xref: /freebsd/contrib/file/magic/Magdir/msdos (revision b0d29bc47dba79f6f38e67eabadfb4b32ffd9390)
1
2#------------------------------------------------------------------------------
3# $File: msdos,v 1.134 2019/10/18 15:16:18 christos Exp $
4# msdos:  file(1) magic for MS-DOS files
5#
6
7# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
8# updated by Joerg Jenderek at Oct 2008,Apr 2011
90	string/t	@
10>1	string/cW	\ echo\ off	DOS batch file text
11!:mime	text/x-msdos-batch
12!:ext	bat
13>1	string/cW	echo\ off	DOS batch file text
14!:mime	text/x-msdos-batch
15!:ext	bat
16>1	string/cW	rem		DOS batch file text
17!:mime	text/x-msdos-batch
18!:ext	bat
19>1	string/cW	set\ 		DOS batch file text
20!:mime	text/x-msdos-batch
21!:ext	bat
22
23
24# OS/2 batch files are REXX. the second regex is a bit generic, oh well
25# the matched commands seem to be common in REXX and uncommon elsewhere
26100	search/0xffff   rxfuncadd
27>100	regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc	OS/2 REXX batch file text
28100	search/0xffff   say
29>100	regex/c =^[\ \t]{0,10}say\ ['"]			OS/2 REXX batch file text
30
31# updated by Joerg Jenderek at Oct 2015
32# https://de.wikipedia.org/wiki/Common_Object_File_Format
33# http://www.delorie.com/djgpp/doc/coff/filhdr.html
34# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable"
35#0	leshort		0x14c	MS Windows COFF Intel 80386 object file
36#>4	ledate		x	stamp %s
370	leshort		0x166	MS Windows COFF MIPS R4000 object file
38#>4	ledate		x	stamp %s
390	leshort		0x184	MS Windows COFF Alpha object file
40#>4	ledate		x	stamp %s
410	leshort		0x268	MS Windows COFF Motorola 68000 object file
42#>4	ledate		x	stamp %s
430	leshort		0x1f0	MS Windows COFF PowerPC object file
44#>4	ledate		x	stamp %s
450	leshort		0x290	MS Windows COFF PA-RISC object file
46#>4	ledate		x	stamp %s
47
48# Tests for various EXE types.
49#
50# Many of the compressed formats were extraced from IDARC 1.23 source code.
51#
520	string/b	MZ
53# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
54>0x18	leshort <0x40 MS-DOS executable
55!:mime	application/x-dosexec
56# Windows and later versions of DOS will allow .EXEs to be named with a .COM
57# extension, mostly for compatibility's sake.
58!:ext	exe/com
59# These traditional tests usually work but not always.  When test quality support is
60# implemented these can be turned on.
61#>>0x18	leshort	0x1c	(Borland compiler)
62#>>0x18	leshort	0x1e	(MS compiler)
63
64# Maybe it's a PE?
65>(0x3c.l)	string		PE\0\0	PE
66!:mime	application/x-dosexec
67>>(0x3c.l+24)	leshort		0x010b	\b32 executable
68>>(0x3c.l+24)	leshort		0x020b	\b32+ executable
69>>(0x3c.l+24)	leshort		0x0107	ROM image
70>>(0x3c.l+24)	default		x	Unknown PE signature
71>>>&0 		leshort		x	0x%x
72>>(0x3c.l+22)	leshort&0x2000	>0	(DLL)
73>>(0x3c.l+92)	leshort		1
74# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the
75# drivers in Windows/System32/drivers/*.sys.
76>>>(0x3c.l+22)	leshort&0x2000	>0	(native)
77!:ext	dll/sys
78>>>(0x3c.l+22)	leshort&0x2000	0	(native)
79!:ext	exe/sys
80>>(0x3c.l+92)	leshort		2
81>>>(0x3c.l+22)	leshort&0x2000	>0	(GUI)
82# These could probably be at least partially distinguished from one another by
83# looking for specific exported functions.
84# CPL: Control Panel item
85# TLB: Type library
86# OCX: OLE/ActiveX control
87# ACM: Audio compression manager codec
88# AX: DirectShow source filter
89# IME: Input method editor
90!:ext	dll/cpl/tlb/ocx/acm/ax/ime
91>>>(0x3c.l+22)	leshort&0x2000	0	(GUI)
92# Screen savers typically include code from the scrnsave.lib static library, but
93# that's not guaranteed.
94!:ext	exe/scr
95>>(0x3c.l+92)	leshort		3
96>>>(0x3c.l+22)	leshort&0x2000	>0	(console)
97!:ext	dll/cpl/tlb/ocx/acm/ax/ime
98>>>(0x3c.l+22)	leshort&0x2000	0	(console)
99!:ext	exe/com
100# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
101>>(0x3c.l+92)	leshort		7	(POSIX)
102>>(0x3c.l+92)	leshort		9	(Windows CE)
103>>(0x3c.l+92)	leshort		10	(EFI application)
104>>(0x3c.l+92)	leshort		11	(EFI boot service driver)
105>>(0x3c.l+92)	leshort		12	(EFI runtime driver)
106>>(0x3c.l+92)	leshort		13	(EFI ROM)
107>>(0x3c.l+92)	leshort		14	(XBOX)
108>>(0x3c.l+92)	leshort		15	(Windows boot application)
109>>(0x3c.l+92)	default		x	(Unknown subsystem
110>>>&0		leshort		x	0x%x)
111>>(0x3c.l+4)	leshort		0x14c	Intel 80386
112>>(0x3c.l+4)	leshort		0x166	MIPS R4000
113>>(0x3c.l+4)	leshort		0x168	MIPS R10000
114>>(0x3c.l+4)	leshort		0x184	Alpha
115>>(0x3c.l+4)	leshort		0x1a2	Hitachi SH3
116>>(0x3c.l+4)	leshort		0x1a3	Hitachi SH3 DSP
117>>(0x3c.l+4)	leshort		0x1a8	Hitachi SH5
118>>(0x3c.l+4)	leshort		0x169	MIPS WCE v2
119>>(0x3c.l+4)	leshort		0x1a6	Hitachi SH4
120>>(0x3c.l+4)	leshort		0x1c0	ARM
121>>(0x3c.l+4)	leshort		0x1c2	ARM Thumb
122>>(0x3c.l+4)	leshort		0x1c4	ARMv7 Thumb
123>>(0x3c.l+4)	leshort		0x1d3	Matsushita AM33
124>>(0x3c.l+4)	leshort		0x1f0	PowerPC
125>>(0x3c.l+4)	leshort		0x1f1	PowerPC with FPU
126>>(0x3c.l+4)	leshort		0x200	Intel Itanium
127>>(0x3c.l+4)	leshort		0x266	MIPS16
128>>(0x3c.l+4)	leshort		0x268	Motorola 68000
129>>(0x3c.l+4)	leshort		0x290	PA-RISC
130>>(0x3c.l+4)	leshort		0x366	MIPSIV
131>>(0x3c.l+4)	leshort		0x466	MIPS16 with FPU
132>>(0x3c.l+4)	leshort		0xebc	EFI byte code
133>>(0x3c.l+4)	leshort		0x5032	RISC-V 32-bit
134>>(0x3c.l+4)	leshort		0x5064	RISC-V 64-bit
135>>(0x3c.l+4)	leshort		0x5128	RISC-V 128-bit
136>>(0x3c.l+4)	leshort		0x9041	Mitsubishi M32R
137>>(0x3c.l+4)	leshort		0x8664	x86-64
138>>(0x3c.l+4)	leshort		0xaa64	Aarch64
139>>(0x3c.l+4)	leshort		0xc0ee	MSIL
140>>(0x3c.l+4)	default		x	Unknown processor type
141>>>&0		leshort		x	0x%x
142>>(0x3c.l+22)	leshort&0x0200	>0	(stripped to external PDB)
143>>(0x3c.l+22)	leshort&0x1000	>0	system file
144>>(0x3c.l+24)	leshort		0x010b
145>>>(0x3c.l+232) lelong	>0	Mono/.Net assembly
146>>(0x3c.l+24)	leshort		0x020b
147>>>(0x3c.l+248) lelong	>0	Mono/.Net assembly
148
149# hooray, there's a DOS extender using the PE format, with a valid PE
150# executable inside (which just prints a message and exits if run in win)
151>>(8.s*16)		string		32STUB	\b, 32rtm DOS extender
152>>(8.s*16)		string		!32STUB	\b, for MS Windows
153>>(0x3c.l+0xf8)		string		UPX0 \b, UPX compressed
154>>(0x3c.l+0xf8)		search/0x140	PEC2 \b, PECompact2 compressed
155>>(0x3c.l+0xf8)		search/0x140	UPX2
156>>>(&0x10.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
157>>(0x3c.l+0xf8)		search/0x140	.idata
158>>>(&0xe.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
159>>>(&0xe.l+(-4))	string		ZZ0 \b, ZZip self-extracting archive
160>>>(&0xe.l+(-4))	string		ZZ1 \b, ZZip self-extracting archive
161>>(0x3c.l+0xf8)		search/0x140	.rsrc
162>>>(&0x0f.l+(-4))	string		a\\\4\5 \b, WinHKI self-extracting archive
163>>>(&0x0f.l+(-4))	string		Rar! \b, RAR self-extracting archive
164>>>(&0x0f.l+(-4))	search/0x3000	MSCF \b, InstallShield self-extracting archive
165>>>(&0x0f.l+(-4))	search/32	Nullsoft \b, Nullsoft Installer self-extracting archive
166>>(0x3c.l+0xf8)		search/0x140	.data
167>>>(&0x0f.l)		string		WEXTRACT \b, MS CAB-Installer self-extracting archive
168>>(0x3c.l+0xf8)		search/0x140	.petite\0 \b, Petite compressed
169>>>(0x3c.l+0xf7)	byte		x
170>>>>(&0x104.l+(-4))	string		=!sfx! \b, ACE self-extracting archive
171>>(0x3c.l+0xf8)		search/0x140	.WISE \b, WISE installer self-extracting archive
172>>(0x3c.l+0xf8)		search/0x140	.dz\0\0\0 \b, Dzip self-extracting archive
173>>&(0x3c.l+0xf8)	search/0x100	_winzip_ \b, ZIP self-extracting archive (WinZip)
174>>&(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
175>>0x30			string		Inno \b, InnoSetup self-extracting archive
176
177# If the relocation table is 0x40 or more bytes into the file, it's definitely
178# not a DOS EXE.
179>0x18  leshort >0x3f
180
181# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
182# must be one of the unusual subformats.
183>>(0x3c.l) string !PE\0\0 MS-DOS executable
184!:mime	application/x-dosexec
185
186>>(0x3c.l)		string		NE \b, NE
187!:mime	application/x-dosexec
188>>>(0x3c.l+0x36)	byte		1 for OS/2 1.x
189>>>(0x3c.l+0x36)	byte		2 for MS Windows 3.x
190>>>(0x3c.l+0x36)	byte		3 for MS-DOS
191>>>(0x3c.l+0x36)	byte		4 for Windows 386
192>>>(0x3c.l+0x36)	byte		5 for Borland Operating System Services
193>>>(0x3c.l+0x36)	default		x
194>>>>(0x3c.l+0x36)	byte		x (unknown OS %x)
195>>>(0x3c.l+0x36)	byte		0x81 for MS-DOS, Phar Lap DOS extender
196>>>(0x3c.l+0x0c)	leshort&0x8000	0x8000 (DLL or font)
197# DRV: Driver
198# 3GR: Grabber device driver
199# CPL: Control Panel Item
200# VBX: Visual Basic Extension
201# FON: Bitmap font
202# FOT: Font resource file
203!:ext	dll/drv/3gr/cpl/vbx/fon/fot
204>>>(0x3c.l+0x0c)	leshort&0x8000	0 (EXE)
205!:ext	exe/scr
206>>>&(&0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
207>>>(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
208
209>>(0x3c.l)		string		LX\0\0 \b, LX
210!:mime	application/x-dosexec
211>>>(0x3c.l+0x0a)	leshort		<1 (unknown OS)
212>>>(0x3c.l+0x0a)	leshort		1 for OS/2
213>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
214>>>(0x3c.l+0x0a)	leshort		3 for DOS
215>>>(0x3c.l+0x0a)	leshort		>3 (unknown OS)
216>>>(0x3c.l+0x10)	lelong&0x28000	=0x8000 (DLL)
217>>>(0x3c.l+0x10)	lelong&0x20000	>0 (device driver)
218>>>(0x3c.l+0x10)	lelong&0x300	0x300 (GUI)
219>>>(0x3c.l+0x10)	lelong&0x28300	<0x300 (console)
220>>>(0x3c.l+0x08)	leshort		1 i80286
221>>>(0x3c.l+0x08)	leshort		2 i80386
222>>>(0x3c.l+0x08)	leshort		3 i80486
223>>>(8.s*16)		string		emx \b, emx
224>>>>&1			string		x %s
225>>>&(&0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive
226
227# MS Windows system file, supposedly a collection of LE executables
228>>(0x3c.l)		string		W3 \b, W3 for MS Windows
229!:mime	application/x-dosexec
230
231>>(0x3c.l)		string		LE\0\0 \b, LE executable
232!:mime	application/x-dosexec
233>>>(0x3c.l+0x0a)	leshort		1
234# some DOS extenders use LE files with OS/2 header
235>>>>0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
236>>>>0x240		search/0x200	WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
237>>>>0x440		search/0x100	CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
238>>>>0x40		search/0x40	PMODE/W for MS-DOS, PMODE/W DOS extender
239>>>>0x40		search/0x40	STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
240>>>>0x40		search/0x80	STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
241>>>>0x40		search/0x80	DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
242# this is a wild guess; hopefully it is a specific signature
243>>>>&0x24		lelong		<0x50
244>>>>>(&0x4c.l)		string		\xfc\xb8WATCOM
245>>>>>>&0		search/8	3\xdbf\xb9 \b, 32Lite compressed
246# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
247#>>>>(0x3c.l+0x1c)	lelong		>0x10000 for OS/2
248# fails with DOS-Extenders.
249>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
250>>>(0x3c.l+0x0a)	leshort		3 for DOS
251>>>(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
252# VXD: VxD for Windows 95/98/Me
253# 386: VxD for Windows 2.10, 3.0, 3.1x
254# PDR: Port driver
255# MPD: Miniport driver (?)
256!:ext	vxd/386/pdr/mpd
257>>>(&0x7c.l+0x26)	string		UPX \b, UPX compressed
258>>>&(&0x54.l-3)		string		UNACE \b, ACE self-extracting archive
259
260# looks like ASCII, probably some embedded copyright message.
261# and definitely not NE/LE/LX/PE
262>>0x3c		lelong	>0x20000000
263>>>(4.s*512)	leshort !0x014c \b, MZ for MS-DOS
264!:mime	application/x-dosexec
265!:ext	exe/com
266# header data too small for extended executable
267>2		long	!0
268>>0x18		leshort <0x40
269>>>(4.s*512)	leshort !0x014c
270
271>>>>&(2.s-514)	string	!LE
272>>>>>&-2	string	!BW \b, MZ for MS-DOS
273!:mime	application/x-dosexec
274>>>>&(2.s-514)	string	LE \b, LE
275>>>>>0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
276# educated guess since indirection is still not capable enough for complex offset
277# calculations (next embedded executable would be at &(&2*512+&0-2)
278# I suspect there are only LE executables in these multi-exe files
279>>>>&(2.s-514)	string	BW
280>>>>>0x240	search/0x100	DOS/4G	\b, LE for MS-DOS, DOS4GW DOS extender (embedded)
281>>>>>0x240	search/0x100	!DOS/4G	\b, BW collection for MS-DOS
282
283# This sequence skips to the first COFF segment, usually .text
284>(4.s*512)	leshort		0x014c \b, COFF
285!:mime	application/x-dosexec
286>>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
287>>(8.s*16)	string		emx
288>>>&1		string		x for DOS, Win or OS/2, emx %s
289>>&(&0x42.l-3)	byte		x
290>>>&0x26	string		UPX \b, UPX compressed
291# and yet another guess: small .text, and after large .data is unusal, could be 32lite
292>>&0x2c		search/0xa0	.text
293>>>&0x0b	lelong		<0x2000
294>>>>&0		lelong		>0x6000 \b, 32lite compressed
295
296>(8.s*16) string $WdX \b, WDos/X DOS extender
297
298# By now an executable type should have been printed out.  The executable
299# may be a self-uncompressing archive, so look for evidence of that and
300# print it out.
301#
302# Some signatures below from Greg Roelofs, newt@uchicago.edu.
303#
304>0x35	string	\x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
305>0xe7	string	LH/2\ 	Self-Extract \b, %s
306>0x1c	string	UC2X	\b, UCEXE compressed
307>0x1c	string	WWP\ 	\b, WWPACK compressed
308>0x1c	string	RJSX 	\b, ARJ self-extracting archive
309>0x1c	string	diet 	\b, diet compressed
310>0x1c	string	LZ09 	\b, LZEXE v0.90 compressed
311>0x1c	string	LZ91 	\b, LZEXE v0.91 compressed
312>0x1c	string	tz 	\b, TinyProg compressed
313>0x1e	string	Copyright\ 1989-1990\ PKWARE\ Inc.	Self-extracting PKZIP archive
314!:mime	application/zip
315# Yes, this really is "Copr", not "Corp."
316>0x1e	string	PKLITE\ Copr.	Self-extracting PKZIP archive
317!:mime	application/zip
318# winarj stores a message in the stub instead of the sig in the MZ header
319>0x20	search/0xe0	aRJsfX \b, ARJ self-extracting archive
320>0x20	string AIN
321>>0x23	string 2	\b, AIN 2.x compressed
322>>0x23	string <2	\b, AIN 1.x compressed
323>>0x23	string >2	\b, AIN 1.x compressed
324>0x24	string	LHa's\ SFX \b, LHa self-extracting archive
325!:mime	application/x-lha
326>0x24	string	LHA's\ SFX \b, LHa self-extracting archive
327!:mime	application/x-lha
328>0x24	string	\ $ARX \b, ARX self-extracting archive
329>0x24	string	\ $LHarc \b, LHarc self-extracting archive
330>0x20	string	SFX\ by\ LARC \b, LARC self-extracting archive
331>0x40	string aPKG \b, aPackage self-extracting archive
332>0x64	string	W\ Collis\0\0 \b, Compack compressed
333>0x7a	string		Windows\ self-extracting\ ZIP	\b, ZIP self-extracting archive
334>>&0xf4 search/0x140 \x0\x40\x1\x0
335>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
336>1638	string	-lh5- \b, LHa self-extracting archive v2.13S
337>0x17888 string Rar! \b, RAR self-extracting archive
338
339# Skip to the end of the EXE.  This will usually work fine in the PE case
340# because the MZ image is hardcoded into the toolchain and almost certainly
341# won't match any of these signatures.
342>(4.s*512)	long	x
343>>&(2.s-517)	byte	x
344>>>&0	string		PK\3\4 \b, ZIP self-extracting archive
345>>>&0	string		Rar! \b, RAR self-extracting archive
346>>>&0	string		=!\x11 \b, AIN 2.x self-extracting archive
347>>>&0	string		=!\x12 \b, AIN 2.x self-extracting archive
348>>>&0	string		=!\x17 \b, AIN 1.x self-extracting archive
349>>>&0	string		=!\x18 \b, AIN 1.x self-extracting archive
350>>>&7	search/400	**ACE** \b, ACE self-extracting archive
351>>>&0	search/0x480	UC2SFX\ Header \b, UC2 self-extracting archive
352
353# a few unknown ZIP sfxes, no idea if they are needed or if they are
354# already captured by the generic patterns above
355>(8.s*16)	search/0x20	PKSFX \b, ZIP self-extracting archive (PKZIP)
356# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
357#
358
359# TELVOX Teleinformatica CODEC self-extractor for OS/2:
360>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
361>>49824 leshort		=1			\b, 1 file
362>>49824 leshort		>1			\b, %u files
363
364# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc
365# and https://www.freedos.org/software/?prog=kpdos
366# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
3670	string/b	KCF		FreeDOS KEYBoard Layout collection
368# only version=0x100 found
369>3	uleshort	x		\b, version 0x%x
370# length of string containing author,info and special characters
371>6	ubyte		>0
372#>>6	pstring		x		\b, name=%s
373>>7	string		>\0		\b, author=%-.14s
374>>7	search/254	\xff		\b, info=
375#>>>&0	string		x		\b%-s
376>>>&0	string		x		\b%-.15s
377# for FreeDOS *.KL files
3780	string/b	KLF		FreeDOS KEYBoard Layout file
379# only version=0x100 or 0x101 found
380>3	uleshort	x		\b, version 0x%x
381# stringlength
382>5	ubyte		>0
383>>8	string		x		\b, name=%-.2s
3840	string	\xffKEYB\ \ \ \0\0\0\0
385>12	string	\0\0\0\0`\004\360	MS-DOS KEYBoard Layout file
386
387# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017
388# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
3890	ulequad&0x07a0ffffffff		0xffffffff
390>0	use				msdos-driver
3910       name    			msdos-driver		DOS executable (
392#!:mime	application/octet-stream
393!:mime	application/x-dosdriver
394# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
395!:ext	sys/dev/bin
396>40	search/7			UPX!			\bUPX compressed
397# DOS device driver attributes
398>4	uleshort&0x8000			0x0000			\bblock device driver
399# character device
400>4	uleshort&0x8000			0x8000			\b
401>>4	uleshort&0x0008			0x0008			\bclock
402# fast video output by int 29h
403>>4	uleshort&0x0010			0x0010			\bfast
404# standard input/output device
405>>4	uleshort&0x0003			>0			\bstandard
406>>>4	uleshort&0x0001			0x0001			\binput
407>>>4	uleshort&0x0003			0x0003			\b/
408>>>4	uleshort&0x0002			0x0002			\boutput
409>>4	uleshort&0x8000			0x8000			\bcharacter device driver
410>0	ubyte				x
411# upx compressed device driver has garbage instead of real in name field of header
412>>40	search/7			UPX!
413>>40	default				x
414# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
415>>>12		ubyte			>0x2E			\b
416>>>>10		ubyte			>0x20
417>>>>>10		ubyte			!0x2E
418>>>>>>10	ubyte			!0x2A			\b%c
419>>>>11		ubyte			>0x20
420>>>>>11		ubyte			!0x2E			\b%c
421>>>>12		ubyte			>0x20
422>>>>>12		ubyte			!0x39
423>>>>>>12	ubyte			!0x2E			\b%c
424>>>13		ubyte			>0x20
425>>>>13		ubyte			!0x2E			\b%c
426>>>>14		ubyte			>0x20
427>>>>>14		ubyte			!0x2E			\b%c
428>>>>15		ubyte			>0x20
429>>>>>15		ubyte			!0x2E			\b%c
430>>>>16		ubyte			>0x20
431>>>>>16		ubyte			!0x2E
432>>>>>>16	ubyte			<0xCB			\b%c
433>>>>17		ubyte			>0x20
434>>>>>17		ubyte			!0x2E
435>>>>>>17	ubyte			<0x90			\b%c
436# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
437>>>12		ubyte			<0x2F
438# they have their real name at offset 22
439# also block device drivers like DUMBDRV.SYS
440>>>>22		string			>\056			%-.6s
441>4	uleshort&0x8000			0x0000
442# 32 bit sector addressing ( > 32 MB) for block devices
443>>4	uleshort&0x0002			0x0002			\b,32-bit sector-
444# support by driver functions 13h, 17h, 18h
445>4	uleshort&0x0040			0x0040			\b,IOCTL-
446# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
447>4	uleshort&0x0800			0x0800			\b,close media-
448# output until busy support by int 10h for character device driver
449>4	uleshort&0x8000			0x8000
450>>4	uleshort&0x2000			0x2000			\b,until busy-
451# direct read/write support by driver functions 03h,0Ch
452>4	uleshort&0x4000			0x4000			\b,control strings-
453>4	uleshort&0x8000			0x8000
454>>4	uleshort&0x6840			>0			\bsupport
455>4	uleshort&0x8000			0x0000
456>>4	uleshort&0x4842			>0			\bsupport
457>0	ubyte				x			\b)
458# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
4590	ulequad				0x0513c00000000012
460>0	use				msdos-driver
461# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
4620	ulequad				0x32f28000ffff0016
463>0	use				msdos-driver
4640	ulequad				0x007f00000000ffff
465>0	use				msdos-driver
4660	ulequad				0x001600000000ffff
467>0	use				msdos-driver
468# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
4690	ulequad				0x0bf708c2ffffffff
470>0	use				msdos-driver
4710	ulequad				0x07bd08c2ffffffff
472>0	use				msdos-driver
473
474# updated by Joerg Jenderek
475# GRR: line below too general as it catches also
476# rt.lib DYADISKS.PIC and many more
477# start with assembler instruction MOV
4780	ubyte		0x8c
479# skip "AppleWorks word processor data" like ARTICLE.1 ./apple
480>4	string			!O====
481# skip some unknown basic binaries like RocketRnger.SHR
482>>5	string			!MAIN
483# skip "GPG symmetrically encrypted data" ./gnu
484# skip "PGP symmetric key encrypted data" ./pgp
485# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type
486>>>4	ubyte			>13	DOS executable (COM, 0x8C-variant)
487# the remaining files should be DOS *.COM executables
488# dosshell.COM	8cc0 2ea35f07 e85211 e88a11 b80058 cd
489# hmload.COM	8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4
490# UNDELETE.COM	8cca 2e8916 6503 b430 cd21 8b 2e0200 8b
491# BOOTFIX.COM	8cca 2e8916 9603 b430 cd21 8b 2e0200 8b
492# RAWRITE3.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
493# SHARE.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
494# validchr.COM	8cca 2e8916 9603 b430 cd21 8b 2e028b1e
495# devload.COM	8cca 8916ad01 b430 cd21 8b2e0200 892e
496!:mime	application/x-dosexec
497!:ext com
498
499# updated by Joerg Jenderek at Oct 2008
5000	ulelong		0xffff10eb	DR-DOS executable (COM)
501# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
5020	ubeshort&0xeb8d	>0xeb00
503# DR-DOS STACKER.COM SCREATE.SYS missed
504
5050       name    msdos-com
506>0  byte        x               DOS executable (COM)
507!:mime	application/x-dosexec
508!:ext	com
509>6	string		SFX\ of\ LHarc	\b, %s
510>0x1FE leshort	0xAA55		    \b, boot code
511>85	string		UPX		        \b, UPX compressed
512>4	string		\ $ARX		    \b, ARX self-extracting archive
513>4	string		\ $LHarc	    \b, LHarc self-extracting archive
514>0x20e string	SFX\ by\ LARC	\b, LARC self-extracting archive
515
516# JMP 8bit
5170	        byte	0xeb
518# allow forward jumps only
519>1          byte    >-1
520# that offset must be accessible
521>>(1.b+2)   byte    x
522>>>0        use msdos-com
523
524# JMP 16bit
5250           byte    0xe9
526# forward jumps
527>1          short   >-1
528# that offset must be accessible
529>>(1.s+3)   byte    x
530>>>0        use msdos-com
531# negative offset, must not lead into PSP
532>1          short   <-259
533# that offset must be accessible
534>>(1,s+65539)   byte    x
535>>>0        use msdos-com
536
537# updated by Joerg Jenderek at Oct 2008,2015
538# following line is too general
5390	ubyte		0xb8
540# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux
541>0	string		!\xb8\xc0\x07\x8e
542# modified by Joerg Jenderek
543# syslinux COM32 or COM32R executable
544>>1	lelong&0xFFFFFFFe 0x21CD4CFe	COM executable (32-bit COMBOOT
545# https://www.syslinux.org/wiki/index.php/Comboot_API
546# Since version 5.00 c32 modules switched from the COM32 object format to ELF
547!:mime	application/x-c32-comboot-syslinux-exec
548!:ext c32
549# https://syslinux.zytor.com/comboot.php
550# older syslinux version ( <4 )
551# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
552# start with assembler instructions mov eax,21cd4cffh
553>>>1	lelong		0x21CD4CFf	\b)
554# syslinux:doc/comboot.txt
555# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
556# eax,21cd4cfeh) as a magic number.
557# syslinux version (4.x)
558# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID
559>>>1	lelong		0x21CD4CFe	\b, relocatable)
560# remaining are DOS COM executables starting with assembler instruction MOV
561# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM
562# MS-DOS SYS.COM RESTART.COM
563# SYSLINUX.COM (version 1.40 - 2.13)
564# GFXBOOT.COM (version 3.75)
565# COPYBS.COM POWEROFF.COM INT18.COM
566>>1	default	x			COM executable for DOS
567!:mime	application/x-dosexec
568#!:mime	application/x-ms-dos-executable
569#!:mime	application/x-msdos-program
570!:ext com
571
5720	string/b	\x81\xfc
573>4	string	\x77\x02\xcd\x20\xb9
574>>36	string	UPX!			FREE-DOS executable (COM), UPX compressed
575!:mime	application/x-dosexec
576!:ext	com
577252	string Must\ have\ DOS\ version DR-DOS executable (COM)
578!:mime	application/x-dosexec
579!:ext	com
580# added by Joerg Jenderek at Oct 2008
581# GRR search is not working
582#34	search/2	UPX!		FREE-DOS executable (COM), UPX compressed
58334	string	UPX!			FREE-DOS executable (COM), UPX compressed
584!:mime	application/x-dosexec
585!:ext	com
58635	string	UPX!			FREE-DOS executable (COM), UPX compressed
587!:mime	application/x-dosexec
588!:ext	com
589# GRR search is not working
590#2	search/28	\xcd\x21	COM executable for MS-DOS
591#WHICHFAT.cOM
5922	string	\xcd\x21		COM executable for DOS
593!:mime	application/x-dosexec
594!:ext	com
595#DELTREE.cOM DELTREE2.cOM
5964	string	\xcd\x21		COM executable for DOS
597!:mime	application/x-dosexec
598!:ext	com
599#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
6005	string	\xcd\x21		COM executable for DOS
601!:mime	application/x-dosexec
602!:ext	com
603#DELTMP.COm HASFAT32.cOM
6047	string	\xcd\x21
605>0	byte	!0xb8			COM executable for DOS
606!:mime	application/x-dosexec
607!:ext	com
608#COMP.cOM MORE.COm
60910	string	\xcd\x21
610>5	string	!\xcd\x21		COM executable for DOS
611!:mime	application/x-dosexec
612!:ext	com
613#comecho.com
61413	string	\xcd\x21		COM executable for DOS
615!:mime	application/x-dosexec
616!:ext	com
617#HELP.COm EDIT.coM
61818	string	\xcd\x21		COM executable for MS-DOS
619!:mime	application/x-dosexec
620!:ext	com
621#NWRPLTRM.COm
62223	string	\xcd\x21		COM executable for MS-DOS
623!:mime	application/x-dosexec
624!:ext	com
625#LOADFIX.cOm LOADFIX.cOm
62630	string	\xcd\x21		COM executable for MS-DOS
627!:mime	application/x-dosexec
628!:ext	com
629#syslinux.com 3.11
63070	string	\xcd\x21		COM executable for DOS
631!:mime	application/x-dosexec
632!:ext	com
633# many compressed/converted COMs start with a copy loop instead of a jump
6340x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
635!:mime	application/x-dosexec
636!:ext	com
6370x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
638!:mime	application/x-dosexec
639!:ext	com
640>0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
6410x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
642!:mime	application/x-dosexec
643!:ext	com
644# FIXME: missing diet .com compression
645
646# miscellaneous formats
6470	string/b	LZ		MS-DOS executable (built-in)
648#0	byte		0xf0		MS-DOS program library data
649#
650
651# AAF files:
652# <stuartc@rd.bbc.co.uk> Stuart Cunningham
6530	string/b	\320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377			AAF legacy file using MS Structured Storage
654>30	byte	9		(512B sectors)
655>30	byte	12		(4kB sectors)
6560	string/b	\320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001			AAF file using MS Structured Storage
657>30	byte	9		(512B sectors)
658>30	byte	12		(4kB sectors)
659
660# Popular applications
661#
662# Update:	Joerg Jenderek
663# URL:		http://fileformats.archiveteam.org/wiki/DOC
664# Reference:	https://web.archive.org/web/20170206041048/
665#		http://www.msxnet.org/word2rtf/formats/ffh-dosword5
666# wIdent+dty
6670	belong	0x31be0000
668# skip droid skeleton like x-fmt-274-signature-id-488.doc
669>128	ubyte		>0  			Microsoft
670>>96	uleshort	=0			Word
671!:mime	application/msword
672!:apple	MSWDWDBN
673# DCX is used in the Unix version.
674!:ext	doc/dcx
675>>>0x6E	ulequad		=0			1.0-4.0
676>>>0x6E	ulequad		!0			5.0-6.0
677>>>0x6E	ulequad		x			(DOS) Document
678# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt
679>>96	uleshort	!0			Write 3.0 (Windows) Document
680!:mime	application/x-mswrite
681!:apple	MSWDWDBN
682# sometimes also doc like in splitter.doc srchtest.doc
683!:ext	wri/doc
684# wTool must be 0125400 octal
685#>>4	uleshort	!0xAB00			\b, wTool %o
686# reserved; must be zero
687#>>6	ulelong		!0			\b, reserved %u
688# block pointer to the block containing optional file manager information
689#>>0x1C	uleshort	x			\b, at 0x%x info block
690# jump to File manager information block
691>>(0x1C.s*128)	uleshort x
692# test for valid information start; maybe also 0012h
693>>>&-2		uleshort	=0x0014
694# Document ASCIIZ name
695>>>>&0x12	string		x		%s
696# author name
697>>>>>&1		string		x		\b, author %s
698# reviser name
699>>>>>>&1	string		x		\b, reviser %s
700# keywords
701>>>>>>>&1	string		x		\b, keywords %s
702# comment
703>>>>>>>>&1	string		x		\b, comment %s
704# version number
705>>>>>>>>>&1	string		x		\b, version %s
706# date of last change MM/DD/YY
707>>>>>>>>>>&1	string		x		\b, %-.8s
708# creation date MM/DD/YY
709>>>>>>>>>>&9	string		x		created %-.8s
710# file name of print format like NORMAL.STY
711>>0x1E	string		>0			\b, formatted by %-.66s
712# count of pages in whole file for write variant; maybe some times wrong
713>>96	uleshort	>0			\b, %u pages
714# name of the printer driver like HPLASMS
715>>0x62	string		>0			\b, %-.8s printer
716# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0
717>>0x6A	uleshort	>0			\b, %u blocks
718# bit field for corrected text areas
719#>>0x6C	uleshort	x			\b, 0x%x bit field
720# text of document; some times start with 4 non printable characters like CR LF
721>>128	ubyte		x			\b,
722>>>128		ubyte	>0x1F
723>>>>128		string	x			%s
724>>>128		ubyte	<0x20
725>>>>129		ubyte	>0x1F
726>>>>>129	string	x			%s
727>>>>129		ubyte	<0x20
728>>>>>130	ubyte	>0x1F
729>>>>>>130	string	x			%s
730>>>>>130	ubyte	<0x20
731>>>>>>131	ubyte	>0x1F
732>>>>>>>131	string	x			%s
733>>>>>>131	ubyte	<0x20
734>>>>>>>132	ubyte	>0x1F
735>>>>>>>>132	string	x			%s
736>>>>>>>132	ubyte	<0x20
737>>>>>>>>133	ubyte	>0x1F
738>>>>>>>>>133	string	x			%s
739#
7400	string/b	PO^Q`				Microsoft Word 6.0 Document
741!:mime	application/msword
742#
7434   long        0
744>0  belong      0xfe320000      Microsoft Word for Macintosh 1.0
745!:mime	application/msword
746!:ext   mcw
747>0  belong      0xfe340000      Microsoft Word for Macintosh 3.0
748!:mime	application/msword
749!:ext   mcw
750>0  belong      0xfe37001c      Microsoft Word for Macintosh 4.0
751!:mime	application/msword
752!:ext   mcw
753>0  belong      0xfe370023      Microsoft Word for Macintosh 5.0
754!:mime	application/msword
755!:ext   mcw
756
7570	string/b	\333\245-\0\0\0			Microsoft Word 2.0 Document
758!:mime	application/msword
759!:ext   doc
760# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs
761#512	string/b	\354\245\301			Microsoft Word Document
762#!:mime	application/msword
763
764#
7650	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
766!:mime application/msword
767#
7680	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
769!:mime application/msword
770
771#
7720	string/b	\x09\x04\x06\x00\x00\x00\x10\x00	Microsoft Excel Worksheet
773!:mime	application/vnd.ms-excel
774# https://www.macdisk.com/macsigen.php
775!:apple	XCELXLS4
776!:ext	xls
777#
778# Update: Joerg Jenderek
779# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3
780# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
781# Note: newer Lotus versions >2 use longer BOF record
782# record type (BeginningOfFile=0000h) + length (001Ah)
7830	belong	0x00001a00
784# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3
785#>18	uleshort&0x73E0	0
786# Lotus Multi Byte Character Set (LMBCS=1-31)
787>20	ubyte		>0
788>>20	ubyte		<32	Lotus 1-2-3
789#!:mime	application/x-123
790!:mime	application/vnd.lotus-1-2-3
791!:apple	????L123
792# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data"
793>>>4	uleshort	0x1000	WorKsheet, version 3
794!:ext	wk3
795# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data"
796>>>4	uleshort	0x1002	WorKsheet, version 4
797# also worksheet template 4 (.wt4)
798!:ext	wk4/wt4
799# no example or documentation for wk5
800#>>4	uleshort	0x????	WorKsheet, version 4
801#!:ext	wk5
802# only MacrotoScript.123 example
803>>>4	uleshort	0x1003	WorKsheet, version 97
804# also worksheet template Smartmaster (.12M)?
805!:ext	123
806# only Set_Y2K.123 example
807>>>4	uleshort	0x1005	WorKsheet, version 9.8 Millennium
808!:ext	123
809# no example for this version
810>>>4	uleshort	0x8001	FoRMatting data
811!:ext	frm
812# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data"
813# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet"
814>>>4	uleshort	0x8007	ForMatting data, version 3
815!:ext	fm3
816>>>4	default		x	unknown
817# file revision sub code 0004h for worksheets
818>>>>6	uleshort	=0x0004	worksheet
819!:ext	wXX
820>>>>6	uleshort	!0x0004	formatting data
821!:ext	fXX
822# main revision number
823>>>>4	uleshort	x	\b, revision 0x%x
824>>>6	uleshort	=0x0004	\b, cell range
825# active cellcoord range (start row, page,column ; end row, page, column)
826# start values normally 0~1st sheet A1
827>>>>8	ulelong		!0
828>>>>>10	ubyte		>0	\b%d*
829>>>>>8	uleshort	x	\b%d,
830>>>>>11	ubyte		x	\b%d-
831# end page mostly 0
832>>>>14	ubyte		>0	\b%d*
833# end raw, column normally not 0
834>>>>12	uleshort	x	\b%d,
835>>>>15	ubyte		x	\b%d
836# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??)
837>>>>20	ubyte		>1	\b, character set 0x%x
838# flags
839>>>>21	ubyte		x	\b, flags 0x%x
840>>>6	uleshort	!0x0004
841# record type (FONTNAME=00AEh)
842>>>>30	search/29	\0\xAE
843# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
844>>>>>&4	string		>\0	\b, 1st font "%s"
845#
846# Update: Joerg Jenderek
847# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3
848# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
849# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
850# record type (BeginningOfFile=0000h) + length (0002h)
8510	belong	0x00000200
852# GRR: line above is too general as it catches also MS Windows CURsor
853# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
854!:strength -1
855# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
856>7	ubyte		0
857# skip Windows cursors with image width 256 and keep Lotus with positiv opcode
858>>6	ubyte		>0	Lotus
859# !:mime	application/x-123
860!:mime	application/vnd.lotus-1-2-3
861!:apple	????L123
862# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...)
863# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3"
864>>>4	uleshort	0x0007	1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF)
865!:ext	cnf
866>>>4	uleshort	0x0C05	1-2-3 CoNFiguration, version 2.4J
867!:ext	cnf
868>>>4	uleshort	0x0801	1-2-3 CoNFiguration, version 1-2.1
869!:ext	cnf
870>>>4	uleshort	0x0802	Symphony CoNFiguration
871!:ext	cnf
872>>>4	uleshort	0x0804	1-2-3 CoNFiguration, version 2.2
873!:ext	cnf
874>>>4	uleshort	0x080A	1-2-3 CoNFiguration, version 2.3-2.4
875!:ext	cnf
876>>>4	uleshort	0x1402	1-2-3 CoNFiguration, version 3.x
877!:ext	cnf
878>>>4	uleshort	0x1450	1-2-3 CoNFiguration, version 4.x
879!:ext	cnf
880# (version 5.26) labeled the entry as "Lotus 123"
881# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
882>>>4	uleshort	0x0404	1-2-3 WorKSheet, version 1
883# extension "wks" also for Microsoft Works document
884!:ext	wks
885# (version 5.26) labeled the entry as "Lotus 123"
886# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
887>>>4	uleshort	0x0405	Symphony WoRksheet, version 1.0
888!:ext	wrk/wr1
889# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data"
890# TrID labeles the entry as "Lotus 123 Worksheet (V2)"
891>>>4	uleshort	0x0406	1-2-3/Symphony worksheet, version 2
892# Symphony (.wr1)
893!:ext	wk1/wr1
894# no example for this japan version
895>>>4	uleshort	0x0600	1-2-3 WorKsheet, version 1.xJ
896!:ext	wj1
897# no example or documentation for wk2
898#>>>4	uleshort	0x????	1-2-3 WorKsheet, version 2
899#!:ext	wk2
900# undocumented japan version
901>>>4	uleshort	0x0602	1-2-3 worksheet, version 2.4J
902!:ext	wj3
903# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data"
904>>>4	uleshort	0x8006	1-2-3 ForMaTting data, version 2.x
905# japan version 2.4J (fj3)
906!:ext	fmt/fj3
907# no example for this version
908>>>4	uleshort	0x8007	1-2-3 FoRMatting data, version 2.0
909!:ext	frm
910# (version 5.26) labeled the entry as "Lotus 1-2-3"
911>>>4	default		x	unknown worksheet or configuration
912!:ext	cnf
913>>>>4	uleshort	x	\b, revision 0x%x
914# 2nd record for most worksheets describes cells range
915>>>6		use	lotus-cells
916# 3nd record for most japan worksheets describes cells range
917>>>(8.s+10)	use	lotus-cells
918#	check and then display Lotus worksheet cells range
9190	name		lotus-cells
920# look for type (RANGE=0006h) + length (0008h) at record begin
921>0	ubelong	0x06000800	\b, cell range
922# cell range (start column, row, end column, row) start values normally 0,0~A1 cell
923>>4	ulong		!0
924>>>4	uleshort	x	\b%d,
925>>>6	uleshort	x	\b%d-
926# end of cell range
927>>8	uleshort	x	\b%d,
928>>10	uleshort	x	\b%d
929# EndOfLotus123
9300	string/b		WordPro\0	Lotus WordPro
931!:mime	application/vnd.lotus-wordpro
9320	string/b		WordPro\r\373	Lotus WordPro
933!:mime	application/vnd.lotus-wordpro
934
935
936# Summary: Script used by InstallScield to uninstall applications
937# Extension: .isu
938# Submitted by: unknown
939# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
9400		string		\x71\xa8\x00\x00\x01\x02
941>12		string		Stirling\ Technologies,		InstallShield Uninstall Script
942
943# Winamp .avs
944#0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
9450	string/b	Nullsoft\ AVS\ Preset\ 	Winamp plug in
946
947# Windows Metafile .WMF
9480	string/b	\327\315\306\232	Windows metafile
949!:mime	image/wmf
950!:ext	wmf
9510	string/b	\002\000\011\000	Windows metafile
952!:mime	image/wmf
953!:ext	wmf
9540	string/b	\001\000\011\000	Windows metafile
955!:mime	image/wmf
956!:ext	wmf
957
958#tz3 files whatever that is (MS Works files)
9590	string/b	\003\001\001\004\070\001\000\000	tz3 ms-works file
9600	string/b	\003\002\001\004\070\001\000\000	tz3 ms-works file
9610	string/b	\003\003\001\004\070\001\000\000	tz3 ms-works file
962
963# PGP sig files .sig
964#0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
9650 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
9660 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
9670 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
9680 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
9690 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
9700 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
971
972# windows zips files .dmf
9730	string/b	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
974
975# Windows icons
976# Update: Joerg Jenderek
977# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
978# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG
9790   belong  0x00000100
980>9  byte    0
981>>0 byte    x
982>>0 use     cur-ico-dir
983>9  ubyte   0xff
984>>0 byte    x
985>>0 use     cur-ico-dir
986#	displays number of icons and information for icon or cursor
9870	name		cur-ico-dir
988# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
989# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
990>18		ulelong		&0x00000006
991# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
992>>(18.l)	ulelong		x		MS Windows
993>>>0		ubelong		0x00000100	icon resource
994# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon
995!:mime		image/vnd.microsoft.icon
996#!:mime		image/x-icon
997!:ext		ico
998>>>>4 		uleshort	x		- %d icon
999# plural s
1000>>>>4 		uleshort	>1		\bs
1001# 1st icon
1002>>>>0x06	use		ico-entry
1003# 2nd icon
1004>>>>4 		uleshort	>1
1005>>>>>0x16	use		ico-entry
1006>>>0		ubelong		0x00000200	cursor resource
1007#!:mime		image/x-cur
1008!:mime		image/x-win-bitmap
1009!:ext		cur
1010>>>>4 		uleshort	x		- %d icon
1011>>>>4 		uleshort	>1		\bs
1012# 1st cursor
1013>>>>0x06	use		cur-entry
1014#>>>>0x16	use		cur-entry
1015#	display information of one cursor entry
10160	name		cur-entry
1017>0	use		cur-ico-entry
1018>4	uleshort	x	\b, hotspot @%dx
1019>6	uleshort	x	\b%d
1020#	display information of one icon entry
10210	name		ico-entry
1022>0			use	cur-ico-entry
1023# normally 0 1 but also found 14
1024>4	uleshort	>1	\b, %d planes
1025# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256
1026>6	uleshort	>1	\b, %d bits/pixel
1027#	display shared information of cursor or icon entry
10280		name		cur-ico-entry
1029>0		byte		=0		\b, 256x
1030>0		byte		!0		\b, %dx
1031>1		byte        	=0		\b256
1032>1		byte        	!0		\b%d
1033# number of colors in palette
1034>2		ubyte		!0		\b, %d colors
1035# reserved 0 FFh
1036#>3		ubyte        	x		\b, reserved %x
1037#>8		ulelong		x		\b, image size %d
1038# offset of PNG or DIB image
1039#>12		ulelong		x		\b, offset 0x%x
1040# PNG header (\x89PNG)
1041>(12.l)		ubelong		=0x89504e47
1042# 1 space char after "with" to get phrase "with PNG image" by magic in ./images
1043>>&-4		indirect	x	\b with
1044# DIB image
1045>(12.l)		ubelong		!0x89504e47
1046#>>&-4		use     	dib-image
1047
1048# Windows non-animated cursors
1049# Update: Joerg Jenderek
1050# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
1051# Note: similar to Windows ICOn. container for BMP ( only DIB part)
1052# GRR: line below is too general as it catches also Lotus 1-2-3 files
10530   belong  0x00000200
1054>9  byte    0
1055>>0 use     cur-ico-dir
1056>9  ubyte   0xff
1057>>0 use     cur-ico-dir
1058
1059# .chr files
10600	string/b	PK\010\010BGI	Borland font
1061>4	string	>\0	%s
1062# then there is a copyright notice
1063
1064
1065# .bgi files
10660	string/b	pk\010\010BGI	Borland device
1067>4	string	>\0	%s
1068# then there is a copyright notice
1069
1070
1071# Windows Recycle Bin record file (named INFO2)
1072# By Abel Cheung (abelcheung AT gmail dot com)
1073# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
1074# Since Vista uses another structure, INFO2 structure probably won't change
1075# anymore. Detailed analysis in:
1076# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
10770	lelong		0x00000004
1078>12	lelong		0x00000118	Windows Recycle Bin INFO2 file (Win98 or below)
1079
10800	lelong		0x00000005
1081>12	lelong		0x00000320	Windows Recycle Bin INFO2 file (Win2k - WinXP)
1082
1083# From Doug Lee via a FreeBSD pr
10849	string		GERBILDOC	First Choice document
10859	string		GERBILDB	First Choice database
10869	string		GERBILCLIP	First Choice database
10870	string		GERBIL		First Choice device file
10889	string		RABBITGRAPH	RabbitGraph file
10890	string		DCU1		Borland Delphi .DCU file
10900	string		=!<spell>	MKS Spell hash list (old format)
10910	string		=!<spell2>	MKS Spell hash list
1092# Too simple - MPi
1093#0	string		AH		Halo(TM) bitmapped font file
10940	lelong		0x08086b70	TurboC BGI file
10950	lelong		0x08084b50	TurboC Font file
1096
1097# Debian#712046: The magic below identifies "Delphi compiled form data".
1098# An additional source of information is available at:
1099# http://www.woodmann.com/fravia/dafix_t1.htm
11000	string		TPF0
1101>4	pstring		>\0		Delphi compiled form '%s'
1102
1103# tests for DBase files moved, updated and merged to database
1104
11050	string		PMCC		Windows 3.x .GRP file
11061	string		RDC-meg		MegaDots
1107>8	byte		>0x2F		version %c
1108>9	byte		>0x2F		\b.%c file
11090	lelong		0x4C
1110>4	lelong		0x00021401	Windows shortcut file
1111
1112# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm
1113# only for windows versions equal or greater 3.0
11140x171	string	MICROSOFT\ PIFEX\0	Windows Program Information File
1115!:mime	application/x-dosexec
1116!:ext	pif
1117#>2	string	 	>\0		\b, Title:%.30s
1118>0x24	string		>\0		\b for %.63s
1119>0x65	string		>\0		\b, directory=%.64s
1120>0xA5	string		>\0		\b, parameters=%.64s
1121#>0x181	leshort	x	\b, offset %x
1122#>0x183	leshort	x	\b, offsetdata %x
1123#>0x185	leshort	x	\b, section length %x
1124>0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0
1125>>&0x5e		ubyte	>0
1126>>>&-1		string	<PIFMGR.DLL		\b, icon=%s
1127#>>>&-1		string	PIFMGR.DLL		\b, icon=%s
1128>>>&-1		string	>PIFMGR.DLL		\b, icon=%s
1129>>&0xF0		ubyte	>0
1130>>>&-1		string	<Terminal		\b, font=%.32s
1131#>>>&-1		string	=Terminal		\b, font=%.32s
1132>>>&-1		string	>Terminal		\b, font=%.32s
1133>>&0x110	ubyte	>0
1134>>>&-1		string	<Lucida\ Console	\b, TrueTypeFont=%.32s
1135#>>>&-1		string	=Lucida\ Console	\b, TrueTypeFont=%.32s
1136>>>&-1		string	>Lucida\ Console	\b, TrueTypeFont=%.32s
1137#>0x187	search/0xB55	WINDOWS\ 286\ 3.0\0	\b, Windows 3.X standard mode-style
1138#>0x187	search/0xB55	WINDOWS\ 386\ 3.0\0	\b, Windows 3.X enhanced mode-style
1139>0x187	search/0xB55	WINDOWS\ NT\ \ 3.1\0	\b, Windows NT-style
1140#>0x187	search/0xB55	WINDOWS\ NT\ \ 4.0\0	\b, Windows NT-style
1141>0x187	search/0xB55	CONFIG\ \ SYS\ 4.0\0	\b +CONFIG.SYS
1142#>>&06		string	x			\b:%s
1143>0x187	search/0xB55	AUTOEXECBAT\ 4.0\0	\b +AUTOEXEC.BAT
1144#>>&06		string	x			\b:%s
1145
1146# DOS EPS Binary File Header
1147# From: Ed Sznyter <ews@Black.Market.NET>
11480	belong		0xC5D0D3C6	DOS EPS Binary File
1149!:mime	image/x-eps
1150>4	long		>0		Postscript starts at byte %d
1151>>8	long		>0		length %d
1152>>>12	long		>0		Metafile starts at byte %d
1153>>>>16	long		>0		length %d
1154>>>20	long		>0		TIFF starts at byte %d
1155>>>>24	long		>0		length %d
1156
1157# TNEF magic From "Joomy" <joomy@se-ed.net>
1158# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
11590	lelong		0x223e9f78	TNEF
1160!:mime	application/vnd.ms-tnef
1161
1162# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
1163# of http://www.davep.org/norton-guides/ng2h-105.tgz
1164# https://en.wikipedia.org/wiki/Norton_Guides
11650	string		NG\0\001
1166# only value 0x100 found at offset 2
1167>2	ulelong		0x00000100	Norton Guide
1168# Title[40]
1169>>8	string		>\0		"%-.40s"
1170#>>6	uleshort	x		\b, MenuCount=%u
1171# szCredits[5][66]
1172>>48	string		>\0		\b, %-.66s
1173>>114	string		>\0		%-.66s
1174
1175# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
1176# of https://www.4dos.info/
1177# pointer,HelpID[8]=4DHnnnmm
11780	ulelong	0x48443408		4DOS help file
1179>4	string	x			\b, version %-4.4s
1180
1181# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
11820	ulequad	0x3a000000024e4c	MS Advisor help file
1183
1184# HtmlHelp files (.chm)
11850	string/b	ITSF\003\000\000\000\x60\000\000\000	MS Windows HtmlHelp Data
1186
1187# GFA-BASIC (Wolfram Kleff)
11882	string/b	GFA-BASIC3	GFA-BASIC 3 data
1189
1190#------------------------------------------------------------------------------
1191# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
1192# Update: Joerg Jenderek
1193# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format)
1194# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx
1195# Note: verified by `7z l *.cab`
1196# Microsoft Cabinet files
11970	string/b	MSCF\0\0\0\0	Microsoft Cabinet archive data
1198#
1199# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool
1200# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE
1201# because some archive does not have *.diag* as 1st or 2nd archive member like
1202# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab
1203# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section
1204>0x2c	search/980/c	.diag		\b, Diagnostic
1205!:mime	application/vnd.ms-cab-compressed
1206!:ext	diagcab
1207# http://fileformats.archiveteam.org/wiki/PUZ
1208# Microsoft Publisher version about 2003 has a "Pack and Go" feature that
1209# bundles a Publisher document *PNG.pub with all links into a CAB
1210>0x2c	search/300/c	png.pub\0		\b, Publisher Packed and Go
1211!:mime	application/vnd.ms-cab-compressed
1212!:ext	puz
1213# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation
1214>0x2c	search/17/c	ppview32.exe\0		\b, PowerPoint Viewer Packed and Go
1215!:mime	application/vnd.ms-powerpoint
1216#!:mime	application/mspowerpoint
1217!:ext	ppz
1218# http://www.incredimail.com/
1219# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims
1220>0x2c	search/3369/c	content.ini\0	\b, IncrediMail
1221!:mime	application/x-incredimail
1222# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf
1223>>0x2c	search/83/c	Flavor.htm\0	ecard
1224!:ext	imf
1225# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims
1226>>0x2c	search/211/c	.swf\0		skin
1227!:ext	ims
1228# member anim.im3 implies IncrediMail animation like in letter_fold.ima
1229>>0x2c	search/92/c	anim.im3\0	animation
1230!:ext	ima
1231# other IncrediMail cab archive
1232>>0x2c	default		x
1233>>>0x2c	search/116/c	thumb		ecard, image, notifier or skin
1234!:ext	imf/imi/imn/ims
1235# http://file-extension.net/seeker/file_extension_ime
1236>>>0x2c	default		x		emoticons or sound
1237!:ext	ime/imw
1238# no Diagnostic and IncrediMail
1239>0x2c	default		x
1240# look for 1st member name
1241>>(16.l+16)	ubyte	x
1242# https://en.wikipedia.org/wiki/SNP_file_format
1243>>>&-1	string/c 	_accrpt_.snp	\b, Access report snapshot
1244!:mime	application/msaccess
1245!:ext	snp
1246# https://www.cabextract.org.uk/wince_cab_format/
1247# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer
1248>>>&7	string 		=.000		\b, WinCE install
1249!:mime	application/vnd.ms-cab-compressed
1250!:ext	cab
1251
1252# https://support.microsoft.com/kb/934307/en-US
1253# All inspected MSU contain a file with name WSUSSCAN.cab
1254# that is called "Windows Update meta data" by Microsoft
1255>>>&-1	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
1256!:mime	application/vnd.ms-cab-compressed
1257!:ext	msu
1258>>>&-1	default		x
1259# look at point charcter of 1st archive member name for file name extension
1260>>>>&-1	search/255 	.
1261# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm
1262# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002
1263# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB
1264>>>>>&0	string/c	ppt\0		\b, PowerPoint Packed and Go
1265!:mime	application/vnd.ms-powerpoint
1266#!:mime	application/mspowerpoint
1267!:ext	ppz
1268# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx
1269# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack
1270# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack
1271>>>>>&0	string/c	theme		\b, Windows
1272!:mime	application/x-windows-themepack
1273# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8
1274# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack
1275# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme
1276>>>>>>(16.l+16)	string	=Panoram	8
1277!:ext	deskthemepack
1278>>>>>>(16.l+16)	string	!Panoram	7 or 8
1279!:ext	themepack/deskthemepack
1280>>>>>>(16.l+16)	ubyte	x		Theme Pack
1281>>>>>&0	default		x
1282# look for null terminator of 1st member name
1283>>>>>>&0	search/255 	\0
1284# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu
1285>>>>>>>&16	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
1286!:mime	application/vnd.ms-cab-compressed
1287!:ext	msu
1288>>>>>>>&16	default	x
1289# archive with more then one file need some output in version 5.32 to avoid error message like
1290# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type
1291# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type
1292# file: could not find any valid magic files!
1293>>>>>>>>28	uleshort	>1	\b, many
1294!:mime	application/vnd.ms-cab-compressed
1295!:ext	cab
1296# remaining archives with just one file
1297>>>>>>>>28	uleshort	=1
1298# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386
1299>>>>>>>>>30	uleshort	=0x0000	\b, Windows 2000/XP setup
1300# cut of last char of source extension and add underscore to generate extension
1301# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_
1302!:mime	application/vnd.ms-cab-compressed
1303!:ext	_/?_/??_
1304# archive need some output like "single" in version 5.32 to avoid error messages
1305>>>>>>>>>30	uleshort	!0x0000	\b, single
1306!:mime	application/vnd.ms-cab-compressed
1307!:ext	cab
1308# TODO: additional extensions like
1309# .xsn	InfoPath Dynamic Form
1310# .xtp	InfoPath Template Part
1311# .lvf	Logitech Video Effects Face Accessory
1312>8	ulelong		x		\b, %u bytes
1313>28	uleshort		1		\b, 1 file
1314>28	uleshort		>1		\b, %u files
1315# Reserved fields, set to zero
1316#>4	belong		!0		\b, reserved1 %x
1317#>12	belong		!0		\b, reserved2 %x
1318# offset of the first CFFILE entry coffFiles: minimal 2Ch
1319>16	ulelong		x		\b, at 0x%x
1320>(16.l)	use		cab-file
1321# at least also 2nd member
1322>28	uleshort		>1
1323>>(16.l+16)	ubyte	x
1324>>>&0	search/255 	\0
1325# second member info
1326>>>>&0	use		cab-file
1327#>20	belong		!0		\b, reserved %x
1328# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3
1329>24	ubeshort	!0x0301		\b version 0x%x
1330# number of CFFOLDER entries
1331>26	uleshort	>1		\b, %u cffolders
1332# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields
1333# only found for flags 0 1 2 3 4 not 7
1334>30	uleshort	>0		\b, flags 0x%x
1335# Cabinet files have a 16-bit cabinet setID field that is designed for application use.
1336# default is zero, however, the -i option of cabarc can be used to set this field
1337>32	uleshort	>0		\b, ID %u
1338# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet
1339#>34	uleshort	x		\b, iCabinet %u
1340# add one for display because humans start numbering by 1 and also fit to name of disk szDisk*
1341>34	uleshort+1	x		\b, number %u
1342>30	uleshort	&0x0004		\b, extra bytes
1343# cbCFHeader optional size of per-cabinet reserved area 14h 1800h
1344>>36	uleshort	>0		%u in head
1345# cbCFFolder is optional size of per-folder reserved area
1346>>38	ubyte		>0		%u in folder
1347# cbCFData is optional size of per-datablock reserved area
1348>>39	ubyte		>0		%u in data block
1349# optional per-cabinet reserved area abReserve[cbCFHeader]
1350>>36	uleshort	>0
1351# 1st CFFOLDER after reserved area in header
1352>>>(36.s+40)	use			cab-folder
1353# no reserved area in header
1354>30	uleshort	^0x0004
1355# no previous and next cab archive
1356>>30	uleshort		=0x0000
1357>>>36	use				cab-folder
1358# only previous cab archive
1359>>30	uleshort		=0x0001	\b, previous
1360>>>36	use				cab-anchor
1361# only next cab archive
1362>>30	uleshort		=0x0002	\b, next
1363>>>36	use				cab-anchor
1364# previous+next cab archive
1365# can not use sub routine cab-anchor to display previous and next cabinet together
1366#>>>36	use				cab-anchor
1367#>>>>&0	use				cab-anchor
1368>>30	uleshort		=0x0003	\b, previous
1369>>>36	string		x		%s
1370# optional name of previous disk szDisk*
1371>>>>&1	string		x		disk %s
1372>>>>>&1	string		x		\b, next %s
1373# optional name of previous disk szDisk*
1374>>>>>>&1	string		x	disk %s
1375>>>>>>>&1	use			cab-folder
1376#	display filename and disk name of previous or next cabinet
13770       name    			cab-anchor
1378# optional name of previous/next cabinet file szCabinet*[255]
1379>&0	string		x		%s
1380# optional name of previous/next disk szDisk*[255]
1381>>&1	string		x		disk %s
1382#	display folder structure CFFOLDER information like compression of cabinet
13830       name    			cab-folder
1384# offset of the CFDATA block in this folder
1385#>0	ulelong		x		\b, coffCabStart 0x%x
1386# number of CFDATA blocks in folder
1387>4	uleshort	x		\b, %u datablock
1388# plural s
1389>4	uleshort	>1		\bs
1390# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15
1391>6	uleshort	x		\b, 0x%x compression
1392# optional per-folder reserved area
1393#>8	ubequad		x		\b, abReserve 0x%llx
1394#	display member structure CFFILE information like member name of cabinet
13950       name    			cab-file
1396# cbFile is uncompressed size of file in bytes
1397#>0	ulelong		x		\b, cbFile %u
1398# uoffFolderStart is uncompressed offset of file in folder
1399#>4	ulelong		>0		\b, uoffFolderStart 0x%x
1400# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet
1401# define ifoldCONTINUED_FROM_PREV      (0xFFFD)
1402# define ifoldCONTINUED_TO_NEXT        (0xFFFE)
1403# define ifoldCONTINUED_PREV_AND_NEXT  (0xFFFF)
1404>8	uleshort	>0		\b, iFolder 0x%x
1405# date stamp for file
1406#>10	uleshort	x		\b, date 0x%x
1407# time stamp for file
1408#>12	uleshort	x		\b, time 0x%x
1409# attribs is attribute flags for file
1410# define  _A_RDONLY       (0x01)  file is read-only
1411# define  _A_HIDDEN       (0x02)  file is hidden
1412# define  _A_SYSTEM       (0x04)  file is a system file
1413# define  _A_ARCH         (0x20)  file modified since last backup
1414# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab
1415# define  _A_EXEC         (0x40)  run after extraction
1416# define  _A_NAME_IS_UTF  (0x80)  szName[] contains UTF
1417# define  UNKNOWN       (0x0100)  undocumented or accident
1418#>14	uleshort	x		\b, attribs 0x%x
1419>14	uleshort	>0		+
1420>>14	uleshort	&0x0001		\bR
1421>>14	uleshort	&0x0002		\bH
1422>>14	uleshort	&0x0004		\bS
1423>>14	uleshort	&0x0020		\bA
1424>>14	uleshort	&0x0040		\bX
1425>>14	uleshort	&0x0080		\bUtf
1426# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB
1427>>14	uleshort	&0x0100		\b?
1428# szName is name of archive member
1429>16	string		x		"%s"
1430# next archive member name if more files
1431#>>&17	string		>\0		\b, NEXT NAME %-.50s
1432
1433# InstallShield Cabinet files
14340	string/b	ISc(		InstallShield Cabinet archive data
1435>5	byte&0xf0	=0x60		version 6,
1436>5	byte&0xf0	!0x60		version 4/5,
1437>(12.l+40)	lelong	x		%u files
1438
1439# Windows CE package files
14400	string/b	MSCE\0\0\0\0	Microsoft WinCE install header
1441>20	lelong		0		\b, architecture-independent
1442>20	lelong		103		\b, Hitachi SH3
1443>20	lelong		104		\b, Hitachi SH4
1444>20	lelong		0xA11		\b, StrongARM
1445>20	lelong		4000		\b, MIPS R4000
1446>20	lelong		10003		\b, Hitachi SH3
1447>20	lelong		10004		\b, Hitachi SH3E
1448>20	lelong		10005		\b, Hitachi SH4
1449>20	lelong		70001		\b, ARM 7TDMI
1450>52	leshort		1		\b, 1 file
1451>52	leshort		>1		\b, %u files
1452>56	leshort		1		\b, 1 registry entry
1453>56	leshort		>1		\b, %u registry entries
1454
1455
1456# Windows Enhanced Metafile (EMF)
1457# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
1458# for further information.
14590	ulelong 1
1460>40	string	\ EMF		Windows Enhanced Metafile (EMF) image data
1461>>44	ulelong x		version 0x%x
1462
1463
14640	string/b	\224\246\056		Microsoft Word Document
1465!:mime	application/msword
1466
1467# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
1468# Magic type for Dell's BIOS .hdr files
1469# Dell's .hdr
14700	string/b $RBU
1471>23	string Dell			%s system BIOS
1472>5	byte   2
1473>>48	byte   x			version %d.
1474>>49	byte   x			\b%d.
1475>>50	byte   x			\b%d
1476>5	byte   <2
1477>>48	string x			version %.3s
1478
1479# Type: Microsoft Document Imaging Format (.mdi)
1480# URL:	https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
1481# From: Daniele Sempione <scrows@oziosi.org>
1482# Too weak (EP)
1483#0	short	0x5045			Microsoft Document Imaging Format
1484
1485# MS eBook format (.lit)
14860	string/b	ITOLITLS		Microsoft Reader eBook Data
1487>8	lelong	x			\b, version %u
1488!:mime					application/x-ms-reader
1489
1490# Windows CE Binary Image Data Format
1491# From: Dr. Jesus <j@hug.gs>
14920	string/b	B000FF\n	Windows Embedded CE binary image
1493
1494# The second byte of these signatures is a file version; I don't know what,
1495# if anything, produced files with version numbers 0-2.
1496# From: John Elliott <johne@seasip.demon.co.uk>
14970	string	\xfc\x03\x00	Mallard BASIC program data (v1.11)
14980	string	\xfc\x04\x00	Mallard BASIC program data (v1.29+)
14990	string	\xfc\x03\x01	Mallard BASIC protected program data (v1.11)
15000	string	\xfc\x04\x01	Mallard BASIC protected program data (v1.29+)
1501
15020	string	MIOPEN		Mallard BASIC Jetsam data
15030	string	Jetsam0		Mallard BASIC Jetsam index data
1504
1505# DOS backup 2.0 to 3.2
1506
1507# backupid.@@@
1508
1509# plausibility check for date
15100x3	ushort	>1979
1511>0x5	ubyte-1 <31
1512>>0x6	ubyte-1 <12
1513# actually 121 nul bytes
1514>>>0x7	string	\0\0\0\0\0\0\0\0
1515>>>>0x1 ubyte	x	DOS 2.0 backup id file, sequence %d
1516!:ext @@@
1517>>>>0x0 ubyte	0xff	\b, last disk
1518
1519# backed up file
1520
1521# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
1522# by looking for trailing nul of maximal file name string
15230x52	ubyte	0
1524# test for flag byte: FFh~complete file, 00h~split file
1525# FFh -127 =	-1 -127 =	-128
1526# 00h -127 =	 0 -127 =	-127
1527>0	byte-127	<-126
1528# plausibility check for file name length
1529>>0x53	ubyte-1	<78
1530# looking for terminating nul of file name string
1531>>>(0x53.b+4)	ubyte	0
1532# looking if last char of string is valid DOS file name
1533>>>>(0x53.b+3)	ubyte	>0x1F
1534# actually 44 nul bytes
1535# but sometimes garbage according to Ralf Quint. So can not be used as test
1536#>0x54	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
1537# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
1538# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
1539>>>>>5	ubyte&0x8C	0x0C
1540# ./msdos (version 5.30) labeled the entry as
1541# "DOS 2.0 backed up file %s, split file, sequence %d" or
1542# "DOS 2.0 backed up file %s, complete file"
1543>>>>>>0	ubyte	x	DOS 2.0-3.2 backed up
1544#>>>>>>0	ubyte	0xff	complete
1545>>>>>>0	ubyte	0
1546>>>>>>>1 uleshort	x	sequence %d of
1547# full file name with path but without drive letter and colon stored from 0x05 til 0x52
1548>>>>>>0x5	string	x	file %s
1549# backup name is original filename
1550#!:ext	*
1551# magic/Magdir/msdos, 1169: Warning: EXTENSION type `     *' has bad char '*'
1552# file: line 1169: Bad magic entry '  *'
1553# after header original file content
1554>>>>>>128	indirect x	\b;
1555
1556
1557# DOS backup 3.3 to 5.x
1558
1559# CONTROL.nnn files
15600	string	\x8bBACKUP\x20
1561# actually 128 nul bytes
1562>0xa	string	\0\0\0\0\0\0\0\0
1563>>0x9	ubyte	x	DOS 3.3 backup control file, sequence %d
1564>>0x8a	ubyte	0xff	\b, last disk
1565
1566# NB: The BACKUP.nnn files consist of the files backed up,
1567# concatenated.
1568