1 2#------------------------------------------------------------------------------ 3# $File: macintosh,v 1.30 2019/12/14 20:40:26 christos Exp $ 4# macintosh description 5# 6# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 7# Daniel Quinlan, quinlan@yggdrasil.com 8# Update: Joerg Jenderek 9# URL: https://en.wikipedia.org/wiki/BinHex 10# Reference: http://fileformats.archiveteam.org/wiki/BinHex 11# Note: only tested with version 4.0 and hqx extension 12# Any text/binary before the characteristic comment sentence is to be ignored like in 13# http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx 140 search/1602 (This\ file\ 15>&0 use binhex 16# http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx 170 search/2652/b (This\ file\ 18>&0 use binhex 190 name binhex 20# keep splitted search string format similar like in version 5.37 21>0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version 22# http://www.macdisk.com/binhexen.php3 23!:apple BNHQTEXT 24# http://www.faqs.org/faqs/macintosh/comm-faq/part1/ 25>>&0 string 1.0 1.0 26!:mime application/mac-binhex 27!:ext hex 28>>&0 string 2.0 2.0 29!:mime application/mac-binhex 30!:ext hcx 31# BinHex 3.0 never existed 32>>&0 string 4.0 4.0 33!:mime application/mac-binhex40 34!:ext hqx 35# BinHex 5.0 also MacBinary I 36>>&0 string 5.0 5.0 37!:mime application/mac-binhex40 38!:ext hqx 39# this should never happen 40>>&0 default x 41>>>&0 string x %.3s 42!:mime application/mac-binhex 43!:ext hqx 44 45# Stuffit archives are the de facto standard of compression for Macintosh 46# files obtained from most archives. (franklsm@tuns.ca) 470 string SIT! StuffIt Archive (data) 48!:mime application/x-stuffit 49!:apple SIT!SIT! 50>2 string x : %s 510 string SITD StuffIt Deluxe (data) 52>2 string x : %s 530 string Seg StuffIt Deluxe Segment (data) 54>2 string x : %s 55 56# Newer StuffIt archives (grant@netbsd.org) 570 string StuffIt StuffIt Archive 58!:mime application/x-stuffit 59!:apple SIT!SIT! 60#>162 string >0 : %s 61 62# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 63# GRR: Too weak 64#0 string APPL Macintosh Application (data) 65#>2 string x \b: %s 66 67# Macintosh System files (franklsm@tuns.ca) 68# GRR: Too weak 69#0 string zsys Macintosh System File (data) 70#0 string FNDR Macintosh Finder (data) 71#0 string libr Macintosh Library (data) 72#>2 string x : %s 73#0 string shlb Macintosh Shared Library (data) 74#>2 string x : %s 75#0 string cdev Macintosh Control Panel (data) 76#>2 string x : %s 77#0 string INIT Macintosh Extension (data) 78#>2 string x : %s 79#0 string FFIL Macintosh Truetype Font (data) 80#>2 string x : %s 81#0 string LWFN Macintosh Postscript Font (data) 82#>2 string x : %s 83 84# Additional Macintosh Files (franklsm@tuns.ca) 85# GRR: Too weak 86#0 string PACT Macintosh Compact Pro Archive (data) 87#>2 string x : %s 88#0 string ttro Macintosh TeachText File (data) 89#>2 string x : %s 90#0 string TEXT Macintosh TeachText File (data) 91#>2 string x : %s 92#0 string PDF Macintosh PDF File (data) 93#>2 string x : %s 94 95# MacBinary format (Eric Fischer, enf@pobox.com) 96# Update: Joerg Jenderek 97# URL: https://en.wikipedia.org/wiki/MacBinary 98# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt 99# 100# Unfortunately MacBinary doesn't really have a magic number prior 101# to the MacBinary III format. 102# 103 104# old version number, must be kept at zero for compatibility 1050 byte 0 106# length of filename (must be in the range 1-63) 107>1 ubyte >0 108# skip T.PIC.LZ INSTRUMENT.7T INVENTORY 109>>1 ubyte <64 110# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)" 111# by looking for printable characters at beginning of file name 112>>>2 ubelong >0x1F000000 113# zero fill, must be zero for compatibility 114>>>>74 byte 0 115# zero fill, must be zero for compatibility 116>>>>>82 byte 0 117# MacBinary I test for valid version numbers 118>>>>>>122 ubeshort 0 119# additional check for creation date after 1 Jan 1970 ~ 7C25B080h 120#>>>>>>>91 ubelong >0x7c25b07F 121# additional check for undefined header fields in MacBinary I 122#>>>>>>>101 ulong 0 123>>>>>>>0 use mac-bin 124# MacBinary II the newer versions begins at 129 125>>>>>>122 ubeshort 0x8181 126>>>>>>>0 use mac-bin 127# MacBinary III with MacBinary II to read 128>>>>>122 ubeshort 0x8281 129>>>>>>0 use mac-bin 130 131# display information of MacBinary file 1320 name mac-bin 133>122 ubyte x MacBinary 134# versions for MacBinary II/III 135>122 ubyte 129 II 136>122 ubyte 130 III 137# only in MacBinary III 138>>102 string !mBIN with surprising version 139!:mime application/x-macbinary 140!:apple PSPTBINA 141!:ext bin/macbin 142# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary 143#>1 ubyte >63 \b, name length %u too BIG! 144#>122 ubeshort x \b, version 0x%x 145# Finder flags if not 0 146# >73 byte !0 \b, flags 0x 147# >73 byte =0 148# >>101 byte !0 \b, flags 0x 149# # original Finder flags (Bits 8-15) 150# >73 byte !0 \b%x 151# # finder flags, bits 0-7 152# >101 byte !0 \b%x 153>73 byte &0x01 \b, inited 154>73 byte &0x02 \b, changed 155>73 byte &0x04 \b, busy 156>73 byte &0x08 \b, bozo 157>73 byte &0x10 \b, system 158>73 byte &0x20 \b, bundle 159>73 byte &0x40 \b, invisible 160>73 byte &0x80 \b, locked 161 162# 75 beshort # vertical posn in window 163#>75 beshort !0 \b, v.pos %u 164# 77 beshort # horiz posn in window 165#>77 beshort !0 \b, h.pos %u 166# 79 beshort # window or folder ID 167>79 ubeshort !0 \b, ID 0x%x 168# protected flag 169>81 byte !0 \b, protected 0x%x 170# length of comment after resource 171>99 ubeshort !0 \b, comment length %u 172# char. code of file name 173>106 ubyte !0 \b, char. code 0x%x 174# still more Finder flags 175>107 ubyte !0 \b, more flags 0x%x 176# length of total files when unpacked only used when pack and unpack on the fly 177>116 ubelong !0 \b, total length %u 178# 120 beshort # length of add'l header 179>120 ubeshort !0 \b, 2nd header length %u 180# 124 beshort # checksum 181#>124 ubeshort !0 \b, CRC 0x%x 182# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080 183>91 beldate-0x7C25B080 x \b, %s 184# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow 185>91 ubelong <0x7c25b080 INVALID date 186#>91 belong-0x7C25B080 x \b, DEBUG DATE %d 187# last modified date 188>95 beldate-0x7C25B080 x \b, modified %s 189# Apple creator+typ if not null 190# file creator (normally expressed as four characters) 191>69 ulong !0 \b, creator 192# instead 4 character code display full creator name 193>>69 use apple-creator 194# file type (normally expressed as four characters) 195>65 ulong !0 \b, type 196>>65 use apple-type 197# length of data segment 198>83 ubelong !0 \b, %u bytes 199# filename (in the range 1-63) 200>1 pstring x "%s" 201# print 1 space and then at offset 128 inspect data fork content if it has one 202>83 ubelong !0 \b 203>>128 indirect x 204# Afterwards resource fork if length of resource segment not zero 205>87 ubelong !0 206# calculate resource fork offset 207>>83 ubelong+128 x \b, at 0x%x 208# length of resource segment 209>>87 ubelong !0 %u bytes 210>>(83.S+128) ubequad x resource 211# further resource fork content inspection 212>>>&-8 indirect x 213 214# Apple Type/Creator Database 215# URL: https://en.wikipedia.org/wiki/Type_code 216# Reference: https://www.lacikam.co.il/tcdb/ 217# https://www.macdisk.com/macsigen.php 218# Note: classic Mac OS files have two 4 character codes for type and creator. 219# Thereby the Finder attach documents types to applications. 220 221#>65 string x \b, type "%4.4s" 222 223# display information about apple type 2240 name apple-type 225>0 string 8BIM PhotoShop 226>0 string ALB3 PageMaker 3 227>0 string ALB4 PageMaker 4 228>0 string ALT3 PageMaker 3 229>0 string APPL application 230>0 string AWWP AppleWorks word processor 231>0 string CIRC simulated circuit 232>0 string DRWG MacDraw 233>0 string EPSF Encapsulated PostScript 234>0 string FFIL font suitcase 235>0 string FKEY function key 236>0 string FNDR Macintosh Finder 237>0 string GIFf GIF image 238>0 string Gzip GNU gzip 239>0 string INIT system extension 240>0 string LIB\ library 241>0 string LWFN PostScript font 242>0 string MSBC Microsoft BASIC 243>0 string PACT Compact Pro archive 244>0 string PDF\ Portable Document Format 245>0 string PICT picture 246>0 string PNTG MacPaint picture 247>0 string PREF preferences 248>0 string PROJ Think C project 249>0 string QPRJ Think Pascal project 250>0 string SCFL Defender scores 251>0 string SCRN startup screen 252>0 string SITD StuffIt Deluxe 253>0 string SPn3 SuperPaint 254>0 string STAK HyperCard stack 255>0 string Seg\ StuffIt segment 256>0 string TARF Unix tar archive 257>0 string TEXT ASCII 258>0 string TIFF TIFF image 259>0 string TOVF Eudora table of contents 260>0 string WDBN Microsoft Word word processor 261>0 string WORD MacWrite word processor 262>0 string XLS\ Microsoft Excel 263>0 string ZIVM compress (.Z) 264>0 string ZSYS Pre-System 7 system file 265>0 string acf3 Aldus FreeHand 266>0 string cdev control panel 267>0 string dfil Desk Accessory suitcase 268>0 string libr library 269>0 string nX^d WriteNow word processor 270>0 string nX^w WriteNow dictionary 271>0 string rsrc resource 272>0 string scbk Scrapbook 273>0 string shlb shared library 274>0 string ttro SimpleText read-only 275>0 string zsys system file 276 277# additional types added in Dec 2017 278>0 string BINA binary file 279>0 string BMPp BMP image 280>0 string JPEG JPEG image 281#>0 string W4BN Microsoft Word x.y word processor? 282# if type name is not known display 4 character identifier 283>0 default x 284>>0 string x '%4.4s' 285 286#>69 string x \b, creator "%4.4s" 287 288# Now Apple has no repository of registered Creator IDs any more. These are 289# just the ones that I happened to have files from and was able to identify. 290 291# display information about apple creator 2920 name apple-creator 293>0 string 8BIM Adobe Photoshop 294>0 string ALD3 PageMaker 3 295>0 string ALD4 PageMaker 4 296>0 string ALFA Alpha editor 297>0 string APLS Apple Scanner 298>0 string APSC Apple Scanner 299>0 string BRKL Brickles 300>0 string BTFT BitFont 301>0 string CCL2 Common Lisp 2 302>0 string CCL\ Common Lisp 303>0 string CDmo The Talking Moose 304>0 string CPCT Compact Pro 305>0 string CSOm Eudora 306>0 string DMOV Font/DA Mover 307>0 string DSIM DigSim 308>0 string EDIT Macintosh Edit 309>0 string ERIK Macintosh Finder 310>0 string EXTR self-extracting archive 311>0 string Gzip GNU gzip 312>0 string KAHL Think C 313>0 string LWFU LaserWriter Utility 314>0 string LZIV compress 315>0 string MACA MacWrite 316>0 string MACS Macintosh operating system 317>0 string MAcK MacKnowledge terminal emulator 318>0 string MLND Defender 319>0 string MPNT MacPaint 320>0 string MSBB Microsoft BASIC (binary) 321>0 string MSWD Microsoft Word 322>0 string NCSA NCSA Telnet 323>0 string PJMM Think Pascal 324>0 string PSAL Hunt the Wumpus 325#>0 string PSI2 Apple File Exchange 326>0 string R*ch BBEdit 327>0 string RMKR Resource Maker 328>0 string RSED Resource Editor 329>0 string Rich BBEdit 330>0 string SIT! StuffIt 331>0 string SPNT SuperPaint 332>0 string Unix NeXT Mac filesystem 333>0 string VIM! Vim editor 334>0 string WILD HyperCard 335>0 string XCEL Microsoft Excel 336>0 string aCa2 Fontographer 337>0 string aca3 Aldus FreeHand 338>0 string dosa Macintosh MS-DOS file system 339>0 string movr Font/DA Mover 340>0 string nX^n WriteNow 341>0 string pdos Apple ProDOS file system 342>0 string scbk Scrapbook 343>0 string ttxt SimpleText 344>0 string ufox Foreign File Access 345# additional creators added in Dec 2017 346# Claris/Apple Works 347>0 string BOBO Apple Works 348# CU-SeeMe_0.87b3_(68K).bin 349#>0 string CUce bar 350>0 string PSPT Apple File Exchange 351# Disk_Copy_4.2.sea.bin 352#>0 string NCse foo 353# probably StuffIt/Aladdin by Smith Micro Software, Inc. 354>0 string STi0 stuffit 355# MacGzip-1.1.3.sea.bin 356#>0 string aust bar 357# D-Disk_Copy_6.3.3.smi.bin 358>0 string oneb Disk Copy Self Mounting 359# if creator name is not known display 4 character identifier 360>0 default x 361>>0 string x '%4.4s' 362 363# sas magic from Bruce Foster (bef@nwu.edu) 364# 365#0 string SAS SAS 366#>8 string x %s 3670 string SAS SAS 368>24 string DATA data file 369>24 string CATALOG catalog 370>24 string INDEX data file index 371>24 string VIEW data view 372# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 373# 3740x54 string SAS SAS 7+ 375>0x9C string DATA data file 376>0x9C string CATALOG catalog 377>0x9C string INDEX data file index 378>0x9C string VIEW data view 379 380# spss magic for SPSS system and portable files, 381# from Bruce Foster (bef@nwu.edu). 382 3830 long 0xc1e2c3c9 SPSS Portable File 384>40 string x %s 385 3860 string $FL2 SPSS System File 387>24 string x %s 388 3890 string $FL3 SPSS System File 390>24 string x %s 391 392# Macintosh filesystem data 393# From "Tom N Harris" <telliamed@mac.com> 394# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 395# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 396# entries depend on the data arithmetic added after v.35 397# There's also some Pascal strings in here, ditto... 398 399# The boot block signature, according to IM:Files, is 400# "for HFS volumes, this field always contains the value 0x4C4B." 401# But if this is true for MFS or HFS+ volumes, I don't know. 402# Alternatively, the boot block is supposed to be zeroed if it's 403# unused, so a simply >0 should suffice. 404 4050x400 beshort 0xD2D7 Macintosh MFS data 406>0 beshort 0x4C4B (bootable) 407>0x40a beshort &0x8000 (locked) 408>0x402 beldate-0x7C25B080 x created: %s, 409>0x406 beldate-0x7C25B080 >0 last backup: %s, 410>0x414 belong x block size: %d, 411>0x412 beshort x number of blocks: %d, 412>0x424 pstring x volume name: %s 413 414# *.hfs updated by Joerg Jenderek 415# https://en.wikipedia.org/wiki/Hierarchical_File_System 416# "BD" gives many false positives 4170x400 beshort 0x4244 418# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 419# first block of volume bit map (always 3) 420>0x40e ubeshort 0x0003 421# maximal length of volume name is 27 422>>0x424 ubyte <28 Macintosh HFS data 423!:mime application/x-apple-diskimage 424#!:apple hfsdINIT 425#!:apple MACSdisk 426# https://www.macdisk.com/macsigen.php 427#!:apple ddskdevi 428!:apple ????devi 429# https://en.wikipedia.org/wiki/Apple_Disk_Image 430!:ext hfs/dmg 431>>>0 beshort 0x4C4B (bootable) 432#>>>0 beshort 0x0000 (not bootable) 433>>>0x40a beshort &0x8000 (locked) 434>>>0x40a beshort ^0x0100 (mounted) 435>>>0x40a beshort &0x0200 (spared blocks) 436>>>0x40a beshort &0x0800 (unclean) 437>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 438# https://www.epochconverter.com/ 439# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 440# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 441# construct not working 442#>>>0x402 beldate-0x7C25B080 x created: %s, 443#>>>0x406 beldate-0x7C25B080 x last modified: %s, 444#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 445# found block sizes 200h,1200h,2800h 446>>>0x414 belong x block size: %d, 447>>>0x412 beshort x number of blocks: %d, 448>>>0x424 pstring x volume name: %s 449 4500x400 beshort 0x482B Macintosh HFS Extended 451>&0 beshort x version %d data 452>0 beshort 0x4C4B (bootable) 453>0x404 belong ^0x00000100 (mounted) 454>&2 belong &0x00000200 (spared blocks) 455>&2 belong &0x00000800 (unclean) 456>&2 belong &0x00008000 (locked) 457>&6 string x last mounted by: '%.4s', 458# really, that should be treated as a belong and we print a string 459# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 460>&14 beldate-0x7C25B080 x created: %s, 461# only the creation date is local time, all other timestamps in HFS+ are UTC. 462>&18 bedate-0x7C25B080 x last modified: %s, 463>&22 bedate-0x7C25B080 >0 last backup: %s, 464>&26 bedate-0x7C25B080 >0 last checked: %s, 465>&38 belong x block size: %d, 466>&42 belong x number of blocks: %d, 467>&46 belong x free blocks: %d 468 469## AFAIK, only the signature is different 470# same as Apple Partition Map 471# GRR: This magic is too weak, it is just "TS" 472#0x200 beshort 0x5453 Apple Old Partition data 473#>0x2 beshort x block size: %d, 474#>0x230 string x first type: %s, 475#>0x210 string x name: %s, 476#>0x254 belong x number of blocks: %d, 477#>0x400 beshort 0x504D 478#>>0x430 string x second type: %s, 479#>>0x410 string x name: %s, 480#>>0x454 belong x number of blocks: %d, 481#>>0x800 beshort 0x504D 482#>>>0x830 string x third type: %s, 483#>>>0x810 string x name: %s, 484#>>>0x854 belong x number of blocks: %d, 485#>>>0xa00 beshort 0x504D 486#>>>>0xa30 string x fourth type: %s, 487#>>>>0xa10 string x name: %s, 488#>>>>0xa54 belong x number of blocks: %d 489 490# From: Remi Mommsen <mommsen@slac.stanford.edu> 4910 string BOMStore Mac OS X bill of materials (BOM) file 492 493# From: Adam Buchbinder <adam.buchbinder@gmail.com> 494# URL: https://en.wikipedia.org/wiki/Datafork_TrueType 495# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 496# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 497# don't know what they mean. 4980 belong 0x100 499>(0x4.L+24) beshort x 500>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 501>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 502>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 503>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 504