1 2#------------------------------------------------------------------------------ 3# $File: msdos,v 1.128 2019/04/19 00:42:27 christos Exp $ 4# msdos: file(1) magic for MS-DOS files 5# 6 7# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 8# updated by Joerg Jenderek at Oct 2008,Apr 2011 90 string/t @ 10>1 string/cW \ echo\ off DOS batch file text 11!:mime text/x-msdos-batch 12!:ext bat 13>1 string/cW echo\ off DOS batch file text 14!:mime text/x-msdos-batch 15!:ext bat 16>1 string/cW rem DOS batch file text 17!:mime text/x-msdos-batch 18!:ext bat 19>1 string/cW set\ DOS batch file text 20!:mime text/x-msdos-batch 21!:ext bat 22 23 24# OS/2 batch files are REXX. the second regex is a bit generic, oh well 25# the matched commands seem to be common in REXX and uncommon elsewhere 26100 search/0xffff rxfuncadd 27>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 28100 search/0xffff say 29>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 30 31# updated by Joerg Jenderek at Oct 2015 32# https://de.wikipedia.org/wiki/Common_Object_File_Format 33# http://www.delorie.com/djgpp/doc/coff/filhdr.html 34# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable" 35#0 leshort 0x14c MS Windows COFF Intel 80386 object file 36#>4 ledate x stamp %s 370 leshort 0x166 MS Windows COFF MIPS R4000 object file 38#>4 ledate x stamp %s 390 leshort 0x184 MS Windows COFF Alpha object file 40#>4 ledate x stamp %s 410 leshort 0x268 MS Windows COFF Motorola 68000 object file 42#>4 ledate x stamp %s 430 leshort 0x1f0 MS Windows COFF PowerPC object file 44#>4 ledate x stamp %s 450 leshort 0x290 MS Windows COFF PA-RISC object file 46#>4 ledate x stamp %s 47 48# Tests for various EXE types. 49# 50# Many of the compressed formats were extraced from IDARC 1.23 source code. 51# 520 string/b MZ 53# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 54>0x18 leshort <0x40 MS-DOS executable 55!:mime application/x-dosexec 56# Windows and later versions of DOS will allow .EXEs to be named with a .COM 57# extension, mostly for compatibility's sake. 58!:ext exe/com 59# These traditional tests usually work but not always. When test quality support is 60# implemented these can be turned on. 61#>>0x18 leshort 0x1c (Borland compiler) 62#>>0x18 leshort 0x1e (MS compiler) 63 64# If the relocation table is 0x40 or more bytes into the file, it's definitely 65# not a DOS EXE. 66>0x18 leshort >0x3f 67 68# Maybe it's a PE? 69>>(0x3c.l) string PE\0\0 PE 70!:mime application/x-dosexec 71>>>(0x3c.l+24) leshort 0x010b \b32 executable 72>>>(0x3c.l+24) leshort 0x020b \b32+ executable 73>>>(0x3c.l+24) leshort 0x0107 ROM image 74>>>(0x3c.l+24) default x Unknown PE signature 75>>>>&0 leshort x 0x%x 76>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 77>>>(0x3c.l+92) leshort 1 78# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the 79# drivers in Windows/System32/drivers/*.sys. 80>>>>(0x3c.l+22) leshort&0x2000 >0 (native) 81!:ext dll/sys 82>>>>(0x3c.l+22) leshort&0x2000 0 (native) 83!:ext exe/sys 84>>>(0x3c.l+92) leshort 2 85>>>>(0x3c.l+22) leshort&0x2000 >0 (GUI) 86# These could probably be at least partially distinguished from one another by 87# looking for specific exported functions. 88# CPL: Control Panel item 89# TLB: Type library 90# OCX: OLE/ActiveX control 91# ACM: Audio compression manager codec 92# AX: DirectShow source filter 93# IME: Input method editor 94!:ext dll/cpl/tlb/ocx/acm/ax/ime 95>>>>(0x3c.l+22) leshort&0x2000 0 (GUI) 96# Screen savers typically include code from the scrnsave.lib static library, but 97# that's not guaranteed. 98!:ext exe/scr 99>>>(0x3c.l+92) leshort 3 100>>>>(0x3c.l+22) leshort&0x2000 >0 (console) 101!:ext dll/cpl/tlb/ocx/acm/ax/ime 102>>>>(0x3c.l+22) leshort&0x2000 0 (console) 103!:ext exe/com 104>>>(0x3c.l+92) leshort 7 (POSIX) 105>>>(0x3c.l+92) leshort 9 (Windows CE) 106>>>(0x3c.l+92) leshort 10 (EFI application) 107>>>(0x3c.l+92) leshort 11 (EFI boot service driver) 108>>>(0x3c.l+92) leshort 12 (EFI runtime driver) 109>>>(0x3c.l+92) leshort 13 (EFI ROM) 110>>>(0x3c.l+92) leshort 14 (XBOX) 111>>>(0x3c.l+92) leshort 15 (Windows boot application) 112>>>(0x3c.l+92) default x (Unknown subsystem 113>>>>&0 leshort x 0x%x) 114>>>(0x3c.l+4) leshort 0x14c Intel 80386 115>>>(0x3c.l+4) leshort 0x166 MIPS R4000 116>>>(0x3c.l+4) leshort 0x168 MIPS R10000 117>>>(0x3c.l+4) leshort 0x184 Alpha 118>>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 119>>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 120>>>(0x3c.l+4) leshort 0x1c0 ARM 121>>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 122>>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 123>>>(0x3c.l+4) leshort 0x1f0 PowerPC 124>>>(0x3c.l+4) leshort 0x200 Intel Itanium 125>>>(0x3c.l+4) leshort 0x266 MIPS16 126>>>(0x3c.l+4) leshort 0x268 Motorola 68000 127>>>(0x3c.l+4) leshort 0x290 PA-RISC 128>>>(0x3c.l+4) leshort 0x366 MIPSIV 129>>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 130>>>(0x3c.l+4) leshort 0xebc EFI byte code 131>>>(0x3c.l+4) leshort 0x8664 x86-64 132>>>(0x3c.l+4) leshort 0xc0ee MSIL 133>>>(0x3c.l+4) default x Unknown processor type 134>>>>&0 leshort x 0x%x 135>>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 136>>>(0x3c.l+22) leshort&0x1000 >0 system file 137>>>(0x3c.l+24) leshort 0x010b 138>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 139>>>(0x3c.l+24) leshort 0x020b 140>>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 141 142# hooray, there's a DOS extender using the PE format, with a valid PE 143# executable inside (which just prints a message and exits if run in win) 144>>>(8.s*16) string 32STUB \b, 32rtm DOS extender 145>>>(8.s*16) string !32STUB \b, for MS Windows 146>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 147>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 148>>>(0x3c.l+0xf8) search/0x140 UPX2 149>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 150>>>(0x3c.l+0xf8) search/0x140 .idata 151>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 152>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 153>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 154>>>(0x3c.l+0xf8) search/0x140 .rsrc 155>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 156>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 157>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 158>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 159>>>(0x3c.l+0xf8) search/0x140 .data 160>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 161>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 162>>>>(0x3c.l+0xf7) byte x 163>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 164>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 165>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 166>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 167>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 168>>>0x30 string Inno \b, InnoSetup self-extracting archive 169 170# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 171# must be one of the unusual subformats. 172>>(0x3c.l) string !PE\0\0 MS-DOS executable 173!:mime application/x-dosexec 174 175>>(0x3c.l) string NE \b, NE 176!:mime application/x-dosexec 177>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 178>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 179>>>(0x3c.l+0x36) byte 3 for MS-DOS 180>>>(0x3c.l+0x36) byte 4 for Windows 386 181>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 182>>>(0x3c.l+0x36) default x 183>>>>(0x3c.l+0x36) byte x (unknown OS %x) 184>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 185>>>(0x3c.l+0x0c) leshort&0x8000 0x8000 (DLL or font) 186# DRV: Driver 187# 3GR: Grabber device driver 188# CPL: Control Panel Item 189# VBX: Visual Basic Extension 190# FON: Bitmap font 191# FOT: Font resource file 192!:ext dll/drv/3gr/cpl/vbx/fon/fot 193>>>(0x3c.l+0x0c) leshort&0x8000 0 (EXE) 194!:ext exe/scr 195>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 196>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 197 198>>(0x3c.l) string LX\0\0 \b, LX 199!:mime application/x-dosexec 200>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 201>>>(0x3c.l+0x0a) leshort 1 for OS/2 202>>>(0x3c.l+0x0a) leshort 2 for MS Windows 203>>>(0x3c.l+0x0a) leshort 3 for DOS 204>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 205>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 206>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 207>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 208>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 209>>>(0x3c.l+0x08) leshort 1 i80286 210>>>(0x3c.l+0x08) leshort 2 i80386 211>>>(0x3c.l+0x08) leshort 3 i80486 212>>>(8.s*16) string emx \b, emx 213>>>>&1 string x %s 214>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 215 216# MS Windows system file, supposedly a collection of LE executables 217>>(0x3c.l) string W3 \b, W3 for MS Windows 218!:mime application/x-dosexec 219 220>>(0x3c.l) string LE\0\0 \b, LE executable 221!:mime application/x-dosexec 222>>>(0x3c.l+0x0a) leshort 1 223# some DOS extenders use LE files with OS/2 header 224>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 225>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 226>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 227>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 228>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 229>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 230>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 231# this is a wild guess; hopefully it is a specific signature 232>>>>&0x24 lelong <0x50 233>>>>>(&0x4c.l) string \xfc\xb8WATCOM 234>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 235# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 236#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 237# fails with DOS-Extenders. 238>>>(0x3c.l+0x0a) leshort 2 for MS Windows 239>>>(0x3c.l+0x0a) leshort 3 for DOS 240>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 241# VXD: VxD for Windows 95/98/Me 242# 386: VxD for Windows 2.10, 3.0, 3.1x 243# PDR: Port driver 244# MPD: Miniport driver (?) 245!:ext vxd/386/pdr/mpd 246>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 247>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 248 249# looks like ASCII, probably some embedded copyright message. 250# and definitely not NE/LE/LX/PE 251>>0x3c lelong >0x20000000 252>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 253!:mime application/x-dosexec 254!:ext exe/com 255# header data too small for extended executable 256>2 long !0 257>>0x18 leshort <0x40 258>>>(4.s*512) leshort !0x014c 259 260>>>>&(2.s-514) string !LE 261>>>>>&-2 string !BW \b, MZ for MS-DOS 262!:mime application/x-dosexec 263>>>>&(2.s-514) string LE \b, LE 264>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 265# educated guess since indirection is still not capable enough for complex offset 266# calculations (next embedded executable would be at &(&2*512+&0-2) 267# I suspect there are only LE executables in these multi-exe files 268>>>>&(2.s-514) string BW 269>>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded) 270>>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS 271 272# This sequence skips to the first COFF segment, usually .text 273>(4.s*512) leshort 0x014c \b, COFF 274!:mime application/x-dosexec 275>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 276>>(8.s*16) string emx 277>>>&1 string x for DOS, Win or OS/2, emx %s 278>>&(&0x42.l-3) byte x 279>>>&0x26 string UPX \b, UPX compressed 280# and yet another guess: small .text, and after large .data is unusal, could be 32lite 281>>&0x2c search/0xa0 .text 282>>>&0x0b lelong <0x2000 283>>>>&0 lelong >0x6000 \b, 32lite compressed 284 285>(8.s*16) string $WdX \b, WDos/X DOS extender 286 287# By now an executable type should have been printed out. The executable 288# may be a self-uncompressing archive, so look for evidence of that and 289# print it out. 290# 291# Some signatures below from Greg Roelofs, newt@uchicago.edu. 292# 293>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 294>0xe7 string LH/2\ Self-Extract \b, %s 295>0x1c string UC2X \b, UCEXE compressed 296>0x1c string WWP\ \b, WWPACK compressed 297>0x1c string RJSX \b, ARJ self-extracting archive 298>0x1c string diet \b, diet compressed 299>0x1c string LZ09 \b, LZEXE v0.90 compressed 300>0x1c string LZ91 \b, LZEXE v0.91 compressed 301>0x1c string tz \b, TinyProg compressed 302>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 303!:mime application/zip 304# Yes, this really is "Copr", not "Corp." 305>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 306!:mime application/zip 307# winarj stores a message in the stub instead of the sig in the MZ header 308>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 309>0x20 string AIN 310>>0x23 string 2 \b, AIN 2.x compressed 311>>0x23 string <2 \b, AIN 1.x compressed 312>>0x23 string >2 \b, AIN 1.x compressed 313>0x24 string LHa's\ SFX \b, LHa self-extracting archive 314!:mime application/x-lha 315>0x24 string LHA's\ SFX \b, LHa self-extracting archive 316!:mime application/x-lha 317>0x24 string \ $ARX \b, ARX self-extracting archive 318>0x24 string \ $LHarc \b, LHarc self-extracting archive 319>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 320>0x40 string aPKG \b, aPackage self-extracting archive 321>0x64 string W\ Collis\0\0 \b, Compack compressed 322>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 323>>&0xf4 search/0x140 \x0\x40\x1\x0 324>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 325>1638 string -lh5- \b, LHa self-extracting archive v2.13S 326>0x17888 string Rar! \b, RAR self-extracting archive 327 328# Skip to the end of the EXE. This will usually work fine in the PE case 329# because the MZ image is hardcoded into the toolchain and almost certainly 330# won't match any of these signatures. 331>(4.s*512) long x 332>>&(2.s-517) byte x 333>>>&0 string PK\3\4 \b, ZIP self-extracting archive 334>>>&0 string Rar! \b, RAR self-extracting archive 335>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 336>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 337>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 338>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 339>>>&7 search/400 **ACE** \b, ACE self-extracting archive 340>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 341 342# a few unknown ZIP sfxes, no idea if they are needed or if they are 343# already captured by the generic patterns above 344>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 345# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 346# 347 348# TELVOX Teleinformatica CODEC self-extractor for OS/2: 349>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 350>>49824 leshort =1 \b, 1 file 351>>49824 leshort >1 \b, %u files 352 353# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc 354# and https://www.freedos.org/software/?prog=kpdos 355# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 3560 string/b KCF FreeDOS KEYBoard Layout collection 357# only version=0x100 found 358>3 uleshort x \b, version 0x%x 359# length of string containing author,info and special characters 360>6 ubyte >0 361#>>6 pstring x \b, name=%s 362>>7 string >\0 \b, author=%-.14s 363>>7 search/254 \xff \b, info= 364#>>>&0 string x \b%-s 365>>>&0 string x \b%-.15s 366# for FreeDOS *.KL files 3670 string/b KLF FreeDOS KEYBoard Layout file 368# only version=0x100 or 0x101 found 369>3 uleshort x \b, version 0x%x 370# stringlength 371>5 ubyte >0 372>>8 string x \b, name=%-.2s 3730 string \xffKEYB\ \ \ \0\0\0\0 374>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 375 376# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017 377# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 3780 ulequad&0x07a0ffffffff 0xffffffff 379>0 use msdos-driver 3800 name msdos-driver DOS executable ( 381#!:mime application/octet-stream 382!:mime application/x-dosdriver 383# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN 384!:ext sys/dev/bin 385>40 search/7 UPX! \bUPX compressed 386# DOS device driver attributes 387>4 uleshort&0x8000 0x0000 \bblock device driver 388# character device 389>4 uleshort&0x8000 0x8000 \b 390>>4 uleshort&0x0008 0x0008 \bclock 391# fast video output by int 29h 392>>4 uleshort&0x0010 0x0010 \bfast 393# standard input/output device 394>>4 uleshort&0x0003 >0 \bstandard 395>>>4 uleshort&0x0001 0x0001 \binput 396>>>4 uleshort&0x0003 0x0003 \b/ 397>>>4 uleshort&0x0002 0x0002 \boutput 398>>4 uleshort&0x8000 0x8000 \bcharacter device driver 399>0 ubyte x 400# upx compressed device driver has garbage instead of real in name field of header 401>>40 search/7 UPX! 402>>40 default x 403# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 404>>>12 ubyte >0x2E \b 405>>>>10 ubyte >0x20 406>>>>>10 ubyte !0x2E 407>>>>>>10 ubyte !0x2A \b%c 408>>>>11 ubyte >0x20 409>>>>>11 ubyte !0x2E \b%c 410>>>>12 ubyte >0x20 411>>>>>12 ubyte !0x39 412>>>>>>12 ubyte !0x2E \b%c 413>>>13 ubyte >0x20 414>>>>13 ubyte !0x2E \b%c 415>>>>14 ubyte >0x20 416>>>>>14 ubyte !0x2E \b%c 417>>>>15 ubyte >0x20 418>>>>>15 ubyte !0x2E \b%c 419>>>>16 ubyte >0x20 420>>>>>16 ubyte !0x2E 421>>>>>>16 ubyte <0xCB \b%c 422>>>>17 ubyte >0x20 423>>>>>17 ubyte !0x2E 424>>>>>>17 ubyte <0x90 \b%c 425# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 426>>>12 ubyte <0x2F 427# they have their real name at offset 22 428# also block device drivers like DUMBDRV.SYS 429>>>>22 string >\056 %-.6s 430>4 uleshort&0x8000 0x0000 431# 32 bit sector addressing ( > 32 MB) for block devices 432>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 433# support by driver functions 13h, 17h, 18h 434>4 uleshort&0x0040 0x0040 \b,IOCTL- 435# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 436>4 uleshort&0x0800 0x0800 \b,close media- 437# output until busy support by int 10h for character device driver 438>4 uleshort&0x8000 0x8000 439>>4 uleshort&0x2000 0x2000 \b,until busy- 440# direct read/write support by driver functions 03h,0Ch 441>4 uleshort&0x4000 0x4000 \b,control strings- 442>4 uleshort&0x8000 0x8000 443>>4 uleshort&0x6840 >0 \bsupport 444>4 uleshort&0x8000 0x0000 445>>4 uleshort&0x4842 >0 \bsupport 446>0 ubyte x \b) 447# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 4480 ulequad 0x0513c00000000012 449>0 use msdos-driver 450# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field 4510 ulequad 0x32f28000ffff0016 452>0 use msdos-driver 4530 ulequad 0x007f00000000ffff 454>0 use msdos-driver 4550 ulequad 0x001600000000ffff 456>0 use msdos-driver 457# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field 4580 ulequad 0x0bf708c2ffffffff 459>0 use msdos-driver 4600 ulequad 0x07bd08c2ffffffff 461>0 use msdos-driver 462 463# updated by Joerg Jenderek 464# GRR: line below too general as it catches also 465# rt.lib DYADISKS.PIC and many more 466# start with assembler instruction MOV 4670 ubyte 0x8c 468# skip "AppleWorks word processor data" like ARTICLE.1 ./apple 469>4 string !O==== 470# skip some unknown basic binaries like RocketRnger.SHR 471>>5 string !MAIN 472# skip "GPG symmetrically encrypted data" ./gnu 473# skip "PGP symmetric key encrypted data" ./pgp 474# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type 475>>>4 ubyte >13 DOS executable (COM, 0x8C-variant) 476# the remaining files should be DOS *.COM executables 477# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd 478# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4 479# UNDELETE.COM 8cca 2e8916 6503 b430 cd21 8b 2e0200 8b 480# BOOTFIX.COM 8cca 2e8916 9603 b430 cd21 8b 2e0200 8b 481# RAWRITE3.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 482# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 483# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e 484# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e 485!:mime application/x-dosexec 486!:ext com 487 488# updated by Joerg Jenderek at Oct 2008 4890 ulelong 0xffff10eb DR-DOS executable (COM) 490# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 4910 ubeshort&0xeb8d >0xeb00 492# DR-DOS STACKER.COM SCREATE.SYS missed 493 4940 name msdos-com 495>0 byte x DOS executable (COM) 496!:mime application/x-dosexec 497!:ext com 498>6 string SFX\ of\ LHarc \b, %s 499>0x1FE leshort 0xAA55 \b, boot code 500>85 string UPX \b, UPX compressed 501>4 string \ $ARX \b, ARX self-extracting archive 502>4 string \ $LHarc \b, LHarc self-extracting archive 503>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 504 505# JMP 8bit 5060 byte 0xeb 507# allow forward jumps only 508>1 byte >-1 509# that offset must be accessible 510>>(1.b+2) byte x 511>>>0 use msdos-com 512 513# JMP 16bit 5140 byte 0xe9 515# forward jumps 516>1 short >-1 517# that offset must be accessible 518>>(1.s+3) byte x 519>>>0 use msdos-com 520# negative offset, must not lead into PSP 521>1 short <-259 522# that offset must be accessible 523>>(1,s+65539) byte x 524>>>0 use msdos-com 525 526# updated by Joerg Jenderek at Oct 2008,2015 527# following line is too general 5280 ubyte 0xb8 529# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux 530>0 string !\xb8\xc0\x07\x8e 531# modified by Joerg Jenderek 532# syslinux COM32 or COM32R executable 533>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT 534# https://www.syslinux.org/wiki/index.php/Comboot_API 535# Since version 5.00 c32 modules switched from the COM32 object format to ELF 536!:mime application/x-c32-comboot-syslinux-exec 537!:ext c32 538# https://syslinux.zytor.com/comboot.php 539# older syslinux version ( <4 ) 540# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 541# start with assembler instructions mov eax,21cd4cffh 542>>>1 lelong 0x21CD4CFf \b) 543# syslinux:doc/comboot.txt 544# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 545# eax,21cd4cfeh) as a magic number. 546# syslinux version (4.x) 547# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID 548>>>1 lelong 0x21CD4CFe \b, relocatable) 549# remaining are DOS COM executables starting with assembler instruction MOV 550# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM 551# MS-DOS SYS.COM RESTART.COM 552# SYSLINUX.COM (version 1.40 - 2.13) 553# GFXBOOT.COM (version 3.75) 554# COPYBS.COM POWEROFF.COM INT18.COM 555>>1 default x COM executable for DOS 556!:mime application/x-dosexec 557#!:mime application/x-ms-dos-executable 558#!:mime application/x-msdos-program 559!:ext com 560 5610 string/b \x81\xfc 562>4 string \x77\x02\xcd\x20\xb9 563>>36 string UPX! FREE-DOS executable (COM), UPX compressed 564!:mime application/x-dosexec 565!:ext com 566252 string Must\ have\ DOS\ version DR-DOS executable (COM) 567!:mime application/x-dosexec 568!:ext com 569# added by Joerg Jenderek at Oct 2008 570# GRR search is not working 571#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed 57234 string UPX! FREE-DOS executable (COM), UPX compressed 573!:mime application/x-dosexec 574!:ext com 57535 string UPX! FREE-DOS executable (COM), UPX compressed 576!:mime application/x-dosexec 577!:ext com 578# GRR search is not working 579#2 search/28 \xcd\x21 COM executable for MS-DOS 580#WHICHFAT.cOM 5812 string \xcd\x21 COM executable for DOS 582!:mime application/x-dosexec 583!:ext com 584#DELTREE.cOM DELTREE2.cOM 5854 string \xcd\x21 COM executable for DOS 586!:mime application/x-dosexec 587!:ext com 588#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 5895 string \xcd\x21 COM executable for DOS 590!:mime application/x-dosexec 591!:ext com 592#DELTMP.COm HASFAT32.cOM 5937 string \xcd\x21 594>0 byte !0xb8 COM executable for DOS 595!:mime application/x-dosexec 596!:ext com 597#COMP.cOM MORE.COm 59810 string \xcd\x21 599>5 string !\xcd\x21 COM executable for DOS 600!:mime application/x-dosexec 601!:ext com 602#comecho.com 60313 string \xcd\x21 COM executable for DOS 604!:mime application/x-dosexec 605!:ext com 606#HELP.COm EDIT.coM 60718 string \xcd\x21 COM executable for MS-DOS 608!:mime application/x-dosexec 609!:ext com 610#NWRPLTRM.COm 61123 string \xcd\x21 COM executable for MS-DOS 612!:mime application/x-dosexec 613!:ext com 614#LOADFIX.cOm LOADFIX.cOm 61530 string \xcd\x21 COM executable for MS-DOS 616!:mime application/x-dosexec 617!:ext com 618#syslinux.com 3.11 61970 string \xcd\x21 COM executable for DOS 620!:mime application/x-dosexec 621!:ext com 622# many compressed/converted COMs start with a copy loop instead of a jump 6230x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 624!:mime application/x-dosexec 625!:ext com 6260x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 627!:mime application/x-dosexec 628!:ext com 629>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 6300x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 631!:mime application/x-dosexec 632!:ext com 633# FIXME: missing diet .com compression 634 635# miscellaneous formats 6360 string/b LZ MS-DOS executable (built-in) 637#0 byte 0xf0 MS-DOS program library data 638# 639 640# AAF files: 641# <stuartc@rd.bbc.co.uk> Stuart Cunningham 6420 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 643>30 byte 9 (512B sectors) 644>30 byte 12 (4kB sectors) 6450 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 646>30 byte 9 (512B sectors) 647>30 byte 12 (4kB sectors) 648 649# Popular applications 6502080 string Microsoft\ Word\ 6.0\ Document %s 651!:mime application/msword 6522080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data 653!:mime application/msword 654# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 6552112 string MSWordDoc Microsoft Word document data 656!:mime application/msword 657# 6580 belong 0x31be0000 Microsoft Word Document 659!:mime application/msword 660# 6610 string/b PO^Q` Microsoft Word 6.0 Document 662!:mime application/msword 663# 6644 long 0 665>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0 666!:mime application/msword 667!:ext mcw 668>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0 669!:mime application/msword 670!:ext mcw 671>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0 672!:mime application/msword 673!:ext mcw 674>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0 675!:mime application/msword 676!:ext mcw 677 6780 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document 679!:mime application/msword 680!:ext doc 681# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs 682#512 string/b \354\245\301 Microsoft Word Document 683#!:mime application/msword 684 685# 6860 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 687!:mime application/msword 688# 6892080 string Microsoft\ Excel\ 5.0\ Worksheet %s 690!:mime application/vnd.ms-excel 691# 6920 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 693!:mime application/msword 694 6952080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s 696!:mime application/vnd.ms-excel 697# 698# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 6992114 string Biff5 Microsoft Excel 5.0 Worksheet 700!:mime application/vnd.ms-excel 701# Italian MS-Excel 7022121 string Biff5 Microsoft Excel 5.0 Worksheet 703!:mime application/vnd.ms-excel 7040 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 705!:mime application/vnd.ms-excel 706# 707# Update: Joerg Jenderek 708# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3 709# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf 710# Note: newer Lotus versions >2 use longer BOF record 711# record type (BeginningOfFile=0000h) + length (001Ah) 7120 belong 0x00001a00 713# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3 714#>18 uleshort&0x73E0 0 715# Lotus Multi Byte Character Set (LMBCS=1-31) 716>20 ubyte >0 717>>20 ubyte <32 Lotus 1-2-3 718#!:mime application/x-123 719!:mime application/vnd.lotus-1-2-3 720!:apple ????L123 721# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data" 722>>>4 uleshort 0x1000 WorKsheet, version 3 723!:ext wk3 724# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data" 725>>>4 uleshort 0x1002 WorKsheet, version 4 726# also worksheet template 4 (.wt4) 727!:ext wk4/wt4 728# no example or documentation for wk5 729#>>4 uleshort 0x???? WorKsheet, version 4 730#!:ext wk5 731# only MacrotoScript.123 example 732>>>4 uleshort 0x1003 WorKsheet, version 97 733# also worksheet template Smartmaster (.12M)? 734!:ext 123 735# only Set_Y2K.123 example 736>>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium 737!:ext 123 738# no example for this version 739>>>4 uleshort 0x8001 FoRMatting data 740!:ext frm 741# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data" 742# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet" 743>>>4 uleshort 0x8007 ForMatting data, version 3 744!:ext fm3 745>>>4 default x unknown 746# file revision sub code 0004h for worksheets 747>>>>6 uleshort =0x0004 worksheet 748!:ext wXX 749>>>>6 uleshort !0x0004 formatting data 750!:ext fXX 751# main revision number 752>>>>4 uleshort x \b, revision 0x%x 753>>>6 uleshort =0x0004 \b, cell range 754# active cellcoord range (start row, page,column ; end row, page, column) 755# start values normally 0~1st sheet A1 756>>>>8 ulelong !0 757>>>>>10 ubyte >0 \b%d* 758>>>>>8 uleshort x \b%d, 759>>>>>11 ubyte x \b%d- 760# end page mostly 0 761>>>>14 ubyte >0 \b%d* 762# end raw, column normally not 0 763>>>>12 uleshort x \b%d, 764>>>>15 ubyte x \b%d 765# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??) 766>>>>20 ubyte >1 \b, character set 0x%x 767# flags 768>>>>21 ubyte x \b, flags 0x%x 769>>>6 uleshort !0x0004 770# record type (FONTNAME=00AEh) 771>>>>30 search/29 \0\xAE 772# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n) 773>>>>>&4 string >\0 \b, 1st font "%s" 774# 775# Update: Joerg Jenderek 776# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3 777# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT 778# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x 779# record type (BeginningOfFile=0000h) + length (0002h) 7800 belong 0x00000200 781# GRR: line above is too general as it catches also MS Windows CURsor 782# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1) 783!:strength -1 784# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h 785>7 ubyte 0 786# skip Windows cursors with image width 256 and keep Lotus with positiv opcode 787>>6 ubyte >0 Lotus 788# !:mime application/x-123 789!:mime application/vnd.lotus-1-2-3 790!:apple ????L123 791# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...) 792# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3" 793>>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF) 794!:ext cnf 795>>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J 796!:ext cnf 797>>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1 798!:ext cnf 799>>>4 uleshort 0x0802 Symphony CoNFiguration 800!:ext cnf 801>>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2 802!:ext cnf 803>>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4 804!:ext cnf 805>>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x 806!:ext cnf 807>>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x 808!:ext cnf 809# (version 5.26) labeled the entry as "Lotus 123" 810# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 811>>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1 812# extension "wks" also for Microsoft Works document 813!:ext wks 814# (version 5.26) labeled the entry as "Lotus 123" 815# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 816>>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0 817!:ext wrk/wr1 818# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data" 819# TrID labeles the entry as "Lotus 123 Worksheet (V2)" 820>>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2 821# Symphony (.wr1) 822!:ext wk1/wr1 823# no example for this japan version 824>>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ 825!:ext wj1 826# no example or documentation for wk2 827#>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2 828#!:ext wk2 829# undocumented japan version 830>>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J 831!:ext wj3 832# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data" 833>>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x 834# japan version 2.4J (fj3) 835!:ext fmt/fj3 836# no example for this version 837>>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0 838!:ext frm 839# (version 5.26) labeled the entry as "Lotus 1-2-3" 840>>>4 default x unknown worksheet or configuration 841!:ext cnf 842>>>>4 uleshort x \b, revision 0x%x 843# 2nd record for most worksheets describes cells range 844>>>6 use lotus-cells 845# 3nd record for most japan worksheets describes cells range 846>>>(8.s+10) use lotus-cells 847# check and then display Lotus worksheet cells range 8480 name lotus-cells 849# look for type (RANGE=0006h) + length (0008h) at record begin 850>0 ubelong 0x06000800 \b, cell range 851# cell range (start column, row, end column, row) start values normally 0,0~A1 cell 852>>4 ulong !0 853>>>4 uleshort x \b%d, 854>>>6 uleshort x \b%d- 855# end of cell range 856>>8 uleshort x \b%d, 857>>10 uleshort x \b%d 858# EndOfLotus123 8590 string/b WordPro\0 Lotus WordPro 860!:mime application/vnd.lotus-wordpro 8610 string/b WordPro\r\373 Lotus WordPro 862!:mime application/vnd.lotus-wordpro 863 864 865# Summary: Script used by InstallScield to uninstall applications 866# Extension: .isu 867# Submitted by: unknown 868# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 8690 string \x71\xa8\x00\x00\x01\x02 870>12 string Stirling\ Technologies, InstallShield Uninstall Script 871 872# Winamp .avs 873#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 8740 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 875 876# Windows Metafile .WMF 8770 string/b \327\315\306\232 Windows metafile 878!:mime image/wmf 879!:ext wmf 8800 string/b \002\000\011\000 Windows metafile 881!:mime image/wmf 882!:ext wmf 8830 string/b \001\000\011\000 Windows metafile 884!:mime image/wmf 885!:ext wmf 886 887#tz3 files whatever that is (MS Works files) 8880 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 8890 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 8900 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 891 892# PGP sig files .sig 893#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 8940 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 8950 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 8960 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 8970 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 8980 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 8990 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 900 901# windows zips files .dmf 9020 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 903 904 905#ico files 9060 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows 907 908# Windows icons 909# Update: Joerg Jenderek 910# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 911# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG 9120 belong 0x00000100 913>9 byte 0 914>>0 byte x 915>>0 use cur-ico-dir 916>9 ubyte 0xff 917>>0 byte x 918>>0 use cur-ico-dir 919# displays number of icons and information for icon or cursor 9200 name cur-ico-dir 921# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with 922# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h 923>18 ulelong &0x00000006 924# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG) 925>>(18.l) ulelong x MS Windows 926>>>0 ubelong 0x00000100 icon resource 927# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon 928!:mime image/vnd.microsoft.icon 929#!:mime image/x-icon 930!:ext ico 931>>>>4 uleshort x - %d icon 932# plural s 933>>>>4 uleshort >1 \bs 934# 1st icon 935>>>>0x06 use ico-entry 936# 2nd icon 937>>>>4 uleshort >1 938>>>>>0x16 use ico-entry 939>>>0 ubelong 0x00000200 cursor resource 940#!:mime image/x-cur 941!:mime image/x-win-bitmap 942!:ext cur 943>>>>4 uleshort x - %d icon 944>>>>4 uleshort >1 \bs 945# 1st cursor 946>>>>0x06 use cur-entry 947#>>>>0x16 use cur-entry 948# display information of one cursor entry 9490 name cur-entry 950>0 use cur-ico-entry 951>4 uleshort x \b, hotspot @%dx 952>6 uleshort x \b%d 953# display information of one icon entry 9540 name ico-entry 955>0 use cur-ico-entry 956# normally 0 1 but also found 14 957>4 uleshort >1 \b, %d planes 958# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256 959>6 uleshort >1 \b, %d bits/pixel 960# display shared information of cursor or icon entry 9610 name cur-ico-entry 962>0 byte =0 \b, 256x 963>0 byte !0 \b, %dx 964>1 byte =0 \b256 965>1 byte !0 \b%d 966# number of colors in palette 967>2 ubyte !0 \b, %d colors 968# reserved 0 FFh 969#>3 ubyte x \b, reserved %x 970#>8 ulelong x \b, image size %d 971# offset of PNG or DIB image 972#>12 ulelong x \b, offset 0x%x 973# PNG header (\x89PNG) 974>(12.l) ubelong =0x89504e47 975# 1 space char after "with" to get phrase "with PNG image" by magic in ./images 976>>&-4 indirect x \b with 977# DIB image 978>(12.l) ubelong !0x89504e47 979#>>&-4 use dib-image 980 981# Windows non-animated cursors 982# Update: Joerg Jenderek 983# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 984# Note: similar to Windows ICOn. container for BMP ( only DIB part) 985# GRR: line below is too general as it catches also Lotus 1-2-3 files 9860 belong 0x00000200 987>9 byte 0 988>>0 use cur-ico-dir 989>9 ubyte 0xff 990>>0 use cur-ico-dir 991 992# .chr files 9930 string/b PK\010\010BGI Borland font 994>4 string >\0 %s 995# then there is a copyright notice 996 997 998# .bgi files 9990 string/b pk\010\010BGI Borland device 1000>4 string >\0 %s 1001# then there is a copyright notice 1002 1003 1004# Windows Recycle Bin record file (named INFO2) 1005# By Abel Cheung (abelcheung AT gmail dot com) 1006# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 1007# Since Vista uses another structure, INFO2 structure probably won't change 1008# anymore. Detailed analysis in: 1009# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 10100 lelong 0x00000004 1011>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 1012 10130 lelong 0x00000005 1014>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 1015 1016# From Doug Lee via a FreeBSD pr 10179 string GERBILDOC First Choice document 10189 string GERBILDB First Choice database 10199 string GERBILCLIP First Choice database 10200 string GERBIL First Choice device file 10219 string RABBITGRAPH RabbitGraph file 10220 string DCU1 Borland Delphi .DCU file 10230 string =!<spell> MKS Spell hash list (old format) 10240 string =!<spell2> MKS Spell hash list 1025# Too simple - MPi 1026#0 string AH Halo(TM) bitmapped font file 10270 lelong 0x08086b70 TurboC BGI file 10280 lelong 0x08084b50 TurboC Font file 1029 1030# Debian#712046: The magic below identifies "Delphi compiled form data". 1031# An additional source of information is available at: 1032# http://www.woodmann.com/fravia/dafix_t1.htm 10330 string TPF0 1034>4 pstring >\0 Delphi compiled form '%s' 1035 1036# tests for DBase files moved, updated and merged to database 1037 10380 string PMCC Windows 3.x .GRP file 10391 string RDC-meg MegaDots 1040>8 byte >0x2F version %c 1041>9 byte >0x2F \b.%c file 10420 lelong 0x4C 1043>4 lelong 0x00021401 Windows shortcut file 1044 1045# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm 1046# only for windows versions equal or greater 3.0 10470x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 1048!:mime application/x-dosexec 1049!:ext pif 1050#>2 string >\0 \b, Title:%.30s 1051>0x24 string >\0 \b for %.63s 1052>0x65 string >\0 \b, directory=%.64s 1053>0xA5 string >\0 \b, parameters=%.64s 1054#>0x181 leshort x \b, offset %x 1055#>0x183 leshort x \b, offsetdata %x 1056#>0x185 leshort x \b, section length %x 1057>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 1058>>&0x5e ubyte >0 1059>>>&-1 string <PIFMGR.DLL \b, icon=%s 1060#>>>&-1 string PIFMGR.DLL \b, icon=%s 1061>>>&-1 string >PIFMGR.DLL \b, icon=%s 1062>>&0xF0 ubyte >0 1063>>>&-1 string <Terminal \b, font=%.32s 1064#>>>&-1 string =Terminal \b, font=%.32s 1065>>>&-1 string >Terminal \b, font=%.32s 1066>>&0x110 ubyte >0 1067>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 1068#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 1069>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 1070#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 1071#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 1072>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 1073#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 1074>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 1075#>>&06 string x \b:%s 1076>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 1077#>>&06 string x \b:%s 1078 1079# DOS EPS Binary File Header 1080# From: Ed Sznyter <ews@Black.Market.NET> 10810 belong 0xC5D0D3C6 DOS EPS Binary File 1082!:mime image/x-eps 1083>4 long >0 Postscript starts at byte %d 1084>>8 long >0 length %d 1085>>>12 long >0 Metafile starts at byte %d 1086>>>>16 long >0 length %d 1087>>>20 long >0 TIFF starts at byte %d 1088>>>>24 long >0 length %d 1089 1090# TNEF magic From "Joomy" <joomy@se-ed.net> 1091# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 10920 lelong 0x223e9f78 TNEF 1093!:mime application/vnd.ms-tnef 1094 1095# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C 1096# of http://www.davep.org/norton-guides/ng2h-105.tgz 1097# https://en.wikipedia.org/wiki/Norton_Guides 10980 string NG\0\001 1099# only value 0x100 found at offset 2 1100>2 ulelong 0x00000100 Norton Guide 1101# Title[40] 1102>>8 string >\0 "%-.40s" 1103#>>6 uleshort x \b, MenuCount=%u 1104# szCredits[5][66] 1105>>48 string >\0 \b, %-.66s 1106>>114 string >\0 %-.66s 1107 1108# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 1109# of https://www.4dos.info/ 1110# pointer,HelpID[8]=4DHnnnmm 11110 ulelong 0x48443408 4DOS help file 1112>4 string x \b, version %-4.4s 1113 1114# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 11150 ulequad 0x3a000000024e4c MS Advisor help file 1116 1117# HtmlHelp files (.chm) 11180 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data 1119 1120# GFA-BASIC (Wolfram Kleff) 11212 string/b GFA-BASIC3 GFA-BASIC 3 data 1122 1123#------------------------------------------------------------------------------ 1124# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 1125# Update: Joerg Jenderek 1126# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format) 1127# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx 1128# Note: verified by `7z l *.cab` 1129# Microsoft Cabinet files 11300 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 1131# 1132# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool 1133# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE 1134# because some archive does not have *.diag* as 1st or 2nd archive member like 1135# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab 1136# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section 1137>0x2c search/980/c .diag \b, Diagnostic 1138!:mime application/vnd.ms-cab-compressed 1139!:ext diagcab 1140# http://fileformats.archiveteam.org/wiki/PUZ 1141# Microsoft Publisher version about 2003 has a "Pack and Go" feature that 1142# bundles a Publisher document *PNG.pub with all links into a CAB 1143>0x2c search/300/c png.pub\0 \b, Publisher Packed and Go 1144!:mime application/vnd.ms-cab-compressed 1145!:ext puz 1146# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation 1147>0x2c search/17/c ppview32.exe\0 \b, PowerPoint Viewer Packed and Go 1148!:mime application/vnd.ms-powerpoint 1149#!:mime application/mspowerpoint 1150!:ext ppz 1151# http://www.incredimail.com/ 1152# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims 1153>0x2c search/3369/c content.ini\0 \b, IncrediMail 1154!:mime application/x-incredimail 1155# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf 1156>>0x2c search/83/c Flavor.htm\0 ecard 1157!:ext imf 1158# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims 1159>>0x2c search/211/c .swf\0 skin 1160!:ext ims 1161# member anim.im3 implies IncrediMail animation like in letter_fold.ima 1162>>0x2c search/92/c anim.im3\0 animation 1163!:ext ima 1164# other IncrediMail cab archive 1165>>0x2c default x 1166>>>0x2c search/116/c thumb ecard, image, notifier or skin 1167!:ext imf/imi/imn/ims 1168# http://file-extension.net/seeker/file_extension_ime 1169>>>0x2c default x emoticons or sound 1170!:ext ime/imw 1171# no Diagnostic and IncrediMail 1172>0x2c default x 1173# look for 1st member name 1174>>(16.l+16) ubyte x 1175# https://en.wikipedia.org/wiki/SNP_file_format 1176>>>&-1 string/c _accrpt_.snp \b, Access report snapshot 1177!:mime application/msaccess 1178!:ext snp 1179# https://www.cabextract.org.uk/wince_cab_format/ 1180# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer 1181>>>&7 string =.000 \b, WinCE install 1182!:mime application/vnd.ms-cab-compressed 1183!:ext cab 1184 1185# https://support.microsoft.com/kb/934307/en-US 1186# All inspected MSU contain a file with name WSUSSCAN.cab 1187# that is called "Windows Update meta data" by Microsoft 1188>>>&-1 string/c wsusscan.cab \b, Microsoft Standalone Update 1189!:mime application/vnd.ms-cab-compressed 1190!:ext msu 1191>>>&-1 default x 1192# look at point charcter of 1st archive member name for file name extension 1193>>>>&-1 search/255 . 1194# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm 1195# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002 1196# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB 1197>>>>>&0 string/c ppt\0 \b, PowerPoint Packed and Go 1198!:mime application/vnd.ms-powerpoint 1199#!:mime application/mspowerpoint 1200!:ext ppz 1201# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx 1202# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack 1203# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack 1204>>>>>&0 string/c theme \b, Windows 1205!:mime application/x-windows-themepack 1206# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8 1207# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack 1208# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme 1209>>>>>>(16.l+16) string =Panoram 8 1210!:ext deskthemepack 1211>>>>>>(16.l+16) string !Panoram 7 or 8 1212!:ext themepack/deskthemepack 1213>>>>>>(16.l+16) ubyte x Theme Pack 1214>>>>>&0 default x 1215# look for null terminator of 1st member name 1216>>>>>>&0 search/255 \0 1217# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu 1218>>>>>>>&16 string/c wsusscan.cab \b, Microsoft Standalone Update 1219!:mime application/vnd.ms-cab-compressed 1220!:ext msu 1221>>>>>>>&16 default x 1222# archive with more then one file need some output in version 5.32 to avoid error message like 1223# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type 1224# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type 1225# file: could not find any valid magic files! 1226>>>>>>>>28 uleshort >1 \b, many 1227!:mime application/vnd.ms-cab-compressed 1228!:ext cab 1229# remaining archives with just one file 1230>>>>>>>>28 uleshort =1 1231# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386 1232>>>>>>>>>30 uleshort =0x0000 \b, Windows 2000/XP setup 1233# cut of last char of source extension and add underscore to generate extension 1234# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_ 1235!:mime application/vnd.ms-cab-compressed 1236!:ext _/?_/??_ 1237# archive need some output like "single" in version 5.32 to avoid error messages 1238>>>>>>>>>30 uleshort !0x0000 \b, single 1239!:mime application/vnd.ms-cab-compressed 1240!:ext cab 1241# TODO: additional extensions like 1242# .xsn InfoPath Dynamic Form 1243# .xtp InfoPath Template Part 1244# .lvf Logitech Video Effects Face Accessory 1245>8 ulelong x \b, %u bytes 1246>28 uleshort 1 \b, 1 file 1247>28 uleshort >1 \b, %u files 1248# Reserved fields, set to zero 1249#>4 belong !0 \b, reserved1 %x 1250#>12 belong !0 \b, reserved2 %x 1251# offset of the first CFFILE entry coffFiles: minimal 2Ch 1252>16 ulelong x \b, at 0x%x 1253>(16.l) use cab-file 1254# at least also 2nd member 1255>28 uleshort >1 1256>>(16.l+16) ubyte x 1257>>>&0 search/255 \0 1258# second member info 1259>>>>&0 use cab-file 1260#>20 belong !0 \b, reserved %x 1261# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3 1262>24 ubeshort !0x0301 \b version 0x%x 1263# number of CFFOLDER entries 1264>26 uleshort >1 \b, %u cffolders 1265# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields 1266# only found for flags 0 1 2 3 4 not 7 1267>30 uleshort >0 \b, flags 0x%x 1268# Cabinet files have a 16-bit cabinet setID field that is designed for application use. 1269# default is zero, however, the -i option of cabarc can be used to set this field 1270>32 uleshort >0 \b, ID %u 1271# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet 1272#>34 uleshort x \b, iCabinet %u 1273# add one for display because humans start numbering by 1 and also fit to name of disk szDisk* 1274>34 uleshort+1 x \b, number %u 1275>30 uleshort &0x0004 \b, extra bytes 1276# cbCFHeader optional size of per-cabinet reserved area 14h 1800h 1277>>36 uleshort >0 %u in head 1278# cbCFFolder is optional size of per-folder reserved area 1279>>38 ubyte >0 %u in folder 1280# cbCFData is optional size of per-datablock reserved area 1281>>39 ubyte >0 %u in data block 1282# optional per-cabinet reserved area abReserve[cbCFHeader] 1283>>36 uleshort >0 1284# 1st CFFOLDER after reserved area in header 1285>>>(36.s+40) use cab-folder 1286# no reserved area in header 1287>30 uleshort ^0x0004 1288# no previous and next cab archive 1289>>30 uleshort =0x0000 1290>>>36 use cab-folder 1291# only previous cab archive 1292>>30 uleshort =0x0001 \b, previous 1293>>>36 use cab-anchor 1294# only next cab archive 1295>>30 uleshort =0x0002 \b, next 1296>>>36 use cab-anchor 1297# previous+next cab archive 1298# can not use sub routine cab-anchor to display previous and next cabinet together 1299#>>>36 use cab-anchor 1300#>>>>&0 use cab-anchor 1301>>30 uleshort =0x0003 \b, previous 1302>>>36 string x %s 1303# optional name of previous disk szDisk* 1304>>>>&1 string x disk %s 1305>>>>>&1 string x \b, next %s 1306# optional name of previous disk szDisk* 1307>>>>>>&1 string x disk %s 1308>>>>>>>&1 use cab-folder 1309# display filename and disk name of previous or next cabinet 13100 name cab-anchor 1311# optional name of previous/next cabinet file szCabinet*[255] 1312>&0 string x %s 1313# optional name of previous/next disk szDisk*[255] 1314>>&1 string x disk %s 1315# display folder structure CFFOLDER information like compression of cabinet 13160 name cab-folder 1317# offset of the CFDATA block in this folder 1318#>0 ulelong x \b, coffCabStart 0x%x 1319# number of CFDATA blocks in folder 1320>4 uleshort x \b, %u datablock 1321# plural s 1322>4 uleshort >1 \bs 1323# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15 1324>6 uleshort x \b, 0x%x compression 1325# optional per-folder reserved area 1326#>8 ubequad x \b, abReserve 0x%llx 1327# display member structure CFFILE information like member name of cabinet 13280 name cab-file 1329# cbFile is uncompressed size of file in bytes 1330#>0 ulelong x \b, cbFile %u 1331# uoffFolderStart is uncompressed offset of file in folder 1332#>4 ulelong >0 \b, uoffFolderStart 0x%x 1333# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet 1334# define ifoldCONTINUED_FROM_PREV (0xFFFD) 1335# define ifoldCONTINUED_TO_NEXT (0xFFFE) 1336# define ifoldCONTINUED_PREV_AND_NEXT (0xFFFF) 1337>8 uleshort >0 \b, iFolder 0x%x 1338# date stamp for file 1339#>10 uleshort x \b, date 0x%x 1340# time stamp for file 1341#>12 uleshort x \b, time 0x%x 1342# attribs is attribute flags for file 1343# define _A_RDONLY (0x01) file is read-only 1344# define _A_HIDDEN (0x02) file is hidden 1345# define _A_SYSTEM (0x04) file is a system file 1346# define _A_ARCH (0x20) file modified since last backup 1347# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab 1348# define _A_EXEC (0x40) run after extraction 1349# define _A_NAME_IS_UTF (0x80) szName[] contains UTF 1350# define UNKNOWN (0x0100) undocumented or accident 1351#>14 uleshort x \b, attribs 0x%x 1352>14 uleshort >0 + 1353>>14 uleshort &0x0001 \bR 1354>>14 uleshort &0x0002 \bH 1355>>14 uleshort &0x0004 \bS 1356>>14 uleshort &0x0020 \bA 1357>>14 uleshort &0x0040 \bX 1358>>14 uleshort &0x0080 \bUtf 1359# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB 1360>>14 uleshort &0x0100 \b? 1361# szName is name of archive member 1362>16 string x "%s" 1363# next archive member name if more files 1364#>>&17 string >\0 \b, NEXT NAME %-.50s 1365 1366# InstallShield Cabinet files 13670 string/b ISc( InstallShield Cabinet archive data 1368>5 byte&0xf0 =0x60 version 6, 1369>5 byte&0xf0 !0x60 version 4/5, 1370>(12.l+40) lelong x %u files 1371 1372# Windows CE package files 13730 string/b MSCE\0\0\0\0 Microsoft WinCE install header 1374>20 lelong 0 \b, architecture-independent 1375>20 lelong 103 \b, Hitachi SH3 1376>20 lelong 104 \b, Hitachi SH4 1377>20 lelong 0xA11 \b, StrongARM 1378>20 lelong 4000 \b, MIPS R4000 1379>20 lelong 10003 \b, Hitachi SH3 1380>20 lelong 10004 \b, Hitachi SH3E 1381>20 lelong 10005 \b, Hitachi SH4 1382>20 lelong 70001 \b, ARM 7TDMI 1383>52 leshort 1 \b, 1 file 1384>52 leshort >1 \b, %u files 1385>56 leshort 1 \b, 1 registry entry 1386>56 leshort >1 \b, %u registry entries 1387 1388 1389# Windows Enhanced Metafile (EMF) 1390# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 1391# for further information. 13920 ulelong 1 1393>40 string \ EMF Windows Enhanced Metafile (EMF) image data 1394>>44 ulelong x version 0x%x 1395 1396 13970 string/b \224\246\056 Microsoft Word Document 1398!:mime application/msword 1399 1400512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document 1401!:mime application/msword 1402 1403# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 1404# Magic type for Dell's BIOS .hdr files 1405# Dell's .hdr 14060 string/b $RBU 1407>23 string Dell %s system BIOS 1408>5 byte 2 1409>>48 byte x version %d. 1410>>49 byte x \b%d. 1411>>50 byte x \b%d 1412>5 byte <2 1413>>48 string x version %.3s 1414 1415# Type: Microsoft Document Imaging Format (.mdi) 1416# URL: https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 1417# From: Daniele Sempione <scrows@oziosi.org> 1418# Too weak (EP) 1419#0 short 0x5045 Microsoft Document Imaging Format 1420 1421# MS eBook format (.lit) 14220 string/b ITOLITLS Microsoft Reader eBook Data 1423>8 lelong x \b, version %u 1424!:mime application/x-ms-reader 1425 1426# Windows CE Binary Image Data Format 1427# From: Dr. Jesus <j@hug.gs> 14280 string/b B000FF\n Windows Embedded CE binary image 1429 1430# The second byte of these signatures is a file version; I don't know what, 1431# if anything, produced files with version numbers 0-2. 1432# From: John Elliott <johne@seasip.demon.co.uk> 14330 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 14340 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 14350 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 14360 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 1437 14380 string MIOPEN Mallard BASIC Jetsam data 14390 string Jetsam0 Mallard BASIC Jetsam index data 1440 1441# DOS backup 2.0 to 3.2 1442 1443# backupid.@@@ 1444 1445# plausibility check for date 14460x3 ushort >1979 1447>0x5 ubyte-1 <31 1448>>0x6 ubyte-1 <12 1449# actually 121 nul bytes 1450>>>0x7 string \0\0\0\0\0\0\0\0 1451>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d 1452!:ext @@@ 1453>>>>0x0 ubyte 0xff \b, last disk 1454 1455# backed up file 1456 1457# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd 1458# by looking for trailing nul of maximal file name string 14590x52 ubyte 0 1460# test for flag byte: FFh~complete file, 00h~split file 1461# FFh -127 = -1 -127 = -128 1462# 00h -127 = 0 -127 = -127 1463>0 byte-127 <-126 1464# plausibility check for file name length 1465>>0x53 ubyte-1 <78 1466# looking for terminating nul of file name string 1467>>>(0x53.b+4) ubyte 0 1468# looking if last char of string is valid DOS file name 1469>>>>(0x53.b+3) ubyte >0x1F 1470# actually 44 nul bytes 1471# but sometimes garbage according to Ralf Quint. So can not be used as test 1472#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 1473# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator 1474# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 1475>>>>>5 ubyte&0x8C 0x0C 1476# ./msdos (version 5.30) labeled the entry as 1477# "DOS 2.0 backed up file %s, split file, sequence %d" or 1478# "DOS 2.0 backed up file %s, complete file" 1479>>>>>>0 ubyte x DOS 2.0-3.2 backed up 1480#>>>>>>0 ubyte 0xff complete 1481>>>>>>0 ubyte 0 1482>>>>>>>1 uleshort x sequence %d of 1483# full file name with path but without drive letter and colon stored from 0x05 til 0x52 1484>>>>>>0x5 string x file %s 1485# backup name is original filename 1486#!:ext * 1487# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*' 1488# file: line 1169: Bad magic entry ' *' 1489# after header original file content 1490>>>>>>128 indirect x \b; 1491 1492 1493# DOS backup 3.3 to 5.x 1494 1495# CONTROL.nnn files 14960 string \x8bBACKUP\x20 1497# actually 128 nul bytes 1498>0xa string \0\0\0\0\0\0\0\0 1499>>0x9 ubyte x DOS 3.3 backup control file, sequence %d 1500>>0x8a ubyte 0xff \b, last disk 1501 1502# NB: The BACKUP.nnn files consist of the files backed up, 1503# concatenated. 1504