xref: /freebsd/contrib/file/magic/Magdir/msdos (revision 911f0260390e18cf85f3dbf2c719b593efdc1e3c)
1
2#------------------------------------------------------------------------------
3# $File: msdos,v 1.158 2022/09/07 11:17:31 christos Exp $
4# msdos:  file(1) magic for MS-DOS files
5#
6
7# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
8# updated by Joerg Jenderek at Oct 2008,Apr 2011
90	string/t	@
10>1	string/cW	\ echo\ off	DOS batch file text
11!:mime	text/x-msdos-batch
12!:ext	bat
13>1	string/cW	echo\ off	DOS batch file text
14!:mime	text/x-msdos-batch
15!:ext	bat
16>1	string/cW	rem		DOS batch file text
17!:mime	text/x-msdos-batch
18!:ext	bat
19>1	string/cW	set\ 		DOS batch file text
20!:mime	text/x-msdos-batch
21!:ext	bat
22
23
24# OS/2 batch files are REXX. the second regex is a bit generic, oh well
25# the matched commands seem to be common in REXX and uncommon elsewhere
26100	search/0xffff   rxfuncadd
27>100	regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc	OS/2 REXX batch file text
28100	search/0xffff   say
29>100	regex/c =^[\ \t]{0,10}say\ ['"]			OS/2 REXX batch file text
30
31# updated by Joerg Jenderek at Oct 2015
32# https://de.wikipedia.org/wiki/Common_Object_File_Format
33# http://www.delorie.com/djgpp/doc/coff/filhdr.html
34# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable"
35#0	leshort		0x14c	MS Windows COFF Intel 80386 object file
36#>4	ledate		x	stamp %s
370	leshort		0x166	MS Windows COFF MIPS R4000 object file
38#>4	ledate		x	stamp %s
390	leshort		0x184	MS Windows COFF Alpha object file
40#>4	ledate		x	stamp %s
410	leshort		0x268	MS Windows COFF Motorola 68000 object file
42#>4	ledate		x	stamp %s
430	leshort		0x1f0	MS Windows COFF PowerPC object file
44#>4	ledate		x	stamp %s
450	leshort		0x290	MS Windows COFF PA-RISC object file
46#>4	ledate		x	stamp %s
47
48# Tests for various EXE types.
49#
50# Many of the compressed formats were extracted from IDARC 1.23 source code.
51#
520	string/b	MZ
53# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
54>0x18	leshort <0x40 MS-DOS executable
55!:mime	application/x-dosexec
56# Windows and later versions of DOS will allow .EXEs to be named with a .COM
57# extension, mostly for compatibility's sake.
58# URL:		https://en.wikipedia.org/wiki/Personal_NetWare#VLM
59# Reference:	https://mark0.net/download/triddefs_xml.7z/defs/e/exe-vlm-msg.trid.xml
60!:ext	exe/com/vlm
61# These traditional tests usually work but not always.  When test quality support is
62# implemented these can be turned on.
63#>>0x18	leshort	0x1c	(Borland compiler)
64#>>0x18	leshort	0x1e	(MS compiler)
65
66# Maybe it's a PE?
67>(0x3c.l)	string		PE\0\0	PE
68!:mime	application/x-dosexec
69>>(0x3c.l+24)	leshort		0x010b	\b32 executable
70>>(0x3c.l+24)	leshort		0x020b	\b32+ executable
71>>(0x3c.l+24)	leshort		0x0107	ROM image
72>>(0x3c.l+24)	default		x	Unknown PE signature
73>>>&0 		leshort		x	%#x
74>>(0x3c.l+22)	leshort&0x2000	>0	(DLL)
75>>(0x3c.l+92)	leshort		1
76# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the
77# drivers in Windows/System32/drivers/*.sys.
78>>>(0x3c.l+22)	leshort&0x2000	>0	(native)
79!:ext	dll/sys
80>>>(0x3c.l+22)	leshort&0x2000	0	(native)
81!:ext	exe/sys
82>>(0x3c.l+92)	leshort		2
83>>>(0x3c.l+22)	leshort&0x2000	>0	(GUI)
84# These could probably be at least partially distinguished from one another by
85# looking for specific exported functions.
86# CPL: Control Panel item
87# TLB: Type library
88# OCX: OLE/ActiveX control
89# ACM: Audio compression manager codec
90# AX: DirectShow source filter
91# IME: Input method editor
92!:ext	dll/cpl/tlb/ocx/acm/ax/ime
93>>>(0x3c.l+22)	leshort&0x2000	0	(GUI)
94# Screen savers typically include code from the scrnsave.lib static library, but
95# that's not guaranteed.
96!:ext	exe/scr
97>>(0x3c.l+92)	leshort		3
98>>>(0x3c.l+22)	leshort&0x2000	>0	(console)
99!:ext	dll/cpl/tlb/ocx/acm/ax/ime
100>>>(0x3c.l+22)	leshort&0x2000	0	(console)
101!:ext	exe/com
102# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
103>>(0x3c.l+92)	leshort		7	(POSIX)
104>>(0x3c.l+92)	leshort		9	(Windows CE)
105>>(0x3c.l+92)	leshort		10	(EFI application)
106>>(0x3c.l+92)	leshort		11	(EFI boot service driver)
107>>(0x3c.l+92)	leshort		12	(EFI runtime driver)
108>>(0x3c.l+92)	leshort		13	(EFI ROM)
109>>(0x3c.l+92)	leshort		14	(XBOX)
110>>(0x3c.l+92)	leshort		15	(Windows boot application)
111>>(0x3c.l+92)	default		x	(Unknown subsystem
112>>>&0		leshort		x	%#x)
113>>(0x3c.l+4)	leshort		0x14c	Intel 80386
114>>(0x3c.l+4)	leshort		0x166	MIPS R4000
115>>(0x3c.l+4)	leshort		0x168	MIPS R10000
116>>(0x3c.l+4)	leshort		0x184	Alpha
117>>(0x3c.l+4)	leshort		0x1a2	Hitachi SH3
118>>(0x3c.l+4)	leshort		0x1a3	Hitachi SH3 DSP
119>>(0x3c.l+4)	leshort		0x1a8	Hitachi SH5
120>>(0x3c.l+4)	leshort		0x169	MIPS WCE v2
121>>(0x3c.l+4)	leshort		0x1a6	Hitachi SH4
122>>(0x3c.l+4)	leshort		0x1c0	ARM
123>>(0x3c.l+4)	leshort		0x1c2	ARM Thumb
124>>(0x3c.l+4)	leshort		0x1c4	ARMv7 Thumb
125>>(0x3c.l+4)	leshort		0x1d3	Matsushita AM33
126>>(0x3c.l+4)	leshort		0x1f0	PowerPC
127>>(0x3c.l+4)	leshort		0x1f1	PowerPC with FPU
128>>(0x3c.l+4)	leshort		0x1f2	PowerPC (big-endian)
129>>(0x3c.l+4)	leshort		0x200	Intel Itanium
130>>(0x3c.l+4)	leshort		0x266	MIPS16
131>>(0x3c.l+4)	leshort		0x268	Motorola 68000
132>>(0x3c.l+4)	leshort		0x290	PA-RISC
133>>(0x3c.l+4)	leshort		0x366	MIPSIV
134>>(0x3c.l+4)	leshort		0x466	MIPS16 with FPU
135>>(0x3c.l+4)	leshort		0xebc	EFI byte code
136>>(0x3c.l+4)	leshort		0x5032	RISC-V 32-bit
137>>(0x3c.l+4)	leshort		0x5064	RISC-V 64-bit
138>>(0x3c.l+4)	leshort		0x5128	RISC-V 128-bit
139>>(0x3c.l+4)	leshort		0x9041	Mitsubishi M32R
140>>(0x3c.l+4)	leshort		0x8664	x86-64
141>>(0x3c.l+4)	leshort		0xaa64	Aarch64
142>>(0x3c.l+4)	leshort		0xc0ee	MSIL
143>>(0x3c.l+4)	default		x	Unknown processor type
144>>>&0		leshort		x	%#x
145>>(0x3c.l+22)	leshort&0x0200	>0	(stripped to external PDB)
146>>(0x3c.l+22)	leshort&0x1000	>0	system file
147>>(0x3c.l+24)	leshort		0x010b
148>>>(0x3c.l+232) lelong	>0	Mono/.Net assembly
149>>(0x3c.l+24)	leshort		0x020b
150>>>(0x3c.l+248) lelong	>0	Mono/.Net assembly
151
152# hooray, there's a DOS extender using the PE format, with a valid PE
153# executable inside (which just prints a message and exits if run in win)
154>>(8.s*16)		string		32STUB	\b, 32rtm DOS extender
155>>(8.s*16)		string		!32STUB	\b, for MS Windows
156>>(0x3c.l+0xf8)		string		UPX0 \b, UPX compressed
157>>(0x3c.l+0xf8)		search/0x140	PEC2 \b, PECompact2 compressed
158>>(0x3c.l+0xf8)		search/0x140	UPX2
159>>>(&0x10.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
160>>(0x3c.l+0xf8)		search/0x140	.idata
161>>>(&0xe.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
162>>>(&0xe.l+(-4))	string		ZZ0 \b, ZZip self-extracting archive
163>>>(&0xe.l+(-4))	string		ZZ1 \b, ZZip self-extracting archive
164>>(0x3c.l+0xf8)		search/0x140	.rsrc
165>>>(&0x0f.l+(-4))	string		a\\\4\5 \b, WinHKI self-extracting archive
166>>>(&0x0f.l+(-4))	string		Rar! \b, RAR self-extracting archive
167>>>(&0x0f.l+(-4))	search/0x3000	MSCF \b, InstallShield self-extracting archive
168>>>(&0x0f.l+(-4))	search/32	Nullsoft \b, Nullsoft Installer self-extracting archive
169>>(0x3c.l+0xf8)		search/0x140	.data
170>>>(&0x0f.l)		string		WEXTRACT \b, MS CAB-Installer self-extracting archive
171>>(0x3c.l+0xf8)		search/0x140	.petite\0 \b, Petite compressed
172>>>(0x3c.l+0xf7)	byte		x
173>>>>(&0x104.l+(-4))	string		=!sfx! \b, ACE self-extracting archive
174>>(0x3c.l+0xf8)		search/0x140	.WISE \b, WISE installer self-extracting archive
175>>(0x3c.l+0xf8)		search/0x140	.dz\0\0\0 \b, Dzip self-extracting archive
176>>&(0x3c.l+0xf8)	search/0x100	_winzip_ \b, ZIP self-extracting archive (WinZip)
177>>&(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
178>>0x30			string		Inno \b, InnoSetup self-extracting archive
179
180# If the relocation table is 0x40 or more bytes into the file, it's definitely
181# not a DOS EXE.
182>0x18  leshort >0x3f
183
184# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
185# must be one of the unusual subformats.
186>>(0x3c.l) string !PE\0\0 MS-DOS executable
187!:mime	application/x-dosexec
188
189>>(0x3c.l)		string		NE \b, NE
190!:mime	application/x-dosexec
191>>>(0x3c.l+0x36)	byte		1 for OS/2 1.x
192>>>(0x3c.l+0x36)	byte		2 for MS Windows 3.x
193>>>(0x3c.l+0x36)	byte		3 for MS-DOS
194>>>(0x3c.l+0x36)	byte		4 for Windows 386
195>>>(0x3c.l+0x36)	byte		5 for Borland Operating System Services
196>>>(0x3c.l+0x36)	default		x
197>>>>(0x3c.l+0x36)	byte		x (unknown OS %x)
198>>>(0x3c.l+0x36)	byte		0x81 for MS-DOS, Phar Lap DOS extender
199>>>(0x3c.l+0x0c)	leshort&0x8000	0x8000 (DLL or font)
200# DRV: Driver
201# 3GR: Grabber device driver
202# CPL: Control Panel Item
203# VBX: Visual Basic Extension
204# FON: Bitmap font
205# FOT: Font resource file
206!:ext	dll/drv/3gr/cpl/vbx/fon/fot
207>>>(0x3c.l+0x0c)	leshort&0x8000	0 (EXE)
208!:ext	exe/scr
209>>>&(&0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
210>>>(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
211
212>>(0x3c.l)		string		LX\0\0 \b, LX
213!:mime	application/x-dosexec
214>>>(0x3c.l+0x0a)	leshort		<1 (unknown OS)
215>>>(0x3c.l+0x0a)	leshort		1 for OS/2
216>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
217>>>(0x3c.l+0x0a)	leshort		3 for DOS
218>>>(0x3c.l+0x0a)	leshort		>3 (unknown OS)
219>>>(0x3c.l+0x10)	lelong&0x28000	=0x8000 (DLL)
220>>>(0x3c.l+0x10)	lelong&0x20000	>0 (device driver)
221>>>(0x3c.l+0x10)	lelong&0x300	0x300 (GUI)
222>>>(0x3c.l+0x10)	lelong&0x28300	<0x300 (console)
223>>>(0x3c.l+0x08)	leshort		1 i80286
224>>>(0x3c.l+0x08)	leshort		2 i80386
225>>>(0x3c.l+0x08)	leshort		3 i80486
226>>>(8.s*16)		string		emx \b, emx
227>>>>&1			string		x %s
228>>>&(&0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive
229
230# MS Windows system file, supposedly a collection of LE executables
231>>(0x3c.l)		string		W3 \b, W3 for MS Windows
232!:mime	application/x-dosexec
233
234>>(0x3c.l)		string		LE\0\0 \b, LE executable
235!:mime	application/x-dosexec
236>>>(0x3c.l+0x0a)	leshort		1
237# some DOS extenders use LE files with OS/2 header
238>>>>0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
239>>>>0x240		search/0x200	WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
240>>>>0x440		search/0x100	CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
241>>>>0x40		search/0x40	PMODE/W for MS-DOS, PMODE/W DOS extender
242>>>>0x40		search/0x40	STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
243>>>>0x40		search/0x80	STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
244>>>>0x40		search/0x80	DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
245# this is a wild guess; hopefully it is a specific signature
246>>>>&0x24		lelong		<0x50
247>>>>>(&0x4c.l)		string		\xfc\xb8WATCOM
248>>>>>>&0		search/8	3\xdbf\xb9 \b, 32Lite compressed
249# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
250#>>>>(0x3c.l+0x1c)	lelong		>0x10000 for OS/2
251# fails with DOS-Extenders.
252>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
253>>>(0x3c.l+0x0a)	leshort		3 for DOS
254>>>(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
255# VXD: VxD for Windows 95/98/Me
256# 386: VxD for Windows 2.10, 3.0, 3.1x
257# PDR: Port driver
258# MPD: Miniport driver (?)
259!:ext	vxd/386/pdr/mpd
260>>>(&0x7c.l+0x26)	string		UPX \b, UPX compressed
261>>>&(&0x54.l-3)		string		UNACE \b, ACE self-extracting archive
262
263# looks like ASCII, probably some embedded copyright message.
264# and definitely not NE/LE/LX/PE
265>>0x3c		lelong	>0x20000000
266>>>(4.s*512)	leshort !0x014c \b, MZ for MS-DOS
267!:mime	application/x-dosexec
268!:ext	exe/com
269# header data too small for extended executable
270>2		long	!0
271>>0x18		leshort <0x40
272>>>(4.s*512)	leshort !0x014c
273
274>>>>&(2.s-514)	string	!LE
275>>>>>&-2	string	!BW \b, MZ for MS-DOS
276!:mime	application/x-dosexec
277>>>>&(2.s-514)	string	LE \b, LE
278>>>>>0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
279# educated guess since indirection is still not capable enough for complex offset
280# calculations (next embedded executable would be at &(&2*512+&0-2)
281# I suspect there are only LE executables in these multi-exe files
282>>>>&(2.s-514)	string	BW
283>>>>>0x240	search/0x100	DOS/4G	\b, LE for MS-DOS, DOS4GW DOS extender (embedded)
284>>>>>0x240	search/0x100	!DOS/4G	\b, BW collection for MS-DOS
285
286# This sequence skips to the first COFF segment, usually .text
287>(4.s*512)	leshort		0x014c \b, COFF
288!:mime	application/x-dosexec
289>>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
290>>(8.s*16)	string		emx
291>>>&1		string		x for DOS, Win or OS/2, emx %s
292>>&(&0x42.l-3)	byte		x
293>>>&0x26	string		UPX \b, UPX compressed
294# and yet another guess: small .text, and after large .data is unusual, could be 32lite
295>>&0x2c		search/0xa0	.text
296>>>&0x0b	lelong		<0x2000
297>>>>&0		lelong		>0x6000 \b, 32lite compressed
298
299>(8.s*16) string $WdX \b, WDos/X DOS extender
300
301# By now an executable type should have been printed out.  The executable
302# may be a self-uncompressing archive, so look for evidence of that and
303# print it out.
304#
305# Some signatures below from Greg Roelofs, newt@uchicago.edu.
306#
307>0x35	string	\x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
308>0xe7	string	LH/2\ 	Self-Extract \b, %s
309>0x1c	string	UC2X	\b, UCEXE compressed
310>0x1c	string	WWP\ 	\b, WWPACK compressed
311>0x1c	string	RJSX 	\b, ARJ self-extracting archive
312>0x1c	string	diet 	\b, diet compressed
313>0x1c	string	LZ09 	\b, LZEXE v0.90 compressed
314>0x1c	string	LZ91 	\b, LZEXE v0.91 compressed
315>0x1c	string	tz 	\b, TinyProg compressed
316>0x1e	string	Copyright\ 1989-1990\ PKWARE\ Inc.	Self-extracting PKZIP archive
317!:mime	application/zip
318# Yes, this really is "Copr", not "Corp."
319>0x1e	string	PKLITE\ Copr.	Self-extracting PKZIP archive
320!:mime	application/zip
321# winarj stores a message in the stub instead of the sig in the MZ header
322>0x20	search/0xe0	aRJsfX \b, ARJ self-extracting archive
323>0x20	string AIN
324>>0x23	string 2	\b, AIN 2.x compressed
325>>0x23	string <2	\b, AIN 1.x compressed
326>>0x23	string >2	\b, AIN 1.x compressed
327>0x24	string	LHa's\ SFX \b, LHa self-extracting archive
328!:mime	application/x-lha
329>0x24	string	LHA's\ SFX \b, LHa self-extracting archive
330!:mime	application/x-lha
331>0x24	string	\ $ARX \b, ARX self-extracting archive
332>0x24	string	\ $LHarc \b, LHarc self-extracting archive
333>0x20	string	SFX\ by\ LARC \b, LARC self-extracting archive
334>0x40	string aPKG \b, aPackage self-extracting archive
335>0x64	string	W\ Collis\0\0 \b, Compack compressed
336>0x7a	string		Windows\ self-extracting\ ZIP	\b, ZIP self-extracting archive
337>>&0xf4 search/0x140 \x0\x40\x1\x0
338>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
339>1638	string	-lh5- \b, LHa self-extracting archive v2.13S
340>0x17888 string Rar! \b, RAR self-extracting archive
341
342# Skip to the end of the EXE.  This will usually work fine in the PE case
343# because the MZ image is hardcoded into the toolchain and almost certainly
344# won't match any of these signatures.
345>(4.s*512)	long	x
346>>&(2.s-517)	byte	x
347>>>&0	string		PK\3\4 \b, ZIP self-extracting archive
348>>>&0	string		Rar! \b, RAR self-extracting archive
349>>>&0	string		=!\x11 \b, AIN 2.x self-extracting archive
350>>>&0	string		=!\x12 \b, AIN 2.x self-extracting archive
351>>>&0	string		=!\x17 \b, AIN 1.x self-extracting archive
352>>>&0	string		=!\x18 \b, AIN 1.x self-extracting archive
353>>>&7	search/400	**ACE** \b, ACE self-extracting archive
354>>>&0	search/0x480	UC2SFX\ Header \b, UC2 self-extracting archive
355
356# a few unknown ZIP sfxes, no idea if they are needed or if they are
357# already captured by the generic patterns above
358>(8.s*16)	search/0x20	PKSFX \b, ZIP self-extracting archive (PKZIP)
359# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
360#
361
362# TELVOX Teleinformatica CODEC self-extractor for OS/2:
363>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
364>>49824 leshort		=1			\b, 1 file
365>>49824 leshort		>1			\b, %u files
366
367# Summary:	OS/2 LX Library and device driver (no DOS stub)
368# From:		Joerg Jenderek
369# URL:		http://en.wikipedia.org/wiki/EXE
370# Reference:	http://www.textfiles.com/programming/FORMATS/lxexe.txt
371#		https://github.com/open-watcom/open-watcom-v2/blob/master/bld/watcom/h/exeflat.h
372# Note:		by dll-os2-no-dos-stub.trid.xml called "OS/2 Dynamic Link Library (no DOS stub)"
373# TODO:		unify with DOS stub variant (MZ magic)
3740	string/b	LX
375>2	ushort		=0
376>>0	use			lx-executable
377# no examples found for big endian variant
378>2	ushort		=0x0101
379>>0	use			\^lx-executable
3800       name    	lx-executable
381# similar looking like variant with MS-DOS stub (MZ magic): "MS-DOS executable, LX"
382#>0x00	uleshort		x	executable,
383# signature OSF_FLAT_LX_SIGNATURE~0x584C~LX OSF_FLAT_SIGNATURE~0x454C~LE
384>0x00	uleshort		=0x584c	LX
385>0x00	uleshort		=0x454C	LE
386>0x00	uleshort		x	executable
387#!:mime	application/x-msdownload
388!:mime	application/x-lx-executable
389# byte order: 00h~little-endian non-zero=1~big-endian
390#>0x02	ubyte			=0		(little-endian)
391>0x02	ubyte			!0		(big-endian)
392# FOR DEBUGGING!
393# word order: 00h~little-endian non-zero=1~big-endian
394#>0x03	ubyte			=0		\b, little-endian word order
395#>0x03	ubyte			!0		\b, big-endian word order
396# cpu_type; CPU type like: 1~286 2~386 3~486 4 20h~i860 21h~Intel N11 40h~MIPS R2000,R3000 41h~MIPS R6000 42h~MIPS R4000
397#>0x08	uleshort		x		\b, CPU %u
398# os_type; target operating system like: 0~unknown 1~OS/2 2~Windows 3~DOS 4.x 4~Windows 386
399#>0x0A	leshort			x		\b, OS %u
400# flags; module type flags
401#>0x10	ulelong			x		\b, FLAGS %#8.8x
402# 00000002h				~Reserved for system use
403#>0x10	ulelong			&0x00000002	\b, 2h reserved
404# OSF_INIT_INSTANCE=00000004h		~Per-Process Library Initialization; setting this bit for EXE file is invalid
405#>0x10	ulelong			&0x00000004	\b, per-process library Initialization
406# OSF_INTERNAL_FIXUPS_DONE=00000010h	~Internal fixups for the module have been applied
407#>0x10	ulelong			&0x00000010	\b, int. fixup
408# OSF_EXTERNAL_FIXUPS_DONE=00000020h	~External fixups for the module have been applied
409#>0x10	ulelong			&0x00000020	\b, ext. fixup
410# OSF_NOT_PM_COMPATIBLE=00000100h	~Incompatible with PM windowing
411#>0x10	ulelong&0x00000100	=0x00000100	\b, incompatible with PM windowing
412# OSF_PM_COMPATIBLE=00000200h		~Compatible with PM windowing
413#>0x10	ulelong&0x00000200	=0x00000200	\b, compatible with PM windowing
414# bit 17; device driver
415#>0x10	ulelong&0x00020000	>0		\b, device driver
416# Per-process Library Termination; setting this bit for EXE file is invalid
417#>0x10	ulelong&0x40000000	=0x40000000	\b, per-process library termination
418>0x0a	leshort			1		for OS/2
419# no example found
420>0x0a	leshort			3		for DOS
421# http://www.ctyme.com/intr/rb-2939.htm#Table1610
422# library by module type mask 00038000h (bits 15-17);
423# 0h ~exectable Program module
424>0x10	ulelong&0x00038000	=0x00000000	(program)
425#!:ext	exe
426# OSF_IS_DLL=8000h			~Library module (DLL)
427>0x10	ulelong&0x00038000	>0x00000000
428# OSF_PHYS_DEVICE=00020000h		~device driver
429>>0x10	ulelong&0x00020000	>0		(device driver)
430!:ext	sys
431# if not device driver it is library (DLL)
432>>0x10	ulelong&0x00020000	=0		(library)
433!:ext	dll
434# bits 8-10; OSF_PM_APP=300h in flags	~Uses PM windowing API; either it is GUI or console
435>0x10  	ulelong&0x00000300	=0x00000300	(GUI)
436>0x10	ulelong&0x00000300	!0x00000300	(console)
437# CPU type
438>0x08	uleshort		1		i80286
439# all inspected examples
440>0x08	uleshort		2		i80386
441>0x08	uleshort		3		i80486
442>0x08	uleshort		4		i80586
443# 21h 	Intel "N11" or compatible
444# 40h 	MIPS Mark I ( R2000, R3000) or compatible
445# 41h 	MIPS Mark II ( R6000 ) or compatible
446# 42h 	MIPS Mark III ( R4000 ) or compatible
447
448# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc
449# and https://www.freedos.org/software/?prog=kpdos
450# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
4510	string/b	KCF		FreeDOS KEYBoard Layout collection
452# only version=0x100 found
453>3	uleshort	x		\b, version %#x
454# length of string containing author,info and special characters
455>6	ubyte		>0
456#>>6	pstring		x		\b, name=%s
457>>7	string		>\0		\b, author=%-.14s
458>>7	search/254	\xff		\b, info=
459#>>>&0	string		x		\b%-s
460>>>&0	string		x		\b%-.15s
461# for FreeDOS *.KL files
4620	string/b	KLF		FreeDOS KEYBoard Layout file
463# only version=0x100 or 0x101 found
464>3	uleshort	x		\b, version %#x
465# stringlength
466>5	ubyte		>0
467>>8	string		x		\b, name=%-.2s
4680	string	\xffKEYB\ \ \ \0\0\0\0
469>12	string	\0\0\0\0`\004\360	MS-DOS KEYBoard Layout file
470
471# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017,Aug 2020
472# URL:		http://fileformats.archiveteam.org/wiki/DOS_device_driver
473# Reference:	http://www.delorie.com/djgpp/doc/rbinter/it/46/16.html
474# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
4750	ulequad&0x07a0ffffffff		0xffffffff
476# skip OS/2 INI ./os2
477>4  ubelong   !0x14000000
478>>0	use				msdos-driver
4790       name    			msdos-driver		DOS executable (
480#!:mime	application/octet-stream
481!:mime	application/x-dosdriver
482# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
483# and IBM Token-Ring adapter IBMTOK.DOS. Why and when DOS instead SYS is used?
484# PROTMAN.DOS ELNKPL.DOS
485!:ext	sys/dev/bin/dos
486# 1 space char after "UPX compressed" to get phrase like "UPX compressed character device"
487>40	search/7			UPX!			\bUPX compressed
488# DOS device driver attributes
489>4	uleshort&0x8000			0x0000			\bblock device driver
490# character device
491>4	uleshort&0x8000			0x8000			\b
492# 1 space char after "clock" to get phrase like "clock character device driver CLOCK$"
493>>4	uleshort&0x0008			0x0008			\bclock
494# fast video output by int 29h
495# 1 space char after "fast" to get phrase like "fast standard input/output character device driver"
496>>4	uleshort&0x0010			0x0010			\bfast
497# standard input/output device
498# 1 space char after "standard" to get phrase like "standard input/output character device driver"
499>>4	uleshort&0x0003			>0			\bstandard
500>>>4	uleshort&0x0001			0x0001			\binput
501>>>4	uleshort&0x0003			0x0003			\b/
502# 1 space char after "output" to get phrase like "input/output character device driver"
503>>>4	uleshort&0x0002			0x0002			\boutput
504>>4	uleshort&0x8000			0x8000			\bcharacter device driver
505>0	ubyte				x
506# upx compressed device driver has garbage instead of real in name field of header
507>>40	search/7			UPX!
508>>40	default				x
509# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
510# 1 space char before device driver name to get phrase like "device driver PROTMAN$"
511>>>12		ubyte			>0x2E			\b
512>>>>10		ubyte			>0x20
513>>>>>10		ubyte			!0x2E
514>>>>>>10	ubyte			!0x2A			\b%c
515>>>>11		ubyte			>0x20
516>>>>>11		ubyte			!0x2E			\b%c
517>>>>12		ubyte			>0x20
518>>>>>12		ubyte			!0x39
519>>>>>>12	ubyte			!0x2E			\b%c
520>>>13		ubyte			>0x20
521>>>>13		ubyte			!0x2E			\b%c
522>>>>14		ubyte			>0x20
523>>>>>14		ubyte			!0x2E			\b%c
524>>>>15		ubyte			>0x20
525>>>>>15		ubyte			!0x2E			\b%c
526>>>>16		ubyte			>0x20
527>>>>>16		ubyte			!0x2E
528>>>>>>16	ubyte			<0xCB			\b%c
529>>>>17		ubyte			>0x20
530>>>>>17		ubyte			!0x2E
531>>>>>>17	ubyte			<0x90			\b%c
532# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
533>>>12		ubyte			<0x2F
534# they have their real name at offset 22
535# also block device drivers like DUMBDRV.SYS
536>>>>22		string			>\056			%-.6s
537>4	uleshort&0x8000			0x0000
538# 32 bit sector addressing ( > 32 MB) for block devices
539>>4	uleshort&0x0002			0x0002			\b,32-bit sector-
540# support by driver functions 13h, 17h, 18h
541>4	uleshort&0x0040			0x0040			\b,IOCTL-
542# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
543>4	uleshort&0x0800			0x0800			\b,close media-
544# output until busy support by int 10h for character device driver
545>4	uleshort&0x8000			0x8000
546>>4	uleshort&0x2000			0x2000			\b,until busy-
547# direct read/write support by driver functions 03h,0Ch
548>4	uleshort&0x4000			0x4000			\b,control strings-
549>4	uleshort&0x8000			0x8000
550>>4	uleshort&0x6840			>0			\bsupport
551>4	uleshort&0x8000			0x0000
552>>4	uleshort&0x4842			>0			\bsupport
553>0	ubyte				x			\b)
554>0	ulelong				!0xffffffff		with pointer %#x
555# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
5560	ulequad				0x0513c00000000012
557>0	use				msdos-driver
558# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
5590	ulequad				0x32f28000ffff0016
560>0	use				msdos-driver
5610	ulequad				0x007f00000000ffff
562>0	use				msdos-driver
563# https://www.uwe-sieber.de/files/cfg_echo.zip
5640	ulequad				0x001600000000ffff
565>0	use				msdos-driver
566# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
5670	ulequad				0x0bf708c2ffffffff
568>0	use				msdos-driver
5690	ulequad				0x07bd08c2ffffffff
570>0	use				msdos-driver
571# 3Com EtherLink 3C501 CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\ELNK.DOS
5720	ulequad				0x027ac0c0ffffffff
573>0	use				msdos-driver
574# IBM Streamer CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\IBMMPC.DOS
5750	ulequad				0x00228880ffffffff
576>0	use				msdos-driver
577
578# updated by Joerg Jenderek
579# GRR: line below too general as it catches also
580# rt.lib DYADISKS.PIC and many more
581# start with assembler instruction MOV
5820	ubyte		0x8c
583# skip "AppleWorks word processor data" like ARTICLE.1 ./apple
584>4	string			!O====
585# skip some unknown basic binaries like RocketRnger.SHR
586>>5	string			!MAIN
587# skip "GPG symmetrically encrypted data" ./gnu
588# skip "PGP symmetric key encrypted data" ./pgp
589# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type
590>>>4	ubyte			>13
591>>>>0		use	msdos-com
592# the remaining files should be DOS *.COM executables
593# dosshell.COM	8cc0 2ea35f07 e85211 e88a11 b80058 cd
594# hmload.COM	8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4
595# UNDELETE.COM	8cca 2e8916 6503 b430 cd21 8b 2e0200 8b
596# BOOTFIX.COM	8cca 2e8916 9603 b430 cd21 8b 2e0200 8b
597# RAWRITE3.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
598# SHARE.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
599# validchr.COM	8cca 2e8916 9603 b430 cd21 8b 2e028b1e
600# devload.COM	8cca 8916ad01 b430 cd21 8b2e0200 892e
601
6020       name    msdos-com
603# URL:		http://fileformats.archiveteam.org/wiki/DOS_executable_(.com)
604>0  byte        x               DOS executable (
605# DOS execuable with JuMP 16-bit instruction
606>0	byte			=0xE9
607# check for probably nil padding til offset 64 of Lotus driver name
608>>56		quad		=0
609# check for "long" alpabetical Lotus driver name like:
610# Diablo "COMPAQ Text Display" "IBM Monochrome Display" "Plantronics ColorPlus"
611>>>24			regex	=^[A-Z][A-Za-z\040]{5,21}	\bLotus driver) %s
612!:mime				application/x-dosexec
613# like: CPQ0TD.DRV IBM0MONO.DRV (Lotus 123 10a) SDIAB4.DRV SPL0CPLS.DRV (Lotus Symphony 2)
614!:ext				drv
615# COM with nils like MODE.COM IBMDOS.COM (pcdos 3.31 ru Compaq) RSSTUB.COM (PC-DOS 2000 de) ACCESS.COM (Lotus Symphony 1)
616>>>24			default	x				\bCOM)
617!:mime				application/x-dosexec
618!:ext				com
619# DOS excutable with JuMP 16-bit and without nil padding
620>>56		quad		!0
621# https://wiki.syslinux.org/wiki/index.php?title=Doc/comboot
622# TODO: HOWTO distinguish COMboot from pure DOS executables?
623# look for unreliable Syslinux specific api call INTerrupt 22h for 16-bit COMBOOT program
624>>>1			search/0xc088	\xcd\x22		\bCOM or COMBOOT 16-bit)
625!:mime				application/x-dosexec
626# like: sbm.cbt command.com (Windows XP) UNI2ASCI.COM (FreeDOS 1.2)
627!:ext				com/cbt
628>>>1			default		x			\bCOM)
629!:mime				application/x-dosexec
630!:ext				com
631# DOS executable without JuMP 16-bit instruction
632>0	byte			!0xE9
633# SCREATE.SYS	https://en.wikipedia.org/wiki/Stac_Electronics
634>>10		string		=?STACVOL			\bSCREATE.SYS)
635!:mime			application/x-dosexec
636!:ext			sys
637# COM executable without JuMP 16-bit instruction and not SCREATE.SYS
638>>10		string		!?STACVOL			\bCOM)
639!:mime			application/x-dosexec
640!:ext			com
641>6	string		SFX\ of\ LHarc	\b, %s
642>0x1FE leshort	0xAA55		    \b, boot code
643>85	string		UPX		        \b, UPX compressed
644>4	string		\ $ARX		    \b, ARX self-extracting archive
645>4	string		\ $LHarc	    \b, LHarc self-extracting archive
646>0x20e string	SFX\ by\ LARC	\b, LARC self-extracting archive
647# like: E30ODI.COM MADGEODI.COM UNI2ASCI.COM RECOVER.COM (DOS 2) COMMAND.COM (DOS 2)
648>1	search/0xc088	\xcd\x22	\b, maybe with interrupt 22h
649>0	ubelong		x		\b, start instruction %#8.8x
650# show more instructions but not in samples like: rem.com (DJGPP)
651>4	ubelong		x		%8.8x
652
653# JMP 8bit
6540	        byte	0xeb
655# byte 0xeb conflicts with magic leshort 0xn2eb of "SYMMETRY i386" handled by ./sequent
656# allow forward jumps only
657>1          byte    >-1
658# that offset must be accessible
659# with hexadecimal values like: 0e 2e 50 8c 8d ba bc bd be e8 fb fc
660>>(1.b+2)   byte    x
661# if look like COM executable with x86 boot signature then this
662# implies FAT volume with x86 real mode code already handled by ./filesystems
663#
664# No x86 boot signature implies often DOS executable
665# check for unrealistic high number of FATs. Then it is an unusual disk image or often a DOS executable
666# like: FIXBIOS.COM (50 bytes)
667>>>16		ubyte		>3
668# https://www.drivedroid.io/
669# skip MBR disk image drivedroid.img version 12 July 2013 by start message
670>>>>2		string		!DriveDroid
671# ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/
672# skip unusual floppy image disk1.img of MS-DOS 1.25 (Corona Data Systems OEM)
673# by check for characteristic message text near the beginning
674>>>>>15		string		!Non\040System\040disk
675# "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 4.0.rar"
676# skip BeOS 4 bootfloppy.img done as "Linux kernel x86 boot executable" by ./linux
677# by check for characteristic message text near the beginning
678>>>>>>6		string		!read\040error\015
679# https://github.com/ventoy/Ventoy/releases/download/v1.0.78/ventoy-1.0.78-windows.zip
680# skip ventoy 1.0.78 boot_hybrid.img
681>>>>>>>24	string		!\220\220\353I$\022\017
682# "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/PC-DOS 1.0 (5.25).rar"
683# skip unusual floppy image PCDOS100.IMG of DOS 1.0
684# by check for characteristic message text near the beginning
685>>>>>>>>9	string		!7-May-81
686# "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 5.0 Personal (BA).rar"
687# skip BeOS 5 floppy_1.44.00.ima done as "DOS/MBR boot sector" by ./filesystems
688# by check for characteristic message near the beginning
689>>>>>>>>>3	string		!\370sdfS\270
690# like: FIXBIOS.COM (50 bytes)
691>>>>>>>>>>0		use		msdos-com
692# check for unrealistic low number of FATs. Then it is an unusual FAT disk image or often a DOS executable
693# like: DEVICE.COM INSTALL.COM (GAG 4.10) WORD.COM (Word 1.15)
694>>>16		ubyte		=0
695# if low FATs with x86 boot signature it can be unusual disk image like: boot.img (Ventoy 1.0.27) geodspms.img (Syslinux)
696>>>>0x1FE	leshort		=0xAA55
697>>>>0x1FE	default		x
698# https://thestarman.pcministry.com/tool/hxd/dimtut.htm
699# skip unusual floppy image TK-DOS11.img IBMDOS11.img of IBM DOS 1.10
700# by check for characteristic bootloader names near end of boot sector
701>>>>>395	string		!ibmbio\040\040com
702>>>>>>0			use		msdos-com
703# 8-bit jump with valid number of FAT implies FAT volume already handled by ./filesystems
704# like: balder.img
705>>>16		default		x
706# skip disk images with boot signature at end of 1st sector
707# like: TDSK-64b.img
708>>>>(11.s-2)	uleshort	!0xAA55
709# skip unusual floppy image without boot signature like 360k-256.img (mtools 4.0.18)
710# by check for characteristic file system type text for FAT (12 bit or 16 bit)
711>>>>>54		string		!FAT
712# "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/Microsoft MS-DOS 3.31 (Compaq OEM) (3.5).rar"
713# skip unusual floppy image Disk4.img without boot signature and file system type text
714# by check for characteristic OEM-ID text
715>>>>>>3		string		!COMPAQ\040\040
716# no such DOS COM executables found
717>>>>>>>0		use		msdos-com
718# JMP 16bit
7190           byte    0xe9
720# 16-bit offset; for DEBUGGING!; can be negative like: USBDRIVE.COM
721#>1		leshort		x	\b, OFFSET %d
722# forward jumps
723>1		leshort	>-1
724# that offset must be accessible
725# with hexadecimal values like: 06 1e 0e 2e 60 8c 8d b4 ba be e8 fc
726>>(1.s+3)   byte    x
727# check for unrealistic high number of FATs. Then it is not a disk image and it is a DOS executable
728# like: CALLVER.COM CPUCACHE.COM K437_EUR.COM SHSUCDX.COM UMBFILL.COM (183 bytes)
729>>>16		ubyte		>3
730>>>>0			use		msdos-com
731# check for unrealistic low number of FATs. Then it is not a disk image and it is a DOS executable
732# like: GAG.COM DRMOUSE.COM NDN.COM CPQ0TD.DRV
733>>>16		ubyte		=0
734>>>>0			use		msdos-com
735# maybe disc image with valid number of FATs or DOS executable
736# like: IPXODI.COM PERUSE.COM TASKID.COM
737>>>16		default	x
738# invalid low media descriptor. Then it is not a disk image and it is a DOS executable
739>>>>21		ubyte		<0xE5
740>>>>>0			use		msdos-com
741# valid media descriptor. Then it is maybe disk image or DOS executable
742>>>>21		ubyte		>0xE4
743# invalid sectorsize not a power of 2 from 32-32768. Then it is not a disk image and it must be DOS executable
744# like: LEARN.COM (Word 1.15)
745>>>>>11		uleshort&0x001f	!0
746>>>>>>0			use		msdos-com
747# negative offset, must not lead into PSP
748# like: BASICA.COM (PC dos 3.20) FORMAT.COM SMC8100.COM WORD.COM (word4)
749# HIDSUPT1.COM USBDRIVE.COM USBSUPT1.COM USBUHCI.COM (FreeDOS USBDOS)
750>1		leshort	<-259
751# that offset must be accessible
752# add 10000h to jump at end of 64 KiB segment, add 1 for jump instruction and 2 for 16-bit offset
753>>(1,s+65539)   byte    x
754# after jump next instruction for DEBUGGING!
755#>>>&-1		ubelong	x	\b, NEXT instruction %#8.8x
756>>>0        use msdos-com
757
758# updated by Joerg Jenderek at Oct 2008,2015,2022
759# following line is too general
7600	ubyte		0xb8
761# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux
762>0	string		!\xb8\xc0\x07\x8e
763# modified by Joerg Jenderek
764# syslinux COM32 or COM32R executable
765>>1	lelong&0xFFFFFFFe 0x21CD4CFe	COM executable (32-bit COMBOOT
766# https://www.syslinux.org/wiki/index.php/Comboot_API
767# Since version 5.00 c32 modules switched from the COM32 object format to ELF
768!:mime	application/x-c32-comboot-syslinux-exec
769!:ext c32
770# https://syslinux.zytor.com/comboot.php
771# older syslinux version ( <4 )
772# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
773# start with assembler instructions mov eax,21cd4cffh
774>>>1	lelong		0x21CD4CFf	\b)
775# syslinux:doc/comboot.txt
776# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
777# eax,21cd4cfeh) as a magic number.
778# syslinux version (4.x)
779# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID
780>>>1	lelong		0x21CD4CFe	\b, relocatable)
781>>1	default	x
782# look for interrupt instruction like in rem.com (DJGPP) LOADER.COM (DR-DOS 7.x)
783>>>3	search/118	\xCD
784# FOR DEBUGGING; possible hexadecimal interupt number like: 10~BANNER.COM 13~bcdw_cl.com 15~poweroff.com (Syslinux)
785# 1A~BERNDPCI.COM 20~SETENHKB.COM 21~mostly 22~gfxboot.com (Syslinux) 2F~SHUTDOWN.COM (GEMSYS)
786#>>>>&0	ubyte	x			\b, INTERUPT %#x
787# few examples with interrupt 0x13 instruction
788>>>>&0	ubyte	=0x13
789# FOR DEBUGGING!
790#>>>>>3	ubequad	x			\b, 2nd INSTRUCTION %#16.16llx
791# skip Gpt.com Mbr.com (edk2-UDK2018 bootsector) described as "DOS/MBR boot sector" by ./filesystems
792# by check for assembler instructions: mov  es,ax ; mov  ax,07c0h ; mov ds,ax
793>>>>>3	ubequad	!0x8ec0b8c0078ed88d
794# few COM exectables with interrupt 0x13 instruction like: Bootable CD Wizard executables bcdw_cl.com fdemuoff.com
795# http://bootcd.narod.ru/bcdw150z_en.zip
796>>>>>>0		use		msdos-com
797# few examples with interrupt 0x16 instruction like flashimg.img
798>>>>&0	ubyte	=0x16
799# skip Syslinux 3.71 flashimg.img done as "DOS/MBR boot sector" by ./filesystems
800# by check for assembler instructions: cmp ax 0xE4E4 (magic); jnz
801>>>>>8	ubelong	!0x3DE4E475
802# no DOS executable with interrupt 0x16 found
803>>>>>>0		use		msdos-com
804# most examples with interrupt instruction unequal 0x13 and 0x16
805>>>>&0	default	x
806#>>>>>&-1 ubyte	x			\b, INTERUPT %#x
807# like: LOADER.COM SETENHKB.COM banner.com copybs.com gif2raw.com poweroff.com rem.com
808>>>>>0		use		msdos-com
809# few COM executables without interupt instruction like RESTART.COM (DOS 7.10) REBOOT.COM
810# or some EUC-KR text files or one Ulead Imaginfo thumbnail
811>>>3	default	x
812# FOR DEBUGGING; 2nd instruction like 0x50 (RESTART.COM) 0x8e (REBOOT.COM)
813# or random like: 0x0 (IMAGINFO.PE3 sky_snow) 0xb1 (euckr_.txt)
814#>>>>3	ubyte	x			\b, 2nd INSTRUCTION %#x
815# skip 1 Ulead Imaginfo thumbnail (IMAGINFO.PE3 sky_snow)
816# inside SAMPLES/TEXTURES/SKY_SNOW
817# from https://archive.org/download/PI3CANON/PI3CANON.iso
818>>>>3	ubyte	!0x0
819# skip some EUC-KR text files like: euckr_falsepositive.txt
820# https://bugs.astron.com/view.php?id=186
821>>>>>3	ubyte	!0xb1
822# like: RESTART.COM (DOS 7.10) REBOOT.COM
823>>>>>>0	use		msdos-com
824
825# URL:		https://en.wikipedia.org/wiki/UPX
826# Reference:	https://github.com/upx/upx/archive/v3.96.zip/upx-3.96/
827#		src/stub/src/i086-dos16.com.S
828# Update:	Joerg Jenderek
829# assembler instructions: cmp sp, offset sp_limit
8300	string/b	\x81\xfc
831#>2	uleshort	x		\b, sp_limit=%#x
832# assembler instructions: jump above +2; int 0x20; mov cx, offset bytes_to_copy
833>4	string	\x77\x02\xcd\x20\xb9
834#>9	uleshort	x		\b, [bytes_to_copy]=%#x
835# at different offsets assembler instructions: push di; jump decomp_start_n2b
836>0x1e	search/3	\x57\xe9
837#>>&0	uleshort	x		\b, decomp_start_n2b=%#x
838# src/stub/src/include/header.S; UPX_MAGIC_LE32
839>>&2	string		UPX!		FREE-DOS executable (COM), UPX
840!:mime	application/x-dosexec
841# UPX compressed *.CPI; See ./fonts
842>>>&21	string		=FONT		compressed DOS code page font
843!:ext	cpx
844>>>&21	string		!FONT		compressed
845!:ext	com
846# compressed size?
847#>>>&14	uleshort+152	x		\b, %u bytes
848# uncompressed len
849>>>&12	uleshort	x		\b, uncompressed %u bytes
850252	string Must\ have\ DOS\ version DR-DOS executable (COM)
851!:mime	application/x-dosexec
852!:ext	com
853# GRR search is not working
854#2	search/28	\xcd\x21	COM executable for MS-DOS
855#WHICHFAT.cOM
8562	string	\xcd\x21		COM executable for DOS
857!:mime	application/x-dosexec
858!:ext	com
859#DELTREE.cOM DELTREE2.cOM
8604	string	\xcd\x21		COM executable for DOS
861!:mime	application/x-dosexec
862!:ext	com
863#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
8645	string	\xcd\x21		COM executable for DOS
865!:mime	application/x-dosexec
866!:ext	com
867#DELTMP.COm HASFAT32.cOM
8687	string	\xcd\x21
869>0	byte	!0xb8			COM executable for DOS
870!:mime	application/x-dosexec
871!:ext	com
872#COMP.cOM MORE.COm
87310	string	\xcd\x21
874>5	string	!\xcd\x21		COM executable for DOS
875!:mime	application/x-dosexec
876!:ext	com
877#comecho.com
87813	string	\xcd\x21		COM executable for DOS
879!:mime	application/x-dosexec
880!:ext	com
881#HELP.COm EDIT.coM
88218	string	\xcd\x21
883# not printable before it?
884>17	byte	>32
885>>17	byte	<126
886>>17	default	x			COM executable for MS-DOS
887!:mime	application/x-dosexec
888!:ext	com
889#NWRPLTRM.COm
89023	string	\xcd\x21		COM executable for MS-DOS
891!:mime	application/x-dosexec
892!:ext	com
893#LOADFIX.cOm LOADFIX.cOm
89430	string	\xcd\x21		COM executable for MS-DOS
895!:mime	application/x-dosexec
896!:ext	com
897#syslinux.com 3.11
89870	string	\xcd\x21		COM executable for DOS
899!:mime	application/x-dosexec
900!:ext	com
901# many compressed/converted COMs start with a copy loop instead of a jump
9020x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
903!:mime	application/x-dosexec
904!:ext	com
9050x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
906!:mime	application/x-dosexec
907!:ext	com
908>0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
9090x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
910!:mime	application/x-dosexec
911!:ext	com
912# FIXME: missing diet .com compression
913
914# miscellaneous formats
9150	string/b	LZ		MS-DOS executable (built-in)
916#0	byte		0xf0		MS-DOS program library data
917#
918
919# AAF files:
920# <stuartc@rd.bbc.co.uk> Stuart Cunningham
9210	string/b	\320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377			AAF legacy file using MS Structured Storage
922>30	byte	9		(512B sectors)
923>30	byte	12		(4kB sectors)
9240	string/b	\320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001			AAF file using MS Structured Storage
925>30	byte	9		(512B sectors)
926>30	byte	12		(4kB sectors)
927
928# Popular applications
929#
930# Update:	Joerg Jenderek
931# URL:		http://fileformats.archiveteam.org/wiki/DOC
932# Reference:	https://web.archive.org/web/20170206041048/
933#		http://www.msxnet.org/word2rtf/formats/ffh-dosword5
934# wIdent+dty
9350	belong	0x31be0000
936# skip droid skeleton like x-fmt-274-signature-id-488.doc
937>128	ubyte		>0  			Microsoft
938>>96	uleshort	=0			Word
939!:mime	application/msword
940!:apple	MSWDWDBN
941# DCX is used in the Unix version.
942!:ext	doc/dcx
943>>>0x6E	ulequad		=0			1.0-4.0
944>>>0x6E	ulequad		!0			5.0-6.0
945>>>0x6E	ulequad		x			(DOS) Document
946# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt
947>>96	uleshort	!0			Write 3.0 (Windows) Document
948!:mime	application/x-mswrite
949!:apple	MSWDWDBN
950# sometimes also doc like in splitter.doc srchtest.doc
951!:ext	wri/doc
952# wTool must be 0125400 octal
953#>>4	uleshort	!0xAB00			\b, wTool %o
954# reserved; must be zero
955#>>6	ulelong		!0			\b, reserved %u
956# block pointer to the block containing optional file manager information
957#>>0x1C	uleshort	x			\b, at %#x info block
958# jump to File manager information block
959>>(0x1C.s*128)	uleshort x
960# test for valid information start; maybe also 0012h
961>>>&-2		uleshort	=0x0014
962# Document ASCIIZ name
963>>>>&0x12	string		x		%s
964# author name
965>>>>>&1		string		x		\b, author %s
966# reviser name
967>>>>>>&1	string		x		\b, reviser %s
968# keywords
969>>>>>>>&1	string		x		\b, keywords %s
970# comment
971>>>>>>>>&1	string		x		\b, comment %s
972# version number
973>>>>>>>>>&1	string		x		\b, version %s
974# date of last change MM/DD/YY
975>>>>>>>>>>&1	string		x		\b, %-.8s
976# creation date MM/DD/YY
977>>>>>>>>>>&9	string		x		created %-.8s
978# file name of print format like NORMAL.STY
979>>0x1E	string		>0			\b, formatted by %-.66s
980# count of pages in whole file for write variant; maybe some times wrong
981>>96	uleshort	>0			\b, %u pages
982# name of the printer driver like HPLASMS
983>>0x62	string		>0			\b, %-.8s printer
984# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0
985>>0x6A	uleshort	>0			\b, %u blocks
986# bit field for corrected text areas
987#>>0x6C	uleshort	x			\b, %#x bit field
988# text of document; some times start with 4 non printable characters like CR LF
989>>128	ubyte		x			\b,
990>>>128		ubyte	>0x1F
991>>>>128		string	x			%s
992>>>128		ubyte	<0x20
993>>>>129		ubyte	>0x1F
994>>>>>129	string	x			%s
995>>>>129		ubyte	<0x20
996>>>>>130	ubyte	>0x1F
997>>>>>>130	string	x			%s
998>>>>>130	ubyte	<0x20
999>>>>>>131	ubyte	>0x1F
1000>>>>>>>131	string	x			%s
1001>>>>>>131	ubyte	<0x20
1002>>>>>>>132	ubyte	>0x1F
1003>>>>>>>>132	string	x			%s
1004>>>>>>>132	ubyte	<0x20
1005>>>>>>>>133	ubyte	>0x1F
1006>>>>>>>>>133	string	x			%s
1007#
10080	string/b	PO^Q`				Microsoft Word 6.0 Document
1009!:mime	application/msword
1010#
10114   long        0
1012>0  belong      0xfe320000      Microsoft Word for Macintosh 1.0
1013!:mime	application/msword
1014!:ext   mcw
1015>0  belong      0xfe340000      Microsoft Word for Macintosh 3.0
1016!:mime	application/msword
1017!:ext   mcw
1018>0  belong      0xfe37001c      Microsoft Word for Macintosh 4.0
1019!:mime	application/msword
1020!:ext   mcw
1021>0  belong      0xfe370023      Microsoft Word for Macintosh 5.0
1022!:mime	application/msword
1023!:ext   mcw
1024
10250	string/b	\333\245-\0\0\0			Microsoft Word 2.0 Document
1026!:mime	application/msword
1027!:ext   doc
1028# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs
1029#512	string/b	\354\245\301			Microsoft Word Document
1030#!:mime	application/msword
1031
1032#
10330	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
1034!:mime application/msword
1035#
10360	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
1037!:mime application/msword
1038
1039#
10400	string/b	\x09\x04\x06\x00\x00\x00\x10\x00	Microsoft Excel Worksheet
1041!:mime	application/vnd.ms-excel
1042# https://www.macdisk.com/macsigen.php
1043!:apple	XCELXLS4
1044!:ext	xls
1045#
1046# Update: Joerg Jenderek
1047# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3
1048# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
1049# Note: newer Lotus versions >2 use longer BOF record
1050# record type (BeginningOfFile=0000h) + length (001Ah)
10510	belong	0x00001a00
1052# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3
1053#>18	uleshort&0x73E0	0
1054# Lotus Multi Byte Character Set (LMBCS=1-31)
1055>20	ubyte		>0
1056>>20	ubyte		<32	Lotus 1-2-3
1057#!:mime	application/x-123
1058!:mime	application/vnd.lotus-1-2-3
1059!:apple	????L123
1060# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data"
1061>>>4	uleshort	0x1000	WorKsheet, version 3
1062!:ext	wk3
1063# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data"
1064>>>4	uleshort	0x1002	WorKsheet, version 4
1065# also worksheet template 4 (.wt4)
1066!:ext	wk4/wt4
1067# no example or documentation for wk5
1068#>>4	uleshort	0x????	WorKsheet, version 4
1069#!:ext	wk5
1070# only MacrotoScript.123 example
1071>>>4	uleshort	0x1003	WorKsheet, version 97
1072# also worksheet template Smartmaster (.12M)?
1073!:ext	123
1074# only Set_Y2K.123 example
1075>>>4	uleshort	0x1005	WorKsheet, version 9.8 Millennium
1076!:ext	123
1077# no example for this version
1078>>>4	uleshort	0x8001	FoRMatting data
1079!:ext	frm
1080# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data"
1081# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet"
1082>>>4	uleshort	0x8007	ForMatting data, version 3
1083!:ext	fm3
1084>>>4	default		x	unknown
1085# file revision sub code 0004h for worksheets
1086>>>>6	uleshort	=0x0004	worksheet
1087!:ext	wXX
1088>>>>6	uleshort	!0x0004	formatting data
1089!:ext	fXX
1090# main revision number
1091>>>>4	uleshort	x	\b, revision %#x
1092>>>6	uleshort	=0x0004	\b, cell range
1093# active cellcoord range (start row, page,column ; end row, page, column)
1094# start values normally 0~1st sheet A1
1095>>>>8	ulelong		!0
1096>>>>>10	ubyte		>0	\b%d*
1097>>>>>8	uleshort	x	\b%d,
1098>>>>>11	ubyte		x	\b%d-
1099# end page mostly 0
1100>>>>14	ubyte		>0	\b%d*
1101# end raw, column normally not 0
1102>>>>12	uleshort	x	\b%d,
1103>>>>15	ubyte		x	\b%d
1104# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??)
1105>>>>20	ubyte		>1	\b, character set %#x
1106# flags
1107>>>>21	ubyte		x	\b, flags %#x
1108>>>6	uleshort	!0x0004
1109# record type (FONTNAME=00AEh)
1110>>>>30	search/29	\0\xAE
1111# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
1112>>>>>&4	string		>\0	\b, 1st font "%s"
1113#
1114# Update: Joerg Jenderek
1115# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3
1116# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
1117# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
1118# record type (BeginningOfFile=0000h) + length (0002h)
11190	belong	0x00000200
1120# GRR: line above is too general as it catches also MS Windows CURsor
1121# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
1122!:strength -1
1123# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
1124>7	ubyte		0
1125# skip Windows cursors with image width 256 and keep Lotus with positive opcode
1126>>6	ubyte		>0	Lotus
1127# !:mime	application/x-123
1128!:mime	application/vnd.lotus-1-2-3
1129!:apple	????L123
1130# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...)
1131# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3"
1132>>>4	uleshort	0x0007	1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF)
1133!:ext	cnf
1134>>>4	uleshort	0x0C05	1-2-3 CoNFiguration, version 2.4J
1135!:ext	cnf
1136>>>4	uleshort	0x0801	1-2-3 CoNFiguration, version 1-2.1
1137!:ext	cnf
1138>>>4	uleshort	0x0802	Symphony CoNFiguration
1139!:ext	cnf
1140>>>4	uleshort	0x0804	1-2-3 CoNFiguration, version 2.2
1141!:ext	cnf
1142>>>4	uleshort	0x080A	1-2-3 CoNFiguration, version 2.3-2.4
1143!:ext	cnf
1144>>>4	uleshort	0x1402	1-2-3 CoNFiguration, version 3.x
1145!:ext	cnf
1146>>>4	uleshort	0x1450	1-2-3 CoNFiguration, version 4.x
1147!:ext	cnf
1148# (version 5.26) labeled the entry as "Lotus 123"
1149# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
1150>>>4	uleshort	0x0404	1-2-3 WorKSheet, version 1
1151# extension "wks" also for Microsoft Works document
1152!:ext	wks
1153# (version 5.26) labeled the entry as "Lotus 123"
1154# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
1155>>>4	uleshort	0x0405	Symphony WoRksheet, version 1.0
1156!:ext	wrk/wr1
1157# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data"
1158# TrID labeles the entry as "Lotus 123 Worksheet (V2)"
1159>>>4	uleshort	0x0406	1-2-3/Symphony worksheet, version 2
1160# Symphony (.wr1)
1161!:ext	wk1/wr1
1162# no example for this japan version
1163>>>4	uleshort	0x0600	1-2-3 WorKsheet, version 1.xJ
1164!:ext	wj1
1165# no example or documentation for wk2
1166#>>>4	uleshort	0x????	1-2-3 WorKsheet, version 2
1167#!:ext	wk2
1168# undocumented japan version
1169>>>4	uleshort	0x0602	1-2-3 worksheet, version 2.4J
1170!:ext	wj3
1171# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data"
1172>>>4	uleshort	0x8006	1-2-3 ForMaTting data, version 2.x
1173# japan version 2.4J (fj3)
1174!:ext	fmt/fj3
1175# no example for this version
1176>>>4	uleshort	0x8007	1-2-3 FoRMatting data, version 2.0
1177!:ext	frm
1178# (version 5.26) labeled the entry as "Lotus 1-2-3"
1179>>>4	default		x	unknown worksheet or configuration
1180!:ext	cnf
1181>>>>4	uleshort	x	\b, revision %#x
1182# 2nd record for most worksheets describes cells range
1183>>>6		use	lotus-cells
1184# 3rd record for most japan worksheets describes cells range
1185>>>(8.s+10)	use	lotus-cells
1186#	check and then display Lotus worksheet cells range
11870	name		lotus-cells
1188# look for type (RANGE=0006h) + length (0008h) at record begin
1189>0	ubelong	0x06000800	\b, cell range
1190# cell range (start column, row, end column, row) start values normally 0,0~A1 cell
1191>>4	ulong		!0
1192>>>4	uleshort	x	\b%d,
1193>>>6	uleshort	x	\b%d-
1194# end of cell range
1195>>8	uleshort	x	\b%d,
1196>>10	uleshort	x	\b%d
1197# EndOfLotus123
11980	string/b		WordPro\0	Lotus WordPro
1199!:mime	application/vnd.lotus-wordpro
12000	string/b		WordPro\r\373	Lotus WordPro
1201!:mime	application/vnd.lotus-wordpro
1202
1203
1204# Summary: Script used by InstallScield to uninstall applications
1205# Extension: .isu
1206# Submitted by: unknown
1207# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
12080		string		\x71\xa8\x00\x00\x01\x02
1209>12		string		Stirling\ Technologies,		InstallShield Uninstall Script
1210
1211# Winamp .avs
1212#0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
12130	string/b	Nullsoft\ AVS\ Preset\ 	Winamp plug in
1214
1215# Windows Metafile .WMF
12160	string/b	\327\315\306\232	Windows metafile
1217!:mime	image/wmf
1218!:ext	wmf
12190	string/b	\002\000\011\000	Windows metafile
1220!:mime	image/wmf
1221!:ext	wmf
12220	string/b	\001\000\011\000	Windows metafile
1223!:mime	image/wmf
1224!:ext	wmf
1225
1226#tz3 files whatever that is (MS Works files)
12270	string/b	\003\001\001\004\070\001\000\000	tz3 ms-works file
12280	string/b	\003\002\001\004\070\001\000\000	tz3 ms-works file
12290	string/b	\003\003\001\004\070\001\000\000	tz3 ms-works file
1230
1231# PGP sig files .sig
1232#0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
12330 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
12340 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
12350 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
12360 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
12370 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
12380 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
1239
1240# windows zips files .dmf
12410	string/b	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
1242
1243# Windows icons
1244# Update: Joerg Jenderek
1245# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
1246# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG
12470   belong  0x00000100
1248>9  byte    0
1249>>0 byte    x
1250>>0 use     cur-ico-dir
1251>9  ubyte   0xff
1252>>0 byte    x
1253>>0 use     cur-ico-dir
1254#	displays number of icons and information for icon or cursor
12550	name		cur-ico-dir
1256# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
1257# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
1258>18		ulelong		&0x00000006
1259# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
1260>>(18.l)	ulelong		x		MS Windows
1261>>>0		ubelong		0x00000100	icon resource
1262# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon
1263!:mime		image/vnd.microsoft.icon
1264#!:mime		image/x-icon
1265!:ext		ico
1266>>>>4 		uleshort	x		- %d icon
1267# plural s
1268>>>>4 		uleshort	>1		\bs
1269# 1st icon
1270>>>>0x06	use		ico-entry
1271# 2nd icon
1272>>>>4 		uleshort	>1
1273>>>>>0x16	use		ico-entry
1274>>>0		ubelong		0x00000200	cursor resource
1275#!:mime		image/x-cur
1276!:mime		image/x-win-bitmap
1277!:ext		cur
1278>>>>4 		uleshort	x		- %d icon
1279>>>>4 		uleshort	>1		\bs
1280# 1st cursor
1281>>>>0x06	use		cur-entry
1282#>>>>0x16	use		cur-entry
1283#	display information of one cursor entry
12840	name		cur-entry
1285>0	use		cur-ico-entry
1286>4	uleshort	x	\b, hotspot @%dx
1287>6	uleshort	x	\b%d
1288#	display information of one icon entry
12890	name		ico-entry
1290>0			use	cur-ico-entry
1291# normally 0 1 but also found 14
1292>4	uleshort	>1	\b, %d planes
1293# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256
1294>6	uleshort	>1	\b, %d bits/pixel
1295#	display shared information of cursor or icon entry
12960		name		cur-ico-entry
1297>0		byte		=0		\b, 256x
1298>0		byte		!0		\b, %dx
1299>1		byte        	=0		\b256
1300>1		byte        	!0		\b%d
1301# number of colors in palette
1302>2		ubyte		!0		\b, %d colors
1303# reserved 0 FFh
1304#>3		ubyte        	x		\b, reserved %x
1305#>8		ulelong		x		\b, image size %d
1306# offset of PNG or DIB image
1307#>12		ulelong		x		\b, offset %#x
1308# PNG header (\x89PNG)
1309>(12.l)		ubelong		=0x89504e47
1310# 1 space char after "with" to get phrase "with PNG image" by magic in ./images
1311>>&-4		indirect	x	\b with
1312# DIB image
1313>(12.l)		ubelong		!0x89504e47
1314#>>&-4		use     	dib-image
1315
1316# Windows non-animated cursors
1317# Update: Joerg Jenderek
1318# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
1319# Note: similar to Windows ICOn. container for BMP ( only DIB part)
1320# GRR: line below is too general as it catches also Lotus 1-2-3 files
13210   belong  0x00000200
1322>9  byte    0
1323>>0 use     cur-ico-dir
1324>9  ubyte   0xff
1325>>0 use     cur-ico-dir
1326
1327# .chr files
13280	string/b	PK\010\010BGI	Borland font
1329>4	string	>\0	%s
1330# then there is a copyright notice
1331
1332
1333# .bgi files
13340	string/b	pk\010\010BGI	Borland device
1335>4	string	>\0	%s
1336# then there is a copyright notice
1337
1338
1339# Windows Recycle Bin record file (named INFO2)
1340# By Abel Cheung (abelcheung AT gmail dot com)
1341# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
1342# Since Vista uses another structure, INFO2 structure probably won't change
1343# anymore. Detailed analysis in:
1344# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
13450	lelong		0x00000004
1346>12	lelong		0x00000118	Windows Recycle Bin INFO2 file (Win98 or below)
1347
13480	lelong		0x00000005
1349>12	lelong		0x00000320	Windows Recycle Bin INFO2 file (Win2k - WinXP)
1350
1351# From Doug Lee via a FreeBSD pr
13529	string		GERBILDOC	First Choice document
13539	string		GERBILDB	First Choice database
13549	string		GERBILCLIP	First Choice database
13550	string		GERBIL		First Choice device file
13569	string		RABBITGRAPH	RabbitGraph file
13570	string		DCU1		Borland Delphi .DCU file
13580	string		=!<spell>	MKS Spell hash list (old format)
13590	string		=!<spell2>	MKS Spell hash list
1360# Too simple - MPi
1361#0	string		AH		Halo(TM) bitmapped font file
13620	lelong		0x08086b70	TurboC BGI file
13630	lelong		0x08084b50	TurboC Font file
1364
1365# Debian#712046: The magic below identifies "Delphi compiled form data".
1366# An additional source of information is available at:
1367# http://www.woodmann.com/fravia/dafix_t1.htm
13680	string		TPF0
1369>4	pstring		>\0		Delphi compiled form '%s'
1370
1371# tests for DBase files moved, updated and merged to database
1372
13730	string		PMCC		Windows 3.x .GRP file
13741	string		RDC-meg		MegaDots
1375>8	byte		>0x2F		version %c
1376>9	byte		>0x2F		\b.%c file
13770	lelong		0x4C
1378>4	lelong		0x00021401	Windows shortcut file
1379
1380# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm
1381# only for windows versions equal or greater 3.0
13820x171	string	MICROSOFT\ PIFEX\0	Windows Program Information File
1383!:mime	application/x-dosexec
1384!:ext	pif
1385#>2	string	 	>\0		\b, Title:%.30s
1386>0x24	string		>\0		\b for %.63s
1387>0x65	string		>\0		\b, directory=%.64s
1388>0xA5	string		>\0		\b, parameters=%.64s
1389#>0x181	leshort	x	\b, offset %x
1390#>0x183	leshort	x	\b, offsetdata %x
1391#>0x185	leshort	x	\b, section length %x
1392>0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0
1393>>&0x5e		ubyte	>0
1394>>>&-1		string	<PIFMGR.DLL		\b, icon=%s
1395#>>>&-1		string	PIFMGR.DLL		\b, icon=%s
1396>>>&-1		string	>PIFMGR.DLL		\b, icon=%s
1397>>&0xF0		ubyte	>0
1398>>>&-1		string	<Terminal		\b, font=%.32s
1399#>>>&-1		string	=Terminal		\b, font=%.32s
1400>>>&-1		string	>Terminal		\b, font=%.32s
1401>>&0x110	ubyte	>0
1402>>>&-1		string	<Lucida\ Console	\b, TrueTypeFont=%.32s
1403#>>>&-1		string	=Lucida\ Console	\b, TrueTypeFont=%.32s
1404>>>&-1		string	>Lucida\ Console	\b, TrueTypeFont=%.32s
1405#>0x187	search/0xB55	WINDOWS\ 286\ 3.0\0	\b, Windows 3.X standard mode-style
1406#>0x187	search/0xB55	WINDOWS\ 386\ 3.0\0	\b, Windows 3.X enhanced mode-style
1407>0x187	search/0xB55	WINDOWS\ NT\ \ 3.1\0	\b, Windows NT-style
1408#>0x187	search/0xB55	WINDOWS\ NT\ \ 4.0\0	\b, Windows NT-style
1409>0x187	search/0xB55	CONFIG\ \ SYS\ 4.0\0	\b +CONFIG.SYS
1410#>>&06		string	x			\b:%s
1411>0x187	search/0xB55	AUTOEXECBAT\ 4.0\0	\b +AUTOEXEC.BAT
1412#>>&06		string	x			\b:%s
1413
1414# DOS EPS Binary File Header
1415# From: Ed Sznyter <ews@Black.Market.NET>
14160	belong		0xC5D0D3C6	DOS EPS Binary File
1417!:mime	image/x-eps
1418>4	long		>0		Postscript starts at byte %d
1419>>8	long		>0		length %d
1420>>>12	long		>0		Metafile starts at byte %d
1421>>>>16	long		>0		length %d
1422>>>20	long		>0		TIFF starts at byte %d
1423>>>>24	long		>0		length %d
1424
1425# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
1426# of http://www.davep.org/norton-guides/ng2h-105.tgz
1427# https://en.wikipedia.org/wiki/Norton_Guides
14280	string		NG\0\001
1429# only value 0x100 found at offset 2
1430>2	ulelong		0x00000100	Norton Guide
1431!:mime	application/x-norton-guide
1432# often like NORTON.NG but some times like NC.HLP
1433!:ext	ng/hlp
1434# Title[40]
1435>>8	string		>\0		"%-.40s"
1436#>>6	uleshort	x		\b, MenuCount=%u
1437# szCredits[5][66]
1438>>48	string		>\0		\b, %-.66s
1439>>114	string		>\0		%-.66s
1440
1441# URL:		https://en.wikipedia.org/wiki/Norton_Commander
1442# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/msg-nc-eng.trid.xml
1443# From:		Joerg Jenderek
1444# Note:		Message file is used by executable with same main name.
1445#		Only tested with version 5.50 (english) and 2.01 (Windows)
14460	string		Abort
1447# \0 or i
1448#>5	ubyte		x		%x
1449# skip ASCII Abort text by looking for error message like in NCVIEW.MSG
1450>6	search/7089	Non-DOS\ disk	Norton Commander module message
1451!:mime	application/x-norton-msg
1452!:ext	msg
1453
1454# URL:		http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm
1455# Reference:	https://mark0.net/download/triddefs_xml.7z/defs/m/msg-netware-dos.trid.xml
1456# From:		Joerg Jenderek
14570	string	DOS\ Client\ Message\ File:	Novell DOS client message
1458#!:mime	application/octet-stream
1459#!:mime	application/x-novell-msg
1460!:ext	msg
1461# look for second letter instead space character
1462>26	ubyte		>0x20
1463# digit 1 or often main or program name like: IPXODI.COM TASKID pnwtrap DOSRqstr
1464>>25		ubyte	!0x20			%c
1465>>>26		ubyte	!0x20			\b%c
1466>>>>27		ubyte	!0x20			\b%c
1467>>>>>28		ubyte	!0x20			\b%c
1468>>>>>>29	ubyte	!0x20			\b%c
1469>>>>>>>30	ubyte	!0x20			\b%c
1470>>>>>>>>31	ubyte	!0x20			\b%c
1471>>>>>>>>>32	ubyte	!0x20			\b%c
1472>>>>>>>>>>33	ubyte	!0x20			\b%c
1473>>>>>>>>>>>34	ubyte	!0x20			\b%c
1474>>>>>>>>>>>>35	ubyte	!0x20			\b%c
1475>>>>>>>>>>>>>36	ubyte	!0x20			\b%c
1476# followed by string like: 0 v.10 V1.20
1477#
1478# followed by ,\040Tran
1479>28	search/14	,\040Tran
1480# probably translated version string like: 0 v1.00
1481>>&0	string	x				\b, tran version %s
1482# followed by Ctrl-J Ctrl-Z
1483>>>&0	ubyte		!0xa			\b, terminated by %#2.2x
1484>>>>&0	ubyte		x			\b%2.2x
1485# Ctrl-Z
1486>0x65	ubyte		!0x1A			\b, at 0x65 %#x
1487# one
1488>0x66	ubyte		!0x01			\b, at 0x66 %#x
1489# URL:		https://en.wikipedia.org/wiki/NetWare
1490# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/dat-novell-msg.trid.xml
1491# ftp://ftp.iitb.ac.in/LDP/en/NLM-HOWTO/NLM-HOWTO-single.html
1492# From:		Joerg Jenderek
14930	string	Novell\ Message\ Librarian\ Data\ File	Novell message librarian data
1494#>35	string	Version\ 1.00
1495#>49	string	COPYRIGHT\ (c)\ 1985\ by\ Novell,\ Inc.
1496#>83	string	\ \ All\ Rights\ Reserved
1497#!:mime	application/octet-stream
1498#!:mime	application/x-novell-msg
1499!:ext	msg
1500#!:ext	msg/dat
1501# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
1502# of https://www.4dos.info/
1503# pointer,HelpID[8]=4DHnnnmm
15040	ulelong	0x48443408		4DOS help file
1505>4	string	x			\b, version %-4.4s
1506
1507# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
15080	ulequad	0x3a000000024e4c	MS Advisor help file
1509
1510# HtmlHelp files (.chm)
15110	string/b	ITSF\003\000\000\000\x60\000\000\000	MS Windows HtmlHelp Data
1512!:mime	application/vnd.ms-htmlhelp
1513!:ext	chm
1514
1515# GFA-BASIC (Wolfram Kleff)
15162	string/b	GFA-BASIC3	GFA-BASIC 3 data
1517
1518#------------------------------------------------------------------------------
1519# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
1520# Update: Joerg Jenderek
1521# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format)
1522# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx
1523# Note: verified by `7z l *.cab`
1524# Microsoft Cabinet files
15250	string/b	MSCF\0\0\0\0	Microsoft Cabinet archive data
1526#
1527# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool
1528# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE
1529# because some archive does not have *.diag* as 1st or 2nd archive member like
1530# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab
1531# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section
1532>0x2c	search/980/c	.diag		\b, Diagnostic
1533!:mime	application/vnd.ms-cab-compressed
1534!:ext	diagcab
1535# http://fileformats.archiveteam.org/wiki/PUZ
1536# Microsoft Publisher version about 2003 has a "Pack and Go" feature that
1537# bundles a Publisher document *PNG.pub with all links into a CAB
1538>0x2c	search/300/c	png.pub\0		\b, Publisher Packed and Go
1539!:mime	application/vnd.ms-cab-compressed
1540!:ext	puz
1541# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation
1542>0x2c	search/17/c	ppview32.exe\0		\b, PowerPoint Viewer Packed and Go
1543!:mime	application/vnd.ms-powerpoint
1544#!:mime	application/mspowerpoint
1545!:ext	ppz
1546# URL:		https://en.wikipedia.org/wiki/Windows_Desktop_Gadgets
1547# Reference:	https://docs.microsoft.com/en-us/previous-versions/windows/desktop/sidebar/
1548# http://win10gadgets.com/download/273/ All_CPU_Meter1.zip/All_CPU_Meter_V4.7.3.gadget
1549>0x2c	search/968/c	gadget.xml		\b, Windows Desktop Gadget
1550#!:mime	application/vnd.ms-cab-compressed
1551# http://extension.nirsoft.net/gadget
1552!:mime	application/x-windows-gadget
1553!:ext	gadget
1554# http://www.incredimail.com/
1555# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims
1556>0x2c	search/3369/c	content.ini\0	\b, IncrediMail
1557!:mime	application/x-incredimail
1558# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf
1559>>0x2c	search/83/c	Flavor.htm\0	ecard
1560!:ext	imf
1561# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims
1562>>0x2c	search/211/c	.swf\0		skin
1563!:ext	ims
1564# member anim.im3 implies IncrediMail animation like in letter_fold.ima
1565>>0x2c	search/92/c	anim.im3\0	animation
1566!:ext	ima
1567# other IncrediMail cab archive
1568>>0x2c	default		x
1569>>>0x2c	search/116/c	thumb		ecard, image, notifier or skin
1570!:ext	imf/imi/imn/ims
1571# http://file-extension.net/seeker/file_extension_ime
1572>>>0x2c	default		x		emoticons or sound
1573!:ext	ime/imw
1574# no Diagnostic, Packed and Go, Windows Desktop Gadget, IncrediMail
1575>0x2c	default		x
1576# look for 1st member name
1577>>(16.l+16)	ubyte	x
1578# https://en.wikipedia.org/wiki/SNP_file_format
1579>>>&-1	string/c 	_accrpt_.snp	\b, Access report snapshot
1580!:mime	application/msaccess
1581!:ext	snp
1582# https://en.wikipedia.org/wiki/Microsoft_InfoPath
1583>>>&-1	string 		manifest.xsf	\b, InfoPath Form Template
1584!:mime	application/vnd.ms-cab-compressed
1585#!:mime	application/vnd.ms-infopath
1586!:ext	xsn
1587# https://www.cabextract.org.uk/wince_cab_format/
1588# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer
1589>>>&7	string 		=.000		\b, WinCE install
1590!:mime	application/vnd.ms-cab-compressed
1591!:ext	cab
1592
1593# https://support.microsoft.com/kb/934307/en-US
1594# All inspected MSU contain a file with name WSUSSCAN.cab
1595# that is called "Windows Update meta data" by Microsoft
1596>>>&-1	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
1597!:mime	application/vnd.ms-cab-compressed
1598!:ext	msu
1599>>>&-1	default		x
1600# look at point character of 1st archive member name for file name extension
1601>>>>&-1	search/255 	.
1602# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm
1603# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002
1604# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB
1605>>>>>&0	string/c	ppt\0		\b, PowerPoint Packed and Go
1606!:mime	application/vnd.ms-powerpoint
1607#!:mime	application/mspowerpoint
1608!:ext	ppz
1609# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx
1610# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack
1611# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack
1612>>>>>&0	string/c	theme		\b, Windows
1613!:mime	application/x-windows-themepack
1614# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8
1615# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack
1616# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme
1617>>>>>>(16.l+16)	string	=Panoram	8
1618!:ext	deskthemepack
1619>>>>>>(16.l+16)	string	!Panoram	7 or 8
1620!:ext	themepack/deskthemepack
1621>>>>>>(16.l+16)	ubyte	x		Theme Pack
1622# URL:		https://en.wikipedia.org/wiki/Microsoft_OneNote#File_format
1623#		http://fileformats.archiveteam.org/wiki/OneNote
1624# Reference:	https://mark0.net/download/triddefs_xml.7z/defs/o/onepkg.trid.xml
1625# 1st member name like: "Class Notes.one" "test-onenote.one" "Open Notebook.onetoc2" "Editor �ffnen.onetoc2"
1626>>>>>&0	string/c	one		\b, OneNote Package
1627!:mime	application/msonenote
1628!:ext	onepkg
1629>>>>>&0	default		x
1630# look for null terminator of 1st member name
1631>>>>>>&0	search/255 	\0
1632# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu
1633>>>>>>>&16	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
1634!:mime	application/vnd.ms-cab-compressed
1635!:ext	msu
1636>>>>>>>&16	default	x
1637# archive with more then one file need some output in version 5.32 to avoid error message like
1638# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type
1639# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type
1640# file: could not find any valid magic files!
1641>>>>>>>>28	uleshort	>1	\b, many
1642!:mime	application/vnd.ms-cab-compressed
1643!:ext	cab
1644# remaining archives with just one file
1645>>>>>>>>28	uleshort	=1
1646# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386
1647>>>>>>>>>30	uleshort	=0x0000	\b, Windows 2000/XP setup
1648# cut of last char of source extension and add underscore to generate extension
1649# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_
1650!:mime	application/vnd.ms-cab-compressed
1651!:ext	_/?_/??_
1652# archive need some output like "single" in version 5.32 to avoid error messages
1653>>>>>>>>>30	uleshort	!0x0000	\b, single
1654!:mime	application/vnd.ms-cab-compressed
1655!:ext	cab
1656# TODO: additional extensions like
1657# .xtp	InfoPath Template Part
1658# .lvf	Logitech Video Effects Face Accessory
1659>8	ulelong		x		\b, %u bytes
1660>28	uleshort		1		\b, 1 file
1661>28	uleshort		>1		\b, %u files
1662# Reserved fields, set to zero
1663#>4	belong		!0		\b, reserved1 %x
1664#>12	belong		!0		\b, reserved2 %x
1665# offset of the first CFFILE entry coffFiles: minimal 2Ch
1666>16	ulelong		x		\b, at %#x
1667>(16.l)	use		cab-file
1668# at least also 2nd member
1669>28	uleshort		>1
1670>>(16.l+16)	ubyte	x
1671>>>&0	search/255 	\0
1672# second member info
1673>>>>&0	use		cab-file
1674#>20	belong		!0		\b, reserved %x
1675# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3
1676>24	ubeshort	!0x0301		\b version %#x
1677# number of CFFOLDER entries
1678>26	uleshort	>1		\b, %u cffolders
1679# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields
1680# only found for flags 0 1 2 3 4 not 7
1681>30	uleshort	>0		\b, flags %#x
1682# Cabinet files have a 16-bit cabinet setID field that is designed for application use.
1683# default is zero, however, the -i option of cabarc can be used to set this field
1684>32	uleshort	>0		\b, ID %u
1685# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet
1686#>34	uleshort	x		\b, iCabinet %u
1687# add one for display because humans start numbering by 1 and also fit to name of disk szDisk*
1688>34	uleshort+1	x		\b, number %u
1689>30	uleshort	&0x0004		\b, extra bytes
1690# cbCFHeader optional size of per-cabinet reserved area 14h 1800h
1691>>36	uleshort	>0		%u in head
1692# cbCFFolder is optional size of per-folder reserved area
1693>>38	ubyte		>0		%u in folder
1694# cbCFData is optional size of per-datablock reserved area
1695>>39	ubyte		>0		%u in data block
1696# optional per-cabinet reserved area abReserve[cbCFHeader]
1697>>36	uleshort	>0
1698# 1st CFFOLDER after reserved area in header
1699>>>(36.s+40)	use			cab-folder
1700# no reserved area in header
1701>30	uleshort	^0x0004
1702# no previous and next cab archive
1703>>30	uleshort		=0x0000
1704>>>36	use				cab-folder
1705# only previous cab archive
1706>>30	uleshort		=0x0001	\b, previous
1707>>>36	use				cab-anchor
1708# only next cab archive
1709>>30	uleshort		=0x0002	\b, next
1710>>>36	use				cab-anchor
1711# previous+next cab archive
1712# can not use sub routine cab-anchor to display previous and next cabinet together
1713#>>>36	use				cab-anchor
1714#>>>>&0	use				cab-anchor
1715>>30	uleshort		=0x0003	\b, previous
1716>>>36	string		x		%s
1717# optional name of previous disk szDisk*
1718>>>>&1	string		x		disk %s
1719>>>>>&1	string		x		\b, next %s
1720# optional name of previous disk szDisk*
1721>>>>>>&1	string		x	disk %s
1722>>>>>>>&1	use			cab-folder
1723#	display filename and disk name of previous or next cabinet
17240       name    			cab-anchor
1725# optional name of previous/next cabinet file szCabinet*[255]
1726>&0	string		x		%s
1727# optional name of previous/next disk szDisk*[255]
1728>>&1	string		x		disk %s
1729#	display folder structure CFFOLDER information like compression of cabinet
17300       name    			cab-folder
1731# offset of the CFDATA block in this folder
1732#>0	ulelong		x		\b, coffCabStart %#x
1733# number of CFDATA blocks in folder
1734>4	uleshort	x		\b, %u datablock
1735# plural s
1736>4	uleshort	>1		\bs
1737# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15
1738>6	uleshort	x		\b, %#x compression
1739# optional per-folder reserved area
1740#>8	ubequad		x		\b, abReserve %#llx
1741#	display member structure CFFILE information like member name of cabinet
17420       name    			cab-file
1743# cbFile is uncompressed size of file in bytes
1744#>0	ulelong		x		\b, cbFile %u
1745# uoffFolderStart is uncompressed offset of file in folder
1746#>4	ulelong		>0		\b, uoffFolderStart %#x
1747# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet
1748# define ifoldCONTINUED_FROM_PREV      (0xFFFD)
1749# define ifoldCONTINUED_TO_NEXT        (0xFFFE)
1750# define ifoldCONTINUED_PREV_AND_NEXT  (0xFFFF)
1751>8	uleshort	>0		\b, iFolder %#x
1752# date stamp for file
1753#>10	uleshort	x		\b, date %#x
1754# time stamp for file
1755#>12	uleshort	x		\b, time %#x
1756# attribs is attribute flags for file
1757# define  _A_RDONLY       (0x01)  file is read-only
1758# define  _A_HIDDEN       (0x02)  file is hidden
1759# define  _A_SYSTEM       (0x04)  file is a system file
1760# define  _A_ARCH         (0x20)  file modified since last backup
1761# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab
1762# define  _A_EXEC         (0x40)  run after extraction
1763# define  _A_NAME_IS_UTF  (0x80)  szName[] contains UTF
1764# define  UNKNOWN       (0x0100)  undocumented or accident
1765#>14	uleshort	x		\b, attribs %#x
1766>14	uleshort	>0		+
1767>>14	uleshort	&0x0001		\bR
1768>>14	uleshort	&0x0002		\bH
1769>>14	uleshort	&0x0004		\bS
1770>>14	uleshort	&0x0020		\bA
1771>>14	uleshort	&0x0040		\bX
1772>>14	uleshort	&0x0080		\bUtf
1773# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB
1774>>14	uleshort	&0x0100		\b?
1775# szName is name of archive member
1776>16	string		x		"%s"
1777# next archive member name if more files
1778#>>&17	string		>\0		\b, NEXT NAME %-.50s
1779
1780# InstallShield Cabinet files
17810	string/b	ISc(		InstallShield Cabinet archive data
1782>5	byte&0xf0	=0x60		version 6,
1783>5	byte&0xf0	!0x60		version 4/5,
1784>(12.l+40)	lelong	x		%u files
1785
1786# Windows CE package files
17870	string/b	MSCE\0\0\0\0	Microsoft WinCE install header
1788>20	lelong		0		\b, architecture-independent
1789>20	lelong		103		\b, Hitachi SH3
1790>20	lelong		104		\b, Hitachi SH4
1791>20	lelong		0xA11		\b, StrongARM
1792>20	lelong		4000		\b, MIPS R4000
1793>20	lelong		10003		\b, Hitachi SH3
1794>20	lelong		10004		\b, Hitachi SH3E
1795>20	lelong		10005		\b, Hitachi SH4
1796>20	lelong		70001		\b, ARM 7TDMI
1797>52	leshort		1		\b, 1 file
1798>52	leshort		>1		\b, %u files
1799>56	leshort		1		\b, 1 registry entry
1800>56	leshort		>1		\b, %u registry entries
1801
1802
1803# Windows Enhanced Metafile (EMF)
1804# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
1805# for further information.
18060	ulelong 1
1807>40	string	\ EMF		Windows Enhanced Metafile (EMF) image data
1808>>44	ulelong x		version %#x
1809
1810
18110	string/b	\224\246\056		Microsoft Word Document
1812!:mime	application/msword
1813
1814# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
1815# Magic type for Dell's BIOS .hdr files
1816# Dell's .hdr
18170	string/b $RBU
1818>23	string Dell			%s system BIOS
1819>5	byte   2
1820>>48	byte   x			version %d.
1821>>49	byte   x			\b%d.
1822>>50	byte   x			\b%d
1823>5	byte   <2
1824>>48	string x			version %.3s
1825
1826# Type: Microsoft Document Imaging Format (.mdi)
1827# URL:	https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
1828# From: Daniele Sempione <scrows@oziosi.org>
1829# Too weak (EP)
1830#0	short	0x5045			Microsoft Document Imaging Format
1831
1832# MS eBook format (.lit)
18330	string/b	ITOLITLS		Microsoft Reader eBook Data
1834>8	lelong	x			\b, version %u
1835!:mime					application/x-ms-reader
1836
1837# Windows CE Binary Image Data Format
1838# From: Dr. Jesus <j@hug.gs>
18390	string/b	B000FF\n	Windows Embedded CE binary image
1840
1841# The second byte of these signatures is a file version; I don't know what,
1842# if anything, produced files with version numbers 0-2.
1843# From: John Elliott <johne@seasip.demon.co.uk>
18440	string	\xfc\x03\x00	Mallard BASIC program data (v1.11)
18450	string	\xfc\x04\x00	Mallard BASIC program data (v1.29+)
18460	string	\xfc\x03\x01	Mallard BASIC protected program data (v1.11)
18470	string	\xfc\x04\x01	Mallard BASIC protected program data (v1.29+)
1848
18490	string	MIOPEN		Mallard BASIC Jetsam data
18500	string	Jetsam0		Mallard BASIC Jetsam index data
1851
1852# DOS backup 2.0 to 3.2
1853# URL:		http://fileformats.archiveteam.org/wiki/BACKUP_(MS-DOS)
1854# Reference:	http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/dos/restore/brtecdoc.htm
1855# backupid.@@@
1856
1857# plausibility check for date
18580x3	ushort	>1979
1859>0x5	ubyte-1 <31
1860>>0x6	ubyte-1 <12
1861# actually 121 nul bytes
1862>>>0x7	string	\0\0\0\0\0\0\0\0
1863>>>>0x1 ubyte	x	DOS 2.0 backup id file, sequence %d
1864#!:mime	application/octet-stream
1865!:ext @@@
1866>>>>0x0 ubyte	0xff	\b, last disk
1867
1868# backed up file
1869
1870# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
1871# by looking for trailing nul of maximal file name string
18720x52	ubyte	0
1873# test for flag byte: FFh~complete file, 00h~split file
1874# FFh -127 =	-1 -127 =	-128
1875# 00h -127 =	 0 -127 =	-127
1876>0	byte-127	<-126
1877# plausibility check for file name length
1878>>0x53	ubyte-1	<78
1879# looking for terminating nul of file name string
1880>>>(0x53.b+4)	ubyte	0
1881# looking if last char of string is valid DOS file name
1882>>>>(0x53.b+3)	ubyte	>0x1F
1883# actually 44 nul bytes
1884# but sometimes garbage according to Ralf Quint. So can not be used as test
1885#>0x54	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
1886# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
1887# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
1888>>>>>5	ubyte&0x8C	0x0C
1889# ./msdos (version 5.30) labeled the entry as
1890# "DOS 2.0 backed up file %s, split file, sequence %d" or
1891# "DOS 2.0 backed up file %s, complete file"
1892>>>>>>0	ubyte	x	DOS 2.0-3.2 backed up
1893#>>>>>>0	ubyte	0xff	complete
1894>>>>>>0	ubyte	0
1895>>>>>>>1 uleshort	x	sequence %d of
1896# full file name with path but without drive letter and colon stored from 0x05 til 0x52
1897>>>>>>0x5	string	x	file %s
1898#!:mime	application/octet-stream
1899# backup name is original filename
1900#!:ext	doc/exe/rar/zip
1901#!:ext	*
1902# magic/Magdir/msdos, 1169: Warning: EXTENSION type `     *' has bad char '*'
1903# file: line 1169: Bad magic entry '  *'
1904# after header original file content
1905>>>>>>128	indirect x	\b;
1906
1907
1908# DOS backup 3.3 to 5.x
1909
1910# CONTROL.nnn files
19110	string	\x8bBACKUP\x20
1912# actually 128 nul bytes
1913>0xa	string	\0\0\0\0\0\0\0\0
1914>>0x9	ubyte	x	DOS 3.3 backup control file, sequence %d
1915>>0x8a	ubyte	0xff	\b, last disk
1916
1917# NB: The BACKUP.nnn files consist of the files backed up,
1918# concatenated.
1919
1920# From:		Joerg Jenderek
1921# URL:		http://fileformats.archiveteam.org/wiki/MS-DOS_date/time
1922# Reference:	https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-dosdatetimetofiletime
1923# Note:		DOS date+time format is different from formats such as Unix epoch
1924#		bit encoded; uses year values relative to 1980 and 2 second precision
19250	name		dos-date
1926# HHHHHMMMMMMSSSSS bit encoded Hour (0-23) Minute (0-59) SecondPart (*2)
1927#>0	uleshort	x	RAW TIME [%#4.4x]
1928# hour part
1929#>0	uleshort/2048	x	hour [%u]
1930# YYYYYMMMMDDDDD bit encoded YearPart (+1980) Month (1-12) Day (1-31)
1931#>2	uleshort	x	RAW DATE [%#4.4x]
1932# day part
1933>2	uleshort&0x001F	x	%u
1934#>2	uleshort/16	x	MONTH PART [%#x]
1935# GRR: not working
1936#>2	uleshort/16	&0x000F	MONTH [%u]
1937#>2	uleshort&0x01E0	x	MONTH PART [%#4.4x]
1938>2	uleshort&0x01E0	=0x0020	jan
1939>2	uleshort&0x01E0	=0x0040	feb
1940>2	uleshort&0x01E0	=0x0060	mar
1941>2	uleshort&0x01E0	=0x0080	apr
1942>2	uleshort&0x01E0	=0x00A0	may
1943>2	uleshort&0x01E0	=0x00C0	jun
1944>2	uleshort&0x01E0	=0x00E0	jul
1945>2	uleshort&0x01E0	=0x0100	aug
1946>2	uleshort&0x01E0	=0x0120	sep
1947>2	uleshort&0x01E0	=0x0140	oct
1948>2	uleshort&0x01E0	=0x0160	nov
1949>2	uleshort&0x01E0	=0x0180	dec
1950# year part
1951>2	uleshort/512	x	1980+%u
1952#
1953