168349Sobrien#------------------------------------------------------------------------------ 2284778Sdelphij# $File: archive,v 1.90 2015/04/24 15:44:12 christos Exp $ 368349Sobrien# archive: file(1) magic for archive formats (see also "msdos" for self- 468349Sobrien# extracting compressed archives) 568349Sobrien# 668349Sobrien# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 768349Sobrien# pre-POSIX "tar" archives are handled in the C code. 868349Sobrien 968349Sobrien# POSIX tar archives 1068349Sobrien257 string ustar\0 POSIX tar archive 11186690Sobrien!:mime application/x-tar # encoding: posix 1268349Sobrien257 string ustar\040\040\0 GNU tar archive 13186690Sobrien!:mime application/x-tar # encoding: gnu 1468349Sobrien 15234250Sobrien# Incremental snapshot gnu-tar format from: 16234250Sobrien# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 17234250Sobrien0 string GNU\ tar- GNU tar incremental snapshot data 18234250Sobrien>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 19234250Sobrien 2068349Sobrien# cpio archives 2168349Sobrien# 2268349Sobrien# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 2368349Sobrien# The idea is to indicate archives produced on machines with the same 2468349Sobrien# byte order as the machine running "file" with "cpio archive", and 2568349Sobrien# to indicate archives produced on machines with the opposite byte order 2668349Sobrien# from the machine running "file" with "byte-swapped cpio archive". 2768349Sobrien# 2868349Sobrien# The SVR4 "cpio(4)" hints that there are additional formats, but they 2968349Sobrien# are defined as "short"s; I think all the new formats are 3068349Sobrien# character-header formats and thus are strings, not numbers. 3168349Sobrien0 short 070707 cpio archive 32186690Sobrien!:mime application/x-cpio 3368349Sobrien0 short 0143561 byte-swapped cpio archive 34186690Sobrien!:mime application/x-cpio # encoding: swapped 3568349Sobrien0 string 070707 ASCII cpio archive (pre-SVR4 or odc) 3668349Sobrien0 string 070701 ASCII cpio archive (SVR4 with no CRC) 3768349Sobrien0 string 070702 ASCII cpio archive (SVR4 with CRC) 3868349Sobrien 3968349Sobrien# 40267843Sdelphij# Various archive formats used by various versions of the "ar" 41267843Sdelphij# command. 42267843Sdelphij# 43267843Sdelphij 44267843Sdelphij# 45267843Sdelphij# Original UNIX archive formats. 46267843Sdelphij# They were written with binary values in host byte order, and 47267843Sdelphij# the magic number was a host "int", which might have been 16 bits 48267843Sdelphij# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 49267843Sdelphij# been ports to little-endian 16-bit-int or 32-bit-int platforms 50267843Sdelphij# (x86?) using some of those formats; if none existed, feel free 51267843Sdelphij# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 52267843Sdelphij# 32-bit. There might have been big-endian ports of that sort as 53267843Sdelphij# well. 54267843Sdelphij# 55267843Sdelphij0 leshort 0177555 very old 16-bit-int little-endian archive 56267843Sdelphij0 beshort 0177555 very old 16-bit-int big-endian archive 57267843Sdelphij0 lelong 0177555 very old 32-bit-int little-endian archive 58267843Sdelphij0 belong 0177555 very old 32-bit-int big-endian archive 59267843Sdelphij 60267843Sdelphij0 leshort 0177545 old 16-bit-int little-endian archive 61267843Sdelphij>2 string __.SYMDEF random library 62267843Sdelphij0 beshort 0177545 old 16-bit-int big-endian archive 63267843Sdelphij>2 string __.SYMDEF random library 64267843Sdelphij0 lelong 0177545 old 32-bit-int little-endian archive 65267843Sdelphij>4 string __.SYMDEF random library 66267843Sdelphij0 belong 0177545 old 32-bit-int big-endian archive 67267843Sdelphij>4 string __.SYMDEF random library 68267843Sdelphij 69267843Sdelphij# 70267843Sdelphij# From "pdp" (but why a 4-byte quantity?) 71267843Sdelphij# 72267843Sdelphij0 lelong 0x39bed PDP-11 old archive 73267843Sdelphij0 lelong 0x39bee PDP-11 4.0 archive 74267843Sdelphij 75267843Sdelphij# 76267843Sdelphij# XXX - what flavor of APL used this, and was it a variant of 77267843Sdelphij# some ar archive format? It's similar to, but not the same 78267843Sdelphij# as, the APL workspace magic numbers in pdp. 79267843Sdelphij# 80267843Sdelphij0 long 0100554 apl workspace 81267843Sdelphij 82267843Sdelphij# 83267843Sdelphij# System V Release 1 portable(?) archive format. 84267843Sdelphij# 85267843Sdelphij0 string =<ar> System V Release 1 ar archive 86267843Sdelphij!:mime application/x-archive 87267843Sdelphij 88267843Sdelphij# 89267843Sdelphij# Debian package; it's in the portable archive format, and needs to go 90267843Sdelphij# before the entry for regular portable archives, as it's recognized as 91267843Sdelphij# a portable archive whose first member has a name beginning with 92267843Sdelphij# "debian". 93267843Sdelphij# 94159764Sobrien0 string =!<arch>\ndebian 9568349Sobrien>8 string debian-split part of multipart Debian package 96267843Sdelphij!:mime application/vnd.debian.binary-package 9768349Sobrien>8 string debian-binary Debian binary package 98267843Sdelphij!:mime application/vnd.debian.binary-package 99186690Sobrien>8 string !debian 100133359Sobrien>68 string >\0 (format %s) 101159764Sobrien# These next two lines do not work, because a bzip2 Debian archive 102159764Sobrien# still uses gzip for the control.tar (first in the archive). Only 103159764Sobrien# data.tar varies, and the location of its filename varies too. 104159764Sobrien# file/libmagic does not current have support for ascii-string based 105159764Sobrien# (offsets) as of 2005-09-15. 106159764Sobrien#>81 string bz2 \b, uses bzip2 compression 107159764Sobrien#>84 string gz \b, uses gzip compression 108133359Sobrien#>136 ledate x created: %s 10968349Sobrien 11068349Sobrien# 111267843Sdelphij# MIPS archive; they're in the portable archive format, and need to go 112267843Sdelphij# before the entry for regular portable archives, as it's recognized as 113267843Sdelphij# a portable archive whose first member has a name beginning with 114267843Sdelphij# "__________E". 115267843Sdelphij# 116159764Sobrien0 string =!<arch>\n__________E MIPS archive 117267843Sdelphij!:mime application/x-archive 11868349Sobrien>20 string U with MIPS Ucode members 11968349Sobrien>21 string L with MIPSEL members 12068349Sobrien>21 string B with MIPSEB members 12168349Sobrien>19 string L and an EL hash table 12268349Sobrien>19 string B and an EB hash table 12368349Sobrien>22 string X -- out of date 12468349Sobrien 125186690Sobrien0 search/1 -h- Software Tools format archive text 12668349Sobrien 12768349Sobrien# 128267843Sdelphij# BSD/SVR2-and-later portable archive formats. 12968349Sobrien# 130159764Sobrien0 string =!<arch> current ar archive 131186690Sobrien!:mime application/x-archive 13268349Sobrien>8 string __.SYMDEF random library 133267843Sdelphij>68 string __.SYMDEF\ SORTED random library 134267843Sdelphij 13568349Sobrien# 136267843Sdelphij# "Thin" archive, as can be produced by GNU ar. 13768349Sobrien# 138267843Sdelphij0 string =!<thin>\n thin archive with 139267843Sdelphij>68 belong 0 no symbol entries 140267843Sdelphij>68 belong 1 %d symbol entry 141267843Sdelphij>68 belong >1 %d symbol entries 14268349Sobrien 14368349Sobrien# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 14468349Sobrien# 14568349Sobrien# The first byte is the magic (0x1a), byte 2 is the compression type for 14668349Sobrien# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 14768349Sobrien# filename of the first file (null terminated). Since some types collide 14868349Sobrien# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 14968349Sobrien# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 15068349Sobrien0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 151186690Sobrien!:mime application/x-arc 15268349Sobrien0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 153186690Sobrien!:mime application/x-arc 15468349Sobrien0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 155186690Sobrien!:mime application/x-arc 15668349Sobrien0 lelong&0x8080ffff 0x0000031a ARC archive data, packed 157186690Sobrien!:mime application/x-arc 15868349Sobrien0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 159186690Sobrien!:mime application/x-arc 16068349Sobrien0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 161186690Sobrien!:mime application/x-arc 162159764Sobrien# [JW] stuff taken from idarc, obviously ARC successors: 163159764Sobrien0 lelong&0x8080ffff 0x00000a1a PAK archive data 164186690Sobrien!:mime application/x-arc 165159764Sobrien0 lelong&0x8080ffff 0x0000141a ARC+ archive data 166186690Sobrien!:mime application/x-arc 167159764Sobrien0 lelong&0x8080ffff 0x0000481a HYP archive data 168186690Sobrien!:mime application/x-arc 16968349Sobrien 17068349Sobrien# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 17168349Sobrien# I can't create either SPARK or ArcFS archives so I have not tested this stuff 17268349Sobrien# [GRR: the original entries collide with ARC, above; replaced with combined 17368349Sobrien# version (not tested)] 174159764Sobrien#0 byte 0x1a RISC OS archive (spark format) 175159764Sobrien0 string \032archive RISC OS archive (ArcFS format) 176139368Sobrien0 string Archive\000 RISC OS archive (ArcFS format) 17768349Sobrien 178159764Sobrien# All these were taken from idarc, many could not be verified. Unfortunately, 179159764Sobrien# there were many low-quality sigs, i.e. easy to trigger false positives. 180159764Sobrien# Please notify me of any real-world fishy/ambiguous signatures and I'll try 181159764Sobrien# to get my hands on the actual archiver and see if I find something better. [JW] 182159764Sobrien# probably many can be enhanced by finding some 0-byte or control char near the start 183159764Sobrien 184159764Sobrien# idarc calls this Crush/Uncompressed... *shrug* 185159764Sobrien0 string CRUSH Crush archive data 186159764Sobrien# Squeeze It (.sqz) 187159764Sobrien0 string HLSQZ Squeeze It archive data 188159764Sobrien# SQWEZ 189159764Sobrien0 string SQWEZ SQWEZ archive data 190159764Sobrien# HPack (.hpk) 191159764Sobrien0 string HPAK HPack archive data 192159764Sobrien# HAP 193159764Sobrien0 string \x91\x33HF HAP archive data 194159764Sobrien# MD/MDCD 195159764Sobrien0 string MDmd MDCD archive data 196159764Sobrien# LIM 197159764Sobrien0 string LIM\x1a LIM archive data 198159764Sobrien# SAR 199159764Sobrien3 string LH5 SAR archive data 200159764Sobrien# BSArc/BS2 201267843Sdelphij0 string \212\3SB\020\0 BSArc/BS2 archive data 202267843Sdelphij# Bethesda Softworks Archive (Oblivion) 203267843Sdelphij0 string BSA\0 BSArc archive data 204267843Sdelphij>4 lelong x version %d 205159764Sobrien# MAR 206159764Sobrien2 string =-ah MAR archive data 207159764Sobrien# ACB 208234250Sobrien#0 belong&0x00f800ff 0x00800000 ACB archive data 209159764Sobrien# CPZ 210159764Sobrien# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 211159764Sobrien# JRC 212159764Sobrien0 string JRchive JRC archive data 213159764Sobrien# Quantum 214159764Sobrien0 string DS\0 Quantum archive data 215159764Sobrien# ReSOF 216159764Sobrien0 string PK\3\6 ReSOF archive data 217159764Sobrien# QuArk 218159764Sobrien0 string 7\4 QuArk archive data 219159764Sobrien# YAC 220159764Sobrien14 string YC YAC archive data 221159764Sobrien# X1 222159764Sobrien0 string X1 X1 archive data 223159764Sobrien0 string XhDr X1 archive data 224159764Sobrien# CDC Codec (.dqt) 225159764Sobrien0 belong&0xffffe000 0x76ff2000 CDC Codec archive data 226159764Sobrien# AMGC 227159764Sobrien0 string \xad6" AMGC archive data 228159764Sobrien# NuLIB 229267843Sdelphij0 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 230159764Sobrien# PakLeo 231159764Sobrien0 string LEOLZW PAKLeo archive data 232159764Sobrien# ChArc 233159764Sobrien0 string SChF ChArc archive data 234159764Sobrien# PSA 235159764Sobrien0 string PSA PSA archive data 236159764Sobrien# CrossePAC 237159764Sobrien0 string DSIGDCC CrossePAC archive data 238159764Sobrien# Freeze 239159764Sobrien0 string \x1f\x9f\x4a\x10\x0a Freeze archive data 240159764Sobrien# KBoom 241267843Sdelphij0 string \xc2\xa8MP\xc2\xa8 KBoom archive data 242159764Sobrien# NSQ, must go after CDC Codec 243159764Sobrien0 string \x76\xff NSQ archive data 244159764Sobrien# DPA 245159764Sobrien0 string Dirk\ Paehl DPA archive data 246159764Sobrien# BA 247159764Sobrien# TODO: idarc says "bytes 0-2 == bytes 3-5" 248159764Sobrien# TTComp 249159764Sobrien0 string \0\6 TTComp archive data 250159764Sobrien# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 251159764Sobrien0 string ESP ESP archive data 252159764Sobrien# ZPack 253159764Sobrien0 string \1ZPK\1 ZPack archive data 254159764Sobrien# Sky 255159764Sobrien0 string \xbc\x40 Sky archive data 256159764Sobrien# UFA 257159764Sobrien0 string UFA UFA archive data 258159764Sobrien# Dry 259159764Sobrien0 string =-H2O DRY archive data 260159764Sobrien# FoxSQZ 261159764Sobrien0 string FOXSQZ FoxSQZ archive data 262159764Sobrien# AR7 263159764Sobrien0 string ,AR7 AR7 archive data 264159764Sobrien# PPMZ 265159764Sobrien0 string PPMZ PPMZ archive data 266159764Sobrien# MS Compress 267159764Sobrien4 string \x88\xf0\x27 MS Compress archive data 268159764Sobrien# updated by Joerg Jenderek 269226048Sobrien>9 string \0 270226048Sobrien>>0 string KWAJ 271159764Sobrien>>>7 string \321\003 MS Compress archive data 272267843Sdelphij>>>>14 ulong >0 \b, original size: %d bytes 273226048Sobrien>>>>18 ubyte >0x65 274226048Sobrien>>>>>18 string x \b, was %.8s 275226048Sobrien>>>>>(10.b-4) string x \b.%.3s 276159764Sobrien# MP3 (archiver, not lossy audio compression) 277159764Sobrien0 string MP3\x1a MP3-Archiver archive data 278159764Sobrien# ZET 279267843Sdelphij0 string OZ\xc3\x9d ZET archive data 280159764Sobrien# TSComp 281159764Sobrien0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 282159764Sobrien# ARQ 283159764Sobrien0 string gW\4\1 ARQ archive data 284159764Sobrien# Squash 285159764Sobrien3 string OctSqu Squash archive data 286159764Sobrien# Terse 287159764Sobrien0 string \5\1\1\0 Terse archive data 288159764Sobrien# PUCrunch 289159764Sobrien0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 290159764Sobrien# UHarc 291159764Sobrien0 string UHA UHarc archive data 292159764Sobrien# ABComp 293159764Sobrien0 string \2AB ABComp archive data 294159764Sobrien0 string \3AB2 ABComp archive data 295159764Sobrien# CMP 296159764Sobrien0 string CO\0 CMP archive data 297159764Sobrien# Splint 298159764Sobrien0 string \x93\xb9\x06 Splint archive data 299159764Sobrien# InstallShield 300226048Sobrien0 string \x13\x5d\x65\x8c InstallShield Z archive Data 301159764Sobrien# Gather 302159764Sobrien1 string GTH Gather archive data 303159764Sobrien# BOA 304159764Sobrien0 string BOA BOA archive data 305159764Sobrien# RAX 306159764Sobrien0 string ULEB\xa RAX archive data 307159764Sobrien# Xtreme 308159764Sobrien0 string ULEB\0 Xtreme archive data 309159764Sobrien# Pack Magic 310267843Sdelphij0 string @\xc3\xa2\1\0 Pack Magic archive data 311159764Sobrien# BTS 312159764Sobrien0 belong&0xfeffffff 0x1a034465 BTS archive data 313159764Sobrien# ELI 5750 314159764Sobrien0 string Ora\ ELI 5750 archive data 315159764Sobrien# QFC 316159764Sobrien0 string \x1aFC\x1a QFC archive data 317159764Sobrien0 string \x1aQF\x1a QFC archive data 318159764Sobrien# PRO-PACK 319159764Sobrien0 string RNC PRO-PACK archive data 320159764Sobrien# 777 321159764Sobrien0 string 777 777 archive data 322159764Sobrien# LZS221 323159764Sobrien0 string sTaC LZS221 archive data 324159764Sobrien# HPA 325159764Sobrien0 string HPA HPA archive data 326159764Sobrien# Arhangel 327159764Sobrien0 string LG Arhangel archive data 328159764Sobrien# EXP1, uses bzip2 329159764Sobrien0 string 0123456789012345BZh EXP1 archive data 330159764Sobrien# IMP 331159764Sobrien0 string IMP\xa IMP archive data 332159764Sobrien# NRV 333159764Sobrien0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 334159764Sobrien# Squish 335159764Sobrien0 string \x73\xb2\x90\xf4 Squish archive data 336159764Sobrien# Par 337159764Sobrien0 string PHILIPP Par archive data 338159764Sobrien0 string PAR Par archive data 339159764Sobrien# HIT 340159764Sobrien0 string UB HIT archive data 341159764Sobrien# SBX 342159764Sobrien0 belong&0xfffff000 0x53423000 SBX archive data 343159764Sobrien# NaShrink 344159764Sobrien0 string NSK NaShrink archive data 345159764Sobrien# SAPCAR 346159764Sobrien0 string #\ CAR\ archive\ header SAPCAR archive data 347159764Sobrien0 string CAR\ 2.00RG SAPCAR archive data 348159764Sobrien# Disintegrator 349159764Sobrien0 string DST Disintegrator archive data 350159764Sobrien# ASD 351159764Sobrien0 string ASD ASD archive data 352159764Sobrien# InstallShield CAB 353159764Sobrien0 string ISc( InstallShield CAB 354159764Sobrien# TOP4 355159764Sobrien0 string T4\x1a TOP4 archive data 356159764Sobrien# BatComp left out: sig looks like COM executable 357159764Sobrien# so TODO: get real 4dos batcomp file and find sig 358159764Sobrien# BlakHole 359159764Sobrien0 string BH\5\7 BlakHole archive data 360159764Sobrien# BIX 361159764Sobrien0 string BIX0 BIX archive data 362159764Sobrien# ChiefLZA 363159764Sobrien0 string ChfLZ ChiefLZA archive data 364159764Sobrien# Blink 365159764Sobrien0 string Blink Blink archive data 366159764Sobrien# Logitech Compress 367159764Sobrien0 string \xda\xfa Logitech Compress archive data 368159764Sobrien# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 369159764Sobrien1 string (C)\ STEPANYUK ARS-Sfx archive data 370159764Sobrien# AKT/AKT32 371159764Sobrien0 string AKT32 AKT32 archive data 372159764Sobrien0 string AKT AKT archive data 373159764Sobrien# NPack 374159764Sobrien0 string MSTSM NPack archive data 375159764Sobrien# PFT 376159764Sobrien0 string \0\x50\0\x14 PFT archive data 377159764Sobrien# SemOne 378159764Sobrien0 string SEM SemOne archive data 379159764Sobrien# PPMD 380159764Sobrien0 string \x8f\xaf\xac\x84 PPMD archive data 381159764Sobrien# FIZ 382159764Sobrien0 string FIZ FIZ archive data 383159764Sobrien# MSXiE 384159764Sobrien0 belong&0xfffff0f0 0x4d530000 MSXiE archive data 385159764Sobrien# DeepFreezer 386159764Sobrien0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 387159764Sobrien# DC 388159764Sobrien0 string =<DC- DC archive data 389159764Sobrien# TPac 390159764Sobrien0 string \4TPAC\3 TPac archive data 391159764Sobrien# Ai 392159764Sobrien0 string Ai\1\1\0 Ai archive data 393159764Sobrien0 string Ai\1\0\0 Ai archive data 394159764Sobrien# Ai32 395159764Sobrien0 string Ai\2\0 Ai32 archive data 396159764Sobrien0 string Ai\2\1 Ai32 archive data 397159764Sobrien# SBC 398159764Sobrien0 string SBC SBC archive data 399159764Sobrien# Ybs 400159764Sobrien0 string YBS Ybs archive data 401159764Sobrien# DitPack 402159764Sobrien0 string \x9e\0\0 DitPack archive data 403159764Sobrien# DMS 404159764Sobrien0 string DMS! DMS archive data 405159764Sobrien# EPC 406159764Sobrien0 string \x8f\xaf\xac\x8c EPC archive data 407159764Sobrien# VSARC 408159764Sobrien0 string VS\x1a VSARC archive data 409159764Sobrien# PDZ 410159764Sobrien0 string PDZ PDZ archive data 411159764Sobrien# ReDuq 412159764Sobrien0 string rdqx ReDuq archive data 413159764Sobrien# GCA 414159764Sobrien0 string GCAX GCA archive data 415159764Sobrien# PPMN 416159764Sobrien0 string pN PPMN archive data 417159764Sobrien# WinImage 418159764Sobrien3 string WINIMAGE WinImage archive data 419159764Sobrien# Compressia 420159764Sobrien0 string CMP0CMP Compressia archive data 421159764Sobrien# UHBC 422159764Sobrien0 string UHB UHBC archive data 423159764Sobrien# WinHKI 424159764Sobrien0 string \x61\x5C\x04\x05 WinHKI archive data 425159764Sobrien# WWPack data file 426159764Sobrien0 string WWP WWPack archive data 427159764Sobrien# BSN (BSA, PTS-DOS) 428159764Sobrien0 string \xffBSG BSN archive data 429159764Sobrien1 string \xffBSG BSN archive data 430159764Sobrien3 string \xffBSG BSN archive data 431159764Sobrien1 string \0\xae\2 BSN archive data 432159764Sobrien1 string \0\xae\3 BSN archive data 433159764Sobrien1 string \0\xae\7 BSN archive data 434159764Sobrien# AIN 435159764Sobrien0 string \x33\x18 AIN archive data 436159764Sobrien0 string \x33\x17 AIN archive data 437159764Sobrien# XPA32 438159764Sobrien0 string xpa\0\1 XPA32 archive data 439159764Sobrien# SZip (TODO: doesn't catch all versions) 440159764Sobrien0 string SZ\x0a\4 SZip archive data 441159764Sobrien# XPack DiskImage 442159764Sobrien0 string jm XPack DiskImage archive data 443159764Sobrien# XPack Data 444159764Sobrien0 string xpa XPack archive data 445159764Sobrien# XPack Single Data 446267843Sdelphij0 string \xc3\x8d\ jm XPack single archive data 447159764Sobrien 448159764Sobrien# TODO: missing due to unknown magic/magic at end of file: 449159764Sobrien#DWC 450159764Sobrien#ARG 451159764Sobrien#ZAR 452159764Sobrien#PC/3270 453159764Sobrien#InstallIt 454159764Sobrien#RKive 455159764Sobrien#RK 456159764Sobrien#XPack Diskimage 457159764Sobrien 458159764Sobrien# These were inspired by idarc, but actually verified 459159764Sobrien# Dzip archiver (.dz) 460159764Sobrien0 string DZ Dzip archive data 461159764Sobrien>2 byte x \b, version %i 462159764Sobrien>3 byte x \b.%i 463159764Sobrien# ZZip archiver (.zz) 464159764Sobrien0 string ZZ\ \0\0 ZZip archive data 465159764Sobrien0 string ZZ0 ZZip archive data 466159764Sobrien# PAQ archiver (.paq) 467159764Sobrien0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 468159764Sobrien0 string PAQ PAQ archive data 469159764Sobrien>3 byte&0xf0 0x30 470159764Sobrien>>3 byte x (v%c) 471159764Sobrien# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 472159764Sobrien0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 473159764Sobrien0 string JARCS JAR (ARJ Software, Inc.) archive data 474159764Sobrien 47568349Sobrien# ARJ archiver (jason@jarthur.Claremont.EDU) 47668349Sobrien0 leshort 0xea60 ARJ archive data 477186690Sobrien!:mime application/x-arj 47868349Sobrien>5 byte x \b, v%d, 47968349Sobrien>8 byte &0x04 multi-volume, 48068349Sobrien>8 byte &0x10 slash-switched, 48168349Sobrien>8 byte &0x20 backup, 48268349Sobrien>34 string x original name: %s, 48368349Sobrien>7 byte 0 os: MS-DOS 48468349Sobrien>7 byte 1 os: PRIMOS 48568349Sobrien>7 byte 2 os: Unix 48668349Sobrien>7 byte 3 os: Amiga 48768349Sobrien>7 byte 4 os: Macintosh 48868349Sobrien>7 byte 5 os: OS/2 48968349Sobrien>7 byte 6 os: Apple ][ GS 49068349Sobrien>7 byte 7 os: Atari ST 49168349Sobrien>7 byte 8 os: NeXT 49268349Sobrien>7 byte 9 os: VAX/VMS 49368349Sobrien>3 byte >0 %d] 494159764Sobrien# [JW] idarc says this is also possible 495159764Sobrien2 leshort 0xea60 ARJ archive data 49668349Sobrien 49768349Sobrien# HA archiver (Greg Roelofs, newt@uchicago.edu) 49868349Sobrien# This is a really bad format. A file containing HAWAII will match this... 49968349Sobrien#0 string HA HA archive data, 50068349Sobrien#>2 leshort =1 1 file, 501267843Sdelphij#>2 leshort >1 %hu files, 50268349Sobrien#>4 byte&0x0f =0 first is type CPY 50368349Sobrien#>4 byte&0x0f =1 first is type ASC 50468349Sobrien#>4 byte&0x0f =2 first is type HSC 50568349Sobrien#>4 byte&0x0f =0x0e first is type DIR 50668349Sobrien#>4 byte&0x0f =0x0f first is type SPECIAL 507159764Sobrien# suggestion: at least identify small archives (<1024 files) 508159764Sobrien0 belong&0xffff00fc 0x48410000 HA archive data 509159764Sobrien>2 leshort =1 1 file, 510159764Sobrien>2 leshort >1 %u files, 511159764Sobrien>4 byte&0x0f =0 first is type CPY 512159764Sobrien>4 byte&0x0f =1 first is type ASC 513159764Sobrien>4 byte&0x0f =2 first is type HSC 514159764Sobrien>4 byte&0x0f =0x0e first is type DIR 515159764Sobrien>4 byte&0x0f =0x0f first is type SPECIAL 51668349Sobrien 51768349Sobrien# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 51868349Sobrien0 string HPAK HPACK archive data 51968349Sobrien 52068349Sobrien# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 521169962Sobrien0 string \351,\001JAM\ JAM archive, 52268349Sobrien>7 string >\0 version %.4s 52368349Sobrien>0x26 byte =0x27 - 52468349Sobrien>>0x2b string >\0 label %.11s, 52568349Sobrien>>0x27 lelong x serial %08x, 52668349Sobrien>>0x36 string >\0 fstype %.8s 52768349Sobrien 52868349Sobrien# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 529159764Sobrien2 string -lh0- LHarc 1.x/ARX archive data [lh0] 530186690Sobrien!:mime application/x-lharc 531159764Sobrien2 string -lh1- LHarc 1.x/ARX archive data [lh1] 532186690Sobrien!:mime application/x-lharc 53368349Sobrien2 string -lz4- LHarc 1.x archive data [lz4] 534186690Sobrien!:mime application/x-lharc 53568349Sobrien2 string -lz5- LHarc 1.x archive data [lz5] 536186690Sobrien!:mime application/x-lharc 53768349Sobrien# [never seen any but the last; -lh4- reported in comp.compression:] 538159764Sobrien2 string -lzs- LHa/LZS archive data [lzs] 539186690Sobrien!:mime application/x-lha 54068349Sobrien2 string -lh\40- LHa 2.x? archive data [lh ] 541186690Sobrien!:mime application/x-lha 54268349Sobrien2 string -lhd- LHa 2.x? archive data [lhd] 543186690Sobrien!:mime application/x-lha 54468349Sobrien2 string -lh2- LHa 2.x? archive data [lh2] 545186690Sobrien!:mime application/x-lha 54668349Sobrien2 string -lh3- LHa 2.x? archive data [lh3] 547186690Sobrien!:mime application/x-lha 54868349Sobrien2 string -lh4- LHa (2.x) archive data [lh4] 549186690Sobrien!:mime application/x-lha 55068349Sobrien2 string -lh5- LHa (2.x) archive data [lh5] 551186690Sobrien!:mime application/x-lha 55280588Sobrien2 string -lh6- LHa (2.x) archive data [lh6] 553186690Sobrien!:mime application/x-lha 554159764Sobrien2 string -lh7- LHa (2.x)/LHark archive data [lh7] 555186690Sobrien!:mime application/x-lha 55668349Sobrien>20 byte x - header level %d 557159764Sobrien# taken from idarc [JW] 558159764Sobrien2 string -lZ PUT archive data 559226048Sobrien2 string -lz LZS archive data 560159764Sobrien2 string -sw1- Swag archive data 56168349Sobrien 56268349Sobrien# RAR archiver (Greg Roelofs, newt@uchicago.edu) 563133359Sobrien0 string Rar! RAR archive data, 564186690Sobrien!:mime application/x-rar 565133359Sobrien>44 byte x v%0x, 566169942Sobrien>10 byte >0 flags: 567169942Sobrien>>10 byte &0x01 Archive volume, 568169942Sobrien>>10 byte &0x02 Commented, 569169942Sobrien>>10 byte &0x04 Locked, 570169942Sobrien>>10 byte &0x08 Solid, 571169942Sobrien>>10 byte &0x20 Authenticated, 572133359Sobrien>35 byte 0 os: MS-DOS 573133359Sobrien>35 byte 1 os: OS/2 574133359Sobrien>35 byte 2 os: Win32 575133359Sobrien>35 byte 3 os: Unix 576159764Sobrien# some old version? idarc says: 577159764Sobrien0 string RE\x7e\x5e RAR archive data 57868349Sobrien 57968349Sobrien# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 58068349Sobrien0 string SQSH squished archive data (Acorn RISCOS) 58168349Sobrien 58268349Sobrien# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 583159764Sobrien# [JW] see exe section for self-extracting version 58468349Sobrien0 string UC2\x1a UC2 archive data 58568349Sobrien 586226048Sobrien# PKZIP multi-volume archive 587226048Sobrien0 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 588186690Sobrien!:mime application/zip 58968349Sobrien 590226048Sobrien# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 591267843Sdelphij0 string PK\005\006 Zip archive data (empty) 592226048Sobrien0 string PK\003\004 593159764Sobrien 594226048Sobrien# Specialised zip formats which start with a member named 'mimetype' 595226048Sobrien# (stored uncompressed, with no 'extra field') containing the file's MIME type. 596226048Sobrien# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 597226048Sobrien# contents starting with "application/": 598226048Sobrien>26 string \x8\0\0\0mimetypeapplication/ 599159764Sobrien 600226048Sobrien# KOffice / OpenOffice & StarOffice / OpenDocument formats 601226048Sobrien# From: Abel Cheung <abel@oaka.org> 602159764Sobrien 603226048Sobrien# KOffice (1.2 or above) formats 604226048Sobrien# (mimetype contains "application/vnd.kde.<SUBTYPE>") 605226048Sobrien>>50 string vnd.kde. KOffice (>=1.2) 606226048Sobrien>>>58 string karbon Karbon document 607226048Sobrien>>>58 string kchart KChart document 608226048Sobrien>>>58 string kformula KFormula document 609226048Sobrien>>>58 string kivio Kivio document 610226048Sobrien>>>58 string kontour Kontour document 611226048Sobrien>>>58 string kpresenter KPresenter document 612226048Sobrien>>>58 string kspread KSpread document 613226048Sobrien>>>58 string kword KWord document 614226048Sobrien 615226048Sobrien# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 616226048Sobrien# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 617226048Sobrien>>50 string vnd.sun.xml. OpenOffice.org 1.x 618226048Sobrien>>>62 string writer Writer 619226048Sobrien>>>>68 byte !0x2e document 620226048Sobrien>>>>68 string .template template 621226048Sobrien>>>>68 string .global global document 622226048Sobrien>>>62 string calc Calc 623226048Sobrien>>>>66 byte !0x2e spreadsheet 624226048Sobrien>>>>66 string .template template 625226048Sobrien>>>62 string draw Draw 626226048Sobrien>>>>66 byte !0x2e document 627226048Sobrien>>>>66 string .template template 628226048Sobrien>>>62 string impress Impress 629226048Sobrien>>>>69 byte !0x2e presentation 630226048Sobrien>>>>69 string .template template 631226048Sobrien>>>62 string math Math document 632226048Sobrien>>>62 string base Database file 633226048Sobrien 634226048Sobrien# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 635226048Sobrien# http://lists.oasis-open.org/archives/office/200505/msg00006.html 636226048Sobrien# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 637226048Sobrien>>50 string vnd.oasis.opendocument. OpenDocument 638226048Sobrien>>>73 string text 639226048Sobrien>>>>77 byte !0x2d Text 640186690Sobrien!:mime application/vnd.oasis.opendocument.text 641226048Sobrien>>>>77 string -template Text Template 642226048Sobrien!:mime application/vnd.oasis.opendocument.text-template 643226048Sobrien>>>>77 string -web HTML Document Template 644226048Sobrien!:mime application/vnd.oasis.opendocument.text-web 645226048Sobrien>>>>77 string -master Master Document 646226048Sobrien!:mime application/vnd.oasis.opendocument.text-master 647226048Sobrien>>>73 string graphics 648226048Sobrien>>>>81 byte !0x2d Drawing 649226048Sobrien!:mime application/vnd.oasis.opendocument.graphics 650226048Sobrien>>>>81 string -template Template 651226048Sobrien!:mime application/vnd.oasis.opendocument.graphics-template 652226048Sobrien>>>73 string presentation 653226048Sobrien>>>>85 byte !0x2d Presentation 654226048Sobrien!:mime application/vnd.oasis.opendocument.presentation 655226048Sobrien>>>>85 string -template Template 656226048Sobrien!:mime application/vnd.oasis.opendocument.presentation-template 657226048Sobrien>>>73 string spreadsheet 658226048Sobrien>>>>84 byte !0x2d Spreadsheet 659226048Sobrien!:mime application/vnd.oasis.opendocument.spreadsheet 660226048Sobrien>>>>84 string -template Template 661226048Sobrien!:mime application/vnd.oasis.opendocument.spreadsheet-template 662226048Sobrien>>>73 string chart 663226048Sobrien>>>>78 byte !0x2d Chart 664226048Sobrien!:mime application/vnd.oasis.opendocument.chart 665226048Sobrien>>>>78 string -template Template 666226048Sobrien!:mime application/vnd.oasis.opendocument.chart-template 667226048Sobrien>>>73 string formula 668226048Sobrien>>>>80 byte !0x2d Formula 669226048Sobrien!:mime application/vnd.oasis.opendocument.formula 670226048Sobrien>>>>80 string -template Template 671226048Sobrien!:mime application/vnd.oasis.opendocument.formula-template 672226048Sobrien>>>73 string database Database 673226048Sobrien!:mime application/vnd.oasis.opendocument.database 674226048Sobrien>>>73 string image 675226048Sobrien>>>>78 byte !0x2d Image 676226048Sobrien!:mime application/vnd.oasis.opendocument.image 677226048Sobrien>>>>78 string -template Template 678226048Sobrien!:mime application/vnd.oasis.opendocument.image-template 679159764Sobrien 680226048Sobrien# EPUB (OEBPS) books using OCF (OEBPS Container Format) 681226048Sobrien# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 682267843Sdelphij# From: Ralf Brown <ralf.brown@gmail.com> 683267843Sdelphij>>50 string epub+zip EPUB document 684267843Sdelphij!:mime application/epub+zip 685226048Sobrien 686226048Sobrien# Catch other ZIP-with-mimetype formats 687226048Sobrien# In a ZIP file, the bytes immediately after a member's contents are 688226048Sobrien# always "PK". The 2 regex rules here print the "mimetype" member's 689226048Sobrien# contents up to the first 'P'. Luckily, most MIME types don't contain 690226048Sobrien# any capital 'P's. This is a kludge. 691226048Sobrien# (mimetype contains "application/<OTHER>") 692226048Sobrien>>50 string !epub+zip 693226048Sobrien>>>50 string !vnd.oasis.opendocument. 694226048Sobrien>>>>50 string !vnd.sun.xml. 695226048Sobrien>>>>>50 string !vnd.kde. 696226048Sobrien>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 697226048Sobrien!:mime application/zip 698226048Sobrien# (mimetype contents other than "application/*") 699226048Sobrien>26 string \x8\0\0\0mimetype 700226048Sobrien>>38 string !application/ 701226048Sobrien>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 702226048Sobrien!:mime application/zip 703226048Sobrien 704267843Sdelphij# Java Jar files 705267843Sdelphij>(26.s+30) leshort 0xcafe Java archive data (JAR) 706267843Sdelphij!:mime application/java-archive 707267843Sdelphij 708226048Sobrien# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 709226048Sobrien# Next line excludes specialized formats: 710267843Sdelphij>(26.s+30) leshort !0xcafe 711267843Sdelphij>>26 string !\x8\0\0\0mimetype Zip archive data 712226048Sobrien!:mime application/zip 713267843Sdelphij>>>4 byte 0x09 \b, at least v0.9 to extract 714267843Sdelphij>>>4 byte 0x0a \b, at least v1.0 to extract 715267843Sdelphij>>>4 byte 0x0b \b, at least v1.1 to extract 716267843Sdelphij>>>4 byte 0x14 \b, at least v2.0 to extract 717284778Sdelphij>>>4 byte 0x2d \b, at least v4.5 to extract 718267843Sdelphij>>>0x161 string WINZIP \b, WinZIP self-extracting 719226048Sobrien 720226048Sobrien# StarView Metafile 721226048Sobrien# From Pierre Ducroquet <pinaraf@pinaraf.info> 722226048Sobrien0 string VCLMTF StarView MetaFile 723226048Sobrien>6 beshort x \b, version %d 724226048Sobrien>8 belong x \b, size %d 725226048Sobrien 72668349Sobrien# Zoo archiver 72768349Sobrien20 lelong 0xfdc4a7dc Zoo archive data 728186690Sobrien!:mime application/x-zoo 72968349Sobrien>4 byte >48 \b, v%c. 73068349Sobrien>>6 byte >47 \b%c 73168349Sobrien>>>7 byte >47 \b%c 73268349Sobrien>32 byte >0 \b, modify: v%d 73368349Sobrien>>33 byte x \b.%d+ 73468349Sobrien>42 lelong 0xfdc4a7dc \b, 73568349Sobrien>>70 byte >0 extract: v%d 73668349Sobrien>>>71 byte x \b.%d+ 73768349Sobrien 73868349Sobrien# Shell archives 73968349Sobrien10 string #\ This\ is\ a\ shell\ archive shell archive text 740186690Sobrien!:mime application/octet-stream 74168349Sobrien 74268349Sobrien# 743226048Sobrien# LBR. NB: May conflict with the questionable 74468349Sobrien# "binary Computer Graphics Metafile" format. 74568349Sobrien# 74668349Sobrien0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 74768349Sobrien# 74868349Sobrien# PMA (CP/M derivative of LHA) 74968349Sobrien# 75068349Sobrien2 string -pm0- PMarc archive data [pm0] 75168349Sobrien2 string -pm1- PMarc archive data [pm1] 75268349Sobrien2 string -pm2- PMarc archive data [pm2] 75368349Sobrien2 string -pms- PMarc SFX archive (CP/M, DOS) 75468349Sobrien5 string -pc1- PopCom compressed executable (CP/M) 75568349Sobrien 756110949Sobrien# From Rafael Laboissiere <rafael@laboissiere.net> 75768349Sobrien# The Project Revision Control System (see 758110949Sobrien# http://prcs.sourceforge.net) generates a packaged project 759226048Sobrien# file which is recognized by the following entry: 76068349Sobrien0 leshort 0xeb81 PRCS packaged project 76174784Sobrien 762226048Sobrien# Microsoft cabinets 76374784Sobrien# by David Necas (Yeti) <yeti@physics.muni.cz> 764133359Sobrien#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 765133359Sobrien#>25 byte x v%d 766133359Sobrien#>24 byte x \b.%d 767133359Sobrien# MPi: All CABs have version 1.3, so this is pointless. 768133359Sobrien# Better magic in debian-additions. 76974784Sobrien 770226048Sobrien# GTKtalog catalogs 77174784Sobrien# by David Necas (Yeti) <yeti@physics.muni.cz> 77275937Sobrien4 string gtktalog\ GTKtalog catalog data, 77375937Sobrien>13 string 3 version 3 77475937Sobrien>>14 beshort 0x677a (gzipped) 77575937Sobrien>>14 beshort !0x677a (not gzipped) 77675937Sobrien>13 string >3 version %s 777103373Sobrien 778103373Sobrien############################################################################ 779103373Sobrien# Parity archive reconstruction file, the 'par' file format now used on Usenet. 780103373Sobrien0 string PAR\0 PARity archive data 781103373Sobrien>48 leshort =0 - Index file 782103373Sobrien>48 leshort >0 - file number %d 783133359Sobrien 784133359Sobrien# Felix von Leitner <felix-file@fefe.de> 785133359Sobrien0 string d8:announce BitTorrent file 786186690Sobrien!:mime application/x-bittorrent 787133359Sobrien 788133359Sobrien# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 789226048Sobrien0 beshort 0x0e0f Atari MSA archive data 790226048Sobrien>2 beshort x \b, %d sectors per track 791226048Sobrien>4 beshort 0 \b, 1 sided 792226048Sobrien>4 beshort 1 \b, 2 sided 793226048Sobrien>6 beshort x \b, starting track: %d 794226048Sobrien>8 beshort x \b, ending track: %d 795133359Sobrien 796133359Sobrien# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 797133359Sobrien0 string PK00PK\003\004 Zip archive data 798133359Sobrien 799133359Sobrien# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 800133359Sobrien# by Stefan `Sec` Zehl <sec@42.org> 801159764Sobrien7 string **ACE** ACE archive data 802133359Sobrien>15 byte >0 version %d 803133359Sobrien>16 byte =0x00 \b, from MS-DOS 804133359Sobrien>16 byte =0x01 \b, from OS/2 805133359Sobrien>16 byte =0x02 \b, from Win/32 806133359Sobrien>16 byte =0x03 \b, from Unix 807133359Sobrien>16 byte =0x04 \b, from MacOS 808133359Sobrien>16 byte =0x05 \b, from WinNT 809133359Sobrien>16 byte =0x06 \b, from Primos 810133359Sobrien>16 byte =0x07 \b, from AppleGS 811133359Sobrien>16 byte =0x08 \b, from Atari 812133359Sobrien>16 byte =0x09 \b, from Vax/VMS 813133359Sobrien>16 byte =0x0A \b, from Amiga 814133359Sobrien>16 byte =0x0B \b, from Next 815133359Sobrien>14 byte x \b, version %d to extract 816133359Sobrien>5 leshort &0x0080 \b, multiple volumes, 817133359Sobrien>>17 byte x \b (part %d), 818133359Sobrien>5 leshort &0x0002 \b, contains comment 819133359Sobrien>5 leshort &0x0200 \b, sfx 820133359Sobrien>5 leshort &0x0400 \b, small dictionary 821133359Sobrien>5 leshort &0x0800 \b, multi-volume 822133359Sobrien>5 leshort &0x1000 \b, contains AV-String 823159764Sobrien>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 824133359Sobrien>5 leshort &0x2000 \b, with recovery record 825133359Sobrien>5 leshort &0x4000 \b, locked 826133359Sobrien>5 leshort &0x8000 \b, solid 827133359Sobrien# Date in MS-DOS format (whatever that is) 828133359Sobrien#>18 lelong x Created on 829133359Sobrien 830133359Sobrien# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 831133359Sobrien# <doj@cubic.org> 832133359Sobrien0x1A string sfArk sfArk compressed Soundfont 833133359Sobrien>0x15 string 2 834133359Sobrien>>0x1 string >\0 Version %s 835133359Sobrien>>0x2A string >\0 : %s 836133359Sobrien 837159764Sobrien# DR-DOS 7.03 Packed File *.??_ 838159764Sobrien0 string Packed\ File\ Personal NetWare Packed File 839226048Sobrien>12 string x \b, was "%.12s" 840159764Sobrien 841159764Sobrien# EET archive 842159764Sobrien# From: Tilman Sauerbeck <tilman@code-monkey.de> 843159764Sobrien0 belong 0x1ee7ff00 EET archive 844186690Sobrien!:mime application/x-eet 845169942Sobrien 846169942Sobrien# rzip archives 847169942Sobrien0 string RZIP rzip compressed data 848169942Sobrien>4 byte x - version %d 849169942Sobrien>5 byte x \b.%d 850169942Sobrien>6 belong x (%d bytes) 851169942Sobrien 852169942Sobrien# From: "Robert Dale" <robdale@gmail.com> 853169942Sobrien0 belong 123 dar archive, 854169942Sobrien>4 belong x label "%.8x 855169942Sobrien>>8 belong x %.8x 856169942Sobrien>>>12 beshort x %.4x" 857169942Sobrien>14 byte 0x54 end slice 858169942Sobrien>14 beshort 0x4e4e multi-part 859169942Sobrien>14 beshort 0x4e53 multi-part, with -S 860169962Sobrien 861169962Sobrien# Symbian installation files 862169962Sobrien# http://www.thouky.co.uk/software/psifs/sis.html 863169962Sobrien# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 864169962Sobrien8 lelong 0x10000419 Symbian installation file 865186690Sobrien!:mime application/vnd.symbian.install 866169962Sobrien>4 lelong 0x1000006D (EPOC release 3/4/5) 867169962Sobrien>4 lelong 0x10003A12 (EPOC release 6) 868169962Sobrien0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 869186690Sobrien!:mime x-epoc/x-sisx-app 870175296Sobrien 871175296Sobrien# From "Nelson A. de Oliveira" <naoliv@gmail.com> 872175296Sobrien0 string MPQ\032 MoPaQ (MPQ) archive 873175296Sobrien 874175296Sobrien# From: Dirk Jagdmann <doj@cubic.org> 875175296Sobrien# xar archive format: http://code.google.com/p/xar/ 876175296Sobrien0 string xar! xar archive 877267843Sdelphij>6 beshort x - version %d 878175296Sobrien 879175296Sobrien# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 880175296Sobrien# .kgb 881175296Sobrien0 string KGB_arch KGB Archiver file 882175296Sobrien>10 string x with compression level %.1s 883186690Sobrien 884186690Sobrien# xar (eXtensible ARchiver) archive 885186690Sobrien# From: "David Remahl" <dremahl@apple.com> 886186690Sobrien0 string xar! xar archive 887186690Sobrien#>4 beshort x header size %d 888186690Sobrien>6 beshort x version %d, 889186690Sobrien#>8 quad x compressed TOC: %d, 890186690Sobrien#>16 quad x uncompressed TOC: %d, 891186690Sobrien>24 belong 0 no checksum 892186690Sobrien>24 belong 1 SHA-1 checksum 893186690Sobrien>24 belong 2 MD5 checksum 894186690Sobrien 895226048Sobrien# Type: Parity Archive 896226048Sobrien# From: Daniel van Eeden <daniel_e@dds.nl> 897226048Sobrien0 string PAR2 Parity Archive Volume Set 898226048Sobrien 899226048Sobrien# Bacula volume format. (Volumes always start with a block header.) 900226048Sobrien# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 901226048Sobrien# From: Adam Buchbinder <adam.buchbinder@gmail.com> 902226048Sobrien12 string BB02 Bacula volume 903226048Sobrien>20 bedate x \b, started %s 904226048Sobrien 905226048Sobrien# ePub is XHTML + XML inside a ZIP archive. The first member of the 906226048Sobrien# archive must be an uncompressed file called 'mimetype' with contents 907226048Sobrien# 'application/epub+zip' 908226048Sobrien 909226048Sobrien 910267843Sdelphij# From: "Michael Gorny" <mgorny@gentoo.org> 911226048Sobrien# ZPAQ: http://mattmahoney.net/dc/zpaq.html 912226048Sobrien0 string zPQ ZPAQ stream 913226048Sobrien>3 byte x \b, level %d 914284778Sdelphij# From: Barry Carter <carter.barry@gmail.com> 915284778Sdelphij# http://encode.ru/threads/456-zpaq-updates/page32 916284778Sdelphij0 string 7kSt ZPAQ file 917226048Sobrien 918226048Sobrien# BBeB ebook, unencrypted (LRF format) 919226048Sobrien# URL: http://www.sven.de/librie/Librie/LrfFormat 920226048Sobrien# From: Adam Buchbinder <adam.buchbinder@gmail.com> 921226048Sobrien0 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 922226048Sobrien>8 beshort x \b, version %d 923226048Sobrien>36 byte 1 \b, front-to-back 924226048Sobrien>36 byte 16 \b, back-to-front 925226048Sobrien>42 beshort x \b, (%dx, 926226048Sobrien>44 beshort x %d) 927267843Sdelphij 928267843Sdelphij# Symantec GHOST image by Joerg Jenderek at May 2014 929267843Sdelphij# http://us.norton.com/ghost/ 930267843Sdelphij# http://www.garykessler.net/library/file_sigs.html 931267843Sdelphij0 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image 932267843Sdelphij# *.GHO 933267843Sdelphij>2 ubyte&0x08 0x00 \b, first file 934267843Sdelphij# *.GHS or *.[0-9] with cns program option 935267843Sdelphij>2 ubyte&0x08 0x08 \b, split file 936267843Sdelphij# part of split index interesting for *.ghs 937267843Sdelphij>>4 ubyte x id=0x%x 938267843Sdelphij# compression tag minus one equals numeric compression command line switch z[1-9] 939267843Sdelphij>3 ubyte 0 \b, no compression 940267843Sdelphij>3 ubyte 2 \b, fast compression (Z1) 941267843Sdelphij>3 ubyte 3 \b, medium compression (Z2) 942267843Sdelphij>3 ubyte >3 943267843Sdelphij>>3 ubyte <11 \b, compression (Z%d-1) 944267843Sdelphij>2 ubyte&0x08 0x00 945267843Sdelphij# ~ 30 byte password field only for *.gho 946267843Sdelphij>>12 ubequad !0 \b, password protected 947267843Sdelphij>>44 ubyte !1 948267843Sdelphij# 1~Image All, sector-by-sector only for *.gho 949267843Sdelphij>>>10 ubyte 1 \b, sector copy 950267843Sdelphij# 1~Image Boot track only for *.gho 951267843Sdelphij>>>43 ubyte 1 \b, boot track 952267843Sdelphij# 1~Image Disc only for *.gho implies Image Boot track and sector copy 953267843Sdelphij>>44 ubyte 1 \b, disc sector copy 954267843Sdelphij# optional image description only *.gho 955267843Sdelphij>>0xff string >\0 "%-.254s" 956267843Sdelphij# look for DOS sector end sequence 957267843Sdelphij>0xE08 search/7776 \x55\xAA 958267843Sdelphij>>&-512 indirect x \b; contains 959267843Sdelphij 960