xref: /freebsd/contrib/file/magic/Magdir/archive (revision ec273ebf3b6aed5fba8c56b6ece5ad8693a48ea7)
1#------------------------------------------------------------------------------
2# $File: archive,v 1.88 2014/08/16 10:42:17 christos Exp $
3# archive:  file(1) magic for archive formats (see also "msdos" for self-
4#           extracting compressed archives)
5#
6# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
7# pre-POSIX "tar" archives are handled in the C code.
8
9# POSIX tar archives
10257	string		ustar\0		POSIX tar archive
11!:mime	application/x-tar # encoding: posix
12257	string		ustar\040\040\0	GNU tar archive
13!:mime	application/x-tar # encoding: gnu
14
15# Incremental snapshot gnu-tar format from:
16# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
170	string		GNU\ tar-	GNU tar incremental snapshot data
18>&0	regex		[0-9]\.[0-9]+-[0-9]+	version %s
19
20# cpio archives
21#
22# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
23# The idea is to indicate archives produced on machines with the same
24# byte order as the machine running "file" with "cpio archive", and
25# to indicate archives produced on machines with the opposite byte order
26# from the machine running "file" with "byte-swapped cpio archive".
27#
28# The SVR4 "cpio(4)" hints that there are additional formats, but they
29# are defined as "short"s; I think all the new formats are
30# character-header formats and thus are strings, not numbers.
310	short		070707		cpio archive
32!:mime	application/x-cpio
330	short		0143561		byte-swapped cpio archive
34!:mime	application/x-cpio # encoding: swapped
350	string		070707		ASCII cpio archive (pre-SVR4 or odc)
360	string		070701		ASCII cpio archive (SVR4 with no CRC)
370	string		070702		ASCII cpio archive (SVR4 with CRC)
38
39#
40# Various archive formats used by various versions of the "ar"
41# command.
42#
43
44#
45# Original UNIX archive formats.
46# They were written with binary values in host byte order, and
47# the magic number was a host "int", which might have been 16 bits
48# or 32 bits.  We don't say "PDP-11" or "VAX", as there might have
49# been ports to little-endian 16-bit-int or 32-bit-int platforms
50# (x86?) using some of those formats; if none existed, feel free
51# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
52# 32-bit.  There might have been big-endian ports of that sort as
53# well.
54#
550	leshort		0177555		very old 16-bit-int little-endian archive
560	beshort		0177555		very old 16-bit-int big-endian archive
570	lelong		0177555		very old 32-bit-int little-endian archive
580	belong		0177555		very old 32-bit-int big-endian archive
59
600	leshort		0177545		old 16-bit-int little-endian archive
61>2	string		__.SYMDEF	random library
620	beshort		0177545		old 16-bit-int big-endian archive
63>2	string		__.SYMDEF	random library
640	lelong		0177545		old 32-bit-int little-endian archive
65>4	string		__.SYMDEF	random library
660	belong		0177545		old 32-bit-int big-endian archive
67>4	string		__.SYMDEF	random library
68
69#
70# From "pdp" (but why a 4-byte quantity?)
71#
720	lelong		0x39bed		PDP-11 old archive
730	lelong		0x39bee		PDP-11 4.0 archive
74
75#
76# XXX - what flavor of APL used this, and was it a variant of
77# some ar archive format?  It's similar to, but not the same
78# as, the APL workspace magic numbers in pdp.
79#
800	long		0100554		apl workspace
81
82#
83# System V Release 1 portable(?) archive format.
84#
850	string		=<ar>		System V Release 1 ar archive
86!:mime	application/x-archive
87
88#
89# Debian package; it's in the portable archive format, and needs to go
90# before the entry for regular portable archives, as it's recognized as
91# a portable archive whose first member has a name beginning with
92# "debian".
93#
940	string		=!<arch>\ndebian
95>8	string		debian-split	part of multipart Debian package
96!:mime	application/vnd.debian.binary-package
97>8	string		debian-binary	Debian binary package
98!:mime	application/vnd.debian.binary-package
99>8	string		!debian
100>68	string		>\0		(format %s)
101# These next two lines do not work, because a bzip2 Debian archive
102# still uses gzip for the control.tar (first in the archive).  Only
103# data.tar varies, and the location of its filename varies too.
104# file/libmagic does not current have support for ascii-string based
105# (offsets) as of 2005-09-15.
106#>81	string		bz2		\b, uses bzip2 compression
107#>84	string		gz		\b, uses gzip compression
108#>136	ledate		x		created: %s
109
110#
111# MIPS archive; they're in the portable archive format, and need to go
112# before the entry for regular portable archives, as it's recognized as
113# a portable archive whose first member has a name beginning with
114# "__________E".
115#
1160	string	=!<arch>\n__________E	MIPS archive
117!:mime	application/x-archive
118>20	string	U			with MIPS Ucode members
119>21	string	L			with MIPSEL members
120>21	string	B			with MIPSEB members
121>19	string	L			and an EL hash table
122>19	string	B			and an EB hash table
123>22	string	X			-- out of date
124
1250	search/1	-h-		Software Tools format archive text
126
127#
128# BSD/SVR2-and-later portable archive formats.
129#
1300	string		=!<arch>		current ar archive
131!:mime	application/x-archive
132>8	string		__.SYMDEF	random library
133>68	string		__.SYMDEF\ SORTED	random library
134
135#
136# "Thin" archive, as can be produced by GNU ar.
137#
1380	string		=!<thin>\n	thin archive with
139>68	belong		0		no symbol entries
140>68	belong		1		%d symbol entry
141>68	belong		>1		%d symbol entries
142
143# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
144#
145# The first byte is the magic (0x1a), byte 2 is the compression type for
146# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
147# filename of the first file (null terminated).  Since some types collide
148# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
149# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
1500	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
151!:mime	application/x-arc
1520	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
153!:mime	application/x-arc
1540	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
155!:mime	application/x-arc
1560	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
157!:mime	application/x-arc
1580	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
159!:mime	application/x-arc
1600	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched
161!:mime	application/x-arc
162# [JW] stuff taken from idarc, obviously ARC successors:
1630	lelong&0x8080ffff	0x00000a1a	PAK archive data
164!:mime	application/x-arc
1650	lelong&0x8080ffff	0x0000141a	ARC+ archive data
166!:mime	application/x-arc
1670	lelong&0x8080ffff	0x0000481a	HYP archive data
168!:mime	application/x-arc
169
170# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
171# I can't create either SPARK or ArcFS archives so I have not tested this stuff
172# [GRR:  the original entries collide with ARC, above; replaced with combined
173#  version (not tested)]
174#0	byte		0x1a		RISC OS archive (spark format)
1750	string		\032archive	RISC OS archive (ArcFS format)
1760       string          Archive\000     RISC OS archive (ArcFS format)
177
178# All these were taken from idarc, many could not be verified. Unfortunately,
179# there were many low-quality sigs, i.e. easy to trigger false positives.
180# Please notify me of any real-world fishy/ambiguous signatures and I'll try
181# to get my hands on the actual archiver and see if I find something better. [JW]
182# probably many can be enhanced by finding some 0-byte or control char near the start
183
184# idarc calls this Crush/Uncompressed... *shrug*
1850	string	CRUSH Crush archive data
186# Squeeze It (.sqz)
1870	string	HLSQZ Squeeze It archive data
188# SQWEZ
1890	string	SQWEZ SQWEZ archive data
190# HPack (.hpk)
1910	string	HPAK HPack archive data
192# HAP
1930	string	\x91\x33HF HAP archive data
194# MD/MDCD
1950	string	MDmd MDCD archive data
196# LIM
1970	string	LIM\x1a LIM archive data
198# SAR
1993	string	LH5 SAR archive data
200# BSArc/BS2
2010	string	\212\3SB\020\0	BSArc/BS2 archive data
202# Bethesda Softworks Archive (Oblivion)
2030	string	BSA\0 		BSArc archive data
204>4	lelong	x		version %d
205# MAR
2062	string	=-ah MAR archive data
207# ACB
208#0	belong&0x00f800ff	0x00800000 ACB archive data
209# CPZ
210# TODO, this is what idarc says: 0	string	\0\0\0 CPZ archive data
211# JRC
2120	string	JRchive JRC archive data
213# Quantum
2140	string	DS\0 Quantum archive data
215# ReSOF
2160	string	PK\3\6 ReSOF archive data
217# QuArk
2180	string	7\4 QuArk archive data
219# YAC
22014	string	YC YAC archive data
221# X1
2220	string	X1 X1 archive data
2230	string	XhDr X1 archive data
224# CDC Codec (.dqt)
2250	belong&0xffffe000	0x76ff2000 CDC Codec archive data
226# AMGC
2270	string	\xad6" AMGC archive data
228# NuLIB
2290	string	N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
230# PakLeo
2310	string	LEOLZW PAKLeo archive data
232# ChArc
2330	string	SChF ChArc archive data
234# PSA
2350	string	PSA PSA archive data
236# CrossePAC
2370	string	DSIGDCC CrossePAC archive data
238# Freeze
2390	string	\x1f\x9f\x4a\x10\x0a Freeze archive data
240# KBoom
2410	string	\xc2\xa8MP\xc2\xa8 KBoom archive data
242# NSQ, must go after CDC Codec
2430	string	\x76\xff NSQ archive data
244# DPA
2450	string	Dirk\ Paehl DPA archive data
246# BA
247# TODO: idarc says "bytes 0-2 == bytes 3-5"
248# TTComp
2490	string	\0\6 TTComp archive data
250# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
2510	string	ESP ESP archive data
252# ZPack
2530	string	\1ZPK\1 ZPack archive data
254# Sky
2550	string	\xbc\x40 Sky archive data
256# UFA
2570	string	UFA UFA archive data
258# Dry
2590	string	=-H2O DRY archive data
260# FoxSQZ
2610	string	FOXSQZ FoxSQZ archive data
262# AR7
2630	string	,AR7 AR7 archive data
264# PPMZ
2650	string	PPMZ PPMZ archive data
266# MS Compress
2674	string	\x88\xf0\x27 MS Compress archive data
268# updated by Joerg Jenderek
269>9	string	\0
270>>0	string	KWAJ
271>>>7	string	\321\003	MS Compress archive data
272>>>>14	ulong	>0		\b, original size: %d bytes
273>>>>18		ubyte	>0x65
274>>>>>18		string	x       \b, was %.8s
275>>>>>(10.b-4)	string	x       \b.%.3s
276# MP3 (archiver, not lossy audio compression)
2770	string	MP3\x1a MP3-Archiver archive data
278# ZET
2790	string	OZ\xc3\x9d ZET archive data
280# TSComp
2810	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
282# ARQ
2830	string	gW\4\1 ARQ archive data
284# Squash
2853	string	OctSqu Squash archive data
286# Terse
2870	string	\5\1\1\0 Terse archive data
288# PUCrunch
2890	string	\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
290# UHarc
2910	string	UHA UHarc archive data
292# ABComp
2930	string	\2AB ABComp archive data
2940	string	\3AB2 ABComp archive data
295# CMP
2960	string	CO\0 CMP archive data
297# Splint
2980	string	\x93\xb9\x06 Splint archive data
299# InstallShield
3000	string	\x13\x5d\x65\x8c InstallShield Z archive Data
301# Gather
3021	string	GTH Gather archive data
303# BOA
3040	string	BOA BOA archive data
305# RAX
3060	string	ULEB\xa RAX archive data
307# Xtreme
3080	string	ULEB\0 Xtreme archive data
309# Pack Magic
3100	string	@\xc3\xa2\1\0 Pack Magic archive data
311# BTS
3120	belong&0xfeffffff	0x1a034465 BTS archive data
313# ELI 5750
3140	string	Ora\  ELI 5750 archive data
315# QFC
3160	string	\x1aFC\x1a QFC archive data
3170	string	\x1aQF\x1a QFC archive data
318# PRO-PACK
3190	string	RNC PRO-PACK archive data
320# 777
3210	string	777 777 archive data
322# LZS221
3230	string	sTaC LZS221 archive data
324# HPA
3250	string	HPA HPA archive data
326# Arhangel
3270	string	LG Arhangel archive data
328# EXP1, uses bzip2
3290	string	0123456789012345BZh EXP1 archive data
330# IMP
3310	string	IMP\xa IMP archive data
332# NRV
3330	string	\x00\x9E\x6E\x72\x76\xFF NRV archive data
334# Squish
3350	string	\x73\xb2\x90\xf4 Squish archive data
336# Par
3370	string	PHILIPP Par archive data
3380	string	PAR Par archive data
339# HIT
3400	string	UB HIT archive data
341# SBX
3420	belong&0xfffff000	0x53423000 SBX archive data
343# NaShrink
3440	string	NSK NaShrink archive data
345# SAPCAR
3460	string	#\ CAR\ archive\ header SAPCAR archive data
3470	string	CAR\ 2.00RG SAPCAR archive data
348# Disintegrator
3490	string	DST Disintegrator archive data
350# ASD
3510	string	ASD ASD archive data
352# InstallShield CAB
3530	string	ISc( InstallShield CAB
354# TOP4
3550	string	T4\x1a TOP4 archive data
356# BatComp left out: sig looks like COM executable
357# so TODO: get real 4dos batcomp file and find sig
358# BlakHole
3590	string	BH\5\7 BlakHole archive data
360# BIX
3610	string	BIX0 BIX archive data
362# ChiefLZA
3630	string	ChfLZ ChiefLZA archive data
364# Blink
3650	string	Blink Blink archive data
366# Logitech Compress
3670	string	\xda\xfa Logitech Compress archive data
368# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
3691	string	(C)\ STEPANYUK ARS-Sfx archive data
370# AKT/AKT32
3710	string	AKT32 AKT32 archive data
3720	string	AKT AKT archive data
373# NPack
3740	string	MSTSM NPack archive data
375# PFT
3760	string	\0\x50\0\x14 PFT archive data
377# SemOne
3780	string	SEM SemOne archive data
379# PPMD
3800	string	\x8f\xaf\xac\x84 PPMD archive data
381# FIZ
3820	string	FIZ FIZ archive data
383# MSXiE
3840	belong&0xfffff0f0	0x4d530000 MSXiE archive data
385# DeepFreezer
3860	belong&0xfffffff0	0x797a3030 DeepFreezer archive data
387# DC
3880	string	=<DC- DC archive data
389# TPac
3900	string	\4TPAC\3 TPac archive data
391# Ai
3920	string	Ai\1\1\0 Ai archive data
3930	string	Ai\1\0\0 Ai archive data
394# Ai32
3950	string	Ai\2\0 Ai32 archive data
3960	string	Ai\2\1 Ai32 archive data
397# SBC
3980	string	SBC SBC archive data
399# Ybs
4000	string	YBS Ybs archive data
401# DitPack
4020	string	\x9e\0\0 DitPack archive data
403# DMS
4040	string	DMS! DMS archive data
405# EPC
4060	string	\x8f\xaf\xac\x8c EPC archive data
407# VSARC
4080	string	VS\x1a VSARC archive data
409# PDZ
4100	string	PDZ PDZ archive data
411# ReDuq
4120	string	rdqx ReDuq archive data
413# GCA
4140	string	GCAX GCA archive data
415# PPMN
4160	string	pN PPMN archive data
417# WinImage
4183	string	WINIMAGE WinImage archive data
419# Compressia
4200	string	CMP0CMP Compressia archive data
421# UHBC
4220	string	UHB UHBC archive data
423# WinHKI
4240	string	\x61\x5C\x04\x05 WinHKI archive data
425# WWPack data file
4260	string	WWP WWPack archive data
427# BSN (BSA, PTS-DOS)
4280	string	\xffBSG BSN archive data
4291	string	\xffBSG BSN archive data
4303	string	\xffBSG BSN archive data
4311	string	\0\xae\2 BSN archive data
4321	string	\0\xae\3 BSN archive data
4331	string	\0\xae\7 BSN archive data
434# AIN
4350	string	\x33\x18 AIN archive data
4360	string	\x33\x17 AIN archive data
437# XPA32
4380	string	xpa\0\1 XPA32 archive data
439# SZip (TODO: doesn't catch all versions)
4400	string	SZ\x0a\4 SZip archive data
441# XPack DiskImage
4420	string	jm XPack DiskImage archive data
443# XPack Data
4440	string	xpa XPack archive data
445# XPack Single Data
4460	string	\xc3\x8d\ jm XPack single archive data
447
448# TODO: missing due to unknown magic/magic at end of file:
449#DWC
450#ARG
451#ZAR
452#PC/3270
453#InstallIt
454#RKive
455#RK
456#XPack Diskimage
457
458# These were inspired by idarc, but actually verified
459# Dzip archiver (.dz)
4600	string	DZ Dzip archive data
461>2	byte	x \b, version %i
462>3	byte	x \b.%i
463# ZZip archiver (.zz)
4640	string	ZZ\ \0\0 ZZip archive data
4650	string	ZZ0 ZZip archive data
466# PAQ archiver (.paq)
4670	string	\xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
4680	string	PAQ PAQ archive data
469>3	byte&0xf0	0x30
470>>3	byte	x (v%c)
471# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
4720xe	string	\x1aJar\x1b JAR (ARJ Software, Inc.) archive data
4730	string	JARCS JAR (ARJ Software, Inc.) archive data
474
475# ARJ archiver (jason@jarthur.Claremont.EDU)
4760	leshort		0xea60		ARJ archive data
477!:mime	application/x-arj
478>5	byte		x		\b, v%d,
479>8	byte		&0x04		multi-volume,
480>8	byte		&0x10		slash-switched,
481>8	byte		&0x20		backup,
482>34	string		x		original name: %s,
483>7	byte		0		os: MS-DOS
484>7	byte		1		os: PRIMOS
485>7	byte		2		os: Unix
486>7	byte		3		os: Amiga
487>7	byte		4		os: Macintosh
488>7	byte		5		os: OS/2
489>7	byte		6		os: Apple ][ GS
490>7	byte		7		os: Atari ST
491>7	byte		8		os: NeXT
492>7	byte		9		os: VAX/VMS
493>3	byte		>0		%d]
494# [JW] idarc says this is also possible
4952	leshort		0xea60		ARJ archive data
496
497# HA archiver (Greg Roelofs, newt@uchicago.edu)
498# This is a really bad format. A file containing HAWAII will match this...
499#0	string		HA		HA archive data,
500#>2	leshort		=1		1 file,
501#>2	leshort		>1		%hu files,
502#>4	byte&0x0f	=0		first is type CPY
503#>4	byte&0x0f	=1		first is type ASC
504#>4	byte&0x0f	=2		first is type HSC
505#>4	byte&0x0f	=0x0e		first is type DIR
506#>4	byte&0x0f	=0x0f		first is type SPECIAL
507# suggestion: at least identify small archives (<1024 files)
5080  belong&0xffff00fc 0x48410000 HA archive data
509>2	leshort		=1		1 file,
510>2	leshort		>1		%u files,
511>4	byte&0x0f	=0		first is type CPY
512>4	byte&0x0f	=1		first is type ASC
513>4	byte&0x0f	=2		first is type HSC
514>4	byte&0x0f	=0x0e		first is type DIR
515>4	byte&0x0f	=0x0f		first is type SPECIAL
516
517# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
5180	string		HPAK		HPACK archive data
519
520# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
5210	string		\351,\001JAM\ 		JAM archive,
522>7	string		>\0			version %.4s
523>0x26	byte		=0x27			-
524>>0x2b	string          >\0			label %.11s,
525>>0x27	lelong		x			serial %08x,
526>>0x36	string		>\0			fstype %.8s
527
528# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
5292	string		-lh0-		LHarc 1.x/ARX archive data [lh0]
530!:mime	application/x-lharc
5312	string		-lh1-		LHarc 1.x/ARX archive data [lh1]
532!:mime	application/x-lharc
5332	string		-lz4-		LHarc 1.x archive data [lz4]
534!:mime	application/x-lharc
5352	string		-lz5-		LHarc 1.x archive data [lz5]
536!:mime	application/x-lharc
537#	[never seen any but the last; -lh4- reported in comp.compression:]
5382	string		-lzs-		LHa/LZS archive data [lzs]
539!:mime	application/x-lha
5402	string		-lh\40-		LHa 2.x? archive data [lh ]
541!:mime	application/x-lha
5422	string		-lhd-		LHa 2.x? archive data [lhd]
543!:mime	application/x-lha
5442	string		-lh2-		LHa 2.x? archive data [lh2]
545!:mime	application/x-lha
5462	string		-lh3-		LHa 2.x? archive data [lh3]
547!:mime	application/x-lha
5482	string		-lh4-		LHa (2.x) archive data [lh4]
549!:mime	application/x-lha
5502	string		-lh5-		LHa (2.x) archive data [lh5]
551!:mime	application/x-lha
5522	string		-lh6-		LHa (2.x) archive data [lh6]
553!:mime	application/x-lha
5542	string		-lh7-		LHa (2.x)/LHark archive data [lh7]
555!:mime	application/x-lha
556>20	byte		x		- header level %d
557# taken from idarc [JW]
5582   string      -lZ         PUT archive data
5592   string      -lz         LZS archive data
5602   string      -sw1-       Swag archive data
561
562# RAR archiver (Greg Roelofs, newt@uchicago.edu)
5630	string		Rar!		RAR archive data,
564!:mime	application/x-rar
565>44	byte		x		v%0x,
566>10	byte		>0		flags:
567>>10	byte		&0x01		Archive volume,
568>>10	byte		&0x02		Commented,
569>>10	byte		&0x04		Locked,
570>>10	byte		&0x08		Solid,
571>>10	byte		&0x20		Authenticated,
572>35	byte		0		os: MS-DOS
573>35	byte		1		os: OS/2
574>35	byte		2		os: Win32
575>35	byte		3		os: Unix
576# some old version? idarc says:
5770   string      RE\x7e\x5e  RAR archive data
578
579# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
5800	string		SQSH		squished archive data (Acorn RISCOS)
581
582# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
583# [JW] see exe section for self-extracting version
5840	string		UC2\x1a		UC2 archive data
585
586# PKZIP multi-volume archive
5870	string		PK\x07\x08PK\x03\x04	Zip multi-volume archive data, at least PKZIP v2.50 to extract
588!:mime	application/zip
589
590# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
5910	string		PK\005\006	Zip archive data (empty)
5920	string		PK\003\004
593
594# Specialised zip formats which start with a member named 'mimetype'
595# (stored uncompressed, with no 'extra field') containing the file's MIME type.
596# Check for have 8-byte name, 0-byte extra field, name "mimetype", and
597#  contents starting with "application/":
598>26	string		\x8\0\0\0mimetypeapplication/
599
600#  KOffice / OpenOffice & StarOffice / OpenDocument formats
601#    From: Abel Cheung <abel@oaka.org>
602
603#   KOffice (1.2 or above) formats
604#    (mimetype contains "application/vnd.kde.<SUBTYPE>")
605>>50	string	vnd.kde.		KOffice (>=1.2)
606>>>58	string	karbon			Karbon document
607>>>58	string	kchart			KChart document
608>>>58	string	kformula		KFormula document
609>>>58	string	kivio			Kivio document
610>>>58	string	kontour			Kontour document
611>>>58	string	kpresenter		KPresenter document
612>>>58	string	kspread			KSpread document
613>>>58	string	kword			KWord document
614
615#   OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
616#    (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
617>>50	string	vnd.sun.xml.		OpenOffice.org 1.x
618>>>62	string	writer			Writer
619>>>>68	byte	!0x2e			document
620>>>>68	string	.template		template
621>>>>68	string	.global			global document
622>>>62	string	calc			Calc
623>>>>66	byte	!0x2e			spreadsheet
624>>>>66	string	.template		template
625>>>62	string	draw			Draw
626>>>>66	byte	!0x2e			document
627>>>>66	string	.template		template
628>>>62	string	impress			Impress
629>>>>69	byte	!0x2e			presentation
630>>>>69	string	.template		template
631>>>62	string	math			Math document
632>>>62	string	base			Database file
633
634#   OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
635#    http://lists.oasis-open.org/archives/office/200505/msg00006.html
636#    (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
637>>50	string	vnd.oasis.opendocument.	OpenDocument
638>>>73	string	text
639>>>>77	byte	!0x2d			Text
640!:mime	application/vnd.oasis.opendocument.text
641>>>>77	string	-template		Text Template
642!:mime	application/vnd.oasis.opendocument.text-template
643>>>>77	string	-web			HTML Document Template
644!:mime	application/vnd.oasis.opendocument.text-web
645>>>>77	string	-master			Master Document
646!:mime	application/vnd.oasis.opendocument.text-master
647>>>73	string	graphics
648>>>>81	byte	!0x2d			Drawing
649!:mime	application/vnd.oasis.opendocument.graphics
650>>>>81	string	-template		Template
651!:mime	application/vnd.oasis.opendocument.graphics-template
652>>>73	string	presentation
653>>>>85	byte	!0x2d			Presentation
654!:mime	application/vnd.oasis.opendocument.presentation
655>>>>85	string	-template		Template
656!:mime	application/vnd.oasis.opendocument.presentation-template
657>>>73	string	spreadsheet
658>>>>84	byte	!0x2d			Spreadsheet
659!:mime	application/vnd.oasis.opendocument.spreadsheet
660>>>>84	string	-template		Template
661!:mime	application/vnd.oasis.opendocument.spreadsheet-template
662>>>73	string	chart
663>>>>78	byte	!0x2d			Chart
664!:mime	application/vnd.oasis.opendocument.chart
665>>>>78	string	-template		Template
666!:mime	application/vnd.oasis.opendocument.chart-template
667>>>73	string	formula
668>>>>80	byte	!0x2d			Formula
669!:mime	application/vnd.oasis.opendocument.formula
670>>>>80	string	-template		Template
671!:mime	application/vnd.oasis.opendocument.formula-template
672>>>73	string	database		Database
673!:mime	application/vnd.oasis.opendocument.database
674>>>73	string	image
675>>>>78	byte	!0x2d			Image
676!:mime	application/vnd.oasis.opendocument.image
677>>>>78	string	-template		Template
678!:mime	application/vnd.oasis.opendocument.image-template
679
680#  EPUB (OEBPS) books using OCF (OEBPS Container Format)
681#    http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
682#    From: Ralf Brown <ralf.brown@gmail.com>
683>>50	string	epub+zip	EPUB document
684!:mime application/epub+zip
685
686#  Catch other ZIP-with-mimetype formats
687#	In a ZIP file, the bytes immediately after a member's contents are
688#	always "PK". The 2 regex rules here print the "mimetype" member's
689#	contents up to the first 'P'. Luckily, most MIME types don't contain
690#	any capital 'P's. This is a kludge.
691#    (mimetype contains "application/<OTHER>")
692>>50		string	!epub+zip
693>>>50		string	!vnd.oasis.opendocument.
694>>>>50		string	!vnd.sun.xml.
695>>>>>50		string	!vnd.kde.
696>>>>>>38	regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
697!:mime	application/zip
698#    (mimetype contents other than "application/*")
699>26		string	\x8\0\0\0mimetype
700>>38		string	!application/
701>>>38		regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
702!:mime	application/zip
703
704# Java Jar files
705>(26.s+30)	leshort	0xcafe		Java archive data (JAR)
706!:mime	application/java-archive
707
708# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
709#   Next line excludes specialized formats:
710>(26.s+30)	leshort	!0xcafe
711>>26    string          !\x8\0\0\0mimetype	Zip archive data
712!:mime	application/zip
713>>>4	byte		0x09		\b, at least v0.9 to extract
714>>>4	byte		0x0a		\b, at least v1.0 to extract
715>>>4	byte		0x0b		\b, at least v1.1 to extract
716>>>4	byte		0x14		\b, at least v2.0 to extract
717>>>4	byte		0x2d		\b, at least v3.0 to extract
718>>>0x161	string		WINZIP		\b, WinZIP self-extracting
719
720# StarView Metafile
721# From Pierre Ducroquet <pinaraf@pinaraf.info>
7220	string	VCLMTF	StarView MetaFile
723>6	beshort	x	\b, version %d
724>8	belong	x	\b, size %d
725
726# Zoo archiver
72720	lelong		0xfdc4a7dc	Zoo archive data
728!:mime	application/x-zoo
729>4	byte		>48		\b, v%c.
730>>6	byte		>47		\b%c
731>>>7	byte		>47		\b%c
732>32	byte		>0		\b, modify: v%d
733>>33	byte		x		\b.%d+
734>42	lelong		0xfdc4a7dc	\b,
735>>70	byte		>0		extract: v%d
736>>>71	byte		x		\b.%d+
737
738# Shell archives
73910	string		#\ This\ is\ a\ shell\ archive	shell archive text
740!:mime	application/octet-stream
741
742#
743# LBR. NB: May conflict with the questionable
744#          "binary Computer Graphics Metafile" format.
745#
7460       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
747#
748# PMA (CP/M derivative of LHA)
749#
7502       string          -pm0-           PMarc archive data [pm0]
7512       string          -pm1-           PMarc archive data [pm1]
7522       string          -pm2-           PMarc archive data [pm2]
7532       string          -pms-           PMarc SFX archive (CP/M, DOS)
7545       string          -pc1-           PopCom compressed executable (CP/M)
755
756# From Rafael Laboissiere <rafael@laboissiere.net>
757# The Project Revision Control System (see
758# http://prcs.sourceforge.net) generates a packaged project
759# file which is recognized by the following entry:
7600	leshort		0xeb81	PRCS packaged project
761
762# Microsoft cabinets
763# by David Necas (Yeti) <yeti@physics.muni.cz>
764#0	string	MSCF\0\0\0\0	Microsoft cabinet file data,
765#>25	byte	x		v%d
766#>24	byte	x		\b.%d
767# MPi: All CABs have version 1.3, so this is pointless.
768# Better magic in debian-additions.
769
770# GTKtalog catalogs
771# by David Necas (Yeti) <yeti@physics.muni.cz>
7724	string	gtktalog\ 	GTKtalog catalog data,
773>13	string	3		version 3
774>>14	beshort	0x677a		(gzipped)
775>>14	beshort	!0x677a		(not gzipped)
776>13	string	>3		version %s
777
778############################################################################
779# Parity archive reconstruction file, the 'par' file format now used on Usenet.
7800       string          PAR\0	PARity archive data
781>48	leshort		=0	- Index file
782>48	leshort		>0	- file number %d
783
784# Felix von Leitner <felix-file@fefe.de>
7850	string	d8:announce	BitTorrent file
786!:mime	application/x-bittorrent
787
788# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
7890	beshort 0x0e0f		Atari MSA archive data
790>2	beshort x		\b, %d sectors per track
791>4	beshort 0		\b, 1 sided
792>4	beshort 1		\b, 2 sided
793>6	beshort x		\b, starting track: %d
794>8	beshort x		\b, ending track: %d
795
796# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
7970	string	PK00PK\003\004	Zip archive data
798
799# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
800# by Stefan `Sec` Zehl <sec@42.org>
8017	string		**ACE**		ACE archive data
802>15	byte	>0		version %d
803>16	byte	=0x00		\b, from MS-DOS
804>16	byte	=0x01		\b, from OS/2
805>16	byte	=0x02		\b, from Win/32
806>16	byte	=0x03		\b, from Unix
807>16	byte	=0x04		\b, from MacOS
808>16	byte	=0x05		\b, from WinNT
809>16	byte	=0x06		\b, from Primos
810>16	byte	=0x07		\b, from AppleGS
811>16	byte	=0x08		\b, from Atari
812>16	byte	=0x09		\b, from Vax/VMS
813>16	byte	=0x0A		\b, from Amiga
814>16	byte	=0x0B		\b, from Next
815>14	byte	x		\b, version %d to extract
816>5	leshort &0x0080		\b, multiple volumes,
817>>17	byte	x		\b (part %d),
818>5	leshort &0x0002		\b, contains comment
819>5	leshort	&0x0200		\b, sfx
820>5	leshort	&0x0400		\b, small dictionary
821>5	leshort	&0x0800		\b, multi-volume
822>5	leshort	&0x1000		\b, contains AV-String
823>>30	string	\x16*UNREGISTERED\x20VERSION*	(unregistered)
824>5	leshort &0x2000		\b, with recovery record
825>5	leshort &0x4000		\b, locked
826>5	leshort &0x8000		\b, solid
827# Date in MS-DOS format (whatever that is)
828#>18	lelong	x		Created on
829
830# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
831# <doj@cubic.org>
8320x1A	string	sfArk		sfArk compressed Soundfont
833>0x15	string	2
834>>0x1	string	>\0		Version %s
835>>0x2A	string	>\0		: %s
836
837# DR-DOS 7.03 Packed File *.??_
8380	string	Packed\ File\ 	Personal NetWare Packed File
839>12	string	x		\b, was "%.12s"
840
841# EET archive
842# From: Tilman Sauerbeck <tilman@code-monkey.de>
8430	belong	0x1ee7ff00	EET archive
844!:mime	application/x-eet
845
846# rzip archives
8470	string	RZIP		rzip compressed data
848>4	byte	x		- version %d
849>5	byte	x		\b.%d
850>6	belong	x		(%d bytes)
851
852# From: "Robert Dale" <robdale@gmail.com>
8530	belong	123		dar archive,
854>4	belong	x		label "%.8x
855>>8	belong	x		%.8x
856>>>12	beshort	x		%.4x"
857>14	byte	0x54		end slice
858>14	beshort	0x4e4e		multi-part
859>14	beshort	0x4e53		multi-part, with -S
860
861# Symbian installation files
862#  http://www.thouky.co.uk/software/psifs/sis.html
863#  http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
8648	lelong	0x10000419	Symbian installation file
865!:mime	application/vnd.symbian.install
866>4	lelong	0x1000006D	(EPOC release 3/4/5)
867>4	lelong	0x10003A12	(EPOC release 6)
8680	lelong	0x10201A7A	Symbian installation file (Symbian OS 9.x)
869!:mime	x-epoc/x-sisx-app
870
871# From "Nelson A. de Oliveira" <naoliv@gmail.com>
8720	string	MPQ\032		MoPaQ (MPQ) archive
873
874# From: Dirk Jagdmann <doj@cubic.org>
875# xar archive format: http://code.google.com/p/xar/
8760	string	xar!		xar archive
877>6	beshort	x		- version %d
878
879# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
880# .kgb
8810	string KGB_arch		KGB Archiver file
882>10	string x		with compression level %.1s
883
884# xar (eXtensible ARchiver) archive
885# From: "David Remahl" <dremahl@apple.com>
8860	string	xar!		xar archive
887#>4	beshort	x		header size %d
888>6	beshort	x		version %d,
889#>8	quad	x		compressed TOC: %d,
890#>16	quad	x		uncompressed TOC: %d,
891>24	belong	0		no checksum
892>24	belong	1		SHA-1 checksum
893>24	belong	2		MD5 checksum
894
895# Type: Parity Archive
896# From: Daniel van Eeden <daniel_e@dds.nl>
8970	string	PAR2		Parity Archive Volume Set
898
899# Bacula volume format. (Volumes always start with a block header.)
900# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
901# From: Adam Buchbinder <adam.buchbinder@gmail.com>
90212	string	BB02		Bacula volume
903>20	bedate	x		\b, started %s
904
905# ePub is XHTML + XML inside a ZIP archive.  The first member of the
906#   archive must be an uncompressed file called 'mimetype' with contents
907#   'application/epub+zip'
908
909
910# From: "Michael Gorny" <mgorny@gentoo.org>
911# ZPAQ: http://mattmahoney.net/dc/zpaq.html
9120	string	zPQ	ZPAQ stream
913>3	byte	x	\b, level %d
914
915# BBeB ebook, unencrypted (LRF format)
916# URL: http://www.sven.de/librie/Librie/LrfFormat
917# From: Adam Buchbinder <adam.buchbinder@gmail.com>
9180	string	L\0R\0F\0\0\0	BBeB ebook data, unencrypted
919>8	beshort	x		\b, version %d
920>36	byte	1		\b, front-to-back
921>36	byte	16		\b, back-to-front
922>42	beshort	x		\b, (%dx,
923>44	beshort	x		%d)
924
925# Symantec GHOST image by Joerg Jenderek at May 2014
926# http://us.norton.com/ghost/
927# http://www.garykessler.net/library/file_sigs.html
9280		ubelong&0xFFFFf7f0	0xFEEF0100	Norton GHost image
929# *.GHO
930>2		ubyte&0x08		0x00		\b, first file
931# *.GHS or *.[0-9] with cns program option
932>2		ubyte&0x08		0x08		\b, split file
933# part of split index interesting for *.ghs
934>>4		ubyte			x		id=0x%x
935# compression tag minus one equals numeric compression command line switch z[1-9]
936>3		ubyte			0		\b, no compression
937>3		ubyte			2		\b, fast compression (Z1)
938>3		ubyte			3		\b, medium compression (Z2)
939>3		ubyte			>3
940>>3		ubyte			<11		\b, compression (Z%d-1)
941>2		ubyte&0x08		0x00
942# ~ 30 byte password field only for *.gho
943>>12		ubequad			!0		\b, password protected
944>>44		ubyte			!1
945# 1~Image All, sector-by-sector only for *.gho
946>>>10		ubyte			1		\b, sector copy
947# 1~Image Boot track only for *.gho
948>>>43		ubyte			1		\b, boot track
949# 1~Image Disc only for *.gho implies Image Boot track and sector copy
950>>44		ubyte			1		\b, disc sector copy
951# optional image description only *.gho
952>>0xff		string			>\0		"%-.254s"
953# look for DOS sector end sequence
954>0xE08	search/7776		\x55\xAA
955>>&-512	indirect		x		\b; contains
956
957