1 2#------------------------------------------------------------------------------ 3# $File: macintosh,v 1.36 2022/12/06 18:45:20 christos Exp $ 4# macintosh description 5# 6# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 7# Daniel Quinlan, quinlan@yggdrasil.com 8# Update: Joerg Jenderek 9# URL: https://en.wikipedia.org/wiki/BinHex 10# Reference: http://fileformats.archiveteam.org/wiki/BinHex 11# Note: only tested with version 4.0 and hqx extension 12# Any text/binary before the characteristic comment sentence is to be ignored like in 13# http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx 140 search/1602 (This\ file\ 15>&0 use binhex 16# http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx 170 search/2652/b (This\ file\ 18>&0 use binhex 190 name binhex 20# keep split search string format similar like in version 5.37 21>0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version 22# http://www.macdisk.com/binhexen.php3 23!:apple BNHQTEXT 24# http://www.faqs.org/faqs/macintosh/comm-faq/part1/ 25>>&0 string 1.0 1.0 26!:mime application/mac-binhex 27!:ext hex 28>>&0 string 2.0 2.0 29!:mime application/mac-binhex 30!:ext hcx 31# BinHex 3.0 never existed 32>>&0 string 4.0 4.0 33!:mime application/mac-binhex40 34!:ext hqx 35# BinHex 5.0 also MacBinary I 36>>&0 string 5.0 5.0 37!:mime application/mac-binhex40 38!:ext hqx 39# this should never happen 40>>&0 default x 41>>>&0 string x %.3s 42!:mime application/mac-binhex 43!:ext hqx 44 45# Stuffit archives are the de facto standard of compression for Macintosh 46# files obtained from most archives. (franklsm@tuns.ca) 470 string SIT! StuffIt Archive (data) 48!:mime application/x-stuffit 49!:apple SIT!SIT! 50>2 string x : %s 510 string SITD StuffIt Deluxe (data) 52>2 string x : %s 530 string Seg StuffIt Deluxe Segment (data) 54>2 string x : %s 55 56# Newer StuffIt archives (grant@netbsd.org) 570 string StuffIt StuffIt Archive 58!:mime application/x-stuffit 59!:apple SIT!SIT! 60#>162 string >0 : %s 61 62# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 63# GRR: Too weak 64#0 string APPL Macintosh Application (data) 65#>2 string x \b: %s 66 67# Macintosh System files (franklsm@tuns.ca) 68# GRR: Too weak 69#0 string zsys Macintosh System File (data) 70#0 string FNDR Macintosh Finder (data) 71#0 string libr Macintosh Library (data) 72#>2 string x : %s 73#0 string shlb Macintosh Shared Library (data) 74#>2 string x : %s 75#0 string cdev Macintosh Control Panel (data) 76#>2 string x : %s 77#0 string INIT Macintosh Extension (data) 78#>2 string x : %s 79#0 string FFIL Macintosh Truetype Font (data) 80#>2 string x : %s 81#0 string LWFN Macintosh Postscript Font (data) 82#>2 string x : %s 83 84# Additional Macintosh Files (franklsm@tuns.ca) 85# GRR: Too weak 86#0 string PACT Macintosh Compact Pro Archive (data) 87#>2 string x : %s 88#0 string ttro Macintosh TeachText File (data) 89#>2 string x : %s 90#0 string TEXT Macintosh TeachText File (data) 91#>2 string x : %s 92#0 string PDF Macintosh PDF File (data) 93#>2 string x : %s 94 95# MacBinary format (Eric Fischer, enf@pobox.com) 96# Update: Joerg Jenderek 97# URL: https://en.wikipedia.org/wiki/MacBinary 98# http://fileformats.archiveteam.org/wiki/MacBinary 99# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt 100# Note: verified by macutils `macunpack -i -v BBEdit4.0.sit.bin` and 101# `deark -l -d -m macbinary G3FirmwareUpdate1.1.smi.bin` 102# 103# Unfortunately MacBinary doesn't really have a magic number prior 104# to the MacBinary III format. 105# 106 107# old version number, must be kept at zero for compatibility 1080 byte 0 109# length of filename (must be in the range 1-63) 110>1 ubyte >0 111# skip T.PIC.LZ INSTRUMENT.7T INVENTORY 112>>1 ubyte <64 113# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)" 114# by looking for printable characters at beginning of file name 115>>>2 ubelong >0x1F000000 116# zero fill, must be zero for compatibility 117>>>>74 byte 0 118# zero fill, must be zero for compatibility 119>>>>>82 byte 0 120# skip few DEGAS mid-res uncompressed bitmap (GEMINI03.PI2 CODE_RAM.PI2) with "too high" file names ffffff88 ffff4f00 121>>>>>>2 ubelong <0xffff0000 122# MacBinary I test for valid version numbers 123>>>>>>>122 ubeshort 0 124# additional check for undefined header fields in MacBinary I 125#>>>>>>>>101 ulong 0 126>>>>>>>>0 use mac-bin 127# MacBinary II the newer versions begins at 129 128>>>>>>>122 ubeshort 0x8181 129>>>>>>>>0 use mac-bin 130# MacBinary III with MacBinary II to read 131>>>>>>122 ubeshort 0x8281 132>>>>>>>0 use mac-bin 133 134# display information of MacBinary file 1350 name mac-bin 136>122 ubyte x MacBinary 137# versions for MacBinary II/III 138>122 ubyte 129 II 139>122 ubyte 130 III 140# only in MacBinary III 141>>102 string !mBIN with surprising version 142!:mime application/x-macbinary 143!:apple PSPTBINA 144!:ext bin/macbin 145# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidentified as MacBinary 146#>1 ubyte >63 \b, name length %u too BIG! 147#>122 ubeshort x \b, version %#x 148# Finder flags if not 0 149# >73 byte !0 \b, flags 0x 150# >73 byte =0 151# >>101 byte !0 \b, flags 0x 152# # original Finder flags (Bits 8-15) 153# >73 byte !0 \b%x 154# # finder flags, bits 0-7 155# >101 byte !0 \b%x 156>73 byte &0x01 \b, inited 157>73 byte &0x02 \b, changed 158>73 byte &0x04 \b, busy 159>73 byte &0x08 \b, bozo 160>73 byte &0x10 \b, system 161>73 byte &0x20 \b, bundle 162>73 byte &0x40 \b, invisible 163>73 byte &0x80 \b, locked 164 165# 75 beshort # vertical posn in window 166#>75 beshort !0 \b, v.pos %u 167# 77 beshort # horiz posn in window 168#>77 beshort !0 \b, h.pos %u 169# 79 beshort # window or folder ID 170>79 ubeshort !0 \b, ID %#x 171# protected flag 172>81 byte !0 \b, protected %#x 173# length of comment after resource 174>99 ubeshort !0 \b, comment length %u 175# char. code of file name 176>106 ubyte !0 \b, char. code %#x 177# still more Finder flags 178>107 ubyte !0 \b, more flags %#x 179# length of total files when unpacked only used when pack and unpack on the fly 180>116 ubelong !0 \b, total length %u 181# 120 beshort # length of add'l header 182>120 ubeshort !0 \b, 2nd header length %u 183# 124 beshort # checksum 184#>124 ubeshort !0 \b, CRC %#x 185# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080 186# few (31/1247) examples (hinkC4.0.sitx.bin InternetExplorer5.1.smi.bin G3FirmwareUpdate1.1.smi.bin Firewire2.3.3.smi.bin LR2image.bin) contain zeroed date fields 187>91 long !0 188>>91 beldate-0x7C25B080 x \b, %s 189# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidentified or time overflow 190>91 ubelong <0x7c25b080 INVALID date 191# reported date seconds by deark 192#>91 ubelong x deark-DATE=%u 193# last modified date 194>95 long !0 195>>95 beldate-0x7C25B080 x \b, modified %s 196# Apple creator+typ if not null 197# file creator (normally expressed as four characters) 198>69 ulong !0 \b, creator 199# instead 4 character code display full creator name 200>>69 use apple-creator 201# file type (normally expressed as four characters) 202>65 ulong !0 \b, type 203>>65 use apple-type 204# length of data segment 205>83 ubelong !0 \b, %u bytes 206# filename (in the range 1-63) 207# like "BBEdit4.0.sit" "Archive.sitx" "MacPGP 2.2 (.sea)" 208>1 pstring x "%s" 209# print 1 space and then at offset 128 inspect data fork content if it has one 210>83 ubelong !0 \b 211>>128 indirect x 212# Afterwards resource fork if length of resource segment not zero 213>87 ubelong !0 214# calculate resource fork offset 215>>83 ubelong+128 x \b, at %#x 216# length of resource segment 217>>87 ubelong !0 %u bytes 218>>(83.S+128) ubequad x resource 219# further resource fork content inspection 220>>>&-8 indirect x 221 222# Apple Type/Creator Database 223# URL: https://en.wikipedia.org/wiki/Type_code 224# Reference: https://www.lacikam.co.il/tcdb/ 225# https://www.macdisk.com/macsigen.php 226# Note: classic Mac OS files have two 4 character codes for type and creator. 227# Thereby the Finder attach documents types to applications. 228 229#>65 string x \b, type "%4.4s" 230 231# display information about apple type 2320 name apple-type 233>0 string 8BIM PhotoShop 234>0 string ALB3 PageMaker 3 235>0 string ALB4 PageMaker 4 236>0 string ALT3 PageMaker 3 237>0 string APPL application 238>0 string AWWP AppleWorks word processor 239>0 string CIRC simulated circuit 240>0 string DRWG MacDraw 241>0 string EPSF Encapsulated PostScript 242>0 string FFIL font suitcase 243>0 string FKEY function key 244>0 string FNDR Macintosh Finder 245>0 string GIFf GIF image 246>0 string Gzip GNU gzip 247>0 string INIT system extension 248>0 string LIB\ library 249>0 string LWFN PostScript font 250>0 string MSBC Microsoft BASIC 251>0 string PACT Compact Pro archive 252>0 string PDF\ Portable Document Format 253>0 string PICT picture 254>0 string PNTG MacPaint picture 255>0 string PREF preferences 256>0 string PROJ Think C project 257>0 string QPRJ Think Pascal project 258>0 string SCFL Defender scores 259>0 string SCRN startup screen 260>0 string SITD StuffIt Deluxe 261>0 string SPn3 SuperPaint 262>0 string STAK HyperCard stack 263>0 string Seg\ StuffIt segment 264>0 string TARF Unix tar archive 265>0 string TEXT ASCII 266>0 string TIFF TIFF image 267>0 string TOVF Eudora table of contents 268>0 string WDBN Microsoft Word word processor 269>0 string WORD MacWrite word processor 270>0 string XLS\ Microsoft Excel 271>0 string ZIVM compress (.Z) 272>0 string ZSYS Pre-System 7 system file 273>0 string acf3 Aldus FreeHand 274>0 string cdev control panel 275>0 string dfil Desk Accessory suitcase 276>0 string libr library 277>0 string nX^d WriteNow word processor 278>0 string nX^w WriteNow dictionary 279>0 string rsrc resource 280>0 string scbk Scrapbook 281>0 string shlb shared library 282>0 string ttro SimpleText read-only 283>0 string zsys system file 284 285# additional types added in Dec 2017 286>0 string BINA binary file 287>0 string BMPp BMP image 288>0 string JPEG JPEG image 289#>0 string W4BN Microsoft Word x.y word processor? 290# if type name is not known display 4 character identifier 291>0 default x 292>>0 string x '%4.4s' 293 294#>69 string x \b, creator "%4.4s" 295 296# Now Apple has no repository of registered Creator IDs any more. These are 297# just the ones that I happened to have files from and was able to identify. 298 299# display information about apple creator 3000 name apple-creator 301>0 string 8BIM Adobe Photoshop 302>0 string ALD3 PageMaker 3 303>0 string ALD4 PageMaker 4 304>0 string ALFA Alpha editor 305>0 string APLS Apple Scanner 306>0 string APSC Apple Scanner 307>0 string BRKL Brickles 308>0 string BTFT BitFont 309>0 string CCL2 Common Lisp 2 310>0 string CCL\ Common Lisp 311>0 string CDmo The Talking Moose 312>0 string CPCT Compact Pro 313>0 string CSOm Eudora 314>0 string DMOV Font/DA Mover 315>0 string DSIM DigSim 316>0 string EDIT Macintosh Edit 317>0 string ERIK Macintosh Finder 318>0 string EXTR self-extracting archive 319>0 string Gzip GNU gzip 320>0 string KAHL Think C 321>0 string LWFU LaserWriter Utility 322>0 string LZIV compress 323>0 string MACA MacWrite 324>0 string MACS Macintosh operating system 325>0 string MAcK MacKnowledge terminal emulator 326>0 string MLND Defender 327>0 string MPNT MacPaint 328>0 string MSBB Microsoft BASIC (binary) 329>0 string MSWD Microsoft Word 330>0 string NCSA NCSA Telnet 331>0 string PJMM Think Pascal 332>0 string PSAL Hunt the Wumpus 333#>0 string PSI2 Apple File Exchange 334>0 string R*ch BBEdit 335>0 string RMKR Resource Maker 336>0 string RSED Resource Editor 337>0 string Rich BBEdit 338>0 string SIT! StuffIt 339>0 string SPNT SuperPaint 340>0 string Unix NeXT Mac filesystem 341>0 string VIM! Vim editor 342>0 string WILD HyperCard 343>0 string XCEL Microsoft Excel 344>0 string aCa2 Fontographer 345>0 string aca3 Aldus FreeHand 346>0 string dosa Macintosh MS-DOS file system 347>0 string movr Font/DA Mover 348>0 string nX^n WriteNow 349>0 string pdos Apple ProDOS file system 350>0 string scbk Scrapbook 351>0 string ttxt SimpleText 352>0 string ufox Foreign File Access 353# additional creators added in Dec 2017 354# Claris/Apple Works 355>0 string BOBO Apple Works 356# CU-SeeMe_0.87b3_(68K).bin 357#>0 string CUce bar 358>0 string PSPT Apple File Exchange 359# Disk_Copy_4.2.sea.bin 360#>0 string NCse foo 361# probably StuffIt/Aladdin by Smith Micro Software, Inc. 362>0 string STi0 stuffit 363# MacGzip-1.1.3.sea.bin 364#>0 string aust bar 365# D-Disk_Copy_6.3.3.smi.bin 366>0 string oneb Disk Copy Self Mounting 367# if creator name is not known display 4 character identifier 368>0 default x 369>>0 string x '%4.4s' 370 371# sas magic from Bruce Foster (bef@nwu.edu) 372# 373#0 string SAS SAS 374#>8 string x %s 3750 string SAS SAS 376>24 string DATA data file 377>24 string CATALOG catalog 378>24 string INDEX data file index 379>24 string VIEW data view 380# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 381# 3820x54 string SAS SAS 7+ 383>0x9C string DATA data file 384>0x9C string CATALOG catalog 385>0x9C string INDEX data file index 386>0x9C string VIEW data view 387 388# spss magic for SPSS system and portable files, 389# from Bruce Foster (bef@nwu.edu). 390 3910 long 0xc1e2c3c9 SPSS Portable File 392>40 string x %s 393 3940 string $FL2 SPSS System File 395>24 string x %s 396 3970 string $FL3 SPSS System File 398>24 string x %s 399 400# Macintosh filesystem data 401# From "Tom N Harris" <telliamed@mac.com> 402# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 403# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 404# entries depend on the data arithmetic added after v.35 405# There's also some Pascal strings in here, ditto... 406 407# The boot block signature, according to IM:Files, is 408# "for HFS volumes, this field always contains the value 0x4C4B." 409# But if this is true for MFS or HFS+ volumes, I don't know. 410# Alternatively, the boot block is supposed to be zeroed if it's 411# unused, so a simply >0 should suffice. 412 4130x400 beshort 0xD2D7 Macintosh MFS data 414>0 beshort 0x4C4B (bootable) 415>0x40a beshort &0x8000 (locked) 416>0x402 beldate-0x7C25B080 x created: %s, 417>0x406 beldate-0x7C25B080 >0 last backup: %s, 418>0x414 belong x block size: %d, 419>0x412 beshort x number of blocks: %d, 420>0x424 pstring x volume name: %s 421 422# *.hfs updated by Joerg Jenderek 423# https://en.wikipedia.org/wiki/Hierarchical_File_System 424# "BD" gives many false positives 4250x400 beshort 0x4244 426# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 427# first block of volume bit map (always 3) 428>0x40e ubeshort 0x0003 429# maximal length of volume name is 27 430>>0x424 ubyte <28 Macintosh HFS data 431!:mime application/x-apple-diskimage 432#!:apple hfsdINIT 433#!:apple MACSdisk 434# https://www.macdisk.com/macsigen.php 435#!:apple ddskdevi 436!:apple ????devi 437# https://en.wikipedia.org/wiki/Apple_Disk_Image 438!:ext hfs/dmg 439>>>0 beshort 0x4C4B (bootable) 440#>>>0 beshort 0x0000 (not bootable) 441>>>0x40a beshort &0x8000 (locked) 442>>>0x40a beshort ^0x0100 (mounted) 443>>>0x40a beshort &0x0200 (spared blocks) 444>>>0x40a beshort &0x0800 (unclean) 445>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 446# https://www.epochconverter.com/ 447# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 448# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 449# construct not working 450#>>>0x402 beldate-0x7C25B080 x created: %s, 451#>>>0x406 beldate-0x7C25B080 x last modified: %s, 452#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 453# found block sizes 200h,1200h,2800h 454>>>0x414 belong x block size: %d, 455>>>0x412 beshort x number of blocks: %d, 456>>>0x424 pstring x volume name: %s 457 4580 name hfsplus 459>&0 beshort x version %d data 460>0 beshort 0x4C4B (bootable) 461>0x404 belong ^0x00000100 (mounted) 462>&2 belong &0x00000200 (spared blocks) 463>&2 belong &0x00000800 (unclean) 464>&2 belong &0x00008000 (locked) 465>&6 string x last mounted by: '%.4s', 466# really, that should be treated as a belong and we print a string 467# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 468>&14 beldate-0x7C25B080 x created: %s, 469# only the creation date is local time, all other timestamps in HFS+ are UTC. 470>&18 bedate-0x7C25B080 x last modified: %s, 471>&22 bedate-0x7C25B080 >0 last backup: %s, 472>&26 bedate-0x7C25B080 >0 last checked: %s, 473>&38 belong x block size: %d, 474>&42 belong x number of blocks: %d, 475>&46 belong x free blocks: %d 476 4770x400 beshort 0x482B Apple HFS Plus 478>&0 use hfsplus 4790x400 beshort 0x4858 Apple HFS Plus Extended 480>&0 use hfsplus 481 482## AFAIK, only the signature is different 483# same as Apple Partition Map 484# GRR: This magic is too weak, it is just "TS" 485#0x200 beshort 0x5453 Apple Old Partition data 486#>0x2 beshort x block size: %d, 487#>0x230 string x first type: %s, 488#>0x210 string x name: %s, 489#>0x254 belong x number of blocks: %d, 490#>0x400 beshort 0x504D 491#>>0x430 string x second type: %s, 492#>>0x410 string x name: %s, 493#>>0x454 belong x number of blocks: %d, 494#>>0x800 beshort 0x504D 495#>>>0x830 string x third type: %s, 496#>>>0x810 string x name: %s, 497#>>>0x854 belong x number of blocks: %d, 498#>>>0xa00 beshort 0x504D 499#>>>>0xa30 string x fourth type: %s, 500#>>>>0xa10 string x name: %s, 501#>>>>0xa54 belong x number of blocks: %d 502 503# From: Remi Mommsen <mommsen@slac.stanford.edu> 5040 string BOMStore Mac OS X bill of materials (BOM) file 505 506