1 2#------------------------------------------------------------------------------ 3# $File: msdos,v 1.158 2022/09/07 11:17:31 christos Exp $ 4# msdos: file(1) magic for MS-DOS files 5# 6 7# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 8# updated by Joerg Jenderek at Oct 2008,Apr 2011 90 string/t @ 10>1 string/cW \ echo\ off DOS batch file text 11!:mime text/x-msdos-batch 12!:ext bat 13>1 string/cW echo\ off DOS batch file text 14!:mime text/x-msdos-batch 15!:ext bat 16>1 string/cW rem DOS batch file text 17!:mime text/x-msdos-batch 18!:ext bat 19>1 string/cW set\ DOS batch file text 20!:mime text/x-msdos-batch 21!:ext bat 22 23 24# OS/2 batch files are REXX. the second regex is a bit generic, oh well 25# the matched commands seem to be common in REXX and uncommon elsewhere 26100 search/0xffff rxfuncadd 27>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 28100 search/0xffff say 29>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 30 31# updated by Joerg Jenderek at Oct 2015 32# https://de.wikipedia.org/wiki/Common_Object_File_Format 33# http://www.delorie.com/djgpp/doc/coff/filhdr.html 34# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable" 35#0 leshort 0x14c MS Windows COFF Intel 80386 object file 36#>4 ledate x stamp %s 370 leshort 0x166 MS Windows COFF MIPS R4000 object file 38#>4 ledate x stamp %s 390 leshort 0x184 MS Windows COFF Alpha object file 40#>4 ledate x stamp %s 410 leshort 0x268 MS Windows COFF Motorola 68000 object file 42#>4 ledate x stamp %s 430 leshort 0x1f0 MS Windows COFF PowerPC object file 44#>4 ledate x stamp %s 450 leshort 0x290 MS Windows COFF PA-RISC object file 46#>4 ledate x stamp %s 47 48# Tests for various EXE types. 49# 50# Many of the compressed formats were extracted from IDARC 1.23 source code. 51# 520 string/b MZ 53# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 54>0x18 leshort <0x40 MS-DOS executable 55!:mime application/x-dosexec 56# Windows and later versions of DOS will allow .EXEs to be named with a .COM 57# extension, mostly for compatibility's sake. 58# URL: https://en.wikipedia.org/wiki/Personal_NetWare#VLM 59# Reference: https://mark0.net/download/triddefs_xml.7z/defs/e/exe-vlm-msg.trid.xml 60!:ext exe/com/vlm 61# These traditional tests usually work but not always. When test quality support is 62# implemented these can be turned on. 63#>>0x18 leshort 0x1c (Borland compiler) 64#>>0x18 leshort 0x1e (MS compiler) 65 66# Maybe it's a PE? 67>(0x3c.l) string PE\0\0 PE 68!:mime application/x-dosexec 69>>(0x3c.l+24) leshort 0x010b \b32 executable 70>>(0x3c.l+24) leshort 0x020b \b32+ executable 71>>(0x3c.l+24) leshort 0x0107 ROM image 72>>(0x3c.l+24) default x Unknown PE signature 73>>>&0 leshort x %#x 74>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 75>>(0x3c.l+92) leshort 1 76# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the 77# drivers in Windows/System32/drivers/*.sys. 78>>>(0x3c.l+22) leshort&0x2000 >0 (native) 79!:ext dll/sys 80>>>(0x3c.l+22) leshort&0x2000 0 (native) 81!:ext exe/sys 82>>(0x3c.l+92) leshort 2 83>>>(0x3c.l+22) leshort&0x2000 >0 (GUI) 84# These could probably be at least partially distinguished from one another by 85# looking for specific exported functions. 86# CPL: Control Panel item 87# TLB: Type library 88# OCX: OLE/ActiveX control 89# ACM: Audio compression manager codec 90# AX: DirectShow source filter 91# IME: Input method editor 92!:ext dll/cpl/tlb/ocx/acm/ax/ime 93>>>(0x3c.l+22) leshort&0x2000 0 (GUI) 94# Screen savers typically include code from the scrnsave.lib static library, but 95# that's not guaranteed. 96!:ext exe/scr 97>>(0x3c.l+92) leshort 3 98>>>(0x3c.l+22) leshort&0x2000 >0 (console) 99!:ext dll/cpl/tlb/ocx/acm/ax/ime 100>>>(0x3c.l+22) leshort&0x2000 0 (console) 101!:ext exe/com 102# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format 103>>(0x3c.l+92) leshort 7 (POSIX) 104>>(0x3c.l+92) leshort 9 (Windows CE) 105>>(0x3c.l+92) leshort 10 (EFI application) 106>>(0x3c.l+92) leshort 11 (EFI boot service driver) 107>>(0x3c.l+92) leshort 12 (EFI runtime driver) 108>>(0x3c.l+92) leshort 13 (EFI ROM) 109>>(0x3c.l+92) leshort 14 (XBOX) 110>>(0x3c.l+92) leshort 15 (Windows boot application) 111>>(0x3c.l+92) default x (Unknown subsystem 112>>>&0 leshort x %#x) 113>>(0x3c.l+4) leshort 0x14c Intel 80386 114>>(0x3c.l+4) leshort 0x166 MIPS R4000 115>>(0x3c.l+4) leshort 0x168 MIPS R10000 116>>(0x3c.l+4) leshort 0x184 Alpha 117>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 118>>(0x3c.l+4) leshort 0x1a3 Hitachi SH3 DSP 119>>(0x3c.l+4) leshort 0x1a8 Hitachi SH5 120>>(0x3c.l+4) leshort 0x169 MIPS WCE v2 121>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 122>>(0x3c.l+4) leshort 0x1c0 ARM 123>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 124>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 125>>(0x3c.l+4) leshort 0x1d3 Matsushita AM33 126>>(0x3c.l+4) leshort 0x1f0 PowerPC 127>>(0x3c.l+4) leshort 0x1f1 PowerPC with FPU 128>>(0x3c.l+4) leshort 0x1f2 PowerPC (big-endian) 129>>(0x3c.l+4) leshort 0x200 Intel Itanium 130>>(0x3c.l+4) leshort 0x266 MIPS16 131>>(0x3c.l+4) leshort 0x268 Motorola 68000 132>>(0x3c.l+4) leshort 0x290 PA-RISC 133>>(0x3c.l+4) leshort 0x366 MIPSIV 134>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 135>>(0x3c.l+4) leshort 0xebc EFI byte code 136>>(0x3c.l+4) leshort 0x5032 RISC-V 32-bit 137>>(0x3c.l+4) leshort 0x5064 RISC-V 64-bit 138>>(0x3c.l+4) leshort 0x5128 RISC-V 128-bit 139>>(0x3c.l+4) leshort 0x9041 Mitsubishi M32R 140>>(0x3c.l+4) leshort 0x8664 x86-64 141>>(0x3c.l+4) leshort 0xaa64 Aarch64 142>>(0x3c.l+4) leshort 0xc0ee MSIL 143>>(0x3c.l+4) default x Unknown processor type 144>>>&0 leshort x %#x 145>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 146>>(0x3c.l+22) leshort&0x1000 >0 system file 147>>(0x3c.l+24) leshort 0x010b 148>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 149>>(0x3c.l+24) leshort 0x020b 150>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 151 152# hooray, there's a DOS extender using the PE format, with a valid PE 153# executable inside (which just prints a message and exits if run in win) 154>>(8.s*16) string 32STUB \b, 32rtm DOS extender 155>>(8.s*16) string !32STUB \b, for MS Windows 156>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 157>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 158>>(0x3c.l+0xf8) search/0x140 UPX2 159>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 160>>(0x3c.l+0xf8) search/0x140 .idata 161>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 162>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 163>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 164>>(0x3c.l+0xf8) search/0x140 .rsrc 165>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 166>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 167>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 168>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 169>>(0x3c.l+0xf8) search/0x140 .data 170>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 171>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 172>>>(0x3c.l+0xf7) byte x 173>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 174>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 175>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 176>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 177>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 178>>0x30 string Inno \b, InnoSetup self-extracting archive 179 180# If the relocation table is 0x40 or more bytes into the file, it's definitely 181# not a DOS EXE. 182>0x18 leshort >0x3f 183 184# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 185# must be one of the unusual subformats. 186>>(0x3c.l) string !PE\0\0 MS-DOS executable 187!:mime application/x-dosexec 188 189>>(0x3c.l) string NE \b, NE 190!:mime application/x-dosexec 191>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 192>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 193>>>(0x3c.l+0x36) byte 3 for MS-DOS 194>>>(0x3c.l+0x36) byte 4 for Windows 386 195>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 196>>>(0x3c.l+0x36) default x 197>>>>(0x3c.l+0x36) byte x (unknown OS %x) 198>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 199>>>(0x3c.l+0x0c) leshort&0x8000 0x8000 (DLL or font) 200# DRV: Driver 201# 3GR: Grabber device driver 202# CPL: Control Panel Item 203# VBX: Visual Basic Extension 204# FON: Bitmap font 205# FOT: Font resource file 206!:ext dll/drv/3gr/cpl/vbx/fon/fot 207>>>(0x3c.l+0x0c) leshort&0x8000 0 (EXE) 208!:ext exe/scr 209>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 210>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 211 212>>(0x3c.l) string LX\0\0 \b, LX 213!:mime application/x-dosexec 214>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 215>>>(0x3c.l+0x0a) leshort 1 for OS/2 216>>>(0x3c.l+0x0a) leshort 2 for MS Windows 217>>>(0x3c.l+0x0a) leshort 3 for DOS 218>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 219>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 220>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 221>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 222>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 223>>>(0x3c.l+0x08) leshort 1 i80286 224>>>(0x3c.l+0x08) leshort 2 i80386 225>>>(0x3c.l+0x08) leshort 3 i80486 226>>>(8.s*16) string emx \b, emx 227>>>>&1 string x %s 228>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 229 230# MS Windows system file, supposedly a collection of LE executables 231>>(0x3c.l) string W3 \b, W3 for MS Windows 232!:mime application/x-dosexec 233 234>>(0x3c.l) string LE\0\0 \b, LE executable 235!:mime application/x-dosexec 236>>>(0x3c.l+0x0a) leshort 1 237# some DOS extenders use LE files with OS/2 header 238>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 239>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 240>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 241>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 242>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 243>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 244>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 245# this is a wild guess; hopefully it is a specific signature 246>>>>&0x24 lelong <0x50 247>>>>>(&0x4c.l) string \xfc\xb8WATCOM 248>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 249# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 250#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 251# fails with DOS-Extenders. 252>>>(0x3c.l+0x0a) leshort 2 for MS Windows 253>>>(0x3c.l+0x0a) leshort 3 for DOS 254>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 255# VXD: VxD for Windows 95/98/Me 256# 386: VxD for Windows 2.10, 3.0, 3.1x 257# PDR: Port driver 258# MPD: Miniport driver (?) 259!:ext vxd/386/pdr/mpd 260>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 261>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 262 263# looks like ASCII, probably some embedded copyright message. 264# and definitely not NE/LE/LX/PE 265>>0x3c lelong >0x20000000 266>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 267!:mime application/x-dosexec 268!:ext exe/com 269# header data too small for extended executable 270>2 long !0 271>>0x18 leshort <0x40 272>>>(4.s*512) leshort !0x014c 273 274>>>>&(2.s-514) string !LE 275>>>>>&-2 string !BW \b, MZ for MS-DOS 276!:mime application/x-dosexec 277>>>>&(2.s-514) string LE \b, LE 278>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 279# educated guess since indirection is still not capable enough for complex offset 280# calculations (next embedded executable would be at &(&2*512+&0-2) 281# I suspect there are only LE executables in these multi-exe files 282>>>>&(2.s-514) string BW 283>>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded) 284>>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS 285 286# This sequence skips to the first COFF segment, usually .text 287>(4.s*512) leshort 0x014c \b, COFF 288!:mime application/x-dosexec 289>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 290>>(8.s*16) string emx 291>>>&1 string x for DOS, Win or OS/2, emx %s 292>>&(&0x42.l-3) byte x 293>>>&0x26 string UPX \b, UPX compressed 294# and yet another guess: small .text, and after large .data is unusual, could be 32lite 295>>&0x2c search/0xa0 .text 296>>>&0x0b lelong <0x2000 297>>>>&0 lelong >0x6000 \b, 32lite compressed 298 299>(8.s*16) string $WdX \b, WDos/X DOS extender 300 301# By now an executable type should have been printed out. The executable 302# may be a self-uncompressing archive, so look for evidence of that and 303# print it out. 304# 305# Some signatures below from Greg Roelofs, newt@uchicago.edu. 306# 307>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 308>0xe7 string LH/2\ Self-Extract \b, %s 309>0x1c string UC2X \b, UCEXE compressed 310>0x1c string WWP\ \b, WWPACK compressed 311>0x1c string RJSX \b, ARJ self-extracting archive 312>0x1c string diet \b, diet compressed 313>0x1c string LZ09 \b, LZEXE v0.90 compressed 314>0x1c string LZ91 \b, LZEXE v0.91 compressed 315>0x1c string tz \b, TinyProg compressed 316>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 317!:mime application/zip 318# Yes, this really is "Copr", not "Corp." 319>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 320!:mime application/zip 321# winarj stores a message in the stub instead of the sig in the MZ header 322>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 323>0x20 string AIN 324>>0x23 string 2 \b, AIN 2.x compressed 325>>0x23 string <2 \b, AIN 1.x compressed 326>>0x23 string >2 \b, AIN 1.x compressed 327>0x24 string LHa's\ SFX \b, LHa self-extracting archive 328!:mime application/x-lha 329>0x24 string LHA's\ SFX \b, LHa self-extracting archive 330!:mime application/x-lha 331>0x24 string \ $ARX \b, ARX self-extracting archive 332>0x24 string \ $LHarc \b, LHarc self-extracting archive 333>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 334>0x40 string aPKG \b, aPackage self-extracting archive 335>0x64 string W\ Collis\0\0 \b, Compack compressed 336>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 337>>&0xf4 search/0x140 \x0\x40\x1\x0 338>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 339>1638 string -lh5- \b, LHa self-extracting archive v2.13S 340>0x17888 string Rar! \b, RAR self-extracting archive 341 342# Skip to the end of the EXE. This will usually work fine in the PE case 343# because the MZ image is hardcoded into the toolchain and almost certainly 344# won't match any of these signatures. 345>(4.s*512) long x 346>>&(2.s-517) byte x 347>>>&0 string PK\3\4 \b, ZIP self-extracting archive 348>>>&0 string Rar! \b, RAR self-extracting archive 349>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 350>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 351>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 352>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 353>>>&7 search/400 **ACE** \b, ACE self-extracting archive 354>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 355 356# a few unknown ZIP sfxes, no idea if they are needed or if they are 357# already captured by the generic patterns above 358>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 359# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 360# 361 362# TELVOX Teleinformatica CODEC self-extractor for OS/2: 363>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 364>>49824 leshort =1 \b, 1 file 365>>49824 leshort >1 \b, %u files 366 367# Summary: OS/2 LX Library and device driver (no DOS stub) 368# From: Joerg Jenderek 369# URL: http://en.wikipedia.org/wiki/EXE 370# Reference: http://www.textfiles.com/programming/FORMATS/lxexe.txt 371# https://github.com/open-watcom/open-watcom-v2/blob/master/bld/watcom/h/exeflat.h 372# Note: by dll-os2-no-dos-stub.trid.xml called "OS/2 Dynamic Link Library (no DOS stub)" 373# TODO: unify with DOS stub variant (MZ magic) 3740 string/b LX 375>2 ushort =0 376>>0 use lx-executable 377# no examples found for big endian variant 378>2 ushort =0x0101 379>>0 use \^lx-executable 3800 name lx-executable 381# similar looking like variant with MS-DOS stub (MZ magic): "MS-DOS executable, LX" 382#>0x00 uleshort x executable, 383# signature OSF_FLAT_LX_SIGNATURE~0x584C~LX OSF_FLAT_SIGNATURE~0x454C~LE 384>0x00 uleshort =0x584c LX 385>0x00 uleshort =0x454C LE 386>0x00 uleshort x executable 387#!:mime application/x-msdownload 388!:mime application/x-lx-executable 389# byte order: 00h~little-endian non-zero=1~big-endian 390#>0x02 ubyte =0 (little-endian) 391>0x02 ubyte !0 (big-endian) 392# FOR DEBUGGING! 393# word order: 00h~little-endian non-zero=1~big-endian 394#>0x03 ubyte =0 \b, little-endian word order 395#>0x03 ubyte !0 \b, big-endian word order 396# cpu_type; CPU type like: 1~286 2~386 3~486 4 20h~i860 21h~Intel N11 40h~MIPS R2000,R3000 41h~MIPS R6000 42h~MIPS R4000 397#>0x08 uleshort x \b, CPU %u 398# os_type; target operating system like: 0~unknown 1~OS/2 2~Windows 3~DOS 4.x 4~Windows 386 399#>0x0A leshort x \b, OS %u 400# flags; module type flags 401#>0x10 ulelong x \b, FLAGS %#8.8x 402# 00000002h ~Reserved for system use 403#>0x10 ulelong &0x00000002 \b, 2h reserved 404# OSF_INIT_INSTANCE=00000004h ~Per-Process Library Initialization; setting this bit for EXE file is invalid 405#>0x10 ulelong &0x00000004 \b, per-process library Initialization 406# OSF_INTERNAL_FIXUPS_DONE=00000010h ~Internal fixups for the module have been applied 407#>0x10 ulelong &0x00000010 \b, int. fixup 408# OSF_EXTERNAL_FIXUPS_DONE=00000020h ~External fixups for the module have been applied 409#>0x10 ulelong &0x00000020 \b, ext. fixup 410# OSF_NOT_PM_COMPATIBLE=00000100h ~Incompatible with PM windowing 411#>0x10 ulelong&0x00000100 =0x00000100 \b, incompatible with PM windowing 412# OSF_PM_COMPATIBLE=00000200h ~Compatible with PM windowing 413#>0x10 ulelong&0x00000200 =0x00000200 \b, compatible with PM windowing 414# bit 17; device driver 415#>0x10 ulelong&0x00020000 >0 \b, device driver 416# Per-process Library Termination; setting this bit for EXE file is invalid 417#>0x10 ulelong&0x40000000 =0x40000000 \b, per-process library termination 418>0x0a leshort 1 for OS/2 419# no example found 420>0x0a leshort 3 for DOS 421# http://www.ctyme.com/intr/rb-2939.htm#Table1610 422# library by module type mask 00038000h (bits 15-17); 423# 0h ~exectable Program module 424>0x10 ulelong&0x00038000 =0x00000000 (program) 425#!:ext exe 426# OSF_IS_DLL=8000h ~Library module (DLL) 427>0x10 ulelong&0x00038000 >0x00000000 428# OSF_PHYS_DEVICE=00020000h ~device driver 429>>0x10 ulelong&0x00020000 >0 (device driver) 430!:ext sys 431# if not device driver it is library (DLL) 432>>0x10 ulelong&0x00020000 =0 (library) 433!:ext dll 434# bits 8-10; OSF_PM_APP=300h in flags ~Uses PM windowing API; either it is GUI or console 435>0x10 ulelong&0x00000300 =0x00000300 (GUI) 436>0x10 ulelong&0x00000300 !0x00000300 (console) 437# CPU type 438>0x08 uleshort 1 i80286 439# all inspected examples 440>0x08 uleshort 2 i80386 441>0x08 uleshort 3 i80486 442>0x08 uleshort 4 i80586 443# 21h Intel "N11" or compatible 444# 40h MIPS Mark I ( R2000, R3000) or compatible 445# 41h MIPS Mark II ( R6000 ) or compatible 446# 42h MIPS Mark III ( R4000 ) or compatible 447 448# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc 449# and https://www.freedos.org/software/?prog=kpdos 450# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 4510 string/b KCF FreeDOS KEYBoard Layout collection 452# only version=0x100 found 453>3 uleshort x \b, version %#x 454# length of string containing author,info and special characters 455>6 ubyte >0 456#>>6 pstring x \b, name=%s 457>>7 string >\0 \b, author=%-.14s 458>>7 search/254 \xff \b, info= 459#>>>&0 string x \b%-s 460>>>&0 string x \b%-.15s 461# for FreeDOS *.KL files 4620 string/b KLF FreeDOS KEYBoard Layout file 463# only version=0x100 or 0x101 found 464>3 uleshort x \b, version %#x 465# stringlength 466>5 ubyte >0 467>>8 string x \b, name=%-.2s 4680 string \xffKEYB\ \ \ \0\0\0\0 469>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 470 471# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017,Aug 2020 472# URL: http://fileformats.archiveteam.org/wiki/DOS_device_driver 473# Reference: http://www.delorie.com/djgpp/doc/rbinter/it/46/16.html 474# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 4750 ulequad&0x07a0ffffffff 0xffffffff 476# skip OS/2 INI ./os2 477>4 ubelong !0x14000000 478>>0 use msdos-driver 4790 name msdos-driver DOS executable ( 480#!:mime application/octet-stream 481!:mime application/x-dosdriver 482# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN 483# and IBM Token-Ring adapter IBMTOK.DOS. Why and when DOS instead SYS is used? 484# PROTMAN.DOS ELNKPL.DOS 485!:ext sys/dev/bin/dos 486# 1 space char after "UPX compressed" to get phrase like "UPX compressed character device" 487>40 search/7 UPX! \bUPX compressed 488# DOS device driver attributes 489>4 uleshort&0x8000 0x0000 \bblock device driver 490# character device 491>4 uleshort&0x8000 0x8000 \b 492# 1 space char after "clock" to get phrase like "clock character device driver CLOCK$" 493>>4 uleshort&0x0008 0x0008 \bclock 494# fast video output by int 29h 495# 1 space char after "fast" to get phrase like "fast standard input/output character device driver" 496>>4 uleshort&0x0010 0x0010 \bfast 497# standard input/output device 498# 1 space char after "standard" to get phrase like "standard input/output character device driver" 499>>4 uleshort&0x0003 >0 \bstandard 500>>>4 uleshort&0x0001 0x0001 \binput 501>>>4 uleshort&0x0003 0x0003 \b/ 502# 1 space char after "output" to get phrase like "input/output character device driver" 503>>>4 uleshort&0x0002 0x0002 \boutput 504>>4 uleshort&0x8000 0x8000 \bcharacter device driver 505>0 ubyte x 506# upx compressed device driver has garbage instead of real in name field of header 507>>40 search/7 UPX! 508>>40 default x 509# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 510# 1 space char before device driver name to get phrase like "device driver PROTMAN$" 511>>>12 ubyte >0x2E \b 512>>>>10 ubyte >0x20 513>>>>>10 ubyte !0x2E 514>>>>>>10 ubyte !0x2A \b%c 515>>>>11 ubyte >0x20 516>>>>>11 ubyte !0x2E \b%c 517>>>>12 ubyte >0x20 518>>>>>12 ubyte !0x39 519>>>>>>12 ubyte !0x2E \b%c 520>>>13 ubyte >0x20 521>>>>13 ubyte !0x2E \b%c 522>>>>14 ubyte >0x20 523>>>>>14 ubyte !0x2E \b%c 524>>>>15 ubyte >0x20 525>>>>>15 ubyte !0x2E \b%c 526>>>>16 ubyte >0x20 527>>>>>16 ubyte !0x2E 528>>>>>>16 ubyte <0xCB \b%c 529>>>>17 ubyte >0x20 530>>>>>17 ubyte !0x2E 531>>>>>>17 ubyte <0x90 \b%c 532# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 533>>>12 ubyte <0x2F 534# they have their real name at offset 22 535# also block device drivers like DUMBDRV.SYS 536>>>>22 string >\056 %-.6s 537>4 uleshort&0x8000 0x0000 538# 32 bit sector addressing ( > 32 MB) for block devices 539>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 540# support by driver functions 13h, 17h, 18h 541>4 uleshort&0x0040 0x0040 \b,IOCTL- 542# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 543>4 uleshort&0x0800 0x0800 \b,close media- 544# output until busy support by int 10h for character device driver 545>4 uleshort&0x8000 0x8000 546>>4 uleshort&0x2000 0x2000 \b,until busy- 547# direct read/write support by driver functions 03h,0Ch 548>4 uleshort&0x4000 0x4000 \b,control strings- 549>4 uleshort&0x8000 0x8000 550>>4 uleshort&0x6840 >0 \bsupport 551>4 uleshort&0x8000 0x0000 552>>4 uleshort&0x4842 >0 \bsupport 553>0 ubyte x \b) 554>0 ulelong !0xffffffff with pointer %#x 555# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 5560 ulequad 0x0513c00000000012 557>0 use msdos-driver 558# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field 5590 ulequad 0x32f28000ffff0016 560>0 use msdos-driver 5610 ulequad 0x007f00000000ffff 562>0 use msdos-driver 563# https://www.uwe-sieber.de/files/cfg_echo.zip 5640 ulequad 0x001600000000ffff 565>0 use msdos-driver 566# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field 5670 ulequad 0x0bf708c2ffffffff 568>0 use msdos-driver 5690 ulequad 0x07bd08c2ffffffff 570>0 use msdos-driver 571# 3Com EtherLink 3C501 CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\ELNK.DOS 5720 ulequad 0x027ac0c0ffffffff 573>0 use msdos-driver 574# IBM Streamer CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\IBMMPC.DOS 5750 ulequad 0x00228880ffffffff 576>0 use msdos-driver 577 578# updated by Joerg Jenderek 579# GRR: line below too general as it catches also 580# rt.lib DYADISKS.PIC and many more 581# start with assembler instruction MOV 5820 ubyte 0x8c 583# skip "AppleWorks word processor data" like ARTICLE.1 ./apple 584>4 string !O==== 585# skip some unknown basic binaries like RocketRnger.SHR 586>>5 string !MAIN 587# skip "GPG symmetrically encrypted data" ./gnu 588# skip "PGP symmetric key encrypted data" ./pgp 589# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type 590>>>4 ubyte >13 591>>>>0 use msdos-com 592# the remaining files should be DOS *.COM executables 593# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd 594# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4 595# UNDELETE.COM 8cca 2e8916 6503 b430 cd21 8b 2e0200 8b 596# BOOTFIX.COM 8cca 2e8916 9603 b430 cd21 8b 2e0200 8b 597# RAWRITE3.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 598# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 599# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e 600# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e 601 6020 name msdos-com 603# URL: http://fileformats.archiveteam.org/wiki/DOS_executable_(.com) 604>0 byte x DOS executable ( 605# DOS execuable with JuMP 16-bit instruction 606>0 byte =0xE9 607# check for probably nil padding til offset 64 of Lotus driver name 608>>56 quad =0 609# check for "long" alpabetical Lotus driver name like: 610# Diablo "COMPAQ Text Display" "IBM Monochrome Display" "Plantronics ColorPlus" 611>>>24 regex =^[A-Z][A-Za-z\040]{5,21} \bLotus driver) %s 612!:mime application/x-dosexec 613# like: CPQ0TD.DRV IBM0MONO.DRV (Lotus 123 10a) SDIAB4.DRV SPL0CPLS.DRV (Lotus Symphony 2) 614!:ext drv 615# COM with nils like MODE.COM IBMDOS.COM (pcdos 3.31 ru Compaq) RSSTUB.COM (PC-DOS 2000 de) ACCESS.COM (Lotus Symphony 1) 616>>>24 default x \bCOM) 617!:mime application/x-dosexec 618!:ext com 619# DOS excutable with JuMP 16-bit and without nil padding 620>>56 quad !0 621# https://wiki.syslinux.org/wiki/index.php?title=Doc/comboot 622# TODO: HOWTO distinguish COMboot from pure DOS executables? 623# look for unreliable Syslinux specific api call INTerrupt 22h for 16-bit COMBOOT program 624>>>1 search/0xc088 \xcd\x22 \bCOM or COMBOOT 16-bit) 625!:mime application/x-dosexec 626# like: sbm.cbt command.com (Windows XP) UNI2ASCI.COM (FreeDOS 1.2) 627!:ext com/cbt 628>>>1 default x \bCOM) 629!:mime application/x-dosexec 630!:ext com 631# DOS executable without JuMP 16-bit instruction 632>0 byte !0xE9 633# SCREATE.SYS https://en.wikipedia.org/wiki/Stac_Electronics 634>>10 string =?STACVOL \bSCREATE.SYS) 635!:mime application/x-dosexec 636!:ext sys 637# COM executable without JuMP 16-bit instruction and not SCREATE.SYS 638>>10 string !?STACVOL \bCOM) 639!:mime application/x-dosexec 640!:ext com 641>6 string SFX\ of\ LHarc \b, %s 642>0x1FE leshort 0xAA55 \b, boot code 643>85 string UPX \b, UPX compressed 644>4 string \ $ARX \b, ARX self-extracting archive 645>4 string \ $LHarc \b, LHarc self-extracting archive 646>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 647# like: E30ODI.COM MADGEODI.COM UNI2ASCI.COM RECOVER.COM (DOS 2) COMMAND.COM (DOS 2) 648>1 search/0xc088 \xcd\x22 \b, maybe with interrupt 22h 649>0 ubelong x \b, start instruction %#8.8x 650# show more instructions but not in samples like: rem.com (DJGPP) 651>4 ubelong x %8.8x 652 653# JMP 8bit 6540 byte 0xeb 655# byte 0xeb conflicts with magic leshort 0xn2eb of "SYMMETRY i386" handled by ./sequent 656# allow forward jumps only 657>1 byte >-1 658# that offset must be accessible 659# with hexadecimal values like: 0e 2e 50 8c 8d ba bc bd be e8 fb fc 660>>(1.b+2) byte x 661# if look like COM executable with x86 boot signature then this 662# implies FAT volume with x86 real mode code already handled by ./filesystems 663# 664# No x86 boot signature implies often DOS executable 665# check for unrealistic high number of FATs. Then it is an unusual disk image or often a DOS executable 666# like: FIXBIOS.COM (50 bytes) 667>>>16 ubyte >3 668# https://www.drivedroid.io/ 669# skip MBR disk image drivedroid.img version 12 July 2013 by start message 670>>>>2 string !DriveDroid 671# ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/ 672# skip unusual floppy image disk1.img of MS-DOS 1.25 (Corona Data Systems OEM) 673# by check for characteristic message text near the beginning 674>>>>>15 string !Non\040System\040disk 675# "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 4.0.rar" 676# skip BeOS 4 bootfloppy.img done as "Linux kernel x86 boot executable" by ./linux 677# by check for characteristic message text near the beginning 678>>>>>>6 string !read\040error\015 679# https://github.com/ventoy/Ventoy/releases/download/v1.0.78/ventoy-1.0.78-windows.zip 680# skip ventoy 1.0.78 boot_hybrid.img 681>>>>>>>24 string !\220\220\353I$\022\017 682# "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/PC-DOS 1.0 (5.25).rar" 683# skip unusual floppy image PCDOS100.IMG of DOS 1.0 684# by check for characteristic message text near the beginning 685>>>>>>>>9 string !7-May-81 686# "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 5.0 Personal (BA).rar" 687# skip BeOS 5 floppy_1.44.00.ima done as "DOS/MBR boot sector" by ./filesystems 688# by check for characteristic message near the beginning 689>>>>>>>>>3 string !\370sdfS\270 690# like: FIXBIOS.COM (50 bytes) 691>>>>>>>>>>0 use msdos-com 692# check for unrealistic low number of FATs. Then it is an unusual FAT disk image or often a DOS executable 693# like: DEVICE.COM INSTALL.COM (GAG 4.10) WORD.COM (Word 1.15) 694>>>16 ubyte =0 695# if low FATs with x86 boot signature it can be unusual disk image like: boot.img (Ventoy 1.0.27) geodspms.img (Syslinux) 696>>>>0x1FE leshort =0xAA55 697>>>>0x1FE default x 698# https://thestarman.pcministry.com/tool/hxd/dimtut.htm 699# skip unusual floppy image TK-DOS11.img IBMDOS11.img of IBM DOS 1.10 700# by check for characteristic bootloader names near end of boot sector 701>>>>>395 string !ibmbio\040\040com 702>>>>>>0 use msdos-com 703# 8-bit jump with valid number of FAT implies FAT volume already handled by ./filesystems 704# like: balder.img 705>>>16 default x 706# skip disk images with boot signature at end of 1st sector 707# like: TDSK-64b.img 708>>>>(11.s-2) uleshort !0xAA55 709# skip unusual floppy image without boot signature like 360k-256.img (mtools 4.0.18) 710# by check for characteristic file system type text for FAT (12 bit or 16 bit) 711>>>>>54 string !FAT 712# "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/Microsoft MS-DOS 3.31 (Compaq OEM) (3.5).rar" 713# skip unusual floppy image Disk4.img without boot signature and file system type text 714# by check for characteristic OEM-ID text 715>>>>>>3 string !COMPAQ\040\040 716# no such DOS COM executables found 717>>>>>>>0 use msdos-com 718# JMP 16bit 7190 byte 0xe9 720# 16-bit offset; for DEBUGGING!; can be negative like: USBDRIVE.COM 721#>1 leshort x \b, OFFSET %d 722# forward jumps 723>1 leshort >-1 724# that offset must be accessible 725# with hexadecimal values like: 06 1e 0e 2e 60 8c 8d b4 ba be e8 fc 726>>(1.s+3) byte x 727# check for unrealistic high number of FATs. Then it is not a disk image and it is a DOS executable 728# like: CALLVER.COM CPUCACHE.COM K437_EUR.COM SHSUCDX.COM UMBFILL.COM (183 bytes) 729>>>16 ubyte >3 730>>>>0 use msdos-com 731# check for unrealistic low number of FATs. Then it is not a disk image and it is a DOS executable 732# like: GAG.COM DRMOUSE.COM NDN.COM CPQ0TD.DRV 733>>>16 ubyte =0 734>>>>0 use msdos-com 735# maybe disc image with valid number of FATs or DOS executable 736# like: IPXODI.COM PERUSE.COM TASKID.COM 737>>>16 default x 738# invalid low media descriptor. Then it is not a disk image and it is a DOS executable 739>>>>21 ubyte <0xE5 740>>>>>0 use msdos-com 741# valid media descriptor. Then it is maybe disk image or DOS executable 742>>>>21 ubyte >0xE4 743# invalid sectorsize not a power of 2 from 32-32768. Then it is not a disk image and it must be DOS executable 744# like: LEARN.COM (Word 1.15) 745>>>>>11 uleshort&0x001f !0 746>>>>>>0 use msdos-com 747# negative offset, must not lead into PSP 748# like: BASICA.COM (PC dos 3.20) FORMAT.COM SMC8100.COM WORD.COM (word4) 749# HIDSUPT1.COM USBDRIVE.COM USBSUPT1.COM USBUHCI.COM (FreeDOS USBDOS) 750>1 leshort <-259 751# that offset must be accessible 752# add 10000h to jump at end of 64 KiB segment, add 1 for jump instruction and 2 for 16-bit offset 753>>(1,s+65539) byte x 754# after jump next instruction for DEBUGGING! 755#>>>&-1 ubelong x \b, NEXT instruction %#8.8x 756>>>0 use msdos-com 757 758# updated by Joerg Jenderek at Oct 2008,2015,2022 759# following line is too general 7600 ubyte 0xb8 761# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux 762>0 string !\xb8\xc0\x07\x8e 763# modified by Joerg Jenderek 764# syslinux COM32 or COM32R executable 765>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT 766# https://www.syslinux.org/wiki/index.php/Comboot_API 767# Since version 5.00 c32 modules switched from the COM32 object format to ELF 768!:mime application/x-c32-comboot-syslinux-exec 769!:ext c32 770# https://syslinux.zytor.com/comboot.php 771# older syslinux version ( <4 ) 772# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 773# start with assembler instructions mov eax,21cd4cffh 774>>>1 lelong 0x21CD4CFf \b) 775# syslinux:doc/comboot.txt 776# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 777# eax,21cd4cfeh) as a magic number. 778# syslinux version (4.x) 779# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID 780>>>1 lelong 0x21CD4CFe \b, relocatable) 781>>1 default x 782# look for interrupt instruction like in rem.com (DJGPP) LOADER.COM (DR-DOS 7.x) 783>>>3 search/118 \xCD 784# FOR DEBUGGING; possible hexadecimal interupt number like: 10~BANNER.COM 13~bcdw_cl.com 15~poweroff.com (Syslinux) 785# 1A~BERNDPCI.COM 20~SETENHKB.COM 21~mostly 22~gfxboot.com (Syslinux) 2F~SHUTDOWN.COM (GEMSYS) 786#>>>>&0 ubyte x \b, INTERUPT %#x 787# few examples with interrupt 0x13 instruction 788>>>>&0 ubyte =0x13 789# FOR DEBUGGING! 790#>>>>>3 ubequad x \b, 2nd INSTRUCTION %#16.16llx 791# skip Gpt.com Mbr.com (edk2-UDK2018 bootsector) described as "DOS/MBR boot sector" by ./filesystems 792# by check for assembler instructions: mov es,ax ; mov ax,07c0h ; mov ds,ax 793>>>>>3 ubequad !0x8ec0b8c0078ed88d 794# few COM exectables with interrupt 0x13 instruction like: Bootable CD Wizard executables bcdw_cl.com fdemuoff.com 795# http://bootcd.narod.ru/bcdw150z_en.zip 796>>>>>>0 use msdos-com 797# few examples with interrupt 0x16 instruction like flashimg.img 798>>>>&0 ubyte =0x16 799# skip Syslinux 3.71 flashimg.img done as "DOS/MBR boot sector" by ./filesystems 800# by check for assembler instructions: cmp ax 0xE4E4 (magic); jnz 801>>>>>8 ubelong !0x3DE4E475 802# no DOS executable with interrupt 0x16 found 803>>>>>>0 use msdos-com 804# most examples with interrupt instruction unequal 0x13 and 0x16 805>>>>&0 default x 806#>>>>>&-1 ubyte x \b, INTERUPT %#x 807# like: LOADER.COM SETENHKB.COM banner.com copybs.com gif2raw.com poweroff.com rem.com 808>>>>>0 use msdos-com 809# few COM executables without interupt instruction like RESTART.COM (DOS 7.10) REBOOT.COM 810# or some EUC-KR text files or one Ulead Imaginfo thumbnail 811>>>3 default x 812# FOR DEBUGGING; 2nd instruction like 0x50 (RESTART.COM) 0x8e (REBOOT.COM) 813# or random like: 0x0 (IMAGINFO.PE3 sky_snow) 0xb1 (euckr_.txt) 814#>>>>3 ubyte x \b, 2nd INSTRUCTION %#x 815# skip 1 Ulead Imaginfo thumbnail (IMAGINFO.PE3 sky_snow) 816# inside SAMPLES/TEXTURES/SKY_SNOW 817# from https://archive.org/download/PI3CANON/PI3CANON.iso 818>>>>3 ubyte !0x0 819# skip some EUC-KR text files like: euckr_falsepositive.txt 820# https://bugs.astron.com/view.php?id=186 821>>>>>3 ubyte !0xb1 822# like: RESTART.COM (DOS 7.10) REBOOT.COM 823>>>>>>0 use msdos-com 824 825# URL: https://en.wikipedia.org/wiki/UPX 826# Reference: https://github.com/upx/upx/archive/v3.96.zip/upx-3.96/ 827# src/stub/src/i086-dos16.com.S 828# Update: Joerg Jenderek 829# assembler instructions: cmp sp, offset sp_limit 8300 string/b \x81\xfc 831#>2 uleshort x \b, sp_limit=%#x 832# assembler instructions: jump above +2; int 0x20; mov cx, offset bytes_to_copy 833>4 string \x77\x02\xcd\x20\xb9 834#>9 uleshort x \b, [bytes_to_copy]=%#x 835# at different offsets assembler instructions: push di; jump decomp_start_n2b 836>0x1e search/3 \x57\xe9 837#>>&0 uleshort x \b, decomp_start_n2b=%#x 838# src/stub/src/include/header.S; UPX_MAGIC_LE32 839>>&2 string UPX! FREE-DOS executable (COM), UPX 840!:mime application/x-dosexec 841# UPX compressed *.CPI; See ./fonts 842>>>&21 string =FONT compressed DOS code page font 843!:ext cpx 844>>>&21 string !FONT compressed 845!:ext com 846# compressed size? 847#>>>&14 uleshort+152 x \b, %u bytes 848# uncompressed len 849>>>&12 uleshort x \b, uncompressed %u bytes 850252 string Must\ have\ DOS\ version DR-DOS executable (COM) 851!:mime application/x-dosexec 852!:ext com 853# GRR search is not working 854#2 search/28 \xcd\x21 COM executable for MS-DOS 855#WHICHFAT.cOM 8562 string \xcd\x21 COM executable for DOS 857!:mime application/x-dosexec 858!:ext com 859#DELTREE.cOM DELTREE2.cOM 8604 string \xcd\x21 COM executable for DOS 861!:mime application/x-dosexec 862!:ext com 863#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 8645 string \xcd\x21 COM executable for DOS 865!:mime application/x-dosexec 866!:ext com 867#DELTMP.COm HASFAT32.cOM 8687 string \xcd\x21 869>0 byte !0xb8 COM executable for DOS 870!:mime application/x-dosexec 871!:ext com 872#COMP.cOM MORE.COm 87310 string \xcd\x21 874>5 string !\xcd\x21 COM executable for DOS 875!:mime application/x-dosexec 876!:ext com 877#comecho.com 87813 string \xcd\x21 COM executable for DOS 879!:mime application/x-dosexec 880!:ext com 881#HELP.COm EDIT.coM 88218 string \xcd\x21 883# not printable before it? 884>17 byte >32 885>>17 byte <126 886>>17 default x COM executable for MS-DOS 887!:mime application/x-dosexec 888!:ext com 889#NWRPLTRM.COm 89023 string \xcd\x21 COM executable for MS-DOS 891!:mime application/x-dosexec 892!:ext com 893#LOADFIX.cOm LOADFIX.cOm 89430 string \xcd\x21 COM executable for MS-DOS 895!:mime application/x-dosexec 896!:ext com 897#syslinux.com 3.11 89870 string \xcd\x21 COM executable for DOS 899!:mime application/x-dosexec 900!:ext com 901# many compressed/converted COMs start with a copy loop instead of a jump 9020x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 903!:mime application/x-dosexec 904!:ext com 9050x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 906!:mime application/x-dosexec 907!:ext com 908>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 9090x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 910!:mime application/x-dosexec 911!:ext com 912# FIXME: missing diet .com compression 913 914# miscellaneous formats 9150 string/b LZ MS-DOS executable (built-in) 916#0 byte 0xf0 MS-DOS program library data 917# 918 919# AAF files: 920# <stuartc@rd.bbc.co.uk> Stuart Cunningham 9210 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 922>30 byte 9 (512B sectors) 923>30 byte 12 (4kB sectors) 9240 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 925>30 byte 9 (512B sectors) 926>30 byte 12 (4kB sectors) 927 928# Popular applications 929# 930# Update: Joerg Jenderek 931# URL: http://fileformats.archiveteam.org/wiki/DOC 932# Reference: https://web.archive.org/web/20170206041048/ 933# http://www.msxnet.org/word2rtf/formats/ffh-dosword5 934# wIdent+dty 9350 belong 0x31be0000 936# skip droid skeleton like x-fmt-274-signature-id-488.doc 937>128 ubyte >0 Microsoft 938>>96 uleshort =0 Word 939!:mime application/msword 940!:apple MSWDWDBN 941# DCX is used in the Unix version. 942!:ext doc/dcx 943>>>0x6E ulequad =0 1.0-4.0 944>>>0x6E ulequad !0 5.0-6.0 945>>>0x6E ulequad x (DOS) Document 946# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt 947>>96 uleshort !0 Write 3.0 (Windows) Document 948!:mime application/x-mswrite 949!:apple MSWDWDBN 950# sometimes also doc like in splitter.doc srchtest.doc 951!:ext wri/doc 952# wTool must be 0125400 octal 953#>>4 uleshort !0xAB00 \b, wTool %o 954# reserved; must be zero 955#>>6 ulelong !0 \b, reserved %u 956# block pointer to the block containing optional file manager information 957#>>0x1C uleshort x \b, at %#x info block 958# jump to File manager information block 959>>(0x1C.s*128) uleshort x 960# test for valid information start; maybe also 0012h 961>>>&-2 uleshort =0x0014 962# Document ASCIIZ name 963>>>>&0x12 string x %s 964# author name 965>>>>>&1 string x \b, author %s 966# reviser name 967>>>>>>&1 string x \b, reviser %s 968# keywords 969>>>>>>>&1 string x \b, keywords %s 970# comment 971>>>>>>>>&1 string x \b, comment %s 972# version number 973>>>>>>>>>&1 string x \b, version %s 974# date of last change MM/DD/YY 975>>>>>>>>>>&1 string x \b, %-.8s 976# creation date MM/DD/YY 977>>>>>>>>>>&9 string x created %-.8s 978# file name of print format like NORMAL.STY 979>>0x1E string >0 \b, formatted by %-.66s 980# count of pages in whole file for write variant; maybe some times wrong 981>>96 uleshort >0 \b, %u pages 982# name of the printer driver like HPLASMS 983>>0x62 string >0 \b, %-.8s printer 984# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0 985>>0x6A uleshort >0 \b, %u blocks 986# bit field for corrected text areas 987#>>0x6C uleshort x \b, %#x bit field 988# text of document; some times start with 4 non printable characters like CR LF 989>>128 ubyte x \b, 990>>>128 ubyte >0x1F 991>>>>128 string x %s 992>>>128 ubyte <0x20 993>>>>129 ubyte >0x1F 994>>>>>129 string x %s 995>>>>129 ubyte <0x20 996>>>>>130 ubyte >0x1F 997>>>>>>130 string x %s 998>>>>>130 ubyte <0x20 999>>>>>>131 ubyte >0x1F 1000>>>>>>>131 string x %s 1001>>>>>>131 ubyte <0x20 1002>>>>>>>132 ubyte >0x1F 1003>>>>>>>>132 string x %s 1004>>>>>>>132 ubyte <0x20 1005>>>>>>>>133 ubyte >0x1F 1006>>>>>>>>>133 string x %s 1007# 10080 string/b PO^Q` Microsoft Word 6.0 Document 1009!:mime application/msword 1010# 10114 long 0 1012>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0 1013!:mime application/msword 1014!:ext mcw 1015>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0 1016!:mime application/msword 1017!:ext mcw 1018>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0 1019!:mime application/msword 1020!:ext mcw 1021>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0 1022!:mime application/msword 1023!:ext mcw 1024 10250 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document 1026!:mime application/msword 1027!:ext doc 1028# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs 1029#512 string/b \354\245\301 Microsoft Word Document 1030#!:mime application/msword 1031 1032# 10330 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 1034!:mime application/msword 1035# 10360 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 1037!:mime application/msword 1038 1039# 10400 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 1041!:mime application/vnd.ms-excel 1042# https://www.macdisk.com/macsigen.php 1043!:apple XCELXLS4 1044!:ext xls 1045# 1046# Update: Joerg Jenderek 1047# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3 1048# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf 1049# Note: newer Lotus versions >2 use longer BOF record 1050# record type (BeginningOfFile=0000h) + length (001Ah) 10510 belong 0x00001a00 1052# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3 1053#>18 uleshort&0x73E0 0 1054# Lotus Multi Byte Character Set (LMBCS=1-31) 1055>20 ubyte >0 1056>>20 ubyte <32 Lotus 1-2-3 1057#!:mime application/x-123 1058!:mime application/vnd.lotus-1-2-3 1059!:apple ????L123 1060# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data" 1061>>>4 uleshort 0x1000 WorKsheet, version 3 1062!:ext wk3 1063# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data" 1064>>>4 uleshort 0x1002 WorKsheet, version 4 1065# also worksheet template 4 (.wt4) 1066!:ext wk4/wt4 1067# no example or documentation for wk5 1068#>>4 uleshort 0x???? WorKsheet, version 4 1069#!:ext wk5 1070# only MacrotoScript.123 example 1071>>>4 uleshort 0x1003 WorKsheet, version 97 1072# also worksheet template Smartmaster (.12M)? 1073!:ext 123 1074# only Set_Y2K.123 example 1075>>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium 1076!:ext 123 1077# no example for this version 1078>>>4 uleshort 0x8001 FoRMatting data 1079!:ext frm 1080# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data" 1081# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet" 1082>>>4 uleshort 0x8007 ForMatting data, version 3 1083!:ext fm3 1084>>>4 default x unknown 1085# file revision sub code 0004h for worksheets 1086>>>>6 uleshort =0x0004 worksheet 1087!:ext wXX 1088>>>>6 uleshort !0x0004 formatting data 1089!:ext fXX 1090# main revision number 1091>>>>4 uleshort x \b, revision %#x 1092>>>6 uleshort =0x0004 \b, cell range 1093# active cellcoord range (start row, page,column ; end row, page, column) 1094# start values normally 0~1st sheet A1 1095>>>>8 ulelong !0 1096>>>>>10 ubyte >0 \b%d* 1097>>>>>8 uleshort x \b%d, 1098>>>>>11 ubyte x \b%d- 1099# end page mostly 0 1100>>>>14 ubyte >0 \b%d* 1101# end raw, column normally not 0 1102>>>>12 uleshort x \b%d, 1103>>>>15 ubyte x \b%d 1104# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??) 1105>>>>20 ubyte >1 \b, character set %#x 1106# flags 1107>>>>21 ubyte x \b, flags %#x 1108>>>6 uleshort !0x0004 1109# record type (FONTNAME=00AEh) 1110>>>>30 search/29 \0\xAE 1111# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n) 1112>>>>>&4 string >\0 \b, 1st font "%s" 1113# 1114# Update: Joerg Jenderek 1115# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3 1116# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT 1117# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x 1118# record type (BeginningOfFile=0000h) + length (0002h) 11190 belong 0x00000200 1120# GRR: line above is too general as it catches also MS Windows CURsor 1121# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1) 1122!:strength -1 1123# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h 1124>7 ubyte 0 1125# skip Windows cursors with image width 256 and keep Lotus with positive opcode 1126>>6 ubyte >0 Lotus 1127# !:mime application/x-123 1128!:mime application/vnd.lotus-1-2-3 1129!:apple ????L123 1130# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...) 1131# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3" 1132>>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF) 1133!:ext cnf 1134>>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J 1135!:ext cnf 1136>>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1 1137!:ext cnf 1138>>>4 uleshort 0x0802 Symphony CoNFiguration 1139!:ext cnf 1140>>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2 1141!:ext cnf 1142>>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4 1143!:ext cnf 1144>>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x 1145!:ext cnf 1146>>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x 1147!:ext cnf 1148# (version 5.26) labeled the entry as "Lotus 123" 1149# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 1150>>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1 1151# extension "wks" also for Microsoft Works document 1152!:ext wks 1153# (version 5.26) labeled the entry as "Lotus 123" 1154# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 1155>>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0 1156!:ext wrk/wr1 1157# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data" 1158# TrID labeles the entry as "Lotus 123 Worksheet (V2)" 1159>>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2 1160# Symphony (.wr1) 1161!:ext wk1/wr1 1162# no example for this japan version 1163>>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ 1164!:ext wj1 1165# no example or documentation for wk2 1166#>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2 1167#!:ext wk2 1168# undocumented japan version 1169>>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J 1170!:ext wj3 1171# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data" 1172>>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x 1173# japan version 2.4J (fj3) 1174!:ext fmt/fj3 1175# no example for this version 1176>>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0 1177!:ext frm 1178# (version 5.26) labeled the entry as "Lotus 1-2-3" 1179>>>4 default x unknown worksheet or configuration 1180!:ext cnf 1181>>>>4 uleshort x \b, revision %#x 1182# 2nd record for most worksheets describes cells range 1183>>>6 use lotus-cells 1184# 3rd record for most japan worksheets describes cells range 1185>>>(8.s+10) use lotus-cells 1186# check and then display Lotus worksheet cells range 11870 name lotus-cells 1188# look for type (RANGE=0006h) + length (0008h) at record begin 1189>0 ubelong 0x06000800 \b, cell range 1190# cell range (start column, row, end column, row) start values normally 0,0~A1 cell 1191>>4 ulong !0 1192>>>4 uleshort x \b%d, 1193>>>6 uleshort x \b%d- 1194# end of cell range 1195>>8 uleshort x \b%d, 1196>>10 uleshort x \b%d 1197# EndOfLotus123 11980 string/b WordPro\0 Lotus WordPro 1199!:mime application/vnd.lotus-wordpro 12000 string/b WordPro\r\373 Lotus WordPro 1201!:mime application/vnd.lotus-wordpro 1202 1203 1204# Summary: Script used by InstallScield to uninstall applications 1205# Extension: .isu 1206# Submitted by: unknown 1207# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 12080 string \x71\xa8\x00\x00\x01\x02 1209>12 string Stirling\ Technologies, InstallShield Uninstall Script 1210 1211# Winamp .avs 1212#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 12130 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 1214 1215# Windows Metafile .WMF 12160 string/b \327\315\306\232 Windows metafile 1217!:mime image/wmf 1218!:ext wmf 12190 string/b \002\000\011\000 Windows metafile 1220!:mime image/wmf 1221!:ext wmf 12220 string/b \001\000\011\000 Windows metafile 1223!:mime image/wmf 1224!:ext wmf 1225 1226#tz3 files whatever that is (MS Works files) 12270 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 12280 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 12290 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 1230 1231# PGP sig files .sig 1232#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 12330 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 12340 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 12350 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 12360 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 12370 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 12380 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 1239 1240# windows zips files .dmf 12410 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 1242 1243# Windows icons 1244# Update: Joerg Jenderek 1245# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 1246# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG 12470 belong 0x00000100 1248>9 byte 0 1249>>0 byte x 1250>>0 use cur-ico-dir 1251>9 ubyte 0xff 1252>>0 byte x 1253>>0 use cur-ico-dir 1254# displays number of icons and information for icon or cursor 12550 name cur-ico-dir 1256# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with 1257# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h 1258>18 ulelong &0x00000006 1259# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG) 1260>>(18.l) ulelong x MS Windows 1261>>>0 ubelong 0x00000100 icon resource 1262# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon 1263!:mime image/vnd.microsoft.icon 1264#!:mime image/x-icon 1265!:ext ico 1266>>>>4 uleshort x - %d icon 1267# plural s 1268>>>>4 uleshort >1 \bs 1269# 1st icon 1270>>>>0x06 use ico-entry 1271# 2nd icon 1272>>>>4 uleshort >1 1273>>>>>0x16 use ico-entry 1274>>>0 ubelong 0x00000200 cursor resource 1275#!:mime image/x-cur 1276!:mime image/x-win-bitmap 1277!:ext cur 1278>>>>4 uleshort x - %d icon 1279>>>>4 uleshort >1 \bs 1280# 1st cursor 1281>>>>0x06 use cur-entry 1282#>>>>0x16 use cur-entry 1283# display information of one cursor entry 12840 name cur-entry 1285>0 use cur-ico-entry 1286>4 uleshort x \b, hotspot @%dx 1287>6 uleshort x \b%d 1288# display information of one icon entry 12890 name ico-entry 1290>0 use cur-ico-entry 1291# normally 0 1 but also found 14 1292>4 uleshort >1 \b, %d planes 1293# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256 1294>6 uleshort >1 \b, %d bits/pixel 1295# display shared information of cursor or icon entry 12960 name cur-ico-entry 1297>0 byte =0 \b, 256x 1298>0 byte !0 \b, %dx 1299>1 byte =0 \b256 1300>1 byte !0 \b%d 1301# number of colors in palette 1302>2 ubyte !0 \b, %d colors 1303# reserved 0 FFh 1304#>3 ubyte x \b, reserved %x 1305#>8 ulelong x \b, image size %d 1306# offset of PNG or DIB image 1307#>12 ulelong x \b, offset %#x 1308# PNG header (\x89PNG) 1309>(12.l) ubelong =0x89504e47 1310# 1 space char after "with" to get phrase "with PNG image" by magic in ./images 1311>>&-4 indirect x \b with 1312# DIB image 1313>(12.l) ubelong !0x89504e47 1314#>>&-4 use dib-image 1315 1316# Windows non-animated cursors 1317# Update: Joerg Jenderek 1318# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 1319# Note: similar to Windows ICOn. container for BMP ( only DIB part) 1320# GRR: line below is too general as it catches also Lotus 1-2-3 files 13210 belong 0x00000200 1322>9 byte 0 1323>>0 use cur-ico-dir 1324>9 ubyte 0xff 1325>>0 use cur-ico-dir 1326 1327# .chr files 13280 string/b PK\010\010BGI Borland font 1329>4 string >\0 %s 1330# then there is a copyright notice 1331 1332 1333# .bgi files 13340 string/b pk\010\010BGI Borland device 1335>4 string >\0 %s 1336# then there is a copyright notice 1337 1338 1339# Windows Recycle Bin record file (named INFO2) 1340# By Abel Cheung (abelcheung AT gmail dot com) 1341# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 1342# Since Vista uses another structure, INFO2 structure probably won't change 1343# anymore. Detailed analysis in: 1344# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 13450 lelong 0x00000004 1346>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 1347 13480 lelong 0x00000005 1349>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 1350 1351# From Doug Lee via a FreeBSD pr 13529 string GERBILDOC First Choice document 13539 string GERBILDB First Choice database 13549 string GERBILCLIP First Choice database 13550 string GERBIL First Choice device file 13569 string RABBITGRAPH RabbitGraph file 13570 string DCU1 Borland Delphi .DCU file 13580 string =!<spell> MKS Spell hash list (old format) 13590 string =!<spell2> MKS Spell hash list 1360# Too simple - MPi 1361#0 string AH Halo(TM) bitmapped font file 13620 lelong 0x08086b70 TurboC BGI file 13630 lelong 0x08084b50 TurboC Font file 1364 1365# Debian#712046: The magic below identifies "Delphi compiled form data". 1366# An additional source of information is available at: 1367# http://www.woodmann.com/fravia/dafix_t1.htm 13680 string TPF0 1369>4 pstring >\0 Delphi compiled form '%s' 1370 1371# tests for DBase files moved, updated and merged to database 1372 13730 string PMCC Windows 3.x .GRP file 13741 string RDC-meg MegaDots 1375>8 byte >0x2F version %c 1376>9 byte >0x2F \b.%c file 13770 lelong 0x4C 1378>4 lelong 0x00021401 Windows shortcut file 1379 1380# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm 1381# only for windows versions equal or greater 3.0 13820x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 1383!:mime application/x-dosexec 1384!:ext pif 1385#>2 string >\0 \b, Title:%.30s 1386>0x24 string >\0 \b for %.63s 1387>0x65 string >\0 \b, directory=%.64s 1388>0xA5 string >\0 \b, parameters=%.64s 1389#>0x181 leshort x \b, offset %x 1390#>0x183 leshort x \b, offsetdata %x 1391#>0x185 leshort x \b, section length %x 1392>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 1393>>&0x5e ubyte >0 1394>>>&-1 string <PIFMGR.DLL \b, icon=%s 1395#>>>&-1 string PIFMGR.DLL \b, icon=%s 1396>>>&-1 string >PIFMGR.DLL \b, icon=%s 1397>>&0xF0 ubyte >0 1398>>>&-1 string <Terminal \b, font=%.32s 1399#>>>&-1 string =Terminal \b, font=%.32s 1400>>>&-1 string >Terminal \b, font=%.32s 1401>>&0x110 ubyte >0 1402>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 1403#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 1404>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 1405#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 1406#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 1407>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 1408#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 1409>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 1410#>>&06 string x \b:%s 1411>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 1412#>>&06 string x \b:%s 1413 1414# DOS EPS Binary File Header 1415# From: Ed Sznyter <ews@Black.Market.NET> 14160 belong 0xC5D0D3C6 DOS EPS Binary File 1417!:mime image/x-eps 1418>4 long >0 Postscript starts at byte %d 1419>>8 long >0 length %d 1420>>>12 long >0 Metafile starts at byte %d 1421>>>>16 long >0 length %d 1422>>>20 long >0 TIFF starts at byte %d 1423>>>>24 long >0 length %d 1424 1425# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C 1426# of http://www.davep.org/norton-guides/ng2h-105.tgz 1427# https://en.wikipedia.org/wiki/Norton_Guides 14280 string NG\0\001 1429# only value 0x100 found at offset 2 1430>2 ulelong 0x00000100 Norton Guide 1431!:mime application/x-norton-guide 1432# often like NORTON.NG but some times like NC.HLP 1433!:ext ng/hlp 1434# Title[40] 1435>>8 string >\0 "%-.40s" 1436#>>6 uleshort x \b, MenuCount=%u 1437# szCredits[5][66] 1438>>48 string >\0 \b, %-.66s 1439>>114 string >\0 %-.66s 1440 1441# URL: https://en.wikipedia.org/wiki/Norton_Commander 1442# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/msg-nc-eng.trid.xml 1443# From: Joerg Jenderek 1444# Note: Message file is used by executable with same main name. 1445# Only tested with version 5.50 (english) and 2.01 (Windows) 14460 string Abort 1447# \0 or i 1448#>5 ubyte x %x 1449# skip ASCII Abort text by looking for error message like in NCVIEW.MSG 1450>6 search/7089 Non-DOS\ disk Norton Commander module message 1451!:mime application/x-norton-msg 1452!:ext msg 1453 1454# URL: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm 1455# Reference: https://mark0.net/download/triddefs_xml.7z/defs/m/msg-netware-dos.trid.xml 1456# From: Joerg Jenderek 14570 string DOS\ Client\ Message\ File: Novell DOS client message 1458#!:mime application/octet-stream 1459#!:mime application/x-novell-msg 1460!:ext msg 1461# look for second letter instead space character 1462>26 ubyte >0x20 1463# digit 1 or often main or program name like: IPXODI.COM TASKID pnwtrap DOSRqstr 1464>>25 ubyte !0x20 %c 1465>>>26 ubyte !0x20 \b%c 1466>>>>27 ubyte !0x20 \b%c 1467>>>>>28 ubyte !0x20 \b%c 1468>>>>>>29 ubyte !0x20 \b%c 1469>>>>>>>30 ubyte !0x20 \b%c 1470>>>>>>>>31 ubyte !0x20 \b%c 1471>>>>>>>>>32 ubyte !0x20 \b%c 1472>>>>>>>>>>33 ubyte !0x20 \b%c 1473>>>>>>>>>>>34 ubyte !0x20 \b%c 1474>>>>>>>>>>>>35 ubyte !0x20 \b%c 1475>>>>>>>>>>>>>36 ubyte !0x20 \b%c 1476# followed by string like: 0 v.10 V1.20 1477# 1478# followed by ,\040Tran 1479>28 search/14 ,\040Tran 1480# probably translated version string like: 0 v1.00 1481>>&0 string x \b, tran version %s 1482# followed by Ctrl-J Ctrl-Z 1483>>>&0 ubyte !0xa \b, terminated by %#2.2x 1484>>>>&0 ubyte x \b%2.2x 1485# Ctrl-Z 1486>0x65 ubyte !0x1A \b, at 0x65 %#x 1487# one 1488>0x66 ubyte !0x01 \b, at 0x66 %#x 1489# URL: https://en.wikipedia.org/wiki/NetWare 1490# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dat-novell-msg.trid.xml 1491# ftp://ftp.iitb.ac.in/LDP/en/NLM-HOWTO/NLM-HOWTO-single.html 1492# From: Joerg Jenderek 14930 string Novell\ Message\ Librarian\ Data\ File Novell message librarian data 1494#>35 string Version\ 1.00 1495#>49 string COPYRIGHT\ (c)\ 1985\ by\ Novell,\ Inc. 1496#>83 string \ \ All\ Rights\ Reserved 1497#!:mime application/octet-stream 1498#!:mime application/x-novell-msg 1499!:ext msg 1500#!:ext msg/dat 1501# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 1502# of https://www.4dos.info/ 1503# pointer,HelpID[8]=4DHnnnmm 15040 ulelong 0x48443408 4DOS help file 1505>4 string x \b, version %-4.4s 1506 1507# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 15080 ulequad 0x3a000000024e4c MS Advisor help file 1509 1510# HtmlHelp files (.chm) 15110 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data 1512!:mime application/vnd.ms-htmlhelp 1513!:ext chm 1514 1515# GFA-BASIC (Wolfram Kleff) 15162 string/b GFA-BASIC3 GFA-BASIC 3 data 1517 1518#------------------------------------------------------------------------------ 1519# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 1520# Update: Joerg Jenderek 1521# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format) 1522# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx 1523# Note: verified by `7z l *.cab` 1524# Microsoft Cabinet files 15250 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 1526# 1527# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool 1528# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE 1529# because some archive does not have *.diag* as 1st or 2nd archive member like 1530# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab 1531# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section 1532>0x2c search/980/c .diag \b, Diagnostic 1533!:mime application/vnd.ms-cab-compressed 1534!:ext diagcab 1535# http://fileformats.archiveteam.org/wiki/PUZ 1536# Microsoft Publisher version about 2003 has a "Pack and Go" feature that 1537# bundles a Publisher document *PNG.pub with all links into a CAB 1538>0x2c search/300/c png.pub\0 \b, Publisher Packed and Go 1539!:mime application/vnd.ms-cab-compressed 1540!:ext puz 1541# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation 1542>0x2c search/17/c ppview32.exe\0 \b, PowerPoint Viewer Packed and Go 1543!:mime application/vnd.ms-powerpoint 1544#!:mime application/mspowerpoint 1545!:ext ppz 1546# URL: https://en.wikipedia.org/wiki/Windows_Desktop_Gadgets 1547# Reference: https://docs.microsoft.com/en-us/previous-versions/windows/desktop/sidebar/ 1548# http://win10gadgets.com/download/273/ All_CPU_Meter1.zip/All_CPU_Meter_V4.7.3.gadget 1549>0x2c search/968/c gadget.xml \b, Windows Desktop Gadget 1550#!:mime application/vnd.ms-cab-compressed 1551# http://extension.nirsoft.net/gadget 1552!:mime application/x-windows-gadget 1553!:ext gadget 1554# http://www.incredimail.com/ 1555# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims 1556>0x2c search/3369/c content.ini\0 \b, IncrediMail 1557!:mime application/x-incredimail 1558# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf 1559>>0x2c search/83/c Flavor.htm\0 ecard 1560!:ext imf 1561# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims 1562>>0x2c search/211/c .swf\0 skin 1563!:ext ims 1564# member anim.im3 implies IncrediMail animation like in letter_fold.ima 1565>>0x2c search/92/c anim.im3\0 animation 1566!:ext ima 1567# other IncrediMail cab archive 1568>>0x2c default x 1569>>>0x2c search/116/c thumb ecard, image, notifier or skin 1570!:ext imf/imi/imn/ims 1571# http://file-extension.net/seeker/file_extension_ime 1572>>>0x2c default x emoticons or sound 1573!:ext ime/imw 1574# no Diagnostic, Packed and Go, Windows Desktop Gadget, IncrediMail 1575>0x2c default x 1576# look for 1st member name 1577>>(16.l+16) ubyte x 1578# https://en.wikipedia.org/wiki/SNP_file_format 1579>>>&-1 string/c _accrpt_.snp \b, Access report snapshot 1580!:mime application/msaccess 1581!:ext snp 1582# https://en.wikipedia.org/wiki/Microsoft_InfoPath 1583>>>&-1 string manifest.xsf \b, InfoPath Form Template 1584!:mime application/vnd.ms-cab-compressed 1585#!:mime application/vnd.ms-infopath 1586!:ext xsn 1587# https://www.cabextract.org.uk/wince_cab_format/ 1588# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer 1589>>>&7 string =.000 \b, WinCE install 1590!:mime application/vnd.ms-cab-compressed 1591!:ext cab 1592 1593# https://support.microsoft.com/kb/934307/en-US 1594# All inspected MSU contain a file with name WSUSSCAN.cab 1595# that is called "Windows Update meta data" by Microsoft 1596>>>&-1 string/c wsusscan.cab \b, Microsoft Standalone Update 1597!:mime application/vnd.ms-cab-compressed 1598!:ext msu 1599>>>&-1 default x 1600# look at point character of 1st archive member name for file name extension 1601>>>>&-1 search/255 . 1602# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm 1603# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002 1604# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB 1605>>>>>&0 string/c ppt\0 \b, PowerPoint Packed and Go 1606!:mime application/vnd.ms-powerpoint 1607#!:mime application/mspowerpoint 1608!:ext ppz 1609# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx 1610# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack 1611# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack 1612>>>>>&0 string/c theme \b, Windows 1613!:mime application/x-windows-themepack 1614# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8 1615# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack 1616# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme 1617>>>>>>(16.l+16) string =Panoram 8 1618!:ext deskthemepack 1619>>>>>>(16.l+16) string !Panoram 7 or 8 1620!:ext themepack/deskthemepack 1621>>>>>>(16.l+16) ubyte x Theme Pack 1622# URL: https://en.wikipedia.org/wiki/Microsoft_OneNote#File_format 1623# http://fileformats.archiveteam.org/wiki/OneNote 1624# Reference: https://mark0.net/download/triddefs_xml.7z/defs/o/onepkg.trid.xml 1625# 1st member name like: "Class Notes.one" "test-onenote.one" "Open Notebook.onetoc2" "Editor �ffnen.onetoc2" 1626>>>>>&0 string/c one \b, OneNote Package 1627!:mime application/msonenote 1628!:ext onepkg 1629>>>>>&0 default x 1630# look for null terminator of 1st member name 1631>>>>>>&0 search/255 \0 1632# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu 1633>>>>>>>&16 string/c wsusscan.cab \b, Microsoft Standalone Update 1634!:mime application/vnd.ms-cab-compressed 1635!:ext msu 1636>>>>>>>&16 default x 1637# archive with more then one file need some output in version 5.32 to avoid error message like 1638# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type 1639# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type 1640# file: could not find any valid magic files! 1641>>>>>>>>28 uleshort >1 \b, many 1642!:mime application/vnd.ms-cab-compressed 1643!:ext cab 1644# remaining archives with just one file 1645>>>>>>>>28 uleshort =1 1646# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386 1647>>>>>>>>>30 uleshort =0x0000 \b, Windows 2000/XP setup 1648# cut of last char of source extension and add underscore to generate extension 1649# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_ 1650!:mime application/vnd.ms-cab-compressed 1651!:ext _/?_/??_ 1652# archive need some output like "single" in version 5.32 to avoid error messages 1653>>>>>>>>>30 uleshort !0x0000 \b, single 1654!:mime application/vnd.ms-cab-compressed 1655!:ext cab 1656# TODO: additional extensions like 1657# .xtp InfoPath Template Part 1658# .lvf Logitech Video Effects Face Accessory 1659>8 ulelong x \b, %u bytes 1660>28 uleshort 1 \b, 1 file 1661>28 uleshort >1 \b, %u files 1662# Reserved fields, set to zero 1663#>4 belong !0 \b, reserved1 %x 1664#>12 belong !0 \b, reserved2 %x 1665# offset of the first CFFILE entry coffFiles: minimal 2Ch 1666>16 ulelong x \b, at %#x 1667>(16.l) use cab-file 1668# at least also 2nd member 1669>28 uleshort >1 1670>>(16.l+16) ubyte x 1671>>>&0 search/255 \0 1672# second member info 1673>>>>&0 use cab-file 1674#>20 belong !0 \b, reserved %x 1675# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3 1676>24 ubeshort !0x0301 \b version %#x 1677# number of CFFOLDER entries 1678>26 uleshort >1 \b, %u cffolders 1679# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields 1680# only found for flags 0 1 2 3 4 not 7 1681>30 uleshort >0 \b, flags %#x 1682# Cabinet files have a 16-bit cabinet setID field that is designed for application use. 1683# default is zero, however, the -i option of cabarc can be used to set this field 1684>32 uleshort >0 \b, ID %u 1685# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet 1686#>34 uleshort x \b, iCabinet %u 1687# add one for display because humans start numbering by 1 and also fit to name of disk szDisk* 1688>34 uleshort+1 x \b, number %u 1689>30 uleshort &0x0004 \b, extra bytes 1690# cbCFHeader optional size of per-cabinet reserved area 14h 1800h 1691>>36 uleshort >0 %u in head 1692# cbCFFolder is optional size of per-folder reserved area 1693>>38 ubyte >0 %u in folder 1694# cbCFData is optional size of per-datablock reserved area 1695>>39 ubyte >0 %u in data block 1696# optional per-cabinet reserved area abReserve[cbCFHeader] 1697>>36 uleshort >0 1698# 1st CFFOLDER after reserved area in header 1699>>>(36.s+40) use cab-folder 1700# no reserved area in header 1701>30 uleshort ^0x0004 1702# no previous and next cab archive 1703>>30 uleshort =0x0000 1704>>>36 use cab-folder 1705# only previous cab archive 1706>>30 uleshort =0x0001 \b, previous 1707>>>36 use cab-anchor 1708# only next cab archive 1709>>30 uleshort =0x0002 \b, next 1710>>>36 use cab-anchor 1711# previous+next cab archive 1712# can not use sub routine cab-anchor to display previous and next cabinet together 1713#>>>36 use cab-anchor 1714#>>>>&0 use cab-anchor 1715>>30 uleshort =0x0003 \b, previous 1716>>>36 string x %s 1717# optional name of previous disk szDisk* 1718>>>>&1 string x disk %s 1719>>>>>&1 string x \b, next %s 1720# optional name of previous disk szDisk* 1721>>>>>>&1 string x disk %s 1722>>>>>>>&1 use cab-folder 1723# display filename and disk name of previous or next cabinet 17240 name cab-anchor 1725# optional name of previous/next cabinet file szCabinet*[255] 1726>&0 string x %s 1727# optional name of previous/next disk szDisk*[255] 1728>>&1 string x disk %s 1729# display folder structure CFFOLDER information like compression of cabinet 17300 name cab-folder 1731# offset of the CFDATA block in this folder 1732#>0 ulelong x \b, coffCabStart %#x 1733# number of CFDATA blocks in folder 1734>4 uleshort x \b, %u datablock 1735# plural s 1736>4 uleshort >1 \bs 1737# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15 1738>6 uleshort x \b, %#x compression 1739# optional per-folder reserved area 1740#>8 ubequad x \b, abReserve %#llx 1741# display member structure CFFILE information like member name of cabinet 17420 name cab-file 1743# cbFile is uncompressed size of file in bytes 1744#>0 ulelong x \b, cbFile %u 1745# uoffFolderStart is uncompressed offset of file in folder 1746#>4 ulelong >0 \b, uoffFolderStart %#x 1747# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet 1748# define ifoldCONTINUED_FROM_PREV (0xFFFD) 1749# define ifoldCONTINUED_TO_NEXT (0xFFFE) 1750# define ifoldCONTINUED_PREV_AND_NEXT (0xFFFF) 1751>8 uleshort >0 \b, iFolder %#x 1752# date stamp for file 1753#>10 uleshort x \b, date %#x 1754# time stamp for file 1755#>12 uleshort x \b, time %#x 1756# attribs is attribute flags for file 1757# define _A_RDONLY (0x01) file is read-only 1758# define _A_HIDDEN (0x02) file is hidden 1759# define _A_SYSTEM (0x04) file is a system file 1760# define _A_ARCH (0x20) file modified since last backup 1761# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab 1762# define _A_EXEC (0x40) run after extraction 1763# define _A_NAME_IS_UTF (0x80) szName[] contains UTF 1764# define UNKNOWN (0x0100) undocumented or accident 1765#>14 uleshort x \b, attribs %#x 1766>14 uleshort >0 + 1767>>14 uleshort &0x0001 \bR 1768>>14 uleshort &0x0002 \bH 1769>>14 uleshort &0x0004 \bS 1770>>14 uleshort &0x0020 \bA 1771>>14 uleshort &0x0040 \bX 1772>>14 uleshort &0x0080 \bUtf 1773# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB 1774>>14 uleshort &0x0100 \b? 1775# szName is name of archive member 1776>16 string x "%s" 1777# next archive member name if more files 1778#>>&17 string >\0 \b, NEXT NAME %-.50s 1779 1780# InstallShield Cabinet files 17810 string/b ISc( InstallShield Cabinet archive data 1782>5 byte&0xf0 =0x60 version 6, 1783>5 byte&0xf0 !0x60 version 4/5, 1784>(12.l+40) lelong x %u files 1785 1786# Windows CE package files 17870 string/b MSCE\0\0\0\0 Microsoft WinCE install header 1788>20 lelong 0 \b, architecture-independent 1789>20 lelong 103 \b, Hitachi SH3 1790>20 lelong 104 \b, Hitachi SH4 1791>20 lelong 0xA11 \b, StrongARM 1792>20 lelong 4000 \b, MIPS R4000 1793>20 lelong 10003 \b, Hitachi SH3 1794>20 lelong 10004 \b, Hitachi SH3E 1795>20 lelong 10005 \b, Hitachi SH4 1796>20 lelong 70001 \b, ARM 7TDMI 1797>52 leshort 1 \b, 1 file 1798>52 leshort >1 \b, %u files 1799>56 leshort 1 \b, 1 registry entry 1800>56 leshort >1 \b, %u registry entries 1801 1802 1803# Windows Enhanced Metafile (EMF) 1804# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 1805# for further information. 18060 ulelong 1 1807>40 string \ EMF Windows Enhanced Metafile (EMF) image data 1808>>44 ulelong x version %#x 1809 1810 18110 string/b \224\246\056 Microsoft Word Document 1812!:mime application/msword 1813 1814# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 1815# Magic type for Dell's BIOS .hdr files 1816# Dell's .hdr 18170 string/b $RBU 1818>23 string Dell %s system BIOS 1819>5 byte 2 1820>>48 byte x version %d. 1821>>49 byte x \b%d. 1822>>50 byte x \b%d 1823>5 byte <2 1824>>48 string x version %.3s 1825 1826# Type: Microsoft Document Imaging Format (.mdi) 1827# URL: https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 1828# From: Daniele Sempione <scrows@oziosi.org> 1829# Too weak (EP) 1830#0 short 0x5045 Microsoft Document Imaging Format 1831 1832# MS eBook format (.lit) 18330 string/b ITOLITLS Microsoft Reader eBook Data 1834>8 lelong x \b, version %u 1835!:mime application/x-ms-reader 1836 1837# Windows CE Binary Image Data Format 1838# From: Dr. Jesus <j@hug.gs> 18390 string/b B000FF\n Windows Embedded CE binary image 1840 1841# The second byte of these signatures is a file version; I don't know what, 1842# if anything, produced files with version numbers 0-2. 1843# From: John Elliott <johne@seasip.demon.co.uk> 18440 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 18450 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 18460 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 18470 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 1848 18490 string MIOPEN Mallard BASIC Jetsam data 18500 string Jetsam0 Mallard BASIC Jetsam index data 1851 1852# DOS backup 2.0 to 3.2 1853# URL: http://fileformats.archiveteam.org/wiki/BACKUP_(MS-DOS) 1854# Reference: http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/dos/restore/brtecdoc.htm 1855# backupid.@@@ 1856 1857# plausibility check for date 18580x3 ushort >1979 1859>0x5 ubyte-1 <31 1860>>0x6 ubyte-1 <12 1861# actually 121 nul bytes 1862>>>0x7 string \0\0\0\0\0\0\0\0 1863>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d 1864#!:mime application/octet-stream 1865!:ext @@@ 1866>>>>0x0 ubyte 0xff \b, last disk 1867 1868# backed up file 1869 1870# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd 1871# by looking for trailing nul of maximal file name string 18720x52 ubyte 0 1873# test for flag byte: FFh~complete file, 00h~split file 1874# FFh -127 = -1 -127 = -128 1875# 00h -127 = 0 -127 = -127 1876>0 byte-127 <-126 1877# plausibility check for file name length 1878>>0x53 ubyte-1 <78 1879# looking for terminating nul of file name string 1880>>>(0x53.b+4) ubyte 0 1881# looking if last char of string is valid DOS file name 1882>>>>(0x53.b+3) ubyte >0x1F 1883# actually 44 nul bytes 1884# but sometimes garbage according to Ralf Quint. So can not be used as test 1885#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 1886# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator 1887# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 1888>>>>>5 ubyte&0x8C 0x0C 1889# ./msdos (version 5.30) labeled the entry as 1890# "DOS 2.0 backed up file %s, split file, sequence %d" or 1891# "DOS 2.0 backed up file %s, complete file" 1892>>>>>>0 ubyte x DOS 2.0-3.2 backed up 1893#>>>>>>0 ubyte 0xff complete 1894>>>>>>0 ubyte 0 1895>>>>>>>1 uleshort x sequence %d of 1896# full file name with path but without drive letter and colon stored from 0x05 til 0x52 1897>>>>>>0x5 string x file %s 1898#!:mime application/octet-stream 1899# backup name is original filename 1900#!:ext doc/exe/rar/zip 1901#!:ext * 1902# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*' 1903# file: line 1169: Bad magic entry ' *' 1904# after header original file content 1905>>>>>>128 indirect x \b; 1906 1907 1908# DOS backup 3.3 to 5.x 1909 1910# CONTROL.nnn files 19110 string \x8bBACKUP\x20 1912# actually 128 nul bytes 1913>0xa string \0\0\0\0\0\0\0\0 1914>>0x9 ubyte x DOS 3.3 backup control file, sequence %d 1915>>0x8a ubyte 0xff \b, last disk 1916 1917# NB: The BACKUP.nnn files consist of the files backed up, 1918# concatenated. 1919 1920# From: Joerg Jenderek 1921# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_date/time 1922# Reference: https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-dosdatetimetofiletime 1923# Note: DOS date+time format is different from formats such as Unix epoch 1924# bit encoded; uses year values relative to 1980 and 2 second precision 19250 name dos-date 1926# HHHHHMMMMMMSSSSS bit encoded Hour (0-23) Minute (0-59) SecondPart (*2) 1927#>0 uleshort x RAW TIME [%#4.4x] 1928# hour part 1929#>0 uleshort/2048 x hour [%u] 1930# YYYYYMMMMDDDDD bit encoded YearPart (+1980) Month (1-12) Day (1-31) 1931#>2 uleshort x RAW DATE [%#4.4x] 1932# day part 1933>2 uleshort&0x001F x %u 1934#>2 uleshort/16 x MONTH PART [%#x] 1935# GRR: not working 1936#>2 uleshort/16 &0x000F MONTH [%u] 1937#>2 uleshort&0x01E0 x MONTH PART [%#4.4x] 1938>2 uleshort&0x01E0 =0x0020 jan 1939>2 uleshort&0x01E0 =0x0040 feb 1940>2 uleshort&0x01E0 =0x0060 mar 1941>2 uleshort&0x01E0 =0x0080 apr 1942>2 uleshort&0x01E0 =0x00A0 may 1943>2 uleshort&0x01E0 =0x00C0 jun 1944>2 uleshort&0x01E0 =0x00E0 jul 1945>2 uleshort&0x01E0 =0x0100 aug 1946>2 uleshort&0x01E0 =0x0120 sep 1947>2 uleshort&0x01E0 =0x0140 oct 1948>2 uleshort&0x01E0 =0x0160 nov 1949>2 uleshort&0x01E0 =0x0180 dec 1950# year part 1951>2 uleshort/512 x 1980+%u 1952# 1953