1 2#------------------------------------------------------------------------------ 3# $File: msdos,v 1.216 2026/03/11 20:05:18 christos Exp $ 4# msdos: file(1) magic for MS-DOS files 5# 6 7# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 8# updated by Joerg Jenderek at Oct 2008,Apr 2011 90 string/t @ 10>1 string/cW \ echo\ off DOS batch file text 11!:mime text/x-msdos-batch 12!:ext bat 13>1 string/cW echo\ off DOS batch file text 14!:mime text/x-msdos-batch 15!:ext bat 16>1 string/cW rem DOS batch file text 17!:mime text/x-msdos-batch 18!:ext bat 19>1 string/cW set\ DOS batch file text 20!:mime text/x-msdos-batch 21!:ext bat 22 23 24# OS/2 batch files are REXX. the second regex is a bit generic, oh well 25# the matched commands seem to be common in REXX and uncommon elsewhere 26100 search/0xffff rxfuncadd 27>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 28100 search/0xffff say 29>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 30 31 32# Tests for various EXE types. 33# 34# Many of the compressed formats were extracted from IDARC 1.23 source code. 35# 36# e_magic 370 string/b MZ 38# TODO 39# FLT: Syntrillium CoolEdit Filter https://en.wikipedia.org/wiki/Adobe_Audition 40# FMX64:FileMaker Pro 64-bit plug-in https://en.wikipedia.org/wiki/FileMaker 41# FMX: FileMaker Pro 32-bit plug-in https://en.wikipedia.org/wiki/FileMaker 42# FOD: WIFE Font Driver 43# GAU: MS Flight Simulator Gauge 44# IFS: OS/2 Installable File System https://en.wikipedia.org/wiki/OS/2 45# MEXW32:MATLAB Windows 32bit compiled function https://en.wikipedia.org/wiki/MATLAB 46# MEXW64:MATLAB Windows 64bit compiled function https://en.wikipedia.org/wiki/MATLAB 47# MLL: Maya plug-in (generic) http://en.wikipedia.org/wiki/Autodesk_Maya 48# PFL: PhotoFilter plugin http://photofiltre.free.fr 49# 8*: PhotoShop plug-in (generic) http://www.adobe.com/products/photoshop/main.html 50# PLG: Aston Shell plugin http://www.astonshell.com/ 51# QLB: Microsoft Basic Quick library https://en.wikipedia.org/wiki/QuickBASIC 52# SKL: WinLIFT skin http://www.zapsolution.com/winlift/index.htm 53# TBK: Asymetrix ToolBook application http://www.toolbook.com 54# TBP: The Bat! plugin http://www.ritlabs.com 55# UPC: Ultimate Paint Graphics Editor plugin http://ultimatepaint.j-t-l.com 56# XFM: Syntrillium Cool Edit Transform Effect bad http://www.cooledit.com 57# XPL: X-Plane plugin http://www.xsquawkbox.net/xpsdk/ 58# ZAP: ZoneLabs Zone Alarm data http://www.zonelabs.com 59# 60# NEXT LINES FOR DEBUGGING! 61# e_cblp; bytes on last page of file 62# e_cp; pages in file 63#>4 uleshort x \b, e_cp 0x%x 64# e_lfanew; file address of new exe header 65#>0x3c ulelong x \b, e_lfanew 0x%x 66# e_lfarlc; address of relocation table 67#>0x18 uleshort x \b, e_lfarlc=0x%x 68# e_ovno; overlay number. If zero, this is the main executable foo 69#>0x1a uleshort !0 \b, e_ovno 0x%x 70#>0x1C ubequad !0 \b, e_res 0x%16.16llx 71# e_oemid; often 0 72#>0x24 uleshort !0 \b, e_oemid 0x%x 73# e_oeminfo; typically zeroes, but 13Dh (WORDSTAR.CNV WPFT5.CNV) 143h (WRITWIN.CNV) 74# 1A3h (DBASE.CNV LOTUS123.CNV RFTDCA.CNV WORDDOS.CNV WORDMAC.CNV WORDWIN1.CNVXLBIFF.CNV) 75#>0x26 uleshort !0 \b, e_oeminfo 0x%x 76# e_res2; typically zeroes, but 000006006F082D2Ah SCSICFG.EXE 00009A0300007C03h de.exe 77# 0000CA0000000002h country.exe dosxmgr.exe 421E0A00421EA823h QMC.EXE 78#>0x28 ubequad !0 \b, e_res2 0x%16.16llx 79# https://web.archive.org/web/20171116024937/http://www.ctyme.com/intr/rb-2939.htm#table1593 80# https://github.com/uxmal/reko/blob/master/src/ImageLoaders/MzExe/ExeImageLoader.cs 81# new exe header magic like: PE NE LE LX W3 W4 82# no examples found for ZM DL MP P2 P3 83#>(0x3c.l) string x \b, at [0x3c] %.2s 84#>(0x3c.l) ubelong x \b, at [0x3c] %#8.8x 85#>(0x3c.l+4) ubelong x \b, at [0x3c+4] %#8.8x 86# 87# Most non-DOS MZ-executable extensions have the relocation table more than 0x40 bytes into the file. 88# http://www.mitec.cz/Downloads/EXE.zip/EXE64.exe e_lfarlc=0x8ead 89# OS/2 ECS\INSTALL\DETECTEI\PCISCAN.EXE e_lfarlc=0x1c 90# some EFI apps Shell_Full.efi ext4_x64_signed.efi e_lfarlc=0 91# Icon library WORD60.ICL e_lfarlc=0 92# Microsoft compiled help format 2.0 WINWORD.DEV.HXS e_lfarlc=0 93>0x18 uleshort <0x40 94# check magic of new second header 95# skip Portable Executable (PE) with low e_lfarlc here, because handled later 96# like: ext4_x64_signed.efi Shell_Full.efi WINWORD.DEV.HXS 97>>(0x3c.l) string !PE\0\0 MS-DOS executable 98# NE executable with low e_lfarlc like: WORD60.ICL 99# This is Icon Manager (IM) by Impact Software format, based on NE version 5 with cleared NE version and e_lfarlc fields 100# It can be parsed/loaded as NE version 5 binary just by skipping e_lfarlc and NE version checks 101# ICL: Icons Library 16-bit http://fileformats.archiveteam.org/wiki/Icon_library 102>>(0x3c.l-0x02) string IMNE \b, NE 103>>>(0x3c.l+0x02) ubyte x \b version %u 104>>>(0x3c.l+0x36) byte 2 for MS Windows 105>>>>(0x3c.l+0x3E) ushort !0 106>>>>>(0x3c.l+0x3F) ubyte x %u 107>>>>>(0x3c.l+0x3E) ubyte x \b.%02u 108>>>(0x3c.l+0x02) ubyte x (Icon Library, Icon Manager by Impact Software) 109!:ext icl 110# handle LX executable with low e_lfarlc like: PCISCAN.EXE 111>>(0x3c.l) string LX \b, LX 112>>>(0x3c.l+0x2) uleshort =0x0000 113>>>>(0x3c.l) use lx-executable 114# no examples found for big endian variant 115>>>(0x3c.l+0x2) uleshort =0x0101 116>>>>(0x3c.l) use \^lx-executable 117# no examples found for PDP-11 endian variant 118>>>(0x3c.l+0x2) uleshort =0x0100 119# PDP-11-endian is not supported by magic "use" keyword yet 120# no examples found for other endian variants 121>>>0 default x 122# other endianity is not supported by magic "use" keyword 123 124# Maybe it's a PE? 125# URL: http://fileformats.archiveteam.org/wiki/Portable_Executable 126# Reference: https://docs.microsoft.com/de-de/windows/win32/debug/pe-format 127>(0x3c.l) string PE\0\0 PE 128!:mime application/vnd.microsoft.portable-executable 129# https://docs.microsoft.com/de-de/windows/win32/debug/pe-format#characteristics 130# DLL Characteristics 131#>>(0x3c.l+22) uleshort x \b, CHARACTERISTICS %#4.4x, 132# 0x0200~IMAGE_FILE_DEBUG_STRIPPED Debugging information is removed from the image file 133# 0x1000~IMAGE_FILE_SYSTEM The image file is a system file, not a user program. 134# 0x2000~IMAGE_FILE_DLL The image file is a dynamic-link library (DLL) 135>>(0x3c.l+24) leshort 0x010b \b32 executable 136# https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#windows-subsystem 137#>>>(0x3c.l+92) leshort x \b, SUBSYSTEM %u 138>>(0x3c.l+24) leshort 0x020b \b32+ executable 139#>>>(0x3c.l+92) leshort x \b, SUBSYSTEM %u 140# ROM image is without DOS MZ header and without PE\0\0 signature 141#>>(0x3c.l+24) leshort 0x0107 ROM image 142>>(0x3c.l+24) default x with unknown signature 143>>>&0 leshort x %#x 144 145## Start of the subsystem switch 146>>(0x3c.l+92) clear x 147 148# 0~IMAGE_SUBSYSTEM_UNKNOWN An unknown subsystem 149>>(0x3c.l+92) leshort 0 150# WINE https://www.winehq.org/ DLL libraries without subsystem, some examples: 151# fakedlls/l3codeca.acm fakedlls/msadp32.acm fakedlls/inetcpl.cpl fakedlls/inetcpl.cpl fakedlls/kernel32.dll fakedlls/user32.dll fakedlls/gdi32.dll 152# fakedlls/winex11.drv fakedlls/winspool.drv fakedlls/gphoto2.ds fakedlls/sane.ds fakedlls/ntoskrnl.exe fakedlls/dhtmled.ocx fakedlls/hhctrl.ocx 153# fakedlls/hidclass.sys fakedlls/mshtml.tlb fakedlls/stdole32.tlb fakedlls/vwin32.vxd fakedlls/vmm.vxd 154>>>0x40 string Wine\ placeholder\ DLL for WINE stub (DLL) 155!:ext acm/cpl/dll/drv/ds/exe/ocx/sys/tlb/vxd 156>>>0x40 string Wine\ builtin\ DLL for WINE (DLL) 157!:ext acm/cpl/dll/drv/ds/exe/ocx/sys/tlb/vxd 158>>>0 default x 159# Summary: Microsoft compiled help *.HXS format 2.0 160# URL: https://en.wikipedia.org/wiki/Microsoft_Help_2 161# Reference: http://www.russotto.net/chm/itolitlsformat.html 162# https://mark0.net/download/triddefs_xml.7z/defs/h/hxs.trid.xml 163# Note: Microsoft compiled help format contains 2 PE32 sections (.rsrc, .its) for Intel i386; 164# The help content is appended after the PE32 binary and starts with ITOLITLS string; 165# End of the PE32 binary is immediately after the .its section. 166# verified by command like: 167# `pelook.exe -d WINWORD.HXS & pelook.exe -h WINWORD.HXS` 168# `objdump -p -s WINWORD.HXS` 169# `readpe WINWORD.HXS` 170>>>>(0x3c.l+6) uleshort =2 171# Second section for these binaries starts at fixed offset 288 (size of PE signature + size of COFF header + size 172# of PE32 optional header with all data dirs + size of first .rsrc section header = 4 + 20 + 96+8*16 + 40 = 288) 173>>>>>(0x3c.l+288) string/b .its\0\0\0\0 174# Read start+length of .its section and just after it 175>>>>>>(&4.l+(-4)) string ITOLITLS \b, Microsoft compiled help format 2.0 176!:ext hxs 177# Fallback for any unrecognized binary with Unknown subsystem 0 178>>>>>>0 default x for Unknown subsystem 0 179>>>>>0 default x for Unknown subsystem 0 180>>>>0 default x for Unknown subsystem 0 181 182# 1~IMAGE_SUBSYSTEM_NATIVE device drivers and native Windows processes 183>>(0x3c.l+92) leshort 1 184# WINE https://www.winehq.org/: fakedlls/fltmgr.sys fakedlls/mountmgr.sys fakedlls/scsiport.sys fakedlls/winebus.sys fakedlls/winehid.sys 185>>>0x40 string Wine\ placeholder\ DLL for WINE stub 186>>>0x40 string Wine\ builtin\ DLL for WINE 187>>>0 default x for MS Windows 188>>>>(0x3c.l+72) leshort x %u 189>>>>(0x3c.l+74) leshort x \b.%02u 190# Native PEs are used by: 191# - NT kernel DLLs: hal.dll, kdcom.dll, pshed.dll, bootvid.dll, ... 192# - NT kernel images: ntoskrnl.exe, ntkrnlmp.exe, ntkrnlpa.exe, ntkrpamp.exe 193# - NT kernel drivers: Windows/System32/drivers/*.sys 194# - NT native userspace DLLs: ntdll.dll, ... 195# - NT native userspace executables: smss.exe, csrss.exe, autochk.exe, ... 196# TODO: write rule to distinguish between Kernel and Native processes 197# (the only way to do this is based on the presence of ntoskrnl.exe in import table) 198>>>(0x3c.l+22) leshort&0x2000 >0 (native) 199!:ext dll/sys 200>>>(0x3c.l+22) leshort&0x2000 0 (native) 201!:ext exe/sys 202 203# 2~IMAGE_SUBSYSTEM_WINDOWS_GUI The Windows graphical user interface (GUI) subsystem 204>>(0x3c.l+92) leshort 2 205# WINE https://www.winehq.org/: fakedlls/clock.exe fakedlls/control.exe fakedlls/explorer.exe fakedlls/notepad.exe 206>>>0x40 string Wine\ placeholder\ DLL for WINE stub 207>>>0x40 string Wine\ builtin\ DLL for WINE 208>>>0 default x for MS Windows 209>>>>(0x3c.l+72) leshort x %u 210>>>>(0x3c.l+74) leshort x \b.%02u 211>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 212# These could probably be at least partially distinguished from one another by 213# looking for specific exported functions. 214# CPL: Control Panel item 215# TLB: Type library 216# OCX: OLE/ActiveX control 217# ACM: Audio compression manager codec 218# AX: DirectShow source filter 219# IME: Input method editor 220!:ext dll/cpl/tlb/ocx/acm/ax/ime 221>>>(0x3c.l+22) leshort&0x2000 0 (GUI) 222# Screen savers typically include code from the scrnsave.lib static library, but 223# that's not guaranteed. 224!:ext exe/scr 225 226# 3~IMAGE_SUBSYSTEM_WINDOWS_CUI The Windows character subsystem 227>>(0x3c.l+92) leshort 3 228# WINE https://www.winehq.org/: fakedlls/cacls.exe fakedlls/cmd.exe fakedlls/expand.exe fakedlls/net.exe fakedlls/reg.exe 229>>>0x40 string Wine\ placeholder\ DLL for WINE stub 230>>>0x40 string Wine\ builtin\ DLL for WINE 231>>>0 default x for MS Windows 232>>>>(0x3c.l+72) leshort x %u 233>>>>(0x3c.l+74) leshort x \b.%02u 234>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 235!:ext dll/cpl/tlb/ocx/acm/ax/ime 236>>>(0x3c.l+22) leshort&0x2000 0 (console) 237!:ext exe/com 238 239# 4~Old Windows CE subsystem (never used) 240#>>(0x3c.l+92) leshort 4 for MS Windows CE OLD 241 242# 5~IMAGE_SUBSYSTEM_OS2_CUI The OS/2 character subsystem 243# Not used in image files, constant used only in in-memory structures of OS/2 subsystem as part of Windows NT 244#>>(0x3c.l+92) leshort 5 for OS/2 245 246# NO Windows Subsystem number 6! 247#>>(0x3c.l+92) leshort 6 for Unknown subsystem 6 248 249# 7~IMAGE_SUBSYSTEM_POSIX_CUI The Posix character subsystem 250>>(0x3c.l+92) leshort 7 for POSIX 251>>>(0x3c.l+72) leshort x %u 252>>>(0x3c.l+74) leshort x \b.%02u 253>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 254# like: PSXDLL.DLL 255!:ext dll 256>>>(0x3c.l+22) leshort&0x2000 0 (EXE) 257# like: PAX.EXE 258!:ext exe 259 260# 8~IMAGE_SUBSYSTEM_NATIVE_WINDOWS Native Win9x driver 261# Win9x never used subsystem 8, all Win9x drivers are either LE/VXD or PE with native (1) subsystem 262# MSVC4 LINK.EXE can create PE binary for subsystem 8 by /SUBSYSTEM:MMOSA flag 263# MMOSA refers to Native Win32E (embedded) API, mentioned at: 264# https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/tr-97-18.doc 265#>>(0x3c.l+92) leshort 8 for Win9x/MMOSA 266# GRR: No examples found by Joerg Jenderek 267 268# 9~IMAGE_SUBSYSTEM_WINDOWS_CE_GUI Windows CE 269>>(0x3c.l+92) leshort 9 270# WINE https://www.winehq.org/ 271>>>0x40 string Wine\ placeholder\ DLL for WINE stub 272>>>0x40 string Wine\ builtin\ DLL for WINE 273>>>0 default x for MS Windows CE 274>>>>(0x3c.l+72) leshort x %u 275>>>>(0x3c.l+74) leshort x \b.%02u 276>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 277# like: MCS9900Ce50.dll Mosiisr99x.dll TMCGPS.DLL 278!:ext dll 279>>>(0x3c.l+22) leshort&0x2000 0 (EXE) 280# like: NNGStart.exe navigator.exe 281!:ext exe 282 283# 10~IMAGE_SUBSYSTEM_EFI_APPLICATION An Extensible Firmware Interface (EFI) application 284>>(0x3c.l+92) leshort 10 for EFI (application) 285# like: bootmgfw.efi grub.efi gdisk_x64.efi Shell_Full.efi shim.efi syslinux.efi 286!:ext efi 287 288# 11~IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER An EFI driver with boot services 289>>(0x3c.l+92) leshort 11 for EFI (boot service driver) 290# like: ext2_x64_signed.efi Fat_x64.efi iso9660_x64_signed.efi 291!:ext efi 292 293# 12~IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER An EFI driver with run-time services 294>>(0x3c.l+92) leshort 12 for EFI (runtime driver) 295# no sample found 296!:ext efi 297 298# 13~IMAGE_SUBSYSTEM_EFI_ROM An EFI ROM image 299>>(0x3c.l+92) leshort 13 for EFI (ROM) 300# no sample found 301!:ext efi 302 303# 14~IMAGE_SUBSYSTEM_XBOX XBOX 304>>(0x3c.l+92) leshort 14 for XBOX 305#!:ext foo-xbox 306 307# NO Windows Subsystem number 15! 308#>>(0x3c.l+92) leshort 15 for Unknown subsystem 15 309 310# 16~IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION Windows boot application 311>>(0x3c.l+92) leshort 16 for MS Windows 312>>>(0x3c.l+72) leshort x %u 313>>>(0x3c.l+74) leshort x \b.%02u 314>>>(0x3c.l+22) leshort&0x2000 >0 (boot DLL) 315# like: bootvhd.dll bootuwf.dll hvloader.dll tcbloader.dll bootspaces.dll 316!:ext dll 317>>>(0x3c.l+22) leshort&0x2000 0 (boot application) 318# like: bootmgr.efi memtest.efi shellx64.efi memtest.exe winload.exe winresume.exe bootvhd.dll hvloader.dll 319!:ext efi/exe 320 321>>(0x3c.l+92) default x 322>>>&0 leshort x for Unknown subsystem %#x 323## End of the subsystem switch 324 325>>(0x3c.l+4) clear x \b, 326>>(0x3c.l+4) use display-coff-processor 327 328>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 329>>(0x3c.l+22) leshort&0x1000 >0 system file 330 331# Check for presence of COM Runtime descriptor 332>>(0x3c.l+24) leshort 0x010b 333>>>(0x3c.l+116) leshort >14 334>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 335>>(0x3c.l+24) leshort 0x020b 336>>>(0x3c.l+132) leshort >14 337>>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 338 339# hooray, there's a DOS extender using the PE format, with a valid PE 340# executable inside (which just prints a message and exits if run in win) 341# FIXME: Find sample of such executable for investigation. In was introduced 342# in file version 4.14 with following check: 343# "(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender" 344# "(8.s*16) string !32STUB for MS Windows" 345# But that check is too generic and had lot of false positives. 32STUB/32rtm 346# sounds like Borland DOS extender with PE loader and Windows emulation which 347# can be injected into any valid Windows PE binary. 348# So it is needed to look at the sample of such executable and check for 349# subsystem or cpu/machine. 350 351# Detect embedded DOS extenders 352>>(8.s*16) string 32STUB 353# BRC32.EXE, TLINK32.EXE or TASM32.EXE from TASM 5.0 354>>>(8.s*16) search/0x50 32rtm-stub\ for\ PE\ files \b, Borland 32rtm DOS extender (stub) 355# CL.EXE or LINK.EXE from MS Visual C++ 1.x 356>>(8.s*16) search/0x50 Phar\ Lap\ Software,\ Inc. \b, Phar Lap TNT DOS extender 357# ulink.exe 358>>(8.s*16) search/0x200 Can't\ find\ DOSWIN32.RTM \b, DosWin32 DOS extender (stub) 359>>(8.s*16) search/0x4000 Stub\ failed\ to\ find\ DOS/4G\ extender. \b, DOS/4G DOS extender (stub) 360# LOADPEX.BIN and HDLD32.BIN 361# x86 jmp near relative (0xe9 0x?? 0x??) + string "MI" (0x4d 0x49) 362>>(8.s*16) ulequad&0xffff0000ff =0x494d0000e9 \b, HX DOS extender (embedded with DPMI host) 363>>(8.s*16) ulequad&0xffff0000ff !0x494d0000e9 364# DPMIST32.BIN 365>>>(8.s*16) search/0x200 cannot\ find\ loader\ DPMILD32.EXE \b, HX DOS extender (stub) 366# LOADPE.BIN 367>>>(8.s*16) search/0x600 PATH=HDPMI32.EXE \b, HX DOS extender (embedded without DPMI host) 368# DPMILD32.BIN 369>>>(8.s*16) search/0x4000 DPMILD32: \b, HX DOS extender (embedded without DPMI host) 370 371>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 372>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 373>>(0x3c.l+0xf8) search/0x140 UPX2 374>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 375>>(0x3c.l+0xf8) search/0x140 .idata 376>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 377>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 378>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 379>>(0x3c.l+0xf8) search/0x140 .rsrc 380>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 381>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 382>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 383>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 384>>(0x3c.l+0xf8) search/0x140 .data 385>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 386>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 387>>>(0x3c.l+0xf7) byte x 388>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 389>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 390>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 391>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 392>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 393>>0x30 string Inno \b, InnoSetup self-extracting archive 394# NumberOfSections; Normal Dynamic Link libraries have a few sections for code, data and resource etc. 395# PE used as container have less sections 396>>(0x3c.l+6) leshort >1 \b, %u sections 397# do not display for 1 section to get output like in version 5.43 and to keep output columns low 398#>>(0x3c.l+6) leshort =1 \b, %u section 399 400# If the relocation table is 0x40 or more bytes into the file, it's definitely 401# not a DOS EXE. 402>0x18 uleshort >0x3f 403 404# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 405# must be one of the unusual subformats. 406>>(0x3c.l) string !PE\0\0 MS-DOS executable 407#!:mime application/x-dosexec 408 409>>(0x3c.l) string NE \b, NE 410#!:mime application/x-dosexec 411!:mime application/x-ms-ne-executable 412>>>(0x3c.l+0x02) ubyte x \b version %u 413>>>(0x3c.l+0x02) ubyte >5 414>>>>(0x3c.l+0x03) ubyte x \b.%02u 415# FOR DEBUGGING! 416# Reference: https://wiki.osdev.org/NE 417# Create time for NE version <5 in FAT12 format 418#>>>(0x3c.l+0x02) ubyte <5 419#>>>>(0x3c.l+0x08) ulelong !0 \b, Created at 420#>>>>>(0x3c.l+0x0a) lemsdosdate x %s 421#>>>>>(0x3c.l+0x08) lemsdostime x %s 422# ProgFlags; Program flags, bitmapped 423#>>>(0x3c.l+0x0C) ubyte x \b, ProgFlags 0x%2.2x 424# >>>(0x3c.l+0x0c) ubyte&0x03 =0 \b, no automatic data segment 425# >>>(0x3c.l+0x0c) ubyte&0x03 =1 \b, single shared 426# >>>(0x3c.l+0x0c) ubyte&0x03 =2 \b, multiple 427# >>>(0x3c.l+0x0c) ubyte&0x03 =3 \b, (null) 428# >>>(0x3c.l+0x0c) ubyte &0x04 \b, Per-Process Library Initialization OR real mode only 429# >>>(0x3c.l+0x0c) ubyte &0x08 \b, Protected mode only 430# >>>(0x3c.l+0x0c) ubyte &0x10 \b, 8086 instructions in OS/2 app OR LIM 3.2 EMS API in Win app 431# >>>(0x3c.l+0x0c) ubyte &0x20 \b, i286 instructions in OS/2 app OR each instance in separate EMS bank in Win app 432# >>>(0x3c.l+0x0c) ubyte &0x40 \b, i386 instructions in OS/2 app OR private GlobalAlloc above the EMS line in Win app 433# >>>(0x3c.l+0x0c) ubyte &0x80 \b, x87 floating point instructions 434# ApplFlags; Application flags, bitmapped 435# https://www.fileformat.info/format/exe/corion-ne.htm 436#>>>(0x3c.l+0x0D) ubyte x \b, ApplFlags 0x%2.2x 437# Application type (bits 0-2); 1~Full screen (not aware of Windows/P.M. API) 438# 2~Compatible with Windows/P.M. API 3~Uses Windows/P.M. API 439#>>>(0x3c.l+0x0D) ubyte&0x07 =1 \b, Not compatiblr with Windows/P.M. API (full screen) 440#>>>(0x3c.l+0x0D) ubyte&0x07 =2 \b, Compatible with Windows/P.M. API (console mode) 441#>>>(0x3c.l+0x0D) ubyte&0x07 =3 \b, use Windows/P.M. API (window mode) 442#>>>(0x3c.l+0x0D) ubyte &0x08 \b, Bound OS/2 app OR application specific loader in Win app 443#>>>(0x3c.l+0x0D) ubyte &0x20 \b, Errors in image 444#>>>(0x3c.l+0x0D) ubyte &0x40 \b, Non-conforming OS/2 app OR private Win library above EMS line 445# bit 7; DLL or driver (SS:SP info invalid, CS:IP points at FAR init routine called with AX handle 446#>>>(0x3c.l+0x0D) ubyte &0x80 \b, DLL or driver 447# AutoDataSegIndex; automatic data segment index like: 0 2 3 22 448# zero if the SINGLEDATA and MULTIPLEDATA bits are cleared 449#>>>(0x3c.l+0x0e) uleshort x \b, AutoDataSegIndex %u 450# InitHeapSize; intial local heap size like; 0 400h 1400h 451# zero if there is no local allocation 452#>>>(0x3c.l+0x10) uleshort !0 \b, InitHeapSize 0x%x 453# InitStackSize; inital stack size like: 0 10h A00h 7D0h A8Ch FA0h 1000h 1388h 454# 1400h (CBT) 1800h 2000h 2800h 2EE0h 2F3Ch 3258h 3E80h 4000h 4E20h 5000h 6000h 455# 6D60h 8000h 40000h 456# zero if the SS register value does not equal the DS register value 457#>>>(0x3c.l+0x12) uleshort !0 \b, InitStackSize 0x%x 458# EntryPoint; segment offset value of CS:IP like: 0 10000h 18A84h 11C1Ah 307F1h 459#>>>(0x3c.l+0x14) ulelong !0 \b, EntryPoint 0x%x 460# InitStack; specifies the segment offset value of stack pointer SS:SP 461# like: 0 20000h 160000h 462#>>>(0x3c.l+0x18) ulelong !0 \b, InitStack 0x%x 463# SegCount; number of segments in segment table like: 0 1 2 3 16h 464#>>>(0x3c.l+0x1C) uleshort x \b, SegCount 0x%x 465# ModRefs; number of module references (DLLs) like; 0 1 3 466#>>>(0x3c.l+0x1E) uleshort !0 \b, ModRefs %u 467# NoResNamesTabSiz; size in bytes of non-resident names table 468# like: Bh 16h B4h B9h 2Ch 18Fh 16AAh 469#>>>(0x3c.l+0x20) uleshort x \b, NoResNamesTabSiz 0x%x 470# SegTableOffset; offset of Segment table like: 40h 471#>>>(0x3c.l+0x22) uleshort !0x40 \b, SegTableOffset 0x%x 472# ResTableOffset; offset of resources table like: 40h 50h 58h F0h 473# 40h for most fonts likedos737.fon FMFONT.FOT but 60h for L1WBASE.FON 474#>>>(0x3c.l+0x24) uleshort x \b, ResTableOffset 0x%x 475# ResidNamTable; offset of resident names table 476# like: 58h 5Ch 60h 68h 74h 98h 2E3h 2E7h 2F0h 477#>>>(0x3c.l+0x26) uleshort x \b, ResidNamTable 0x%x 478# ImportNameTable; offset of imported names table (array of counted strings, terminated with string of length 00h) 479# like: 77h 7Eh 80h C6h A7h ACh 2F8h 3FFh 480#>>>(0x3c.l+0x2a) uleshort x \b, ImportNameTable 0x%x 481# OffStartNonResTab; offset from start of file to non-resident names table 482# like: 110h 11Dh 19Bh 1A5h 3F5h 4C8h 4EEh D93h 483#>>>(0x3c.l+0x2c) ulelong x \b, OffStartNonResTab 0x%x 484# MovEntryCount; number of movable entry points like: 0 4 5 6 16 17 24 312 355 446 485#>>>(0x3c.l+0x30) uleshort !0 \b, MovEntryCount %u 486# FileAlnSzShftCnt; log2 of the segment sector size; 4~16 0~9~512 (default) 487#>>>(0x3c.l+0x32) uleshort !9 \b, FileAlnSzShftCnt %u 488# nResTabEntries; number of resource table entries like: 0 2 489#>>>(0x3c.l+0x34) uleshort !0 \b, nResTabEntries %u 490# Following fields are valid only for NE version 5+ 491>>>(0x3c.l+0x02) ubyte >4 492# targOS; Target OS; 0~unspecified (OS/2 or Windows); detect it based on Windows-only flags and OS/2 specific import lib (DOSCALLS) 493#>>>(0x3c.l+0x36) byte x TARGOS %x 494>>>>(0x3c.l+0x36) byte 0 495# if windows version is specified then it is windows binary 496>>>>>(0x3c.l+0x3E) ushort !0 for MS Windows 497>>>>>>(0x3c.l+0x3F) ubyte x %u 498>>>>>>(0x3c.l+0x3E) ubyte x \b.%02u 499>>>>>>(0x3c.l+0x3F) ubyte <3 500>>>>>>>(0x3c.l+0x37) byte&0x04 0 (real mode only) 501>>>>>>>(0x3c.l+0x37) byte&0x04 !0 (real+protected mode) 502>>>>>>(0x3c.l+0x3E) ushort =0x0300 503>>>>>>>(0x3c.l+0x0c) ubyte&0x08 0 (real+protected mode) 504>>>>>>>(0x3c.l+0x0c) ubyte&0x08 !0 (protected mode only) 505>>>>>(0x3c.l+0x3E) ushort 0 506>>>>>>(0x3c.l+0x2a) leshort 0 for OS/2 1.x or MS Windows 1.x/2.x 507>>>>>>(0x3c.l+0x2a) default x 508# Binaries with DOSCALLS import library are for OS/2 509>>>>>>>&(&0.s-0x29) search/512/C \x08DOSCALLS for OS/2 1.x 510>>>>>>>(0x3c.l+0x2a) default x 511# Binaries with KERNEL, USER or GDI import library are for Windows 512# FIXME: names are prefixed by its length, but regex type does not support binary bytes 513>>>>>>>>&(&0.s-0x29) regex/512 KERNEL|USER|GDI for MS Windows 1.x/2.x 514>>>>>>>>>(0x3c.l+0x37) byte&0x04 0 (real mode only) 515>>>>>>>>>(0x3c.l+0x37) byte&0x04 !0 (real+protected mode) 516# Binaries without any of those import library can be for any OS 517>>>>>>>>(0x3c.l+0x2a) default x for OS/2 1.x or MS Windows 1.x/2.x 518>>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 519>>>>(0x3c.l+0x36) byte 2 for MS Windows 520# expctwinver; expected Windows version (minor first) like: 521# 0.0~DTM.DLL 203.4~Windows 1.03 GDI.EXE 2.1~TTY.DRV 3.0~dos737.fon FMFONT.FOT THREED.VBX 3.10~GDI.EXE 4.0~(ME) VGAFULL.3GR 522>>>>>(0x3c.l+0x3E) ushort !0 523>>>>>>(0x3c.l+0x3F) ubyte x %u 524>>>>>>(0x3c.l+0x3E) ubyte x \b.%02u 525# Empty version is is treated by Windows 3.x OS as Windows 2.01 version and by Windows 2.x OS as Windows 1.01 version 526>>>>>(0x3c.l+0x3E) ushort 0 1.x/2.x 527>>>>>(0x3c.l+0x3F) ubyte <3 528>>>>>>(0x3c.l+0x37) byte&0x04 0 (real mode only) 529>>>>>>(0x3c.l+0x37) byte&0x04 !0 (real+protected mode) 530>>>>>(0x3c.l+0x3E) ushort =0x0300 531>>>>>>(0x3c.l+0x0c) ubyte&0x08 0 (real+protected mode) 532>>>>>>(0x3c.l+0x0c) ubyte&0x08 !0 (protected mode only) 533# Windows P-code application 534# https://web.archive.org/web/20000304044656/http://msdn.microsoft.com/library/backgrnd/html/msdn_c7pcode2.htm 535# https://library.thedatadungeon.com/msdn-1992-09/msjv7/html/msjv0g6a.content.htm 536# https://en.wikipedia.org/wiki/P-code_machine#Microsoft_P-code 537# Can be created by MSC7 or MSVC1.x CL.EXE /Oq switch which calls MPC.EXE 538# MPC.EXE (Make P-Code utility) sets bit2 in MZ e_res[2] (e_flags) field 539# Filter out false-positive Windows 3.x applications with OS/2 WLO loader 540# (sets bit7 in NE ne_flagsothers) as they do not have MZ e_res[] fields 541>>>>>(0x3c.l+0x3E) ushort >0x0300 542>>>>>>(0x3c.l+0x37) ubyte&0x80 0 543>>>>>>>0x20 ubyte&0x04 !0 \b, P-code application 544# 32-bit Watcom Win386 extender in 16-bit Windows 3.x NE binaries 545# https://www.os2museum.com/wp/watcom-win386/ 546# https://github.com/open-watcom/open-watcom-v2/blob/master/bld/win386/ 547# https://misc.daniel-marschall.de/spiele/blown_away/disassemble.php 548# Examples: BA_LITE.EXE WALDO.EXE 549>>>>>(0x3c.l+0x3E) ushort >0x0300 550>>>>>>0x38 ulong !0 551>>>>>>>(0x38.l) string MQ \b, Watcom Win386 extender 552# OS 3 was reserved for Multitasking MS-DOS but it never used NE version 5+ (only NE version 4) 553#>>>>(0x3c.l+0x36) byte 3 for Multitasking MS-DOS 554# OS 4 was reserved for MS Windows/386 device drivers but MS Windows/386 2.x never used NE format (Xenix x.out format was used instead) 555#>>>>(0x3c.l+0x36) byte 4 for MS Windows/386 device driver 556# OS 5 is assigned to BOSS (Borland Operating System Services) but is used also by other 16-bit DOS applications 557>>>>(0x3c.l+0x36) byte 5 for MS-DOS 558# HDLD16.BIN 559# x86 jmp near relative (0xe9 0x?? 0x??) + string "MI" (0x4d 0x49) 560>>>>>(8.s*16) ulequad&0xffff0000ff =0x494d0000e9 \b, HX DOS extender 16-bit (embedded with DPMI host) 561>>>>>(8.s*16) ulequad&0xffff0000ff !0x494d0000e9 562# DPMIST16.BIN 563>>>>>>(8.s*16) search/0x200 cannot\ find\ loader\ DPMILD16.EXE \b, HX DOS extender 16-bit (stub) 564# DPMILD16.BIN 565>>>>>>(8.s*16) search/0x4000 DPMILD16: \b, HX DOS extender 16-bit (embedded without DPMI host) 566# TLINK.EXE or TD.EXE from TASM 5.0 567>>>>>>(8.s*16) string 16STUB 568>>>>>>>(8.s*16) search/0x1000 rtm.exe\0dpmi16bi.ovl \b, Borland rtm DOS extender (stub) 569>>>>>>(8.s*16) string !16STUB 570# TLINK.EXE or BRC.EXE from Borland Pascal 7.0 571>>>>>>>(8.s*16) search/0x1000 BOSS\ Stub\ Version \b, Borland BOSS DOS extender (stub) 572# OS 6 is not assigned but is used by 32-bit DOS application with extender (found only with HX DOS extender 32-bit) 573# http://downloads.sourceforge.net/dfendreloaded/D-Fend-Reloaded-1.4.4.zip 574# D-Fend Reloaded/VirtualHD/FREEDOS/DPMILD32.EXE 575# https://www.japheth.de/HX/DPMILD32.TXT 576>>>>(0x3c.l+0x36) byte 6 for MS-DOS 577# HDLD32.BIN 578# x86 jmp near relative (0xe9 0x?? 0x??) + string "MI" (0x4d 0x49) 579>>>>>(8.s*16) ulequad&0xffff0000ff =0x494d0000e9 \b, HX DOS extender 32-bit (embedded with DPMI host) 580>>>>>(8.s*16) ulequad&0xffff0000ff !0x494d0000e9 581# DPMIST32.BIN 582>>>>>>(8.s*16) search/0x200 cannot\ find\ loader\ DPMILD32.EXE \b, HX DOS extender 32-bit (stub) 583# DPMILD32.BIN 584>>>>>>(8.s*16) search/0x4000 DPMILD32: \b, HX DOS extender 32-bit (embedded without DPMI host) 585# https://en.wikipedia.org/wiki/Phar_Lap_(company) 586# like: TELLPROT.EXE from 286DEX 587# can be created by BIND286.EXE from OS/2 NE binary 588>>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap 286 DOS extender, emulating OS/2 1.x 589# like: CVP7.EXE from 286DEX 590# can be created by BIND286.EXE from Windows NE binary 591>>>>(0x3c.l+0x36) byte 0x82 for MS-DOS, Phar Lap 286 DOS extender, emulating MS Windows 592>>>>>(0x3c.l+0x3E) ushort 0 1.x/2.x 593>>>>>(0x3c.l+0x3E) ushort !0 594>>>>>>(0x3c.l+0x3F) ubyte x %u 595>>>>>>(0x3c.l+0x3E) ubyte x \b.%02u 596>>>>(0x3c.l+0x36) default x 597>>>>>(0x3c.l+0x36) ubyte x for unknown OS %#x 598# OS2EXEFlags; other EXE flags 599# 1~Long filename support 2~Win2.x proportional fonts 4~Win2.x protected mode 8~Executable has gangload area 10~Win9x thunk lib without DllEntryPoint 80~Win3.x app with OS/2 WLO loader 600#>>>>(0x3c.l+0x37) byte !0 \b, OS2EXEFlags 0x%x 601# gangstart; offset to start of gangload area like: 0 34h 58h 246h 602#>>>>(0x3c.l+0x38) uleshort !0 \b, gangstart 0x%x 603# ganglength; size of gangload area 604# like: 0 33Eh 39Ah AEEh 605#>>>>(0x3c.l+0x3A) uleshort !0 \b, ganglength 0x%x 606# mincodeswap; minimum code swap area size like 0 620Ch 607#>>>>(0x3c.l+0x3C) uleshort !0 \b, mincodeswap 0x%x 608>>>>(0x3c.l+0x3F) ubyte =3 609>>>>>0x3c ulelong >0x800 610>>>>>>(0x3c.l+0x37) ubyte &0x80 with OS/2 WLO loader 611# Detection for NE versions <5 which do not have OS type byte 0x36 612# These versions are used only by WINE, Windows 1.x/2.x and Multitasking MS-DOS 613# WINE binaries have special signature after the dos header (at fixed offset 0x40) 614# Multitasking MS-DOS binaries imports DOSCALLS library, so use it for distinguishing 615# Import libraries are part of the string table which starts one byte after the 616# 16-bit indirect offset 0x2a relative to the beginning of NE header, and consist 617# of concatenated pascal strings (first byte of the string is its length) 618>>>(0x3c.l+0x02) ubyte <5 619# like: fakedlls/krnl386.exe16 fakedlls/gdi.exe16 fakedlls/winsock.dll16 fakedlls/winoldap.mod16 fakedlls/mouse.drv16 620>>>>0x40 string Wine\ placeholder\ DLL for WINE stub 621>>>>(0x3c.l+0x2a) default x 622# like: HE_DAEM.EXE POPUP.EXE QUEUER.EXE 623>>>>>&(&0.s-0x29) search/512/C \x08DOSCALLS for Multitasking MS-DOS 624>>>>>(0x3c.l+0x2a) default x for MS Windows 1.x/2.x 625# Special case, Windows 3.x OS parse from NE version 4 binaries also following NE version 5 fields: 626# - os type if is 0 or 2 627# - bits proportional fonts and protected mode 628# Such NE version 4 binary is treated by Windows 3.x OS as Windows 2.01 629# compatible binary and by Windows 2.x OS as Windows 1.01 compatible binary. 630# So if os type is correct (0 or 2; matched mask 0xfd) and at least one 631# of those bits is set and others are cleared (matched mask 0xf9) then 632# detect if binary has NE version 5 protected mode bit set. 633>>>>>>(0x3c.l+0x36) leshort&0xf9fd 0 634>>>>>>>(0x3c.l+0x37) byte&0x06 !0 635>>>>>>>>(0x3c.l+0x37) byte&0x04 0 (real mode only) 636>>>>>>>>(0x3c.l+0x37) byte&0x04 !0 (real+protected mode) 637>>>>>>>(0x3c.l+0x37) default x (real mode only) 638>>>>>>(0x3c.l+0x36) default x (real mode only) 639# DRV: Driver 640# 3GR: Grabber device driver 641# CPL: Control Panel Item 642# VBX: Visual Basic Extension https://en.wikipedia.org/wiki/Visual_Basic 643# FON: Bitmap font http://fileformats.archiveteam.org/wiki/FON 644# FOT: Font resource file 645# EXE: WINSPOOL.EXE USER.EXE krnl386.exe GDI.EXE 646# CNV: Microsoft Word text conversion https://www.file-extensions.org/cnv-file-extension-microsoft-word-text-conversion-data 647>>>(0x3c.l+0x0c) leshort &0x8000 648# Check segment count, if 0 then this is resource-only DLL 649>>>>(0x3c.l+0x1c) leshort 0 650>>>>>(0x3c.l+0x2c) lelong !0 651>>>>>>(&-4.l+1) string/C FONTRES (DLL, font) 652!:ext fon/fot 653>>>>>>(&-4.l+1) default x (DLL, resource-only) 654!:ext dll 655>>>>>(0x3c.l+0x2c) lelong 0 (DLL, resource-only) 656!:ext dll 657>>>>(0x3c.l+0x1c) leshort !0 658# Check description of the module, first word specifies type of the DLL library 659>>>>>(0x3c.l+0x2c) lelong !0 660>>>>>>(&-4.l+1) string/C DDRV (DLL, driver) 661!:ext drv 662>>>>>>(&-4.l+1) default x (DLL) 663!:ext dll/drv/3gr/cpl/vbx 664>>>>>(0x3c.l+0x2c) lelong 0 (DLL) 665!:ext dll/drv/3gr/cpl/vbx 666>>>(0x3c.l+0x0c) leshort&0x8000 0 (EXE) 667!:ext exe/scr 668>>>>(0x3c.l+0x0d) ubyte&0x07 =1 (full screen) 669>>>>(0x3c.l+0x0d) ubyte&0x07 =2 (console) 670>>>>(0x3c.l+0x0d) ubyte&0x07 =3 (GUI) 671>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 672>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 673 674>>(0x3c.l) string LX \b, LX 675!:mime application/x-dosexec 676>>>(0x3c.l+0x2) uleshort =0x0000 677>>>>(0x3c.l) use lx-executable 678# no examples found for big endian variant 679>>>(0x3c.l+0x2) uleshort =0x0101 680>>>>(0x3c.l) use \^lx-executable 681# no examples found for PDP-11 endian variant 682>>>(0x3c.l+0x2) uleshort =0x0100 683# PDP-11-endian is not supported by magic "use" keyword yet 684# no examples found for other endian variants 685>>>0 default x 686# other endianity is not supported by magic "use" keyword 687>>>(8.s*16) string emx \b, emx 688>>>>&1 string x %s 689>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 690 691# MS Windows system file, supposedly a collection of LE executables 692# like vmm32.vxd WIN386.EXE 693>>(0x3c.l) string W3 \b, W3 for MS Windows 694#!:mime application/x-dosexec 695!:mime application/x-ms-w3-executable 696>>>(0x3c.l+0x3) ubyte <4 %u 697# Windows 3.x WIN386.EXE 698!:ext exe 699>>>(0x3c.l+0x3) ubyte >3 %u 700# Windows 95 VMM32.VXD 701!:ext vxd 702>>>(0x3c.l+0x2) ubyte x \b.%02u 703 704# W4 executable 705>>(0x3c.l) string W4 \b, W4 for MS Windows 706#!:mime application/x-dosexec 707!:mime application/x-ms-w4-executable 708# windows 98 VMM32.VXD 709!:ext vxd 710>>>(0x3c.l+0x3) ubyte x %u 711>>>(0x3c.l+0x2) ubyte x \b.%02u 712 713# Linear Executable (LE) in Little Endian (\0\0) 714>>(0x3c.l) string LE\0\0 \b, LE 715!:mime application/x-dosexec 716>>>(0x3c.l+0x0a) leshort 1 717# some DOS extenders use LE files with OS/2 header 718>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS/4G DOS extender 719>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS/4GW DOS extender 720>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 721>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 722>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 723>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 724>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 725# D3XW.EXE 726>>>>(8.s*16) string o2LEstub for MS-DOS, D3X DOS extender 727>>>>0 default x 728# DOS32MW.DLL 729>>>>>(0x3c.l+0x10) lelong&0x38000 =0x18000 for MS-DOS (DLL) 730!:ext dll 731# HPFS.386 (HPFS386 filesystem for OS/2 1.x, part of Microsoft LAN Manager) 732# https://www.os2museum.com/wp/os2-history/os2-16-bit-server/ 733# EXE module (&0x38000=0x00000) with zero application type (&0x700=0x000) and 734# with no external fixups (&0x20=0x20) is .386 32-bit driver module for OS/2 1.x 735>>>>>(0x3c.l+0x10) lelong&0x38720 =0x00020 for OS/2 1.x (driver) 736!:ext 386 737>>>>>0 default x for unknown OS 0x1 738# this is a wild guess; hopefully it is a specific signature 739>>>>&0x24 lelong <0x50 740>>>>>(&0x4c.l) string \xfc\xb8WATCOM 741>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 742# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 743#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 744# fails with DOS-Extenders. 745# OS 2 was reserved for MS Windows 16-bit but it never used LE (NE format was used instead) 746#>>>(0x3c.l+0x0a) leshort 2 for MS Windows 16-bit 747# OS 3 was reserved for Multitasking MS-DOS but it never used LE (NE format was used instead) 748#>>>(0x3c.l+0x0a) leshort 3 for Multitasking MS-DOS 749>>>(0x3c.l+0x0a) leshort 4 for MS Windows 750>>>>(0x3c.l+0xc3) ubyte x %u 751>>>>(0x3c.l+0xc2) ubyte x \b.%02u 752>>>>(0x3c.l+0x10) lelong&0x38000 =0x08000 753# DLL module (0x08000) with no external fixups (0x20) for i386 CPU (2) is .386 VxD file for MS Windows 3.x 754>>>>>(0x3c.l+0x10) lelong&0x20 !0 755>>>>>>(0x3c.l+0x08) leshort 2 (VxD 386) 756!:ext 386 757>>>>(0x3c.l+0x10) lelong&0x38000 =0x28000 (VxD static) 758# VXD: VxD for MS Windows 95/98/Me 759# PDR: Port driver 760# MPD: Miniport driver (?) 761!:ext vxd/pdr/mpd 762>>>>(0x3c.l+0x10) lelong&0x38000 =0x38000 (VxD dynamic) 763!:ext vxd/pdr/mpd 764>>>(0x3c.l+0x0a) default x 765>>>>(0x3c.l+0x0a) leshort x for unknown OS %#x 766>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 767>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 768 769# DOS/32A Linear Compressed file format 770>>(0x3c.l) string LC\0\0 \b, LC for MS-DOS 771>>>0x40 search/0x40 STUB/32A \b, DOS/32A DOS extender (stub) 772>>>0x40 search/0x80 STUB/32C \b, DOS/32A DOS extender (configurable stub) 773>>>0x40 search/0x80 DOS/32A \b, DOS/32A DOS extender (embedded) 774 775# PL\0\0 signature for 32-bit DOS Applications in Phar Lap TNT PE/PL Format 776# Binaries can be created by TNT MARKPHAR.EXE or by 386LINK.EXE -markphar switch 777# FULLSCR.EXE, GDEMO.EXE, MOUSE.EXE from MSVC32s SDK and from Phar Lap TNT SDK 778>(0x3c.l) string PL\0\0 \b, PE32 executable for MS-DOS 779>>(8.s*16) search/0x50 Phar\ Lap\ Software,\ Inc. \b, Phar Lap TNT DOS extender 780 781# PX\0\0 signature for 32/64-bit DOS Applications in DOS-PE Format (https://www.japheth.de/HX.html) 782# SHDPMI.EXE, DOSTEST.EXE, GETVMODE.EXE, RMINT.EXE 783>(0x3c.l) string PX\0\0 \b, PE32 784>>(0x3c.l+24) leshort 0x020b \b+ 785>>0 clear x 786>>0 default x executable for MS-DOS 787# LOADPEX.BIN and HDLD32.BIN 788# x86 jmp near relative (0xe9 0x?? 0x??) + string "MI" (0x4d 0x49) 789>>(8.s*16) ulequad&0xffff0000ff =0x494d0000e9 \b, HX DOS extender (embedded with DPMI host) 790>>(8.s*16) ulequad&0xffff0000ff !0x494d0000e9 791# DPMIST32.BIN 792>>>(8.s*16) search/0x200 cannot\ find\ loader\ DPMILD32.EXE \b, HX DOS extender (stub) 793# LOADPE.BIN 794>>>(8.s*16) search/0x600 PATH=HDPMI32.EXE \b, HX DOS extender (embedded without DPMI host) 795# DPMILD32.BIN 796>>>(8.s*16) search/0x4000 DPMILD32: \b, HX DOS extender (embedded without DPMI host) 797 798>0 clear x 799# Skip already parsed binary types 800# If magic in the branch is not parsed then always jumps to mz-unrecognized 801>(0x3c.l) string PE\0\0 802>(0x3c.l) string PL\0\0 803>(0x3c.l) string PX\0\0 804>(0x3c.l) string LX 805>(0x3c.l) string NE 806>>(0x3c.l-0x02) string !IMNE 807>>>0x18 uleshort <0x40 808>>>>0 use mz-unrecognized 809>(0x3c.l) string W3 810>>0x18 uleshort <0x40 811>>>0 use mz-unrecognized 812>(0x3c.l) string W4 813>>0x18 uleshort <0x40 814>>>0 use mz-unrecognized 815>(0x3c.l) string LE\0\0 816>>0x18 uleshort <0x40 817>>>0 use mz-unrecognized 818>(0x3c.l) string LC 819>>0x18 uleshort <0x40 820>>>0 use mz-unrecognized 821>0 default x 822# This sequence jumps to the next MZ overlay 823>>2 leshort !0 824# FIXME: Following line does not match binaries which total size is less than (4.s*512) 825>>>(4.s*512) leshort x 826>>>>&(2.s-514) leshort x 827>>>>>&-2 use mz-next-overlay 828>>>>>&-2 string BW 829>>>>>>0 use mz-bw-collection 830>>>>>&-2 string 3P 831>>>>>>0 use mz-3p 832>>>>0 default x 833>>>>>0 use mz-unrecognized 834>>>0 default x 835>>>>0 use mz-unrecognized 836>>2 leshort 0 837>>>(4.s*512) leshort x 838>>>>&-2 use mz-next-overlay 839>>>>&-2 string BW 840>>>>>0 use mz-bw-collection 841>>>>&-2 string 3P 842>>>>>0 use mz-3p 843>>>0 default x 844>>>>0 use mz-unrecognized 845 846# Parse content of the COFF, executable type was already printed in mz-next-overlay 847>(4.s*512) leshort 0x014c 848#!:mime application/x-dosexec 849# djgpp go32 v1 COFF 850# F2C.EXE from f2c95201.zip or compress.exe from djdev112.zip 851>>(&-6.l) string/b StubInfoMagic!!\0 for MS-DOS 852# djgpp go32 v2 COFF 853>>(8.s*16) string go32stub for MS-DOS 854>>(8.s*16) string emx 855>>>&1 string x for DOS, Win or OS/2, emx %s 856>>&(&0x42.l-3) byte x 857>>>&0x26 string UPX \b, UPX compressed 858# and yet another guess: small .text, and after large .data is unusual, could be 32lite 859>>&0x2c search/0xa0 .text 860>>>&0x0b lelong <0x2000 861>>>>&0 lelong >0x6000 \b, 32lite compressed 862 863# Parse content of the a.out, executable type was already printed in mz-next-overlay 864>(4.s*512) leshort 0x010b 865# djgpp go32 v1 a.out 866>>(&-6.l) string/b StubInfoMagic!!\0 for MS-DOS 867 868# djgpp go32 v1 869# Note that for "redirect" binaries is offset (4.s*512) behind end-of-file, so access it via "default" 870>(4.s*512) clear x 871>(4.s*512) default x 872>>(&-4.l) string/b StubInfoMagic!!\0 873>>>&0 lelong >39 874>>>>&19 byte x \b, DJGPP go32 v%u 875>>>>&18 byte x \b.%u 876>>>>&17 byte x \b%c DOS extender (stub) 877>>>&0 lelong <40 \b, DJGPP go32 v1 DOS extender (stub) 878>>>&0 lelong >35 879>>>>&0 byte !0 880>>>>>&-1 string/16 x \b, autoload "%s" 881>>>&0 lelong >62 882>>>>&28 byte !0 883# zcat.exe from djdev112.zip 884>>>>>&-1 string/15 x \b, redirect to "%s" 885 886# djgpp go32 v2 887>(8.s*16) string go32stub 888# Version string is usually ", v 2.05", so skip leading spaces 889>>&0 string ,\ v\ 890>>>&0 string/4 x \b, DJGPP go32 v%s DOS extender 891>>&0 default x 892>>>&0 string/8 x \b, DJGPP go32 %s DOS extender 893>>&8 lelong >43 894>>>&24 byte 0 895# check for embedded DPMI host PMODSTUB.EXE 896>>>>0x1c string PMODSTUB.EXE (embedded PMODE/DJ) 897>>>>0x1c string !PMODSTUB.EXE 898>>>>>0x18 leshort 0 899# check for the default djgpp stub 900>>>>>>0x40 search/0x80 The\ STUB.EXE\ stub\ loader (stub) 901>>>>>>>(8.s*16) default x 902>>>>>>>>&8 lelong >83 903>>>>>>>>>&56 byte !0 904# show which DPMI host executable is autoloaded when none is running 905>>>>>>>>>>&-1 string/16 x \b, autoload "%s" 906>>>>>(0x18.s) default x 907>>>>>>&(0x6.s*4) default x 908# check for embedded DPMI host CWSDSTUB.EXE 909>>>>>>>&0 search/16 CWSDPMI 910>>>>>>>>&-7 regex/T =^CWSDPMI(\ [^\ ]+\ )? (embedded %s) 911# check for embedded DPMI host D3XD.EXE 912>>>>>>>&0 search/16 D3X 913>>>>>>>>&-3 regex/T =^D3X(\ [^\ ]+\ )? (embedded %s) 914>>>&24 byte !0 915# djtarx.exe or dxegen.exe from djdev205.zip 916>>>>&-1 string/8 x \b, redirect to "%s" 917 918>(8.s*16) string $WdX \b, WDos/X DOS extender 919 920# By now an executable type should have been printed out. The executable 921# may be a self-uncompressing archive, so look for evidence of that and 922# print it out. 923# 924# Some signatures below from Greg Roelofs, newt@uchicago.edu. 925# 926>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 927>0xe7 string LH/2\ Self-Extract \b, %s 928>0x1c string UC2X \b, UCEXE compressed 929>0x1c string WWP\ \b, WWPACK compressed 930>0x1c string RJSX \b, ARJ self-extracting archive 931>0x1c string diet \b, diet compressed 932>0x1c string LZ09 \b, LZEXE v0.90 compressed 933>0x1c string LZ91 \b, LZEXE v0.91 compressed 934>0x1c string tz \b, TinyProg compressed 935>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. \b, Self-extracting PKZIP archive 936!:mime application/zip 937# Yes, this really is "Copr", not "Corp." 938>0x1e string PKLITE\ Copr. \b, Self-extracting PKZIP archive 939!:mime application/zip 940# winarj stores a message in the stub instead of the sig in the MZ header 941>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 942>0x20 string AIN 943>>0x23 string 2 \b, AIN 2.x compressed 944>>0x23 string <2 \b, AIN 1.x compressed 945>>0x23 string >2 \b, AIN 1.x compressed 946>0x24 string LHa's\ SFX \b, LHa self-extracting archive 947!:mime application/x-lha 948>0x24 string LHA's\ SFX \b, LHa self-extracting archive 949!:mime application/x-lha 950>0x24 string \ $ARX \b, ARX self-extracting archive 951>0x24 string \ $LHarc \b, LHarc self-extracting archive 952>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 953>0x40 string aPKG \b, aPackage self-extracting archive 954>0x64 string W\ Collis\0\0 \b, Compack compressed 955>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 956>>&0xf4 search/0x140 \x0\x40\x1\x0 957>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 958>1638 string -lh5- \b, LHa self-extracting archive v2.13S 959>0x17888 string Rar! \b, RAR self-extracting archive 960 961# Skip to the end of the EXE. This will usually work fine in the PE case 962# because the MZ image is hardcoded into the toolchain and almost certainly 963# won't match any of these signatures. 964>(4.s*512) long x 965>>&(2.s-517) byte x 966>>>&0 string PK\3\4 \b, ZIP self-extracting archive 967>>>&0 string Rar! \b, RAR self-extracting archive 968>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 969>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 970>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 971>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 972>>>&7 search/400 **ACE** \b, ACE self-extracting archive 973>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 974 975# a few unknown ZIP sfxes, no idea if they are needed or if they are 976# already captured by the generic patterns above 977>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 978# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 979# 980 981# TELVOX Teleinformatica CODEC self-extractor for OS/2: 982>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 983>>49824 leshort =1 \b, 1 file 984>>49824 leshort >1 \b, %u files 985 986 987# This named instance is called for multi overlay MZ executable with offset of the next overlay 9880 name mz-next-overlay 989>0 string P2 \b, EXP (P2) for MS-DOS, Phar Lap 286 DOS extender 990>0 string P3 \b, EXP (P3) for MS-DOS, Phar Lap 386 DOS extender 991>0 string MT \b, MT for MS-DOS, IGC XMLOD i386 DOS extender 992>0 string 3P \b, 3P for MS-DOS 993# Other 3P details are printed later as they depend on the original MZ content 994>>32 lelong&0x00000001 !0 \b, 16-bit 995>>32 lelong&0x00000001 0 996# CWC.EXE from cw349bin.zip is 32-bit 997>>>32 lelong&0x00010000 0 \b, 32-bit 998# WL32.EXE from cw349bin.zip is dual mode 999>>>32 lelong&0x00010000 !0 \b, Dual mode 1000>>32 lelong&0x80000000 !0 \b, Compressed 1001>0 string D3X1 \b, D3X1 for MS-DOS, D3X DOS extender 1002# BW details are printed later as they depend on the original MZ content 1003>0 string BW \b, BW collection for MS-DOS 1004# a.out details are printed later as they depend on the original MZ content 1005>0 leshort 0x010b \b, a.out 1006# COFF details are printed later as they depend on the original MZ content 1007>0 leshort 0x014c \b, COFF 1008>0 default x 1009# now make offset aligned to 0x10 1010>>0 offset%0x10 0x0 1011# already aligned 1012>>>0x0 use mz-next-overlay-aligned 1013>>0 offset%0x10 0x1 1014>>>0xf use mz-next-overlay-aligned 1015>>0 offset%0x10 0x2 1016>>>0xe use mz-next-overlay-aligned 1017>>0 offset%0x10 0x3 1018>>>0xd use mz-next-overlay-aligned 1019>>0 offset%0x10 0x4 1020>>>0xc use mz-next-overlay-aligned 1021>>0 offset%0x10 0x5 1022>>>0xb use mz-next-overlay-aligned 1023>>0 offset%0x10 0x6 1024>>>0xa use mz-next-overlay-aligned 1025>>0 offset%0x10 0x7 1026>>>0x9 use mz-next-overlay-aligned 1027>>0 offset%0x10 0x8 1028>>>0x8 use mz-next-overlay-aligned 1029>>0 offset%0x10 0x9 1030>>>0x7 use mz-next-overlay-aligned 1031>>0 offset%0x10 0xa 1032>>>0x6 use mz-next-overlay-aligned 1033>>0 offset%0x10 0xb 1034>>>0x5 use mz-next-overlay-aligned 1035>>0 offset%0x10 0xc 1036>>>0x4 use mz-next-overlay-aligned 1037>>0 offset%0x10 0xd 1038>>>0x3 use mz-next-overlay-aligned 1039>>0 offset%0x10 0xe 1040>>>0x2 use mz-next-overlay-aligned 1041>>0 offset%0x10 0xf 1042>>>0x1 use mz-next-overlay-aligned 10430 name mz-next-overlay-aligned 1044>0 string MP \b, EXP (MP) for MS-DOS, Phar Lap 386 DOS extender 1045>0 default x 1046>>0 use mz-unrecognized 1047 1048 1049# This named instance is called for unrecognized MZ DOS binary from any offset 10500 name mz-unrecognized 1051>0 default x \b, MZ for MS-DOS 1052!:mime application/x-dosexec 1053# Windows and later versions of DOS will allow .EXEs to be named with a .COM 1054# extension, mostly for compatibility's sake. 1055# like: EDIT.COM 4DOS.COM CMD8086.COM CMD-FR.COM SYSLINUX.COM 1056# URL: https://en.wikipedia.org/wiki/Personal_NetWare#VLM 1057# Reference: https://mark0.net/download/triddefs_xml.7z/defs/e/exe-vlm-msg.trid.xml 1058# also like: BGISRV.DRV 1059!:ext exe/com/vlm/drv 1060 1061 1062# This named instance is called for BW collection with offset from the beginning of the file 10630 name mz-bw-collection 1064>(8.s*16) default x 1065>>&(&0x30.s) default x 1066>>>&0 string DOS/16M \b, DOS/16M DOS extender (embedded) 1067>>>&-8 string DOS/16M \b, DOS/16M DOS extender (embedded) 1068>>>&-8 string DOS/4G \b, DOS/4G DOS extender (embedded) 1069>>>0 default x 1070>>>>(8.s*16) search/0x4000 Stub\ failed\ to\ find\ DOS/4G\ extender. \b, DOS/4G DOS extender (stub) 1071 1072 1073# This named instance is called for CauseWay MZ 3P binary with offset from the beginning of the file 10740 name mz-3p 1075# CWC.EXE and WL32.EXE from cw349bin.bin 1076>0x440 search/0x100 CauseWay\ DOS\ Extender \b, CauseWay DOS extender 1077# CWHELP.EXE from cw349bin.bin 1078>0x200 search/0x100 CauseWay\ dynamic\ link\ library \b, CauseWay DLL 1079 1080 1081# Summary: OS/2 LX Library and device driver (no DOS stub) 1082# From: Joerg Jenderek 1083# URL: http://en.wikipedia.org/wiki/EXE 1084# Reference: http://www.textfiles.com/programming/FORMATS/lxexe.txt 1085# https://github.com/open-watcom/open-watcom-v2/blob/master/bld/watcom/h/exeflat.h 1086# https://github.com/bitwiseworks/os2tk45/blob/master/h/exe386.h 1087# https://archive.org/download/IBMOS2Warp4ToolkitDocuments2/lxref.htm 1088# Note: by dll-os2-no-dos-stub.trid.xml called "OS/2 Dynamic Link Library (no DOS stub)" 1089# similar looking like variant with MS-DOS stub (MZ magic): "MS-DOS executable, LX" 10900 string/b LX LX executable 1091#!:mime application/x-msdownload 1092!:mime application/x-lx-executable 1093>2 uleshort =0x0000 1094>>0 use lx-executable 1095# no examples found for big endian variant 1096>2 uleshort =0x0101 1097>>0 use \^lx-executable 1098# no examples found for PDP-11 endian variant 1099>2 uleshort =0x0100 1100# PDP-11-endian is not supported by magic "use" keyword yet 1101# no examples found for other endian variants 1102>>0 default x 1103# other endianity is not supported by magic "use" keyword 1104 11050 name lx-executable 1106# FOR DEBUGGING! 1107# byte order: 00h~little-endian 01h~big-endian 1108#>0x02 ubyte =0 \b, little-endian byte order 1109#>0x02 ubyte =1 \b, big-endian word order 1110# word order: 00h~little-endian 01h~big-endian 1111#>0x03 ubyte =0 \b, little-endian word order 1112#>0x03 ubyte =1 \b, big-endian word order 1113# cpu_type; CPU type like: 1~i286 2~i386 3~i486 4~i586 20h~i860-N10 21h~i860-N11 40h~MIPS R2000,R3000 41h~MIPS R6000 42h~MIPS R4000 1114#>0x08 uleshort x \b, CPU %u 1115# os_type; target operating system like: 0~unknown 1~OS/2 2~Windows 16-bit 3~Multitasking MS-DOS 4.x 4~Windows 386 5~IBM Microkernel PN 1116#>0x0A leshort x \b, OS %u 1117# flags; module type flags 1118#>0x10 ulelong x \b, FLAGS %#8.8x 1119# 00000002h ~Reserved for system use 1120#>0x10 ulelong &0x00000002 \b, 2h reserved 1121# OSF_INIT_INSTANCE=00000004h ~Per-Process Library Initialization; setting this bit for EXE file is invalid 1122#>0x10 ulelong &0x00000004 \b, per-process library Initialization 1123#>0x10 ulelong &0x00000008 \b, system dll 1124# OSF_INTERNAL_FIXUPS_DONE=00000010h ~Internal fixups for the module have been applied 1125#>0x10 ulelong &0x00000010 \b, int. fixup 1126# OSF_EXTERNAL_FIXUPS_DONE=00000020h ~External fixups for the module have been applied 1127#>0x10 ulelong &0x00000020 \b, ext. fixup 1128# OSF_NOT_PM_COMPATIBLE=00000100h ~Incompatible with PM windowing 1129#>0x10 ulelong&0x00000700 =0x00000100 \b, incompatible with PM windowing 1130# OSF_PM_COMPATIBLE=00000200h ~Compatible with PM windowing 1131#>0x10 ulelong&0x00000700 =0x00000200 \b, compatible with PM windowing 1132#>0x10 ulelong&0x00000700 =0x00000300 \b, uses PM windowing API 1133#>0x10 ulelong &0x00002000 \b, not loadable 1134#>0x10 ulelong &0x00008000 \b, library module 1135# bit 17; device driver 1136#>0x10 ulelong &0x00020000 \b, device driver 1137#>0x10 ulelong &0x00080000 \b, multiple-processor unsafe 1138# Per-process Library Termination; setting this bit for EXE file is invalid 1139#>0x10 ulelong &0x40000000 \b, per-process library termination 1140# OS type 1141>0x0a clear x 1142>0x0a leshort 1 for OS/2 1143# OS 2 was reserved for MS Windows 16-bit but it never used LX (NE format was used instead) 1144#>0x0a leshort 2 for MS Windows 16-bit 1145# OS 3 was reserved for Multitasking MS-DOS but it never used LX (NE format was used instead) 1146#>0x0a leshort 3 for Multitasking MS-DOS 1147# OS 4 was reserved for MS Windows device drivers but it never used LX (LE format was used instead) 1148#>0x0a leshort 4 for MS Windows 1149# OS 5 was reserved for IBM Microkernel Personality Neutral but it never used LX (the only released IBM Workplace OS for PowerPC used ELF format) 1150#>0x0a leshort 5 for IBM Microkernel Personality Neutral 1151>0x0a default x 1152>>0x0a leshort x for unknown OS %#x 1153# http://www.ctyme.com/intr/rb-2939.htm#Table1610 1154# library by module type mask 00038000h (bits 15-17); 1155# 0h ~executable Program module 1156>0x10 ulelong&0x00038000 =0x00000000 (EXE) 1157!:ext exe 1158# bits 8-10; OSF_PM_APP=700h in flags ~Uses PM windowing API; either it is GUI or console 1159>>0x10 ulelong&0x00000700 =0x00000100 (full screen) 1160>>0x10 ulelong&0x00000700 =0x00000200 (console) 1161>>0x10 ulelong&0x00000700 =0x00000300 (GUI) 1162>0x10 ulelong&0x00038000 =0x00008000 (DLL) 1163!:ext dll 1164>0x10 ulelong&0x00038000 =0x00010000 (unknown) 1165>0x10 ulelong&0x00038000 =0x00018000 (PMDLL) 1166>0x10 ulelong&0x00038000 =0x00020000 (PDD) 1167!:ext sys 1168>0x10 ulelong&0x00038000 =0x00028000 (VDD) 1169!:ext sys 1170>0x10 ulelong&0x00038000 =0x00030000 (DLD) 1171>0x10 ulelong&0x00038000 =0x00038000 (unknown) 1172# CPU type 1173>0x08 clear x 1174>0x08 uleshort 1 \b, Intel i286 1175# all inspected examples 1176>0x08 uleshort 2 \b, Intel i386 1177>0x08 uleshort 3 \b, Intel i486 1178>0x08 uleshort 4 \b, Intel i586 1179# 20h Intel i860 N10 or compatible 1180# 21h Intel i860 N11 or compatible 1181# 40h MIPS Mark I ( R2000, R3000) or compatible 1182# 41h MIPS Mark II ( R6000 ) or compatible 1183# 42h MIPS Mark III ( R4000 ) or compatible 1184>0x08 default x 1185>>0x08 uleshort x \b, unknown CPU %#x 1186# Endianity for debugging, there are no samples for non-little-endian 1187#>0x02 clear x 1188#>0x02 uleshort =0x0000 (little-endian) 1189#>0x02 uleshort =0x0101 (big-endian) 1190#>0x02 uleshort =0x0100 (PDP-11-endian) 1191#>0x02 default x (unknown-endian) 1192 1193# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc 1194# and https://www.freedos.org/software/?prog=kpdos 1195# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 11960 string/b KCF FreeDOS KEYBoard Layout collection 1197# only version=0x100 found 1198>3 uleshort x \b, version %#x 1199# length of string containing author,info and special characters 1200>6 ubyte >0 1201#>>6 pstring x \b, name=%s 1202>>7 string >\0 \b, author=%-.14s 1203>>7 search/254 \xff \b, info= 1204#>>>&0 string x \b%-s 1205>>>&0 string x \b%-.15s 1206# for FreeDOS *.KL files 12070 string/b KLF FreeDOS KEYBoard Layout file 1208# only version=0x100 or 0x101 found 1209>3 uleshort x \b, version %#x 1210# stringlength 1211>5 ubyte >0 1212>>8 string x \b, name=%-.2s 12130 string \xffKEYB\ \ \ \0\0\0\0 1214>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 1215 1216# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017,Aug 2020,Mar 2023 1217# URL: http://fileformats.archiveteam.org/wiki/DOS_device_driver 1218# Reference: http://www.delorie.com/djgpp/doc/rbinter/it/46/16.html 1219# http://www.o3one.org/hwdocs/bios_doc/dosref22.html 12200 ulequad&0x07a0ffffffff 0xffffffff 1221# skip OS/2 INI ./os2 1222>4 ubelong !0x14000000 1223#>>10 ubequad x MAYBE_DRIVER_NAME=%16.16llx 1224# https://bugs.astron.com/view.php?id=434 1225# skip OOXML document fragment 0000.dat where driver name is "empty" instead of "ASCII like" 1226>>10 ubequad !0 1227>>>0 use msdos-driver 12280 name msdos-driver DOS executable ( 1229#!:mime application/octet-stream 1230!:mime application/x-dosdriver 1231# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN 1232# and IBM Token-Ring adapter IBMTOK.DOS. Why and when DOS instead SYS is used? 1233# PROTMAN.DOS ELNKPL.DOS 1234!:ext sys/dev/bin/dos 1235# 1 space char after "UPX compressed" to get phrase like "UPX compressed character device" 1236>40 search/7 UPX! \bUPX compressed 1237# DOS device driver attributes 1238>4 uleshort&0x8000 0x0000 \bblock device driver 1239# character device 1240>4 uleshort&0x8000 0x8000 \b 1241# 1 space char after "clock" to get phrase like "clock character device driver CLOCK$" 1242>>4 uleshort&0x0008 0x0008 \bclock 1243# fast video output by int 29h 1244# 1 space char after "fast" to get phrase like "fast standard input/output character device driver" 1245>>4 uleshort&0x0010 0x0010 \bfast 1246# standard input/output device 1247# 1 space char after "standard" to get phrase like "standard input/output character device driver" 1248>>4 uleshort&0x0003 >0 \bstandard 1249>>>4 uleshort&0x0001 0x0001 \binput 1250>>>4 uleshort&0x0003 0x0003 \b/ 1251# 1 space char after "output" to get phrase like "input/output character device driver" 1252>>>4 uleshort&0x0002 0x0002 \boutput 1253>>4 uleshort&0x8000 0x8000 \bcharacter device driver 1254>0 ubyte x 1255# upx compressed device driver has garbage instead of real in name field of header 1256>>40 search/7 UPX! 1257>>40 default x 1258# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 1259# 1 space char before device driver name to get phrase like "device driver PROTMAN$" "device driver HP-150II" "device driver PC$MOUSE" 1260>>>12 ubyte >0x23 \b 1261>>>>10 ubyte >0x20 1262>>>>>10 ubyte !0x2E 1263>>>>>>10 ubyte !0x2A \b%c 1264>>>>11 ubyte >0x20 1265>>>>>11 ubyte !0x2E \b%c 1266>>>>12 ubyte >0x20 1267>>>>>12 ubyte !0x39 1268>>>>>>12 ubyte !0x2E \b%c 1269>>>13 ubyte >0x20 1270>>>>13 ubyte !0x2E \b%c 1271>>>>14 ubyte >0x20 1272>>>>>14 ubyte !0x2E \b%c 1273>>>>15 ubyte >0x20 1274>>>>>15 ubyte !0x2E \b%c 1275>>>>16 ubyte >0x20 1276>>>>>16 ubyte !0x2E 1277>>>>>>16 ubyte <0xCB \b%c 1278>>>>17 ubyte >0x20 1279>>>>>17 ubyte !0x2E 1280>>>>>>17 ubyte <0x90 \b%c 1281# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 1282>>>12 ubyte <0x2F 1283# they have their real name at offset 22 1284# also block device drivers like DUMBDRV.SYS 1285>>>>22 string >\056 %-.6s 1286>4 uleshort&0x8000 0x0000 1287# 32 bit sector addressing ( > 32 MB) for block devices 1288>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 1289# support by driver functions 13h, 17h, 18h 1290>4 uleshort&0x0040 0x0040 \b,IOCTL- 1291# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 1292>4 uleshort&0x0800 0x0800 \b,close media- 1293# output until busy support by int 10h for character device driver 1294>4 uleshort&0x8000 0x8000 1295>>4 uleshort&0x2000 0x2000 \b,until busy- 1296# direct read/write support by driver functions 03h,0Ch 1297>4 uleshort&0x4000 0x4000 \b,control strings- 1298>4 uleshort&0x8000 0x8000 1299>>4 uleshort&0x6840 >0 \bsupport 1300>4 uleshort&0x8000 0x0000 1301>>4 uleshort&0x4842 >0 \bsupport 1302>0 ubyte x \b) 1303>0 ulelong !0xffffffff with pointer %#x 1304# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 13050 ulequad 0x0513c00000000012 1306>0 use msdos-driver 1307# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field 13080 ulequad 0x32f28000ffff0016 1309>0 use msdos-driver 13100 ulequad 0x007f00000000ffff 1311>0 use msdos-driver 1312# https://www.uwe-sieber.de/files/cfg_echo.zip 13130 ulequad 0x001600000000ffff 1314>0 use msdos-driver 1315# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field 13160 ulequad 0x0bf708c2ffffffff 1317>0 use msdos-driver 13180 ulequad 0x07bd08c2ffffffff 1319>0 use msdos-driver 1320# 3Com EtherLink 3C501 CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\ELNK.DOS 13210 ulequad 0x027ac0c0ffffffff 1322>0 use msdos-driver 1323# IBM Streamer CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\IBMMPC.DOS 13240 ulequad 0x00228880ffffffff 1325>0 use msdos-driver 1326 1327# updated by Joerg Jenderek 1328# GRR: line below too general as it catches also 1329# rt.lib DYADISKS.PIC and many more 1330# start with assembler instruction MOV 13310 ubyte 0x8c 1332# skip "AppleWorks word processor data" like ARTICLE.1 ./apple 1333>4 string !O==== 1334# skip some unknown basic binaries like RocketRnger.SHR 1335>>5 string !MAIN 1336# skip "GPG symmetrically encrypted data" ./gnu 1337# skip "PGP symmetric key encrypted data" ./pgp 1338# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type 1339>>>4 ubyte >13 1340>>>>0 use msdos-com 1341# the remaining files should be DOS *.COM executables 1342# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd 1343# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4 1344# UNDELETE.COM 8cca 2e8916 6503 b430 cd21 8b 2e0200 8b 1345# BOOTFIX.COM 8cca 2e8916 9603 b430 cd21 8b 2e0200 8b 1346# RAWRITE3.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 1347# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 1348# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e 1349# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e 1350 13510 name msdos-com 1352# URL: http://fileformats.archiveteam.org/wiki/DOS_executable_(.com) 1353>0 byte x DOS executable ( 1354# DOS executable with JuMP 16-bit instruction 1355>0 byte =0xE9 1356# check for probably nil padding til offset 64 of Lotus driver name 1357>>56 quad =0 1358# check for "long" alphabetic Lotus driver name like: 1359# Diablo "COMPAQ Text Display" "IBM Monochrome Display" "Plantronics ColorPlus" 1360>>>24 regex =^[A-Z][A-Za-z\040]{5,21} \bLotus driver) %s 1361!:mime application/x-dosexec 1362# like: CPQ0TD.DRV IBM0MONO.DRV (Lotus 123 10a) SDIAB4.DRV SPL0CPLS.DRV (Lotus Symphony 2) 1363!:ext drv 1364# COM with nils like MODE.COM IBMDOS.COM (pcdos 3.31 ru Compaq) RSSTUB.COM (PC-DOS 2000 de) ACCESS.COM (Lotus Symphony 1) 1365>>>24 default x \bCOM) 1366!:mime application/x-dosexec 1367!:ext com 1368# DOS executable with JuMP 16-bit and without nil padding 1369>>56 quad !0 1370# https://wiki.syslinux.org/wiki/index.php?title=Doc/comboot 1371# TODO: HOWTO distinguish COMboot from pure DOS executables? 1372# look for unreliable Syslinux specific api call INTerrupt 22h for 16-bit COMBOOT program 1373>>>1 search/0xc088 \xcd\x22 \bCOM or COMBOOT 16-bit) 1374!:mime application/x-dosexec 1375# like: sbm.cbt command.com (Windows XP) UNI2ASCI.COM (FreeDOS 1.2) 1376!:ext com/cbt 1377>>>1 default x \bCOM) 1378!:mime application/x-dosexec 1379!:ext com 1380# DOS executable without JuMP 16-bit instruction 1381>0 byte !0xE9 1382# SCREATE.SYS https://en.wikipedia.org/wiki/Stac_Electronics 1383>>10 string =?STACVOL \bSCREATE.SYS) 1384!:mime application/x-dosexec 1385!:ext sys 1386# COM executable without JuMP 16-bit instruction and not SCREATE.SYS 1387>>10 string !?STACVOL \bCOM) 1388!:mime application/x-dosexec 1389!:ext com 1390>6 string SFX\ of\ LHarc \b, %s 1391>0x1FE leshort 0xAA55 \b, boot code 1392>85 string UPX \b, UPX compressed 1393>4 string \ $ARX \b, ARX self-extracting archive 1394>4 string \ $LHarc \b, LHarc self-extracting archive 1395>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 1396# like: E30ODI.COM MADGEODI.COM UNI2ASCI.COM RECOVER.COM (DOS 2) COMMAND.COM (DOS 2) 1397>1 search/0xc088 \xcd\x22 \b, maybe with interrupt 22h 1398>0 ubelong x \b, start instruction %#8.8x 1399# show more instructions but not in samples like: rem.com (DJGPP) 1400>4 ubelong x %8.8x 1401 1402# JMP 8bit 14030 byte 0xeb 1404# byte 0xeb conflicts with magic leshort 0xn2eb of "SYMMETRY i386" handled by ./sequent 1405# allow forward jumps only 1406>1 byte >-1 1407# that offset must be accessible 1408# with hexadecimal values like: 0e 2e 50 8c 8d ba bc bd be e8 fb fc 1409>>(1.b+2) byte x 1410# if look like COM executable with x86 boot signature then this 1411# implies FAT volume with x86 real mode code already handled by ./filesystems 1412# 1413# No x86 boot signature implies often DOS executable 1414# check for unrealistic high number of FATs. Then it is an unusual disk image or often a DOS executable 1415# like: FIXBIOS.COM (50 bytes) 1416>>>16 ubyte >3 1417# https://www.drivedroid.io/ 1418# skip MBR disk image drivedroid.img version 12 July 2013 by start message 1419>>>>2 string !DriveDroid 1420# ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/ 1421# skip unusual floppy image disk1.img of MS-DOS 1.25 (Corona Data Systems OEM) 1422# by check for characteristic message text near the beginning 1423>>>>>15 string !Non\040System\040disk 1424# "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 4.0.rar" 1425# skip BeOS 4 bootfloppy.img done as "Linux kernel x86 boot executable" by ./linux 1426# by check for characteristic message text near the beginning 1427>>>>>>6 string !read\040error\015 1428# https://github.com/ventoy/Ventoy/releases/download/v1.0.78/ventoy-1.0.78-windows.zip 1429# skip ventoy 1.0.78 boot_hybrid.img 1430>>>>>>>24 string !\220\220\353I$\022\017 1431# "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/PC-DOS 1.0 (5.25).rar" 1432# skip unusual floppy image PCDOS100.IMG of DOS 1.0 1433# by check for characteristic message text near the beginning 1434>>>>>>>>9 string !7-May-81 1435# "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 5.0 Personal (BA).rar" 1436# skip BeOS 5 floppy_1.44.00.ima done as "DOS/MBR boot sector" by ./filesystems 1437# by check for characteristic message near the beginning 1438>>>>>>>>>3 string !\370sdfS\270 1439# like: FIXBIOS.COM (50 bytes) 1440>>>>>>>>>>0 use msdos-com 1441# check for unrealistic low number of FATs. Then it is an unusual FAT disk image or often a DOS executable 1442# like: DEVICE.COM INSTALL.COM (GAG 4.10) WORD.COM (Word 1.15) 1443>>>16 ubyte =0 1444# if low FATs with x86 boot signature it can be unusual disk image like: boot.img (Ventoy 1.0.27) geodspms.img (Syslinux) 1445>>>>0x1FE leshort =0xAA55 1446>>>>0x1FE default x 1447# https://thestarman.pcministry.com/tool/hxd/dimtut.htm 1448# skip unusual floppy image TK-DOS11.img IBMDOS11.img of IBM DOS 1.10 1449# by check for characteristic bootloader names near end of boot sector 1450>>>>>395 string !ibmbio\040\040com 1451>>>>>>0 use msdos-com 1452# 8-bit jump with valid number of FAT implies FAT volume already handled by ./filesystems 1453# like: balder.img 1454>>>16 default x 1455# skip disk images with boot signature at end of 1st sector 1456# like: TDSK-64b.img 1457>>>>(11.s-2) uleshort !0xAA55 1458# skip unusual floppy image without boot signature like 360k-256.img (mtools 4.0.18) 1459# by check for characteristic file system type text for FAT (12 bit or 16 bit) 1460>>>>>54 string !FAT 1461# "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/Microsoft MS-DOS 3.31 (Compaq OEM) (3.5).rar" 1462# skip unusual floppy image Disk4.img without boot signature and file system type text 1463# by check for characteristic OEM-ID text 1464>>>>>>3 string !COMPAQ\040\040 1465# no such DOS COM executables found 1466>>>>>>>0 use msdos-com 1467# JMP 16bit 14680 byte 0xe9 1469# display DOS executable (COM or COMBOOT 16-bit strength=40=40-0) after ESP-IDF application image (strength=40=40+0) handled by ./firmware 1470#!:strength -0 1471# 16-bit offset; for DEBUGGING!; can be negative like: USBDRIVE.COM 1472# 2h (CPQ0TD.DRV) 4FEh (NDN.COM) 581h (DRMOUSE.COM) 1FDh (GAG.COM) BE07h (USBDRIVE.COM) 1473#>1 uleshort x \b, OFFSET=%#4.4x 1474#>1 leshort x \b, OFFSET %d 1475# forward jumps 1476>1 leshort >-1 1477# that offset must be accessible 1478# with hexadecimal values like: 06 1e 0e 2e 60 8c 8d b4 ba be e8 fc 1479>>(1.s+3) byte x 1480# check for unrealistic high number of FATs. Then it is not a disk image and it is a DOS executable 1481# like: CALLVER.COM CPUCACHE.COM K437_EUR.COM SHSUCDX.COM UMBFILL.COM (183 bytes) 1482>>>16 ubyte >3 1483>>>>0 use msdos-com 1484# check for unrealistic low number of FATs. Then it is not a disk image and it is a DOS executable 1485# like: GAG.COM DRMOUSE.COM NDN.COM CPQ0TD.DRV 1486# or ESP-IDF application image like: WLED_0.14.0_ESP32-C3.bin opendtu-generic_esp32.bin 1487>>>16 ubyte =0 1488# skip ESP-IDF application image handled by ./firmware with ESP_APP_DESC_MAGIC_WORD 1489>>>>32 ulelong !0xABCD5432 1490>>>>>0 use msdos-com 1491# maybe disc image with valid number of FATs or DOS executable 1492# like: IPXODI.COM PERUSE.COM TASKID.COM 1493>>>16 default x 1494# invalid low media descriptor. Then it is not a disk image and it is a DOS executable 1495>>>>21 ubyte <0xE5 1496>>>>>0 use msdos-com 1497# valid media descriptor. Then it is maybe disk image or DOS executable 1498>>>>21 ubyte >0xE4 1499# invalid sectorsize not a power of 2 from 32-32768. Then it is not a disk image and it must be DOS executable 1500# like: LEARN.COM (Word 1.15) 1501>>>>>11 uleshort&0x001f !0 1502>>>>>>0 use msdos-com 1503# negative offset, must not lead into PSP 1504# like: BASICA.COM (PC dos 3.20) FORMAT.COM SMC8100.COM WORD.COM (word4) 1505# HIDSUPT1.COM USBDRIVE.COM USBSUPT1.COM USBUHCI.COM (FreeDOS USBDOS) 1506>1 leshort <-259 1507# that offset must be accessible 1508# add 10000h to jump at end of 64 KiB segment, add 1 for jump instruction and 2 for 16-bit offset 1509>>(1.s+65539) byte x 1510# after jump next instruction for DEBUGGING! 1511#>>>&-1 ubelong x \b, NEXT instruction %#8.8x 1512>>>0 use msdos-com 1513 1514# updated by Joerg Jenderek at Oct 2008,2015,2022 1515# following line is too general 15160 ubyte 0xb8 1517# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux 1518>0 string !\xb8\xc0\x07\x8e 1519# modified by Joerg Jenderek 1520# syslinux COM32 or COM32R executable 1521>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT 1522# https://www.syslinux.org/wiki/index.php/Comboot_API 1523# Since version 5.00 c32 modules switched from the COM32 object format to ELF 1524!:mime application/x-c32-comboot-syslinux-exec 1525!:ext c32 1526# https://syslinux.zytor.com/comboot.php 1527# older syslinux version ( <4 ) 1528# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 1529# start with assembler instructions mov eax,21cd4cffh 1530>>>1 lelong 0x21CD4CFf \b) 1531# syslinux:doc/comboot.txt 1532# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 1533# eax,21cd4cfeh) as a magic number. 1534# syslinux version (4.x) 1535# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID 1536>>>1 lelong 0x21CD4CFe \b, relocatable) 1537>>1 default x 1538# look for interrupt instruction like in rem.com (DJGPP) LOADER.COM (DR-DOS 7.x) 1539>>>3 search/118 \xCD 1540# FOR DEBUGGING; possible hexadecimal interrupt number like: 10~BANNER.COM 13~bcdw_cl.com 15~poweroff.com (Syslinux) 1541# 1A~BERNDPCI.COM 20~SETENHKB.COM 21~mostly 22~gfxboot.com (Syslinux) 2F~SHUTDOWN.COM (GEMSYS) 1542#>>>>&0 ubyte x \b, INTERUPT %#x 1543# few examples with interrupt 0x13 instruction 1544>>>>&0 ubyte =0x13 1545# FOR DEBUGGING! 1546#>>>>>3 ubequad x \b, 2nd INSTRUCTION %#16.16llx 1547# skip Gpt.com Mbr.com (edk2-UDK2018 bootsector) described as "DOS/MBR boot sector" by ./filesystems 1548# by check for assembler instructions: mov es,ax ; mov ax,07c0h ; mov ds,ax 1549>>>>>3 ubequad !0x8ec0b8c0078ed88d 1550# few COM executables with interrupt 0x13 instruction like: Bootable CD Wizard executables bcdw_cl.com fdemuoff.com 1551# http://bootcd.narod.ru/bcdw150z_en.zip 1552>>>>>>0 use msdos-com 1553# few examples with interrupt 0x16 instruction like flashimg.img 1554>>>>&0 ubyte =0x16 1555# skip Syslinux 3.71 flashimg.img done as "DOS/MBR boot sector" by ./filesystems 1556# by check for assembler instructions: cmp ax 0xE4E4 (magic); jnz 1557>>>>>8 ubelong !0x3DE4E475 1558# no DOS executable with interrupt 0x16 found 1559>>>>>>0 use msdos-com 1560# most examples with interrupt instruction unequal 0x13 and 0x16 1561>>>>&0 default x 1562#>>>>>&-1 ubyte x \b, INTERUPT %#x 1563# like: LOADER.COM SETENHKB.COM banner.com copybs.com gif2raw.com poweroff.com rem.com 1564>>>>>0 use msdos-com 1565# few COM executables without interrupt instruction like RESTART.COM (DOS 7.10) REBOOT.COM 1566# or some EUC-KR text files or one Ulead Imaginfo thumbnail 1567>>>3 default x 1568# FOR DEBUGGING; 2nd instruction like 0x50 (RESTART.COM) 0x8e (REBOOT.COM) 1569# or random like: 0x0 (IMAGINFO.PE3 sky_snow) 0xb1 (euckr_.txt) 1570#>>>>3 ubyte x \b, 2nd INSTRUCTION %#x 1571# skip 1 Ulead Imaginfo thumbnail (IMAGINFO.PE3 sky_snow) 1572# inside SAMPLES/TEXTURES/SKY_SNOW 1573# from https://archive.org/download/PI3CANON/PI3CANON.iso 1574>>>>3 ubyte !0x0 1575# skip some EUC-KR text files like: euckr_falsepositive.txt 1576# https://bugs.astron.com/view.php?id=186 1577>>>>>3 ubyte !0xb1 1578# like: RESTART.COM (DOS 7.10) REBOOT.COM 1579>>>>>>0 use msdos-com 1580 1581# URL: https://en.wikipedia.org/wiki/UPX 1582# Reference: https://github.com/upx/upx/archive/v3.96.zip/upx-3.96/ 1583# src/stub/src/i086-dos16.com.S 1584# Update: Joerg Jenderek 1585# assembler instructions: cmp sp, offset sp_limit 15860 string/b \x81\xfc 1587#>2 uleshort x \b, sp_limit=%#x 1588# assembler instructions: jump above +2; int 0x20; mov cx, offset bytes_to_copy 1589>4 string \x77\x02\xcd\x20\xb9 1590#>9 uleshort x \b, [bytes_to_copy]=%#x 1591# at different offsets assembler instructions: push di; jump decomp_start_n2b 1592>0x1e search/3 \x57\xe9 1593#>>&0 uleshort x \b, decomp_start_n2b=%#x 1594# src/stub/src/include/header.S; UPX_MAGIC_LE32 1595>>&2 string UPX! FREE-DOS executable (COM), UPX 1596!:mime application/x-dosexec 1597# UPX compressed *.CPI; See ./fonts 1598>>>&21 string =FONT compressed DOS code page font 1599!:ext cpx 1600>>>&21 string !FONT compressed 1601!:ext com 1602# compressed size? 1603#>>>&14 uleshort+152 x \b, %u bytes 1604# uncompressed len 1605>>>&12 uleshort x \b, uncompressed %u bytes 1606252 string Must\ have\ DOS\ version DR-DOS executable (COM) 1607!:mime application/x-dosexec 1608!:ext com 1609# GRR search is not working 1610#2 search/28 \xcd\x21 COM executable for MS-DOS 1611#WHICHFAT.cOM 16122 string \xcd\x21 COM executable for DOS 1613!:mime application/x-dosexec 1614!:ext com 1615#DELTREE.cOM DELTREE2.cOM 16164 string \xcd\x21 COM executable for DOS 1617!:mime application/x-dosexec 1618!:ext com 1619#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 16205 string \xcd\x21 COM executable for DOS 1621!:mime application/x-dosexec 1622!:ext com 1623#DELTMP.COm HASFAT32.cOM 16247 string \xcd\x21 1625>0 byte !0xb8 COM executable for DOS 1626!:mime application/x-dosexec 1627!:ext com 1628#COMP.cOM MORE.COm 162910 string \xcd\x21 1630>5 string !\xcd\x21 COM executable for DOS 1631!:mime application/x-dosexec 1632!:ext com 1633#comecho.com 163413 string \xcd\x21 COM executable for DOS 1635!:mime application/x-dosexec 1636!:ext com 1637#HELP.COm EDIT.coM 163818 string \xcd\x21 1639# not printable before it? 1640>17 byte >32 1641>>17 byte <126 1642>>17 default x COM executable for MS-DOS 1643!:mime application/x-dosexec 1644!:ext com 1645#NWRPLTRM.COm 164623 string \xcd\x21 COM executable for MS-DOS 1647!:mime application/x-dosexec 1648!:ext com 1649#LOADFIX.cOm LOADFIX.cOm 165030 string \xcd\x21 COM executable for MS-DOS 1651!:mime application/x-dosexec 1652!:ext com 1653#syslinux.com 3.11 165470 string \xcd\x21 COM executable for DOS 1655!:mime application/x-dosexec 1656!:ext com 1657# many compressed/converted COMs start with a copy loop instead of a jump 16580x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 1659!:mime application/x-dosexec 1660!:ext com 16610x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 1662!:mime application/x-dosexec 1663!:ext com 1664>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 16650x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 1666!:mime application/x-dosexec 1667!:ext com 1668# FIXME: missing diet .com compression 1669 1670# miscellaneous formats 16710 string/b LZ MS-DOS executable (built-in) 1672#0 byte 0xf0 MS-DOS program library data 1673# 1674 1675# AAF files: 1676# <stuartc@rd.bbc.co.uk> Stuart Cunningham 16770 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 1678>30 byte 9 (512B sectors) 1679>30 byte 12 (4kB sectors) 16800 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 1681>30 byte 9 (512B sectors) 1682>30 byte 12 (4kB sectors) 1683 1684# Popular applications 1685# 1686# Update: Joerg Jenderek 1687# URL: http://fileformats.archiveteam.org/wiki/DOC 1688# Reference: https://web.archive.org/web/20170206041048/ 1689# http://www.msxnet.org/word2rtf/formats/ffh-dosword5 1690# wIdent+dty 16910 belong 0x31be0000 1692# skip droid skeleton like x-fmt-274-signature-id-488.doc 1693>128 ubyte >0 Microsoft 1694>>96 uleshort =0 Word 1695!:mime application/msword 1696!:apple MSWDWDBN 1697# DCX is used in the Unix version. 1698!:ext doc/dcx 1699>>>0x6E ulequad =0 1.0-4.0 1700>>>0x6E ulequad !0 5.0-6.0 1701>>>0x6E ulequad x (DOS) Document 1702# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt 1703>>96 uleshort !0 Write 3.0 (Windows) Document 1704!:mime application/x-mswrite 1705!:apple MSWDWDBN 1706# sometimes also doc like in splitter.doc srchtest.doc 1707!:ext wri/doc 1708# wTool must be 0125400 octal 1709#>>4 uleshort !0xAB00 \b, wTool %o 1710# reserved; must be zero 1711#>>6 ulelong !0 \b, reserved %u 1712# block pointer to the block containing optional file manager information 1713#>>0x1C uleshort x \b, at %#x info block 1714# jump to File manager information block 1715>>(0x1C.s*128) uleshort x 1716# test for valid information start; maybe also 0012h 1717>>>&-2 uleshort =0x0014 1718# Document ASCIIZ name 1719>>>>&0x12 string x %s 1720# author name 1721>>>>>&1 string x \b, author %s 1722# reviser name 1723>>>>>>&1 string x \b, reviser %s 1724# keywords 1725>>>>>>>&1 string x \b, keywords %s 1726# comment 1727>>>>>>>>&1 string x \b, comment %s 1728# version number 1729>>>>>>>>>&1 string x \b, version %s 1730# date of last change MM/DD/YY 1731>>>>>>>>>>&1 string x \b, %-.8s 1732# creation date MM/DD/YY 1733>>>>>>>>>>&9 string x created %-.8s 1734# file name of print format like NORMAL.STY 1735>>0x1E string >0 \b, formatted by %-.66s 1736# count of pages in whole file for write variant; maybe some times wrong 1737>>96 uleshort >0 \b, %u pages 1738# name of the printer driver like HPLASMS 1739>>0x62 string >0 \b, %-.8s printer 1740# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0 1741>>0x6A uleshort >0 \b, %u blocks 1742# bit field for corrected text areas 1743#>>0x6C uleshort x \b, %#x bit field 1744# text of document; some times start with 4 non printable characters like CR LF 1745>>128 ubyte x \b, 1746>>>128 ubyte >0x1F 1747>>>>128 string x %s 1748>>>128 ubyte <0x20 1749>>>>129 ubyte >0x1F 1750>>>>>129 string x %s 1751>>>>129 ubyte <0x20 1752>>>>>130 ubyte >0x1F 1753>>>>>>130 string x %s 1754>>>>>130 ubyte <0x20 1755>>>>>>131 ubyte >0x1F 1756>>>>>>>131 string x %s 1757>>>>>>131 ubyte <0x20 1758>>>>>>>132 ubyte >0x1F 1759>>>>>>>>132 string x %s 1760>>>>>>>132 ubyte <0x20 1761>>>>>>>>133 ubyte >0x1F 1762>>>>>>>>>133 string x %s 1763# 17640 string/b PO^Q` Microsoft Word 6.0 Document 1765!:mime application/msword 1766# 17674 long 0 1768>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0 1769!:mime application/msword 1770!:ext mcw 1771>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0 1772!:mime application/msword 1773!:ext mcw 1774>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0 1775!:mime application/msword 1776!:ext mcw 1777>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0 1778!:mime application/msword 1779!:ext mcw 1780 17810 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document 1782!:mime application/msword 1783!:ext doc 1784# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs 1785#512 string/b \354\245\301 Microsoft Word Document 1786#!:mime application/msword 1787 1788# 17890 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 1790!:mime application/msword 1791 1792# 17930 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 1794!:mime application/vnd.ms-excel 1795# https://www.macdisk.com/macsigen.php 1796!:apple XCELXLS4 1797!:ext xls 1798# 1799# Update: Joerg Jenderek 1800# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3 1801# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf 1802# Note: newer Lotus versions >2 use longer BOF record 1803# record type (BeginningOfFile=0000h) + length (001Ah) 18040 belong 0x00001a00 1805# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3 1806#>18 uleshort&0x73E0 0 1807# Lotus Multi Byte Character Set (LMBCS=1-31) 1808>20 ubyte >0 1809>>20 ubyte <32 Lotus 1-2-3 1810#!:mime application/x-123 1811!:mime application/vnd.lotus-1-2-3 1812!:apple ????L123 1813# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data" 1814>>>4 uleshort 0x1000 WorKsheet, version 3 1815!:ext wk3 1816# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data" 1817>>>4 uleshort 0x1002 WorKsheet, version 4 1818# also worksheet template 4 (.wt4) 1819!:ext wk4/wt4 1820# no example or documentation for wk5 1821#>>4 uleshort 0x???? WorKsheet, version 4 1822#!:ext wk5 1823# only MacrotoScript.123 example 1824>>>4 uleshort 0x1003 WorKsheet, version 97 1825# also worksheet template Smartmaster (.12M)? 1826!:ext 123 1827# only Set_Y2K.123 example 1828>>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium 1829!:ext 123 1830# no example for this version 1831>>>4 uleshort 0x8001 FoRMatting data 1832!:ext frm 1833# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data" 1834# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet" 1835>>>4 uleshort 0x8007 ForMatting data, version 3 1836!:ext fm3 1837>>>4 default x unknown 1838# file revision sub code 0004h for worksheets 1839>>>>6 uleshort =0x0004 worksheet 1840!:ext wXX 1841>>>>6 uleshort !0x0004 formatting data 1842!:ext fXX 1843# main revision number 1844>>>>4 uleshort x \b, revision %#x 1845>>>6 uleshort =0x0004 \b, cell range 1846# active cellcoord range (start row, page,column ; end row, page, column) 1847# start values normally 0~1st sheet A1 1848>>>>8 ulelong !0 1849>>>>>10 ubyte >0 \b%d* 1850>>>>>8 uleshort x \b%d, 1851>>>>>11 ubyte x \b%d- 1852# end page mostly 0 1853>>>>14 ubyte >0 \b%d* 1854# end raw, column normally not 0 1855>>>>12 uleshort x \b%d, 1856>>>>15 ubyte x \b%d 1857# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??) 1858>>>>20 ubyte >1 \b, character set %#x 1859# flags 1860>>>>21 ubyte x \b, flags %#x 1861>>>6 uleshort !0x0004 1862# record type (FONTNAME=00AEh) 1863>>>>30 search/29 \0\xAE 1864# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n) 1865>>>>>&4 string >\0 \b, 1st font "%s" 1866# 1867# Update: Joerg Jenderek 1868# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3 1869# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT 1870# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x 1871# record type (BeginningOfFile=0000h) + length (0002h) 18720 belong 0x00000200 1873# GRR: line above is too general as it catches also MS Windows CURsor 1874# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1) 1875!:strength -1 1876# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h 1877>7 ubyte 0 1878# skip Windows cursors with image width 256 and keep Lotus with positive opcode 1879>>6 ubyte >0 Lotus 1880# !:mime application/x-123 1881!:mime application/vnd.lotus-1-2-3 1882!:apple ????L123 1883# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...) 1884# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3" 1885>>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF) 1886!:ext cnf 1887>>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J 1888!:ext cnf 1889>>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1 1890!:ext cnf 1891>>>4 uleshort 0x0802 Symphony CoNFiguration 1892!:ext cnf 1893>>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2 1894!:ext cnf 1895>>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4 1896!:ext cnf 1897>>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x 1898!:ext cnf 1899>>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x 1900!:ext cnf 1901# (version 5.26) labeled the entry as "Lotus 123" 1902# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 1903>>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1 1904# extension "wks" also for Microsoft Works document 1905!:ext wks 1906# (version 5.26) labeled the entry as "Lotus 123" 1907# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 1908>>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0 1909!:ext wrk/wr1 1910# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data" 1911# TrID labeles the entry as "Lotus 123 Worksheet (V2)" 1912>>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2 1913# Symphony (.wr1) 1914!:ext wk1/wr1 1915# no example for this japan version 1916>>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ 1917!:ext wj1 1918# no example or documentation for wk2 1919#>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2 1920#!:ext wk2 1921# undocumented japan version 1922>>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J 1923!:ext wj3 1924# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data" 1925>>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x 1926# japan version 2.4J (fj3) 1927!:ext fmt/fj3 1928# no example for this version 1929>>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0 1930!:ext frm 1931# (version 5.26) labeled the entry as "Lotus 1-2-3" 1932>>>4 default x unknown worksheet or configuration 1933!:ext cnf 1934>>>>4 uleshort x \b, revision %#x 1935# 2nd record for most worksheets describes cells range 1936>>>6 use lotus-cells 1937# 3rd record for most japan worksheets describes cells range 1938>>>(8.s+10) use lotus-cells 1939# check and then display Lotus worksheet cells range 19400 name lotus-cells 1941# look for type (RANGE=0006h) + length (0008h) at record begin 1942>0 ubelong 0x06000800 \b, cell range 1943# cell range (start column, row, end column, row) start values normally 0,0~A1 cell 1944>>4 ulong !0 1945>>>4 uleshort x \b%d, 1946>>>6 uleshort x \b%d- 1947# end of cell range 1948>>8 uleshort x \b%d, 1949>>10 uleshort x \b%d 1950# EndOfLotus123 19510 string/b WordPro\0 Lotus WordPro 1952!:mime application/vnd.lotus-wordpro 19530 string/b WordPro\r\373 Lotus WordPro 1954!:mime application/vnd.lotus-wordpro 1955 1956 1957# Summary: Script used by InstallScield to uninstall applications 1958# Extension: .isu 1959# Submitted by: unknown 1960# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 19610 string \x71\xa8\x00\x00\x01\x02 1962>12 string Stirling\ Technologies, InstallShield Uninstall Script 1963 1964# Winamp .avs 1965#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 19660 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 1967 1968# Windows Metafile .WMF 1969# URL: http://fileformats.archiveteam.org/wiki/Windows_Metafile 1970# http://en.wikipedia.org/wiki/Windows_Metafile 1971# Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/%5bMS-WMF%5d.pdf 1972# http://mark0.net/download/triddefs_xml.7z/defs/w/wmf.trid.xml 1973# Note: called "Windows Metafile" by TrID and 1974# verified by ImageMagick `identify -verbose *.wmf` as WMF (Windows Meta File) 1975# META_PLACEABLE Record (Aldus Placeable Metafile signature) 19760 string/b \327\315\306\232 1977# Note: called "Windows Metafile Image with Placeable File Header" by DROID via PUID x-fmt/119 1978# and verified by XnView `nconvert -info abydos.wmf SPA_FLAG.wmf hardcopy-windows-meta.wmf` as "Windows Placeable metafile" 1979# skip failed libreoffice-7.3.2.2 ofz35149-1.wmf with invalid version 2020h and exttextout-2.wmf with invalid version 3a02h 1980# and x-fmt-119-signature-id-609.wmf without version instead of 0100h=METAVERSION100 or 0300h=METAVERSION300 1981>26 uleshort&0xFDff =0x0100 Windows metafile 1982# HWmf; resource handle to the metafile; When the metafile is on disk, this field MUST contain 0 1983# seems to be always true but in failed samples 2020h ofz35149-1.wmf 56f8h exttextout-2.wmf 1984>>4 uleshort !0 \b, resource handle %#x 1985# BoundingBox; the rectangle in the playback context measured in logical units for displaying 1986# sometimes useful like: hardcopy-windows-meta.wmf (0,0 / 1280,1024) 1987# but garbage in x-fmt-119-signature-id-609.wmf (-21589,-21589 / -21589,-21589) 1988#>>6 ubequad x \b, bounding box %#16.16llx 1989# Left; x-coordinate of the upper-left corner of the rectangle 1990>>6 leshort x \b, bounding box (%d 1991# Top; y-coordinate upper-left corner 1992>>8 leshort x \b,%d 1993# Right; x-coordinate lower-right corner 1994>>10 leshort x / %d 1995# Bottom; y-coordinate lower-right corner 1996>>12 leshort x \b,%d) 1997# Inch; number of logical units per inch like: 72 96 575 576 1000 1200 1439 1440 2540 1998>>14 uleshort x \b, dpi %u 1999# Reserved; field is not used and MUST be set to 0; but ababababh in x-fmt-119-signature-id-609.wmf 2000>>16 ulelong !0 \b, reserved %#x 2001# Checksum; checksum for the previous 10 words 2002>>20 uleshort x \b, checksum %#x 2003# META_HEADER Record after META_PLACEABLE Record 2004>>22 use wmf-head 2005# GRR: no example for type 2 (DISKMETAFILE) variant found under few thousands WMF 20060 string/b \002\000\011\000 Windows metafile 2007>0 use wmf-head 2008# Reference: http://mark0.net/download/triddefs_xml.7z/defs/w/wmf-16.trid.xml 2009# Note: called "Windows Metafile (old Win 3.x format)" by TrID and 2010# "Windows Metafile Image without Placeable File Header" by DROID via PUID x-fmt/119 2011# verified by XnView `nconvert -info *.wmf` as Windows metafile 2012# variant with type=1=MEMORYMETAFILE and valid HeaderSize 9 20130 string/b \001\000\011\000 2014# skip DROID x-fmt-119-signature-id-1228.wmf by looking for content after header (18 bytes=2*011) 2015>18 ulelong >0 Windows metafile 2016# GRR: in version 5.44 unequal and not endian variant not working! 2017#>18 ulelong !0 THIS_SHOULD_NOT_HAPPEN 2018#>18 long !0 THIS_SHOULD_NOT_HAPPEN 2019>>0 use wmf-head 2020# display information of Windows metafile header (type, size, objects) 20210 name wmf-head 2022# MetafileType: 0001h=MEMORYMETAFILE~Metafile is stored in memory 0002h=DISKMETAFILE~Metafile is stored on disk 2023>0 uleshort !0x0001 \b, type %#x 2024# HeaderSize; the number of WORDs in header record; seems to be always 9 (18 bytes) 2025>2 uleshort*2 !18 \b, header size %u 2026# MetafileVersion: 0100h=METAVERSION100~DIBs (device-independent bitmaps) not supported 0300h=METAVERSION300~DIBs are supported 2027# but in failed samples 2020h ofz35149-1.wmf 3a02h exttextout-2.wmf 2028>4 uleshort =0x0100 \b, DIBs not supported 2029>4 uleshort =0x0300 2030#>4 uleshort =0x0300 \b, DIBs supported 2031# this should not happen! 2032>4 default x \b, version 2033>>4 uleshort x %#x 2034# Size; the number of WORDs in the entire metafile 2035>6 ulelong x \b, size %u words 2036#>6 ulelong*2 x \b, size %u bytes 2037!:mime image/wmf 2038!:ext wmf 2039# NumberOfObjects: the number of graphics objects like: 0 hardcopy-windows-meta.wmf 1 2 3 4 5 6 7 8 9 12 13 14 16 17 20 27 110 PERSGRID.WMF 2040>10 uleshort x \b, %u objects 2041# MaxRecord: the size of the largest record in the metafile in WORDs like: 78h b0h 1f4h 310h 63fh 1e0022h 3fcc21h 2042>12 ulelong x \b, largest record size %#x 2043# NumberOfMembers: It SHOULD be 0x0000, but 5 TestBitBltStretchBlt.wmf 13 TestPalette.wmf and in failed samples 4254 bitcount-1.wmf 8224 ofz5942-1.wmf 56832 exttextout-2.wmf 2044>16 uleshort !0 \b, %u members 2045 2046#tz3 files whatever that is (MS Works files) 20470 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 20480 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 20490 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 2050 2051# PGP sig files .sig 2052#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 20530 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 20540 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 20550 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 20560 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 20570 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 20580 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 2059 2060# windows zips files .dmf 20610 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 2062 2063# Windows icons 2064# Update: Joerg Jenderek 2065# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 2066# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG 20670 belong 0x00000100 2068>9 byte 0 2069>>0 byte x 2070>>0 use cur-ico-dir 2071>9 ubyte 0xff 2072>>0 byte x 2073>>0 use cur-ico-dir 2074# displays number of icons and information for icon or cursor 20750 name cur-ico-dir 2076# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with 2077# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h 2078>18 ulelong &0x00000006 2079# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG) 2080>>(18.l) ulelong x MS Windows 2081>>>0 ubelong 0x00000100 icon resource 2082# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon 2083!:mime image/vnd.microsoft.icon 2084#!:mime image/x-icon 2085!:ext ico 2086>>>>4 uleshort x - %d icon 2087# plural s 2088>>>>4 uleshort >1 \bs 2089# 1st icon 2090>>>>0x06 use ico-entry 2091# 2nd icon 2092>>>>4 uleshort >1 2093>>>>>0x16 use ico-entry 2094>>>0 ubelong 0x00000200 cursor resource 2095#!:mime image/x-cur 2096!:mime image/x-win-bitmap 2097!:ext cur 2098>>>>4 uleshort x - %d icon 2099>>>>4 uleshort >1 \bs 2100# 1st cursor 2101>>>>0x06 use cur-entry 2102#>>>>0x16 use cur-entry 2103# display information of one cursor entry 21040 name cur-entry 2105>0 use cur-ico-entry 2106>4 uleshort x \b, hotspot @%dx 2107>6 uleshort x \b%d 2108# display information of one icon entry 21090 name ico-entry 2110>0 use cur-ico-entry 2111# normally 0 1 but also found 14 2112>4 uleshort >1 \b, %d planes 2113# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256 2114>6 uleshort >1 \b, %d bits/pixel 2115# display shared information of cursor or icon entry 21160 name cur-ico-entry 2117>0 byte =0 \b, 256x 2118>0 ubyte !0 \b, %dx 2119>1 byte =0 \b256 2120>1 ubyte !0 \b%d 2121# number of colors in palette 2122>2 ubyte !0 \b, %d colors 2123# reserved 0 FFh 2124#>3 ubyte x \b, reserved %x 2125#>8 ulelong x \b, image size %d 2126# offset of PNG or DIB image 2127#>12 ulelong x \b, offset %#x 2128# PNG header (\x89PNG) 2129>(12.l) ubelong =0x89504e47 2130# 1 space char after "with" to get phrase "with PNG image" by magic in ./images 2131>>&-4 indirect x \b with 2132# DIB image 2133>(12.l) ubelong !0x89504e47 2134#>>&-4 use dib-image 2135 2136# Windows non-animated cursors 2137# Update: Joerg Jenderek 2138# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 2139# Note: similar to Windows ICOn. container for BMP ( only DIB part) 2140# GRR: line below is too general as it catches also Lotus 1-2-3 files 21410 belong 0x00000200 2142>9 byte 0 2143>>0 use cur-ico-dir 2144>9 ubyte 0xff 2145>>0 use cur-ico-dir 2146 2147# .chr files 21480 string/b PK\010\010BGI Borland font 2149>4 string >\0 %s 2150# then there is a copyright notice 2151 2152 2153# .bgi files 21540 string/b pk\010\010BGI Borland device 2155>4 string >\0 %s 2156# then there is a copyright notice 2157 2158 2159# Windows Recycle Bin record file (named INFO2) 2160# By Abel Cheung (abelcheung AT gmail dot com) 2161# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 2162# Since Vista uses another structure, INFO2 structure probably won't change 2163# anymore. Detailed analysis in: 2164# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 21650 lelong 0x00000004 2166>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 2167 21680 lelong 0x00000005 2169>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 2170 2171# From Doug Lee via a FreeBSD pr 21729 string GERBILDOC First Choice document 21739 string GERBILDB First Choice database 21749 string GERBILCLIP First Choice database 21750 string GERBIL First Choice device file 21769 string RABBITGRAPH RabbitGraph file 21770 string DCU1 Borland Delphi .DCU file 21780 string =!<spell> MKS Spell hash list (old format) 21790 string =!<spell2> MKS Spell hash list 2180# Too simple - MPi 2181#0 string AH Halo(TM) bitmapped font file 21820 lelong 0x08086b70 TurboC BGI file 21830 lelong 0x08084b50 TurboC Font file 2184 2185# Debian#712046: The magic below identifies "Delphi compiled form data". 2186# An additional source of information is available at: 2187# http://www.woodmann.com/fravia/dafix_t1.htm 21880 string TPF0 2189>4 pstring >\0 Delphi compiled form '%s' 2190 2191# tests for DBase files moved, updated and merged to database 2192 21930 string PMCC Windows 3.x .GRP file 21941 string RDC-meg MegaDots 2195>8 byte >0x2F version %c 2196>9 byte >0x2F \b.%c file 2197 2198# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm 2199# only for windows versions equal or greater 3.0 22000x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 2201!:mime application/x-dosexec 2202!:ext pif 2203#>2 string >\0 \b, Title:%.30s 2204>0x24 string >\0 \b for %.63s 2205>0x65 string >\0 \b, directory=%.64s 2206>0xA5 string >\0 \b, parameters=%.64s 2207#>0x181 leshort x \b, offset %x 2208#>0x183 leshort x \b, offsetdata %x 2209#>0x185 leshort x \b, section length %x 2210>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 2211>>&0x5e ubyte >0 2212>>>&-1 string <PIFMGR.DLL \b, icon=%s 2213#>>>&-1 string PIFMGR.DLL \b, icon=%s 2214>>>&-1 string >PIFMGR.DLL \b, icon=%s 2215>>&0xF0 ubyte >0 2216>>>&-1 string <Terminal \b, font=%.32s 2217#>>>&-1 string =Terminal \b, font=%.32s 2218>>>&-1 string >Terminal \b, font=%.32s 2219>>&0x110 ubyte >0 2220>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 2221#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 2222>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 2223#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 2224#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 2225>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 2226#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 2227>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 2228#>>&06 string x \b:%s 2229>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 2230#>>&06 string x \b:%s 2231 2232# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C 2233# of http://www.davep.org/norton-guides/ng2h-105.tgz 2234# https://en.wikipedia.org/wiki/Norton_Guides 22350 string NG\0\001 2236# only value 0x100 found at offset 2 2237>2 ulelong 0x00000100 Norton Guide 2238!:mime application/x-norton-guide 2239# often like NORTON.NG but some times like NC.HLP 2240!:ext ng/hlp 2241# Title[40] 2242>>8 string >\0 "%-.40s" 2243#>>6 uleshort x \b, MenuCount=%u 2244# szCredits[5][66] 2245>>48 string >\0 \b, %-.66s 2246>>114 string >\0 %-.66s 2247 2248# URL: https://en.wikipedia.org/wiki/Norton_Commander 2249# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/msg-nc-eng.trid.xml 2250# From: Joerg Jenderek 2251# Note: Message file is used by executable with same main name. 2252# Only tested with version 5.50 (english) and 2.01 (Windows) 22530 string Abort 2254# \0 or i 2255#>5 ubyte x %x 2256# skip ASCII Abort text by looking for error message like in NCVIEW.MSG 2257>6 search/7089 Non-DOS\ disk Norton Commander module message 2258!:mime application/x-norton-msg 2259!:ext msg 2260 2261# URL: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm 2262# Reference: https://mark0.net/download/triddefs_xml.7z/defs/m/msg-netware-dos.trid.xml 2263# From: Joerg Jenderek 22640 string DOS\ Client\ Message\ File: Novell DOS client message 2265#!:mime application/octet-stream 2266#!:mime application/x-novell-msg 2267!:ext msg 2268# look for second letter instead space character 2269>26 ubyte >0x20 2270# digit 1 or often main or program name like: IPXODI.COM TASKID pnwtrap DOSRqstr 2271>>25 ubyte !0x20 %c 2272>>>26 ubyte !0x20 \b%c 2273>>>>27 ubyte !0x20 \b%c 2274>>>>>28 ubyte !0x20 \b%c 2275>>>>>>29 ubyte !0x20 \b%c 2276>>>>>>>30 ubyte !0x20 \b%c 2277>>>>>>>>31 ubyte !0x20 \b%c 2278>>>>>>>>>32 ubyte !0x20 \b%c 2279>>>>>>>>>>33 ubyte !0x20 \b%c 2280>>>>>>>>>>>34 ubyte !0x20 \b%c 2281>>>>>>>>>>>>35 ubyte !0x20 \b%c 2282>>>>>>>>>>>>>36 ubyte !0x20 \b%c 2283# followed by string like: 0 v.10 V1.20 2284# 2285# followed by ,\040Tran 2286>28 search/14 ,\040Tran 2287# probably translated version string like: 0 v1.00 2288>>&0 string x \b, tran version %s 2289# followed by Ctrl-J Ctrl-Z 2290>>>&0 ubyte !0xa \b, terminated by %#2.2x 2291>>>>&0 ubyte x \b%2.2x 2292# Ctrl-Z 2293>0x65 ubyte !0x1A \b, at 0x65 %#x 2294# one 2295>0x66 ubyte !0x01 \b, at 0x66 %#x 2296# URL: https://en.wikipedia.org/wiki/NetWare 2297# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dat-novell-msg.trid.xml 2298# ftp://ftp.iitb.ac.in/LDP/en/NLM-HOWTO/NLM-HOWTO-single.html 2299# From: Joerg Jenderek 23000 string Novell\ Message\ Librarian\ Data\ File Novell message librarian data 2301#>35 string Version\ 1.00 2302#>49 string COPYRIGHT\ (c)\ 1985\ by\ Novell,\ Inc. 2303#>83 string \ \ All\ Rights\ Reserved 2304#!:mime application/octet-stream 2305#!:mime application/x-novell-msg 2306!:ext msg 2307#!:ext msg/dat 2308 2309# Summary: Turbo Pascal Help 2310# From: Joerg Jenderek 2311# URL: https://en.wikipedia.org/wiki/Turbo_Pascal 2312# Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/hlp-tp-2.trid.xml 2313# Note: called "Turbo Pascal Help (v2)" by TrID 23140 string TPH2 Turbo Pascal help, version 2 2315#!:mime application/octet-stream 2316!:mime application/x-pascal-hlp 2317# 4DOS help file, version 1.00 3.30 2318!:ext hlp 2319# URL: https://en.wikipedia.org/wiki/4DOS 2320# Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/hlp-4dos-v2.trid.xml 2321# Note: called "4DOS Help (v2)" by TrID 23220 string ALIAS\r\nASSIGN\r\n 2323>13 search/3016 4DOS 4DOS help file, version 2.x 2324#!:mime text/plain 2325!:mime application/x-4dos-hlp 2326# DOS.HLP 4DOS help file, version 2.21 2327!:ext hlp 2328# Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/hlp-4dos-v4.trid.xml 2329# Note: called "4DOS Help (v4)" by TrID 23300 string 4DH4 4DOS help file, version 4.x 2331#!:mime application/octet-stream 2332!:mime application/x-4dos-hlp 2333# 4dos402b.hlp 2334!:ext hlp 2335# Reference: https://4dos.info/4dsource/4helpsrc.zip/TPHELP.PAS 2336# Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/hlp-4dos.trid.xml 2337# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 2338# of https://www.4dos.info/ 2339# check for valid pascal string length (6 or 8) of HelpID, 4DH magic, valid major number (5 6 7 8) 23400 ubequad&0xF1ffFFffF0000000 0x0034444830000000 4DOS help file 2341#!:mime application/octet-stream 2342!:mime application/x-4dos-hlp 2343!:ext hlp 2344# pascal string length of of HelpID like: 6 8 2345#>0 ubyte x PLENGHT=%x 2346# Note: version string correspond or is a little bit lower than value of _4VER variable or output of 4DOS command `VER /R` 2347# one-digit major version number of version string 2348>4 string x \b, version %-1.1s 2349# two-digit minor version number depending on pascal string length at the beginning 2350>>0 ubyte 8 \b. 2351>>>5 string x \b%-2.2s 2352# Byte at offset 7 (A=41h) and 8 (A=41h) is not Revison like C (=43h) as reported by VER /R for 4DOS602b.HLP 2353# GRR: maybe this is patch level 2354>>>7 string x %-.2s 2355# few samples with string length 6 (implying exact 2 byte minor version digits) like in 4DOS500f.HLP 4dos551c_ge.hlp 2356>>0 ubyte 6 \b. 2357>>>5 string x \b%-2.2s 2358# just in case pascal string length is neither 6 nor 8 2359#>>0 default x \b. 2360#>>>5 string x %-2.2s 2361# false for version 5.52 and older, but true for version 6.02 and newer 2362>4 ubeshort >0x3535 2363# HighestTopic; highest topic number 2364#>>9 uleshort x HighestTopic=%#4.4x 2365# NumTopics; number of topics 2366#>>11 uleshort x NumTopics=%#4.4x 2367# BiggestTopic; size of largest topic in uncompressed bytes 2368#>>13 uleshort x BiggestTopic=%#4.4x 2369# NamedTopics; number of topics in help index 2370#>>15 uleshort x NamedTopics=%#4.4x 2371# NameSize; Size of largest name, 0 for none 2372#>>17 uleshort x NameSize=%#4.4x 2373# PickSize; size of each entry in pick table, 0 for none 2374#>>18 uleshort x PickSize=%#4.4x 2375# width; width of help window, with frame if any 2376#>>19 ubyte x Width=%#2.2x 2377# FirstTopic; topic to show first (0 = index) 2378#>>20 uleshort x FirstTopic=%#4.4x 2379# KeysTopic; topic to show when keys help needed 2380#>>22 uleshort x KeysTopic=%#4.4x 2381# ExtHelpName; string[13]; name for external help program like: HELP.COM DOSBOOK.EXE 2382>>24 pstring x \b, external help %s 2383# ExtHelpEnv; String[16]; environment variable for alternate external help program name like: DOSHELP 2384>>38 pstring x or specified by DOS environment variable %s 2385# XlateArray = array[0..29] of Byte; {Most common characters in help text} 2386#>>55 ubequad x XlateArray=%#16.16llx 2387# SharewareData : SharewareDataRec; shareware info for 4DOS.COM 2388#>>87 ubequad x SharewareData=%#16.16llx 2389 2390# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 2391# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Advisor_Help 2392# Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/hlp-ms-adv.trid.xml 2393# Note: called "Microsoft Advisor Help" by TrID 23940 ulequad&0xFFffFFfeFFffFFff 0x003a000000024e4c MS Advisor help file 2395#!:mime application/octet-stream 2396!:mime application/x-ms-hlp 2397!:ext hlp 2398 2399# HtmlHelp files (.chm) 24000 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data 2401!:mime application/vnd.ms-htmlhelp 2402!:ext chm 2403 2404# GFA-BASIC (Wolfram Kleff) 24052 string/b GFA-BASIC3 GFA-BASIC 3 data 2406 2407#------------------------------------------------------------------------------ 2408# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 2409# Update: Joerg Jenderek 2410# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format) 2411# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx 2412# Note: verified by `7z l *.cab` 2413# Microsoft Cabinet files 24140 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 2415# 2416# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool 2417# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE 2418# because some archive does not have *.diag* as 1st or 2nd archive member like 2419# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab 2420# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section 2421>0x2c search/980/c .diag \b, Diagnostic 2422!:mime application/vnd.ms-cab-compressed 2423!:ext diagcab 2424# http://fileformats.archiveteam.org/wiki/PUZ 2425# Microsoft Publisher version about 2003 has a "Pack and Go" feature that 2426# bundles a Publisher document *PNG.pub with all links into a CAB 2427>0x2c search/300/c png.pub\0 \b, Publisher Packed and Go 2428!:mime application/vnd.ms-cab-compressed 2429!:ext puz 2430# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation 2431>0x2c search/17/c ppview32.exe\0 \b, PowerPoint Viewer Packed and Go 2432!:mime application/vnd.ms-powerpoint 2433#!:mime application/mspowerpoint 2434!:ext ppz 2435# URL: https://en.wikipedia.org/wiki/Windows_Desktop_Gadgets 2436# Reference: https://docs.microsoft.com/en-us/previous-versions/windows/desktop/sidebar/ 2437# http://win10gadgets.com/download/273/ All_CPU_Meter1.zip/All_CPU_Meter_V4.7.3.gadget 2438>0x2c search/968/c gadget.xml \b, Windows Desktop Gadget 2439#!:mime application/vnd.ms-cab-compressed 2440# http://extension.nirsoft.net/gadget 2441!:mime application/x-windows-gadget 2442!:ext gadget 2443# http://www.incredimail.com/ 2444# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims 2445>0x2c search/3369/c content.ini\0 \b, IncrediMail 2446!:mime application/x-incredimail 2447# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf 2448>>0x2c search/83/c Flavor.htm\0 ecard 2449!:ext imf 2450# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims 2451>>0x2c search/211/c .swf\0 skin 2452!:ext ims 2453# member anim.im3 implies IncrediMail animation like in letter_fold.ima 2454>>0x2c search/92/c anim.im3\0 animation 2455!:ext ima 2456# other IncrediMail cab archive 2457>>0x2c default x 2458>>>0x2c search/116/c thumb ecard, image, notifier or skin 2459!:ext imf/imi/imn/ims 2460# http://file-extension.net/seeker/file_extension_ime 2461>>>0x2c default x emoticons or sound 2462!:ext ime/imw 2463# no Diagnostic, Packed and Go, Windows Desktop Gadget, IncrediMail 2464>0x2c default x 2465# look for 1st member name 2466>>(16.l+16) ubyte x 2467# From: Joerg Jenderek 2468# URL: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/building-device-metadata-packages 2469# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/devicemetadata-ms.trid.xml 2470>>>&-1 string PackageInfo.xml \b, Device Metadata Package 2471!:mime application/vnd.ms-cab-compressed 2472!:ext devicemetadata-ms 2473# https://en.wikipedia.org/wiki/SNP_file_format 2474>>>&-1 string/c _accrpt_.snp \b, Access report snapshot 2475!:mime application/msaccess 2476!:ext snp 2477# https://en.wikipedia.org/wiki/Microsoft_InfoPath 2478>>>&-1 string manifest.xsf \b, InfoPath Form Template 2479!:mime application/vnd.ms-cab-compressed 2480#!:mime application/vnd.ms-infopath 2481!:ext xsn 2482# https://www.cabextract.org.uk/wince_cab_format/ 2483# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer 2484>>>&7 string =.000 \b, WinCE install 2485!:mime application/vnd.ms-cab-compressed 2486!:ext cab 2487 2488# https://support.microsoft.com/kb/934307/en-US 2489# All inspected MSU contain a file with name WSUSSCAN.cab 2490# that is called "Windows Update meta data" by Microsoft 2491>>>&-1 string/c wsusscan.cab \b, Microsoft Standalone Update 2492!:mime application/vnd.ms-cab-compressed 2493!:ext msu 2494>>>&-1 default x 2495# look at point character of 1st archive member name for file name extension 2496# GRR: search range is maybe too large and match point else where like in EN600x64.cab! 2497>>>>&-1 search/255 . 2498# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm 2499# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002 2500# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB 2501>>>>>&0 string/c ppt\0 2502>>>>>>28 uleshort >1 \b, PowerPoint Packed and Go 2503!:mime application/vnd.ms-powerpoint 2504#!:mime application/mspowerpoint 2505!:ext ppz 2506# or POWERPNT.PPT packed as POWERPNT.PP_ found on Windows 2000,XP setup CD in directory i386 2507>>>>>>28 uleshort =1 \b, one packed PowerPoint 2508!:mime application/vnd.ms-cab-compressed 2509!:ext pp_ 2510# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx 2511# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack 2512# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack 2513>>>>>&0 string/c theme \b, Windows 2514!:mime application/x-windows-themepack 2515# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8 2516# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack 2517# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme 2518>>>>>>(16.l+16) string =Panoram 8 2519!:ext deskthemepack 2520>>>>>>(16.l+16) string !Panoram 7 or 8 2521!:ext themepack/deskthemepack 2522>>>>>>(16.l+16) ubyte x Theme Pack 2523# URL: https://en.wikipedia.org/wiki/Microsoft_OneNote#File_format 2524# http://fileformats.archiveteam.org/wiki/OneNote 2525# Reference: https://mark0.net/download/triddefs_xml.7z/defs/o/onepkg.trid.xml 2526# 1st member name like: "Class Notes.one" "test-onenote.one" "Open Notebook.onetoc2" "Editor offnen.onetoc2" 2527>>>>>&0 string/c one \b, OneNote Package 2528!:mime application/msonenote 2529!:ext onepkg 2530>>>>>&0 default x 2531# look for null terminator of 1st member name 2532>>>>>>&0 search/255 \0 2533# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu 2534>>>>>>>&16 string/c wsusscan.cab \b, Microsoft Standalone Update 2535!:mime application/vnd.ms-cab-compressed 2536!:ext msu 2537>>>>>>>&16 default x 2538# archive with more then one file need some output in version 5.32 to avoid error message like 2539# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type 2540# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type 2541# file: could not find any valid magic files! 2542>>>>>>>>28 uleshort >1 \b, many 2543!:mime application/vnd.ms-cab-compressed 2544!:ext cab 2545# remaining archives with just one file 2546>>>>>>>>28 uleshort =1 2547# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386 2548>>>>>>>>>30 uleshort =0x0000 \b, Windows 2000/XP setup 2549# cut of last char of source extension and add underscore to generate extension 2550# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_ 2551!:mime application/vnd.ms-cab-compressed 2552!:ext _/?_/??_ 2553# archive need some output like "single" in version 5.32 to avoid error messages 2554>>>>>>>>>30 uleshort !0x0000 \b, single 2555!:mime application/vnd.ms-cab-compressed 2556!:ext cab 2557# first archive name without point character 2558>>>>&-1 default x 2559>>>>>28 uleshort =1 \b, single 2560!:mime application/vnd.ms-cab-compressed 2561# on XP_CD\I386\ like: NETWORKS._ PROTOCOL._ QUOTES._ SERVICES._ 2562!:ext _ 2563>>>>>28 uleshort >1 \b, many 2564!:mime application/vnd.ms-cab-compressed 2565# like: HP Envy 6000 printer driver packages Full_x86.cab Full_x64.cab 2566!:ext cab 2567# TODO: additional extensions like 2568# .xtp InfoPath Template Part 2569# .lvf Logitech Video Effects Face Accessory 2570>8 ulelong x \b, %u bytes 2571>28 uleshort 1 \b, 1 file 2572>28 uleshort >1 \b, %u files 2573# Reserved fields, set to zero 2574#>4 belong !0 \b, reserved1 %x 2575#>12 belong !0 \b, reserved2 %x 2576# offset of the first CFFILE entry coffFiles: minimal 2Ch 2577>16 ulelong x \b, at %#x 2578>(16.l) use cab-file 2579# at least also 2nd member 2580>28 uleshort >1 2581>>(16.l+16) ubyte x 2582>>>&0 search/255 \0 2583# second member info 2584>>>>&0 use cab-file 2585#>20 belong !0 \b, reserved %x 2586# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3 2587>24 ubeshort !0x0301 \b version %#x 2588# number of CFFOLDER entries 2589>26 uleshort >1 \b, %u cffolders 2590# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields 2591# only found for flags 0 1 2 3 4 not 7 2592>30 uleshort >0 \b, flags %#x 2593# Cabinet files have a 16-bit cabinet setID field that is designed for application use. 2594# default is zero, however, the -i option of cabarc can be used to set this field 2595>32 uleshort >0 \b, ID %u 2596# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet 2597#>34 uleshort x \b, iCabinet %u 2598# add one for display because humans start numbering by 1 and also fit to name of disk szDisk* 2599>34 uleshort+1 x \b, number %u 2600>30 uleshort &0x0004 \b, extra bytes 2601# cbCFHeader optional size of per-cabinet reserved area 14h 1800h 2602>>36 uleshort >0 %u in head 2603# cbCFFolder is optional size of per-folder reserved area 2604>>38 ubyte >0 %u in folder 2605# cbCFData is optional size of per-datablock reserved area 2606>>39 ubyte >0 %u in data block 2607# optional per-cabinet reserved area abReserve[cbCFHeader] 2608>>36 uleshort >0 2609# 1st CFFOLDER after reserved area in header 2610>>>(36.s+40) use cab-folder 2611# no reserved area in header 2612>30 uleshort ^0x0004 2613# no previous and next cab archive 2614>>30 uleshort =0x0000 2615>>>36 use cab-folder 2616# only previous cab archive 2617>>30 uleshort =0x0001 \b, previous 2618>>>36 use cab-anchor 2619# only next cab archive 2620>>30 uleshort =0x0002 \b, next 2621>>>36 use cab-anchor 2622# previous+next cab archive 2623# can not use sub routine cab-anchor to display previous and next cabinet together 2624#>>>36 use cab-anchor 2625#>>>>&0 use cab-anchor 2626>>30 uleshort =0x0003 \b, previous 2627>>>36 string x %s 2628# optional name of previous disk szDisk* 2629>>>>&1 string x disk %s 2630>>>>>&1 string x \b, next %s 2631# optional name of previous disk szDisk* 2632>>>>>>&1 string x disk %s 2633>>>>>>>&1 use cab-folder 2634# display filename and disk name of previous or next cabinet 26350 name cab-anchor 2636# optional name of previous/next cabinet file szCabinet*[255] 2637>&0 string x %s 2638# optional name of previous/next disk szDisk*[255] 2639>>&1 string x disk %s 2640# display folder structure CFFOLDER information like compression of cabinet 26410 name cab-folder 2642# offset of the CFDATA block in this folder 2643#>0 ulelong x \b, coffCabStart %#x 2644# number of CFDATA blocks in folder 2645>4 uleshort x \b, %u datablock 2646# plural s 2647>4 uleshort >1 \bs 2648# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15 2649>6 uleshort x \b, %#x compression 2650# optional per-folder reserved area 2651#>8 ubequad x \b, abReserve %#llx 2652# display member structure CFFILE information like member name of cabinet 26530 name cab-file 2654# cbFile is uncompressed size of file in bytes 2655#>0 ulelong x \b, cbFile %u 2656# uoffFolderStart is uncompressed offset of file in folder 2657#>4 ulelong >0 \b, uoffFolderStart %#x 2658# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet 2659# define ifoldCONTINUED_FROM_PREV (0xFFFD) 2660# define ifoldCONTINUED_TO_NEXT (0xFFFE) 2661# define ifoldCONTINUED_PREV_AND_NEXT (0xFFFF) 2662>8 uleshort >0 \b, iFolder %#x 2663# date stamp for file 2664>10 lemsdosdate x last modified %s 2665# time stamp for file 2666>12 lemsdostime x %s 2667# attribs is attribute flags for file 2668# define _A_RDONLY (0x01) file is read-only 2669# define _A_HIDDEN (0x02) file is hidden 2670# define _A_SYSTEM (0x04) file is a system file 2671# define _A_ARCH (0x20) file modified since last backup 2672# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab 2673# define _A_EXEC (0x40) run after extraction 2674# define _A_NAME_IS_UTF (0x80) szName[] contains UTF 2675# define UNKNOWN (0x0100) undocumented or accident 2676#>14 uleshort x \b, attribs %#x 2677>14 uleshort >0 + 2678>>14 uleshort &0x0001 \bR 2679>>14 uleshort &0x0002 \bH 2680>>14 uleshort &0x0004 \bS 2681>>14 uleshort &0x0020 \bA 2682>>14 uleshort &0x0040 \bX 2683>>14 uleshort &0x0080 \bUtf 2684# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB 2685>>14 uleshort &0x0100 \b? 2686# szName is name of archive member 2687>16 string x "%s" 2688# next archive member name if more files 2689#>>&17 string >\0 \b, NEXT NAME %-.50s 2690 2691# Windows CE package files 26920 string/b MSCE\0\0\0\0 Microsoft WinCE install header 2693>20 lelong 0 \b, architecture-independent 2694>20 lelong 103 \b, Hitachi SH3 2695>20 lelong 104 \b, Hitachi SH4 2696>20 lelong 0xA11 \b, StrongARM 2697>20 lelong 4000 \b, MIPS R4000 2698>20 lelong 10003 \b, Hitachi SH3 2699>20 lelong 10004 \b, Hitachi SH3E 2700>20 lelong 10005 \b, Hitachi SH4 2701>20 lelong 70001 \b, ARM 7TDMI 2702>52 leshort 1 \b, 1 file 2703>52 leshort >1 \b, %u files 2704>56 leshort 1 \b, 1 registry entry 2705>56 leshort >1 \b, %u registry entries 2706 2707 2708# Windows Enhanced Metafile (EMF) 2709# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 2710# for further information. 27110 ulelong 1 2712>40 string \ EMF Windows Enhanced Metafile (EMF) image data 2713>>44 ulelong x version %#x 2714 2715 27160 string/b \224\246\056 Microsoft Word Document 2717!:mime application/msword 2718 2719# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 2720# Magic type for Dell's BIOS .hdr files 2721# Dell's .hdr 27220 string/b $RBU 2723>23 string Dell %s system BIOS 2724>5 byte 2 2725>>48 byte x version %d. 2726>>49 byte x \b%d. 2727>>50 byte x \b%d 2728>5 byte <2 2729>>48 string x version %.3s 2730 2731# Type: Microsoft Document Imaging Format (.mdi) 2732# URL: https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 2733# From: Daniele Sempione <scrows@oziosi.org> 2734# Too weak (EP) 2735#0 short 0x5045 Microsoft Document Imaging Format 2736 2737# MS eBook format (.lit) 27380 string/b ITOLITLS Microsoft Reader eBook Data 2739>8 lelong x \b, version %u 2740!:mime application/x-ms-reader 2741 2742# Windows CE Binary Image Data Format 2743# From: Dr. Jesus <j@hug.gs> 27440 string/b B000FF\n Windows Embedded CE binary image 2745 2746# The second byte of these signatures is a file version; I don't know what, 2747# if anything, produced files with version numbers 0-2. 2748# From: John Elliott <johne@seasip.demon.co.uk> 27490 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 27500 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 27510 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 27520 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 2753 27540 string MIOPEN Mallard BASIC Jetsam data 27550 string Jetsam0 Mallard BASIC Jetsam index data 2756 2757# DOS backup 2.0 to 3.2 2758# URL: http://fileformats.archiveteam.org/wiki/BACKUP_(MS-DOS) 2759# Reference: http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/dos/restore/brtecdoc.htm 2760# backupid.@@@ 2761 2762# plausibility check for date 27630x3 ushort >1979 2764>0x5 ubyte-1 <31 2765>>0x6 ubyte-1 <12 2766# actually 121 nul bytes 2767>>>0x7 string \0\0\0\0\0\0\0\0 2768>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d 2769#!:mime application/octet-stream 2770!:ext @@@ 2771>>>>0x0 ubyte 0xff \b, last disk 2772 2773# backed up file 2774 2775# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd 2776# by looking for trailing nul of maximal file name string 27770x52 ubyte 0 2778# test for flag byte: FFh~complete file, 00h~split file 2779# FFh -127 = -1 -127 = -128 2780# 00h -127 = 0 -127 = -127 2781>0 byte-127 <-126 2782# plausibility check for file name length 2783>>0x53 ubyte-1 <78 2784# looking for terminating nul of file name string 2785>>>(0x53.b+4) ubyte 0 2786# looking if last char of string is valid DOS file name 2787>>>>(0x53.b+3) ubyte >0x1F 2788# actually 44 nul bytes 2789# but sometimes garbage according to Ralf Quint. So can not be used as test 2790#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 2791# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator 2792# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 2793>>>>>5 ubyte&0x8C 0x0C 2794# ./msdos (version 5.30) labeled the entry as 2795# "DOS 2.0 backed up file %s, split file, sequence %d" or 2796# "DOS 2.0 backed up file %s, complete file" 2797>>>>>>0 ubyte x DOS 2.0-3.2 backed up 2798#>>>>>>0 ubyte 0xff complete 2799>>>>>>0 ubyte 0 2800>>>>>>>1 uleshort x sequence %d of 2801# full file name with path but without drive letter and colon stored from 0x05 til 0x52 2802>>>>>>0x5 string x file %s 2803#!:mime application/octet-stream 2804# backup name is original filename 2805#!:ext doc/exe/rar/zip 2806#!:ext * 2807# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*' 2808# file: line 1169: Bad magic entry ' *' 2809# after header original file content 2810>>>>>>128 indirect x \b; 2811 2812 2813# DOS backup 3.3 to 5.x 2814 2815# CONTROL.nnn files 28160 string \x8bBACKUP\x20 2817# actually 128 nul bytes 2818>0xa string \0\0\0\0\0\0\0\0 2819>>0x9 ubyte x DOS 3.3 backup control file, sequence %d 2820>>0x8a ubyte 0xff \b, last disk 2821 2822# NB: The BACKUP.nnn files consist of the files backed up, 2823# concatenated. 2824 2825# ExcelBIFF2-8BOF.magic - Excel Binary Interchange File Format versions 2-8 2826# Beginning of File records 2827# See https://www.gaia-gis.it/gaia-sins/freexl-1.0.6-doxy-doc/html/Format.html 2828# Excel Commercial BIFF Release 2829# Version Name Version Year Notes 2830# 2.x Excel 2.0 BIFF2 1987 Before CFBF. File is the BIFF 2831# stream, containing a single 2832# worksheet. 2833# 3.0 Excel 3.0 BIFF3 1990 "" 2834# 4.0 Excel 4.0 BIFF4 1992 "" 2835# 5.0 Excel 5.0 BIFF5 1993 Starting with BIFF5, a single 2836# Workbook can internally store 2837# many individual Worksheets. 2838# The BIFF stream is stored in 2839# the CFBF file container. 2840# 7.0 Excel 95 BIFF5 1995 2841# 8.0 Excel 98 BIFF8 1998 2842# 9.0 Excel 2000 BIFF8 1999 2843# 10.0 Excel XP BIFF8 2001 2844# 11.0 Excel 2003 BIFF8 2003 2845# See https://www.openoffice.org/sc/excelfileformat.pdf#page=135 2846# 5.8 BOF – Beginning of File 2847# See also https://en.wikipedia.org/wiki/Microsoft_Excel; 2848# Old file extensions 2849# Format Extension Description 2850# Spreadsheet .xls Main spreadsheet format which holds data in 2851# worksheets, charts, and macros 2852# Add-in (VBA) .xla Adds custom functionality; written in VBA 2853# Toolbar .xlb The file extension where Microsoft Excel custom 2854# toolbar settings are stored. 2855# Chart .xlc A chart created with data from a Microsoft Excel 2856# spreadsheet that only saves the chart. 2857# To save the chart and spreadsheet save as .XLS. 2858# XLC is not supported in Excel 2007 or in any 2859# newer versions of Excel. 2860# Dialog .xld Used in older versions of Excel. 2861# Archive .xlk A backup of an Excel Spreadsheet 2862# Add-in (DLL) .xll Adds custom functionality; written in C++/C, 2863# Fortran, etc. and compiled in to a special 2864# dynamic-link library 2865# Macro .xlm A macro is created by the user or pre-installed 2866# with Excel. 2867# Template .xlt A pre-formatted spreadsheet created by the user 2868# or by Microsoft Excel. 2869# Module .xlv A module is written in VBA (Visual Basic for 2870# Applications) for Microsoft Excel 2871# Workspace .xlw Arrangement of the windows of multiple Workbooks 2872# Library .DLL Code written in VBA may access functions in a 2873# DLL, typically this is used to access the 2874# Windows API 2875#!:ext xls/xla/xlb/xlc/xld/xlk/xll/xlm/xlt/xlv/xlw 2876 2877#!:mime application/vnd.ms-excel 2878 2879# 5.8.1 BOF Records Written by Excel 2880# Record BOF, BIFF2 (record identifier is 0009 H): 2881# Offset Size Contents 2882# 0 2 BIFF version (not used) 2883# 2 2 Type of the following data: 0010H = Sheet 2884# 0020H = Chart 2885# 0040H = Macro sheet 2886# e.g. 0x0009 BOF len 4 version 2 content 0x0010 Sheet 28870 uleshort =0x0009 Excel 2 BIFF 2 2888>2 uleshort =4 2889# version 2890>>4 uleshort =0 2891>>4 uleshort =2 2892>>>6 uleshort =0x0010 Sheet 2893>>>6 uleshort =0x0020 Chart 2894>>>6 uleshort =0x0040 Macros 2895 2896# Record BOF, BIFF3 (record identifier is 0209 H) and 2897# BIFF4 (record identifier is 0409H): 2898# Offset Size Contents 2899# 0 2 BIFF version (not used) 2900# 2 2 Type of the following data: 0010H = Sheet 2901# 0020H = Chart 2902# 0040H = Macro sheet 2903# 0100H = Workspace 2904# (BIFF3W/BIFF4W only) 2905# 4 2 Not used 29060 uleshort =0x0209 Excel 3 BIFF 3 2907>2 uleshort =6 2908# version 2909>>4 uleshort =0 2910>>4 uleshort =3 2911>>>6 uleshort =0x0010 Sheet 2912>>>6 uleshort =0x0020 Chart 2913>>>6 uleshort =0x0040 Macros 2914# (BIFF3W only) 2915>>>6 uleshort =0x0100 Workspace 2916 29170 uleshort =0x0409 Excel 4 BIFF 4 2918>2 uleshort =6 2919# version 2920>>4 uleshort =0 2921>>4 uleshort =4 2922>>>6 uleshort =0x0010 Sheet 2923>>>6 uleshort =0x0020 Chart 2924>>>6 uleshort =0x0040 Macros 2925# (BIFF4W only) 2926>>>6 uleshort =0x0100 Workspace 2927 2928# Record BOF, BIFF5 (record identifier is 0809 H): 2929# Offset Size Contents 2930# 0 2 BIFF version (always 0500H for BIFF5). 2931# Should only be used, if this record is the leading 2932# workbook globals BOF (see above). 2933# 2 2 Type of the following data: 2934# 0005H = Workbook globals 2935# 0006H = Visual Basic module 2936# 0010H = Sheet or dialogue (see SHEETPR, 2937# ➜5.97) 2938# 0020H = Chart 2939# 0040H = Macro sheet 2940# 0100H = Workspace (BIFF5W only) 2941# 4 2 Build identifier, must not be 0 2942# 6 2 Build year 29430 uleshort =0x0809 Excel 5 BIFF 5 2944>2 uleshort =8 2945# version 2946>>4 uleshort =0x0500 2947>>4 uleshort =5 2948>>4 uleshort =0 2949>>>6 uleshort =0x0005 Workbook Globals 2950>>>6 uleshort =0x0006 VB Module 2951>>>6 uleshort =0x0010 Sheet 2952>>>6 uleshort =0x0020 Chart 2953>>>6 uleshort =0x0040 Macros 2954# (BIFF5W only) 2955>>>6 uleshort =0x0100 Workspace 2956>>>>8 uleshort >0 Build %d 2957>>>>>10 uleshort >1900 Year %d 2958 2959# Record BOF, BIFF8 (record identifier is 0809 H): 2960# Offset Size Contents 2961# 0 2 BIFF version (always 0600 H for BIFF8) 2962# 2 2 Type of the following data: 2963# 0005H = Workbook globals 2964# 0006H = Visual Basic module 2965# 0010H = Sheet or dialogue (see SHEETPR, 2966# ➜5.97) 2967# 0020H = Chart 2968# 0040H = Macro sheet 2969# 0100H = Workspace (BIFF8W only) 2970# 4 2 Build identifier, must not be 0 2971# 6 2 Build year, must not be 0 2972# 8 4 File history flags 2973# 12 4 Lowest Excel version that can read all records in this 2974# file 29750 uleshort =0x0809 Excel 8 BIFF 8 2976>2 uleshort =16 2977# version 2978>>4 uleshort =0x0600 2979>>4 uleshort =8 2980>>4 uleshort =0 2981>>>6 uleshort =0x0005 Workbook Globals 2982>>>6 uleshort =0x0006 VB Module 2983>>>6 uleshort =0x0010 Sheet 2984>>>6 uleshort =0x0020 Chart 2985>>>6 uleshort =0x0040 Macros 2986# (BIFF8W only) 2987>>>6 uleshort =0x0100 Workspace 2988>>>>8 uleshort >0 Build %d 2989>>>>>10 uleshort >1900 Year %d 2990>>>>>>12 ulelong !0 File history %d 2991>>>>>>16 ulelong >0 Excel version needed %d 2992 2993# 5.8.2 BOF Records Written by Other External Tools 2994# Various external tools write non-standard BOF records with the record 2995# identifier 0809H (determining a BIFF5-BIFF8 BOF record), but with a 2996# different BIFF version field. In this case, the record identifier is 2997# ignored, and only the version field is used to set the BIFF version of 2998# the workbook. 2999# Record BOF (record identifier is 0809 H): 3000# Offset Size Contents 3001# 0 2 BIFF version: 0000H = BIFF5 3002# 0200H = BIFF2 3003# 0300H = BIFF3 3004# 0400H = BIFF4 3005# 0500H = BIFF5 3006# 0600H = BIFF8 3007# 2 2 Type of the following data: 3008# 0005H = Workbook globals 3009# 0006H = Visual Basic module 3010# 0010H = Sheet or dialogue (see SHEETPR, 3011# ➜5.97) 3012# 0020H = Chart 3013# 0040H = Macro sheet 3014# 0100H = Workspace 3015# [4] var. (optional) Additional fields of a BOF record, 3016# should be ignored 30170 uleshort =0x0809 3018# >= 4 3019>2 uleshort >3 3020>>4 uleshort =0 Excel 5 BIFF 5 3021>>4 uleshort =0x0200 Excel 2 BIFF 2 3022>>4 uleshort =2 Excel 2 BIFF 2 3023>>4 uleshort =0x0300 Excel 3 BIFF 3 3024>>4 uleshort =3 Excel 3 BIFF 3 3025>>4 uleshort =0x0400 Excel 4 BIFF 4 3026>>4 uleshort =4 Excel 4 BIFF 4 3027>>4 uleshort =0x0500 Excel 5 BIFF 5 3028>>4 uleshort =5 Excel 5 BIFF 5 3029>>4 uleshort =0x0600 Excel 8 BIFF 8 3030>>4 uleshort =6 Excel 8 BIFF 8 3031>>4 uleshort =0x0800 Excel 8 BIFF 8 3032>>4 uleshort =8 Excel 8 BIFF 8 3033>>>6 uleshort =0x0005 Workbook Globals 3034>>>6 uleshort =0x0006 VB Module 3035>>>6 uleshort =0x0010 Sheet/Dialogue 3036>>>6 uleshort =0x0020 Chart 3037>>>6 uleshort =0x0040 Macros 3038# (BIFF8W only) 3039>>>6 uleshort =0x0100 Workspace 3040 3041