQ PAQ archive data 925>3 byte&0xf0 0x30 926>>3 byte x (v%c) 927# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 9280xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 9290 string JARCS JAR (ARJ Software, Inc.) archive data 930 931# ARJ archiver (jason@jarthur.Claremont.EDU) 9320 leshort 0xea60 ARJ archive data 933!:mime application/x-arj 934>5 byte x \b, v%d, 935>8 byte &0x04 multi-volume, 936>8 byte &0x10 slash-switched, 937>8 byte &0x20 backup, 938>34 string x original name: %s, 939>7 byte 0 os: MS-DOS 940>7 byte 1 os: PRIMOS 941>7 byte 2 os: Unix 942>7 byte 3 os: Amiga 943>7 byte 4 os: Macintosh 944>7 byte 5 os: OS/2 945>7 byte 6 os: Apple ][ GS 946>7 byte 7 os: Atari ST 947>7 byte 8 os: NeXT 948>7 byte 9 os: VAX/VMS 949>3 byte >0 %d] 950# [JW] idarc says this is also possible 9512 leshort 0xea60 ARJ archive data 952 953# HA archiver (Greg Roelofs, newt@uchicago.edu) 954# This is a really bad format. A file containing HAWAII will match this... 955#0 string HA HA archive data, 956#>2 leshort =1 1 file, 957#>2 leshort >1 %hu files, 958#>4 byte&0x0f =0 first is type CPY 959#>4 byte&0x0f =1 first is type ASC 960#>4 byte&0x0f =2 first is type HSC 961#>4 byte&0x0f =0x0e first is type DIR 962#>4 byte&0x0f =0x0f first is type SPECIAL 963# suggestion: at least identify small archives (<1024 files) 9640 belong&0xffff00fc 0x48410000 HA archive data 965>2 leshort =1 1 file, 966>2 leshort >1 %u files, 967>4 byte&0x0f =0 first is type CPY 968>4 byte&0x0f =1 first is type ASC 969>4 byte&0x0f =2 first is type HSC 970>4 byte&0x0f =0x0e first is type DIR 971>4 byte&0x0f =0x0f first is type SPECIAL 972 973# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 9740 string HPAK HPACK archive data 975 976# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 9770 string \351,\001JAM\ JAM archive, 978>7 string >\0 version %.4s 979>0x26 byte =0x27 - 980>>0x2b string >\0 label %.11s, 981>>0x27 lelong x serial %08x, 982>>0x36 string >\0 fstype %.8s 983 984# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 985# Update: Joerg Jenderek 986# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 987# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html 988# 989# check and display information of lharc (LHa,PMarc) file 9900 name lharc-file 991# check 1st character of method id like -lz4- -lh5- or -pm2- 992>2 string - 993# check 5th character of method id 994>>6 string - 995# check header level 0 1 2 3 996>>>20 ubyte <4 997# check 2nd, 3th and 4th character of method id 998>>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b 999!:mime application/x-lzh-compressed 1000# creator type "LHA " 1001!:apple ????LHA 1002# display archive type name like "LHa/LZS archive data" or "LArc archive" 1003>>>>>2 string -lz \b 1004!:ext lzs 1005# already known -lzs- -lz4- -lz5- with old names 1006>>>>>>2 string -lzs LHa/LZS archive data 1007>>>>>>3 regex \^lz[45] LHarc 1.x archive data 1008# missing -lz?- with wikipedia names 1009>>>>>>3 regex \^lz[2378] LArc archive 1010# display archive type name like "LHa (2.x) archive data" 1011>>>>>2 string -lh \b 1012# already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names 1013>>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data 1014# LHice archiver use ".ICE" as name extension instead usual one ".lzh" 1015# FOOBAR archiver use ".foo" as name extension instead usual one 1016# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment 1017>>>>>>>2 string -lh1 \b 1018!:ext lha/lzh/ice 1019>>>>>>3 regex \^lh[23d] LHa 2.x? archive data 1020>>>>>>3 regex \^lh[7] LHa (2.x)/LHark archive data 1021>>>>>>3 regex \^lh[456] LHa (2.x) archive data 1022>>>>>>>2 string -lh5 \b 1023# https://en.wikipedia.org/wiki/BIOS 1024# Some mainboard BIOS like Award use LHa compression. So archives with unusual extension are found like 1025# bios.rom , kd7_v14.bin, 1010.004, ... 1026!:ext lha/lzh/rom/bin 1027# missing -lh?- variants (Joe Jared) 1028>>>>>>3 regex \^lh[89a-ce] LHa (Joe Jared) archive 1029# UNLHA32 2.67a 1030>>>>>>2 string -lhx LHa (UNLHA32) archive 1031# lha archives with standard file name extensions ".lha" ".lzh" 1032>>>>>>3 regex !\^(lh1|lh5) \b 1033!:ext lha/lzh 1034# this should not happen if all -lh variants are described 1035>>>>>>2 default x LHa (unknown) archive 1036#!:ext lha 1037# PMarc 1038>>>>>3 regex \^pm[012] PMarc archive data 1039!:ext pma 1040# append method id without leading and trailing minus character 1041>>>>>3 string x [%3.3s] 1042>>>>>>0 use lharc-header 1043# 1044# check and display information of lharc header 10450 name lharc-header 1046# header size 0x4 , 0x1b-0x61 1047>0 ubyte x 1048# compressed data size != compressed file size 1049#>7 ulelong x \b, data size %d 1050# attribute: 0x2~?? 0x10~symlink|target 0x20~normal 1051#>19 ubyte x \b, 19_%#x 1052# level identifier 0 1 2 3 1053#>20 ubyte x \b, level %d 1054# time stamp 1055#>15 ubelong x DATE %#8.8x 1056# OS ID for level 1 1057>20 ubyte 1 1058# 0x20 types find for *.rom files 1059>>(21.b+24) ubyte <0x21 \b, %#x OS 1060# ascii type like M for MSDOS 1061>>(21.b+24) ubyte >0x20 \b, '%c' OS 1062# OS ID for level 2 1063>20 ubyte 2 1064#>>23 ubyte x \b, OS ID %#x 1065>>23 ubyte <0x21 \b, %#x OS 1066>>23 ubyte >0x20 \b, '%c' OS 1067# filename only for level 0 and 1 1068>20 ubyte <2 1069# length of filename 1070>>21 ubyte >0 \b, with 1071# filename 1072>>>21 pstring x "%s" 1073# 1074#2 string -lh0- LHarc 1.x/ARX archive data [lh0] 1075#!:mime application/x-lharc 10762 string -lh0- 1077>0 use lharc-file 1078#2 string -lh1- LHarc 1.x/ARX archive data [lh1] 1079#!:mime application/x-lharc 10802 string -lh1- 1081>0 use lharc-file 1082# NEW -lz2- ... -lz8- 10832 string -lz2- 1084>0 use lharc-file 10852 string -lz3- 1086>0 use lharc-file 10872 string -lz4- 1088>0 use lharc-file 10892 string -lz5- 1090>0 use lharc-file 10912 string -lz7- 1092>0 use lharc-file 10932 string -lz8- 1094>0 use lharc-file 1095# [never seen any but the last; -lh4- reported in comp.compression:] 1096#2 string -lzs- LHa/LZS archive data [lzs] 10972 string -lzs- 1098>0 use lharc-file 1099# According to wikipedia and others such a version does not exist 1100#2 string -lh\40- LHa 2.x? archive data [lh ] 1101#2 string -lhd- LHa 2.x? archive data [lhd] 11022 string -lhd- 1103>0 use lharc-file 1104#2 string -lh2- LHa 2.x? archive data [lh2] 11052 string -lh2- 1106>0 use lharc-file 1107#2 string -lh3- LHa 2.x? archive data [lh3] 11082 string -lh3- 1109>0 use lharc-file 1110#2 string -lh4- LHa (2.x) archive data [lh4] 11112 string -lh4- 1112>0 use lharc-file 1113#2 string -lh5- LHa (2.x) archive data [lh5] 11142 string -lh5- 1115>0 use lharc-file 1116#2 string -lh6- LHa (2.x) archive data [lh6] 11172 string -lh6- 1118>0 use lharc-file 1119#2 string -lh7- LHa (2.x)/LHark archive data [lh7] 11202 string -lh7- 1121# !:mime application/x-lha 1122# >20 byte x - header level %d 1123>0 use lharc-file 1124# NEW -lh8- ... -lhe- , -lhx- 11252 string -lh8- 1126>0 use lharc-file 11272 string -lh9- 1128>0 use lharc-file 11292 string -lha- 1130>0 use lharc-file 11312 string -lhb- 1132>0 use lharc-file 11332 string -lhc- 1134>0 use lharc-file 11352 string -lhe- 1136>0 use lharc-file 11372 string -lhx- 1138>0 use lharc-file 1139# taken from idarc [JW] 11402 string -lZ PUT archive data 1141# already done by LHarc magics 1142# this should never happen if all sub types of LZS archive are identified 1143#2 string -lz LZS archive data 11442 string -sw1- Swag archive data 1145 11460 name rar-file-header 1147>24 byte 15 \b, v1.5 1148>24 byte 20 \b, v2.0 1149>24 byte 29 \b, v4 1150>15 byte 0 \b, os: MS-DOS 1151>15 byte 1 \b, os: OS/2 1152>15 byte 2 \b, os: Win32 1153>15 byte 3 \b, os: Unix 1154>15 byte 4 \b, os: Mac OS 1155>15 byte 5 \b, os: BeOS 1156 11570 name rar-archive-header 1158>3 leshort&0x1ff >0 \b, flags: 1159>>3 leshort &0x01 ArchiveVolume 1160>>3 leshort &0x02 Commented 1161>>3 leshort &0x04 Locked 1162>>3 leshort &0x10 NewVolumeNaming 1163>>3 leshort &0x08 Solid 1164>>3 leshort &0x20 Authenticated 1165>>3 leshort &0x40 RecoveryRecordPresent 1166>>3 leshort &0x80 EncryptedBlockHeader 1167>>3 leshort &0x100 FirstVolume 1168 1169# RAR (Roshal Archive) archive 11700 string Rar!\x1a\7\0 RAR archive data 1171!:mime application/x-rar 1172!:ext rar/cbr 1173# file header 1174>(0xc.l+9) byte 0x74 1175>>(0xc.l+7) use rar-file-header 1176# subblock seems to share information with file header 1177>(0xc.l+9) byte 0x7a 1178>>(0xc.l+7) use rar-file-header 1179>9 byte 0x73 1180>>7 use rar-archive-header 1181 11820 string Rar!\x1a\7\1\0 RAR archive data, v5 1183!:mime application/x-rar 1184!:ext rar 1185 1186# Very old RAR archive 1187# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf 11880 string RE\x7e\x5e RAR archive data (<v1.5) 1189!:mime application/x-rar 1190!:ext rar/cbr 1191 1192# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 11930 string SQSH squished archive data (Acorn RISCOS) 1194 1195# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 1196# [JW] see exe section for self-extracting version 11970 string UC2\x1a UC2 archive data 1198 1199# PKZIP multi-volume archive 12000 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 1201!:mime application/zip 1202!:ext zip/cbz 1203 1204# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 12050 string PK\005\006 Zip archive data (empty) 1206!:mime application/zip 1207!:ext zip/cbz 1208!:strength +1 12090 string PK\003\004 1210!:strength +1 1211 1212# Specialised zip formats which start with a member named 'mimetype' 1213# (stored uncompressed, with no 'extra field') containing the file's MIME type. 1214# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 1215# contents starting with "application/": 1216>26 string \x8\0\0\0mimetypeapplication/ 1217 1218# KOffice / OpenOffice & StarOffice / OpenDocument formats 1219# From: Abel Cheung <abel@oaka.org> 1220 1221# KOffice (1.2 or above) formats 1222# (mimetype contains "application/vnd.kde.<SUBTYPE>") 1223>>50 string vnd.kde. KOffice (>=1.2) 1224>>>58 string karbon Karbon document 1225>>>58 string kchart KChart document 1226>>>58 string kformula KFormula document 1227>>>58 string kivio Kivio document 1228>>>58 string kontour Kontour document 1229>>>58 string kpresenter KPresenter document 1230>>>58 string kspread KSpread document 1231>>>58 string kword KWord document 1232 1233# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 1234# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 1235# URL: https://en.wikipedia.org/wiki/OpenOffice.org_XML 1236# reference: http://fileformats.archiveteam.org/wiki/OpenOffice.org_XML 1237>>50 string vnd.sun.xml. OpenOffice.org 1.x 1238>>>62 string writer Writer 1239>>>>68 byte !0x2e document 1240!:mime application/vnd.sun.xml.writer 1241!:ext sxw 1242>>>>68 string .template template 1243!:mime application/vnd.sun.xml.writer.template 1244!:ext stw 1245>>>>68 string .web Web template 1246!:mime application/vnd.sun.xml.writer.web 1247!:ext stw 1248>>>>68 string .global global document 1249!:mime application/vnd.sun.xml.writer.global 1250!:ext sxg 1251>>>62 string calc Calc 1252>>>>66 byte !0x2e spreadsheet 1253!:mime application/vnd.sun.xml.calc 1254!:ext sxc 1255>>>>66 string .template template 1256!:mime application/vnd.sun.xml.calc.template 1257!:ext stc 1258>>>62 string draw Draw 1259>>>>66 byte !0x2e document 1260!:mime application/vnd.sun.xml.draw 1261!:ext sxd 1262>>>>66 string .template template 1263!:mime application/vnd.sun.xml.draw.template 1264!:ext std 1265>>>62 string impress Impress 1266>>>>69 byte !0x2e presentation 1267!:mime application/vnd.sun.xml.impress 1268!:ext sxi 1269>>>>69 string .template template 1270!:mime application/vnd.sun.xml.impress.template 1271!:ext sti 1272>>>62 string math Math document 1273!:mime application/vnd.sun.xml.math 1274!:ext sxm 1275>>>62 string base Database file 1276!:mime application/vnd.sun.xml.base 1277!:ext sdb 1278 1279# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 1280# URL: http://fileformats.archiveteam.org/wiki/OpenDocument 1281# https://lists.oasis-open.org/archives/office/200505/msg00006.html 1282# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 1283>>50 string vnd.oasis.opendocument. OpenDocument 1284>>>73 string text 1285>>>>77 byte !0x2d Text 1286!:mime application/vnd.oasis.opendocument.text 1287!:ext odt 1288>>>>77 string -template Text Template 1289!:mime application/vnd.oasis.opendocument.text-template 1290!:ext ott 1291>>>>77 string -web HTML Document Template 1292!:mime application/vnd.oasis.opendocument.text-web 1293!:ext oth 1294>>>>77 string -master Master Document 1295!:mime application/vnd.oasis.opendocument.text-master 1296!:ext odm 1297>>>73 string graphics 1298>>>>81 byte !0x2d Drawing 1299!:mime application/vnd.oasis.opendocument.graphics 1300!:ext odg 1301>>>>81 string -template Drawing Template 1302!:mime application/vnd.oasis.opendocument.graphics-template 1303!:ext otg 1304>>>73 string presentation 1305>>>>85 byte !0x2d Presentation 1306!:mime application/vnd.oasis.opendocument.presentation 1307!:ext odp 1308>>>>85 string -template Presentation Template 1309!:mime application/vnd.oasis.opendocument.presentation-template 1310!:ext otp 1311>>>73 string spreadsheet 1312>>>>84 byte !0x2d Spreadsheet 1313!:mime application/vnd.oasis.opendocument.spreadsheet 1314!:ext ods 1315>>>>84 string -template Spreadsheet Template 1316!:mime application/vnd.oasis.opendocument.spreadsheet-template 1317!:ext ots 1318>>>73 string chart 1319>>>>78 byte !0x2d Chart 1320!:mime application/vnd.oasis.opendocument.chart 1321!:ext odc 1322>>>>78 string -template Chart Template 1323!:mime application/vnd.oasis.opendocument.chart-template 1324!:ext otc 1325>>>73 string formula 1326>>>>80 byte !0x2d Formula 1327!:mime application/vnd.oasis.opendocument.formula 1328!:ext odf 1329>>>>80 string -template Formula Template 1330!:mime application/vnd.oasis.opendocument.formula-template 1331!:ext otf 1332# https://www.loc.gov/preservation/digital/formats/fdd/fdd000441.shtml 1333>>>73 string database Database 1334!:mime application/vnd.oasis.opendocument.database 1335!:ext odb 1336# Valid for LibreOffice Base 6.0.1.1 at least 1337>>>73 string base Database 1338# https://bugs.documentfoundation.org/show_bug.cgi?id=45854 1339!:mime application/vnd.oasis.opendocument.database 1340#!:mime application/vnd.oasis.opendocument.base 1341!:ext odb 1342>>>73 string image 1343>>>>78 byte !0x2d Image 1344!:mime application/vnd.oasis.opendocument.image 1345!:ext odi 1346>>>>78 string -template Image Template 1347!:mime application/vnd.oasis.opendocument.image-template 1348!:ext oti 1349 1350# EPUB (OEBPS) books using OCF (OEBPS Container Format) 1351# https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 1352# From: Ralf Brown <ralf.brown@gmail.com> 1353>>50 string epub+zip EPUB document 1354!:mime application/epub+zip 1355 1356# From: Joerg Jenderek 1357# URL: http://en.wikipedia.org/wiki/CorelDRAW 1358# NOTE: version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based 1359>>50 string x-vnd.corel. Corel 1360>>>62 string draw.document+zip Draw drawing, version 14-16 1361!:mime application/x-vnd.corel.draw.document+zip 1362!:ext cdr 1363>>>62 string draw.template+zip Draw template, version 14-16 1364!:mime application/x-vnd.corel.draw.template+zip 1365!:ext cdrt 1366>>>62 string zcf.draw.document+zip Draw drawing, version 17-22 1367!:mime application/x-vnd.corel.zcf.draw.document+zip 1368!:ext cdr 1369>>>62 string zcf.draw.template+zip Draw template, version 17-22 1370!:mime application/x-vnd.corel.zcf.draw.template+zip 1371!:ext cdt/cdrt 1372# URL: http://product.corel.com/help/CorelDRAW/540240626/Main/EN/Doc/CorelDRAW-Other-file-formats.html 1373>>>62 string zcf.pattern+zip Draw pattern, version 22 1374!:mime application/x-vnd.corel.zcf.pattern+zip 1375!:ext pat 1376# URL: https://en.wikipedia.org/wiki/Corel_Designer 1377# Reference: http://fileformats.archiveteam.org/wiki/Corel_Designer 1378# Note: called by TrID "Corel DESIGN graphics" 1379>>>62 string designer.document+zip DESIGNER graphics, version 14-16 1380!:mime application/x-vnd.corel.designer.document+zip 1381!:ext des 1382>>>62 string zcf.designer.document+zip DESIGNER graphics, version 17-21 1383!:mime application/x-vnd.corel.zcf.designer.document+zip 1384!:ext des 1385# URL: http://product.corel.com/help/CorelDRAW/540223850/Main/EN/Documentation/ 1386# CorelDRAW-Corel-Symbol-Library-CSL.html 1387>>>62 string symbol.library+zip Symbol Library, version 6-16.3 1388!:mime application/x-vnd.corel.symbol.library+zip 1389!:ext csl 1390>>>62 string zcf.symbol.library+zip Symbol Library, version 17-22 1391!:mime application/x-vnd.corel.zcf.symbol.library+zip 1392!:ext csl 1393 1394# Catch other ZIP-with-mimetype formats 1395# In a ZIP file, the bytes immediately after a member's contents are 1396# always "PK". The 2 regex rules here print the "mimetype" member's 1397# contents up to the first 'P'. Luckily, most MIME types don't contain 1398# any capital 'P's. This is a kludge. 1399# (mimetype contains "application/<OTHER>") 1400>>50 default x Zip data 1401>>>38 regex [!-OQ-~]+ (MIME type "%s"?) 1402!:mime application/zip 1403# (mimetype contents other than "application/*") 1404>26 string \x8\0\0\0mimetype 1405>>38 string !application/ 1406>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 1407!:mime application/zip 1408 1409# Java Jar files 1410>(26.s+30) leshort 0xcafe Java archive data (JAR) 1411!:mime application/java-archive 1412 1413# iOS App 1414>(26.s+30) leshort !0xcafe 1415>>26 string !\x8\0\0\0mimetype 1416>>>30 string Payload/ 1417>>>>38 search/64 .app/ iOS App 1418!:mime application/x-ios-app 1419 1420# Dup, see above. 1421#>30 search/100/b application/epub+zip EPUB document 1422#!:mime application/epub+zip 1423 1424# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 1425# Next line excludes specialized formats: 1426>(26.s+30) leshort !0xcafe 1427>>30 search/100/b !application/epub+zip 1428>>>26 string !\x8\0\0\0mimetype Zip archive data 1429!:mime application/zip 1430>>>>4 beshort x \b, at least 1431>>>>4 use zipversion 1432>>>>4 beshort x to extract 1433>>>>8 beshort x \b, compression method= 1434>>>>8 use zipcompression 1435>>>>0x161 string WINZIP \b, WinZIP self-extracting 1436 1437# StarView Metafile 1438# From Pierre Ducroquet <pinaraf@pinaraf.info> 14390 string VCLMTF StarView MetaFile 1440>6 beshort x \b, version %d 1441>8 belong x \b, size %d 1442 1443# Zoo archiver 144420 lelong 0xfdc4a7dc Zoo archive data 1445!:mime application/x-zoo 1446>4 byte >48 \b, v%c. 1447>>6 byte >47 \b%c 1448>>>7 byte >47 \b%c 1449>32 byte >0 \b, modify: v%d 1450>>33 byte x \b.%d+ 1451>42 lelong 0xfdc4a7dc \b, 1452>>70 byte >0 extract: v%d 1453>>>71 byte x \b.%d+ 1454 1455# Shell archives 145610 string #\ This\ is\ a\ shell\ archive shell archive text 1457!:mime application/octet-stream 1458 1459# 1460# LBR. NB: May conflict with the questionable 1461# "binary Computer Graphics Metafile" format. 1462# 14630 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 1464# 1465# PMA (CP/M derivative of LHA) 1466# Update: Joerg Jenderek 1467# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 1468# 1469#2 string -pm0- PMarc archive data [pm0] 14702 string -pm0- 1471>0 use lharc-file 1472#2 string -pm1- PMarc archive data [pm1] 14732 string -pm1- 1474>0 use lharc-file 1475#2 string -pm2- PMarc archive data [pm2] 14762 string -pm2- 1477>0 use lharc-file 14782 string -pms- PMarc SFX archive (CP/M, DOS) 1479#!:mime application/x-foobar-exec 1480!:ext com 14815 string -pc1- PopCom compressed executable (CP/M) 1482#!:mime application/x- 1483#!:ext com 1484 1485# From Rafael Laboissiere <rafael@laboissiere.net> 1486# The Project Revision Control System (see 1487# http://prcs.sourceforge.net) generates a packaged project 1488# file which is recognized by the following entry: 14890 leshort 0xeb81 PRCS packaged project 1490 1491# Microsoft cabinets 1492# by David Necas (Yeti) <yeti@physics.muni.cz> 1493#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 1494#>25 byte x v%d 1495#>24 byte x \b.%d 1496# MPi: All CABs have version 1.3, so this is pointless. 1497# Better magic in debian-additions. 1498 1499# GTKtalog catalogs 1500# by David Necas (Yeti) <yeti@physics.muni.cz> 15014 string gtktalog\ GTKtalog catalog data, 1502>13 string 3 version 3 1503>>14 beshort 0x677a (gzipped) 1504>>14 beshort !0x677a (not gzipped) 1505>13 string >3 version %s 1506 1507############################################################################ 1508# Parity archive reconstruction file, the 'par' file format now used on Usenet. 15090 string PAR\0 PARity archive data 1510>48 leshort =0 - Index file 1511>48 leshort >0 - file number %d 1512 1513# Felix von Leitner <felix-file@fefe.de> 15140 string d8:announce BitTorrent file 1515!:mime application/x-bittorrent 1516# Durval Menezes, <jmgthbfile at durval dot com> 15170 string d13:announce-list BitTorrent file 1518!:mime application/x-bittorrent 15190 string d7:comment BitTorrent file 1520!:mime application/x-bittorrent 15210 string d4:info BitTorrent file 1522!:mime application/x-bittorrent 1523 1524# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 15250 beshort 0x0e0f Atari MSA archive data 1526>2 beshort x \b, %d sectors per track 1527>4 beshort 0 \b, 1 sided 1528>4 beshort 1 \b, 2 sided 1529>6 beshort x \b, starting track: %d 1530>8 beshort x \b, ending track: %d 1531 1532# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 15330 string PK00PK\003\004 Zip archive data 1534!:mime application/zip 1535!:ext zip/cbz 1536 1537# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 1538# by Stefan `Sec` Zehl <sec@42.org> 15397 string **ACE** ACE archive data 1540>15 byte >0 version %d 1541>16 byte =0x00 \b, from MS-DOS 1542>16 byte =0x01 \b, from OS/2 1543>16 byte =0x02 \b, from Win/32 1544>16 byte =0x03 \b, from Unix 1545>16 byte =0x04 \b, from MacOS 1546>16 byte =0x05 \b, from WinNT 1547>16 byte =0x06 \b, from Primos 1548>16 byte =0x07 \b, from AppleGS 1549>16 byte =0x08 \b, from Atari 1550>16 byte =0x09 \b, from Vax/VMS 1551>16 byte =0x0A \b, from Amiga 1552>16 byte =0x0B \b, from Next 1553>14 byte x \b, version %d to extract 1554>5 leshort &0x0080 \b, multiple volumes, 1555>>17 byte x \b (part %d), 1556>5 leshort &0x0002 \b, contains comment 1557>5 leshort &0x0200 \b, sfx 1558>5 leshort &0x0400 \b, small dictionary 1559>5 leshort &0x0800 \b, multi-volume 1560>5 leshort &0x1000 \b, contains AV-String 1561>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 1562>5 leshort &0x2000 \b, with recovery record 1563>5 leshort &0x4000 \b, locked 1564>5 leshort &0x8000 \b, solid 1565# Date in MS-DOS format (whatever that is) 1566#>18 lelong x Created on 1567 1568# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 1569# <doj@cubic.org> 15700x1A string sfArk sfArk compressed Soundfont 1571>0x15 string 2 1572>>0x1 string >\0 Version %s 1573>>0x2A string >\0 : %s 1574 1575# DR-DOS 7.03 Packed File *.??_ 1576# Reference: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm 1577# Note: unpacked by PNUNPACK.EXE 15780 string Packed\ File\ 1579# by looking for Control-Z skip ASCII text starting with Packed File 1580>0x18 ubyte 0x1a Personal NetWare Packed File 1581!:mime application/x-novell-compress 1582!:ext ??_ 1583>>12 string x \b, was "%.12s" 1584# 1 or 2 1585#>>0x19 ubyte x \b, at 0x19 %u 1586>>0x1b ulelong x with %u bytes 1587 1588# EET archive 1589# From: Tilman Sauerbeck <tilman@code-monkey.de> 15900 belong 0x1ee7ff00 EET archive 1591!:mime application/x-eet 1592 1593# rzip archives 15940 string RZIP rzip compressed data 1595>4 byte x - version %d 1596>5 byte x \b.%d 1597>6 belong x (%d bytes) 1598 1599# From: Joerg Jenderek 1600# URL: https://help.foxitsoftware.com/kb/install-fzip-file.php 1601# reference: http://mark0.net/download/triddefs_xml.7z/ 1602# defs/f/fzip.trid.xml 1603# Note: unknown compression; No "PK" zip magic; normally in directory like 1604# "%APPDATA%\Foxit Software\Addon\Foxit Reader\Install" 16050 ubequad 0x2506781901010000 Foxit add-on/update 1606!:mime application/x-fzip 1607!:ext fzip 1608 1609# From: "Robert Dale" <robdale@gmail.com> 16100 belong 123 dar archive, 1611>4 belong x label "%.8x 1612>>8 belong x %.8x 1613>>>12 beshort x %.4x" 1614>14 byte 0x54 end slice 1615>14 beshort 0x4e4e multi-part 1616>14 beshort 0x4e53 multi-part, with -S 1617 1618# Symbian installation files 1619# https://www.thouky.co.uk/software/psifs/sis.html 1620# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 16218 lelong 0x10000419 Symbian installation file 1622!:mime application/vnd.symbian.install 1623>4 lelong 0x1000006D (EPOC release 3/4/5) 1624>4 lelong 0x10003A12 (EPOC release 6) 16250 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 1626!:mime x-epoc/x-sisx-app 1627 1628# From "Nelson A. de Oliveira" <naoliv@gmail.com> 16290 string MPQ\032 MoPaQ (MPQ) archive 1630 1631# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 1632# .kgb 16330 string KGB_arch KGB Archiver file 1634>10 string x with compression level %.1s 1635 1636# xar (eXtensible ARchiver) archive 1637# URL: https://en.wikipedia.org/wiki/Xar_(archiver) 1638# xar archive format: https://code.google.com/p/xar/ 1639# From: "David Remahl" <dremahl@apple.com> 1640# Update: Joerg Jenderek 1641# TODO: lzma compression; X509Data for pkg and xip 1642# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or 1643# 7z t -txar Xcode_10.2_beta_4.xip` 16440 string xar! xar archive 1645!:mime application/x-xar 1646# pkg for Mac OSX installer package like FullBundleUpdate.pkg 1647# xip for signed Apple software like Xcode_10.2_beta_4.xip 1648!:ext xar/pkg/xip 1649# always 28 in older archives 1650>4 ubeshort >28 \b, header size %u 1651# currently there exit only version 1 since about 2014 1652>6 ubeshort >1 version %u, 1653>8 ubequad x compressed TOC: %llu, 1654#>16 ubequad x uncompressed TOC: %llu, 1655# cksum_alg 0-2 in older and also 3-4 in newer 1656>24 belong 0 no checksum 1657>24 belong 1 SHA-1 checksum 1658>24 belong 2 MD5 checksum 1659>24 belong 3 SHA-256 checksum 1660>24 belong 4 SHA-512 checksum 1661>24 belong >4 unknown %#x checksum 1662#>24 belong >4 checksum 1663# For no compression jump 0 bytes 1664>24 belong 0 1665>>0 ubyte x 1666# jump more bytes forward by header size 1667>>>&(4.S) ubyte x 1668# jump more bytes forward by compressed table of contents size 1669#>>>>&(8.Q) ubequad x \b, heap data %#llx 1670>>>>&(8.Q) ubyte x 1671# look for data by ./compress after message with 1 space at end 1672>>>>>&-3 indirect x \b, contains 1673# For SHA-1 jump 20 minus 2 bytes 1674>24 belong 1 1675>>18 ubyte x 1676# jump more bytes forward by header size 1677>>>&(4.S) ubyte x 1678# jump more bytes forward by compressed table of contents size 1679>>>>&(8.Q) ubyte x 1680# data compressed by gzip, bzip, lzma or none 1681>>>>>&-1 indirect x \b, contains 1682# For SHA-256 jump 32 minus 2 bytes 1683>24 belong 3 1684>>30 ubyte x 1685# jump more bytes forward by header size 1686>>>&(4.S) ubyte x 1687# jump more bytes forward by compressed table of contents size 1688>>>>&(8.Q) ubyte x 1689>>>>>&-1 indirect x \b, contains 1690# For SHA-512 jump 64 minus 2 bytes 1691>24 belong 4 1692>>62 ubyte x 1693# jump more bytes forward by header size 1694>>>&(4.S) ubyte x 1695# jump more bytes forward by compressed table of contents size 1696>>>>&(8.Q) ubyte x 1697>>>>>&-1 indirect x \b, contains 1698 1699# Type: Parity Archive 1700# From: Daniel van Eeden <daniel_e@dds.nl> 17010 string PAR2 Parity Archive Volume Set 1702 1703# Bacula volume format. (Volumes always start with a block header.) 1704# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 1705# From: Adam Buchbinder <adam.buchbinder@gmail.com> 170612 string BB02 Bacula volume 1707>20 bedate x \b, started %s 1708 1709# ePub is XHTML + XML inside a ZIP archive. The first member of the 1710# archive must be an uncompressed file called 'mimetype' with contents 1711# 'application/epub+zip' 1712 1713 1714# From: "Michael Gorny" <mgorny@gentoo.org> 1715# ZPAQ: http://mattmahoney.net/dc/zpaq.html 17160 string zPQ ZPAQ stream 1717>3 byte x \b, level %d 1718# From: Barry Carter <carter.barry@gmail.com> 1719# https://encode.ru/threads/456-zpaq-updates/page32 17200 string 7kSt ZPAQ file 1721 1722# BBeB ebook, unencrypted (LRF format) 1723# URL: https://www.sven.de/librie/Librie/LrfFormat 1724# From: Adam Buchbinder <adam.buchbinder@gmail.com> 17250 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 1726>8 beshort x \b, version %d 1727>36 byte 1 \b, front-to-back 1728>36 byte 16 \b, back-to-front 1729>42 beshort x \b, (%dx, 1730>44 beshort x %d) 1731 1732# Symantec GHOST image by Joerg Jenderek at May 2014 1733# https://us.norton.com/ghost/ 1734# https://www.garykessler.net/library/file_sigs.html 17350 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image 1736# *.GHO 1737>2 ubyte&0x08 0x00 \b, first file 1738# *.GHS or *.[0-9] with cns program option 1739>2 ubyte&0x08 0x08 \b, split file 1740# part of split index interesting for *.ghs 1741>>4 ubyte x id=%#x 1742# compression tag minus one equals numeric compression command line switch z[1-9] 1743>3 ubyte 0 \b, no compression 1744>3 ubyte 2 \b, fast compression (Z1) 1745>3 ubyte 3 \b, medium compression (Z2) 1746>3 ubyte >3 1747>>3 ubyte <11 \b, compression (Z%d-1) 1748>2 ubyte&0x08 0x00 1749# ~ 30 byte password field only for *.gho 1750>>12 ubequad !0 \b, password protected 1751>>44 ubyte !1 1752# 1~Image All, sector-by-sector only for *.gho 1753>>>10 ubyte 1 \b, sector copy 1754# 1~Image Boot track only for *.gho 1755>>>43 ubyte 1 \b, boot track 1756# 1~Image Disc only for *.gho implies Image Boot track and sector copy 1757>>44 ubyte 1 \b, disc sector copy 1758# optional image description only *.gho 1759>>0xff string >\0 "%-.254s" 1760# look for DOS sector end sequence 1761>0xE08 search/7776 \x55\xAA 1762>>&-512 indirect x \b; contains 1763 1764# Google Chrome extensions 1765# https://developer.chrome.com/extensions/crx 1766# https://developer.chrome.com/extensions/hosting 17670 string Cr24 Google Chrome extension 1768!:mime application/x-chrome-extension 1769>4 ulong x \b, version %u 1770 1771# SeqBox - Sequenced container 1772# ext: sbx, seqbox 1773# Marco Pontello marcopon@gmail.com 1774# reference: https://github.com/MarcoPon/SeqBox 17750 string SBx SeqBox, 1776>3 byte x version %d 1777 1778# LyNX archive 177956 string USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE LyNX archive 1780 1781# From: Joerg Jenderek 1782# URL: https://www.acronis.com/ 1783# Reference: https://en.wikipedia.org/wiki/TIB_(file_format) 1784# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110 17850 ubequad 0xce24b9a220000000 Acronis True Image backup 1786!:mime application/x-acronis-tib 1787!:ext tib 1788# 01000000 1789#>20 ubelong x \b, at 20 %#x 1790# 20000000 1791#>28 ubelong x \b, at 28 %#x 1792# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0" 1793# ??? 1794# strings like "\Device\0000011e" "\Device\0000015a" 1795#>0 search/0x6852300/cs \\Device\\ 1796#>>&-1 pstring x \b, %s 1797# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39" 1798#>>>&1 search/180/cs \\Device\\ 1799#>>>>&-1 pstring x \b, %s 1800#>>>>>&0 search/29/cs \0\0\xc8\0 1801# disk label 1802#>>>>>>&10 lestring16 x \b, disk label %11.11s 1803#>>>>>>&9 plestring16 x \b, disk label "%11.11s" 1804#>>>>>>&10 ubequad x %16.16llx 1805 1806 1807# Gentoo XPAK binary package 1808# by Michal Gorny <mgorny@gentoo.org> 1809# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5 1810-4 string STOP 1811>-16 string XPAKSTOP Gentoo binary package (XPAK) 1812 1813# From: Joerg Jenderek 1814# URL: https://kodi.wiki/view/TexturePacker 1815# Reference: https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz 1816# /xbmc-Krypton/xbmc/guilib/XBTF.h 1817# /xbmc-Krypton/xbmc/guilib/XBTF.cpp 18180 string XBTF 1819# skip ASCII text by looking for terminating \0 of path 1820>264 ubyte 0 XBMC texture package 1821!:mime application/x-xbmc-xbt 1822!:ext xbt 1823# XBTF_VERSION 2 1824>>4 string !2 \b, version %-.1s 1825# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp 1826>>5 ulelong x \b, %u file 1827# plural s 1828>>5 ulelong >1 \bs 1829# path[CXBTFFile[MaximumPathLength=256] 1830>>9 string x \b, 1st %s 1831 1832# ALZIP archive 1833# by Hyungjun Park <hyungjun.park@worksmobile.com>, Hajin Jang <hajin_jang@worksmobile.com> 1834# http://kippler.com/win/unalz/ 1835# https://salsa.debian.org/l10n-korean-team/unalz 18360 string ALZ\001 ALZ archive data 1837!:ext alz 1838 1839# https://cf-aldn.altools.co.kr/setup/EGG_Specification.zip 18400 string EGGA EGG archive data, 1841!:ext egg 1842>5 byte x version %u 1843>4 byte x \b.%u 1844>>0x0E ulelong =0x08E28222 1845>>0x0E ulelong =0x24F5A262 \b, split 1846>>0x0E ulelong =0x24E5A060 \b, solid 1847>>0x0E default x \b, unknown 1848 1849# PAQ9A archive 1850# URL: http://mattmahoney.net/dc/#paq9a 1851# Note: Line 1186 of paq9a.cpp gives the magic bytes 18520 string pQ9\001 PAQ9A archive 1853