3# filesystems: file(1) magic for different filesystems 4# 50 name partid 6>0 ubyte 0x00 Unused 7>0 ubyte 0x01 12-bit FAT 8>0 ubyte 0x02 XENIX / 9>0 ubyte 0x03 XENIX /usr 10>0 ubyte 0x04 16-bit FAT, less than 32M 11>0 ubyte 0x05 extended partition 12>0 ubyte 0x06 16-bit FAT, more than 32M 13>0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX 14>0 ubyte 0x08 AIX or os, or etc. 15>0 ubyte 0x09 AIX boot partition or Coherent 16>0 ubyte 0x0a O/2 boot manager or Coherent swap 17>0 ubyte 0x0b 32-bit FAT 18>0 ubyte 0x0c 32-bit FAT, LBA-mapped 19>0 ubyte 0x0d 7XXX, LBA-mapped 20>0 ubyte 0x0e 16-bit FAT, LBA-mapped 21>0 ubyte 0x0f extended partition, LBA-mapped 22>0 ubyte 0x10 OPUS 23>0 ubyte 0x11 OS/2 DOS 12-bit FAT 24>0 ubyte 0x12 Compaq diagnostics 25>0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M 26>0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M 27>0 ubyte 0x17 OS/2 hidden IFS 28>0 ubyte 0x18 AST Windows swapfile 29>0 ubyte 0x19 Willowtech Photon coS 30>0 ubyte 0x1b hidden win95 fat 32 31>0 ubyte 0x1c hidden win95 fat 32 lba 32>0 ubyte 0x1d hidden win95 fat 16 lba 33>0 ubyte 0x20 Willowsoft OFS1 34>0 ubyte 0x21 reserved 35>0 ubyte 0x23 reserved 36>0 ubyte 0x24 NEC DOS 37>0 ubyte 0x26 reserved 38>0 ubyte 0x31 reserved 39>0 ubyte 0x32 Alien Internet Services NOS 40>0 ubyte 0x33 reserved 41>0 ubyte 0x34 reserved 42>0 ubyte 0x35 JFS on OS2 43>0 ubyte 0x36 reserved 44>0 ubyte 0x38 Theos 45>0 ubyte 0x39 Plan 9, or Theos spanned 46>0 ubyte 0x3a Theos ver 4 4gb partition 47>0 ubyte 0x3b Theos ve 4 extended partition 48>0 ubyte 0x3c PartitionMagic recovery 49>0 ubyte 0x3d Hidden Netware 50>0 ubyte 0x40 VENIX 286 or LynxOS 51>0 ubyte 0x41 PReP 52>0 ubyte 0x42 linux swap sharing DRDOS disk 53>0 ubyte 0x43 linux sharing DRDOS disk 54>0 ubyte 0x44 GoBack change utility 55>0 ubyte 0x45 Boot US Boot manager 56>0 ubyte 0x46 EUMEL/Elan or Ergos 3 57>0 ubyte 0x47 EUMEL/Elan or Ergos 3 58>0 ubyte 0x48 EUMEL/Elan or Ergos 3 59>0 ubyte 0x4a ALFX/THIN filesystem for DOS 60>0 ubyte 0x4c Oberon partition 61>0 ubyte 0x4d QNX4.x 62>0 ubyte 0x4e QNX4.x 2nd part 63>0 ubyte 0x4f QNX4.x 3rd part 64>0 ubyte 0x50 DM (disk manager) 65>0 ubyte 0x51 DM6 Aux1 (or Novell) 66>0 ubyte 0x52 CP/M or Microport SysV/AT 67>0 ubyte 0x53 DM6 Aux3 68>0 ubyte 0x54 DM6 DDO 69>0 ubyte 0x55 EZ-Drive (disk manager) 70>0 ubyte 0x56 Golden Bow (disk manager) 71>0 ubyte 0x57 Drive PRO 72>0 ubyte 0x5c Priam Edisk (disk manager) 73>0 ubyte 0x61 SpeedStor 74>0 ubyte 0x63 GNU HURD or Mach or Sys V/386 75>0 ubyte 0x64 Novell Netware 2.xx or Speedstore 76>0 ubyte 0x65 Novell Netware 3.xx 77>0 ubyte 0x66 Novell 386 Netware 78>0 ubyte 0x67 Novell 79>0 ubyte 0x68 Novell 80>0 ubyte 0x69 Novell 81>0 ubyte 0x70 DiskSecure Multi-Boot 82>0 ubyte 0x71 reserved 83>0 ubyte 0x73 reserved 84>0 ubyte 0x74 reserved 85>0 ubyte 0x75 PC/IX 86>0 ubyte 0x76 reserved 87>0 ubyte 0x77 M2FS/M2CS partition 88>0 ubyte 0x78 XOSL boot loader filesystem 89>0 ubyte 0x80 MINIX until 1.4a 90>0 ubyte 0x81 MINIX since 1.4b 91>0 ubyte 0x82 Linux swap or Solaris 92>0 ubyte 0x83 Linux native 93>0 ubyte 0x84 OS/2 hidden C: drive 94>0 ubyte 0x85 Linux extended partition 95>0 ubyte 0x86 NT FAT volume set 96>0 ubyte 0x87 NTFS volume set or HPFS mirrored 97>0 ubyte 0x8a Linux Kernel AiR-BOOT partition 98>0 ubyte 0x8b Legacy Fault tolerant FAT32 99>0 ubyte 0x8c Legacy Fault tolerant FAT32 ext 100>0 ubyte 0x8d Hidden free FDISK FAT12 101>0 ubyte 0x8e Linux Logical Volume Manager 102>0 ubyte 0x90 Hidden free FDISK FAT16 103>0 ubyte 0x91 Hidden free FDISK DOS EXT 104>0 ubyte 0x92 Hidden free FDISK FAT16 Big 105>0 ubyte 0x93 Amoeba filesystem 106>0 ubyte 0x94 Amoeba bad block table 107>0 ubyte 0x95 MIT EXOPC native partitions 108>0 ubyte 0x97 Hidden free FDISK FAT32 109>0 ubyte 0x98 Datalight ROM-DOS Super-Boot 110>0 ubyte 0x99 Mylex EISA SCSI 111>0 ubyte 0x9a Hidden free FDISK FAT16 LBA 112>0 ubyte 0x9b Hidden free FDISK EXT LBA 113>0 ubyte 0x9f BSDI? 114>0 ubyte 0xa0 IBM Thinkpad hibernation 115>0 ubyte 0xa1 HP Volume expansion (SpeedStor) 116>0 ubyte 0xa3 HP Volume expansion (SpeedStor) 117>0 ubyte 0xa4 HP Volume expansion (SpeedStor) 118>0 ubyte 0xa5 386BSD partition type 119>0 ubyte 0xa6 OpenBSD partition type 120>0 ubyte 0xa7 NeXTSTEP 486 121>0 ubyte 0xa8 Apple UFS 122>0 ubyte 0xa9 NetBSD partition type 123>0 ubyte 0xaa Olivetty Fat12 1.44MB Service part 124>0 ubyte 0xab Apple Boot 125>0 ubyte 0xae SHAG OS filesystem 126>0 ubyte 0xaf Apple HFS 127>0 ubyte 0xb0 BootStar Dummy 128>0 ubyte 0xb1 reserved 129>0 ubyte 0xb3 reserved 130>0 ubyte 0xb4 reserved 131>0 ubyte 0xb6 reserved 132>0 ubyte 0xb7 BSDI BSD/386 filesystem 133>0 ubyte 0xb8 BSDI BSD/386 swap 134>0 ubyte 0xbb Boot Wizard Hidden 135>0 ubyte 0xbe Solaris 8 partition type 136>0 ubyte 0xbf Solaris partition type 137>0 ubyte 0xc0 CTOS 138>0 ubyte 0xc1 DRDOS/sec (FAT-12) 139>0 ubyte 0xc2 Hidden Linux 140>0 ubyte 0xc3 Hidden Linux swap 141>0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) 142>0 ubyte 0xc5 DRDOS/sec (EXT) 143>0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) 144>0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled 145>0 ubyte 0xc8 Reserved for DR-DOS 8.0+ 146>0 ubyte 0xc9 Reserved for DR-DOS 8.0+ 147>0 ubyte 0xca Reserved for DR-DOS 8.0+ 148>0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS 149>0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA 150>0 ubyte 0xcd CTOS Memdump 151>0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA 152>0 ubyte 0xcf DR-DOS 7.04+ EXT LBA 153>0 ubyte 0xd0 REAL/32 secure big partition 154>0 ubyte 0xd1 Old Multiuser DOS FAT12 155>0 ubyte 0xd4 Old Multiuser DOS FAT16 Small 156>0 ubyte 0xd5 Old Multiuser DOS Extended 157>0 ubyte 0xd6 Old Multiuser DOS FAT16 Big 158>0 ubyte 0xd8 CP/M 86 159>0 ubyte 0xdb CP/M or Concurrent CP/M 160>0 ubyte 0xdd Hidden CTOS Memdump 161>0 ubyte 0xde Dell PowerEdge Server utilities 162>0 ubyte 0xdf DG/UX virtual disk manager 163>0 ubyte 0xe0 STMicroelectronics ST AVFS 164>0 ubyte 0xe1 DOS access or SpeedStor 12-bit 165>0 ubyte 0xe3 DOS R/O or Storage Dimensions 166>0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. 167>0 ubyte 0xe5 reserved 168>0 ubyte 0xe6 reserved 169>0 ubyte 0xeb BeOS 170>0 ubyte 0xee GPT Protective MBR 171>0 ubyte 0xef EFI system partition 172>0 ubyte 0xf0 Linux PA-RISC boot loader 173>0 ubyte 0xf1 SpeedStor or Storage Dimensions 174>0 ubyte 0xf2 DOS 3.3+ Secondary 175>0 ubyte 0xf3 reserved 176>0 ubyte 0xf4 SpeedStor large partition 177>0 ubyte 0xf5 Prologue multi-volumen partition 178>0 ubyte 0xf6 reserved 179>0 ubyte 0xf9 pCache: ext2/ext3 persistent cache 180>0 ubyte 0xfa Bochs x86 emulator 181>0 ubyte 0xfb VMware File System 182>0 ubyte 0xfc VMware Swap 183>0 ubyte 0xfd Linux RAID partition persistent sb 184>0 ubyte 0xfe LANstep or IBM PS/2 IML 185>0 ubyte 0xff Xenix Bad Block Table 186 1870 string \366\366\366\366 PC formatted floppy with no filesystem 188# Sun disk labels 189# From /usr/include/sun/dklabel.h: 1900774 beshort 0xdabe 191# modified by Joerg Jenderek, because original test 192# succeeds for Cabinet archive dao360.dl_ with negative blocks 193>0770 long >0 Sun disk label 194>>0 string x '%s 195>>>31 string >\0 \b%s 196>>>>63 string >\0 \b%s 197>>>>>95 string >\0 \b%s 198>>0 string x \b' 199>>0734 short >0 %d rpm, 200>>0736 short >0 %d phys cys, 201>>0740 short >0 %d alts/cyl, 202>>0746 short >0 %d interleave, 203>>0750 short >0 %d data cyls, 204>>0752 short >0 %d alt cyls, 205>>0754 short >0 %d heads/partition, 206>>0756 short >0 %d sectors/track, 207>>0764 long >0 start cyl %d, 208>>0770 long x %d blocks 209# Is there a boot block written 1 sector in? 210>512 belong&077777777 0600407 \b, boot block present 211 212# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk 213# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 2140 string SBMBAKUP_ Smart Boot Manager backup file 215>9 string x \b, version %-5.5s 216>>14 string =_ 217>>>15 string x %-.1s 218>>>>16 string =_ \b. 219>>>>>17 string x \b%-.1s 220>>>>>>18 string =_ \b. 221>>>>>>>19 string x \b%-.1s 222>>>22 ubyte 0 223>>>>21 ubyte x \b, from drive 0x%x 224>>>22 ubyte >0 225>>>>21 string x \b, from drive %s 226>>>535 search/17 \x55\xAA 227>>>>&-512 indirect x \b; contains 228 229# updated by Joerg Jenderek at Nov 2012 230# DOS Emulator image is 128 byte, null right padded header + harddisc image 2310 string DOSEMU\0 232>0x27E leshort 0xAA55 233#offset is 128 234>>19 ubyte 128 235>>>(19.b-1) ubyte 0x0 DOS Emulator image 236>>>>7 ulelong >0 \b, %u heads 237>>>>11 ulelong >0 \b, %d sectors/track 238>>>>15 ulelong >0 \b, %d cylinders 239>>>>128 indirect x \b; contains 240 241# added by Joerg Jenderek at Nov 2012 242# http://www.thenakedpc.com/articles/v04/08/0408-05.html 243# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 2440 string PNCIHISK\0 Norton Utilities disc image data 245# real x86 boot sector with jump instruction 246>509 search/1026 \x55\xAA\xeb 247>>&-1 indirect x \b; contains 248# http://file-extension.net/seeker/file_extension_dat 2490 string PNCIUNDO Norton Disk Doctor UnDo file 250# 251 252# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013 253# for any allowed sector sizes 25430 search/481 \x55\xAA 255# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) 256# DOS BPB information (70) and after DOS floppy (120) like in previous file version 257!:strength +65 258# for sector sizes < 512 Bytes 259>11 uleshort <512 260>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector 261# for sector sizes with 512 or more Bytes 262>0x1FE leshort 0xAA55 DOS/MBR boot sector 263>2 string OSBS OS/BS MBR 264# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/ 265# and http://en.wikipedia.org/wiki/Master_Boot_Record 266# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by 267# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 268>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR 269# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) 270# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld 271>>8 ubequad 0x8bf45007501ffbfc 272# http://thestarman.pcministry.com/asm/mbr/200MBR.htm 273>>>0x16 ubyte 0xF3 \b,DOS 2 274>>>>219 regex Author\ -\ Author: 275# found "David Litton" , "A Pehrsson " 276>>>>>&0 string x "%s" 277>>>0x16 ubyte 0xF2 278# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm 279# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz 280>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 281# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) 282>>>>0x22 default x \b,D0S version 3.3-7.0 283# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) 284# where nn is string offset varying for different languages 285# "Invalid partition table" nn=0x8b for english version 286>>>>>(0x49.b) string Invalid\ partition\ table english 287>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german 288>>>>>(0x49.b) string Table\ de\ partition\ invalide french 289>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese 290>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish 291>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian 292>>>>>0x49 ubyte >0 at offset 0x%x 293>>>>>>(0x49.b) string >\0 "%s" 294# "Error loading operating system" nn=0xa3 for english version 295# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version 296# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version 297# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version 298# "Error al cargar sistema operativo" nn=0xa8 for spanish version 299# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version 300>>>>>0x74 ubyte >0 at offset 0x%x 301>>>>>>(0x74.b) string >\0 "%s" 302# "Missing operating system" nn=0xc2 for english version 303# "Betriebssystem fehlt" nn=0xcd for german version 304# "Syst\212me d'exploitation absent" nn=0xd2 for french version 305# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version 306# "Falta sistema operativo" nn=0xca for spanish version 307# "Sistema operativo mancante" nn=0xe2 for italian version 308>>>>>0x79 ubyte >0 at offset 0x%x 309>>>>>>(0x79.b) string >\0 "%s" 310# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) 311# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b 312>>8 ubequad 0x5007501ffcbe1b7c 313# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 314>>>24 ubequad 0xf3a4cbbebe07b104 9M 315# "Invalid partition table" nn=0x10F for english version 316# "Ung\201ltige Partitionstabelle" nn=0x10F for german version 317# "Table de partition erron\202e" nn=0x10F for french version 318# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version 319>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english 320>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german 321>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french 322>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian 323>>>>0x3C ubyte x at offset 0x%x+0xFF 324>>>>(0x3C.b+0x0FF) string >\0 "%s" 325# "Error loading operating system" nn=0x127 for english version 326# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version 327# "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version 328# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version 329>>>>0xBD ubyte x at offset 0x1%x 330>>>>(0xBD.b+0x100) string >\0 "%s" 331# "Missing operating system" nn=0x146 for english version 332# "Betriebssystem fehlt" nn=0x151 for german version 333# "Syst\212me d'exploitation manquant" nn=0x15e for french version 334# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version 335>>>>0xA9 ubyte x at offset 0x1%x 336>>>>(0xA9.b+0x100) string >\0 "%s" 337# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm 338# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 339>>>24 ubequad 0xf3a4cbbdbe07b104 XP 340# where xxyyzz are lower bits from offsets of error messages varying for different languages 341>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english 342>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german 343# "Invalid partition table" xx=0x12C for english version 344# "Ung\201ltige Partitionstabelle" xx=0x12C for german version 345>>>>0x1b5 ubyte >0 at offset 0x1%x 346>>>>(0x1b5.b+0x100) string >\0 "%s" 347# "Error loading operating system" yy=0x144 for english version 348# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version 349>>>>0x1b6 ubyte >0 at offset 0x1%x 350>>>>(0x1b6.b+0x100) string >\0 "%s" 351# "Missing operating system" zz=0x163 for english version 352# "Betriebssystem nicht vorhanden" zz=0x16e for german version 353>>>>0x1b7 ubyte >0 at offset 0x1%x 354>>>>(0x1b7.b+0x100) string >\0 "%s" 355# Microsoft Windows Vista or 7 356# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 357>>8 ubequad 0xc08ed8be007cbf00 358# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) 359# assembler instructions: jnz 0729;cmp ebx,"TCPA" 360>>>0xEC ubequad 0x753b6681fb544350 Vista 361# where xxyyzz are lower bits from offsets of error messages varying for different languages 362>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english 363#>>>>0x1B4 ubelong&0x00FFFFFF ? german 364# "Invalid partition table" xx=0x162 for english version 365# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 366>>>>0x1b5 ubyte >0 at offset 0x1%x 367>>>>(0x1b5.b+0x100) string >\0 "%s" 368# "Error loading operating system" yy=0x17a for english version 369# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version 370>>>>0x1b6 ubyte >0 at offset 0x1%x 371>>>>(0x1b6.b+0x100) string >\0 "%s" 372# "Missing operating system" zz=0x199 for english version 373# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 374>>>>0x1b7 ubyte >0 at offset 0x1%x 375>>>>(0x1b7.b+0x100) string >\0 "%s" 376# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm) 377# assembler instructions: cmp ebx,"TCPA";cmp 378>>>0xEC ubequad 0x6681fb5443504175 Windows 7 379# where xxyyzz are lower bits from offsets of error messages varying for different languages 380>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english 381#>>>>0x1B4 ubelong&0x00FFFFFF ? german 382# "Invalid partition table" xx=0x163 for english version 383# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 384>>>>0x1b5 ubyte >0 at offset 0x1%x 385>>>>(0x1b5.b+0x100) string >\0 "%s" 386# "Error loading operating system" yy=0x17b for english version 387# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version 388>>>>0x1b6 ubyte >0 at offset 0x1%x 389>>>>(0x1b6.b+0x100) string >\0 "%s" 390# "Missing operating system" zz=0x19a for english version 391# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 392>>>>0x1b7 ubyte >0 at offset 0x1%x 393>>>>(0x1b7.b+0x100) string >\0 "%s" 394# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs 395# http://en.wikipedia.org/wiki/MBR_disk_signature#ID 396>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x 397# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm 398>>0xDA uleshort 0 399>>>0xDC ulelong >0 \b, created 400# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive 401>>>>0xDC ubyte x with driveID 0x%x 402# hours, minutes and seconds 403>>>>0xDf ubyte x at %x 404>>>>0xDe ubyte x \b:%x 405>>>>0xDd ubyte x \b:%x 406# special case for Microsoft MS-DOS 3.21 spanish 407# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov 408>0 ubequad 0xfab830008ed0bc00 409# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov 410>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish 411# Microsoft MBR IPL end 412 413# dr-dos with some upper-, lowercase variants 414>0x9D string Invalid\ partition\ table$ 415>>181 string No\ Operating\ System$ 416>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 417>0x9D string Invalid\ partition\ table$ 418>>181 string No\ operating\ system$ 419>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 420>342 string Invalid\ partition\ table$ 421>>366 string No\ operating\ system$ 422>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 423>295 string NEWLDR\0 424>>302 string Bad\ PT\ $ 425>>>310 string No\ OS\ $ 426>>>>317 string OS\ load\ err$ 427>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 428>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 429>>>>>>>387 string Copyright\ (c)\ 1984,1998 430>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 431# 432# tests for different MS-DOS Master Boot Records (MBR) moved and merged 433# 434#>0x145 string Default:\ F \b, FREE-DOS MBR 435#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 436>0x145 search/7 Default:\ F \b, FREE-DOS MBR 437#>>313 string F0\ .\ .\ . 438#>>>322 string disk\ 1 439#>>>>382 string FAT3 440>64 string no\ active\ partition\ found 441>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 442# Ranish Partition Manager http://www.ranish.com/part/ 443>387 search/4 \0\ Error!\r 444>>378 search/7 Virus! 445>>>397 search/4 Booting\ 446>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 447>>>>>416 string Writing\ changes... \b2.37 448>>>>>>438 ubyte x \b,0x%x dots 449>>>>>>440 ubyte >0 \b,virus check 450>>>>>>441 ubyte >0 \b,partition %c 451#2.38,2.42,2.44 452>>>>>416 string !Writing\ changes... \b 453>>>>>>418 ubyte 1 \bvirus check, 454>>>>>>419 ubyte x \b0x%x seconds 455>>>>>>420 ubyte&0x0F >0 \b,partition 456>>>>>>>420 ubyte&0x0F <5 \b %x 457>>>>>>>420 ubyte&0x0F 0Xf \b ask 458>>>>>420 ubyte x \b) 459# 460# SYSLINUX MBR moved 461# http://www.acronis.de/ 462>362 string MBR\ Error\ \0\r 463>>376 string ress\ any\ key\ to\ 464>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 465# added by Joerg Jenderek 466# http://www.visopsys.org/ 467# http://partitionlogic.org.uk/ 468>309 string No\ bootable\ partition\ found\r 469>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 470>349 string No\ bootable\ partition\ found\r 471>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 472# bootloader, bootmanager 473>0x40 string SBML 474# label with 11 characters of FAT 12 bit filesystem 475>>43 string SMART\ BTMGR 476>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 477# OEM-ID not always "SBM" 478#>>>>3 strings SBM 479>>>>6 string >\0 \b, version %s 480>382 string XOSLLOADXCF \b, eXtended Operating System Loader 481>6 string LILO \b, LInux i386 boot LOader 482>>120 string LILO \b, version 22.3.4 SuSe 483>>172 string LILO \b, version 22.5.8 Debian 484# updated by Joerg Jenderek at Oct 2008 485# variables according to grub-0.97/stage1/stage1.S or 486# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 487# usual values are marked with comments to get only informations of strange GRUB loaders 488>342 search/60 \0Geom\0 489#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 490>>0x41 ubyte <2 491>>>0x3E ubyte >2 \b; GRand Unified Bootloader 492# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 493>>>>0x3E ubyte x \b, stage1 version 0x%x 494#If it is 0xFF, use a drive passed by BIOS 495>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 496# in most case 0,1,0x2e for GRUB 0.5.95 497>>>>0x41 ubyte >0 \b, LBA flag 0x%x 498>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 499#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 500>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 501#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 502>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 503>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 504#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 505>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 506>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 507>>>>>394 string stage1 \b, GRUB version 0.5.95 508>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 509>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 510>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 511>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 512>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 513>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 514>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 515>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 516# unknown version 517>>>343 string Geom\0Read\0\ Error\0 518>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 519>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 520>>>>374 string GRUB\ \0 \b, GRUB version n.m 521# SYSLINUX bootloader moved 522>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 523# http://www.bcdwb.de/bcdw/index_e.htm 524>3 string BCDL 525>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 526# mbr partition table entries updated by Joerg Jenderek at Sep 2013 527# skip Norton Utilities disc image data 528>3 string !IHISK 529# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax; 530>>0 belong !0xb8c0078e 531# not Linux kernel 532>>>514 string !HdrS 533# not BeOS 534>>>>422 string !Be\ Boot\ Loader 535>>>>>32769 string CD001 536>>>>>>0 use cdrom 537# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr 538>>>>>0 ubelong&0xFD000000 =0xE9000000 539# AdvanceMAME mbr 540>>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e 541>>>>>>>446 use partition-table 542# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader 543>>>>>0 ubelong&0xFD000000 !0xE9000000 544# skip FSInfosector 545>>>>>>0 string !RRaA 546# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, 547# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm 548>>>>>>>0 ubequad !0xfa660fb64610668b 549# skip 13rd sector of MS x86 bootloader 550>>>>>>>>0 ubequad !0x660fb64610668b4e 551# skip sector starting with DOS new line 552>>>>>>>>>0 string !\r\n 553# allowed active flag 0,80h-FFh 554>>>>>>>>>>446 ubyte 0 555>>>>>>>>>>>446 use partition-table 556>>>>>>>>>>446 ubyte >0x7F 557>>>>>>>>>>>446 use partition-table 558# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries 559# mbr partition table entries end 560# http://www.acronis.de/ 561#FAT label=ACRONIS\ SZ 562#OEM-ID=BOOTWIZ0 563>442 string Non-system\ disk,\ 564>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 565# updated by Joerg Jenderek at Nov 2012, Sep 2013 566# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes 567# display 1 space 568>>>447 ubyte x \b 569>>>477 use DOS-filename 570# 571>185 string FDBOOT\ Version\ 572>>204 string \rNo\ Systemdisk.\ 573>>>220 string Booting\ from\ harddisk.\n\r 574>>>245 string Cannot\ load\ from\ harddisk.\n\r 575>>>>273 string Insert\ Systemdisk\ 576>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 577>>>>>>200 string >\0 \b, version %-3s 578>242 string Bootsector\ from\ C.H.\ Hochst\204 579# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c 580# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string 581# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut 582>242 search/127 Bootsector\ from\ C.H.\ Hochst 583>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk 584# followed by variants with point,CR-NL or NL-CR 585>>>208 search/261 Cannot\ load\ from\ harddisk. 586# followed by variants CR-NL or NL-CR 587>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. 588# followed by variants with point,CR-NL or NL-CR 589>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader 590# followed by string like "6.50 (c) 1993-2004 Gilles Vollant" 591>>>>>>&0 string x \b, version %-4.4s 592>(1.b+2) ubyte 0xe 593>>(1.b+3) ubyte 0x1f 594>>>(1.b+4) ubyte 0xbe 595# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others 596>>>>(1.b+5) ubyte&0xd3 0x53 597>>>>>(1.b+6) ubyte 0x7c 598# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, 599>>>>>>(1.b+7) ubyte 0xac 600>>>>>>>(1.b+8) ubyte 0x22 601>>>>>>>>(1.b+9) ubyte 0xc0 602>>>>>>>>>(1.b+10) ubyte 0x74 603>>>>>>>>>>(1.b+11) ubyte 0x0b 604>>>>>>>>>>>(1.b+12) ubyte 0x56 605>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 606# FAT1X version 607>>>>>>>>>>>>>(1.b+5) ubyte 0x5b 608>>>>>>>>>>>>>>0x5b string >\0 "%-s" 609# FAT32 version 610>>>>>>>>>>>>>(1.b+5) ubyte 0x77 611>>>>>>>>>>>>>>0x77 string >\0 "%-s" 612>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 613#>>244 string from\ dosemu-freedos-*-bin.tgz\r 614#>>>170 string Sorry,\ could\ not\ load\ an\ 615#>>>>195 string operating\ system.\r\n 616# 617>103 string This\ is\ not\ a\ bootable\ disk.\ 618>>132 string Please\ insert\ a\ bootable\ 619>>>157 string floppy\ and\r\n 620>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 621# 622>66 string Solaris\ Boot\ Sector 623>>99 string Incomplete\ MDBoot\ load. 624>>>89 string Version \b, Sun Solaris Bootloader 625>>>>97 byte x version %c 626# 627>408 string OS/2\ !!\ SYS01475\r\0 628>>429 string OS/2\ !!\ SYS02025\r\0 629>>>450 string OS/2\ !!\ SYS02027\r\0 630>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 631# 632>409 string OS/2\ !!\ SYS01475\r\0 633>>430 string OS/2\ !!\ SYS02025\r\0 634>>>451 string OS/2\ !!\ SYS02027\r\0 635>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 636>112 string This\ disk\ is\ not\ bootable\r 637>>142 string If\ you\ wish\ to\ make\ it\ bootable 638>>>176 string run\ the\ DOS\ program\ SYS\ 639>>>200 string after\ the\r 640>>>>216 string system\ has\ been\ loaded\r\n 641>>>>>242 string Please\ insert\ a\ DOS\ diskette\ 642>>>>>271 string into\r\n\ the\ drive\ and\ 643>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 644# XP 645>430 string NTLDR\ is\ missing\xFF\r\n 646>>449 string Disk\ error\xFF\r\n 647>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 648# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 649>>>>417 ubyte&0xDF >0 650>>>>>417 string x %-.5s 651>>>>>>422 ubyte&0xDF >0 652>>>>>>>422 string x \b%-.3s 653>>>>>425 ubyte&0xDF >0 654>>>>>>425 string >\ \b.%-.3s 655# 656>>>>371 ubyte >0x20 657>>>>>368 ubyte&0xDF >0 658>>>>>>368 string x %-.5s 659>>>>>>>373 ubyte&0xDF >0 660>>>>>>>>373 string x \b%-.3s 661>>>>>>376 ubyte&0xDF >0 662>>>>>>>376 string x \b.%-.3s 663# 664>430 string NTLDR\ nicht\ gefunden\xFF\r\n 665>>453 string Datentr\204gerfehler\xFF\r\n 666>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 667>>>>417 ubyte&0xDF >0 668>>>>>417 string x %-.5s 669>>>>>>422 ubyte&0xDF >0 670>>>>>>>422 string x \b%-.3s 671>>>>>425 ubyte&0xDF >0 672>>>>>>425 string >\ \b.%-.3s 673# offset variant 674>>>>379 string \0 675>>>>>368 ubyte&0xDF >0 676>>>>>>368 string x %-.5s 677>>>>>>>373 ubyte&0xDF >0 678>>>>>>>>373 string x \b%-.3s 679# 680>430 string NTLDR\ fehlt\xFF\r\n 681>>444 string Datentr\204gerfehler\xFF\r\n 682>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 683>>>>417 ubyte&0xDF >0 684>>>>>417 string x %-.5s 685>>>>>>422 ubyte&0xDF >0 686>>>>>>>422 string x \b%-.3s 687>>>>>425 ubyte&0xDF >0 688>>>>>>425 string >\ \b.%-.3s 689# variant 690>>>>371 ubyte >0x20 691>>>>>368 ubyte&0xDF >0 692>>>>>>368 string x %-.5s 693>>>>>>>373 ubyte&0xDF >0 694>>>>>>>>373 string x \b%-.3s 695>>>>>>376 ubyte&0xDF >0 696>>>>>>>376 string x \b.%-.3s 697# 698>430 string NTLDR\ fehlt\xFF\r\n 699>>444 string Medienfehler\xFF\r\n 700>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 701>>>>371 ubyte >0x20 702>>>>>368 ubyte&0xDF >0 703>>>>>>368 string x %-.5s 704>>>>>>>373 ubyte&0xDF >0 705>>>>>>>>373 string x \b%-.3s 706>>>>>>376 ubyte&0xDF >0 707>>>>>>>376 string x \b.%-.3s 708# variant 709>>>>417 ubyte&0xDF >0 710>>>>>417 string x %-.5s 711>>>>>>422 ubyte&0xDF >0 712>>>>>>>422 string x \b%-.3s 713>>>>>425 ubyte&0xDF >0 714>>>>>>425 string >\ \b.%-.3s 715# 716>430 string Datentr\204ger\ entfernen\xFF\r\n 717>>454 string Medienfehler\xFF\r\n 718>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 719>>>>379 string \0 720>>>>>368 ubyte&0xDF >0 721>>>>>>368 string x %-.5s 722>>>>>>>373 ubyte&0xDF >0 723>>>>>>>>373 string x \b%-.3s 724>>>>>>376 ubyte&0xDF >0 725>>>>>>>376 string x \b.%-.3s 726# variant 727>>>>417 ubyte&0xDF >0 728>>>>>417 string x %-.5s 729>>>>>>422 ubyte&0xDF >0 730>>>>>>>422 string x \b%-.3s 731>>>>>425 ubyte&0xDF >0 732>>>>>>425 string >\ \b.%-.3s 733# 734 735#>3 string NTFS\ \ \ \ 736>389 string Fehler\ beim\ Lesen\ 737>>407 string des\ Datentr\204gers 738>>>426 string NTLDR\ fehlt 739>>>>440 string NTLDR\ ist\ komprimiert 740>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 741#>3 string NTFS\ \ \ \ 742>313 string A\ disk\ read\ error\ occurred.\r 743>>345 string A\ kernel\ file\ is\ missing\ 744>>>370 string from\ the\ disk.\r 745>>>>484 string NTLDR\ is\ compressed 746>>>>>429 string Insert\ a\ system\ diskette\ 747>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 748# DOS loader variants different languages,offsets 749>472 ubyte&0xDF >0 750>>389 string Invalid\ system\ disk\xFF\r\n 751>>>411 string Disk\ I/O\ error 752>>>>428 string Replace\ the\ disk,\ and\ 753>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 754#IO.SYS 755>>>>>>472 ubyte&0xDF >0 756>>>>>>>472 string x \b %-.2s 757>>>>>>>>474 ubyte&0xDF >0 758>>>>>>>>>474 string x \b%-.5s 759>>>>>>>>>>479 ubyte&0xDF >0 760>>>>>>>>>>>479 string x \b%-.1s 761>>>>>>>480 ubyte&0xDF >0 762>>>>>>>>480 string x \b.%-.3s 763#MSDOS.SYS 764>>>>>>>483 ubyte&0xDF >0 \b+ 765>>>>>>>>483 string x \b%-.5s 766>>>>>>>>>488 ubyte&0xDF >0 767>>>>>>>>>>488 string x \b%-.3s 768>>>>>>>>491 ubyte&0xDF >0 769>>>>>>>>>491 string x \b.%-.3s 770# 771>>390 string Invalid\ system\ disk\xFF\r\n 772>>>412 string Disk\ I/O\ error\xFF\r\n 773>>>>429 string Replace\ the\ disk,\ and\ 774>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 775>>388 string Ungueltiges\ System\ \xFF\r\n 776>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 777>>>>427 string Datentraeger\ wechseln\ und\ 778>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 779#WINBOOT.SYS only not spaces (0xDF) 780>>>>>>497 ubyte&0xDF >0 781>>>>>>>497 string x %-.5s 782>>>>>>>>502 ubyte&0xDF >0 783>>>>>>>>>502 string x \b%-.1s 784>>>>>>>>>>503 ubyte&0xDF >0 785>>>>>>>>>>>503 string x \b%-.1s 786>>>>>>>>>>>>504 ubyte&0xDF >0 787>>>>>>>>>>>>>504 string x \b%-.1s 788>>>>>>505 ubyte&0xDF >0 789>>>>>>>505 string x \b.%-.3s 790#IO.SYS 791>>>>>>472 ubyte&0xDF >0 or 792>>>>>>>472 string x \b %-.2s 793>>>>>>>>474 ubyte&0xDF >0 794>>>>>>>>>474 string x \b%-.5s 795>>>>>>>>>>479 ubyte&0xDF >0 796>>>>>>>>>>>479 string x \b%-.1s 797>>>>>>>480 ubyte&0xDF >0 798>>>>>>>>480 string x \b.%-.3s 799#MSDOS.SYS 800>>>>>>>483 ubyte&0xDF >0 \b+ 801>>>>>>>>483 string x \b%-.5s 802>>>>>>>>>488 ubyte&0xDF >0 803>>>>>>>>>>488 string x \b%-.3s 804>>>>>>>>491 ubyte&0xDF >0 805>>>>>>>>>491 string x \b.%-.3s 806# 807>>390 string Ungueltiges\ System\ \xFF\r\n 808>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 809>>>>429 string Datentraeger\ wechseln\ und\ 810>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 811#WINBOOT.SYS only not spaces (0xDF) 812>>>>>>497 ubyte&0xDF >0 813>>>>>>>497 string x %-.7s 814>>>>>>>>504 ubyte&0xDF >0 815>>>>>>>>>504 string x \b%-.1s 816>>>>>>505 ubyte&0xDF >0 817>>>>>>>505 string x \b.%-.3s 818#IO.SYS 819>>>>>>472 ubyte&0xDF >0 or 820>>>>>>>472 string x \b %-.2s 821>>>>>>>>474 ubyte&0xDF >0 822>>>>>>>>>474 string x \b%-.6s 823>>>>>>>480 ubyte&0xDF >0 824>>>>>>>>480 string x \b.%-.3s 825#MSDOS.SYS 826>>>>>>>483 ubyte&0xDF >0 \b+ 827>>>>>>>>483 string x \b%-.5s 828>>>>>>>>>488 ubyte&0xDF >0 829>>>>>>>>>>488 string x \b%-.3s 830>>>>>>>>491 ubyte&0xDF >0 831>>>>>>>>>491 string x \b.%-.3s 832# 833>>389 string Ungueltiges\ System\ \xFF\r\n 834>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 835>>>>428 string Datentraeger\ wechseln\ und\ 836>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 837# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 838>>>>>>472 string x %-.2s 839>>>>>>>474 ubyte&0xDF >0 840>>>>>>>>474 string x \b%-.5s 841>>>>>>>>479 ubyte&0xDF >0 842>>>>>>>>>479 string x \b%-.1s 843>>>>>>480 ubyte&0xDF >0 844>>>>>>>480 string x \b.%-.3s 845>>>>>>483 ubyte&0xDF >0 \b+ 846>>>>>>>483 string x \b%-.5s 847>>>>>>>488 ubyte&0xDF >0 848>>>>>>>>488 string x \b%-.2s 849>>>>>>>>490 ubyte&0xDF >0 850>>>>>>>>>490 string x \b%-.1s 851>>>>>>>491 ubyte&0xDF >0 852>>>>>>>>491 string x \b.%-.3s 853>479 ubyte&0xDF >0 854>>416 string Kein\ System\ oder\ 855>>>433 string Laufwerksfehler 856>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 857#IO.SYS 858>>>>>479 string x \b %-.2s 859>>>>>>481 ubyte&0xDF >0 860>>>>>>>481 string x \b%-.6s 861>>>>>487 ubyte&0xDF >0 862>>>>>>487 string x \b.%-.3s 863#MSDOS.SYS 864>>>>>>490 ubyte&0xDF >0 \b+ 865>>>>>>>490 string x \b%-.5s 866>>>>>>>>495 ubyte&0xDF >0 867>>>>>>>>>495 string x \b%-.3s 868>>>>>>>498 ubyte&0xDF >0 869>>>>>>>>498 string x \b.%-.3s 870# 871>376 search/41 Non-System\ disk\ or\ 872>>395 search/41 disk\ error\r 873>>>407 search/41 Replace\ and\ 874>>>>419 search/41 press\ \b, 875>>>>419 search/41 strike\ \b, old 876>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 877#449 Disk\ Boot\ failure\r MS 3.21 878#466 Boot\ Failure\r MS 3.30 879>>>>>468 search/18 \0 880#IO.SYS,IBMBIO.COM 881>>>>>>&0 string x \b %-.2s 882>>>>>>>&-20 ubyte&0xDF >0 883>>>>>>>>&-1 string x \b%-.4s 884>>>>>>>>>&-16 ubyte&0xDF >0 885>>>>>>>>>>&-1 string x \b%-.2s 886>>>>>>&8 ubyte&0xDF >0 \b. 887>>>>>>>&-1 string x \b%-.3s 888#MSDOS.SYS,IBMDOS.COM 889>>>>>>&11 ubyte&0xDF >0 \b+ 890>>>>>>>&-1 string x \b%-.5s 891>>>>>>>>&-6 ubyte&0xDF >0 892>>>>>>>>>&-1 string x \b%-.1s 893>>>>>>>>>>&-5 ubyte&0xDF >0 894>>>>>>>>>>>&-1 string x \b%-.2s 895>>>>>>>&7 ubyte&0xDF >0 \b. 896>>>>>>>>&-1 string x \b%-.3s 897>441 string Cannot\ load\ from\ harddisk.\n\r 898>>469 string Insert\ Systemdisk\ 899>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 900#>43 string \224R-LOADER\ \ SYS =label 901>54 string SYS 902>>324 string VASKK 903>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 904# 905>98 string Press\ a\ key\ to\ retry\0\r 906>>120 string Cannot\ find\ file\ \0\r 907>>>139 string Disk\ read\ error\0\r 908>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 909#DRBIOS.SYS 910>>>>>44 ubyte&0xDF >0 911>>>>>>44 string x \b %-.6s 912>>>>>>>50 ubyte&0xDF >0 913>>>>>>>>50 string x \b%-.2s 914>>>>>>52 ubyte&0xDF >0 915>>>>>>>52 string x \b.%-.3s 916# 917>70 string IBMBIO\ \ COM 918>>472 string Cannot\ load\ DOS!\ 919>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 920>>471 string Cannot\ load\ DOS\ 921>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 922#?? 923>444 string KERNEL\ \ SYS 924>>314 string BOOT\ error! \b, FREE-DOS Bootloader 925>499 string KERNEL\ \ SYS 926>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 927>449 string KERNEL\ \ SYS 928>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 929# 930>449 string Loading\ FreeDOS 931>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 932>>>497 ubyte&0xDF >0 933>>>>497 string x \b %-.6s 934>>>>>503 ubyte&0xDF >0 935>>>>>>503 string x \b%-.1s 936>>>>>>>504 ubyte&0xDF >0 937>>>>>>>>504 string x \b%-.1s 938>>>>505 ubyte&0xDF >0 939>>>>>505 string x \b.%-.3s 940# 941>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 942# 943>125 string Loading\ FreeDOS...\r 944>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 945>>>441 ubyte&0xDF >0 946>>>>441 string x \b %-.6s 947>>>>>447 ubyte&0xDF >0 948>>>>>>447 string x \b%-.1s 949>>>>>>>448 ubyte&0xDF >0 950>>>>>>>>448 string x \b%-.1s 951>>>>449 ubyte&0xDF >0 952>>>>>449 string x \b.%-.3s 953>124 string FreeDOS\0 954>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 955# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 956>>>497 ubyte&0xDF >0 957>>>>497 string x \b %-.6s 958>>>>>503 ubyte&0xDF >0 959>>>>>>503 string x \b%-.1s 960>>>>>>>504 ubyte&0xDF >0 961>>>>>>>>504 string x \b%-.1s 962>>>>505 ubyte&0xDF >0 963>>>>>505 string x \b.%-.3s 964>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 965>>>497 ubyte&0xDF >0 966>>>>497 string x \b %-.6s 967>>>>>503 ubyte&0xDF >0 968>>>>>>503 string x \b%-.1s 969>>>>>>>504 ubyte&0xDF >0 970>>>>>>>>504 string x \b%-.1s 971>>>>505 ubyte&0xDF >0 972>>>>>505 string x \b.%-.3s 973>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 974>>>497 ubyte&0xDF >0 975>>>>497 string x \b %-.6s 976>>>>>503 ubyte&0xDF >0 977>>>>>>503 string x \b%-.1s 978>>>>>>>504 ubyte&0xDF >0 979>>>>>>>>504 string x \b%-.1s 980>>>>505 ubyte&0xDF >0 981>>>>>505 string x \b.%-.3s 982>336 string Error!\ 983>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 984>>>497 ubyte&0xDF >0 985>>>>497 string x \b %-.6s 986>>>>>503 ubyte&0xDF >0 987>>>>>>503 string x \b%-.1s 988>>>>>>>504 ubyte&0xDF >0 989>>>>>>>>504 string x \b%-.1s 990>>>>505 ubyte&0xDF >0 991>>>>>505 string x \b.%-.3s 992# added by Joerg Jenderek 993# http://www.visopsys.org/ 994# http://partitionlogic.org.uk/ 995# OEM-ID=Visopsys 996>478 ulelong 0 997>>(1.b+326) string I/O\ Error\ reading\ 998>>>(1.b+344) string Visopsys\ loader\r 999>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 1000# http://alexfru.chat.ru/epm.html#bootprog 1001>494 ubyte >0x4D 1002>>495 string >E 1003>>>495 string <S 1004#OEM-ID is not reliable 1005>>>>3 string BootProg 1006# It just looks for a program file name at the root directory 1007# and loads corresponding file with following execution. 1008# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 1009>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 1010>>>>>499 use DOS-filename 1011#If the boot sector fails to read any other sector, 1012#it prints a very short message ("RE") to the screen and hangs the computer. 1013#If the boot sector fails to find needed program in the root directory, 1014#it also hangs with another message ("NF"). 1015>>>>>492 string RENF \b, FAT (12 bit) 1016>>>>>495 string RENF \b, FAT (16 bit) 1017#If the boot sector fails to read any other sector, 1018#it prints a very short message ("RE") to the screen and hangs the computer. 1019# x86 bootloader end 1020 1021# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 1022# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector 1023>0 string RRaA 1024>>0x1E4 string rrAa \b, FSInfosector 1025#>>0x1FC uleshort =0 SHOULD BE ZERO 1026>>>0x1E8 ulelong <0xffffffff \b, %u free clusters 1027>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u 1028 1029# updated by Joerg Jenderek at Sep 2007 1030>3 ubyte 0 1031#no active flag 1032>>446 ubyte 0 1033# partition 1 not empty 1034>>>450 ubyte >0 1035# partitions 3,4 empty 1036>>>>482 ubyte 0 1037>>>>>498 ubyte 0 1038# partition 2 ID=0,5,15 1039>>>>>>466 ubyte <0x10 1040>>>>>>>466 ubyte 0x05 \b, extended partition table 1041>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 1042>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 1043 1044# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 1045 1046>0x200 lelong 0x82564557 \b, BSD disklabel 1047 1048# by Joerg Jenderek at Apr 2013 1049# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension 1050# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 10510 name DOS-filename 1052# space=0x20 (00100000b) means empty 1053>0 ubyte&0xDF >0 1054>>0 ubyte x \b%c 1055>>>1 ubyte&0xDF >0 1056>>>>1 ubyte x \b%c 1057>>>>>2 ubyte&0xDF >0 1058>>>>>>2 ubyte x \b%c 1059>>>>>>>3 ubyte&0xDF >0 1060>>>>>>>>3 ubyte x \b%c 1061>>>>>>>>>4 ubyte&0xDF >0 1062>>>>>>>>>>4 ubyte x \b%c 1063>>>>>>>>>>>5 ubyte&0xDF >0 1064>>>>>>>>>>>>5 ubyte x \b%c 1065>>>>>>>>>>>>>6 ubyte&0xDF >0 1066>>>>>>>>>>>>>>6 ubyte x \b%c 1067>>>>>>>>>>>>>>>7 ubyte&0xDF >0 1068>>>>>>>>>>>>>>>>7 ubyte x \b%c 1069# DOS filename extension 1070>>8 ubyte&0xDF >0 \b. 1071>>>8 ubyte x \b%c 1072>>>>9 ubyte&0xDF >0 1073>>>>>9 ubyte x \b%c 1074>>>>>>10 ubyte&0xDF >0 1075>>>>>>>10 ubyte x \b%c 1076# Print 2 following DOS filenames from directory entry form 1077# like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 10780 name 2xDOS-filename 1079# display 1 space 1080>0 ubyte x \b 1081>0 use DOS-filename 1082>11 ubyte x \b+ 1083>11 use DOS-filename 1084 1085# http://en.wikipedia.org/wiki/Master_boot_record#PTE 1086# display standard partition table 10870 name partition-table 1088#>0 ubyte x PARTITION-TABLE 1089# test and display 1st til 4th partition table entry 1090>0 use partition-entry-test 1091>16 use partition-entry-test 1092>32 use partition-entry-test 1093>48 use partition-entry-test 1094# test for entry of partition table 10950 name partition-entry-test 1096# partition type ID > 0 1097>4 ubyte >0 1098# active flag 0 1099>>0 ubyte 0 1100>>>0 use partition-entry 1101# active flag 0x80, 0x81, ... 1102>>0 ubyte >0x7F 1103>>>0 use partition-entry 1104# Print entry of partition table 11050 name partition-entry 1106# partition type ID > 0 1107>4 ubyte >0 \b; partition 1108>>64 leshort 0xAA55 1 1109>>48 leshort 0xAA55 2 1110>>32 leshort 0xAA55 3 1111>>16 leshort 0xAA55 4 1112>>4 ubyte x : ID=0x%x 1113>>0 ubyte&0x80 0x80 \b, active 1114>>0 ubyte >0x80 0x%x 1115>>1 ubyte x \b, start-CHS ( 1116>>1 use partition-chs 1117>>5 ubyte x \b), end-CHS ( 1118>>5 use partition-chs 1119>>8 ulelong x \b), startsector %u 1120>>12 ulelong x \b, %u sectors 1121# Print cylinder,head,sector (CHS) of partition entry 11220 name partition-chs 1123# cylinder 1124>1 ubyte x \b0x 1125>1 ubyte&0xC0 0x40 \b1 1126>1 ubyte&0xC0 0x80 \b2 1127>1 ubyte&0xC0 0xC0 \b3 1128>2 ubyte x \b%x 1129# head 1130>0 ubyte x \b,%u 1131# sector 1132>1 ubyte&0x3F x \b,%u 1133 1134# FATX 11350 string FATX FATX filesystem data 1136 1137# romfs filesystems - Juan Cespedes <cespedes@debian.org> 11380 string -rom1fs- romfs filesystem, version 1 1139>8 belong x %d bytes, 1140>16 string x named %s. 1141 1142# netboot image - Juan Cespedes <cespedes@debian.org> 11430 lelong 0x1b031336L Netboot image, 1144>4 lelong&0xFFFFFF00 0 1145>>4 lelong&0x100 0x000 mode 2 1146>>4 lelong&0x100 0x100 mode 3 1147>4 lelong&0xFFFFFF00 !0 unknown mode 1148 11490x18b string OS/2 OS/2 Boot Manager 1150 1151# updated by Joerg Jenderek at Oct 2008 and Sep 2012 1152# http://syslinux.zytor.com/iso.php 1153# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 1154# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 11550 ulequad&0x909000007cc0eafa 0x909000007c40eafa 1156>631 search/689 ISOLINUX\ isolinux Loader 1157>>&0 string x (version %-4.4s) 1158# http://syslinux.zytor.com/pxe.php 1159# assembler instructions: jmp 7C05 11600 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) 1161# assembler instructions: pushfd;pushad 11620 ulelong 0x60669c66 pxelinux loader 1163# assembler instructions: jmp 05 11640 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) 1165# http://syslinux.zytor.com/wiki/index.php/SYSLINUX 11660 string LDLINUX\ SYS\ SYSLINUX loader 1167>12 string x (older version %-4.4s) 11680 string \r\nSYSLINUX\ SYSLINUX loader 1169>11 string x (version %-4.4s) 1170# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 1171# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 11720 ulelong&0x80909bEB 0x009018EB 1173# OEM-ID not always "SYSLINUX" 1174>434 search/47 Boot\ failed 1175# followed by \r\n\0 or :\ 1176>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) 1177>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) 1178>459 search/30 Boot\ error\r\n\0 1179>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) 1180# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 1181# assembler instructions: mov di,0600h;mov cx,0100h 118216 search/4 \xbf\x00\x06\xb9\x00\x01 1183# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) 1184!:strength +36 1185>94 search/249 Missing\ operating\ system 1186# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other 1187# skip Ranish MBR 1188>>408 search/4 HD1/\0 1189>>408 default x 1190>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR 1191# followed by "ing " or space 1192>>>>292 search/98 error 1193>>>>>&0 string \r (version 3.35 or older) 1194>>>>>&0 string .\r (version 3.52 or newer) 1195>>>>>&0 default x (version 3.36-3.51 ) 1196>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR 1197>>156 search/10 \0Boot\ partition\ not\ found\r\n 1198>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) 1199>>174 search/10 \0Missing\ OS\r\n 1200>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) 1201# SYSLINUX END 1202 1203# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 1204# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 12050 ubequad 0x31c08ed0bc007c8e 1206# mbr_bootsel magic before partition table not reliable with small ipl fragments 1207#>444 uleshort 0xb5e1 1208>0004 uleshort x 1209# ERRorTeXT 1210>>181 search/166 Error\ \0\r\n NetBSD mbr 1211# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS 1212>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x 1213# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx 1214>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector 1215# BOOT_EXTENDED definitions contains assembler instructions: 1216# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 1217>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended 1218# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al 1219>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO 1220# not TERSE_ERROR 1221>>>196 search/106 No\ active\ partition\0 1222>>>>&0 string Disk\ read\ error\0 1223>>>>>&0 string No\ operating\ system\0 \b,verbose 1224# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 1225>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS 1226# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 1227>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check 1228# assembler instructions: movw nametab,bx 1229>>>0x26 search/21 \xBB\x94\x07 1230# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf 1231>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 1232>>>>>181 search/166 Error\ \0 1233# "a: disk" , "Fn: diskn" or "NetBSD MBR boot" 1234>>>>>>&3 string x \b,"%s" 1235>>>446 use partition-table 1236# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html 1237# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 1238# assembler instructions: jmp short 0x58;nop;ASCII 12390 ubequad&0xeb58908000000000 0xeb58900000000000 1240# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, 1241>(1.b+2) ubequad 0xfa31c08ed88ec08e 1242# Error messages at end of code 1243>>376 string No\ operating\ system\r\n\0 1244>>>398 string Disk\ error\r\n\0FDD\0HDD\0 1245>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr 1246 1247# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ 1248# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 1249# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, 1250# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 12510 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC 1252# pointer to the data starting with Neil Turton signature string 1253>(0x1BC.s) string NDTmbr 1254>>&-14 string 1234F\0 Turton mbr ( 1255# parameters also viewed by install-mbr --list 1256>>>(0x1BC.s+7) ubyte x \b%u<= 1257>>>(0x1BC.s+9) ubyte x \bVersion<=%u 1258#>>>(0x1BC.s+8) ubyte x asm_flag_%x 1259>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix 1260# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode 1261>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk 1262#0x1~1,..,0x8~4,0x10~F,0x80~A enabled 1263#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x 1264#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot 1265#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x 1266# for older versions 1267>>>(0x1BC.s+9) ubyte <2 1268#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds 1269>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds 1270# floppy A: or B: 1271>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x 1272>>>>(0x1BC.s+13) ubyte >1 1273# 1st hard disc 1274#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x 1275# not 1st hard disc 1276>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x 1277# for version >= 2 maximal timeout can be 65534 1278>>>(0x1BC.s+9) ubyte >1 1279#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds 1280>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds 1281# floppy A: or B: 1282>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x 1283>>>>(0x1BC.s+14) ubyte >1 1284# 1st hard disc 1285#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x 1286# not 1st hard disc 1287>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x 1288>>>0 ubyte x \b) 1289 1290# added by Joerg Jenderek 1291# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 1292# grub-1.94/kern/i386/pc/startup.S 1293# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 1294# usual values are marked with comments to get only informations of strange GRUB loaders 12950x200 uleshort 0x70EA 1296# found only version 3.{1,2} 1297>0x206 ubeshort >0x0300 1298# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 1299>>0x212 ubyte >0x29 1300>>>0x213 ubyte >0x29 1301# not iso9660_stage1_5 1302#>>>0 ulelong&0x00BE5652 0x00BE5652 1303>>>>0x213 ubyte >0x29 GRand Unified Bootloader 1304# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 1305>>>>0x217 ubyte 0xFF stage1_5 1306>>>>0x217 ubyte <0xFF stage2 1307>>>>0x206 ubyte x \b version %u 1308>>>>0x207 ubyte x \b.%u 1309# module_size for 1.94 1310>>>>0x208 ulelong <0xffffff \b, installed partition %u 1311#>>>>0x208 ulelong =0xffffff \b, %lu (default) 1312>>>>0x208 ulelong >0xffffff \b, installed partition %u 1313# GRUB 0.5.95 unofficial 1314>>>>0x20C ulelong&0x2E300000 0x2E300000 1315# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 1316>>>>>0x20C ubyte x \b, identifier 0x%x 1317#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 1318>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 1319# GRUB version as string 1320>>>>>0x20E string >\0 \b, GRUB version %-s 1321# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 1322>>>>>>0x215 ulong 0xffffffff 1323>>>>>>>0x219 string >\0 \b, configuration file %-s 1324>>>>>>0x215 ulong !0xffffffff 1325>>>>>>>0x215 string >\0 \b, configuration file %-s 1326# newer GRUB versions 1327>>>>0x20C ulelong&0x2E300000 !0x2E300000 1328##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 1329>>>>>0x20C ulelong >0 \b, saved entry %d 1330# for 1.94 contains kernel image size 1331# for 0.93,0.94,0.96,0.97 1332# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 1333>>>>>0x210 ubyte x \b, identifier 0x%x 1334# The flag for LBA forcing is in most cases 0 1335#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 1336>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 1337# GRUB version as string 1338>>>>>0x212 string >\0 \b, GRUB version %-s 1339# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 1340>>>>>0x217 ulong 0xffffffff 1341>>>>>>0x21b string >\0 \b, configuration file %-s 1342>>>>>0x217 ulong !0xffffffff 1343>>>>>>0x217 string >\0 \b, configuration file %-s 1344 1345# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 1346# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 1347# over BIOS parameter block (BPB) 1348# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD 1349# older drives may use Near JuMP instruction E9 xx xx 1350# minimal short forward jump found 0x29 for bootloaders or 0x0 1351# maximal short forward jump is 0x7f 1352# OEM-ID is empty or contain readable bytes 13530 ulelong&0x804000E9 0x000000E9 1354!:strength +60 1355# mtools-3.9.8/msdos.h 1356# usual values are marked with comments to get only informations of strange FAT systems 1357# valid sectorsize must be a power of 2 from 32 to 32768 1358>11 uleshort&0x001f 0 1359>>11 uleshort <32769 1360>>>11 uleshort >31 1361>>>>21 ubyte&0xf0 0xF0 1362>>>>>0 ubyte 0xEB DOS/MBR boot sector 1363>>>>>>1 ubyte x \b, code offset 0x%x+2 1364>>>>>0 ubyte 0xE9 1365>>>>>>1 uleshort x \b, code offset 0x%x+3 1366>>>>>3 string >\0 \b, OEM-ID "%-.8s" 1367#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 1368>>>>>>8 string IHC \b cached by Windows 9M 1369>>>>>11 uleshort >512 \b, Bytes/sector %u 1370#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 1371>>>>>11 uleshort <512 \b, Bytes/sector %u 1372>>>>>13 ubyte >1 \b, sectors/cluster %u 1373#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 1374# for lazy FAT32 implementation like Transcend digital photo frame PF830 1375>>>>>82 string/c fat32 1376>>>>>>14 uleshort !32 \b, reserved sectors %u 1377#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 1378>>>>>82 string/c !fat32 1379>>>>>>14 uleshort >1 \b, reserved sectors %u 1380#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 1381#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) 1382>>>>>16 ubyte >2 \b, FATs %u 1383#>>>>>16 ubyte =2 \b, FATs %u (usual) 1384>>>>>16 ubyte =1 \b, FAT %u 1385>>>>>16 ubyte >0 1386>>>>>17 uleshort >0 \b, root entries %u 1387#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) 1388>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 1389#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) 1390>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 1391#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 1392>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 1393>>>>>22 uleshort >0 \b, sectors/FAT %u 1394#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) 1395>>>>>24 uleshort x \b, sectors/track %u 1396>>>>>26 ubyte >2 \b, heads %u 1397#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 1398>>>>>26 ubyte =1 \b, heads %u 1399# valid only for sector sizes with more then 32 Bytes 1400>>>>>11 uleshort >32 1401# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block 1402# skip for values 2,2Ah,70h,73h,DFh 1403# and continue for extended boot signature values 0,28h,29h,80h 1404>>>>>>38 ubyte&0x56 =0 1405>>>>>>>28 ulelong >0 \b, hidden sectors %u 1406#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 1407>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 1408#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 1409# FAT<32 bit specific 1410>>>>>>>82 string/c !fat32 1411#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 1412#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 1413>>>>>>>>36 ubyte !0x80 1414>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 1415# VGA-copy CRC or 1416# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 1417>>>>>>>>37 ubyte >0 \b, reserved 0x%x 1418#>>>>>>>>37 ubyte =0 \b, reserved 0x%x 1419# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others 1420>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 1421>>>>>>>>38 ubyte&0xFE =0x28 1422>>>>>>>>>39 ulelong x \b, serial number 0x%x 1423>>>>>>>>38 ubyte =0x29 1424>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 1425>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 1426>>>>>>>>>43 string =NO\ NAME \b, unlabeled 1427# there exist some old floppies without word FAT at offset 54 1428# a word like "FATnm " is only a hint for a FAT size on nm-bits 1429# Normally the number of clusters is calculated by the values of BPP. 1430# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, 1431# otherwise FAT is 16 bit. 1432# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html 1433>>>>>82 string/c !fat32 1434>>>>>>54 string FAT12 \b, FAT (12 bit) 1435>>>>>>54 string FAT16 \b, FAT (16 bit) 1436>>>>>>54 default x 1437# determinate FAT bit size by media descriptor 1438# small floppies implies FAT12 1439>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor) 1440# with media descriptor F0h floppy or maybe superfloppy with FAT16 1441>>>>>>>21 ubyte =0xF0 1442# superfloppy (many sectors) implies FAT16 1443>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors) 1444# no superfloppy with media descriptor F0h implies FAT12 1445>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors) 1446# with media descriptor F8h floppy or hard disc with FAT12 or FAT16 1447>>>>>>>21 ubyte =0xF8 1448# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12 1449>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry) 1450# hard disc with FAT12 or FAT16 1451>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 1452# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc 1453>>>>>>>21 ubyte =0xFA 1454# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12 1455>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry) 1456# RAM disc with FAT12 or FAT16 or Tandy hard disc 1457>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 1458# others are floppy 1459>>>>>>>21 default x \b, FAT (12 bit by descriptor) 1460# FAT32 bit specific 1461>>>>>82 string/c fat32 \b, FAT (32 bit) 1462>>>>>>36 ulelong x \b, sectors/FAT %u 1463# http://technet.microsoft.com/en-us/library/cc977221.aspx 1464>>>>>>40 uleshort >0 \b, extension flags 0x%x 1465#>>>>>>40 uleshort =0 \b, extension flags %hu 1466>>>>>>42 uleshort >0 \b, fsVersion %u 1467#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 1468>>>>>>44 ulelong >2 \b, rootdir cluster %u 1469#>>>>>>44 ulelong =2 \b, rootdir cluster %u 1470#>>>>>>44 ulelong =1 \b, rootdir cluster %u 1471>>>>>>48 uleshort >1 \b, infoSector %u 1472#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 1473>>>>>>48 uleshort <1 \b, infoSector %u 1474# 0 or 0xFFFF instead of usual 6 means no backup sector 1475>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector 1476>>>>>>50 uleshort =0 \b, no Backup boot sector 1477#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 1478>>>>>>50 default x 1479>>>>>>>50 uleshort x \b, Backup boot sector %u 1480# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 1481>>>>>>52 ulelong >0 \b, reserved1 0x%x 1482>>>>>>56 ulelong >0 \b, reserved2 0x%x 1483>>>>>>60 ulelong >0 \b, reserved3 0x%x 1484# same structure as FAT1X 1485#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 1486#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 1487>>>>>>64 ubyte !0x80 1488>>>>>>>64 ubyte >0 \b, physical drive 0x%x 1489# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 1490>>>>>>65 ubyte >0 \b, reserved 0x%x 1491>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 1492>>>>>>66 ubyte =0x29 1493>>>>>>>67 ulelong x \b, serial number 0x%x 1494>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 1495>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 1496>>>>>>>71 string =NO\ NAME \b, unlabeled 1497# additional tests for floppy image added by Joerg Jenderek 1498# no fixed disk 1499>>>>>21 ubyte !0xF8 1500# floppy media with 12 bit FAT 1501>>>>>>54 string !FAT16 1502# test for FAT after bootsector 1503>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT 1504# floppy image 1505!:mime application/x-ima 1506# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm 1507# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html 1508# 0 FATs 1509>>>>>16 ubyte =0 1510# 0 root entries 1511>>>>>>17 uleshort =0 1512# 0 DOS sectors 1513>>>>>>>19 uleshort =0 1514# 0 sectors/FAT 1515# dos < 4.0 BootSector value found is 0x80 1516#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) 1517>>>>>>>>22 uleshort =0 \b; NTFS 1518>>>>>>>>>24 uleshort >0 \b, sectors/track %u 1519>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x 1520>>>>>>>>>40 ulequad >0 \b, sectors %lld 1521>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld 1522>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld 1523# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. 1524# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. 1525>>>>>>>>>64 lelong <256 1526>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d 1527>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) 1528# Values 0 to 127 represent index block sizes of 0 to 127 clusters. 1529# Values 128 to 255 represent index block sizes of 2^(256-N) byte 1530>>>>>>>>>68 ulelong <256 1531>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d 1532#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) 1533>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) 1534>>>>>>>>>72 ulequad x \b, serial number 0%llx 1535>>>>>>>>>80 ulelong >0 \b, checksum 0x%x 1536#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) 1537>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 1538>>>>>>>>>>&-92 indirect x \b; contains 1539# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 1540# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm 1541# unused assembler instructions JMP y2;NOP;NOP 15420x056 ulelong&0xFFFF0FFF 0x909002EB 1543# unicode loadername terminated by CTRL-D 1544>(0.s*2) ulelong&0xFFFFFF00 0x00040000 1545# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR 1546>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s 1547>>0x12 string $ 1548>>>0x0c lestring16 x \b%-2.2s 1549### DOS,NTFS boot sectors end 1550 15519564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 1552>8404 string x last mounted on %s, 1553#>9504 ledate x last checked at %s, 1554>8224 ledate x last written at %s, 1555>8401 byte x clean flag %d, 1556>8228 lelong x number of blocks %d, 1557>8232 lelong x number of data blocks %d, 1558>8236 lelong x number of cylinder groups %d, 1559>8240 lelong x block size %d, 1560>8244 lelong x fragment size %d, 1561>8252 lelong x minimum percentage of free blocks %d, 1562>8256 lelong x rotational delay %dms, 1563>8260 lelong x disk rotational speed %drps, 1564>8320 lelong 0 TIME optimization 1565>8320 lelong 1 SPACE optimization 1566 156742332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 1568>&-1164 string x last mounted on %s, 1569>&-696 string >\0 volume name %s, 1570>&-304 leqldate x last written at %s, 1571>&-1167 byte x clean flag %d, 1572>&-1168 byte x readonly flag %d, 1573>&-296 lequad x number of blocks %lld, 1574>&-288 lequad x number of data blocks %lld, 1575>&-1332 lelong x number of cylinder groups %d, 1576>&-1328 lelong x block size %d, 1577>&-1324 lelong x fragment size %d, 1578>&-180 lelong x average file size %d, 1579>&-176 lelong x average number of files in dir %d, 1580>&-272 lequad x pending blocks to free %lld, 1581>&-264 lelong x pending inodes to free %d, 1582>&-664 lequad x system-wide uuid %0llx, 1583>&-1316 lelong x minimum percentage of free blocks %d, 1584>&-1248 lelong 0 TIME optimization 1585>&-1248 lelong 1 SPACE optimization 1586 158766908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 1588>&-1164 string x last mounted on %s, 1589>&-696 string >\0 volume name %s, 1590>&-304 leqldate x last written at %s, 1591>&-1167 byte x clean flag %d, 1592>&-1168 byte x readonly flag %d, 1593>&-296 lequad x number of blocks %lld, 1594>&-288 lequad x number of data blocks %lld, 1595>&-1332 lelong x number of cylinder groups %d, 1596>&-1328 lelong x block size %d, 1597>&-1324 lelong x fragment size %d, 1598>&-180 lelong x average file size %d, 1599>&-176 lelong x average number of files in dir %d, 1600>&-272 lequad x pending blocks to free %lld, 1601>&-264 lelong x pending inodes to free %d, 1602>&-664 lequad x system-wide uuid %0llx, 1603>&-1316 lelong x minimum percentage of free blocks %d, 1604>&-1248 lelong 0 TIME optimization 1605>&-1248 lelong 1 SPACE optimization 1606 16079564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 1608>7168 belong 0x4c41424c Apple UFS Volume 1609>>7186 string x named %s, 1610>>7176 belong x volume label version %d, 1611>>7180 bedate x created on %s, 1612>8404 string x last mounted on %s, 1613#>9504 bedate x last checked at %s, 1614>8224 bedate x last written at %s, 1615>8401 byte x clean flag %d, 1616>8228 belong x number of blocks %d, 1617>8232 belong x number of data blocks %d, 1618>8236 belong x number of cylinder groups %d, 1619>8240 belong x block size %d, 1620>8244 belong x fragment size %d, 1621>8252 belong x minimum percentage of free blocks %d, 1622>8256 belong x rotational delay %dms, 1623>8260 belong x disk rotational speed %drps, 1624>8320 belong 0 TIME optimization 1625>8320 belong 1 SPACE optimization 1626 162742332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 1628>&-1164 string x last mounted on %s, 1629>&-696 string >\0 volume name %s, 1630>&-304 beqldate x last written at %s, 1631>&-1167 byte x clean flag %d, 1632>&-1168 byte x readonly flag %d, 1633>&-296 bequad x number of blocks %lld, 1634>&-288 bequad x number of data blocks %lld, 1635>&-1332 belong x number of cylinder groups %d, 1636>&-1328 belong x block size %d, 1637>&-1324 belong x fragment size %d, 1638>&-180 belong x average file size %d, 1639>&-176 belong x average number of files in dir %d, 1640>&-272 bequad x pending blocks to free %lld, 1641>&-264 belong x pending inodes to free %d, 1642>&-664 bequad x system-wide uuid %0llx, 1643>&-1316 belong x minimum percentage of free blocks %d, 1644>&-1248 belong 0 TIME optimization 1645>&-1248 belong 1 SPACE optimization 1646 164766908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 1648>&-1164 string x last mounted on %s, 1649>&-696 string >\0 volume name %s, 1650>&-304 beqldate x last written at %s, 1651>&-1167 byte x clean flag %d, 1652>&-1168 byte x readonly flag %d, 1653>&-296 bequad x number of blocks %lld, 1654>&-288 bequad x number of data blocks %lld, 1655>&-1332 belong x number of cylinder groups %d, 1656>&-1328 belong x block size %d, 1657>&-1324 belong x fragment size %d, 1658>&-180 belong x average file size %d, 1659>&-176 belong x average number of files in dir %d, 1660>&-272 bequad x pending blocks to free %lld, 1661>&-264 belong x pending inodes to free %d, 1662>&-664 bequad x system-wide uuid %0llx, 1663>&-1316 belong x minimum percentage of free blocks %d, 1664>&-1248 belong 0 TIME optimization 1665>&-1248 belong 1 SPACE optimization 1666 1667# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 1668# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 1669# volume label and UUID Russell Coker 1670# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 16710x438 leshort 0xEF53 Linux 1672>0x44c lelong x rev %d 1673>0x43e leshort x \b.%d 1674# No journal? ext2 1675>0x45c lelong ^0x0000004 ext2 filesystem data 1676>>0x43a leshort ^0x0000001 (mounted or unclean) 1677# Has a journal? ext3 or ext4 1678>0x45c lelong &0x0000004 1679# and small INCOMPAT? 1680>>0x460 lelong <0x0000040 1681# and small RO_COMPAT? 1682>>>0x464 lelong <0x0000008 ext3 filesystem data 1683# else large RO_COMPAT? 1684>>>0x464 lelong >0x0000007 ext4 filesystem data 1685# else large INCOMPAT? 1686>>0x460 lelong >0x000003f ext4 filesystem data 1687>0x468 belong x \b, UUID=%08x 1688>0x46c beshort x \b-%04x 1689>0x46e beshort x \b-%04x 1690>0x470 beshort x \b-%04x 1691>0x472 belong x \b-%08x 1692>0x476 beshort x \b%04x 1693>0x478 string >0 \b, volume name "%s" 1694# General flags for any ext* fs 1695>0x460 lelong &0x0000004 (needs journal recovery) 1696>0x43a leshort &0x0000002 (errors) 1697# INCOMPAT flags 1698>0x460 lelong &0x0000001 (compressed) 1699#>0x460 lelong &0x0000002 (filetype) 1700#>0x460 lelong &0x0000010 (meta bg) 1701>0x460 lelong &0x0000040 (extents) 1702>0x460 lelong &0x0000080 (64bit) 1703#>0x460 lelong &0x0000100 (mmp) 1704#>0x460 lelong &0x0000200 (flex bg) 1705# RO_INCOMPAT flags 1706#>0x464 lelong &0x0000001 (sparse super) 1707>0x464 lelong &0x0000002 (large files) 1708>0x464 lelong &0x0000008 (huge files) 1709#>0x464 lelong &0x0000010 (gdt checksum) 1710#>0x464 lelong &0x0000020 (many subdirs) 1711#>0x463 lelong &0x0000040 (extra isize) 1712 1713# Minix filesystems - Juan Cespedes <cespedes@debian.org> 17140x410 leshort 0x137f 1715!:strength / 2 1716>0x402 beshort < 100 1717>0x402 beshort > -1 Minix filesystem, V1, %d zones 1718>0x1e string minix \b, bootable 17190x410 beshort 0x137f 1720!:strength / 2 1721>0x402 beshort < 100 1722>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones 1723>0x1e string minix \b, bootable 17240x410 leshort 0x138f 1725!:strength / 2 1726>0x402 beshort < 100 1727>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones 1728>0x1e string minix \b, bootable 17290x410 beshort 0x138f 1730!:strength / 2 1731>0x402 beshort < 100 1732>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones 1733>0x1e string minix \b, bootable 17340x410 leshort 0x2468 1735>0x402 beshort < 100 1736>>0x402 beshort > -1 Minix filesystem, V2, %d zones 1737>0x1e string minix \b, bootable 17380x410 beshort 0x2468 1739>0x402 beshort < 100 1740>0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones 1741>0x1e string minix \b, bootable 1742 17430x410 leshort 0x2478 1744>0x402 beshort < 100 1745>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones 1746>0x1e string minix \b, bootable 17470x410 leshort 0x2478 1748>0x402 beshort < 100 1749>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones 1750>0x1e string minix \b, bootable 17510x410 beshort 0x2478 1752>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones 1753>0x1e string minix \b, bootable 17540x410 leshort 0x4d5a 1755>0x402 beshort !0 Minix filesystem, V3, %d zones 1756>0x1e string minix \b, bootable 1757 1758# SGI disk labels - Nathan Scott <nathans@debian.org> 17590 belong 0x0BE5A941 SGI disk label (volume header) 1760 1761# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 17620 belong 0x58465342 SGI XFS filesystem data 1763>0x4 belong x (blksz %d, 1764>0x68 beshort x inosz %d, 1765>0x64 beshort ^0x2004 v1 dirs) 1766>0x64 beshort &0x2004 v2 dirs) 1767 1768############################################################################ 1769# Minix-ST kernel floppy 17700x800 belong 0x46fc2700 Atari-ST Minix kernel image 1771# http://en.wikipedia.org/wiki/BIOS_parameter_block 1772# floppies with valid BPB and any instruction at beginning 1773>19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy 1774>19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy 1775 1776############################################################################ 1777# Hmmm, is this a better way of detecting _standard_ floppy images ? 177819 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k 1779>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 178019 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k 1781>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 178219 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 1783>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1784 178519 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM 1786>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 178719 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs 1788>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1789 179019 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 179119 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k 1792# | | | | | 1793# | | | | heads 1794# | | | sectors/track 1795# | | sectors/FAT 1796# | media descriptor 1797# BPB: sectors 1798 1799# Valid media descriptor bytes for MS-DOS: 1800# 1801# Byte Capacity Media Size and Type 1802# ------------------------------------------------- 1803# 1804# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 1805# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 1806# F9 720K 3.5-inch, 2-sided, 9-sector 1807# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 1808# FD 360K 5.25-inch, 2-sided, 9-sector 1809# FF 320K 5.25-inch, 2-sided, 8-sector 1810# FC 180K 5.25-inch, 1-sided, 9-sector 1811# FE 160K 5.25-inch, 1-sided, 8-sector 1812# FE 250K 8-inch, 1-sided, single-density 1813# FD 500K 8-inch, 2-sided, single-density 1814# FE 1.2 MB 8-inch, 2-sided, double-density 1815# F8 ----- Fixed disk 1816# 1817# FC xxxK Apricot 70x1x9 boot disk. 1818# 1819# Originally a bitmap: 1820# xxxxxxx0 Not two sided 1821# xxxxxxx1 Double sided 1822# xxxxxx0x Not 8 SPT 1823# xxxxxx1x 8 SPT 1824# xxxxx0xx Not Removable drive 1825# xxxxx1xx Removable drive 1826# 11111xxx Must be one. 1827# 1828# But now it's rather random: 1829# 111111xx Low density disk 1830# 00 SS, Not 8 SPT 1831# 01 DS, Not 8 SPT 1832# 10 SS, 8 SPT 1833# 11 DS, 8 SPT 1834# 1835# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 1836# 11110000 High density 3 1/2 floppy disk 1837# 11111000 Hard disk any format 1838# 1839 1840# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 1841# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions 1842# Too Weak. 1843#512 ubelong&0xE0ffff00 0xE0ffff00 1844# without valid Media descriptor in place of BPB, cases with are done at other places 1845#>21 ubyte <0xE5 floppy with old FAT filesystem 1846# but valid Media descriptor at begin of FAT 1847#>>512 ubyte =0xed 720k 1848#>>512 ubyte =0xf0 1440k 1849#>>512 ubyte =0xf8 720k 1850#>>512 ubyte =0xf9 1220k 1851#>>512 ubyte =0xfa 320k 1852#>>512 ubyte =0xfb 640k 1853#>>512 ubyte =0xfc 180k 1854# look like an an old DOS directory entry 1855#>>>0xA0E ubequad 0 1856#>>>>0xA00 ubequad !0 1857#!:mime application/x-ima 1858#>>512 ubyte =0xfd 1859# look for 2nd FAT at different location to distinguish between 360k and 500k 1860#>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k 1861#>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k 1862#>>>0xA0E ubequad 0 1863#!:mime application/x-ima 1864#>>512 ubyte =0xfe 1865#>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k 1866#>>>>0x60E ubequad 0 1867#>>>>>0x600 ubequad !0 1868#!:mime application/x-ima 1869#>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k 1870#>>512 ubyte =0xff 320k 1871#>>>0x60E ubequad 0 1872#>>>>0x600 ubequad !0 1873#!:mime application/x-ima 1874#>>512 ubyte x \b, Media descriptor 0x%x 1875# without x86 jump instruction 1876#>>0 ulelong&0x804000E9 !0x000000E9 1877# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV 1878#>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader 1879# IOSYS.COM+MSDOS.COM 1880#>>>>0xc4 use 2xDOS-filename 1881#>>0 ulelong&0x804000E9 =0x000000E9 1882# only x86 short jump instruction found 1883#>>>0 ubyte =0xEB 1884#>>>>1 ubyte x \b, code offset 0x%x+2 1885# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm 1886# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 1887#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader 1888# ibmbio.com+ibmdos.com 1889#>>>>>0x176 use DOS-filename 1890#>>>>>0x181 ubyte x \b+ 1891#>>>>>0x182 use DOS-filename 1892# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm 1893# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV 1894#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader 1895# ibmbio.com+ibmdos.com 1896#>>>>>0x18b use DOS-filename 1897#>>>>>0x196 ubyte x \b+ 1898#>>>>>0x197 use DOS-filename 1899# http://en.wikipedia.org/wiki/Zenith_Data_Systems 1900# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 1901#>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader 1902# IO.SYS+MSDOS.SYS 1903#>>>>>0x20 use 2xDOS-filename 1904# http://en.wikipedia.org/wiki/Corona_Data_Systems 1905# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; 1906#>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader 1907# IO.SYS+MSDOS.SYS 1908#>>>>>0x69 use 2xDOS-filename 1909# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; 1910#>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader 1911# defect IO.SYS+MSDOS.SYS ? 1912#>>>>>0x162 use 2xDOS-filename 1913 19140 name cdrom 1915>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 1916!:mime application/x-iso9660-image 1917>38913 string NSR0 UDF filesystem data 1918!:mime application/x-iso9660-image 1919>>38917 string 1 (version 1.0) 1920>>38917 string 2 (version 1.5) 1921>>38917 string 3 (version 2.0) 1922>>38917 byte >0x33 (unknown version, ID 0x%X) 1923>>38917 byte <0x31 (unknown version, ID 0x%X) 1924# "application id" which appears to be used as a volume label 1925>32808 string/T >\0 '%s' 1926>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 192737633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 1928!:mime application/x-iso9660-image 192932777 string CDROM High Sierra CD-ROM filesystem data 1930 1931# CDROM Filesystems 1932# https://en.wikipedia.org/wiki/ISO_9660 1933# Modified for UDF by gerardo.cacciari@gmail.com 193432769 string CD001 1935# mime line at that position does not work 1936# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51) 1937!:strength -11 1938# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51) 1939# does not work 1940#!:strength +33 1941>0 use cdrom 1942 1943# .cso files 19440 string CISO Compressed ISO CD image 1945 1946# cramfs filesystem - russell@coker.com.au 19470 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 1948>4 lelong x size %u 1949>8 lelong &1 version #2 1950>8 lelong &2 sorted_dirs 1951>8 lelong &4 hole_support 1952>32 lelong x CRC 0x%x, 1953>36 lelong x edition %u, 1954>40 lelong x %u blocks, 1955>44 lelong x %u files 1956 19570 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 1958>4 belong x size %u 1959>8 belong &1 version #2 1960>8 belong &2 sorted_dirs 1961>8 belong &4 hole_support 1962>32 belong x CRC 0x%x, 1963>36 belong x edition %u, 1964>40 belong x %u blocks, 1965>44 belong x %u files 1966 1967# reiserfs - russell@coker.com.au 19680x10034 string ReIsErFs ReiserFS V3.5 19690x10034 string ReIsEr2Fs ReiserFS V3.6 19700x10034 string ReIsEr3Fs ReiserFS V3.6.19 1971>0x1002c leshort x block size %d 1972>0x10032 leshort &2 (mounted or unclean) 1973>0x10000 lelong x num blocks %d 1974>0x10040 lelong 1 tea hash 1975>0x10040 lelong 2 yura hash 1976>0x10040 lelong 3 r5 hash 1977 1978# JFFS - russell@coker.com.au 19790 lelong 0x34383931 Linux Journalled Flash File system, little endian 19800 belong 0x34383931 Linux Journalled Flash File system, big endian 1981 1982# EST flat binary format (which isn't, but anyway) 1983# From: Mark Brown <broonie@sirena.org.uk> 19840 string ESTFBINR EST flat binary 1985 1986# Aculab VoIP firmware 1987# From: Mark Brown <broonie@sirena.org.uk> 19880 string VoIP\ Startup\ and Aculab VoIP firmware 1989>35 string x format %s 1990 1991# From: Mark Brown <broonie@sirena.org.uk> [old] 1992# From: Behan Webster <behanw@websterwood.com> 19930 belong 0x27051956 u-boot legacy uImage, 1994>32 string x %s, 1995>28 byte 0 Invalid os/ 1996>28 byte 1 OpenBSD/ 1997>28 byte 2 NetBSD/ 1998>28 byte 3 FreeBSD/ 1999>28 byte 4 4.4BSD/ 2000>28 byte 5 Linux/ 2001>28 byte 6 SVR4/ 2002>28 byte 7 Esix/ 2003>28 byte 8 Solaris/ 2004>28 byte 9 Irix/ 2005>28 byte 10 SCO/ 2006>28 byte 11 Dell/ 2007>28 byte 12 NCR/ 2008>28 byte 13 LynxOS/ 2009>28 byte 14 VxWorks/ 2010>28 byte 15 pSOS/ 2011>28 byte 16 QNX/ 2012>28 byte 17 Firmware/ 2013>28 byte 18 RTEMS/ 2014>28 byte 19 ARTOS/ 2015>28 byte 20 Unity OS/ 2016>28 byte 21 INTEGRITY/ 2017>29 byte 0 \bInvalid CPU, 2018>29 byte 1 \bAlpha, 2019>29 byte 2 \bARM, 2020>29 byte 3 \bIntel x86, 2021>29 byte 4 \bIA64, 2022>29 byte 5 \bMIPS, 2023>29 byte 6 \bMIPS 64-bit, 2024>29 byte 7 \bPowerPC, 2025>29 byte 8 \bIBM S390, 2026>29 byte 9 \bSuperH, 2027>29 byte 10 \bSparc, 2028>29 byte 11 \bSparc 64-bit, 2029>29 byte 12 \bM68K, 2030>29 byte 13 \bNios-32, 2031>29 byte 14 \bMicroBlaze, 2032>29 byte 15 \bNios-II, 2033>29 byte 16 \bBlackfin, 2034>29 byte 17 \bAVR32, 2035>29 byte 18 \bSTMicroelectronics ST200, 2036>30 byte 0 Invalid Image 2037>30 byte 1 Standalone Program 2038>30 byte 2 OS Kernel Image 2039>30 byte 3 RAMDisk Image 2040>30 byte 4 Multi-File Image 2041>30 byte 5 Firmware Image 2042>30 byte 6 Script File 2043>30 byte 7 Filesystem Image (any type) 2044>30 byte 8 Binary Flat Device Tree BLOB 2045>31 byte 0 (Not compressed), 2046>31 byte 1 (gzip), 2047>31 byte 2 (bzip2), 2048>31 byte 3 (lzma), 2049>12 belong x %d bytes, 2050>8 bedate x %s, 2051>16 belong x Load Address: 0x%08X, 2052>20 belong x Entry Point: 0x%08X, 2053>4 belong x Header CRC: 0x%08X, 2054>24 belong x Data CRC: 0x%08X 2055 2056# JFFS2 file system 20570 leshort 0x1984 Linux old jffs2 filesystem data little endian 20580 leshort 0x1985 Linux jffs2 filesystem data little endian 2059 2060# Squashfs 20610 string sqsh Squashfs filesystem, big endian, 2062>28 beshort x version %d. 2063>30 beshort x \b%d, 2064>28 beshort <3 2065>>8 belong x %d bytes, 2066>28 beshort >2 2067>>28 beshort <4 2068>>>63 bequad x %lld bytes, 2069>>28 beshort >3 2070>>>40 bequad x %lld bytes, 2071#>>67 belong x %d bytes, 2072>4 belong x %d inodes, 2073>28 beshort <2 2074>>32 beshort x blocksize: %d bytes, 2075>28 beshort >1 2076>>28 beshort <4 2077>>>51 belong x blocksize: %d bytes, 2078>>28 beshort >3 2079>>>12 belong x blocksize: %d bytes, 2080>28 beshort <4 2081>>39 bedate x created: %s 2082>28 beshort >3 2083>>8 bedate x created: %s 20840 string hsqs Squashfs filesystem, little endian, 2085>28 leshort x version %d. 2086>30 leshort x \b%d, 2087>28 leshort <3 2088>>8 lelong x %d bytes, 2089>28 leshort >2 2090>>28 leshort <4 2091>>>63 lequad x %lld bytes, 2092>>28 leshort >3 2093>>>40 lequad x %lld bytes, 2094#>>63 lelong x %d bytes, 2095>4 lelong x %d inodes, 2096>28 leshort <2 2097>>32 leshort x blocksize: %d bytes, 2098>28 leshort >1 2099>>28 leshort <4 2100>>>51 lelong x blocksize: %d bytes, 2101>>28 leshort >3 2102>>>12 lelong x blocksize: %d bytes, 2103>28 leshort <4 2104>>39 ledate x created: %s 2105>28 leshort >3 2106>>8 ledate x created: %s 2107 2108# AFS Dump Magic 2109# From: Ty Sarna <tsarna@sarna.org> 21100 string \x01\xb3\xa1\x13\x22 AFS Dump 2111>&0 belong x (v%d) 2112>>&0 byte 0x76 2113>>>&0 belong x Vol %d, 2114>>>>&0 byte 0x6e 2115>>>>>&0 string x %s 2116>>>>>>&1 byte 0x74 2117>>>>>>>&0 beshort 2 2118>>>>>>>>&4 bedate x on: %s 2119>>>>>>>>&0 bedate =0 full dump 2120>>>>>>>>&0 bedate !0 incremental since: %s 2121 2122#---------------------------------------------------------- 2123#delta ISO Daniel Novotny (dnovotny@redhat.com) 21240 string DISO Delta ISO data
|