1226048Sobrien 268349Sobrien#------------------------------------------------------------------------------ 3330569Sgordon# $File: apple,v 1.36 2017/03/17 21:35:28 christos Exp $ 468349Sobrien# apple: file(1) magic for Apple file formats 568349Sobrien# 6226048Sobrien0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 768349Sobrien0 string \x0aGL Binary II (apple ][) data 868349Sobrien0 string \x76\xff Squeezed (apple ][) data 968349Sobrien0 string NuFile NuFile archive (apple ][) data 1068349Sobrien0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 1168349Sobrien0 belong 0x00051600 AppleSingle encoded Macintosh file 1268349Sobrien0 belong 0x00051607 AppleDouble encoded Macintosh file 1368349Sobrien 14186690Sobrien# Type: Apple Emulator 2IMG format 15186690Sobrien# From: Radek Vokal <rvokal@redhat.com> 16186690Sobrien0 string 2IMG Apple ][ 2IMG Disk Image 17186690Sobrien>4 string XGS! \b, XGS 18186690Sobrien>4 string CTKG \b, Catakig 19186690Sobrien>4 string ShIm \b, Sheppy's ImageMaker 20186690Sobrien>4 string WOOF \b, Sweet 16 21186690Sobrien>4 string B2TR \b, Bernie ][ the Rescue 22186690Sobrien>4 string !nfc \b, ASIMOV2 23186690Sobrien>4 string x \b, Unknown Format 24186690Sobrien>0xc byte 00 \b, DOS 3.3 sector order 25186690Sobrien>>0x10 byte 00 \b, Volume 254 26186690Sobrien>>0x10 byte&0x7f x \b, Volume %u 27186690Sobrien>0xc byte 01 \b, ProDOS sector order 28186690Sobrien>>0x14 short x \b, %u Blocks 29186690Sobrien>0xc byte 02 \b, NIB data 30186690Sobrien 3168349Sobrien# magic for Newton PDA package formats 3268349Sobrien# from Ruda Moura <ruda@helllabs.org> 3375937Sobrien0 string package0 Newton package, NOS 1.x, 3468349Sobrien>12 belong &0x80000000 AutoRemove, 3568349Sobrien>12 belong &0x40000000 CopyProtect, 3668349Sobrien>12 belong &0x10000000 NoCompression, 3768349Sobrien>12 belong &0x04000000 Relocation, 3868349Sobrien>12 belong &0x02000000 UseFasterCompression, 3968349Sobrien>16 belong x version %d 4068349Sobrien 4175937Sobrien0 string package1 Newton package, NOS 2.x, 4275937Sobrien>12 belong &0x80000000 AutoRemove, 4375937Sobrien>12 belong &0x40000000 CopyProtect, 4475937Sobrien>12 belong &0x10000000 NoCompression, 4575937Sobrien>12 belong &0x04000000 Relocation, 4675937Sobrien>12 belong &0x02000000 UseFasterCompression, 4775937Sobrien>16 belong x version %d 4875937Sobrien 49133359Sobrien0 string package4 Newton package, 50133359Sobrien>8 byte 8 NOS 1.x, 51133359Sobrien>8 byte 9 NOS 2.x, 52133359Sobrien>12 belong &0x80000000 AutoRemove, 53133359Sobrien>12 belong &0x40000000 CopyProtect, 54133359Sobrien>12 belong &0x10000000 NoCompression, 55133359Sobrien 5668349Sobrien# The following entries for the Apple II are for files that have 5768349Sobrien# been transferred as raw binary data from an Apple, without having 5868349Sobrien# been encapsulated by any of the above archivers. 5968349Sobrien# 6068349Sobrien# In general, Apple II formats are hard to identify because Apple DOS 6168349Sobrien# and especially Apple ProDOS have strong typing in the file system and 6268349Sobrien# therefore programmers never felt much need to include type information 6368349Sobrien# in the files themselves. 6468349Sobrien# 6568349Sobrien# Eric Fischer <enf@pobox.com> 6668349Sobrien 6768349Sobrien# AppleWorks word processor: 68330569Sgordon# URL: https://en.wikipedia.org/wiki/AppleWorks 69330569Sgordon# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx 70330569Sgordon# Update: Joerg Jenderek 71330569Sgordon# NOTE: 7268349Sobrien# The "O" is really the magic number, but that's so common that it's 7368349Sobrien# necessary to check the tab stops that follow it to avoid false positives. 74330569Sgordon# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge 75330569Sgordon# the newer AppleWorks is from claris with extension CWK 76330569Sgordon4 string O 77330569Sgordon# test for unused bits of zoom- , paginated-boolean bytes 78330569Sgordon>84 ubequad ^0x00Fe00000000Fe00 79330569Sgordon# look for tabstop definitions "=" no tab, "|" no tab 80330569Sgordon# "<" left tab,"^" center tab,">" right tab, "." decimal tab, 81330569Sgordon# unofficial "!" other , "\x8a" other 82330569Sgordon# official only if SFMinVers is nonzero 83330569Sgordon>>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor 84330569Sgordon# AppleWorks Word Processor File (Apple II) 85330569Sgordon# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" 86330569Sgordon# application/x-appleworks is mime type for claris version with cwk extension 87330569Sgordon!:mime application/x-appleworks3 88330569Sgordon# http://home.earthlink.net/~hughhood/appleiiworksenvoy/ 89330569Sgordon# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') 90330569Sgordon# $70 $1A $F8 $FF is this the apple type ? 91330569Sgordon#:apple pdosp�� 92330569Sgordon!:ext awp 93330569Sgordon# minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) 94330569Sgordon>>>183 ubyte 30 3.0 95330569Sgordon>>>183 ubyte !30 96330569Sgordon>>>>183 ubyte !0 0x%x 97330569Sgordon# usual tabstop start sequence "=====<" 98330569Sgordon>>>5 string x \b, tabstop ruler "%6.6s" 99330569Sgordon# tabstop ruler 100330569Sgordon#>>>5 string >\0 \b, tabstops "%-79s" 101330569Sgordon# zoom switch 102330569Sgordon>>>85 byte&0x01 >0 \b, zoomed 103330569Sgordon# whether paginated 104330569Sgordon>>>90 byte&0x01 >0 \b, paginated 105330569Sgordon# contains any mail-merge commands 106330569Sgordon>>>92 byte&0x01 >0 \b, with mail merge 107330569Sgordon# left margin in 1/10 inches ( normally 0 or 10 ) 108330569Sgordon>>>91 ubyte >0 109330569Sgordon>>>>91 ubyte x \b, %d/10 inch left margin 11068349Sobrien 11168349Sobrien# AppleWorks database: 11268349Sobrien# 11368349Sobrien# This isn't really a magic number, but it's the closest thing to one 11468349Sobrien# that I could find. The 1 and 2 really mean "order in which you defined 11568349Sobrien# categories" and "left to right, top to bottom," respectively; the D and R 11668349Sobrien# mean that the cursor should move either down or right when you press Return. 11768349Sobrien 11875937Sobrien#30 string \x01D AppleWorks database data 11975937Sobrien#30 string \x02D AppleWorks database data 12075937Sobrien#30 string \x01R AppleWorks database data 12175937Sobrien#30 string \x02R AppleWorks database data 12268349Sobrien 12368349Sobrien# AppleWorks spreadsheet: 12468349Sobrien# 12568349Sobrien# Likewise, this isn't really meant as a magic number. The R or C means 12668349Sobrien# row- or column-order recalculation; the A or M means automatic or manual 12768349Sobrien# recalculation. 12868349Sobrien 12975937Sobrien#131 string RA AppleWorks spreadsheet data 13075937Sobrien#131 string RM AppleWorks spreadsheet data 13175937Sobrien#131 string CA AppleWorks spreadsheet data 13275937Sobrien#131 string CM AppleWorks spreadsheet data 13368349Sobrien 13468349Sobrien# Applesoft BASIC: 13568349Sobrien# 13668349Sobrien# This is incredibly sloppy, but will be true if the program was 13768349Sobrien# written at its usual memory location of 2048 and its first line 13868349Sobrien# number is less than 256. Yuck. 139267843Sdelphij# update by Joerg Jenderek at Feb 2013 14068349Sobrien 141267843Sdelphij# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 142267843Sdelphij#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 143330569Sgordon0 belong&0x00ff00ff 0x00080000 144267843Sdelphij# assuming that line number must be positive 145267843Sdelphij>2 leshort >0 Applesoft BASIC program data, first line number %d 14668349Sobrien#>2 leshort x \b, first line number %d 14768349Sobrien 14868349Sobrien# ORCA/EZ assembler: 149330569Sgordon# 15068349Sobrien# This will not identify ORCA/M source files, since those have 15168349Sobrien# some sort of date code instead of the two zero bytes at 6 and 7 15268349Sobrien# XXX Conflicts with ELF 15368349Sobrien#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 15468349Sobrien#>5 byte x \b, build number %d 15568349Sobrien 15668349Sobrien# Broderbund Fantavision 15768349Sobrien# 15868349Sobrien# I don't know what these values really mean, but they seem to recur. 15968349Sobrien# Will they cause too many conflicts? 16068349Sobrien 16168349Sobrien# Probably :-) 16268349Sobrien#2 belong&0xFF00FF 0x040008 Fantavision movie data 16368349Sobrien 16468349Sobrien# Some attempts at images. 16568349Sobrien# 16668349Sobrien# These are actually just bit-for-bit dumps of the frame buffer, so 16768349Sobrien# there's really no reasonably way to distinguish them except for their 16868349Sobrien# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 16968349Sobrien# or, occasionally, 8184. 17068349Sobrien# 17168349Sobrien# Nevertheless this will manage to catch a lot of images that happen 17268349Sobrien# to have a solid-colored line at the bottom of the screen. 17368349Sobrien 174186690Sobrien# GRR: Magic too weak 175186690Sobrien#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 176186690Sobrien#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 177186690Sobrien#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 178186690Sobrien#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 179186690Sobrien#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 18068349Sobrien 18168349Sobrien# Beagle Bros. Apple Mechanic fonts 18268349Sobrien 18368349Sobrien0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 184133359Sobrien 185133359Sobrien# Apple Universal Disk Image Format (UDIF) - dmg files. 186133359Sobrien# From Johan Gade. 187133359Sobrien# These entries are disabled for now until we fix the following issues. 188133359Sobrien# 189330569Sgordon# Note there might be some problems with the "VAX COFF executable" 190330569Sgordon# entry. Note this entry should be placed before the mac filesystem section, 191133359Sobrien# particularly the "Apple Partition data" entry. 192133359Sobrien# 193330569Sgordon# The intended meaning of these tests is, that the file is only of the 194133359Sobrien# specified type if both of the lines are correct - i.e. if the first 195133359Sobrien# line matches and the second doesn't then it is not of that type. 196133359Sobrien# 197133359Sobrien#0 long 0x7801730d 198133359Sobrien#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 199133359Sobrien# 200330569Sgordon# Note that this entry is recognized correctly by the "Apple Partition 201133359Sobrien# data" entry - however since this entry is more specific - this 202133359Sobrien# information seems to be more useful. 203133359Sobrien#0 long 0x45520200 204133359Sobrien#>0x410 string disk\ image UDIF read/write image (UDRW) 205159764Sobrien 206159764Sobrien# From: Toby Peterson <toby@apple.com> 207159764Sobrien0 string bplist00 Apple binary property list 208159764Sobrien 209159764Sobrien# Apple binary property list (bplist) 210159764Sobrien# Assumes version bytes are hex. 211159764Sobrien# Provides content hints for version 0 files. Assumes that the root 212159764Sobrien# object is the first object (true for CoreFoundation implementation). 213159764Sobrien# From: David Remahl <dremahl@apple.com> 214159764Sobrien0 string bplist 215159764Sobrien>6 byte x \bCoreFoundation binary property list data, version 0x%c 216159764Sobrien>>7 byte x \b%c 217159764Sobrien>6 string 00 \b 218159764Sobrien>>8 byte&0xF0 0x00 \b 219159764Sobrien>>>8 byte&0x0F 0x00 \b, root type: null 220159764Sobrien>>>8 byte&0x0F 0x08 \b, root type: false boolean 221159764Sobrien>>>8 byte&0x0F 0x09 \b, root type: true boolean 222159764Sobrien>>8 byte&0xF0 0x10 \b, root type: integer 223159764Sobrien>>8 byte&0xF0 0x20 \b, root type: real 224159764Sobrien>>8 byte&0xF0 0x30 \b, root type: date 225159764Sobrien>>8 byte&0xF0 0x40 \b, root type: data 226159764Sobrien>>8 byte&0xF0 0x50 \b, root type: ascii string 227159764Sobrien>>8 byte&0xF0 0x60 \b, root type: unicode string 228159764Sobrien>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 229159764Sobrien>>8 byte&0xF0 0xa0 \b, root type: array 230159764Sobrien>>8 byte&0xF0 0xd0 \b, root type: dictionary 231159764Sobrien 232159764Sobrien# Apple/NeXT typedstream data 233159764Sobrien# Serialization format used by NeXT and Apple for various 234159764Sobrien# purposes in YellowStep/Cocoa, including some nib files. 235159764Sobrien# From: David Remahl <dremahl@apple.com> 236159764Sobrien2 string typedstream NeXT/Apple typedstream data, big endian 237267843Sdelphij>0 byte x \b, version %d 238159764Sobrien>0 byte <5 \b 239159764Sobrien>>13 byte 0x81 \b 240267843Sdelphij>>>14 ubeshort x \b, system %d 241159764Sobrien2 string streamtyped NeXT/Apple typedstream data, little endian 242267843Sdelphij>0 byte x \b, version %d 243159764Sobrien>0 byte <5 \b 244159764Sobrien>>13 byte 0x81 \b 245267843Sdelphij>>>14 uleshort x \b, system %d 246175296Sobrien 247175296Sobrien#------------------------------------------------------------------------------ 248175296Sobrien# CAF: Apple CoreAudio File Format 249175296Sobrien# 250175296Sobrien# Container format for high-end audio purposes. 251175296Sobrien# From: David Remahl <dremahl@apple.com> 252175296Sobrien# 253175296Sobrien0 string caff CoreAudio Format audio file 254175296Sobrien>4 beshort <10 version %d 255175296Sobrien>6 beshort x 256175296Sobrien 257175296Sobrien 258175296Sobrien#------------------------------------------------------------------------------ 259175296Sobrien# Keychain database files 260175296Sobrien0 string kych Mac OS X Keychain File 261175296Sobrien 262175296Sobrien#------------------------------------------------------------------------------ 263175296Sobrien# Code Signing related file types 264175296Sobrien0 belong 0xfade0c00 Mac OS X Code Requirement 265175296Sobrien>8 belong 1 (opExpr) 266175296Sobrien>4 belong x - %d bytes 267175296Sobrien 268175296Sobrien0 belong 0xfade0c01 Mac OS X Code Requirement Set 269175296Sobrien>8 belong >1 containing %d items 270175296Sobrien>4 belong x - %d bytes 271175296Sobrien 272175296Sobrien0 belong 0xfade0c02 Mac OS X Code Directory 273175296Sobrien>8 belong x version %x 274175296Sobrien>12 belong >0 flags 0x%x 275175296Sobrien>4 belong x - %d bytes 276175296Sobrien 277175296Sobrien0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 278175296Sobrien>4 belong x - %d bytes 279175296Sobrien 280175296Sobrien0 belong 0xfade0cc1 Mac OS X Detached Code Signature 281175296Sobrien>8 belong >1 (%d elements) 282175296Sobrien>4 belong x - %d bytes 283175296Sobrien 284175296Sobrien# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 285175296Sobrien# .vdi 286175296Sobrien4 string innotek\ VirtualBox\ Disk\ Image %s 287267843Sdelphij 288330569Sgordon# Apple disk partition stuff 289330569Sgordon# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 290330569Sgordon# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h 291330569Sgordon# Update: Joerg Jenderek 292330569Sgordon# "ER" is APPLE_DRVR_MAP_MAGIC signature 293267843Sdelphij0 beshort 0x4552 294330569Sgordon# display Apple Driver Map (strength=50) after Syslinux bootloader (71) 295330569Sgordon#!:strength +0 296330569Sgordon# strengthen the magic by looking for used blocksizes 512 2048 297330569Sgordon>2 ubeshort&0xf1FF 0 Apple Driver Map 298330569Sgordon# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid 299330569Sgordon#>>504 ubequad&0x0000FFffFFff0000 0 300330569Sgordon!:mime application/x-apple-diskimage 301330569Sgordon!:apple ????devr 302330569Sgordon# https://en.wikipedia.org/wiki/Apple_Disk_Image 303330569Sgordon!:ext dmg/iso 304330569Sgordon# sbBlkSize for driver descriptor map 512 2048 305267843Sdelphij>>2 beshort x \b, blocksize %d 306330569Sgordon# sbBlkCount sometimes garbish like 307330569Sgordon# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg 308330569Sgordon# 0xf2720100 for bunziped Firefox 48.0-2.dmg 309330569Sgordon# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso 310330569Sgordon# 0x00009090 by syslinux-6.03/utils/isohybrid.c 311330569Sgordon>>4 ubelong x \b, blockcount %u 312330569Sgordon# following device/driver information not very useful 313330569Sgordon# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 314330569Sgordon>>8 ubeshort x \b, devtype %u 315330569Sgordon# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 316330569Sgordon>>10 ubeshort x \b, devid %u 317330569Sgordon# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) 318330569Sgordon>>12 ubelong >0 319330569Sgordon>>>12 ubelong x \b, driver data %u 320330569Sgordon# number of driver descriptors sbDrvrCount <= 61 321330569Sgordon# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 322330569Sgordon>>16 ubeshort x \b, driver count %u 323330569Sgordon# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map 324330569Sgordon# >>18 use apple-driver-map 325330569Sgordon# >>26 use apple-driver-map 326330569Sgordon# # ... 327330569Sgordon# >>500 use apple-driver-map 328330569Sgordon# number of partitions is always same in every partition (map block count) 329330569Sgordon#>>0x0204 ubelong x \b, %u partitions 330330569Sgordon>>0x0204 ubelong >0 \b, contains[@0x200]: 331330569Sgordon>>>0x0200 use apple-apm 332330569Sgordon>>0x0204 ubelong >1 \b, contains[@0x400]: 333330569Sgordon>>>0x0400 use apple-apm 334330569Sgordon>>0x0204 ubelong >2 \b, contains[@0x600]: 335330569Sgordon>>>0x0600 use apple-apm 336330569Sgordon>>0x0204 ubelong >3 \b, contains[@0x800]: 337330569Sgordon>>>0x0800 use apple-apm 338330569Sgordon>>0x0204 ubelong >4 \b, contains[@0xA00]: 339330569Sgordon>>>0x0A00 use apple-apm 340330569Sgordon>>0x0204 ubelong >5 \b, contains[@0xC00]: 341330569Sgordon>>>0x0C00 use apple-apm 342330569Sgordon>>0x0204 ubelong >6 \b, contains[@0xE00]: 343330569Sgordon>>>0x0E00 use apple-apm 344330569Sgordon>>0x0204 ubelong >7 \b, contains[@0x1000]: 345330569Sgordon>>>0x1000 use apple-apm 346330569Sgordon# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 347330569Sgordon0 name apple-driver-map 348330569Sgordon>0 ubequad !0 349330569Sgordon# descBlock first block of driver 350330569Sgordon>>0 ubelong x \b, driver start block %u 351330569Sgordon# descSize driver size in blocks 352330569Sgordon>>4 ubeshort x \b, size %u 353330569Sgordon# descType driver system type 1 701h F8FFh FFFFh 354330569Sgordon>>6 ubeshort x \b, type 0x%x 355267843Sdelphij 356330569Sgordon# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 357330569Sgordon# Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h 358330569Sgordon# Update: Joerg Jenderek 359330569Sgordon# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the 360267843Sdelphij# magic stronger. 361330569Sgordon# for apple partition map stored as a single file 362330569Sgordon0 belong 0x504d0000 363330569Sgordon# to display Apple Partition Map (strength=70) after Syslinux bootloader (71) 364330569Sgordon#!:strength +0 365330569Sgordon>0 use apple-apm 366330569Sgordon# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type 367330569Sgordon# file: could not find any valid magic files! 368330569Sgordon#!:ext bin 369330569Sgordon# display apple partition map. Normally called after Apple driver map 370330569Sgordon0 name apple-apm 371330569Sgordon>0 belong 0x504d0000 Apple Partition Map 372330569Sgordon# number of partitions 373330569Sgordon>>4 ubelong x \b, map block count %u 374330569Sgordon# logical block (512 bytes) start of partition 375330569Sgordon>>8 ubelong x \b, start block %u 376330569Sgordon>>12 ubelong x \b, block count %u 377330569Sgordon>>16 string >0 \b, name %s 378330569Sgordon>>48 string >0 \b, type %s 379330569Sgordon# processor type dpme_process_id[16] e.g. "68000" "68020" 380330569Sgordon>>120 string >0 \b, processor %s 381330569Sgordon# A/UX boot arguments BootArgs[128] 382330569Sgordon>>136 string >0 \b, boot arguments %s 383330569Sgordon# status of partition dpme_flags 384330569Sgordon>>88 belong & 1 \b, valid 385330569Sgordon>>88 belong & 2 \b, allocated 386330569Sgordon>>88 belong & 4 \b, in use 387330569Sgordon>>88 belong & 8 \b, has boot info 388330569Sgordon>>88 belong & 16 \b, readable 389330569Sgordon>>88 belong & 32 \b, writable 390330569Sgordon>>88 belong & 64 \b, pic boot code 391330569Sgordon>>88 belong & 128 \b, chain compatible driver 392330569Sgordon>>88 belong & 256 \b, real driver 393330569Sgordon>>88 belong & 512 \b, chain driver 394330569Sgordon# mount automatically at startup APPLE_PS_AUTO_MOUNT 395330569Sgordon>>88 ubelong &0x40000000 \b, mount at startup 396330569Sgordon# is the startup partition APPLE_PS_STARTUP 397330569Sgordon>>88 ubelong &0x80000000 \b, is the startup partition 398267843Sdelphij 399330569Sgordon#http://wiki.mozilla.org/DS_Store_File_Format 400267843Sdelphij#http://en.wikipedia.org/wiki/.DS_Store 401267843Sdelphij0 string \0\0\0\1Bud1\0 Apple Desktop Services Store 402284778Sdelphij 403284778Sdelphij# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) 404284778Sdelphij# Usually not in separate files, but have either filename rsrc with 405284778Sdelphij# no extension, or a filename corresponding to another file, with 406284778Sdelphij# extensions rsr/rsrc 407284778Sdelphij0 string \000\000\001\000 408284778Sdelphij>4 leshort 0 409330569Sgordon>>16 lelong 0 Apple HFS/HFS+ resource fork 410284778Sdelphij 411330569Sgordon#https://en.wikipedia.org/wiki/AppleScript 412330569Sgordon0 string FasdUAS AppleScript compiled 413330569Sgordon 414330569Sgordon# AppleWorks/ClarisWorks 415330569Sgordon# https://github.com/joshenders/appleworks_format 416330569Sgordon# http://fileformats.archiveteam.org/wiki/AppleWorks 417330569Sgordon0 name appleworks 418330569Sgordon>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document 419330569Sgordon>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document 420330569Sgordon>0 default x 421330569Sgordon>>0 belong x AppleWorks/ClarisWorks CWK Document 422330569Sgordon>0 byte x \b, version %d 423330569Sgordon>30 beshort x \b, %d 424330569Sgordon>32 beshort x \bx%d 425330569Sgordon!:ext cwk 426330569Sgordon 427330569Sgordon4 string BOBO 428330569Sgordon>0 byte >4 429330569Sgordon>>12 belong 0 430330569Sgordon>>>26 belong 0 431330569Sgordon>>>>0 use appleworks 432330569Sgordon>0 belong 0x0481ad00 433330569Sgordon>>0 use appleworks 434