| archive (267897) | archive (275698) |
|---|---|
| 1#------------------------------------------------------------------------------ | 1#------------------------------------------------------------------------------ |
| 2# $File: archive,v 1.87 2014/06/03 19:15:58 christos Exp $ | 2# $File: archive,v 1.88 2014/08/16 10:42:17 christos Exp $ |
| 3# archive: file(1) magic for archive formats (see also "msdos" for self- 4# extracting compressed archives) 5# 6# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 7# pre-POSIX "tar" archives are handled in the C code. 8 9# POSIX tar archives 10257 string ustar\0 POSIX tar archive --- 938 unchanged lines hidden (view full) --- 949# 1~Image Disc only for *.gho implies Image Boot track and sector copy 950>>44 ubyte 1 \b, disc sector copy 951# optional image description only *.gho 952>>0xff string >\0 "%-.254s" 953# look for DOS sector end sequence 954>0xE08 search/7776 \x55\xAA 955>>&-512 indirect x \b; contains 956 | 3# archive: file(1) magic for archive formats (see also "msdos" for self- 4# extracting compressed archives) 5# 6# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 7# pre-POSIX "tar" archives are handled in the C code. 8 9# POSIX tar archives 10257 string ustar\0 POSIX tar archive --- 938 unchanged lines hidden (view full) --- 949# 1~Image Disc only for *.gho implies Image Boot track and sector copy 950>>44 ubyte 1 \b, disc sector copy 951# optional image description only *.gho 952>>0xff string >\0 "%-.254s" 953# look for DOS sector end sequence 954>0xE08 search/7776 \x55\xAA 955>>&-512 indirect x \b; contains 956 |
| 957# Symantec GHOST image by Joerg Jenderek at May 2014 958# http://us.norton.com/ghost/ 959# http://www.garykessler.net/library/file_sigs.html 9600 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image 961# *.GHO 962>2 ubyte&0x08 0x00 \b, first file 963# *.GHS or *.[0-9] with cns program option 964>2 ubyte&0x08 0x08 \b, split file 965# part of split index interesting for *.ghs 966>>4 ubyte x id=0x%x 967# compression tag minus one equals numeric compression command line switch z[1-9] 968>3 ubyte 0 \b, no compression 969>3 ubyte 2 \b, fast compression (Z1) 970>3 ubyte 3 \b, medium compression (Z2) 971>3 ubyte >3 972>>3 ubyte <11 \b, compression (Z%d-1) 973>2 ubyte&0x08 0x00 974# ~ 30 byte password field only for *.gho 975>>12 ubequad !0 \b, password protected 976>>44 ubyte !1 977# 1~Image All, sector-by-sector only for *.gho 978>>>10 ubyte 1 \b, sector copy 979# 1~Image Boot track only for *.gho 980>>>43 ubyte 1 \b, boot track 981# 1~Image Disc only for *.gho implies Image Boot track and sector copy 982>>44 ubyte 1 \b, disc sector copy 983# optional image description only *.gho 984>>0xff string >\0 "%-.254s" 985# look for DOS sector end sequence 986>0xE08 search/7776 \x55\xAA 987>>&-512 indirect x \b; contains | |