1 2#------------------------------------------------------------------------------ 3# $File: macintosh,v 1.23 2013/11/19 18:47:58 christos Exp $ 4# macintosh description 5# 6# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 7# Daniel Quinlan, quinlan@yggdrasil.com 811 string must\ be\ converted\ with\ BinHex BinHex binary text 9!:mime application/mac-binhex40 10>41 string x \b, version %.3s 11 12# Stuffit archives are the de facto standard of compression for Macintosh 13# files obtained from most archives. (franklsm@tuns.ca) 140 string SIT! StuffIt Archive (data) 15!:mime application/x-stuffit 16!:apple SIT!SIT! 17>2 string x : %s 180 string SITD StuffIt Deluxe (data) 19>2 string x : %s 200 string Seg StuffIt Deluxe Segment (data) 21>2 string x : %s 22 23# Newer StuffIt archives (grant@netbsd.org) 240 string StuffIt StuffIt Archive 25!:mime application/x-stuffit 26!:apple SIT!SIT! 27#>162 string >0 : %s 28 29# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 30# GRR: Too weak 31#0 string APPL Macintosh Application (data) 32#>2 string x \b: %s 33 34# Macintosh System files (franklsm@tuns.ca) 35# GRR: Too weak 36#0 string zsys Macintosh System File (data) 37#0 string FNDR Macintosh Finder (data) 38#0 string libr Macintosh Library (data) 39#>2 string x : %s 40#0 string shlb Macintosh Shared Library (data) 41#>2 string x : %s 42#0 string cdev Macintosh Control Panel (data) 43#>2 string x : %s 44#0 string INIT Macintosh Extension (data) 45#>2 string x : %s 46#0 string FFIL Macintosh Truetype Font (data) 47#>2 string x : %s 48#0 string LWFN Macintosh Postscript Font (data) 49#>2 string x : %s 50 51# Additional Macintosh Files (franklsm@tuns.ca) 52# GRR: Too weak 53#0 string PACT Macintosh Compact Pro Archive (data) 54#>2 string x : %s 55#0 string ttro Macintosh TeachText File (data) 56#>2 string x : %s 57#0 string TEXT Macintosh TeachText File (data) 58#>2 string x : %s 59#0 string PDF Macintosh PDF File (data) 60#>2 string x : %s 61 62# MacBinary format (Eric Fischer, enf@pobox.com) 63# 64# Unfortunately MacBinary doesn't really have a magic number prior 65# to the MacBinary III format. The checksum is really the way to 66# do it, but the magic file format isn't up to the challenge. 67# 68# 0 byte 0 69# 1 byte # filename length 70# 2 string # filename 71# 65 string # file type 72# 69 string # file creator 73# 73 byte # Finder flags 74# 74 byte 0 75# 75 beshort # vertical posn in window 76# 77 beshort # horiz posn in window 77# 79 beshort # window or folder ID 78# 81 byte # protected? 79# 82 byte 0 80# 83 belong # length of data segment 81# 87 belong # length of resource segment 82# 91 belong # file creation date 83# 95 belong # file modification date 84# 99 beshort # length of comment after resource 85# 101 byte # new Finder flags 86# 102 string mBIN # (only in MacBinary III) 87# 106 byte # char. code of file name 88# 107 byte # still more Finder flags 89# 116 belong # total file length 90# 120 beshort # length of add'l header 91# 122 byte 129 # for MacBinary II 92# 122 byte 130 # for MacBinary III 93# 123 byte 129 # minimum version that can read fmt 94# 124 beshort # checksum 95# 96# This attempts to use the version numbers as a magic number, requiring 97# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second 98# be 0x81. This works for the files I have, but maybe not for everyone's. 99 100# Unfortunately, this magic is quite weak - MPi 101#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data 102 103# MacBinary I doesn't have the version number field at all, but MacBinary II 104# has been in use since 1987 so I hope there aren't many really old files 105# floating around that this will miss. The original spec calls for using 106# the nulls in 0, 74, and 82 as the magic number. 107# 108# Another possibility, that would also work for MacBinary I, is to use 109# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will 110# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, 111# and that 74 will be 0. So something like 112# 113# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data 114# 115# >73 byte&0x01 0x01 \b, inited 116# >73 byte&0x02 0x02 \b, changed 117# >73 byte&0x04 0x04 \b, busy 118# >73 byte&0x08 0x08 \b, bozo 119# >73 byte&0x10 0x10 \b, system 120# >73 byte&0x10 0x20 \b, bundle 121# >73 byte&0x10 0x40 \b, invisible 122# >73 byte&0x10 0x80 \b, locked 123 124#>65 string x \b, type "%4.4s" 125 126#>65 string 8BIM (PhotoShop) 127#>65 string ALB3 (PageMaker 3) 128#>65 string ALB4 (PageMaker 4) 129#>65 string ALT3 (PageMaker 3) 130#>65 string APPL (application) 131#>65 string AWWP (AppleWorks word processor) 132#>65 string CIRC (simulated circuit) 133#>65 string DRWG (MacDraw) 134#>65 string EPSF (Encapsulated PostScript) 135#>65 string FFIL (font suitcase) 136#>65 string FKEY (function key) 137#>65 string FNDR (Macintosh Finder) 138#>65 string GIFf (GIF image) 139#>65 string Gzip (GNU gzip) 140#>65 string INIT (system extension) 141#>65 string LIB\ (library) 142#>65 string LWFN (PostScript font) 143#>65 string MSBC (Microsoft BASIC) 144#>65 string PACT (Compact Pro archive) 145#>65 string PDF\ (Portable Document Format) 146#>65 string PICT (picture) 147#>65 string PNTG (MacPaint picture) 148#>65 string PREF (preferences) 149#>65 string PROJ (Think C project) 150#>65 string QPRJ (Think Pascal project) 151#>65 string SCFL (Defender scores) 152#>65 string SCRN (startup screen) 153#>65 string SITD (StuffIt Deluxe) 154#>65 string SPn3 (SuperPaint) 155#>65 string STAK (HyperCard stack) 156#>65 string Seg\ (StuffIt segment) 157#>65 string TARF (Unix tar archive) 158#>65 string TEXT (ASCII) 159#>65 string TIFF (TIFF image) 160#>65 string TOVF (Eudora table of contents) 161#>65 string WDBN (Microsoft Word word processor) 162#>65 string WORD (MacWrite word processor) 163#>65 string XLS\ (Microsoft Excel) 164#>65 string ZIVM (compress (.Z)) 165#>65 string ZSYS (Pre-System 7 system file) 166#>65 string acf3 (Aldus FreeHand) 167#>65 string cdev (control panel) 168#>65 string dfil (Desk Acessory suitcase) 169#>65 string libr (library) 170#>65 string nX^d (WriteNow word processor) 171#>65 string nX^w (WriteNow dictionary) 172#>65 string rsrc (resource) 173#>65 string scbk (Scrapbook) 174#>65 string shlb (shared library) 175#>65 string ttro (SimpleText read-only) 176#>65 string zsys (system file) 177 178#>69 string x \b, creator "%4.4s" 179 180# Somewhere, Apple has a repository of registered Creator IDs. These are 181# just the ones that I happened to have files from and was able to identify. 182 183#>69 string 8BIM (Adobe Photoshop) 184#>69 string ALD3 (PageMaker 3) 185#>69 string ALD4 (PageMaker 4) 186#>69 string ALFA (Alpha editor) 187#>69 string APLS (Apple Scanner) 188#>69 string APSC (Apple Scanner) 189#>69 string BRKL (Brickles) 190#>69 string BTFT (BitFont) 191#>69 string CCL2 (Common Lisp 2) 192#>69 string CCL\ (Common Lisp) 193#>69 string CDmo (The Talking Moose) 194#>69 string CPCT (Compact Pro) 195#>69 string CSOm (Eudora) 196#>69 string DMOV (Font/DA Mover) 197#>69 string DSIM (DigSim) 198#>69 string EDIT (Macintosh Edit) 199#>69 string ERIK (Macintosh Finder) 200#>69 string EXTR (self-extracting archive) 201#>69 string Gzip (GNU gzip) 202#>69 string KAHL (Think C) 203#>69 string LWFU (LaserWriter Utility) 204#>69 string LZIV (compress) 205#>69 string MACA (MacWrite) 206#>69 string MACS (Macintosh operating system) 207#>69 string MAcK (MacKnowledge terminal emulator) 208#>69 string MLND (Defender) 209#>69 string MPNT (MacPaint) 210#>69 string MSBB (Microsoft BASIC (binary)) 211#>69 string MSWD (Microsoft Word) 212#>69 string NCSA (NCSA Telnet) 213#>69 string PJMM (Think Pascal) 214#>69 string PSAL (Hunt the Wumpus) 215#>69 string PSI2 (Apple File Exchange) 216#>69 string R*ch (BBEdit) 217#>69 string RMKR (Resource Maker) 218#>69 string RSED (Resource Editor) 219#>69 string Rich (BBEdit) 220#>69 string SIT! (StuffIt) 221#>69 string SPNT (SuperPaint) 222#>69 string Unix (NeXT Mac filesystem) 223#>69 string VIM! (Vim editor) 224#>69 string WILD (HyperCard) 225#>69 string XCEL (Microsoft Excel) 226#>69 string aCa2 (Fontographer) 227#>69 string aca3 (Aldus FreeHand) 228#>69 string dosa (Macintosh MS-DOS file system) 229#>69 string movr (Font/DA Mover) 230#>69 string nX^n (WriteNow) 231#>69 string pdos (Apple ProDOS file system) 232#>69 string scbk (Scrapbook) 233#>69 string ttxt (SimpleText) 234#>69 string ufox (Foreign File Access) 235 236# Just in case... 237 238102 string mBIN MacBinary III data with surprising version number 239 240# sas magic from Bruce Foster (bef@nwu.edu) 241# 242#0 string SAS SAS 243#>8 string x %s 2440 string SAS SAS 245>24 string DATA data file 246>24 string CATALOG catalog 247>24 string INDEX data file index 248>24 string VIEW data view 249# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 250# 2510x54 string SAS SAS 7+ 252>0x9C string DATA data file 253>0x9C string CATALOG catalog 254>0x9C string INDEX data file index 255>0x9C string VIEW data view 256 257# spss magic for SPSS system and portable files, 258# from Bruce Foster (bef@nwu.edu). 259 2600 long 0xc1e2c3c9 SPSS Portable File 261>40 string x %s 262 2630 string $FL2 SPSS System File 264>24 string x %s 265 2660 string $FL3 SPSS System File 267>24 string x %s 268 269# Macintosh filesystem data 270# From "Tom N Harris" <telliamed@mac.com> 271# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 272# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 273# entries depend on the data arithmetic added after v.35 274# There's also some Pascal strings in here, ditto... 275 276# The boot block signature, according to IM:Files, is 277# "for HFS volumes, this field always contains the value 0x4C4B." 278# But if this is true for MFS or HFS+ volumes, I don't know. 279# Alternatively, the boot block is supposed to be zeroed if it's 280# unused, so a simply >0 should suffice. 281 2820x400 beshort 0xD2D7 Macintosh MFS data 283>0 beshort 0x4C4B (bootable) 284>0x40a beshort &0x8000 (locked) 285>0x402 beldate-0x7C25B080 x created: %s, 286>0x406 beldate-0x7C25B080 >0 last backup: %s, 287>0x414 belong x block size: %d, 288>0x412 beshort x number of blocks: %d, 289>0x424 pstring x volume name: %s 290 291# "BD" gives many false positives 292#0x400 beshort 0x4244 Macintosh HFS data 293#>0 beshort 0x4C4B (bootable) 294#>0x40a beshort &0x8000 (locked) 295#>0x40a beshort ^0x0100 (mounted) 296#>0x40a beshort &0x0200 (spared blocks) 297#>0x40a beshort &0x0800 (unclean) 298#>0x47C beshort 0x482B (Embedded HFS+ Volume) 299#>0x402 beldate-0x7C25B080 x created: %s, 300#>0x406 beldate-0x7C25B080 x last modified: %s, 301#>0x440 beldate-0x7C25B080 >0 last backup: %s, 302#>0x414 belong x block size: %d, 303#>0x412 beshort x number of blocks: %d, 304#>0x424 pstring x volume name: %s 305 3060x400 beshort 0x482B Macintosh HFS Extended 307>&0 beshort x version %d data 308>0 beshort 0x4C4B (bootable) 309>0x404 belong ^0x00000100 (mounted) 310>&2 belong &0x00000200 (spared blocks) 311>&2 belong &0x00000800 (unclean) 312>&2 belong &0x00008000 (locked) 313>&6 string x last mounted by: '%.4s', 314# really, that should be treated as a belong and we print a string 315# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 316>&14 beldate-0x7C25B080 x created: %s, 317# only the creation date is local time, all other timestamps in HFS+ are UTC. 318>&18 bedate-0x7C25B080 x last modified: %s, 319>&22 bedate-0x7C25B080 >0 last backup: %s, 320>&26 bedate-0x7C25B080 >0 last checked: %s, 321>&38 belong x block size: %d, 322>&42 belong x number of blocks: %d, 323>&46 belong x free blocks: %d 324 325# I don't think this is really necessary since it doesn't do much and 326# anything with a valid driver descriptor will also have a valid 327# partition map 328#0 beshort 0x4552 Apple Device Driver data 329#>&24 beshort =1 \b, MacOS 330 331# Is that the partition type a cstring or a pstring? Well, IM says "strings 332# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a 333# cstring. Of course, partitions can contain more than four entries, but 334# what're you gonna do? 335# GRR: This magic is too weak, it is just "PM" 336#0x200 beshort 0x504D Apple Partition data 337#>0x2 beshort x (block size: %d): 338#>0x230 string x first type: %s, 339#>0x210 string x name: %s, 340#>0x254 belong x number of blocks: %d, 341#>0x400 beshort 0x504D 342#>>0x430 string x second type: %s, 343#>>0x410 string x name: %s, 344#>>0x454 belong x number of blocks: %d, 345#>>0x600 beshort 0x504D 346#>>>0x630 string x third type: %s, 347#>>>0x610 string x name: %s, 348#>>>0x654 belong x number of blocks: %d, 349#>>0x800 beshort 0x504D 350#>>>0x830 string x fourth type: %s, 351#>>>0x810 string x name: %s, 352#>>>0x854 belong x number of blocks: %d, 353#>>>0xa00 beshort 0x504D 354#>>>>0xa30 string x fifth type: %s, 355#>>>>0xa10 string x name: %s, 356#>>>>0xa54 belong x number of blocks: %d 357#>>>0xc00 beshort 0x504D 358#>>>>0xc30 string x sixth type: %s, 359#>>>>0xc10 string x name: %s, 360#>>>>0xc54 belong x number of blocks: %d 361## AFAIK, only the signature is different 362#0x200 beshort 0x5453 Apple Old Partition data 363#>0x2 beshort x block size: %d, 364#>0x230 string x first type: %s, 365#>0x210 string x name: %s, 366#>0x254 belong x number of blocks: %d, 367#>0x400 beshort 0x504D 368#>>0x430 string x second type: %s, 369#>>0x410 string x name: %s, 370#>>0x454 belong x number of blocks: %d, 371#>>0x800 beshort 0x504D 372#>>>0x830 string x third type: %s, 373#>>>0x810 string x name: %s, 374#>>>0x854 belong x number of blocks: %d, 375#>>>0xa00 beshort 0x504D 376#>>>>0xa30 string x fourth type: %s, 377#>>>>0xa10 string x name: %s, 378#>>>>0xa54 belong x number of blocks: %d 379 380# From: Remi Mommsen <mommsen@slac.stanford.edu> 3810 string BOMStore Mac OS X bill of materials (BOM) file 382 383# From: Adam Buchbinder <adam.buchbinder@gmail.com> 384# URL: http://en.wikipedia.org/wiki/Datafork_TrueType 385# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 386# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 387# don't know what they mean. 3880 belong 0x100 389>(0x4.L+24) beshort x 390>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 391>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 392>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 393>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 394