1226048Sobrien 268349Sobrien#------------------------------------------------------------------------------ 3284778Sdelphij# $File: apple,v 1.30 2015/04/13 13:09:06 christos Exp $ 468349Sobrien# apple: file(1) magic for Apple file formats 568349Sobrien# 6226048Sobrien0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 768349Sobrien0 string \x0aGL Binary II (apple ][) data 868349Sobrien0 string \x76\xff Squeezed (apple ][) data 968349Sobrien0 string NuFile NuFile archive (apple ][) data 1068349Sobrien0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 1168349Sobrien0 belong 0x00051600 AppleSingle encoded Macintosh file 1268349Sobrien0 belong 0x00051607 AppleDouble encoded Macintosh file 1368349Sobrien 14186690Sobrien# Type: Apple Emulator 2IMG format 15186690Sobrien# From: Radek Vokal <rvokal@redhat.com> 16186690Sobrien0 string 2IMG Apple ][ 2IMG Disk Image 17186690Sobrien>4 string XGS! \b, XGS 18186690Sobrien>4 string CTKG \b, Catakig 19186690Sobrien>4 string ShIm \b, Sheppy's ImageMaker 20186690Sobrien>4 string WOOF \b, Sweet 16 21186690Sobrien>4 string B2TR \b, Bernie ][ the Rescue 22186690Sobrien>4 string !nfc \b, ASIMOV2 23186690Sobrien>4 string x \b, Unknown Format 24186690Sobrien>0xc byte 00 \b, DOS 3.3 sector order 25186690Sobrien>>0x10 byte 00 \b, Volume 254 26186690Sobrien>>0x10 byte&0x7f x \b, Volume %u 27186690Sobrien>0xc byte 01 \b, ProDOS sector order 28186690Sobrien>>0x14 short x \b, %u Blocks 29186690Sobrien>0xc byte 02 \b, NIB data 30186690Sobrien 3168349Sobrien# magic for Newton PDA package formats 3268349Sobrien# from Ruda Moura <ruda@helllabs.org> 3375937Sobrien0 string package0 Newton package, NOS 1.x, 3468349Sobrien>12 belong &0x80000000 AutoRemove, 3568349Sobrien>12 belong &0x40000000 CopyProtect, 3668349Sobrien>12 belong &0x10000000 NoCompression, 3768349Sobrien>12 belong &0x04000000 Relocation, 3868349Sobrien>12 belong &0x02000000 UseFasterCompression, 3968349Sobrien>16 belong x version %d 4068349Sobrien 4175937Sobrien0 string package1 Newton package, NOS 2.x, 4275937Sobrien>12 belong &0x80000000 AutoRemove, 4375937Sobrien>12 belong &0x40000000 CopyProtect, 4475937Sobrien>12 belong &0x10000000 NoCompression, 4575937Sobrien>12 belong &0x04000000 Relocation, 4675937Sobrien>12 belong &0x02000000 UseFasterCompression, 4775937Sobrien>16 belong x version %d 4875937Sobrien 49133359Sobrien0 string package4 Newton package, 50133359Sobrien>8 byte 8 NOS 1.x, 51133359Sobrien>8 byte 9 NOS 2.x, 52133359Sobrien>12 belong &0x80000000 AutoRemove, 53133359Sobrien>12 belong &0x40000000 CopyProtect, 54133359Sobrien>12 belong &0x10000000 NoCompression, 55133359Sobrien 5668349Sobrien# The following entries for the Apple II are for files that have 5768349Sobrien# been transferred as raw binary data from an Apple, without having 5868349Sobrien# been encapsulated by any of the above archivers. 5968349Sobrien# 6068349Sobrien# In general, Apple II formats are hard to identify because Apple DOS 6168349Sobrien# and especially Apple ProDOS have strong typing in the file system and 6268349Sobrien# therefore programmers never felt much need to include type information 6368349Sobrien# in the files themselves. 6468349Sobrien# 6568349Sobrien# Eric Fischer <enf@pobox.com> 6668349Sobrien 6768349Sobrien# AppleWorks word processor: 6868349Sobrien# 6968349Sobrien# This matches the standard tab stops for an AppleWorks file, but if 7068349Sobrien# a file has a tab stop set in the first four columns this will fail. 7168349Sobrien# 7268349Sobrien# The "O" is really the magic number, but that's so common that it's 7368349Sobrien# necessary to check the tab stops that follow it to avoid false positives. 7468349Sobrien 7568349Sobrien4 string O==== AppleWorks word processor data 7668349Sobrien>85 byte&0x01 >0 \b, zoomed 7768349Sobrien>90 byte&0x01 >0 \b, paginated 7868349Sobrien>92 byte&0x01 >0 \b, with mail merge 7968349Sobrien#>91 byte x \b, left margin %d 8068349Sobrien 8168349Sobrien# AppleWorks database: 8268349Sobrien# 8368349Sobrien# This isn't really a magic number, but it's the closest thing to one 8468349Sobrien# that I could find. The 1 and 2 really mean "order in which you defined 8568349Sobrien# categories" and "left to right, top to bottom," respectively; the D and R 8668349Sobrien# mean that the cursor should move either down or right when you press Return. 8768349Sobrien 8875937Sobrien#30 string \x01D AppleWorks database data 8975937Sobrien#30 string \x02D AppleWorks database data 9075937Sobrien#30 string \x01R AppleWorks database data 9175937Sobrien#30 string \x02R AppleWorks database data 9268349Sobrien 9368349Sobrien# AppleWorks spreadsheet: 9468349Sobrien# 9568349Sobrien# Likewise, this isn't really meant as a magic number. The R or C means 9668349Sobrien# row- or column-order recalculation; the A or M means automatic or manual 9768349Sobrien# recalculation. 9868349Sobrien 9975937Sobrien#131 string RA AppleWorks spreadsheet data 10075937Sobrien#131 string RM AppleWorks spreadsheet data 10175937Sobrien#131 string CA AppleWorks spreadsheet data 10275937Sobrien#131 string CM AppleWorks spreadsheet data 10368349Sobrien 10468349Sobrien# Applesoft BASIC: 10568349Sobrien# 10668349Sobrien# This is incredibly sloppy, but will be true if the program was 10768349Sobrien# written at its usual memory location of 2048 and its first line 10868349Sobrien# number is less than 256. Yuck. 109267843Sdelphij# update by Joerg Jenderek at Feb 2013 11068349Sobrien 111267843Sdelphij# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 112267843Sdelphij#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 113267843Sdelphij0 belong&0x00ff00ff 0x00080000 114267843Sdelphij# assuming that line number must be positive 115267843Sdelphij>2 leshort >0 Applesoft BASIC program data, first line number %d 11668349Sobrien#>2 leshort x \b, first line number %d 11768349Sobrien 11868349Sobrien# ORCA/EZ assembler: 11968349Sobrien# 12068349Sobrien# This will not identify ORCA/M source files, since those have 12168349Sobrien# some sort of date code instead of the two zero bytes at 6 and 7 12268349Sobrien# XXX Conflicts with ELF 12368349Sobrien#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 12468349Sobrien#>5 byte x \b, build number %d 12568349Sobrien 12668349Sobrien# Broderbund Fantavision 12768349Sobrien# 12868349Sobrien# I don't know what these values really mean, but they seem to recur. 12968349Sobrien# Will they cause too many conflicts? 13068349Sobrien 13168349Sobrien# Probably :-) 13268349Sobrien#2 belong&0xFF00FF 0x040008 Fantavision movie data 13368349Sobrien 13468349Sobrien# Some attempts at images. 13568349Sobrien# 13668349Sobrien# These are actually just bit-for-bit dumps of the frame buffer, so 13768349Sobrien# there's really no reasonably way to distinguish them except for their 13868349Sobrien# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 13968349Sobrien# or, occasionally, 8184. 14068349Sobrien# 14168349Sobrien# Nevertheless this will manage to catch a lot of images that happen 14268349Sobrien# to have a solid-colored line at the bottom of the screen. 14368349Sobrien 144186690Sobrien# GRR: Magic too weak 145186690Sobrien#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 146186690Sobrien#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 147186690Sobrien#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 148186690Sobrien#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 149186690Sobrien#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 15068349Sobrien 15168349Sobrien# Beagle Bros. Apple Mechanic fonts 15268349Sobrien 15368349Sobrien0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 154133359Sobrien 155133359Sobrien# Apple Universal Disk Image Format (UDIF) - dmg files. 156133359Sobrien# From Johan Gade. 157133359Sobrien# These entries are disabled for now until we fix the following issues. 158133359Sobrien# 159133359Sobrien# Note there might be some problems with the "VAX COFF executable" 160133359Sobrien# entry. Note this entry should be placed before the mac filesystem section, 161133359Sobrien# particularly the "Apple Partition data" entry. 162133359Sobrien# 163133359Sobrien# The intended meaning of these tests is, that the file is only of the 164133359Sobrien# specified type if both of the lines are correct - i.e. if the first 165133359Sobrien# line matches and the second doesn't then it is not of that type. 166133359Sobrien# 167133359Sobrien#0 long 0x7801730d 168133359Sobrien#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 169133359Sobrien# 170133359Sobrien# Note that this entry is recognized correctly by the "Apple Partition 171133359Sobrien# data" entry - however since this entry is more specific - this 172133359Sobrien# information seems to be more useful. 173133359Sobrien#0 long 0x45520200 174133359Sobrien#>0x410 string disk\ image UDIF read/write image (UDRW) 175159764Sobrien 176159764Sobrien# From: Toby Peterson <toby@apple.com> 177159764Sobrien0 string bplist00 Apple binary property list 178159764Sobrien 179159764Sobrien# Apple binary property list (bplist) 180159764Sobrien# Assumes version bytes are hex. 181159764Sobrien# Provides content hints for version 0 files. Assumes that the root 182159764Sobrien# object is the first object (true for CoreFoundation implementation). 183159764Sobrien# From: David Remahl <dremahl@apple.com> 184159764Sobrien0 string bplist 185159764Sobrien>6 byte x \bCoreFoundation binary property list data, version 0x%c 186159764Sobrien>>7 byte x \b%c 187159764Sobrien>6 string 00 \b 188159764Sobrien>>8 byte&0xF0 0x00 \b 189159764Sobrien>>>8 byte&0x0F 0x00 \b, root type: null 190159764Sobrien>>>8 byte&0x0F 0x08 \b, root type: false boolean 191159764Sobrien>>>8 byte&0x0F 0x09 \b, root type: true boolean 192159764Sobrien>>8 byte&0xF0 0x10 \b, root type: integer 193159764Sobrien>>8 byte&0xF0 0x20 \b, root type: real 194159764Sobrien>>8 byte&0xF0 0x30 \b, root type: date 195159764Sobrien>>8 byte&0xF0 0x40 \b, root type: data 196159764Sobrien>>8 byte&0xF0 0x50 \b, root type: ascii string 197159764Sobrien>>8 byte&0xF0 0x60 \b, root type: unicode string 198159764Sobrien>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 199159764Sobrien>>8 byte&0xF0 0xa0 \b, root type: array 200159764Sobrien>>8 byte&0xF0 0xd0 \b, root type: dictionary 201159764Sobrien 202159764Sobrien# Apple/NeXT typedstream data 203159764Sobrien# Serialization format used by NeXT and Apple for various 204159764Sobrien# purposes in YellowStep/Cocoa, including some nib files. 205159764Sobrien# From: David Remahl <dremahl@apple.com> 206159764Sobrien2 string typedstream NeXT/Apple typedstream data, big endian 207267843Sdelphij>0 byte x \b, version %d 208159764Sobrien>0 byte <5 \b 209159764Sobrien>>13 byte 0x81 \b 210267843Sdelphij>>>14 ubeshort x \b, system %d 211159764Sobrien2 string streamtyped NeXT/Apple typedstream data, little endian 212267843Sdelphij>0 byte x \b, version %d 213159764Sobrien>0 byte <5 \b 214159764Sobrien>>13 byte 0x81 \b 215267843Sdelphij>>>14 uleshort x \b, system %d 216175296Sobrien 217175296Sobrien#------------------------------------------------------------------------------ 218175296Sobrien# CAF: Apple CoreAudio File Format 219175296Sobrien# 220175296Sobrien# Container format for high-end audio purposes. 221175296Sobrien# From: David Remahl <dremahl@apple.com> 222175296Sobrien# 223175296Sobrien0 string caff CoreAudio Format audio file 224175296Sobrien>4 beshort <10 version %d 225175296Sobrien>6 beshort x 226175296Sobrien 227175296Sobrien 228175296Sobrien#------------------------------------------------------------------------------ 229175296Sobrien# Keychain database files 230175296Sobrien0 string kych Mac OS X Keychain File 231175296Sobrien 232175296Sobrien#------------------------------------------------------------------------------ 233175296Sobrien# Code Signing related file types 234175296Sobrien0 belong 0xfade0c00 Mac OS X Code Requirement 235175296Sobrien>8 belong 1 (opExpr) 236175296Sobrien>4 belong x - %d bytes 237175296Sobrien 238175296Sobrien0 belong 0xfade0c01 Mac OS X Code Requirement Set 239175296Sobrien>8 belong >1 containing %d items 240175296Sobrien>4 belong x - %d bytes 241175296Sobrien 242175296Sobrien0 belong 0xfade0c02 Mac OS X Code Directory 243175296Sobrien>8 belong x version %x 244175296Sobrien>12 belong >0 flags 0x%x 245175296Sobrien>4 belong x - %d bytes 246175296Sobrien 247175296Sobrien0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 248175296Sobrien>4 belong x - %d bytes 249175296Sobrien 250175296Sobrien0 belong 0xfade0cc1 Mac OS X Detached Code Signature 251175296Sobrien>8 belong >1 (%d elements) 252175296Sobrien>4 belong x - %d bytes 253175296Sobrien 254175296Sobrien# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 255175296Sobrien# .vdi 256175296Sobrien4 string innotek\ VirtualBox\ Disk\ Image %s 257267843Sdelphij 258267843Sdelphij# Apple disk partition stuff, strengthen the magic using byte 4 259267843Sdelphij0 beshort 0x4552 260267843Sdelphij>4 byte 0 Apple Driver Map 261267843Sdelphij>>2 beshort x \b, blocksize %d 262267843Sdelphij>>4 belong x \b, blockcount %d 263267843Sdelphij>>10 beshort x \b, devtype %d 264267843Sdelphij>>12 beshort x \b, devid %d 265267843Sdelphij>>20 beshort x \b, descriptors %d 266267843Sdelphij# Assume 8 partitions each at a multiple of the sector size. 267267843Sdelphij# We could glean this from the partition descriptors, but they are empty!?!? 268267843Sdelphij>>(2.S*1) indirect \b, contains[@0x%x]: 269267843Sdelphij>>(2.S*2) indirect \b, contains[@0x%x]: 270267843Sdelphij>>(2.S*3) indirect \b, contains[@0x%x]: 271267843Sdelphij>>(2.S*4) indirect \b, contains[@0x%x]: 272267843Sdelphij>>(2.S*5) indirect \b, contains[@0x%x]: 273267843Sdelphij>>(2.S*6) indirect \b, contains[@0x%x]: 274267843Sdelphij>>(2.S*7) indirect \b, contains[@0x%x]: 275267843Sdelphij>>(2.S*8) indirect \b, contains[@0x%x]: 276267843Sdelphij 277267843Sdelphij# Yes, the 3rd and 4th bytes are reserved, but we use them to make the 278267843Sdelphij# magic stronger. 279267843Sdelphij0 belong 0x504d0000 Apple Partition Map 280267843Sdelphij>4 belong x \b, map block count %d 281267843Sdelphij>8 belong x \b, start block %d 282267843Sdelphij>12 belong x \b, block count %d 283267843Sdelphij>16 string >0 \b, name %s 284267843Sdelphij>48 string >0 \b, type %s 285267843Sdelphij>124 string >0 \b, processor %s 286267843Sdelphij>140 string >0 \b, boot arguments %s 287267843Sdelphij>92 belong & 1 \b, valid 288267843Sdelphij>92 belong & 2 \b, allocated 289267843Sdelphij>92 belong & 4 \b, in use 290267843Sdelphij>92 belong & 8 \b, has boot info 291267843Sdelphij>92 belong & 16 \b, readable 292267843Sdelphij>92 belong & 32 \b, writable 293267843Sdelphij>92 belong & 64 \b, pic boot code 294267843Sdelphij>92 belong & 128 \b, chain compatible driver 295267843Sdelphij>92 belong & 256 \b, real driver 296267843Sdelphij>92 belong & 512 \b, chain driver 297267843Sdelphij>92 belong & 1024 \b, mount at startup 298267843Sdelphij>92 belong & 2048 \b, is the startup partition 299267843Sdelphij 300267843Sdelphij#http://wiki.mozilla.org/DS_Store_File_Format` 301267843Sdelphij#http://en.wikipedia.org/wiki/.DS_Store 302267843Sdelphij0 string \0\0\0\1Bud1\0 Apple Desktop Services Store 303284778Sdelphij 304284778Sdelphij# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) 305284778Sdelphij# Usually not in separate files, but have either filename rsrc with 306284778Sdelphij# no extension, or a filename corresponding to another file, with 307284778Sdelphij# extensions rsr/rsrc 308284778Sdelphij0 string \000\000\001\000 309284778Sdelphij>4 leshort 0 310284778Sdelphij>>16 lelong 0 Apple HFS/HFS+ resource fork 311284778Sdelphij 312