1
2#------------------------------------------------------------------------------
|
3# $File: macintosh,v 1.23 2013/11/19 18:47:58 christos Exp $
|
| 3# $File: macintosh,v 1.25 2014/09/03 13:34:16 christos Exp $ |
4# macintosh description
5#
6# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
7# Daniel Quinlan, quinlan@yggdrasil.com
811 string must\ be\ converted\ with\ BinHex BinHex binary text
9!:mime application/mac-binhex40
10>41 string x \b, version %.3s
11
12# Stuffit archives are the de facto standard of compression for Macintosh
13# files obtained from most archives. (franklsm@tuns.ca)
140 string SIT! StuffIt Archive (data)
15!:mime application/x-stuffit
16!:apple SIT!SIT!
17>2 string x : %s
180 string SITD StuffIt Deluxe (data)
19>2 string x : %s
200 string Seg StuffIt Deluxe Segment (data)
21>2 string x : %s
22
23# Newer StuffIt archives (grant@netbsd.org)
240 string StuffIt StuffIt Archive
25!:mime application/x-stuffit
26!:apple SIT!SIT!
27#>162 string >0 : %s
28
29# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
30# GRR: Too weak
31#0 string APPL Macintosh Application (data)
32#>2 string x \b: %s
33
34# Macintosh System files (franklsm@tuns.ca)
35# GRR: Too weak
36#0 string zsys Macintosh System File (data)
37#0 string FNDR Macintosh Finder (data)
38#0 string libr Macintosh Library (data)
39#>2 string x : %s
40#0 string shlb Macintosh Shared Library (data)
41#>2 string x : %s
42#0 string cdev Macintosh Control Panel (data)
43#>2 string x : %s
44#0 string INIT Macintosh Extension (data)
45#>2 string x : %s
46#0 string FFIL Macintosh Truetype Font (data)
47#>2 string x : %s
48#0 string LWFN Macintosh Postscript Font (data)
49#>2 string x : %s
50
51# Additional Macintosh Files (franklsm@tuns.ca)
52# GRR: Too weak
53#0 string PACT Macintosh Compact Pro Archive (data)
54#>2 string x : %s
55#0 string ttro Macintosh TeachText File (data)
56#>2 string x : %s
57#0 string TEXT Macintosh TeachText File (data)
58#>2 string x : %s
59#0 string PDF Macintosh PDF File (data)
60#>2 string x : %s
61
62# MacBinary format (Eric Fischer, enf@pobox.com)
63#
64# Unfortunately MacBinary doesn't really have a magic number prior
65# to the MacBinary III format. The checksum is really the way to
66# do it, but the magic file format isn't up to the challenge.
67#
68# 0 byte 0
69# 1 byte # filename length
70# 2 string # filename
71# 65 string # file type
72# 69 string # file creator
73# 73 byte # Finder flags
74# 74 byte 0
75# 75 beshort # vertical posn in window
76# 77 beshort # horiz posn in window
77# 79 beshort # window or folder ID
78# 81 byte # protected?
79# 82 byte 0
80# 83 belong # length of data segment
81# 87 belong # length of resource segment
82# 91 belong # file creation date
83# 95 belong # file modification date
84# 99 beshort # length of comment after resource
85# 101 byte # new Finder flags
86# 102 string mBIN # (only in MacBinary III)
87# 106 byte # char. code of file name
88# 107 byte # still more Finder flags
89# 116 belong # total file length
90# 120 beshort # length of add'l header
91# 122 byte 129 # for MacBinary II
92# 122 byte 130 # for MacBinary III
93# 123 byte 129 # minimum version that can read fmt
94# 124 beshort # checksum
95#
96# This attempts to use the version numbers as a magic number, requiring
97# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
98# be 0x81. This works for the files I have, but maybe not for everyone's.
99
100# Unfortunately, this magic is quite weak - MPi
101#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
102
103# MacBinary I doesn't have the version number field at all, but MacBinary II
104# has been in use since 1987 so I hope there aren't many really old files
105# floating around that this will miss. The original spec calls for using
106# the nulls in 0, 74, and 82 as the magic number.
107#
108# Another possibility, that would also work for MacBinary I, is to use
109# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
110# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
111# and that 74 will be 0. So something like
112#
113# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
114#
115# >73 byte&0x01 0x01 \b, inited
116# >73 byte&0x02 0x02 \b, changed
117# >73 byte&0x04 0x04 \b, busy
118# >73 byte&0x08 0x08 \b, bozo
119# >73 byte&0x10 0x10 \b, system
120# >73 byte&0x10 0x20 \b, bundle
121# >73 byte&0x10 0x40 \b, invisible
122# >73 byte&0x10 0x80 \b, locked
123
124#>65 string x \b, type "%4.4s"
125
126#>65 string 8BIM (PhotoShop)
127#>65 string ALB3 (PageMaker 3)
128#>65 string ALB4 (PageMaker 4)
129#>65 string ALT3 (PageMaker 3)
130#>65 string APPL (application)
131#>65 string AWWP (AppleWorks word processor)
132#>65 string CIRC (simulated circuit)
133#>65 string DRWG (MacDraw)
134#>65 string EPSF (Encapsulated PostScript)
135#>65 string FFIL (font suitcase)
136#>65 string FKEY (function key)
137#>65 string FNDR (Macintosh Finder)
138#>65 string GIFf (GIF image)
139#>65 string Gzip (GNU gzip)
140#>65 string INIT (system extension)
141#>65 string LIB\ (library)
142#>65 string LWFN (PostScript font)
143#>65 string MSBC (Microsoft BASIC)
144#>65 string PACT (Compact Pro archive)
145#>65 string PDF\ (Portable Document Format)
146#>65 string PICT (picture)
147#>65 string PNTG (MacPaint picture)
148#>65 string PREF (preferences)
149#>65 string PROJ (Think C project)
150#>65 string QPRJ (Think Pascal project)
151#>65 string SCFL (Defender scores)
152#>65 string SCRN (startup screen)
153#>65 string SITD (StuffIt Deluxe)
154#>65 string SPn3 (SuperPaint)
155#>65 string STAK (HyperCard stack)
156#>65 string Seg\ (StuffIt segment)
157#>65 string TARF (Unix tar archive)
158#>65 string TEXT (ASCII)
159#>65 string TIFF (TIFF image)
160#>65 string TOVF (Eudora table of contents)
161#>65 string WDBN (Microsoft Word word processor)
162#>65 string WORD (MacWrite word processor)
163#>65 string XLS\ (Microsoft Excel)
164#>65 string ZIVM (compress (.Z))
165#>65 string ZSYS (Pre-System 7 system file)
166#>65 string acf3 (Aldus FreeHand)
167#>65 string cdev (control panel)
|
168#>65 string dfil (Desk Acessory suitcase)
|
| 168#>65 string dfil (Desk Accessory suitcase) |
169#>65 string libr (library)
170#>65 string nX^d (WriteNow word processor)
171#>65 string nX^w (WriteNow dictionary)
172#>65 string rsrc (resource)
173#>65 string scbk (Scrapbook)
174#>65 string shlb (shared library)
175#>65 string ttro (SimpleText read-only)
176#>65 string zsys (system file)
177
178#>69 string x \b, creator "%4.4s"
179
180# Somewhere, Apple has a repository of registered Creator IDs. These are
181# just the ones that I happened to have files from and was able to identify.
182
183#>69 string 8BIM (Adobe Photoshop)
184#>69 string ALD3 (PageMaker 3)
185#>69 string ALD4 (PageMaker 4)
186#>69 string ALFA (Alpha editor)
187#>69 string APLS (Apple Scanner)
188#>69 string APSC (Apple Scanner)
189#>69 string BRKL (Brickles)
190#>69 string BTFT (BitFont)
191#>69 string CCL2 (Common Lisp 2)
192#>69 string CCL\ (Common Lisp)
193#>69 string CDmo (The Talking Moose)
194#>69 string CPCT (Compact Pro)
195#>69 string CSOm (Eudora)
196#>69 string DMOV (Font/DA Mover)
197#>69 string DSIM (DigSim)
198#>69 string EDIT (Macintosh Edit)
199#>69 string ERIK (Macintosh Finder)
200#>69 string EXTR (self-extracting archive)
201#>69 string Gzip (GNU gzip)
202#>69 string KAHL (Think C)
203#>69 string LWFU (LaserWriter Utility)
204#>69 string LZIV (compress)
205#>69 string MACA (MacWrite)
206#>69 string MACS (Macintosh operating system)
207#>69 string MAcK (MacKnowledge terminal emulator)
208#>69 string MLND (Defender)
209#>69 string MPNT (MacPaint)
210#>69 string MSBB (Microsoft BASIC (binary))
211#>69 string MSWD (Microsoft Word)
212#>69 string NCSA (NCSA Telnet)
213#>69 string PJMM (Think Pascal)
214#>69 string PSAL (Hunt the Wumpus)
215#>69 string PSI2 (Apple File Exchange)
216#>69 string R*ch (BBEdit)
217#>69 string RMKR (Resource Maker)
218#>69 string RSED (Resource Editor)
219#>69 string Rich (BBEdit)
220#>69 string SIT! (StuffIt)
221#>69 string SPNT (SuperPaint)
222#>69 string Unix (NeXT Mac filesystem)
223#>69 string VIM! (Vim editor)
224#>69 string WILD (HyperCard)
225#>69 string XCEL (Microsoft Excel)
226#>69 string aCa2 (Fontographer)
227#>69 string aca3 (Aldus FreeHand)
228#>69 string dosa (Macintosh MS-DOS file system)
229#>69 string movr (Font/DA Mover)
230#>69 string nX^n (WriteNow)
231#>69 string pdos (Apple ProDOS file system)
232#>69 string scbk (Scrapbook)
233#>69 string ttxt (SimpleText)
234#>69 string ufox (Foreign File Access)
235
236# Just in case...
237
238102 string mBIN MacBinary III data with surprising version number
239
240# sas magic from Bruce Foster (bef@nwu.edu)
241#
242#0 string SAS SAS
243#>8 string x %s
2440 string SAS SAS
245>24 string DATA data file
246>24 string CATALOG catalog
247>24 string INDEX data file index
248>24 string VIEW data view
249# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
250#
2510x54 string SAS SAS 7+
252>0x9C string DATA data file
253>0x9C string CATALOG catalog
254>0x9C string INDEX data file index
255>0x9C string VIEW data view
256
257# spss magic for SPSS system and portable files,
258# from Bruce Foster (bef@nwu.edu).
259
2600 long 0xc1e2c3c9 SPSS Portable File
261>40 string x %s
262
2630 string $FL2 SPSS System File
264>24 string x %s
265
2660 string $FL3 SPSS System File
267>24 string x %s
268
269# Macintosh filesystem data
270# From "Tom N Harris" <telliamed@mac.com>
271# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
272# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
273# entries depend on the data arithmetic added after v.35
274# There's also some Pascal strings in here, ditto...
275
276# The boot block signature, according to IM:Files, is
277# "for HFS volumes, this field always contains the value 0x4C4B."
278# But if this is true for MFS or HFS+ volumes, I don't know.
279# Alternatively, the boot block is supposed to be zeroed if it's
280# unused, so a simply >0 should suffice.
281
2820x400 beshort 0xD2D7 Macintosh MFS data
283>0 beshort 0x4C4B (bootable)
284>0x40a beshort &0x8000 (locked)
285>0x402 beldate-0x7C25B080 x created: %s,
286>0x406 beldate-0x7C25B080 >0 last backup: %s,
287>0x414 belong x block size: %d,
288>0x412 beshort x number of blocks: %d,
289>0x424 pstring x volume name: %s
290
|
291# *.hfs updated by Joerg Jenderek
292# http://en.wikipedia.org/wiki/Hierarchical_File_System |
293# "BD" gives many false positives
|
292#0x400 beshort 0x4244 Macintosh HFS data
293#>0 beshort 0x4C4B (bootable)
294#>0x40a beshort &0x8000 (locked)
295#>0x40a beshort ^0x0100 (mounted)
296#>0x40a beshort &0x0200 (spared blocks)
297#>0x40a beshort &0x0800 (unclean)
298#>0x47C beshort 0x482B (Embedded HFS+ Volume)
299#>0x402 beldate-0x7C25B080 x created: %s,
300#>0x406 beldate-0x7C25B080 x last modified: %s,
301#>0x440 beldate-0x7C25B080 >0 last backup: %s,
302#>0x414 belong x block size: %d,
303#>0x412 beshort x number of blocks: %d,
304#>0x424 pstring x volume name: %s
|
2940x400 beshort 0x4244
295# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
296# first block of volume bit map (always 3)
297>0x40e ubeshort 0x0003
298# maximal length of volume name is 27
299>>0x424 ubyte <28 Macintosh HFS data
300#!:mime application/octet-stream
301# these mime and apple types are not sure
302!:mime application/x-apple-diskimage
303#!:apple hfsdINIT
304#!:apple MACSdisk
305>>>0 beshort 0x4C4B (bootable)
306#>>>0 beshort 0x0000 (not bootable)
307>>>0x40a beshort &0x8000 (locked)
308>>>0x40a beshort ^0x0100 (mounted)
309>>>0x40a beshort &0x0200 (spared blocks)
310>>>0x40a beshort &0x0800 (unclean)
311>>>0x47C beshort 0x482B (Embedded HFS+ Volume)
312# http://www.epochconverter.com/
313# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970
314# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00
315# construct not working
316#>>>0x402 beldate-0x7C25B080 x created: %s,
317#>>>0x406 beldate-0x7C25B080 x last modified: %s,
318#>>>0x440 beldate-0x7C25B080 >0 last backup: %s,
319# found block sizes 200h,1200h,2800h
320>>>0x414 belong x block size: %d,
321>>>0x412 beshort x number of blocks: %d,
322>>>0x424 pstring x volume name: %s |
323
3240x400 beshort 0x482B Macintosh HFS Extended
325>&0 beshort x version %d data
326>0 beshort 0x4C4B (bootable)
327>0x404 belong ^0x00000100 (mounted)
328>&2 belong &0x00000200 (spared blocks)
329>&2 belong &0x00000800 (unclean)
330>&2 belong &0x00008000 (locked)
331>&6 string x last mounted by: '%.4s',
332# really, that should be treated as a belong and we print a string
333# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
334>&14 beldate-0x7C25B080 x created: %s,
335# only the creation date is local time, all other timestamps in HFS+ are UTC.
336>&18 bedate-0x7C25B080 x last modified: %s,
337>&22 bedate-0x7C25B080 >0 last backup: %s,
338>&26 bedate-0x7C25B080 >0 last checked: %s,
339>&38 belong x block size: %d,
340>&42 belong x number of blocks: %d,
341>&46 belong x free blocks: %d
342
|
325# I don't think this is really necessary since it doesn't do much and
326# anything with a valid driver descriptor will also have a valid
327# partition map
328#0 beshort 0x4552 Apple Device Driver data
329#>&24 beshort =1 \b, MacOS
330
331# Is that the partition type a cstring or a pstring? Well, IM says "strings
332# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
333# cstring. Of course, partitions can contain more than four entries, but
334# what're you gonna do?
335# GRR: This magic is too weak, it is just "PM"
336#0x200 beshort 0x504D Apple Partition data
337#>0x2 beshort x (block size: %d):
338#>0x230 string x first type: %s,
339#>0x210 string x name: %s,
340#>0x254 belong x number of blocks: %d,
341#>0x400 beshort 0x504D
342#>>0x430 string x second type: %s,
343#>>0x410 string x name: %s,
344#>>0x454 belong x number of blocks: %d,
345#>>0x600 beshort 0x504D
346#>>>0x630 string x third type: %s,
347#>>>0x610 string x name: %s,
348#>>>0x654 belong x number of blocks: %d,
349#>>0x800 beshort 0x504D
350#>>>0x830 string x fourth type: %s,
351#>>>0x810 string x name: %s,
352#>>>0x854 belong x number of blocks: %d,
353#>>>0xa00 beshort 0x504D
354#>>>>0xa30 string x fifth type: %s,
355#>>>>0xa10 string x name: %s,
356#>>>>0xa54 belong x number of blocks: %d
357#>>>0xc00 beshort 0x504D
358#>>>>0xc30 string x sixth type: %s,
359#>>>>0xc10 string x name: %s,
360#>>>>0xc54 belong x number of blocks: %d
|
343## AFAIK, only the signature is different
|
344# same as Apple Partition Map
345# GRR: This magic is too weak, it is just "TS" |
346#0x200 beshort 0x5453 Apple Old Partition data
347#>0x2 beshort x block size: %d,
348#>0x230 string x first type: %s,
349#>0x210 string x name: %s,
350#>0x254 belong x number of blocks: %d,
351#>0x400 beshort 0x504D
352#>>0x430 string x second type: %s,
353#>>0x410 string x name: %s,
354#>>0x454 belong x number of blocks: %d,
355#>>0x800 beshort 0x504D
356#>>>0x830 string x third type: %s,
357#>>>0x810 string x name: %s,
358#>>>0x854 belong x number of blocks: %d,
359#>>>0xa00 beshort 0x504D
360#>>>>0xa30 string x fourth type: %s,
361#>>>>0xa10 string x name: %s,
362#>>>>0xa54 belong x number of blocks: %d
363
364# From: Remi Mommsen <mommsen@slac.stanford.edu>
3650 string BOMStore Mac OS X bill of materials (BOM) file
366
367# From: Adam Buchbinder <adam.buchbinder@gmail.com>
368# URL: http://en.wikipedia.org/wiki/Datafork_TrueType
369# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
370# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
371# don't know what they mean.
3720 belong 0x100
373>(0x4.L+24) beshort x
374>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType
375>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT'
376>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT'
377>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript
|