xref: /freebsd/contrib/file/magic/Magdir/ole2compounddocs (revision 43a5ec4eb41567cc92586503212743d89686d78f)
1b6cee71dSXin LI
2b6cee71dSXin LI#------------------------------------------------------------------------------
3*43a5ec4eSXin LI# $File: ole2compounddocs,v 1.12 2021/09/04 16:00:38 christos Exp $
4b6cee71dSXin LI# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
558a0f0d0SEitan Adler# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
6b6cee71dSXin LI# Additional tests for OLE 2 Compound Documents should be under this recipe.
7d38c30c0SXin LI# reference:	https://www.openoffice.org/sc/compdocfileformat.pdf
8b6cee71dSXin LI
9d38c30c0SXin LI0   string  \320\317\021\340\241\261\032\341
10d38c30c0SXin LI# https://digital-preservation.github.io/droid/
11d38c30c0SXin LI# skip droid skeleton like fmt-39-signature-id-128.doc by valid version
12d38c30c0SXin LI>0x1A	ushort		!0xABAB		OLE 2 Compound Document
13*43a5ec4eSXin LI#>0x1C	uleshort		x			\b, endnian %#4.4x
14d38c30c0SXin LI# big endian not tested
15d38c30c0SXin LI>>0x1C	ubeshort		=0xfffe			\b, big-endian
16d38c30c0SXin LI>>>546	string	jbjb			: Microsoft Word Document
1758a0f0d0SEitan Adler!:mime	application/msword
1858a0f0d0SEitan Adler!:apple	MSWDWDBN
1958a0f0d0SEitan Adler!:ext	doc
20d38c30c0SXin LI# Byte Order 0xFFFE means little-endian found in real world applications
21d38c30c0SXin LI#>>0x1C	uleshort		=0xfffe			\b, little-endian
22d38c30c0SXin LI>>0x1C	uleshort		=0xfffe
23d38c30c0SXin LI# From:		Joerg Jenderek
24d38c30c0SXin LI# Major Version 3 or 4
25d38c30c0SXin LI>>>0x1A	uleshort		x			\b, v%u
26d38c30c0SXin LI# Minor Version 32h=50 3Bh=59 3Eh=62
27d38c30c0SXin LI>>>0x18	uleshort		x			\b.%u
28d38c30c0SXin LI# SecID of first sector of the directory stream is often 1 but high like 3144h
29*43a5ec4eSXin LI>>>48	ulelong			x			\b, SecID %#x
302726a701SXin LI# Sector Shift Exponent in short-stream container stream: 6~64 bytes
312726a701SXin LI>>>32	uleshort		!6			\b, exponent of short stream %u
322726a701SXin LI# total number of sectors used for the FAT
332726a701SXin LI>>>44	ulelong			>1			\b, %u FAT sectors
342726a701SXin LI# SecID of first sector of the short-sector allocation table (Mini FAT)
352726a701SXin LI# or -2 (End Of ChainSecID) if not extant
36*43a5ec4eSXin LI>>>60	ulelong			!0xffFFffFE		\b, Mini FAT start sector %#x
372726a701SXin LI# total number of sectors used for the short-sector allocation table
382726a701SXin LI>>>64	ulelong			!1			\b, %u Mini FAT sector
392726a701SXin LI# plural s
402726a701SXin LI>>>>64	ulelong			>1			\bs
412726a701SXin LI# SecID of first sector of the master sector allocation table (DIFAT)
422726a701SXin LI# or -2 (End Of Chain SecID) if no additional sectors used
43*43a5ec4eSXin LI>>>68	ulelong			!0xffFFffFE		\b, DIFAT start sector %#x
442726a701SXin LI# total number of sectors used for the master sector allocation table (DIFAT)
452726a701SXin LI>>>72	ulelong			>0			\b, %u DIFAT sectors
462726a701SXin LI# First part of the master sector allocation table (DIFAT) containing 109 SecIDs
47*43a5ec4eSXin LI#>>>76 	ubequad			x			\b, DIFAT=%#16.16llx
482726a701SXin LI#>>>84 	ubequad			x			\b%16.16llx...
49d38c30c0SXin LI# pointer to root entry only works with standard configuration for SecID ~< 800h
50d38c30c0SXin LI# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls
51d38c30c0SXin LI# "ORLEN Factbook 2017.xls" XnView_metadata.doc
52d38c30c0SXin LI# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized
53d38c30c0SXin LI>>>48	ulelong			>0x800			too big for FILE_BYTES_MAX = 1 MiB
54d38c30c0SXin LI# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4
55d38c30c0SXin LI>>>0x1E	uleshort		0xc			\b, blocksize 4096
56d38c30c0SXin LI# jump to one block (4096 bytes per block) before root storage block
57d38c30c0SXin LI>>>>(48.l*4096)	ubyte	x
58d38c30c0SXin LI>>>>>&4095 	use		ole2-directory
59d38c30c0SXin LI#>>>0x1E	uleshort		9			\b, blocksize 512
60d38c30c0SXin LI>>>0x1E	uleshort		9
61d38c30c0SXin LI# jump to one block (512 bytes per block) before root storage block
62d38c30c0SXin LI# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h
63d38c30c0SXin LI>>>>(48.l*512)	ubyte		x
64d38c30c0SXin LI>>>>>&511 	use		ole2-directory
65d38c30c0SXin LI# check directory entry structure and display types by GUID
66d38c30c0SXin LI0	name			ole2-directory
67d38c30c0SXin LI# directory entry name like "Root Entry"
68d38c30c0SXin LI#>0 	lestring16	x 			\b, 1st %.10s
69d38c30c0SXin LI# type of the entry; 5~Root storage
70d38c30c0SXin LI#>66 	ubyte		x			\b, type %x
71d38c30c0SXin LI# node colour of the entry: 00H ~ Red 01H ~ Black
72d38c30c0SXin LI#>67 	ubyte		x			\b, color %x
732726a701SXin LI# the DirIDs of the child nodes. Should both be -1 in the root storage entry
74d38c30c0SXin LI#>68 	bequad		!0xffffffffffffffff	\b, DirIDs %llx
75d38c30c0SXin LI# second directory entry name like VisioDocument Control000
76d38c30c0SXin LI#>128	lestring16	x \b, 2nd %.20s
77d38c30c0SXin LI# third directory entry like WordDocument
78d38c30c0SXin LI#>256	lestring16	x \b, 3rd %.20s
79d38c30c0SXin LI# forth
80d38c30c0SXin LI#>384	lestring16	x \b, 4th %.10s
81d38c30c0SXin LI# 5th
82d38c30c0SXin LI#>512	lestring16	x \b, 5th %.10s
83d38c30c0SXin LI# 6th
84d38c30c0SXin LI#>640	lestring16	x \b, 6th %.10s
85d38c30c0SXin LI# 7th
86d38c30c0SXin LI#>768	lestring16	x \b, 7th %.10s
87d38c30c0SXin LI#	https://wikileaks.org/ciav7p1/cms/page_13762814.html
88d38c30c0SXin LI#	https://m.blog.naver.com/superman4u/40047693679
89d38c30c0SXin LI#	https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt
90*43a5ec4eSXin LI#	https://toolslick.com/conversion/data/guid
91*43a5ec4eSXin LI#>80 	ubequad		!0			\b, clsid %#16.16llx
92d38c30c0SXin LI#>>88 	ubequad		x			\b%16.16llx
93d38c30c0SXin LI# test for "Root Entry" inside directory by type 5 value
94d38c30c0SXin LI>66 	ubyte		5
95d38c30c0SXin LI# look for CLSID GUID 0
96d38c30c0SXin LI>>88 	ubequad		0x0
97d38c30c0SXin LI>>>80 	ubequad		0x0
98d38c30c0SXin LI# - Microstation V8 DGN files (www.bentley.com)
99d38c30c0SXin LI# URL:	https://en.wikipedia.org/wiki/MicroStation
100d38c30c0SXin LI#   Last update on 10/23/2006 by Lester Hightower
101d38c30c0SXin LI#   07/24/2019 by Joerg Jenderek
102d38c30c0SXin LI# Second directory entry name like Dgn~H Dgn~S
103d38c30c0SXin LI>>>>128 	lestring16	Dgn~			: Microstation V8 CAD
104d38c30c0SXin LI#!:mime	application/x-ole-storage
105d38c30c0SXin LI!:mime	application/x-bentley-dgn
106d38c30c0SXin LI# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn
107d38c30c0SXin LI!:ext	dgn
108d38c30c0SXin LI#
109d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/WordPerfect
110d38c30c0SXin LI# Second directory entry name PerfectOffice_
111d38c30c0SXin LI>>>>128 	lestring16	PerfectOffice_		: WordPerfect 7-X3 presentations Master, Document or Graphic
112d38c30c0SXin LI!:mime	application/vnd.wordperfect
113d38c30c0SXin LI# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
114d38c30c0SXin LI!:apple	????WPC7
115d38c30c0SXin LI!:ext	mst/wpd/wpg
116d38c30c0SXin LI#
117d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
118d38c30c0SXin LI# Second directory entry name MatOST_
119d38c30c0SXin LI>>>>128 	lestring16	MatOST			: Microsoft Works 3.0 document
120d38c30c0SXin LI!:mime	application/vnd.ms-works
121d38c30c0SXin LI!:apple	????AWWP
122d38c30c0SXin LI!:ext	wps
123d38c30c0SXin LI#
124d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet
125d38c30c0SXin LI# 3rd directory entry name WksSSWorkBook
126d38c30c0SXin LI>>>>256 	lestring16	WksSSWorkBook		: Microsoft Works 6-9 spreadsheet
127d38c30c0SXin LI!:mime	application/vnd.ms-works
128d38c30c0SXin LI!:apple	????AWSS
129d38c30c0SXin LI!:ext	xlr
130d38c30c0SXin LI#
131d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/XLS
132d38c30c0SXin LI# what is the difference to {00020820-0000-0000-c000-000000000046} ?
133d38c30c0SXin LI# Second directory entry name Workbook
134d38c30c0SXin LI>>>>128 	lestring16	Workbook
135d38c30c0SXin LI>>>>>256 	lestring16	!WksSSWorkBook		: Microsoft Excel 97-2003 worksheet 0 clsid
136d38c30c0SXin LI!:mime	application/vnd.ms-excel
137d38c30c0SXin LI# https://www.macdisk.com/macsigen.php	XLS5 for Excel 5
138d38c30c0SXin LI!:apple	????XLS9
139d38c30c0SXin LI!:ext	xls
140d38c30c0SXin LI#
141d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/PPT
142d38c30c0SXin LI# Second directory entry name Object1 Object12 Object35
143d38c30c0SXin LI>>>>128 	lestring16	Object			: Microsoft PowerPoint 4 presentation
144d38c30c0SXin LI!:mime	application/vnd.ms-powerpoint
145d38c30c0SXin LI# https://www.macdisk.com/macsigen.php
146d38c30c0SXin LI!:apple	????PPT3
147d38c30c0SXin LI!:ext	ppt
148d38c30c0SXin LI#
149d38c30c0SXin LI# URL:	https://www.msoutlook.info/question/164
150d38c30c0SXin LI# Second directory entry name __CollDataStm
151d38c30c0SXin LI>>>>128 	lestring16	__CollDataStm		: Microsoft Outlook Send Receive Settings
152d38c30c0SXin LI#!:mime	application/vnd.ms-outlook
153d38c30c0SXin LI!:mime	application/x-ms-srs
154d38c30c0SXin LI# %APPDATA%\Microsoft\Outlook\Outlook.srs
155d38c30c0SXin LI!:ext	srs
156d38c30c0SXin LI#
157d38c30c0SXin LI# URL:	https://www.file-extensions.org/cag-file-extension
158d38c30c0SXin LI# Second directory entry name Category
159d38c30c0SXin LI>>>>128 	lestring16	Category		: Microsoft Clip Art Gallery
160d38c30c0SXin LI#!:mime	application/x-ole-storage
161d38c30c0SXin LI!:mime	application/x-ms-cag
162d38c30c0SXin LI!:apple	MScgCGdb
163d38c30c0SXin LI!:ext	cag/
164d38c30c0SXin LI#
165d38c30c0SXin LI# URL:	https://www.filesuffix.com/de/extension/rra
166d38c30c0SXin LI# 3rd directory entry name StrIndex_StringTable
167d38c30c0SXin LI>>>>256 	lestring16	StrIndex_StringTable	: Windows temporarily installer
168d38c30c0SXin LI#!:mime	application/x-ole-storage
169d38c30c0SXin LI!:mime	application/x-ms-rra
170d38c30c0SXin LI!:ext	rra
171d38c30c0SXin LI#
172d38c30c0SXin LI# URL:	https://www.forensicswiki.org/wiki/Jump_Lists
173d38c30c0SXin LI# 3rd directory entry name DestList
174d38c30c0SXin LI>>>>256 	lestring16	DestList		: Windows jump list
175d38c30c0SXin LI#!:mime	application/x-ole-storage
176d38c30c0SXin LI!:mime	application/x-ms-jumplist
177d38c30c0SXin LI# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms
178d38c30c0SXin LI!:ext	automaticDestinations-ms
179d38c30c0SXin LI#
180d38c30c0SXin LI# URL:	https://en.wikipedia.org/wiki/Windows_thumbnail_cache
181d38c30c0SXin LI# Second directory entry name 256_
182d38c30c0SXin LI>>>>128 	lestring16	256_			: Windows thumbnail database 256
183d38c30c0SXin LI#!:mime	application/x-ole-storage
184d38c30c0SXin LI!:mime	application/x-ms-thumbnail
185d38c30c0SXin LI# Thumbs.db
186d38c30c0SXin LI!:ext	db
187d38c30c0SXin LI>>>>128 	lestring16	96_			: Windows thumbnail database 96
188d38c30c0SXin LI!:mime	application/x-ms-thumbnail
189d38c30c0SXin LI!:ext	db
190d38c30c0SXin LI# 3rd directory entry name Catalog_
191d38c30c0SXin LI>>>>256 	lestring16	Catalog			: Windows thumbnail database
192d38c30c0SXin LI!:mime	application/x-ms-thumbnail
193d38c30c0SXin LI!:ext	db
194d38c30c0SXin LI#
195d38c30c0SXin LI# URL:	https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches
196d38c30c0SXin LI# Note:	older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based
197d38c30c0SXin LI# Second directory entry name Control000
198d38c30c0SXin LI>>>>128 	lestring16	Control000		: Microsoft old Systeminfo
199d38c30c0SXin LI#!:mime	application/x-ole-storage
200d38c30c0SXin LI!:mime	application/x-ms-info
201d38c30c0SXin LI!:ext	nfo
202d38c30c0SXin LI#
203d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/Corel_Print_House
204d38c30c0SXin LI# Second directory entry name Thumbnail
205d38c30c0SXin LI>>>>128 	lestring16	Thumbnail		: Corel PrintHouse image
206d38c30c0SXin LI#!:mime	application/x-ole-storage
207d38c30c0SXin LI!:mime	application/x-corel-cph
208d38c30c0SXin LI!:ext	cph
209d38c30c0SXin LI# 3rd directory entry name Thumbnail
210d38c30c0SXin LI>>>>256 	lestring16	Thumbnail		: Corel PrintHouse image
211d38c30c0SXin LI!:mime	application/x-corel-cph
212d38c30c0SXin LI!:ext	cph
213*43a5ec4eSXin LI# URL:	http://fileformats.archiveteam.org/wiki/Corel_Gallery
214*43a5ec4eSXin LI# Note:	format since Gallery 2; sometimes called Corel Multimedia Manager Album
215*43a5ec4eSXin LI# third directory entry name _INFO_
216*43a5ec4eSXin LI>>>>256 	lestring16	_INFO_			: Corel Gallery
217*43a5ec4eSXin LI# second directory entry name _ITEM_ or _DATA_
218*43a5ec4eSXin LI# later directory entry names: _ALBUM_ _THUMBNAIL_
219*43a5ec4eSXin LI#!:mime	application/x-ole-storage
220*43a5ec4eSXin LI!:mime	application/x-corel-gal
221*43a5ec4eSXin LI!:ext	gal
222d38c30c0SXin LI#
223d38c30c0SXin LI# URL:	https://en.wikipedia.org/wiki/Hangul_(word_processor)
224d38c30c0SXin LI# Note:	"HWP Document File" signature found in FileHeader
225d38c30c0SXin LI# Second directory entry name FileHeader hint for Thinkfree Office document
226d38c30c0SXin LI>>>>128 	lestring16	FileHeader		: Hangul (Korean) 5.0 Word Processor File
227d38c30c0SXin LI#!:mime	application/haansofthwp
228d38c30c0SXin LI!:mime	application/x-hwp
229d38c30c0SXin LI# https://example-files.online-convert.com/document/hwp/example.hwp
230d38c30c0SXin LI!:ext	hwp
231d38c30c0SXin LI#
232d38c30c0SXin LI# URL:	https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/
233d38c30c0SXin LI# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083
234d38c30c0SXin LI>>>>128 	lestring16	dd2			: StarOffice Gallery view
235d38c30c0SXin LI#!:mime	application/x-ole-storage
236d38c30c0SXin LI!:mime	application/x-star-sdv
237d38c30c0SXin LI!:ext	sdv
2382726a701SXin LI# URL:	https://en.wikipedia.org/wiki/SoftMaker_Office
2392726a701SXin LI# second directory entry name Current User
2402726a701SXin LI>>>>128 	lestring16	Current\ User		: SoftMaker
2412726a701SXin LI# third directory entry name SMNativeObjData
2422726a701SXin LI>>>>>256	lestring16	SMNativeObjData
243*43a5ec4eSXin LI# 5th directory entry name PowerPoint
2442726a701SXin LI>>>>>>512	lestring16	PowerPoint		PowerPoint presentation or template
2452726a701SXin LI!:mime	application/vnd.ms-powerpoint
2462726a701SXin LI!:ext	ppt/pps/pot
2472726a701SXin LI# 4th directory entry name PowerPoint
2482726a701SXin LI>>>>>384	lestring16	PowerPoint		Presentations or template
2492726a701SXin LI# http://extension.nirsoft.net/prv
2502726a701SXin LI!:mime	application/vnd.softmaker.presentations
2512726a701SXin LI!:ext	prd/prv
2522726a701SXin LI# third directory entry name like Current User
2532726a701SXin LI>>>>256 	lestring16	Current\ User		: SoftMaker
2542726a701SXin LI# 5th directory entry name PowerPoint
2552726a701SXin LI>>>>>512	lestring16	PowerPoint		Presentations or template
2562726a701SXin LI# http://extension.nirsoft.net/prd
2572726a701SXin LI!:mime	application/vnd.softmaker.presentations
2582726a701SXin LI!:ext	prd/prv
2592726a701SXin LI# 2nd directory entry name Pictures
2602726a701SXin LI>>>>>>128 	lestring16	Pictures		with pictures
261d38c30c0SXin LI#	remaining null clsid
262d38c30c0SXin LI>>>>128 	default		x			: UNKNOWN
263*43a5ec4eSXin LI# second directory entry name like VisioDocument Control000
264*43a5ec4eSXin LI>>>>>128	lestring16	x with names %.20s
265*43a5ec4eSXin LI# third directory entry like WordDocument
266*43a5ec4eSXin LI>>>>>256	lestring16	x %.20s
267*43a5ec4eSXin LI# forth
268*43a5ec4eSXin LI>>>>>384	lestring16	x %.20s
269d38c30c0SXin LI!:mime	application/x-ole-storage
270d38c30c0SXin LI#	look for known clsid GUID
271d38c30c0SXin LI# - Visio documents
272d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/Visio
273d38c30c0SXin LI#   Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek
274d38c30c0SXin LI>>88 	ubequad		0xc000000000000046	: Microsoft
275d38c30c0SXin LI>>>80 	ubequad		0x131a020000000000	Visio 2000-2002 Document, stencil or template
276d38c30c0SXin LI!:mime	application/vnd.visio
277d38c30c0SXin LI# VSD~Drawing VSS~Stencil VST~Template
278d38c30c0SXin LI!:ext	vsd/vss/vst
279d38c30c0SXin LI>>>80 	ubequad		0x141a020000000000	Visio 2003-2010 Document, stencil or template
280d38c30c0SXin LI!:mime	application/vnd.visio
281d38c30c0SXin LI!:ext	vsd/vss/vst
282d38c30c0SXin LI#
283d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/Windows_Installer
284d38c30c0SXin LI>>>80 	ubequad		0x84100c0000000000	Windows Installer Package
285d38c30c0SXin LI!:mime	application/x-msi
286d38c30c0SXin LI#!:mime	application/x-ms-win-installer
287d38c30c0SXin LI!:ext	msi
288d38c30c0SXin LI>>>80 	ubequad		0x86100c0000000000	Windows Installer Patch
289d38c30c0SXin LI# ??
290d38c30c0SXin LI!:mime	application/x-wine-extension-msp
291d38c30c0SXin LI#!:mime	application/x-ms-msp
292d38c30c0SXin LI!:ext	msp
293d38c30c0SXin LI#
294d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/DOC
295d38c30c0SXin LI>>>80 	ubequad		0x0009020000000000	Word 6-95 document or template
296d38c30c0SXin LI!:mime	application/msword
297d38c30c0SXin LI# for template MSWDW8TN
298d38c30c0SXin LI!:apple	MSWDWDBN
299d38c30c0SXin LI!:ext	doc/dot
300d38c30c0SXin LI>>>80 	ubequad		0x0609020000000000	Word 97-2003 document or template
301d38c30c0SXin LI!:mime	application/msword
302d38c30c0SXin LI!:apple	MSWDWDBN
303d38c30c0SXin LI# dot for template; no extension on Macintosh
304d38c30c0SXin LI!:ext	doc/dot/
305d38c30c0SXin LI#
306d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
307d38c30c0SXin LI>>>80 	ubequad		0x0213020000000000	Works 3-4 document or template
308d38c30c0SXin LI!:mime	application/vnd.ms-works
309d38c30c0SXin LI!:apple	????AWWP
310d38c30c0SXin LI# ps for template	https://filext.com/file-extension/PS	bps for backup
311d38c30c0SXin LI!:ext	wps/ps/bps
312d38c30c0SXin LI#
313d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
314d38c30c0SXin LI>>>80 	ubequad		0x0313020000000000	Works 3-4 database or template
315d38c30c0SXin LI!:mime	application/vnd.ms-works-db
316d38c30c0SXin LI# https://www.macdisk.com/macsigen.php
317d38c30c0SXin LI!:apple	????AWDB
318d38c30c0SXin LI# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup
319d38c30c0SXin LI!:ext	wdb/db/bdb
320d38c30c0SXin LI#
321d38c30c0SXin LI# URL:	https://en.wikipedia.org/wiki/Microsoft_Excel
322d38c30c0SXin LI>>>80 	ubequad		0x1008020000000000	Excel 5-95 worksheet, addin or template
323d38c30c0SXin LI!:mime	application/vnd.ms-excel
324d38c30c0SXin LI# https://www.macdisk.com/macsigen.php
325d38c30c0SXin LI!:apple	????XLS5
326d38c30c0SXin LI# worksheet/addin/template/no extension on Macintosh
327d38c30c0SXin LI!:ext	xls/xla/xlt/
328d38c30c0SXin LI#
329d38c30c0SXin LI>>>80 	ubequad		0x2008020000000000	Excel 97-2003
330d38c30c0SXin LI!:mime	application/vnd.ms-excel
331d38c30c0SXin LI# https://www.macdisk.com/macsigen.php	XLS5 for Excel 5
332d38c30c0SXin LI!:apple	????XLS9
333*43a5ec4eSXin LI# 3rd directory entry name
334d38c30c0SXin LI>>>>256 	lestring16	_VBA_PROJECT_CUR	addin
335d38c30c0SXin LI!:ext	xla/
336d38c30c0SXin LI# 4th directory entry name
337d38c30c0SXin LI>>>>384 	lestring16	_VBA_PROJECT_CUR	addin
338d38c30c0SXin LI!:ext	xla
339d38c30c0SXin LI#!:ext	xla/
340d38c30c0SXin LI>>>>256 	default		x			worksheet or template
341d38c30c0SXin LI!:ext	xls/xlt
342d38c30c0SXin LI#!:ext	xls/xlt/
343d38c30c0SXin LI#
344d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/OLE2
345d38c30c0SXin LI>>>80 	ubequad		0x0b0d020000000000	Outlook 97-2003 item
346d38c30c0SXin LI#>>>80 	ubequad		0x0b0d020000000000	Outlook 97-2003 Message
347d38c30c0SXin LI#!:mime	application/vnd.ms-outlook
348d38c30c0SXin LI!:mime	application/x-ms-msg
349d38c30c0SXin LI!:ext	msg
350d38c30c0SXin LI# URL:	https://wiki.fileformat.com/email/oft/
351d38c30c0SXin LI>>>80 	ubequad		0x46f0060000000000	Outlook 97-2003 item template
352d38c30c0SXin LI#!:mime	application/vnd.ms-outlook
353d38c30c0SXin LI!:mime	application/x-ms-oft
354d38c30c0SXin LI!:ext	oft
355d38c30c0SXin LI#
356d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/PPT
357d38c30c0SXin LI>>>80 	ubequad		0x5148040000000000	PowerPoint 4.0 presentation
358d38c30c0SXin LI!:mime	application/vnd.ms-powerpoint
359d38c30c0SXin LI# https://www.macdisk.com/macsigen.php
360d38c30c0SXin LI!:apple	????PPT3
361d38c30c0SXin LI!:ext	ppt
362d38c30c0SXin LI#??
363d38c30c0SXin LI# URL:	http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/
364d38c30c0SXin LI>>88 	ubequad		0xa29a00aa004a1a72	: Microsoft
365d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
366d38c30c0SXin LI>>>80 	ubequad		0xc2dbcd28e20ace11	Works 4 document
367d38c30c0SXin LI!:mime	application/vnd.ms-works
368d38c30c0SXin LI!:apple	????AWWP
369d38c30c0SXin LI!:ext	wps
370d38c30c0SXin LI#
371d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
372d38c30c0SXin LI>>>80 	ubequad		0xc3dbcd28e20ace11	Works 4 database
373d38c30c0SXin LI!:mime	application/vnd.ms-works-db
374d38c30c0SXin LI!:apple	????AWDB
375d38c30c0SXin LI!:ext	wdb/bdb
376d38c30c0SXin LI#??
377d38c30c0SXin LI>>88 	ubequad		0xa40700c04fb932ba	: Microsoft
378d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
379d38c30c0SXin LI>>>80 	ubequad		0xb25aa40e0a9ed111	Works 5-6 document
380d38c30c0SXin LI!:mime	application/vnd.ms-works
381d38c30c0SXin LI!:apple	????AWWP
382d38c30c0SXin LI!:ext	wps
383*43a5ec4eSXin LI# From:		Joerg Jenderek
384*43a5ec4eSXin LI# URL:		https://en.wikipedia.org/wiki/Microsoft_Works
385*43a5ec4eSXin LI# Reference:	http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
386*43a5ec4eSXin LI# Note:		probably version 6 and 7
387*43a5ec4eSXin LI# organize pictures like JPFG images in streams __cf1 with names like
388*43a5ec4eSXin LI# 001.JPG, 002.JPG ... in streams __fname
389*43a5ec4eSXin LI>>88 	ubequad		0xa1c800c04f612452	: Microsoft
390*43a5ec4eSXin LI>>>80 	ubequad		0xc0c7266eb98cd311	Works portfolio
391*43a5ec4eSXin LI# 2nd directory entry name PfOrder, 3rd __LastID and 4th __SizeUsed
392*43a5ec4eSXin LI#!:mime	application/x-ole-storage
393*43a5ec4eSXin LI# https://www.iana.org/assignments/media-types/application/vnd.ms-works
394*43a5ec4eSXin LI!:mime	application/vnd.ms-works
395*43a5ec4eSXin LI# https://extension.nirsoft.net/wsb
396*43a5ec4eSXin LI# like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb
397*43a5ec4eSXin LI!:ext	wsb
398d38c30c0SXin LI#??
399d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
400d38c30c0SXin LI>>88 	ubequad		0x00c0000000000046	: Microsoft
401d38c30c0SXin LI>>>80 	ubequad		0x0112020000000000	Publisher
402d38c30c0SXin LI!:mime	application/vnd.ms-publisher
403d38c30c0SXin LI!:ext	pub
404d38c30c0SXin LI#
405d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/PPT
406d38c30c0SXin LI#??
407d38c30c0SXin LI>>88 	ubequad		0xa90300aa00510ea3	: Microsoft
408d38c30c0SXin LI>>>80 	ubequad		0x70ae7bea3bfbcd11	PowerPoint 95 presentation
409d38c30c0SXin LI!:mime	application/vnd.ms-powerpoint
410d38c30c0SXin LI# https://www.macdisk.com/macsigen.php
411d38c30c0SXin LI!:apple	????PPT3
412d38c30c0SXin LI!:ext	ppt/pot
413d38c30c0SXin LI#??
414d38c30c0SXin LI>>88 	ubequad		0x86ea00aa00b929e8	: Microsoft
415d38c30c0SXin LI>>>80 	ubequad		0x108d81649b4fcf11	PowerPoint 97-2003 presentation or template
416d38c30c0SXin LI!:mime	application/vnd.ms-powerpoint
417d38c30c0SXin LI!:apple	????PPT3
418d38c30c0SXin LI# /autostart/template
419d38c30c0SXin LI!:ext	ppt/pps/pot
420d38c30c0SXin LI#
421d38c30c0SXin LI# URL:	https://en.wikipedia.org/wiki/Microsoft_Project
422d38c30c0SXin LI#??
423d38c30c0SXin LI>>88 	ubequad		0xbe1100c04fb6faf1	: Microsoft
424d38c30c0SXin LI>>>80 	ubequad		0x3a8fb774c8c8d111	Project
425d38c30c0SXin LI!:mime	application/vnd.ms-project
426d38c30c0SXin LI!:ext	mpp
427d38c30c0SXin LI#
428*43a5ec4eSXin LI# URL:		http://fileformats.archiveteam.org/wiki/WordPerfect
429*43a5ec4eSXin LI# Reference:	http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
430*43a5ec4eSXin LI#		https://github.com/OneWingedShark/WordPerfect/
431*43a5ec4eSXin LI#		blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm
432*43a5ec4eSXin LI# From:		Joerg Jenderek
433*43a5ec4eSXin LI# Note:		internal version x.2 or 2.2 like in embedded ole6-PerfectOffice_MAIN.wpd
434*43a5ec4eSXin LI# 3rd directory entry name PerfectOffice_OBJECT and 2nd PerfectOffice_MAIN,
435*43a5ec4eSXin LI# which contains WordPerfect document \xffWPC signature handled by ./wordprocessors
436*43a5ec4eSXin LI>>88 	ubequad		0x19370000929679cd	: WordPerfect 7
437*43a5ec4eSXin LI>>>80 	ubequad		0xff739851ad2d2002	Document
438*43a5ec4eSXin LI!:mime	application/vnd.wordperfect
439*43a5ec4eSXin LI#!:apple	????WPC?
440*43a5ec4eSXin LI# https://fossies.org/linux/wp2latex/test/ole6.wpd
441*43a5ec4eSXin LI!:ext	wpd
442*43a5ec4eSXin LI#>>>>0	search/0xc01/s	\xffWPC			\b, WPC SIGNATURE
443*43a5ec4eSXin LI# inspect embedded WordPerfect document by ./wordprocessors with 1 space at end
444*43a5ec4eSXin LI#>>>>>&0	indirect	x	\b; contains
445*43a5ec4eSXin LI# GRR: the above expression does not work correctly
446*43a5ec4eSXin LI#
447d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/SHW_(Corel)
448d38c30c0SXin LI#???
449d38c30c0SXin LI>>88 	ubequad		0x99ae04021c007002	: WordPerfect
450d38c30c0SXin LI>>>80 	ubequad		0x62fe2e4099191b10	7-X3 presentation
451d38c30c0SXin LI!:mime	application/x-corelpresentations
452d38c30c0SXin LI#!:mime	application/x-shw-viewer
453d38c30c0SXin LI#!:mime	image/x-presentations
454d38c30c0SXin LI!:ext	shw
455d38c30c0SXin LI#
456d38c30c0SXin LI# URL:	http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/
457d38c30c0SXin LI>>>80 	ubequad		0x60fe2e4099191b10	9 Graphic
458d38c30c0SXin LI#!:mime	application/x-wpg
459d38c30c0SXin LI#!:mime	image/x-wordperfect-graphics
460d38c30c0SXin LI!:mime	image/x-wpg
461d38c30c0SXin LI# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
462d38c30c0SXin LI!:apple	????WPC9
463d38c30c0SXin LI!:ext	wpg
464d38c30c0SXin LI#
465d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats
466d38c30c0SXin LI>>88 	ubequad		0x996104021c007002	: StarOffice
467d38c30c0SXin LI>>>80 	ubequad		0x407e5cdc5cb31b10	StarWriter 3.0 document or template
468d38c30c0SXin LI# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html
469d38c30c0SXin LI!:mime	application/x-starwriter
470d38c30c0SXin LI!:ext	sdw/vor
471d38c30c0SXin LI#
472d38c30c0SXin LI>>>80 	ubequad		0xa03f543fa6b61b10	StarCalc 3.0 spreadsheet or template
473d38c30c0SXin LI!:mime	application/x-starcalc
474d38c30c0SXin LI!:ext	sdc/vor
475d38c30c0SXin LI#
476d38c30c0SXin LI>>>80 	ubequad		0xe0aa10af6db31b10	StarDraw 3.0 drawing or template
477d38c30c0SXin LI!:mime	application/x-starimpress
478d38c30c0SXin LI#!:mime	application/x-stardraw
479d38c30c0SXin LI# sda ??
480d38c30c0SXin LI!:ext	sdd/sda/vor
481d38c30c0SXin LI#??
482d38c30c0SXin LI>>88 	ubequad		0x89cb008029e4b0b1	: StarOffice
483d38c30c0SXin LI>>>80 	ubequad		0x41d461633542d011	StarCalc 4.0 spreadsheet or template
484d38c30c0SXin LI!:mime	application/x-starcalc
485d38c30c0SXin LI!:ext	sdc/vor
486d38c30c0SXin LI#
487d38c30c0SXin LI>>>80 	ubequad		0x61b8a5c6d685d111	StarCalc 5.0 spreadsheet or template
488d38c30c0SXin LI!:mime	application/vnd.stardivision.cal
489d38c30c0SXin LI!:ext	sdc/vor
490d38c30c0SXin LI#
491d38c30c0SXin LI>>>80 	ubequad		0xc03c2d011642d011	StarImpress 4.0 presentation or template
492d38c30c0SXin LI!:mime	application/x-starimpress
493d38c30c0SXin LI!:ext	sdd/vor
494d38c30c0SXin LI#??
495d38c30c0SXin LI>>88 	ubequad		0xb12a04021c007002	: StarOffice
496d38c30c0SXin LI>>>80 	ubequad		0x600459d4fd351c10	StarMath 3.0
497d38c30c0SXin LI!:mime	application/x-starmath
498d38c30c0SXin LI!:ext	smf
499d38c30c0SXin LI#??
500d38c30c0SXin LI>>88 	ubequad		0x8e2c00001b4cc711	: StarOffice
501d38c30c0SXin LI>>>80 	ubequad		0xe0999cfb6d2c1c10	StarChart 3.0
502d38c30c0SXin LI!:mime	application/x-starchart
503d38c30c0SXin LI!:ext	sds
504d38c30c0SXin LI#??
505d38c30c0SXin LI>>88 	ubequad		0xa45e00a0249d57b1	: StarOffice
506d38c30c0SXin LI>>>80 	ubequad		0xb0e9048b0e42d011	StarWriter 4.0 document or template
507d38c30c0SXin LI!:mime	application/x-starwriter
508d38c30c0SXin LI!:ext	sdw/vor
509d38c30c0SXin LI#??
510d38c30c0SXin LI>>88 	ubequad		0x89ca008029e4b0b1	: StarOffice
511d38c30c0SXin LI>>>80 	ubequad		0xe1b7b3022542d011	StarMath 4.0
512d38c30c0SXin LI!:mime	application/x-starmath
513d38c30c0SXin LI!:ext	smf
514d38c30c0SXin LI#
515d38c30c0SXin LI>>>80 	ubequad		0xe0b7b3022542d011	StarChart 4.0
516d38c30c0SXin LI!:mime	application/x-starchart
517d38c30c0SXin LI!:ext	sds
518d38c30c0SXin LI#??
519d38c30c0SXin LI>>88 	ubequad		0xa53f00a0249d57b1	: StarOffice
520d38c30c0SXin LI>>>80 	ubequad		0x70c90a340de3d011	Master 4.0 document
521d38c30c0SXin LI!:mime	application/x-starwriter-global
522d38c30c0SXin LI!:ext	sgl
523d38c30c0SXin LI#??
524d38c30c0SXin LI>>88 	ubequad		0x89d0008029e4b0b1	: StarOffice
525d38c30c0SXin LI>>>80 	ubequad		0x40e6b5ffde85d111	StarMath 5.0
526d38c30c0SXin LI!:mime	application/vnd.stardivision.math
527d38c30c0SXin LI!:ext	smf
528d38c30c0SXin LI#
529d38c30c0SXin LI>>>80 	ubequad		0xa005892ebd85d111	StarDraw 5.0 drawing or template
530d38c30c0SXin LI!:mime	application/vnd.stardivision.draw
531d38c30c0SXin LI!:ext	sda/vor
532d38c30c0SXin LI#
533d38c30c0SXin LI>>>80 	ubequad		0x21725c56bc85d111	StarImpress 5.0 presentation or template
534d38c30c0SXin LI!:mime	application/vnd.stardivision.impress
535d38c30c0SXin LI# sda is used for what?
536d38c30c0SXin LI!:ext	sdd/vor/sda
537d38c30c0SXin LI#
538d38c30c0SXin LI>>>80 	ubequad		0x214388bfdd85d111	StarChart 5.0
539d38c30c0SXin LI!:mime	application/vnd.stardivision.chart
540d38c30c0SXin LI!:ext	sds
541d38c30c0SXin LI# ??
542d38c30c0SXin LI>>88 	ubequad		0xaab4006097da561a	: StarOffice
543d38c30c0SXin LI>>>80 	ubequad		0xd1f90cc2ae85d111	StarWriter 5.0 document or template
544d38c30c0SXin LI!:mime	application/vnd.stardivision.writer
545d38c30c0SXin LI!:ext	sdw/vor
546d38c30c0SXin LI#
547d38c30c0SXin LI>>>80 	ubequad		0xd3f90cc2ae85d111	Master 5.0 document
548d38c30c0SXin LI!:mime	application/vnd.stardivision.writer-global
549d38c30c0SXin LI!:ext	sgl
550d38c30c0SXin LI#??
551d38c30c0SXin LI# URL:	http://fileformats.archiveteam.org/wiki/FlashPix
552d38c30c0SXin LI>>88 	ubequad		0x855300aa00a1f95b	: Kodak
553d38c30c0SXin LI>>>80 	ubequad		0x0067615654c1ce11	FlashPIX Image
554d38c30c0SXin LI!:mime	image/vnd.fpx
555d38c30c0SXin LI!:apple	????FPix
556d38c30c0SXin LI!:ext	fpx
5572726a701SXin LI# URL:	https://en.wikipedia.org/wiki/SoftMaker_Office
5582726a701SXin LI>>88 	ubequad		0x95f600a0cc3cca14	: PlanMaker
5592726a701SXin LI>>>80 	ubequad		0x9174088a6452d411	document or template
5602726a701SXin LI!:mime	application/vnd.softmaker.planmaker
5612726a701SXin LI# pmv for template	https://www.file-extensions.org/pmv-file-extension
5622726a701SXin LI!:ext	pmd/pmv
563d38c30c0SXin LI# remaining non null clsid
564d38c30c0SXin LI>>88 	default		x			: UNKNOWN
565d38c30c0SXin LI!:mime	application/x-ole-storage
566*43a5ec4eSXin LI>>>80 	ubequad		!0			\b, clsid %#16.16llx
567d38c30c0SXin LI>>>88 	ubequad		x			\b%16.16llx
56858a0f0d0SEitan Adler
569