| macintosh (267897) | macintosh (275698) |
|---|---|
| 1 2#------------------------------------------------------------------------------ | 1 2#------------------------------------------------------------------------------ |
| 3# $File: macintosh,v 1.23 2013/11/19 18:47:58 christos Exp $ | 3# $File: macintosh,v 1.25 2014/09/03 13:34:16 christos Exp $ |
| 4# macintosh description 5# 6# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 7# Daniel Quinlan, quinlan@yggdrasil.com 811 string must\ be\ converted\ with\ BinHex BinHex binary text 9!:mime application/mac-binhex40 10>41 string x \b, version %.3s 11 --- 148 unchanged lines hidden (view full) --- 160#>65 string TOVF (Eudora table of contents) 161#>65 string WDBN (Microsoft Word word processor) 162#>65 string WORD (MacWrite word processor) 163#>65 string XLS\ (Microsoft Excel) 164#>65 string ZIVM (compress (.Z)) 165#>65 string ZSYS (Pre-System 7 system file) 166#>65 string acf3 (Aldus FreeHand) 167#>65 string cdev (control panel) | 4# macintosh description 5# 6# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 7# Daniel Quinlan, quinlan@yggdrasil.com 811 string must\ be\ converted\ with\ BinHex BinHex binary text 9!:mime application/mac-binhex40 10>41 string x \b, version %.3s 11 --- 148 unchanged lines hidden (view full) --- 160#>65 string TOVF (Eudora table of contents) 161#>65 string WDBN (Microsoft Word word processor) 162#>65 string WORD (MacWrite word processor) 163#>65 string XLS\ (Microsoft Excel) 164#>65 string ZIVM (compress (.Z)) 165#>65 string ZSYS (Pre-System 7 system file) 166#>65 string acf3 (Aldus FreeHand) 167#>65 string cdev (control panel) |
| 168#>65 string dfil (Desk Acessory suitcase) | 168#>65 string dfil (Desk Accessory suitcase) |
| 169#>65 string libr (library) 170#>65 string nX^d (WriteNow word processor) 171#>65 string nX^w (WriteNow dictionary) 172#>65 string rsrc (resource) 173#>65 string scbk (Scrapbook) 174#>65 string shlb (shared library) 175#>65 string ttro (SimpleText read-only) 176#>65 string zsys (system file) --- 106 unchanged lines hidden (view full) --- 283>0 beshort 0x4C4B (bootable) 284>0x40a beshort &0x8000 (locked) 285>0x402 beldate-0x7C25B080 x created: %s, 286>0x406 beldate-0x7C25B080 >0 last backup: %s, 287>0x414 belong x block size: %d, 288>0x412 beshort x number of blocks: %d, 289>0x424 pstring x volume name: %s 290 | 169#>65 string libr (library) 170#>65 string nX^d (WriteNow word processor) 171#>65 string nX^w (WriteNow dictionary) 172#>65 string rsrc (resource) 173#>65 string scbk (Scrapbook) 174#>65 string shlb (shared library) 175#>65 string ttro (SimpleText read-only) 176#>65 string zsys (system file) --- 106 unchanged lines hidden (view full) --- 283>0 beshort 0x4C4B (bootable) 284>0x40a beshort &0x8000 (locked) 285>0x402 beldate-0x7C25B080 x created: %s, 286>0x406 beldate-0x7C25B080 >0 last backup: %s, 287>0x414 belong x block size: %d, 288>0x412 beshort x number of blocks: %d, 289>0x424 pstring x volume name: %s 290 |
| 291# *.hfs updated by Joerg Jenderek 292# http://en.wikipedia.org/wiki/Hierarchical_File_System |
|
| 291# "BD" gives many false positives | 293# "BD" gives many false positives |
| 292#0x400 beshort 0x4244 Macintosh HFS data 293#>0 beshort 0x4C4B (bootable) 294#>0x40a beshort &0x8000 (locked) 295#>0x40a beshort ^0x0100 (mounted) 296#>0x40a beshort &0x0200 (spared blocks) 297#>0x40a beshort &0x0800 (unclean) 298#>0x47C beshort 0x482B (Embedded HFS+ Volume) 299#>0x402 beldate-0x7C25B080 x created: %s, 300#>0x406 beldate-0x7C25B080 x last modified: %s, 301#>0x440 beldate-0x7C25B080 >0 last backup: %s, 302#>0x414 belong x block size: %d, 303#>0x412 beshort x number of blocks: %d, 304#>0x424 pstring x volume name: %s | 2940x400 beshort 0x4244 295# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 296# first block of volume bit map (always 3) 297>0x40e ubeshort 0x0003 298# maximal length of volume name is 27 299>>0x424 ubyte <28 Macintosh HFS data 300#!:mime application/octet-stream 301# these mime and apple types are not sure 302!:mime application/x-apple-diskimage 303#!:apple hfsdINIT 304#!:apple MACSdisk 305>>>0 beshort 0x4C4B (bootable) 306#>>>0 beshort 0x0000 (not bootable) 307>>>0x40a beshort &0x8000 (locked) 308>>>0x40a beshort ^0x0100 (mounted) 309>>>0x40a beshort &0x0200 (spared blocks) 310>>>0x40a beshort &0x0800 (unclean) 311>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 312# http://www.epochconverter.com/ 313# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 314# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 315# construct not working 316#>>>0x402 beldate-0x7C25B080 x created: %s, 317#>>>0x406 beldate-0x7C25B080 x last modified: %s, 318#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 319# found block sizes 200h,1200h,2800h 320>>>0x414 belong x block size: %d, 321>>>0x412 beshort x number of blocks: %d, 322>>>0x424 pstring x volume name: %s |
| 305 3060x400 beshort 0x482B Macintosh HFS Extended 307>&0 beshort x version %d data 308>0 beshort 0x4C4B (bootable) 309>0x404 belong ^0x00000100 (mounted) 310>&2 belong &0x00000200 (spared blocks) 311>&2 belong &0x00000800 (unclean) 312>&2 belong &0x00008000 (locked) --- 4 unchanged lines hidden (view full) --- 317# only the creation date is local time, all other timestamps in HFS+ are UTC. 318>&18 bedate-0x7C25B080 x last modified: %s, 319>&22 bedate-0x7C25B080 >0 last backup: %s, 320>&26 bedate-0x7C25B080 >0 last checked: %s, 321>&38 belong x block size: %d, 322>&42 belong x number of blocks: %d, 323>&46 belong x free blocks: %d 324 | 323 3240x400 beshort 0x482B Macintosh HFS Extended 325>&0 beshort x version %d data 326>0 beshort 0x4C4B (bootable) 327>0x404 belong ^0x00000100 (mounted) 328>&2 belong &0x00000200 (spared blocks) 329>&2 belong &0x00000800 (unclean) 330>&2 belong &0x00008000 (locked) --- 4 unchanged lines hidden (view full) --- 335# only the creation date is local time, all other timestamps in HFS+ are UTC. 336>&18 bedate-0x7C25B080 x last modified: %s, 337>&22 bedate-0x7C25B080 >0 last backup: %s, 338>&26 bedate-0x7C25B080 >0 last checked: %s, 339>&38 belong x block size: %d, 340>&42 belong x number of blocks: %d, 341>&46 belong x free blocks: %d 342 |
| 325# I don't think this is really necessary since it doesn't do much and 326# anything with a valid driver descriptor will also have a valid 327# partition map 328#0 beshort 0x4552 Apple Device Driver data 329#>&24 beshort =1 \b, MacOS 330 331# Is that the partition type a cstring or a pstring? Well, IM says "strings 332# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a 333# cstring. Of course, partitions can contain more than four entries, but 334# what're you gonna do? 335# GRR: This magic is too weak, it is just "PM" 336#0x200 beshort 0x504D Apple Partition data 337#>0x2 beshort x (block size: %d): 338#>0x230 string x first type: %s, 339#>0x210 string x name: %s, 340#>0x254 belong x number of blocks: %d, 341#>0x400 beshort 0x504D 342#>>0x430 string x second type: %s, 343#>>0x410 string x name: %s, 344#>>0x454 belong x number of blocks: %d, 345#>>0x600 beshort 0x504D 346#>>>0x630 string x third type: %s, 347#>>>0x610 string x name: %s, 348#>>>0x654 belong x number of blocks: %d, 349#>>0x800 beshort 0x504D 350#>>>0x830 string x fourth type: %s, 351#>>>0x810 string x name: %s, 352#>>>0x854 belong x number of blocks: %d, 353#>>>0xa00 beshort 0x504D 354#>>>>0xa30 string x fifth type: %s, 355#>>>>0xa10 string x name: %s, 356#>>>>0xa54 belong x number of blocks: %d 357#>>>0xc00 beshort 0x504D 358#>>>>0xc30 string x sixth type: %s, 359#>>>>0xc10 string x name: %s, 360#>>>>0xc54 belong x number of blocks: %d | |
| 361## AFAIK, only the signature is different | 343## AFAIK, only the signature is different |
| 344# same as Apple Partition Map 345# GRR: This magic is too weak, it is just "TS" |
|
| 362#0x200 beshort 0x5453 Apple Old Partition data 363#>0x2 beshort x block size: %d, 364#>0x230 string x first type: %s, 365#>0x210 string x name: %s, 366#>0x254 belong x number of blocks: %d, 367#>0x400 beshort 0x504D 368#>>0x430 string x second type: %s, 369#>>0x410 string x name: %s, --- 24 unchanged lines hidden --- | 346#0x200 beshort 0x5453 Apple Old Partition data 347#>0x2 beshort x block size: %d, 348#>0x230 string x first type: %s, 349#>0x210 string x name: %s, 350#>0x254 belong x number of blocks: %d, 351#>0x400 beshort 0x504D 352#>>0x430 string x second type: %s, 353#>>0x410 string x name: %s, --- 24 unchanged lines hidden --- |