168349Sobrien#------------------------------------------------------------------------------ 2362844Sdelphij# $File: archive,v 1.138 2020/06/07 23:29:26 christos Exp $ 368349Sobrien# archive: file(1) magic for archive formats (see also "msdos" for self- 468349Sobrien# extracting compressed archives) 568349Sobrien# 668349Sobrien# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 7337827Seadler# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c. 868349Sobrien 968349Sobrien# POSIX tar archives 10337827Seadler# URL: https://en.wikipedia.org/wiki/Tar_(computing) 11337827Seadler# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current 12337827Seadler# header mainly padded with nul bytes 13337827Seadler500 quad 0 14337827Seadler!:strength /2 15337827Seadler# filename or extended attribute printable strings in range space null til umlaut ue 16337827Seadler>0 ubeshort >0x1F00 17337827Seadler>>0 ubeshort <0xFCFD 18337827Seadler# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad 19337827Seadler# at https://sourceforge.net/projects/s-tar/files/testscripts/ 20337827Seadler>>>508 ubelong&0x8B9E8DFF 0 21337827Seadler# nul, space or ascii digit 0-7 at start of mode 22337827Seadler>>>>100 ubyte&0xC8 =0 23337827Seadler>>>>>101 ubyte&0xC8 =0 24337827Seadler# nul, space at end of check sum 25337827Seadler>>>>>>155 ubyte&0xDF =0 26337827Seadler# space or ascii digit 0 at start of check sum 27337827Seadler>>>>>>>148 ubyte&0xEF =0x20 28337827Seadler>>>>>>>>0 use tar-file 29337827Seadler# minimal check and then display tar archive information which can also be 30337827Seadler# embedded inside others like Android Backup, Clam AntiVirus database 31337827Seadler0 name tar-file 32337827Seadler>257 string !ustar 33337827Seadler# header padded with nuls 34337827Seadler>>257 ulong =0 35337827Seadler# GNU tar version 1.29 with non pax format option without refusing 36337827Seadler# creates misleading V7 header for Long path, Multi-volume, Volume type 37337827Seadler>>>156 ubyte 0x4c GNU tar archive 38337827Seadler!:mime application/x-gtar 39337827Seadler!:ext tar/gtar 40337827Seadler>>>156 ubyte 0x4d GNU tar archive 41337827Seadler!:mime application/x-gtar 42337827Seadler!:ext tar/gtar 43337827Seadler>>>156 ubyte 0x56 GNU tar archive 44337827Seadler!:mime application/x-gtar 45337827Seadler!:ext tar/gtar 46337827Seadler>>>156 default x tar archive (V7) 47337827Seadler!:mime application/x-tar 48337827Seadler!:ext tar 49337827Seadler# other stuff in padding 50337827Seadler# some implementations add new fields to the blank area at the end of the header record 51337827Seadler# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option 52337827Seadler>>257 ulong !0 tar archive (old) 53337827Seadler!:mime application/x-tar 54337827Seadler!:ext tar 55337827Seadler# magic in newer, GNU, posix variants 56337827Seadler>257 string =ustar 57337827Seadler# 2 last char of magic and UStar version because string expression does not work 58337827Seadler# 2 space characters followed by a null for GNU variant 59337827Seadler>>261 ubelong =0x72202000 POSIX tar archive (GNU) 60337827Seadler!:mime application/x-gtar 61337827Seadler!:ext tar/gtar 62337827Seadler# UStar version with ASCII "00" 63337827Seadler>>261 ubelong 0x72003030 POSIX 64337827Seadler# gLOBAL and ExTENSION type only found in POSIX.1-2001 format 65337827Seadler>>>156 ubyte 0x67 \b.1-2001 66337827Seadler>>>156 ubyte 0x78 \b.1-2001 67337827Seadler>>>156 ubyte x tar archive 68337827Seadler!:mime application/x-ustar 69337827Seadler!:ext tar/ustar 70337827Seadler# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab 71337827Seadler>>261 ubelong 0x72000000 tar archive (ustar) 72337827Seadler!:mime application/x-ustar 73337827Seadler!:ext tar/ustar 74337827Seadler# not seen ustar variant with garbish version 75337827Seadler>>261 default x tar archive (unknown ustar) 76337827Seadler!:mime application/x-ustar 77337827Seadler!:ext tar/ustar 78337827Seadler# type flag of 1st tar archive member 79337827Seadler#>156 ubyte x \b, %c-type 80337827Seadler>156 ubyte x 81337827Seadler>>156 ubyte 0 \b, file 82337827Seadler>>156 ubyte 0x30 \b, file 83337827Seadler>>156 ubyte 0x31 \b, hard link 84337827Seadler>>156 ubyte 0x32 \b, symlink 85337827Seadler>>156 ubyte 0x33 \b, char device 86337827Seadler>>156 ubyte 0x34 \b, block device 87337827Seadler>>156 ubyte 0x35 \b, directory 88337827Seadler>>156 ubyte 0x36 \b, fifo 89337827Seadler>>156 ubyte 0x37 \b, reserved 90337827Seadler>>156 ubyte 0x4c \b, long path 91337827Seadler>>156 ubyte 0x4d \b, multi volume 92337827Seadler>>156 ubyte 0x56 \b, volume 93337827Seadler>>156 ubyte 0x67 \b, global 94337827Seadler>>156 ubyte 0x78 \b, extension 95337827Seadler>>156 default x \b, type 96337827Seadler>>>156 ubyte x '%c' 97337827Seadler# name[100] 98337827Seadler>0 string >\0 %-.60s 99337827Seadler# mode mainly stored as an octal number in ASCII null or space terminated 100337827Seadler>100 string >\0 \b, mode %-.7s 101337827Seadler# user id mainly as octal numbers in ASCII null or space terminated 102337827Seadler>108 string >\0 \b, uid %-.7s 103337827Seadler# group id mainly as octal numbers in ASCII null or space terminated 104337827Seadler>116 string >\0 \b, gid %-.7s 105337827Seadler# size mainly as octal number in ASCII 106337827Seadler>124 ubyte <0x38 107337827Seadler>>124 string >\0 \b, size %-.12s 108337827Seadler# coding indicated by setting the high-order bit of the leftmost byte 109337827Seadler>124 ubyte >0xEF \b, size 0x 110337827Seadler>>124 ubyte !0xff \b%2.2x 111337827Seadler>>125 ubyte !0xff \b%2.2x 112337827Seadler>>126 ubyte !0xff \b%2.2x 113337827Seadler>>127 ubyte !0xff \b%2.2x 114337827Seadler>>128 ubyte !0xff \b%2.2x 115337827Seadler>>129 ubyte !0xff \b%2.2x 116337827Seadler>>130 ubyte !0xff \b%2.2x 117337827Seadler>>131 ubyte !0xff \b%2.2x 118337827Seadler>>132 ubyte !0xff \b%2.2x 119337827Seadler>>133 ubyte !0xff \b%2.2x 120337827Seadler>>134 ubyte !0xff \b%2.2x 121337827Seadler>>135 ubyte !0xff \b%2.2x 122337827Seadler# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated 123337827Seadler>136 string >\0 \b, seconds %-.11s 124337827Seadler# header checksum stored as an octal number in ASCII null or space terminated 125337827Seadler#>148 string x \b, cksum %.7s 126337827Seadler# linkname[100] 127337827Seadler>157 string >\0 \b, linkname %-.40s 128337827Seadler# additional fields for ustar 129337827Seadler>257 string =ustar 130337827Seadler# owner user name null terminated 131337827Seadler>>265 string >\0 \b, user %-.32s 132337827Seadler# group name null terminated 133337827Seadler>>297 string >\0 \b, group %-.32s 134337827Seadler# device major minor if not zero 135337827Seadler>>329 ubequad&0xCFCFCFCFcFcFcFdf !0 136337827Seadler>>>329 string x \b, devmaj %-.7s 137337827Seadler>>337 ubequad&0xCFCFCFCFcFcFcFdf !0 138337827Seadler>>>337 string x \b, devmin %-.7s 139337827Seadler# prefix[155] 140337827Seadler>>345 string >\0 \b, prefix %-.155s 141337827Seadler# old non ustar/POSIX tar 142337827Seadler>257 string !ustar 143337827Seadler>>508 string =tar\0 144337827Seadler# padding[255] in old star 145337827Seadler>>>257 string >\0 \b, padding: %-.40s 146337827Seadler>>508 default x 147337827Seadler# padding[255] in old tar sometimes comment field 148337827Seadler>>>257 string >\0 \b, comment: %-.40s 14968349Sobrien 150234250Sobrien# Incremental snapshot gnu-tar format from: 151354939Sdelphij# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 152234250Sobrien0 string GNU\ tar- GNU tar incremental snapshot data 153234250Sobrien>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 154234250Sobrien 15568349Sobrien# cpio archives 15668349Sobrien# 15768349Sobrien# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 15868349Sobrien# The idea is to indicate archives produced on machines with the same 15968349Sobrien# byte order as the machine running "file" with "cpio archive", and 16068349Sobrien# to indicate archives produced on machines with the opposite byte order 16168349Sobrien# from the machine running "file" with "byte-swapped cpio archive". 16268349Sobrien# 16368349Sobrien# The SVR4 "cpio(4)" hints that there are additional formats, but they 16468349Sobrien# are defined as "short"s; I think all the new formats are 16568349Sobrien# character-header formats and thus are strings, not numbers. 16668349Sobrien0 short 070707 cpio archive 167186690Sobrien!:mime application/x-cpio 16868349Sobrien0 short 0143561 byte-swapped cpio archive 169186690Sobrien!:mime application/x-cpio # encoding: swapped 17068349Sobrien0 string 070707 ASCII cpio archive (pre-SVR4 or odc) 17168349Sobrien0 string 070701 ASCII cpio archive (SVR4 with no CRC) 17268349Sobrien0 string 070702 ASCII cpio archive (SVR4 with CRC) 17368349Sobrien 17468349Sobrien# 175267843Sdelphij# Various archive formats used by various versions of the "ar" 176267843Sdelphij# command. 177267843Sdelphij# 178267843Sdelphij 179267843Sdelphij# 180267843Sdelphij# Original UNIX archive formats. 181267843Sdelphij# They were written with binary values in host byte order, and 182267843Sdelphij# the magic number was a host "int", which might have been 16 bits 183267843Sdelphij# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 184267843Sdelphij# been ports to little-endian 16-bit-int or 32-bit-int platforms 185267843Sdelphij# (x86?) using some of those formats; if none existed, feel free 186267843Sdelphij# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 187267843Sdelphij# 32-bit. There might have been big-endian ports of that sort as 188267843Sdelphij# well. 189267843Sdelphij# 190267843Sdelphij0 leshort 0177555 very old 16-bit-int little-endian archive 191267843Sdelphij0 beshort 0177555 very old 16-bit-int big-endian archive 192267843Sdelphij0 lelong 0177555 very old 32-bit-int little-endian archive 193267843Sdelphij0 belong 0177555 very old 32-bit-int big-endian archive 194267843Sdelphij 195267843Sdelphij0 leshort 0177545 old 16-bit-int little-endian archive 196267843Sdelphij>2 string __.SYMDEF random library 197267843Sdelphij0 beshort 0177545 old 16-bit-int big-endian archive 198267843Sdelphij>2 string __.SYMDEF random library 199267843Sdelphij0 lelong 0177545 old 32-bit-int little-endian archive 200267843Sdelphij>4 string __.SYMDEF random library 201267843Sdelphij0 belong 0177545 old 32-bit-int big-endian archive 202267843Sdelphij>4 string __.SYMDEF random library 203267843Sdelphij 204267843Sdelphij# 205267843Sdelphij# From "pdp" (but why a 4-byte quantity?) 206267843Sdelphij# 207267843Sdelphij0 lelong 0x39bed PDP-11 old archive 208267843Sdelphij0 lelong 0x39bee PDP-11 4.0 archive 209267843Sdelphij 210267843Sdelphij# 211267843Sdelphij# XXX - what flavor of APL used this, and was it a variant of 212267843Sdelphij# some ar archive format? It's similar to, but not the same 213267843Sdelphij# as, the APL workspace magic numbers in pdp. 214267843Sdelphij# 215267843Sdelphij0 long 0100554 apl workspace 216267843Sdelphij 217267843Sdelphij# 218267843Sdelphij# System V Release 1 portable(?) archive format. 219267843Sdelphij# 220267843Sdelphij0 string =<ar> System V Release 1 ar archive 221267843Sdelphij!:mime application/x-archive 222267843Sdelphij 223267843Sdelphij# 224267843Sdelphij# Debian package; it's in the portable archive format, and needs to go 225267843Sdelphij# before the entry for regular portable archives, as it's recognized as 226267843Sdelphij# a portable archive whose first member has a name beginning with 227267843Sdelphij# "debian". 228267843Sdelphij# 229354939Sdelphij# Update: Joerg Jenderek 230354939Sdelphij# URL: https://en.wikipedia.org/wiki/Deb_(file_format) 231159764Sobrien0 string =!<arch>\ndebian 232354939Sdelphij# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html 233354939Sdelphij>14 string -split part of multipart Debian package 234267843Sdelphij!:mime application/vnd.debian.binary-package 235354939Sdelphij# udeb is used for stripped down deb file 236354939Sdelphij!:ext deb/udeb 237354939Sdelphij>14 string -binary Debian binary package 238267843Sdelphij!:mime application/vnd.debian.binary-package 239362844Sdelphij# For ipk packager see also https://en.wikipedia.org/wiki/Opkg 240362844Sdelphij!:ext deb/udeb/ipk 241354939Sdelphij# This should not happen 242354939Sdelphij>14 default x Unknown Debian package 243354939Sdelphij# NL terminated version; for most Debian cases this is 2.0 or 2.1 for splitted 244133359Sobrien>68 string >\0 (format %s) 245354939Sdelphij#>68 string !2.0\n 246354939Sdelphij#>>68 string x (format %.3s) 247354939Sdelphij>68 string =2.0\n 248354939Sdelphij# 2nd archive name=control archive name like control.tar.gz or control.tar.xz 249354939Sdelphij>>72 string >\0 \b, with %.14s 250354939Sdelphij# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma} 251354939Sdelphij>>0 search/0x93e4f data.tar. \b, data compression 252354939Sdelphij# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised 253354939Sdelphij# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb 254362844Sdelphij>>>&0 string x %.2s 255362844Sdelphij# skip space (0x20 BSD) and slash (0x2f System V) character marking end of name 256362844Sdelphij>>>&2 ubyte !0x20 257362844Sdelphij>>>>&-1 ubyte !0x2f 258362844Sdelphij# display 3rd character of file name extension like 2 of bz2 or m of lzma 259362844Sdelphij>>>>>&-1 ubyte x \b%c 260362844Sdelphij>>>>>>&0 ubyte !0x20 261362844Sdelphij>>>>>>>&-1 ubyte !0x2f 262362844Sdelphij# display 4th character of file name extension like a of lzma 263362844Sdelphij>>>>>>>>&-1 ubyte x \b%c 264354939Sdelphij# splitted debian package case 265354939Sdelphij>68 string =2.1\n 266354939Sdelphij# dpkg-1.18.25/dpkg-split/info.c 267354939Sdelphij# NL terminated ASCII package name like ckermit 268354939Sdelphij>>&0 string x \b, %s 269354939Sdelphij# NL terminated package version like 302-5.3 270354939Sdelphij>>>&1 string x %s 271354939Sdelphij# NL terminated MD5 checksum 272354939Sdelphij>>>>&1 string x \b, MD5 %s 273354939Sdelphij# NL terminated original package length 274354939Sdelphij>>>>>&1 string x \b, unsplitted size %s 275354939Sdelphij# NL terminated part length 276360521Sdelphij>>>>>>&1 string x \b, part length %s 277354939Sdelphij# NL terminated package part like n/m 278354939Sdelphij>>>>>>>&1 string x \b, part %s 279354939Sdelphij# NL terminated package architecture like armhf since dpkg 1.16.1 or later 280354939Sdelphij>>>>>>>>&1 string x \b, %s 28168349Sobrien 28268349Sobrien# 283267843Sdelphij# MIPS archive; they're in the portable archive format, and need to go 284267843Sdelphij# before the entry for regular portable archives, as it's recognized as 285267843Sdelphij# a portable archive whose first member has a name beginning with 286267843Sdelphij# "__________E". 287267843Sdelphij# 288159764Sobrien0 string =!<arch>\n__________E MIPS archive 289267843Sdelphij!:mime application/x-archive 29068349Sobrien>20 string U with MIPS Ucode members 29168349Sobrien>21 string L with MIPSEL members 29268349Sobrien>21 string B with MIPSEB members 29368349Sobrien>19 string L and an EL hash table 29468349Sobrien>19 string B and an EB hash table 29568349Sobrien>22 string X -- out of date 29668349Sobrien 29768349Sobrien# 298267843Sdelphij# BSD/SVR2-and-later portable archive formats. 29968349Sobrien# 300354939Sdelphij# Update: Joerg Jenderek 301354939Sdelphij# URL: http://fileformats.archiveteam.org/wiki/AR 302354939Sdelphij# Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/ 303354939Sdelphij# Note: Mach-O universal binary in ./cafebabe is dependent 304354939Sdelphij# TODO: unify current ar archive, MIPS archive, Debian package 305354939Sdelphij# distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR; 306354939Sdelphij# *.ar packages from *.a libraries. handle empty archive 307337827Seadler0 string =!<arch>\n current ar archive 308354939Sdelphij# print first and possibly second ar_name[16] for debugging purpose 309354939Sdelphij#>8 string x \b, 1st "%.16s" 310354939Sdelphij#>68 string x \b, 2nd "%.16s" 311186690Sobrien!:mime application/x-archive 312354939Sdelphij# a in most case for libraries; lib for Microsoft libraries; ar else cases 313354939Sdelphij!:ext a/lib/ar 31468349Sobrien>8 string __.SYMDEF random library 315354939Sdelphij# first member with long marked name __.SYMDEF SORTED implies BSD library 316267843Sdelphij>68 string __.SYMDEF\ SORTED random library 317354939Sdelphij# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf 318354939Sdelphij# "archive file" entry moved from ./hp 319354939Sdelphij# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture 320354939Sdelphij# LST header a_magic 0619h~relocatable library 321354939Sdelphij>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 322354939Sdelphij>68 belong 0x02100619 - PA-RISC1.1 relocatable library 323354939Sdelphij>68 belong 0x02110619 - PA-RISC1.2 relocatable library 324354939Sdelphij>68 belong 0x02140619 - PA-RISC2.0 relocatable library 325354939Sdelphij#EOF for common ar archives 326267843Sdelphij 32768349Sobrien# 328267843Sdelphij# "Thin" archive, as can be produced by GNU ar. 32968349Sobrien# 330267843Sdelphij0 string =!<thin>\n thin archive with 331267843Sdelphij>68 belong 0 no symbol entries 332267843Sdelphij>68 belong 1 %d symbol entry 333267843Sdelphij>68 belong >1 %d symbol entries 33468349Sobrien 335354939Sdelphij0 search/1 -h- Software Tools format archive text 336354939Sdelphij 33768349Sobrien# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 33868349Sobrien# 33968349Sobrien# The first byte is the magic (0x1a), byte 2 is the compression type for 34068349Sobrien# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 34168349Sobrien# filename of the first file (null terminated). Since some types collide 34268349Sobrien# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 34368349Sobrien# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 34468349Sobrien0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 345186690Sobrien!:mime application/x-arc 34668349Sobrien0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 347186690Sobrien!:mime application/x-arc 34868349Sobrien0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 349186690Sobrien!:mime application/x-arc 35068349Sobrien0 lelong&0x8080ffff 0x0000031a ARC archive data, packed 351186690Sobrien!:mime application/x-arc 35268349Sobrien0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 353186690Sobrien!:mime application/x-arc 35468349Sobrien0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 355186690Sobrien!:mime application/x-arc 356159764Sobrien# [JW] stuff taken from idarc, obviously ARC successors: 357159764Sobrien0 lelong&0x8080ffff 0x00000a1a PAK archive data 358186690Sobrien!:mime application/x-arc 359159764Sobrien0 lelong&0x8080ffff 0x0000141a ARC+ archive data 360186690Sobrien!:mime application/x-arc 361159764Sobrien0 lelong&0x8080ffff 0x0000481a HYP archive data 362186690Sobrien!:mime application/x-arc 36368349Sobrien 36468349Sobrien# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 36568349Sobrien# I can't create either SPARK or ArcFS archives so I have not tested this stuff 36668349Sobrien# [GRR: the original entries collide with ARC, above; replaced with combined 36768349Sobrien# version (not tested)] 368159764Sobrien#0 byte 0x1a RISC OS archive (spark format) 369159764Sobrien0 string \032archive RISC OS archive (ArcFS format) 370139368Sobrien0 string Archive\000 RISC OS archive (ArcFS format) 37168349Sobrien 372159764Sobrien# All these were taken from idarc, many could not be verified. Unfortunately, 373159764Sobrien# there were many low-quality sigs, i.e. easy to trigger false positives. 374159764Sobrien# Please notify me of any real-world fishy/ambiguous signatures and I'll try 375159764Sobrien# to get my hands on the actual archiver and see if I find something better. [JW] 376159764Sobrien# probably many can be enhanced by finding some 0-byte or control char near the start 377159764Sobrien 378159764Sobrien# idarc calls this Crush/Uncompressed... *shrug* 379159764Sobrien0 string CRUSH Crush archive data 380159764Sobrien# Squeeze It (.sqz) 381159764Sobrien0 string HLSQZ Squeeze It archive data 382159764Sobrien# SQWEZ 383159764Sobrien0 string SQWEZ SQWEZ archive data 384159764Sobrien# HPack (.hpk) 385159764Sobrien0 string HPAK HPack archive data 386159764Sobrien# HAP 387159764Sobrien0 string \x91\x33HF HAP archive data 388159764Sobrien# MD/MDCD 389159764Sobrien0 string MDmd MDCD archive data 390159764Sobrien# LIM 391159764Sobrien0 string LIM\x1a LIM archive data 392159764Sobrien# SAR 393159764Sobrien3 string LH5 SAR archive data 394159764Sobrien# BSArc/BS2 395267843Sdelphij0 string \212\3SB\020\0 BSArc/BS2 archive data 396267843Sdelphij# Bethesda Softworks Archive (Oblivion) 397267843Sdelphij0 string BSA\0 BSArc archive data 398267843Sdelphij>4 lelong x version %d 399159764Sobrien# MAR 400159764Sobrien2 string =-ah MAR archive data 401159764Sobrien# ACB 402234250Sobrien#0 belong&0x00f800ff 0x00800000 ACB archive data 403159764Sobrien# CPZ 404159764Sobrien# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 405159764Sobrien# JRC 406159764Sobrien0 string JRchive JRC archive data 407159764Sobrien# Quantum 408159764Sobrien0 string DS\0 Quantum archive data 409159764Sobrien# ReSOF 410159764Sobrien0 string PK\3\6 ReSOF archive data 411159764Sobrien# QuArk 412159764Sobrien0 string 7\4 QuArk archive data 413159764Sobrien# YAC 414159764Sobrien14 string YC YAC archive data 415159764Sobrien# X1 416159764Sobrien0 string X1 X1 archive data 417159764Sobrien0 string XhDr X1 archive data 418159764Sobrien# CDC Codec (.dqt) 419159764Sobrien0 belong&0xffffe000 0x76ff2000 CDC Codec archive data 420159764Sobrien# AMGC 421159764Sobrien0 string \xad6" AMGC archive data 422159764Sobrien# NuLIB 423267843Sdelphij0 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 424159764Sobrien# PakLeo 425159764Sobrien0 string LEOLZW PAKLeo archive data 426159764Sobrien# ChArc 427159764Sobrien0 string SChF ChArc archive data 428159764Sobrien# PSA 429159764Sobrien0 string PSA PSA archive data 430159764Sobrien# CrossePAC 431159764Sobrien0 string DSIGDCC CrossePAC archive data 432159764Sobrien# Freeze 433159764Sobrien0 string \x1f\x9f\x4a\x10\x0a Freeze archive data 434159764Sobrien# KBoom 435267843Sdelphij0 string \xc2\xa8MP\xc2\xa8 KBoom archive data 436159764Sobrien# NSQ, must go after CDC Codec 437159764Sobrien0 string \x76\xff NSQ archive data 438159764Sobrien# DPA 439159764Sobrien0 string Dirk\ Paehl DPA archive data 440159764Sobrien# BA 441159764Sobrien# TODO: idarc says "bytes 0-2 == bytes 3-5" 442159764Sobrien# TTComp 443298192Sdelphij# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive 444298192Sdelphij# Update: Joerg Jenderek 445298192Sdelphij# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others 446328874Seadler0 string \0\6 447298192Sdelphij# look for first keyword of Panorama database *.pan 448328874Seadler>12 search/261 DESIGN 449298192Sdelphij# skip keyword with low entropy 450298192Sdelphij>12 default x TTComp archive, binary, 4K dictionary 451298192Sdelphij# (version 5.25) labeled the above entry as "TTComp archive data" 452360521Sdelphij# From: Joerg Jenderek 453360521Sdelphij# URL: https://wiki.68kmla.org/DiskCopy_4.2_format_specification 454360521Sdelphij# reference: http://nulib.com/library/FTN.e00005.htm 455360521Sdelphij0x52 ubeshort 0x0100 456360521Sdelphij# test for disk size equal or above 400k 457360521Sdelphij>0x40 ubelong >409599 Apple DiskCopy 4.2 image 458360521Sdelphij#!:mime application/octet-stream 459360521Sdelphij!:apple dCpydImg 460360521Sdelphij!:ext image/dc42 461360521Sdelphij# image pascal name padded with NULs like Microsoft Mail 462360521Sdelphij>>00 pstring/B x %s 463360521Sdelphij# data size in bytes like 409600 464360521Sdelphij>>0x40 ubelong x \b, %u bytes 465360521Sdelphij# tag size in bytes 466360521Sdelphij>>0x44 ubelong >0 \b, 0x%x tag size 467360521Sdelphij# data checksum 468360521Sdelphij#>>0x48 ubelong x \b, 0x%x checksum 469360521Sdelphij# tag checksum 470360521Sdelphij#>>0x4c ubelong x \b, 0x%x tag checksum 471360521Sdelphij# disk encoding 472360521Sdelphij>>0x50 ubyte 0 \b, GCR CLV ssdd (400k) 473360521Sdelphij>>0x50 ubyte 1 \b, GCR CLV dsdd (800k) 474360521Sdelphij>>0x50 ubyte 2 \b, MFM CAV dsdd (720k) 475360521Sdelphij>>0x50 ubyte 3 \b, MFM CAV dshd (1440k) 476360521Sdelphij>>0x50 ubyte >3 \b, 0x%x encoding 477360521Sdelphij# format byte 478360521Sdelphij>>0x51 ubyte x \b, 0x%x format 479360521Sdelphij#>>0x54 ubequad x \b, data 0x%16.16llx 480159764Sobrien# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 481159764Sobrien0 string ESP ESP archive data 482159764Sobrien# ZPack 483159764Sobrien0 string \1ZPK\1 ZPack archive data 484159764Sobrien# Sky 485159764Sobrien0 string \xbc\x40 Sky archive data 486159764Sobrien# UFA 487159764Sobrien0 string UFA UFA archive data 488159764Sobrien# Dry 489159764Sobrien0 string =-H2O DRY archive data 490159764Sobrien# FoxSQZ 491159764Sobrien0 string FOXSQZ FoxSQZ archive data 492159764Sobrien# AR7 493159764Sobrien0 string ,AR7 AR7 archive data 494159764Sobrien# PPMZ 495159764Sobrien0 string PPMZ PPMZ archive data 496159764Sobrien# MS Compress 497337827Seadler# Update: Joerg Jenderek 498337827Seadler# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression 499337827Seadler# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html 500337827Seadler# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z 501337827Seadler4 string \x88\xf0\x27 502337827Seadler# KWAJ variant 503337827Seadler>0 string KWAJ MS Compress archive data, KWAJ variant 504337827Seadler!:mime application/x-ms-compress-kwaj 505337827Seadler# extension not working in version 5.32 506337827Seadler# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?' 507337827Seadler# file: line 284: Bad magic entry ' ??_' 508337827Seadler!:ext ??_ 509337827Seadler# compression method (0-4) 510337827Seadler>>8 uleshort x \b, %u method 511337827Seadler# offset of compressed data 512337827Seadler>>10 uleshort x \b, 0x%x offset 513337827Seadler#>>(10.s) uleshort x 514337827Seadler#>>>&-6 string x \b, TEST extension %-.3s 515337827Seadler# header flags to mark header extensions 516337827Seadler>>12 uleshort >0 \b, 0x%x flags 517337827Seadler# 4 bytes: decompressed length of file 518337827Seadler>>12 uleshort &0x01 519337827Seadler>>>14 ulelong x \b, original size: %u bytes 520337827Seadler# 2 bytes: unknown purpose 521337827Seadler# 2 bytes: length of unknown data + mentioned bytes 522337827Seadler# 1-9 bytes: null-terminated file name 523337827Seadler# 1-4 bytes: null-terminated file extension 524337827Seadler>>12 uleshort &0x08 525337827Seadler>>>12 uleshort ^0x01 526337827Seadler>>>>12 uleshort ^0x02 527337827Seadler>>>>>12 uleshort ^0x04 528337827Seadler>>>>>>12 uleshort ^0x10 529337827Seadler>>>>>>>14 string x \b, %-.8s 530337827Seadler>>>>>>12 uleshort &0x10 531337827Seadler>>>>>>>14 string x \b, %-.8s 532337827Seadler>>>>>>>>&1 string x \b.%-.3s 533337827Seadler>>>>>12 uleshort &0x04 534337827Seadler>>>>>>12 uleshort ^0x10 535337827Seadler>>>>>>>(14.s) uleshort x 536337827Seadler>>>>>>>>&14 string x \b, %-.8s 537337827Seadler>>>>>>12 uleshort &0x10 538337827Seadler>>>>>>>(14.s) uleshort x 539337827Seadler>>>>>>>>&14 string x \b, %-.8s 540337827Seadler>>>>>>>>>&1 string x \b.%-.3s 541337827Seadler>>>>12 uleshort &0x02 542337827Seadler>>>>>12 uleshort ^0x04 543337827Seadler>>>>>>12 uleshort ^0x10 544337827Seadler>>>>>>>16 string x \b, %-.8s 545337827Seadler>>>>>>12 uleshort &0x10 546337827Seadler>>>>>>>16 string x \b, %-.8s 547337827Seadler>>>>>>>>&1 string x \b.%-.3s 548337827Seadler>>>>>12 uleshort &0x04 549337827Seadler>>>>>>12 uleshort ^0x10 550337827Seadler>>>>>>>(16.s) uleshort x 551337827Seadler>>>>>>>>&16 string x \b, %-.8s 552337827Seadler>>>>>>12 uleshort &0x10 553337827Seadler>>>>>>>(16.s) uleshort x 554337827Seadler>>>>>>>&16 string x %-.8s 555337827Seadler>>>>>>>>&1 string x \b.%-.3s 556337827Seadler>>>12 uleshort &0x01 557337827Seadler>>>>12 uleshort ^0x02 558337827Seadler>>>>>12 uleshort ^0x04 559337827Seadler>>>>>>12 uleshort ^0x10 560337827Seadler>>>>>>>18 string x \b, %-.8s 561337827Seadler>>>>>>12 uleshort &0x10 562337827Seadler>>>>>>>18 string x \b, %-.8s 563337827Seadler>>>>>>>>&1 string x \b.%-.3s 564337827Seadler>>>>>12 uleshort &0x04 565337827Seadler>>>>>>12 uleshort ^0x10 566337827Seadler>>>>>>>(18.s) uleshort x 567337827Seadler>>>>>>>>&18 string x \b, %-.8s 568337827Seadler>>>>>>12 uleshort &0x10 569337827Seadler>>>>>>>(18.s) uleshort x 570337827Seadler>>>>>>>>&18 string x \b, %-.8s 571337827Seadler>>>>>>>>>&1 string x \b.%-.3s 572337827Seadler>>>>12 uleshort &0x02 573337827Seadler>>>>>12 uleshort ^0x04 574337827Seadler>>>>>>12 uleshort ^0x10 575337827Seadler>>>>>>>20 string x \b, %-.8s 576337827Seadler>>>>>>12 uleshort &0x10 577337827Seadler>>>>>>>20 string x \b, %-.8s 578337827Seadler>>>>>>>>&1 string x \b.%-.3s 579337827Seadler>>>>>12 uleshort &0x04 580337827Seadler>>>>>>12 uleshort ^0x10 581337827Seadler>>>>>>>(20.s) uleshort x 582337827Seadler>>>>>>>>&20 string x \b, %-.8s 583337827Seadler>>>>>>12 uleshort &0x10 584337827Seadler>>>>>>>(20.s) uleshort x 585337827Seadler>>>>>>>>&20 string x \b, %-.8s 586337827Seadler>>>>>>>>>&1 string x \b.%-.3s 587337827Seadler# 2 bytes: length of data + mentioned bytes 588337827Seadler# 589337827Seadler# SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ 590337827Seadler>0 string SZDD MS Compress archive data, SZDD variant 591337827Seadler!:mime application/x-ms-compress-szdd 592337827Seadler!:ext ??_ 593337827Seadler# The character missing from the end of the filename (0=unknown) 594337827Seadler>>9 string >\0 \b, %-.1s is last character of original name 595337827Seadler# https://www.betaarchive.com/forum/viewtopic.php?t=26161 596337827Seadler# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e 597337827Seadler>>8 string !A \b, %-.1s method 598337827Seadler>>10 ulelong >0 \b, original size: %u bytes 599337827Seadler# QBasic SZDD variant 600337827Seadler3 string \x88\xf0\x27 601337827Seadler>0 string SZ\x20 MS Compress archive data, QBasic variant 602337827Seadler!:mime application/x-ms-compress-sz 603337827Seadler!:ext ??$ 604337827Seadler>>8 ulelong >0 \b, original size: %u bytes 605337827Seadler 606159764Sobrien# MP3 (archiver, not lossy audio compression) 607159764Sobrien0 string MP3\x1a MP3-Archiver archive data 608159764Sobrien# ZET 609267843Sdelphij0 string OZ\xc3\x9d ZET archive data 610159764Sobrien# TSComp 611159764Sobrien0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 612159764Sobrien# ARQ 613159764Sobrien0 string gW\4\1 ARQ archive data 614159764Sobrien# Squash 615159764Sobrien3 string OctSqu Squash archive data 616159764Sobrien# Terse 617159764Sobrien0 string \5\1\1\0 Terse archive data 618159764Sobrien# PUCrunch 619159764Sobrien0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 620159764Sobrien# UHarc 621159764Sobrien0 string UHA UHarc archive data 622159764Sobrien# ABComp 623159764Sobrien0 string \2AB ABComp archive data 624159764Sobrien0 string \3AB2 ABComp archive data 625159764Sobrien# CMP 626159764Sobrien0 string CO\0 CMP archive data 627159764Sobrien# Splint 628159764Sobrien0 string \x93\xb9\x06 Splint archive data 629159764Sobrien# InstallShield 630226048Sobrien0 string \x13\x5d\x65\x8c InstallShield Z archive Data 631159764Sobrien# Gather 632159764Sobrien1 string GTH Gather archive data 633159764Sobrien# BOA 634159764Sobrien0 string BOA BOA archive data 635159764Sobrien# RAX 636159764Sobrien0 string ULEB\xa RAX archive data 637159764Sobrien# Xtreme 638159764Sobrien0 string ULEB\0 Xtreme archive data 639159764Sobrien# Pack Magic 640267843Sdelphij0 string @\xc3\xa2\1\0 Pack Magic archive data 641159764Sobrien# BTS 642159764Sobrien0 belong&0xfeffffff 0x1a034465 BTS archive data 643159764Sobrien# ELI 5750 644159764Sobrien0 string Ora\ ELI 5750 archive data 645159764Sobrien# QFC 646159764Sobrien0 string \x1aFC\x1a QFC archive data 647159764Sobrien0 string \x1aQF\x1a QFC archive data 648159764Sobrien# PRO-PACK 649159764Sobrien0 string RNC PRO-PACK archive data 650159764Sobrien# 777 651159764Sobrien0 string 777 777 archive data 652159764Sobrien# LZS221 653159764Sobrien0 string sTaC LZS221 archive data 654159764Sobrien# HPA 655159764Sobrien0 string HPA HPA archive data 656159764Sobrien# Arhangel 657159764Sobrien0 string LG Arhangel archive data 658159764Sobrien# EXP1, uses bzip2 659159764Sobrien0 string 0123456789012345BZh EXP1 archive data 660159764Sobrien# IMP 661159764Sobrien0 string IMP\xa IMP archive data 662159764Sobrien# NRV 663159764Sobrien0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 664159764Sobrien# Squish 665159764Sobrien0 string \x73\xb2\x90\xf4 Squish archive data 666159764Sobrien# Par 667159764Sobrien0 string PHILIPP Par archive data 668159764Sobrien0 string PAR Par archive data 669159764Sobrien# HIT 670159764Sobrien0 string UB HIT archive data 671159764Sobrien# SBX 672159764Sobrien0 belong&0xfffff000 0x53423000 SBX archive data 673159764Sobrien# NaShrink 674159764Sobrien0 string NSK NaShrink archive data 675159764Sobrien# SAPCAR 676159764Sobrien0 string #\ CAR\ archive\ header SAPCAR archive data 677159764Sobrien0 string CAR\ 2.00RG SAPCAR archive data 678159764Sobrien# Disintegrator 679159764Sobrien0 string DST Disintegrator archive data 680159764Sobrien# ASD 681159764Sobrien0 string ASD ASD archive data 682159764Sobrien# InstallShield CAB 683159764Sobrien0 string ISc( InstallShield CAB 684159764Sobrien# TOP4 685159764Sobrien0 string T4\x1a TOP4 archive data 686159764Sobrien# BatComp left out: sig looks like COM executable 687159764Sobrien# so TODO: get real 4dos batcomp file and find sig 688159764Sobrien# BlakHole 689159764Sobrien0 string BH\5\7 BlakHole archive data 690159764Sobrien# BIX 691159764Sobrien0 string BIX0 BIX archive data 692159764Sobrien# ChiefLZA 693159764Sobrien0 string ChfLZ ChiefLZA archive data 694159764Sobrien# Blink 695159764Sobrien0 string Blink Blink archive data 696159764Sobrien# Logitech Compress 697159764Sobrien0 string \xda\xfa Logitech Compress archive data 698159764Sobrien# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 699159764Sobrien1 string (C)\ STEPANYUK ARS-Sfx archive data 700159764Sobrien# AKT/AKT32 701159764Sobrien0 string AKT32 AKT32 archive data 702159764Sobrien0 string AKT AKT archive data 703159764Sobrien# NPack 704159764Sobrien0 string MSTSM NPack archive data 705159764Sobrien# PFT 706159764Sobrien0 string \0\x50\0\x14 PFT archive data 707159764Sobrien# SemOne 708159764Sobrien0 string SEM SemOne archive data 709159764Sobrien# PPMD 710159764Sobrien0 string \x8f\xaf\xac\x84 PPMD archive data 711159764Sobrien# FIZ 712159764Sobrien0 string FIZ FIZ archive data 713159764Sobrien# MSXiE 714159764Sobrien0 belong&0xfffff0f0 0x4d530000 MSXiE archive data 715159764Sobrien# DeepFreezer 716159764Sobrien0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 717159764Sobrien# DC 718159764Sobrien0 string =<DC- DC archive data 719159764Sobrien# TPac 720159764Sobrien0 string \4TPAC\3 TPac archive data 721159764Sobrien# Ai 722159764Sobrien0 string Ai\1\1\0 Ai archive data 723159764Sobrien0 string Ai\1\0\0 Ai archive data 724159764Sobrien# Ai32 725159764Sobrien0 string Ai\2\0 Ai32 archive data 726159764Sobrien0 string Ai\2\1 Ai32 archive data 727159764Sobrien# SBC 728159764Sobrien0 string SBC SBC archive data 729159764Sobrien# Ybs 730159764Sobrien0 string YBS Ybs archive data 731159764Sobrien# DitPack 732159764Sobrien0 string \x9e\0\0 DitPack archive data 733159764Sobrien# DMS 734159764Sobrien0 string DMS! DMS archive data 735159764Sobrien# EPC 736159764Sobrien0 string \x8f\xaf\xac\x8c EPC archive data 737159764Sobrien# VSARC 738159764Sobrien0 string VS\x1a VSARC archive data 739159764Sobrien# PDZ 740159764Sobrien0 string PDZ PDZ archive data 741159764Sobrien# ReDuq 742159764Sobrien0 string rdqx ReDuq archive data 743159764Sobrien# GCA 744159764Sobrien0 string GCAX GCA archive data 745159764Sobrien# PPMN 746159764Sobrien0 string pN PPMN archive data 747159764Sobrien# WinImage 748159764Sobrien3 string WINIMAGE WinImage archive data 749159764Sobrien# Compressia 750159764Sobrien0 string CMP0CMP Compressia archive data 751159764Sobrien# UHBC 752159764Sobrien0 string UHB UHBC archive data 753159764Sobrien# WinHKI 754159764Sobrien0 string \x61\x5C\x04\x05 WinHKI archive data 755159764Sobrien# WWPack data file 756159764Sobrien0 string WWP WWPack archive data 757159764Sobrien# BSN (BSA, PTS-DOS) 758159764Sobrien0 string \xffBSG BSN archive data 759159764Sobrien1 string \xffBSG BSN archive data 760159764Sobrien3 string \xffBSG BSN archive data 761159764Sobrien1 string \0\xae\2 BSN archive data 762159764Sobrien1 string \0\xae\3 BSN archive data 763159764Sobrien1 string \0\xae\7 BSN archive data 764159764Sobrien# AIN 765159764Sobrien0 string \x33\x18 AIN archive data 766159764Sobrien0 string \x33\x17 AIN archive data 767288143Sdelphij# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015 768159764Sobrien# SZip (TODO: doesn't catch all versions) 769159764Sobrien0 string SZ\x0a\4 SZip archive data 770159764Sobrien# XPack DiskImage 771288143Sdelphij# *.XDI updated by Joerg Jenderek Sep 2015 772328874Seadler# ftp://ftp.sac.sk/pub/sac/pack/0index.txt 773288143Sdelphij# GRR: this test is still too general as it catches also text files starting with jm 774328874Seadler0 string jm 775288143Sdelphij# only found examples with this additional characteristic 2 bytes 776288143Sdelphij>2 string \x2\x4 Xpack DiskImage archive data 777288143Sdelphij#!:ext xdi 778159764Sobrien# XPack Data 779288143Sdelphij# *.xpa updated by Joerg Jenderek Sep 2015 780288143Sdelphij# ftp://ftp.elf.stuba.sk/pub/pc/pack/ 781288143Sdelphij0 string xpa XPA 782288143Sdelphij!:ext xpa 783288143Sdelphij# XPA32 784288143Sdelphij# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip 785288143Sdelphij# created by XPA32.EXE version 1.0.2 for Windows 786288143Sdelphij>0 string xpa\0\1 \b32 archive data 787328874Seadler# created by XPACK.COM version 1.67m or 1.67r with short 0x1800 788288143Sdelphij>3 ubeshort !0x0001 \bck archive data 789159764Sobrien# XPack Single Data 790288143Sdelphij# changed by Joerg Jenderek Sep 2015 back to like in version 5.12 791288143Sdelphij# letter 'I'+ acute accent is equivalent to \xcd 792288143Sdelphij0 string \xcd\ jm Xpack single archive data 793288143Sdelphij#!:mime application/x-xpa-compressed 794288143Sdelphij!:ext xpa 795159764Sobrien 796159764Sobrien# TODO: missing due to unknown magic/magic at end of file: 797159764Sobrien#DWC 798159764Sobrien#ARG 799159764Sobrien#ZAR 800159764Sobrien#PC/3270 801159764Sobrien#InstallIt 802159764Sobrien#RKive 803159764Sobrien#RK 804159764Sobrien#XPack Diskimage 805159764Sobrien 806159764Sobrien# These were inspired by idarc, but actually verified 807159764Sobrien# Dzip archiver (.dz) 808337827Seadler# Update: Joerg Jenderek 809337827Seadler# URL: http://speeddemosarchive.com/dzip/ 810337827Seadler# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c 811337827Seadler# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt 812337827Seadler0 string DZ 813337827Seadler# latest version is 2.9 dated 7 may 2003 814337827Seadler>2 byte <4 Dzip archive data 815337827Seadler!:mime application/x-dzip 816337827Seadler!:ext dz 817337827Seadler>>2 byte x \b, version %i 818337827Seadler>>3 byte x \b.%i 819337827Seadler>>4 ulelong x \b, offset 0x%x 820337827Seadler>>8 ulelong x \b, %u files 821159764Sobrien# ZZip archiver (.zz) 822159764Sobrien0 string ZZ\ \0\0 ZZip archive data 823159764Sobrien0 string ZZ0 ZZip archive data 824159764Sobrien# PAQ archiver (.paq) 825159764Sobrien0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 826159764Sobrien0 string PAQ PAQ archive data 827159764Sobrien>3 byte&0xf0 0x30 828159764Sobrien>>3 byte x (v%c) 829159764Sobrien# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 830159764Sobrien0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 831159764Sobrien0 string JARCS JAR (ARJ Software, Inc.) archive data 832159764Sobrien 83368349Sobrien# ARJ archiver (jason@jarthur.Claremont.EDU) 83468349Sobrien0 leshort 0xea60 ARJ archive data 835186690Sobrien!:mime application/x-arj 83668349Sobrien>5 byte x \b, v%d, 83768349Sobrien>8 byte &0x04 multi-volume, 83868349Sobrien>8 byte &0x10 slash-switched, 83968349Sobrien>8 byte &0x20 backup, 84068349Sobrien>34 string x original name: %s, 84168349Sobrien>7 byte 0 os: MS-DOS 84268349Sobrien>7 byte 1 os: PRIMOS 84368349Sobrien>7 byte 2 os: Unix 84468349Sobrien>7 byte 3 os: Amiga 84568349Sobrien>7 byte 4 os: Macintosh 84668349Sobrien>7 byte 5 os: OS/2 84768349Sobrien>7 byte 6 os: Apple ][ GS 84868349Sobrien>7 byte 7 os: Atari ST 84968349Sobrien>7 byte 8 os: NeXT 85068349Sobrien>7 byte 9 os: VAX/VMS 85168349Sobrien>3 byte >0 %d] 852159764Sobrien# [JW] idarc says this is also possible 853159764Sobrien2 leshort 0xea60 ARJ archive data 85468349Sobrien 85568349Sobrien# HA archiver (Greg Roelofs, newt@uchicago.edu) 85668349Sobrien# This is a really bad format. A file containing HAWAII will match this... 85768349Sobrien#0 string HA HA archive data, 85868349Sobrien#>2 leshort =1 1 file, 859267843Sdelphij#>2 leshort >1 %hu files, 86068349Sobrien#>4 byte&0x0f =0 first is type CPY 86168349Sobrien#>4 byte&0x0f =1 first is type ASC 86268349Sobrien#>4 byte&0x0f =2 first is type HSC 86368349Sobrien#>4 byte&0x0f =0x0e first is type DIR 86468349Sobrien#>4 byte&0x0f =0x0f first is type SPECIAL 865159764Sobrien# suggestion: at least identify small archives (<1024 files) 866159764Sobrien0 belong&0xffff00fc 0x48410000 HA archive data 867159764Sobrien>2 leshort =1 1 file, 868159764Sobrien>2 leshort >1 %u files, 869159764Sobrien>4 byte&0x0f =0 first is type CPY 870159764Sobrien>4 byte&0x0f =1 first is type ASC 871159764Sobrien>4 byte&0x0f =2 first is type HSC 872159764Sobrien>4 byte&0x0f =0x0e first is type DIR 873159764Sobrien>4 byte&0x0f =0x0f first is type SPECIAL 87468349Sobrien 87568349Sobrien# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 87668349Sobrien0 string HPAK HPACK archive data 87768349Sobrien 87868349Sobrien# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 879169962Sobrien0 string \351,\001JAM\ JAM archive, 88068349Sobrien>7 string >\0 version %.4s 88168349Sobrien>0x26 byte =0x27 - 88268349Sobrien>>0x2b string >\0 label %.11s, 88368349Sobrien>>0x27 lelong x serial %08x, 88468349Sobrien>>0x36 string >\0 fstype %.8s 88568349Sobrien 88668349Sobrien# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 887328874Seadler# Update: Joerg Jenderek 888298192Sdelphij# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 889354939Sdelphij# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html 890298192Sdelphij# 891298192Sdelphij# check and display information of lharc (LHa,PMarc) file 892298192Sdelphij0 name lharc-file 893298192Sdelphij# check 1st character of method id like -lz4- -lh5- or -pm2- 894298192Sdelphij>2 string - 895298192Sdelphij# check 5th character of method id 896328874Seadler>>6 string - 897298192Sdelphij# check header level 0 1 2 3 898328874Seadler>>>20 ubyte <4 899298192Sdelphij# check 2nd, 3th and 4th character of method id 900298192Sdelphij>>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b 901298192Sdelphij!:mime application/x-lzh-compressed 902298192Sdelphij# creator type "LHA " 903328874Seadler!:apple ????LHA 904298192Sdelphij# display archive type name like "LHa/LZS archive data" or "LArc archive" 905298192Sdelphij>>>>>2 string -lz \b 906298192Sdelphij!:ext lzs 907298192Sdelphij# already known -lzs- -lz4- -lz5- with old names 908298192Sdelphij>>>>>>2 string -lzs LHa/LZS archive data 909298192Sdelphij>>>>>>3 regex \^lz[45] LHarc 1.x archive data 910298192Sdelphij# missing -lz?- with wikipedia names 911298192Sdelphij>>>>>>3 regex \^lz[2378] LArc archive 912298192Sdelphij# display archive type name like "LHa (2.x) archive data" 913328874Seadler>>>>>2 string -lh \b 914298192Sdelphij# already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names 915298192Sdelphij>>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data 916298192Sdelphij# LHice archiver use ".ICE" as name extension instead usual one ".lzh" 917298192Sdelphij# FOOBAR archiver use ".foo" as name extension instead usual one 918298192Sdelphij# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment 919298192Sdelphij>>>>>>>2 string -lh1 \b 920298192Sdelphij!:ext lha/lzh/ice 921298192Sdelphij>>>>>>3 regex \^lh[23d] LHa 2.x? archive data 922298192Sdelphij>>>>>>3 regex \^lh[7] LHa (2.x)/LHark archive data 923298192Sdelphij>>>>>>3 regex \^lh[456] LHa (2.x) archive data 924298192Sdelphij>>>>>>>2 string -lh5 \b 925298192Sdelphij# https://en.wikipedia.org/wiki/BIOS 926298192Sdelphij# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like 927298192Sdelphij# bios.rom , kd7_v14.bin, 1010.004, ... 928298192Sdelphij!:ext lha/lzh/rom/bin 929298192Sdelphij# missing -lh?- variants (Joe Jared) 930298192Sdelphij>>>>>>3 regex \^lh[89a-ce] LHa (Joe Jared) archive 931298192Sdelphij# UNLHA32 2.67a 932298192Sdelphij>>>>>>2 string -lhx LHa (UNLHA32) archive 933298192Sdelphij# lha archives with standard file name extensions ".lha" ".lzh" 934298192Sdelphij>>>>>>3 regex !\^(lh1|lh5) \b 935298192Sdelphij!:ext lha/lzh 936298192Sdelphij# this should not happen if all -lh variants are described 937298192Sdelphij>>>>>>2 default x LHa (unknown) archive 938298192Sdelphij#!:ext lha 939298192Sdelphij# PMarc 940298192Sdelphij>>>>>3 regex \^pm[012] PMarc archive data 941298192Sdelphij!:ext pma 942298192Sdelphij# append method id without leading and trailing minus character 943298192Sdelphij>>>>>3 string x [%3.3s] 944298192Sdelphij>>>>>>0 use lharc-header 945298192Sdelphij# 946298192Sdelphij# check and display information of lharc header 947298192Sdelphij0 name lharc-header 948298192Sdelphij# header size 0x4 , 0x1b-0x61 949328874Seadler>0 ubyte x 950298192Sdelphij# compressed data size != compressed file size 951298192Sdelphij#>7 ulelong x \b, data size %d 952328874Seadler# attribute: 0x2~?? 0x10~symlink|target 0x20~normal 953298192Sdelphij#>19 ubyte x \b, 19_0x%x 954298192Sdelphij# level identifier 0 1 2 3 955298192Sdelphij#>20 ubyte x \b, level %d 956298192Sdelphij# time stamp 957298192Sdelphij#>15 ubelong x DATE 0x%8.8x 958298192Sdelphij# OS ID for level 1 959328874Seadler>20 ubyte 1 960298192Sdelphij# 0x20 types find for *.rom files 961298192Sdelphij>>(21.b+24) ubyte <0x21 \b, 0x%x OS 962298192Sdelphij# ascii type like M for MSDOS 963298192Sdelphij>>(21.b+24) ubyte >0x20 \b, '%c' OS 964298192Sdelphij# OS ID for level 2 965328874Seadler>20 ubyte 2 966298192Sdelphij#>>23 ubyte x \b, OS ID 0x%x 967298192Sdelphij>>23 ubyte <0x21 \b, 0x%x OS 968298192Sdelphij>>23 ubyte >0x20 \b, '%c' OS 969298192Sdelphij# filename only for level 0 and 1 970328874Seadler>20 ubyte <2 971298192Sdelphij# length of filename 972298192Sdelphij>>21 ubyte >0 \b, with 973298192Sdelphij# filename 974298192Sdelphij>>>21 pstring x "%s" 975298192Sdelphij# 976298192Sdelphij#2 string -lh0- LHarc 1.x/ARX archive data [lh0] 977298192Sdelphij#!:mime application/x-lharc 978328874Seadler2 string -lh0- 979298192Sdelphij>0 use lharc-file 980298192Sdelphij#2 string -lh1- LHarc 1.x/ARX archive data [lh1] 981298192Sdelphij#!:mime application/x-lharc 982328874Seadler2 string -lh1- 983298192Sdelphij>0 use lharc-file 984298192Sdelphij# NEW -lz2- ... -lz8- 985328874Seadler2 string -lz2- 986298192Sdelphij>0 use lharc-file 987328874Seadler2 string -lz3- 988298192Sdelphij>0 use lharc-file 989328874Seadler2 string -lz4- 990298192Sdelphij>0 use lharc-file 991328874Seadler2 string -lz5- 992298192Sdelphij>0 use lharc-file 993328874Seadler2 string -lz7- 994298192Sdelphij>0 use lharc-file 995328874Seadler2 string -lz8- 996298192Sdelphij>0 use lharc-file 99768349Sobrien# [never seen any but the last; -lh4- reported in comp.compression:] 998298192Sdelphij#2 string -lzs- LHa/LZS archive data [lzs] 999328874Seadler2 string -lzs- 1000298192Sdelphij>0 use lharc-file 1001298192Sdelphij# According to wikipedia and others such a version does not exist 1002298192Sdelphij#2 string -lh\40- LHa 2.x? archive data [lh ] 1003298192Sdelphij#2 string -lhd- LHa 2.x? archive data [lhd] 1004328874Seadler2 string -lhd- 1005298192Sdelphij>0 use lharc-file 1006298192Sdelphij#2 string -lh2- LHa 2.x? archive data [lh2] 1007328874Seadler2 string -lh2- 1008298192Sdelphij>0 use lharc-file 1009298192Sdelphij#2 string -lh3- LHa 2.x? archive data [lh3] 1010328874Seadler2 string -lh3- 1011298192Sdelphij>0 use lharc-file 1012298192Sdelphij#2 string -lh4- LHa (2.x) archive data [lh4] 1013328874Seadler2 string -lh4- 1014298192Sdelphij>0 use lharc-file 1015298192Sdelphij#2 string -lh5- LHa (2.x) archive data [lh5] 1016328874Seadler2 string -lh5- 1017298192Sdelphij>0 use lharc-file 1018298192Sdelphij#2 string -lh6- LHa (2.x) archive data [lh6] 1019328874Seadler2 string -lh6- 1020298192Sdelphij>0 use lharc-file 1021298192Sdelphij#2 string -lh7- LHa (2.x)/LHark archive data [lh7] 1022328874Seadler2 string -lh7- 1023298192Sdelphij# !:mime application/x-lha 1024298192Sdelphij# >20 byte x - header level %d 1025298192Sdelphij>0 use lharc-file 1026298192Sdelphij# NEW -lh8- ... -lhe- , -lhx- 1027328874Seadler2 string -lh8- 1028298192Sdelphij>0 use lharc-file 1029328874Seadler2 string -lh9- 1030298192Sdelphij>0 use lharc-file 1031328874Seadler2 string -lha- 1032298192Sdelphij>0 use lharc-file 1033328874Seadler2 string -lhb- 1034298192Sdelphij>0 use lharc-file 1035328874Seadler2 string -lhc- 1036298192Sdelphij>0 use lharc-file 1037328874Seadler2 string -lhe- 1038298192Sdelphij>0 use lharc-file 1039328874Seadler2 string -lhx- 1040298192Sdelphij>0 use lharc-file 1041159764Sobrien# taken from idarc [JW] 1042159764Sobrien2 string -lZ PUT archive data 1043298192Sdelphij# already done by LHarc magics 1044328874Seadler# this should never happen if all sub types of LZS archive are identified 1045298192Sdelphij#2 string -lz LZS archive data 1046159764Sobrien2 string -sw1- Swag archive data 104768349Sobrien 1048298192Sdelphij0 name rar-file-header 1049298192Sdelphij>24 byte 15 \b, v1.5 1050298192Sdelphij>24 byte 20 \b, v2.0 1051298192Sdelphij>24 byte 29 \b, v4 1052298192Sdelphij>15 byte 0 \b, os: MS-DOS 1053298192Sdelphij>15 byte 1 \b, os: OS/2 1054298192Sdelphij>15 byte 2 \b, os: Win32 1055298192Sdelphij>15 byte 3 \b, os: Unix 1056298192Sdelphij>15 byte 4 \b, os: Mac OS 1057298192Sdelphij>15 byte 5 \b, os: BeOS 1058298192Sdelphij 1059298192Sdelphij0 name rar-archive-header 1060298192Sdelphij>3 leshort&0x1ff >0 \b, flags: 1061298192Sdelphij>>3 leshort &0x01 ArchiveVolume 1062298192Sdelphij>>3 leshort &0x02 Commented 1063298192Sdelphij>>3 leshort &0x04 Locked 1064298192Sdelphij>>3 leshort &0x10 NewVolumeNaming 1065298192Sdelphij>>3 leshort &0x08 Solid 1066298192Sdelphij>>3 leshort &0x20 Authenticated 1067298192Sdelphij>>3 leshort &0x40 RecoveryRecordPresent 1068298192Sdelphij>>3 leshort &0x80 EncryptedBlockHeader 1069298192Sdelphij>>3 leshort &0x100 FirstVolume 1070298192Sdelphij 1071298192Sdelphij# RAR (Roshal Archive) archive 1072298192Sdelphij0 string Rar!\x1a\7\0 RAR archive data 1073186690Sobrien!:mime application/x-rar 1074298192Sdelphij!:ext rar/cbr 1075298192Sdelphij# file header 1076298192Sdelphij>(0xc.l+9) byte 0x74 1077298192Sdelphij>>(0xc.l+7) use rar-file-header 1078298192Sdelphij# subblock seems to share information with file header 1079298192Sdelphij>(0xc.l+9) byte 0x7a 1080298192Sdelphij>>(0xc.l+7) use rar-file-header 1081298192Sdelphij>9 byte 0x73 1082298192Sdelphij>>7 use rar-archive-header 108368349Sobrien 1084298192Sdelphij0 string Rar!\x1a\7\1\0 RAR archive data, v5 1085298192Sdelphij!:mime application/x-rar 1086298192Sdelphij!:ext rar 1087298192Sdelphij 1088298192Sdelphij# Very old RAR archive 1089354939Sdelphij# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf 1090298192Sdelphij0 string RE\x7e\x5e RAR archive data (<v1.5) 1091298192Sdelphij!:mime application/x-rar 1092298192Sdelphij!:ext rar/cbr 1093298192Sdelphij 109468349Sobrien# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 109568349Sobrien0 string SQSH squished archive data (Acorn RISCOS) 109668349Sobrien 109768349Sobrien# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 1098159764Sobrien# [JW] see exe section for self-extracting version 109968349Sobrien0 string UC2\x1a UC2 archive data 110068349Sobrien 1101226048Sobrien# PKZIP multi-volume archive 1102226048Sobrien0 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 1103186690Sobrien!:mime application/zip 1104298192Sdelphij!:ext zip/cbz 110568349Sobrien 1106226048Sobrien# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 1107267843Sdelphij0 string PK\005\006 Zip archive data (empty) 1108298192Sdelphij!:mime application/zip 1109298192Sdelphij!:ext zip/cbz 1110354939Sdelphij!:strength +1 1111226048Sobrien0 string PK\003\004 1112354939Sdelphij!:strength +1 1113159764Sobrien 1114226048Sobrien# Specialised zip formats which start with a member named 'mimetype' 1115226048Sobrien# (stored uncompressed, with no 'extra field') containing the file's MIME type. 1116226048Sobrien# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 1117226048Sobrien# contents starting with "application/": 1118226048Sobrien>26 string \x8\0\0\0mimetypeapplication/ 1119159764Sobrien 1120226048Sobrien# KOffice / OpenOffice & StarOffice / OpenDocument formats 1121226048Sobrien# From: Abel Cheung <abel@oaka.org> 1122159764Sobrien 1123226048Sobrien# KOffice (1.2 or above) formats 1124226048Sobrien# (mimetype contains "application/vnd.kde.<SUBTYPE>") 1125226048Sobrien>>50 string vnd.kde. KOffice (>=1.2) 1126226048Sobrien>>>58 string karbon Karbon document 1127226048Sobrien>>>58 string kchart KChart document 1128226048Sobrien>>>58 string kformula KFormula document 1129226048Sobrien>>>58 string kivio Kivio document 1130226048Sobrien>>>58 string kontour Kontour document 1131226048Sobrien>>>58 string kpresenter KPresenter document 1132226048Sobrien>>>58 string kspread KSpread document 1133226048Sobrien>>>58 string kword KWord document 1134226048Sobrien 1135226048Sobrien# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 1136226048Sobrien# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 1137362844Sdelphij# URL: https://en.wikipedia.org/wiki/OpenOffice.org_XML 1138362844Sdelphij# reference: http://fileformats.archiveteam.org/wiki/OpenOffice.org_XML 1139226048Sobrien>>50 string vnd.sun.xml. OpenOffice.org 1.x 1140226048Sobrien>>>62 string writer Writer 1141226048Sobrien>>>>68 byte !0x2e document 1142362844Sdelphij!:mime application/vnd.sun.xml.writer 1143362844Sdelphij!:ext sxw 1144226048Sobrien>>>>68 string .template template 1145362844Sdelphij!:mime application/vnd.sun.xml.writer.template 1146362844Sdelphij!:ext stw 1147362844Sdelphij>>>>68 string .web Web template 1148362844Sdelphij!:mime application/vnd.sun.xml.writer.web 1149362844Sdelphij!:ext stw 1150226048Sobrien>>>>68 string .global global document 1151362844Sdelphij!:mime application/vnd.sun.xml.writer.global 1152362844Sdelphij!:ext sxg 1153226048Sobrien>>>62 string calc Calc 1154226048Sobrien>>>>66 byte !0x2e spreadsheet 1155362844Sdelphij!:mime application/vnd.sun.xml.calc 1156362844Sdelphij!:ext sxc 1157226048Sobrien>>>>66 string .template template 1158362844Sdelphij!:mime application/vnd.sun.xml.calc.template 1159362844Sdelphij!:ext stc 1160226048Sobrien>>>62 string draw Draw 1161226048Sobrien>>>>66 byte !0x2e document 1162362844Sdelphij!:mime application/vnd.sun.xml.draw 1163362844Sdelphij!:ext sxd 1164226048Sobrien>>>>66 string .template template 1165362844Sdelphij!:mime application/vnd.sun.xml.draw.template 1166362844Sdelphij!:ext std 1167226048Sobrien>>>62 string impress Impress 1168226048Sobrien>>>>69 byte !0x2e presentation 1169362844Sdelphij!:mime application/vnd.sun.xml.impress 1170362844Sdelphij!:ext sxi 1171226048Sobrien>>>>69 string .template template 1172362844Sdelphij!:mime application/vnd.sun.xml.impress.template 1173362844Sdelphij!:ext sti 1174226048Sobrien>>>62 string math Math document 1175362844Sdelphij!:mime application/vnd.sun.xml.math 1176362844Sdelphij!:ext sxm 1177226048Sobrien>>>62 string base Database file 1178362844Sdelphij!:mime application/vnd.sun.xml.base 1179362844Sdelphij!:ext sdb 1180226048Sobrien 1181226048Sobrien# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 1182362844Sdelphij# URL: http://fileformats.archiveteam.org/wiki/OpenDocument 1183354939Sdelphij# https://lists.oasis-open.org/archives/office/200505/msg00006.html 1184226048Sobrien# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 1185226048Sobrien>>50 string vnd.oasis.opendocument. OpenDocument 1186226048Sobrien>>>73 string text 1187226048Sobrien>>>>77 byte !0x2d Text 1188186690Sobrien!:mime application/vnd.oasis.opendocument.text 1189362844Sdelphij!:ext odt 1190226048Sobrien>>>>77 string -template Text Template 1191226048Sobrien!:mime application/vnd.oasis.opendocument.text-template 1192362844Sdelphij!:ext ott 1193226048Sobrien>>>>77 string -web HTML Document Template 1194226048Sobrien!:mime application/vnd.oasis.opendocument.text-web 1195362844Sdelphij!:ext oth 1196226048Sobrien>>>>77 string -master Master Document 1197226048Sobrien!:mime application/vnd.oasis.opendocument.text-master 1198362844Sdelphij!:ext odm 1199226048Sobrien>>>73 string graphics 1200226048Sobrien>>>>81 byte !0x2d Drawing 1201226048Sobrien!:mime application/vnd.oasis.opendocument.graphics 1202362844Sdelphij!:ext odg 1203362844Sdelphij>>>>81 string -template Drawing Template 1204226048Sobrien!:mime application/vnd.oasis.opendocument.graphics-template 1205362844Sdelphij!:ext otg 1206226048Sobrien>>>73 string presentation 1207226048Sobrien>>>>85 byte !0x2d Presentation 1208226048Sobrien!:mime application/vnd.oasis.opendocument.presentation 1209362844Sdelphij!:ext odp 1210362844Sdelphij>>>>85 string -template Presentation Template 1211226048Sobrien!:mime application/vnd.oasis.opendocument.presentation-template 1212362844Sdelphij!:ext otp 1213226048Sobrien>>>73 string spreadsheet 1214226048Sobrien>>>>84 byte !0x2d Spreadsheet 1215226048Sobrien!:mime application/vnd.oasis.opendocument.spreadsheet 1216362844Sdelphij!:ext ods 1217362844Sdelphij>>>>84 string -template Spreadsheet Template 1218226048Sobrien!:mime application/vnd.oasis.opendocument.spreadsheet-template 1219362844Sdelphij!:ext ots 1220226048Sobrien>>>73 string chart 1221226048Sobrien>>>>78 byte !0x2d Chart 1222226048Sobrien!:mime application/vnd.oasis.opendocument.chart 1223362844Sdelphij!:ext odc 1224362844Sdelphij>>>>78 string -template Chart Template 1225226048Sobrien!:mime application/vnd.oasis.opendocument.chart-template 1226362844Sdelphij!:ext otc 1227226048Sobrien>>>73 string formula 1228226048Sobrien>>>>80 byte !0x2d Formula 1229226048Sobrien!:mime application/vnd.oasis.opendocument.formula 1230362844Sdelphij!:ext odf 1231362844Sdelphij>>>>80 string -template Formula Template 1232226048Sobrien!:mime application/vnd.oasis.opendocument.formula-template 1233362844Sdelphij!:ext otf 1234362844Sdelphij# https://www.loc.gov/preservation/digital/formats/fdd/fdd000441.shtml 1235226048Sobrien>>>73 string database Database 1236226048Sobrien!:mime application/vnd.oasis.opendocument.database 1237362844Sdelphij!:ext odb 1238337827Seadler# Valid for LibreOffice Base 6.0.1.1 at least 1239337827Seadler>>>73 string base Database 1240362844Sdelphij# https://bugs.documentfoundation.org/show_bug.cgi?id=45854 1241362844Sdelphij!:mime application/vnd.oasis.opendocument.database 1242362844Sdelphij#!:mime application/vnd.oasis.opendocument.base 1243362844Sdelphij!:ext odb 1244226048Sobrien>>>73 string image 1245226048Sobrien>>>>78 byte !0x2d Image 1246226048Sobrien!:mime application/vnd.oasis.opendocument.image 1247362844Sdelphij!:ext odi 1248362844Sdelphij>>>>78 string -template Image Template 1249226048Sobrien!:mime application/vnd.oasis.opendocument.image-template 1250362844Sdelphij!:ext oti 1251159764Sobrien 1252226048Sobrien# EPUB (OEBPS) books using OCF (OEBPS Container Format) 1253354939Sdelphij# https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 1254267843Sdelphij# From: Ralf Brown <ralf.brown@gmail.com> 1255267843Sdelphij>>50 string epub+zip EPUB document 1256267843Sdelphij!:mime application/epub+zip 1257226048Sobrien 1258360521Sdelphij# From: Joerg Jenderek 1259360521Sdelphij# URL: http://en.wikipedia.org/wiki/CorelDRAW 1260360521Sdelphij# NOTE: version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based 1261360521Sdelphij>>50 string x-vnd.corel. Corel 1262360521Sdelphij>>>62 string draw.document+zip Draw drawing, version 14-16 1263360521Sdelphij!:mime application/x-vnd.corel.draw.document+zip 1264360521Sdelphij!:ext cdr 1265360521Sdelphij>>>62 string draw.template+zip Draw template, version 14-16 1266360521Sdelphij!:mime application/x-vnd.corel.draw.template+zip 1267360521Sdelphij!:ext cdrt 1268362844Sdelphij>>>62 string zcf.draw.document+zip Draw drawing, version 17-22 1269360521Sdelphij!:mime application/x-vnd.corel.zcf.draw.document+zip 1270360521Sdelphij!:ext cdr 1271362844Sdelphij>>>62 string zcf.draw.template+zip Draw template, version 17-22 1272360521Sdelphij!:mime application/x-vnd.corel.zcf.draw.template+zip 1273360521Sdelphij!:ext cdt/cdrt 1274362844Sdelphij# URL: http://product.corel.com/help/CorelDRAW/540240626/Main/EN/Doc/CorelDRAW-Other-file-formats.html 1275362844Sdelphij>>>62 string zcf.pattern+zip Draw pattern, version 22 1276362844Sdelphij!:mime application/x-vnd.corel.zcf.pattern+zip 1277362844Sdelphij!:ext pat 1278362844Sdelphij# URL: https://en.wikipedia.org/wiki/Corel_Designer 1279362844Sdelphij# Reference: http://fileformats.archiveteam.org/wiki/Corel_Designer 1280362844Sdelphij# Note: called by TrID "Corel DESIGN graphics" 1281362844Sdelphij>>>62 string designer.document+zip DESIGNER graphics, version 14-16 1282362844Sdelphij!:mime application/x-vnd.corel.designer.document+zip 1283362844Sdelphij!:ext des 1284362844Sdelphij>>>62 string zcf.designer.document+zip DESIGNER graphics, version 17-21 1285362844Sdelphij!:mime application/x-vnd.corel.zcf.designer.document+zip 1286362844Sdelphij!:ext des 1287362844Sdelphij# URL: http://product.corel.com/help/CorelDRAW/540223850/Main/EN/Documentation/ 1288362844Sdelphij# CorelDRAW-Corel-Symbol-Library-CSL.html 1289362844Sdelphij>>>62 string symbol.library+zip Symbol Library, version 6-16.3 1290362844Sdelphij!:mime application/x-vnd.corel.symbol.library+zip 1291362844Sdelphij!:ext csl 1292362844Sdelphij>>>62 string zcf.symbol.library+zip Symbol Library, version 17-22 1293362844Sdelphij!:mime application/x-vnd.corel.zcf.symbol.library+zip 1294362844Sdelphij!:ext csl 1295360521Sdelphij 1296226048Sobrien# Catch other ZIP-with-mimetype formats 1297226048Sobrien# In a ZIP file, the bytes immediately after a member's contents are 1298226048Sobrien# always "PK". The 2 regex rules here print the "mimetype" member's 1299226048Sobrien# contents up to the first 'P'. Luckily, most MIME types don't contain 1300226048Sobrien# any capital 'P's. This is a kludge. 1301226048Sobrien# (mimetype contains "application/<OTHER>") 1302360521Sdelphij>>50 default x Zip data 1303360521Sdelphij>>>38 regex [!-OQ-~]+ (MIME type "%s"?) 1304226048Sobrien!:mime application/zip 1305226048Sobrien# (mimetype contents other than "application/*") 1306226048Sobrien>26 string \x8\0\0\0mimetype 1307226048Sobrien>>38 string !application/ 1308226048Sobrien>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 1309226048Sobrien!:mime application/zip 1310226048Sobrien 1311267843Sdelphij# Java Jar files 1312267843Sdelphij>(26.s+30) leshort 0xcafe Java archive data (JAR) 1313267843Sdelphij!:mime application/java-archive 1314267843Sdelphij 1315299736Sdelphij# iOS App 1316299736Sdelphij>(26.s+30) leshort !0xcafe 1317299736Sdelphij>>26 string !\x8\0\0\0mimetype 1318299736Sdelphij>>>30 string Payload/ 1319299736Sdelphij>>>>38 search/64 .app/ iOS App 1320299736Sdelphij!:mime application/x-ios-app 1321299736Sdelphij 1322362844Sdelphij>30 search/100/b application/epub+zip EPUB document 1323362844Sdelphij!:mime application/epub+zip 1324299736Sdelphij 1325226048Sobrien# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 1326226048Sobrien# Next line excludes specialized formats: 1327267843Sdelphij>(26.s+30) leshort !0xcafe 1328362844Sdelphij>>30 search/100/b !application/epub+zip 1329362844Sdelphij>>>26 string !\x8\0\0\0mimetype Zip archive data 1330226048Sobrien!:mime application/zip 1331362844Sdelphij>>>>4 beshort x \b, at least 1332362844Sdelphij>>>>4 use zipversion 1333362844Sdelphij>>>>4 beshort x to extract 1334362844Sdelphij>>>>0x161 string WINZIP \b, WinZIP self-extracting 1335226048Sobrien 1336226048Sobrien# StarView Metafile 1337226048Sobrien# From Pierre Ducroquet <pinaraf@pinaraf.info> 1338226048Sobrien0 string VCLMTF StarView MetaFile 1339226048Sobrien>6 beshort x \b, version %d 1340226048Sobrien>8 belong x \b, size %d 1341226048Sobrien 134268349Sobrien# Zoo archiver 134368349Sobrien20 lelong 0xfdc4a7dc Zoo archive data 1344186690Sobrien!:mime application/x-zoo 134568349Sobrien>4 byte >48 \b, v%c. 134668349Sobrien>>6 byte >47 \b%c 134768349Sobrien>>>7 byte >47 \b%c 134868349Sobrien>32 byte >0 \b, modify: v%d 134968349Sobrien>>33 byte x \b.%d+ 135068349Sobrien>42 lelong 0xfdc4a7dc \b, 135168349Sobrien>>70 byte >0 extract: v%d 135268349Sobrien>>>71 byte x \b.%d+ 135368349Sobrien 135468349Sobrien# Shell archives 135568349Sobrien10 string #\ This\ is\ a\ shell\ archive shell archive text 1356186690Sobrien!:mime application/octet-stream 135768349Sobrien 135868349Sobrien# 1359226048Sobrien# LBR. NB: May conflict with the questionable 136068349Sobrien# "binary Computer Graphics Metafile" format. 136168349Sobrien# 136268349Sobrien0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 136368349Sobrien# 136468349Sobrien# PMA (CP/M derivative of LHA) 1365328874Seadler# Update: Joerg Jenderek 1366298192Sdelphij# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 136768349Sobrien# 1368298192Sdelphij#2 string -pm0- PMarc archive data [pm0] 1369328874Seadler2 string -pm0- 1370298192Sdelphij>0 use lharc-file 1371298192Sdelphij#2 string -pm1- PMarc archive data [pm1] 1372328874Seadler2 string -pm1- 1373298192Sdelphij>0 use lharc-file 1374298192Sdelphij#2 string -pm2- PMarc archive data [pm2] 1375328874Seadler2 string -pm2- 1376298192Sdelphij>0 use lharc-file 137768349Sobrien2 string -pms- PMarc SFX archive (CP/M, DOS) 1378298192Sdelphij#!:mime application/x-foobar-exec 1379298192Sdelphij!:ext com 138068349Sobrien5 string -pc1- PopCom compressed executable (CP/M) 1381298192Sdelphij#!:mime application/x- 1382298192Sdelphij#!:ext com 138368349Sobrien 1384110949Sobrien# From Rafael Laboissiere <rafael@laboissiere.net> 138568349Sobrien# The Project Revision Control System (see 1386110949Sobrien# http://prcs.sourceforge.net) generates a packaged project 1387226048Sobrien# file which is recognized by the following entry: 138868349Sobrien0 leshort 0xeb81 PRCS packaged project 138974784Sobrien 1390226048Sobrien# Microsoft cabinets 139174784Sobrien# by David Necas (Yeti) <yeti@physics.muni.cz> 1392133359Sobrien#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 1393133359Sobrien#>25 byte x v%d 1394133359Sobrien#>24 byte x \b.%d 1395133359Sobrien# MPi: All CABs have version 1.3, so this is pointless. 1396133359Sobrien# Better magic in debian-additions. 139774784Sobrien 1398226048Sobrien# GTKtalog catalogs 139974784Sobrien# by David Necas (Yeti) <yeti@physics.muni.cz> 140075937Sobrien4 string gtktalog\ GTKtalog catalog data, 140175937Sobrien>13 string 3 version 3 140275937Sobrien>>14 beshort 0x677a (gzipped) 140375937Sobrien>>14 beshort !0x677a (not gzipped) 140475937Sobrien>13 string >3 version %s 1405103373Sobrien 1406103373Sobrien############################################################################ 1407103373Sobrien# Parity archive reconstruction file, the 'par' file format now used on Usenet. 1408103373Sobrien0 string PAR\0 PARity archive data 1409103373Sobrien>48 leshort =0 - Index file 1410103373Sobrien>48 leshort >0 - file number %d 1411133359Sobrien 1412133359Sobrien# Felix von Leitner <felix-file@fefe.de> 1413133359Sobrien0 string d8:announce BitTorrent file 1414186690Sobrien!:mime application/x-bittorrent 1415298192Sdelphij# Durval Menezes, <jmgthbfile at durval dot com> 1416298192Sdelphij0 string d13:announce-list BitTorrent file 1417298192Sdelphij!:mime application/x-bittorrent 1418360521Sdelphij0 string d7:comment BitTorrent file 1419360521Sdelphij!:mime application/x-bittorrent 1420360521Sdelphij0 string d4:info BitTorrent file 1421360521Sdelphij!:mime application/x-bittorrent 1422133359Sobrien 1423133359Sobrien# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 1424226048Sobrien0 beshort 0x0e0f Atari MSA archive data 1425226048Sobrien>2 beshort x \b, %d sectors per track 1426226048Sobrien>4 beshort 0 \b, 1 sided 1427226048Sobrien>4 beshort 1 \b, 2 sided 1428226048Sobrien>6 beshort x \b, starting track: %d 1429226048Sobrien>8 beshort x \b, ending track: %d 1430133359Sobrien 1431133359Sobrien# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 1432133359Sobrien0 string PK00PK\003\004 Zip archive data 1433337827Seadler!:mime application/zip 1434337827Seadler!:ext zip/cbz 1435133359Sobrien 1436133359Sobrien# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 1437133359Sobrien# by Stefan `Sec` Zehl <sec@42.org> 1438159764Sobrien7 string **ACE** ACE archive data 1439133359Sobrien>15 byte >0 version %d 1440133359Sobrien>16 byte =0x00 \b, from MS-DOS 1441133359Sobrien>16 byte =0x01 \b, from OS/2 1442133359Sobrien>16 byte =0x02 \b, from Win/32 1443133359Sobrien>16 byte =0x03 \b, from Unix 1444133359Sobrien>16 byte =0x04 \b, from MacOS 1445133359Sobrien>16 byte =0x05 \b, from WinNT 1446133359Sobrien>16 byte =0x06 \b, from Primos 1447133359Sobrien>16 byte =0x07 \b, from AppleGS 1448133359Sobrien>16 byte =0x08 \b, from Atari 1449133359Sobrien>16 byte =0x09 \b, from Vax/VMS 1450133359Sobrien>16 byte =0x0A \b, from Amiga 1451133359Sobrien>16 byte =0x0B \b, from Next 1452133359Sobrien>14 byte x \b, version %d to extract 1453133359Sobrien>5 leshort &0x0080 \b, multiple volumes, 1454133359Sobrien>>17 byte x \b (part %d), 1455133359Sobrien>5 leshort &0x0002 \b, contains comment 1456133359Sobrien>5 leshort &0x0200 \b, sfx 1457133359Sobrien>5 leshort &0x0400 \b, small dictionary 1458133359Sobrien>5 leshort &0x0800 \b, multi-volume 1459133359Sobrien>5 leshort &0x1000 \b, contains AV-String 1460159764Sobrien>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 1461133359Sobrien>5 leshort &0x2000 \b, with recovery record 1462133359Sobrien>5 leshort &0x4000 \b, locked 1463133359Sobrien>5 leshort &0x8000 \b, solid 1464133359Sobrien# Date in MS-DOS format (whatever that is) 1465133359Sobrien#>18 lelong x Created on 1466133359Sobrien 1467133359Sobrien# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 1468133359Sobrien# <doj@cubic.org> 1469133359Sobrien0x1A string sfArk sfArk compressed Soundfont 1470133359Sobrien>0x15 string 2 1471133359Sobrien>>0x1 string >\0 Version %s 1472133359Sobrien>>0x2A string >\0 : %s 1473133359Sobrien 1474159764Sobrien# DR-DOS 7.03 Packed File *.??_ 1475159764Sobrien0 string Packed\ File\ Personal NetWare Packed File 1476226048Sobrien>12 string x \b, was "%.12s" 1477159764Sobrien 1478159764Sobrien# EET archive 1479159764Sobrien# From: Tilman Sauerbeck <tilman@code-monkey.de> 1480159764Sobrien0 belong 0x1ee7ff00 EET archive 1481186690Sobrien!:mime application/x-eet 1482169942Sobrien 1483169942Sobrien# rzip archives 1484169942Sobrien0 string RZIP rzip compressed data 1485169942Sobrien>4 byte x - version %d 1486169942Sobrien>5 byte x \b.%d 1487169942Sobrien>6 belong x (%d bytes) 1488169942Sobrien 1489354939Sdelphij# From: Joerg Jenderek 1490354939Sdelphij# URL: https://help.foxitsoftware.com/kb/install-fzip-file.php 1491354939Sdelphij# reference: http://mark0.net/download/triddefs_xml.7z/ 1492354939Sdelphij# defs/f/fzip.trid.xml 1493354939Sdelphij# Note: unknown compression; No "PK" zip magic; normally in directory like 1494354939Sdelphij# "%APPDATA%\Foxit Software\Addon\Foxit Reader\Install" 1495354939Sdelphij0 ubequad 0x2506781901010000 Foxit add-on/update 1496354939Sdelphij!:mime application/x-fzip 1497354939Sdelphij!:ext fzip 1498354939Sdelphij 1499169942Sobrien# From: "Robert Dale" <robdale@gmail.com> 1500169942Sobrien0 belong 123 dar archive, 1501169942Sobrien>4 belong x label "%.8x 1502169942Sobrien>>8 belong x %.8x 1503169942Sobrien>>>12 beshort x %.4x" 1504169942Sobrien>14 byte 0x54 end slice 1505169942Sobrien>14 beshort 0x4e4e multi-part 1506169942Sobrien>14 beshort 0x4e53 multi-part, with -S 1507169962Sobrien 1508169962Sobrien# Symbian installation files 1509354939Sdelphij# https://www.thouky.co.uk/software/psifs/sis.html 1510169962Sobrien# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 1511169962Sobrien8 lelong 0x10000419 Symbian installation file 1512186690Sobrien!:mime application/vnd.symbian.install 1513169962Sobrien>4 lelong 0x1000006D (EPOC release 3/4/5) 1514169962Sobrien>4 lelong 0x10003A12 (EPOC release 6) 1515169962Sobrien0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 1516186690Sobrien!:mime x-epoc/x-sisx-app 1517175296Sobrien 1518175296Sobrien# From "Nelson A. de Oliveira" <naoliv@gmail.com> 1519175296Sobrien0 string MPQ\032 MoPaQ (MPQ) archive 1520175296Sobrien 1521175296Sobrien# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 1522175296Sobrien# .kgb 1523175296Sobrien0 string KGB_arch KGB Archiver file 1524175296Sobrien>10 string x with compression level %.1s 1525186690Sobrien 1526186690Sobrien# xar (eXtensible ARchiver) archive 1527354939Sdelphij# URL: https://en.wikipedia.org/wiki/Xar_(archiver) 1528354939Sdelphij# xar archive format: https://code.google.com/p/xar/ 1529186690Sobrien# From: "David Remahl" <dremahl@apple.com> 1530354939Sdelphij# Update: Joerg Jenderek 1531354939Sdelphij# TODO: lzma compression; X509Data for pkg and xip 1532354939Sdelphij# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or 1533354939Sdelphij# 7z t -txar Xcode_10.2_beta_4.xip` 1534186690Sobrien0 string xar! xar archive 1535298192Sdelphij!:mime application/x-xar 1536354939Sdelphij# pkg for Mac OSX installer package like FullBundleUpdate.pkg 1537354939Sdelphij# xip for signed Apple software like Xcode_10.2_beta_4.xip 1538354939Sdelphij!:ext xar/pkg/xip 1539354939Sdelphij# always 28 in older archives 1540354939Sdelphij>4 ubeshort >28 \b, header size %u 1541354939Sdelphij# currently there exit only version 1 since about 2014 1542354939Sdelphij>6 ubeshort >1 version %u, 1543354939Sdelphij>8 ubequad x compressed TOC: %llu, 1544354939Sdelphij#>16 ubequad x uncompressed TOC: %llu, 1545354939Sdelphij# cksum_alg 0-2 in older and also 3-4 in newer 1546186690Sobrien>24 belong 0 no checksum 1547186690Sobrien>24 belong 1 SHA-1 checksum 1548186690Sobrien>24 belong 2 MD5 checksum 1549354939Sdelphij>24 belong 3 SHA-256 checksum 1550354939Sdelphij>24 belong 4 SHA-512 checksum 1551354939Sdelphij>24 belong >4 unknown 0x%x checksum 1552354939Sdelphij#>24 belong >4 checksum 1553354939Sdelphij# For no compression jump 0 bytes 1554354939Sdelphij>24 belong 0 1555354939Sdelphij>>0 ubyte x 1556354939Sdelphij# jump more bytes forward by header size 1557354939Sdelphij>>>&(4.S) ubyte x 1558354939Sdelphij# jump more bytes forward by compressed table of contents size 1559354939Sdelphij#>>>>&(8.Q) ubequad x \b, heap data 0x%llx 1560354939Sdelphij>>>>&(8.Q) ubyte x 1561354939Sdelphij# look for data by ./compress after message with 1 space at end 1562354939Sdelphij>>>>>&-3 indirect x \b, contains 1563354939Sdelphij# For SHA-1 jump 20 minus 2 bytes 1564354939Sdelphij>24 belong 1 1565354939Sdelphij>>18 ubyte x 1566354939Sdelphij# jump more bytes forward by header size 1567354939Sdelphij>>>&(4.S) ubyte x 1568354939Sdelphij# jump more bytes forward by compressed table of contents size 1569354939Sdelphij>>>>&(8.Q) ubyte x 1570354939Sdelphij# data compressed by gzip, bzip, lzma or none 1571354939Sdelphij>>>>>&-1 indirect x \b, contains 1572354939Sdelphij# For SHA-256 jump 32 minus 2 bytes 1573354939Sdelphij>24 belong 3 1574354939Sdelphij>>30 ubyte x 1575354939Sdelphij# jump more bytes forward by header size 1576354939Sdelphij>>>&(4.S) ubyte x 1577354939Sdelphij# jump more bytes forward by compressed table of contents size 1578354939Sdelphij>>>>&(8.Q) ubyte x 1579354939Sdelphij>>>>>&-1 indirect x \b, contains 1580354939Sdelphij# For SHA-512 jump 64 minus 2 bytes 1581354939Sdelphij>24 belong 4 1582354939Sdelphij>>62 ubyte x 1583354939Sdelphij# jump more bytes forward by header size 1584354939Sdelphij>>>&(4.S) ubyte x 1585354939Sdelphij# jump more bytes forward by compressed table of contents size 1586354939Sdelphij>>>>&(8.Q) ubyte x 1587354939Sdelphij>>>>>&-1 indirect x \b, contains 1588186690Sobrien 1589226048Sobrien# Type: Parity Archive 1590226048Sobrien# From: Daniel van Eeden <daniel_e@dds.nl> 1591226048Sobrien0 string PAR2 Parity Archive Volume Set 1592226048Sobrien 1593226048Sobrien# Bacula volume format. (Volumes always start with a block header.) 1594354939Sdelphij# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 1595226048Sobrien# From: Adam Buchbinder <adam.buchbinder@gmail.com> 1596226048Sobrien12 string BB02 Bacula volume 1597226048Sobrien>20 bedate x \b, started %s 1598226048Sobrien 1599226048Sobrien# ePub is XHTML + XML inside a ZIP archive. The first member of the 1600226048Sobrien# archive must be an uncompressed file called 'mimetype' with contents 1601226048Sobrien# 'application/epub+zip' 1602226048Sobrien 1603226048Sobrien 1604267843Sdelphij# From: "Michael Gorny" <mgorny@gentoo.org> 1605226048Sobrien# ZPAQ: http://mattmahoney.net/dc/zpaq.html 1606226048Sobrien0 string zPQ ZPAQ stream 1607226048Sobrien>3 byte x \b, level %d 1608284237Sdelphij# From: Barry Carter <carter.barry@gmail.com> 1609354939Sdelphij# https://encode.ru/threads/456-zpaq-updates/page32 1610284237Sdelphij0 string 7kSt ZPAQ file 1611226048Sobrien 1612226048Sobrien# BBeB ebook, unencrypted (LRF format) 1613354939Sdelphij# URL: https://www.sven.de/librie/Librie/LrfFormat 1614226048Sobrien# From: Adam Buchbinder <adam.buchbinder@gmail.com> 1615226048Sobrien0 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 1616226048Sobrien>8 beshort x \b, version %d 1617226048Sobrien>36 byte 1 \b, front-to-back 1618226048Sobrien>36 byte 16 \b, back-to-front 1619226048Sobrien>42 beshort x \b, (%dx, 1620226048Sobrien>44 beshort x %d) 1621267843Sdelphij 1622267843Sdelphij# Symantec GHOST image by Joerg Jenderek at May 2014 1623354939Sdelphij# https://us.norton.com/ghost/ 1624354939Sdelphij# https://www.garykessler.net/library/file_sigs.html 1625267843Sdelphij0 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image 1626267843Sdelphij# *.GHO 1627267843Sdelphij>2 ubyte&0x08 0x00 \b, first file 1628267843Sdelphij# *.GHS or *.[0-9] with cns program option 1629267843Sdelphij>2 ubyte&0x08 0x08 \b, split file 1630267843Sdelphij# part of split index interesting for *.ghs 1631267843Sdelphij>>4 ubyte x id=0x%x 1632267843Sdelphij# compression tag minus one equals numeric compression command line switch z[1-9] 1633267843Sdelphij>3 ubyte 0 \b, no compression 1634267843Sdelphij>3 ubyte 2 \b, fast compression (Z1) 1635267843Sdelphij>3 ubyte 3 \b, medium compression (Z2) 1636328874Seadler>3 ubyte >3 1637267843Sdelphij>>3 ubyte <11 \b, compression (Z%d-1) 1638328874Seadler>2 ubyte&0x08 0x00 1639267843Sdelphij# ~ 30 byte password field only for *.gho 1640267843Sdelphij>>12 ubequad !0 \b, password protected 1641328874Seadler>>44 ubyte !1 1642267843Sdelphij# 1~Image All, sector-by-sector only for *.gho 1643267843Sdelphij>>>10 ubyte 1 \b, sector copy 1644267843Sdelphij# 1~Image Boot track only for *.gho 1645267843Sdelphij>>>43 ubyte 1 \b, boot track 1646267843Sdelphij# 1~Image Disc only for *.gho implies Image Boot track and sector copy 1647267843Sdelphij>>44 ubyte 1 \b, disc sector copy 1648267843Sdelphij# optional image description only *.gho 1649267843Sdelphij>>0xff string >\0 "%-.254s" 1650267843Sdelphij# look for DOS sector end sequence 1651328874Seadler>0xE08 search/7776 \x55\xAA 1652328874Seadler>>&-512 indirect x \b; contains 1653267843Sdelphij 1654298192Sdelphij# Google Chrome extensions 1655298192Sdelphij# https://developer.chrome.com/extensions/crx 1656298192Sdelphij# https://developer.chrome.com/extensions/hosting 1657298192Sdelphij0 string Cr24 Google Chrome extension 1658298192Sdelphij!:mime application/x-chrome-extension 1659298192Sdelphij>4 ulong x \b, version %u 1660328874Seadler 1661328874Seadler# SeqBox - Sequenced container 1662328874Seadler# ext: sbx, seqbox 1663328874Seadler# Marco Pontello marcopon@gmail.com 1664328874Seadler# reference: https://github.com/MarcoPon/SeqBox 1665328874Seadler0 string SBx SeqBox, 1666328874Seadler>3 byte x version %d 1667337827Seadler 1668337827Seadler# LyNX archive 1669337827Seadler56 string USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE LyNX archive 1670354939Sdelphij 1671354939Sdelphij# From: Joerg Jenderek 1672354939Sdelphij# URL: https://www.acronis.com/ 1673354939Sdelphij# Reference: https://en.wikipedia.org/wiki/TIB_(file_format) 1674354939Sdelphij# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110 1675354939Sdelphij0 ubequad 0xce24b9a220000000 Acronis True Image backup 1676354939Sdelphij!:mime application/x-acronis-tib 1677354939Sdelphij!:ext tib 1678354939Sdelphij# 01000000 1679354939Sdelphij#>20 ubelong x \b, at 20 0x%x 1680354939Sdelphij# 20000000 1681354939Sdelphij#>28 ubelong x \b, at 28 0x%x 1682354939Sdelphij# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0" 1683354939Sdelphij# ??? 1684354939Sdelphij# strings like "\Device\0000011e" "\Device\0000015a" 1685354939Sdelphij#>0 search/0x6852300/cs \\Device\\ 1686354939Sdelphij#>>&-1 pstring x \b, %s 1687354939Sdelphij# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39" 1688354939Sdelphij#>>>&1 search/180/cs \\Device\\ 1689354939Sdelphij#>>>>&-1 pstring x \b, %s 1690354939Sdelphij#>>>>>&0 search/29/cs \0\0\xc8\0 1691354939Sdelphij# disk label 1692354939Sdelphij#>>>>>>&10 lestring16 x \b, disk label %11.11s 1693354939Sdelphij#>>>>>>&9 plestring16 x \b, disk label "%11.11s" 1694354939Sdelphij#>>>>>>&10 ubequad x %16.16llx 1695354939Sdelphij 1696354939Sdelphij 1697354939Sdelphij# Gentoo XPAK binary package 1698354939Sdelphij# by Michal Gorny <mgorny@gentoo.org> 1699354939Sdelphij# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5 1700354939Sdelphij-4 string STOP 1701354939Sdelphij>-16 string XPAKSTOP Gentoo binary package (XPAK) 1702354939Sdelphij 1703354939Sdelphij# From: Joerg Jenderek 1704354939Sdelphij# URL: https://kodi.wiki/view/TexturePacker 1705354939Sdelphij# Reference: https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz 1706354939Sdelphij# /xbmc-Krypton/xbmc/guilib/XBTF.h 1707354939Sdelphij# /xbmc-Krypton/xbmc/guilib/XBTF.cpp 1708354939Sdelphij0 string XBTF 1709354939Sdelphij# skip ASCII text by looking for terminating \0 of path 1710354939Sdelphij>264 ubyte 0 XBMC texture package 1711354939Sdelphij!:mime application/x-xbmc-xbt 1712354939Sdelphij!:ext xbt 1713354939Sdelphij# XBTF_VERSION 2 1714354939Sdelphij>>4 string !2 \b, version %-.1s 1715354939Sdelphij# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp 1716354939Sdelphij>>5 ulelong x \b, %u file 1717354939Sdelphij# plural s 1718354939Sdelphij>>5 ulelong >1 \bs 1719354939Sdelphij# path[CXBTFFile[MaximumPathLength=256] 1720354939Sdelphij>>9 string x \b, 1st %s 1721354939Sdelphij 1722