macintosh revision 337827
1 2#------------------------------------------------------------------------------ 3# $File: macintosh,v 1.28 2017/12/05 02:17:48 christos Exp $ 4# macintosh description 5# 6# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 7# Daniel Quinlan, quinlan@yggdrasil.com 811 string must\ be\ converted\ with\ BinHex BinHex binary text 9!:mime application/mac-binhex40 10>41 string x \b, version %.3s 11 12# Stuffit archives are the de facto standard of compression for Macintosh 13# files obtained from most archives. (franklsm@tuns.ca) 140 string SIT! StuffIt Archive (data) 15!:mime application/x-stuffit 16!:apple SIT!SIT! 17>2 string x : %s 180 string SITD StuffIt Deluxe (data) 19>2 string x : %s 200 string Seg StuffIt Deluxe Segment (data) 21>2 string x : %s 22 23# Newer StuffIt archives (grant@netbsd.org) 240 string StuffIt StuffIt Archive 25!:mime application/x-stuffit 26!:apple SIT!SIT! 27#>162 string >0 : %s 28 29# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 30# GRR: Too weak 31#0 string APPL Macintosh Application (data) 32#>2 string x \b: %s 33 34# Macintosh System files (franklsm@tuns.ca) 35# GRR: Too weak 36#0 string zsys Macintosh System File (data) 37#0 string FNDR Macintosh Finder (data) 38#0 string libr Macintosh Library (data) 39#>2 string x : %s 40#0 string shlb Macintosh Shared Library (data) 41#>2 string x : %s 42#0 string cdev Macintosh Control Panel (data) 43#>2 string x : %s 44#0 string INIT Macintosh Extension (data) 45#>2 string x : %s 46#0 string FFIL Macintosh Truetype Font (data) 47#>2 string x : %s 48#0 string LWFN Macintosh Postscript Font (data) 49#>2 string x : %s 50 51# Additional Macintosh Files (franklsm@tuns.ca) 52# GRR: Too weak 53#0 string PACT Macintosh Compact Pro Archive (data) 54#>2 string x : %s 55#0 string ttro Macintosh TeachText File (data) 56#>2 string x : %s 57#0 string TEXT Macintosh TeachText File (data) 58#>2 string x : %s 59#0 string PDF Macintosh PDF File (data) 60#>2 string x : %s 61 62# MacBinary format (Eric Fischer, enf@pobox.com) 63# Update: Joerg Jenderek 64# URL: https://en.wikipedia.org/wiki/MacBinary 65# Reference: http://files.stairways.com/other/macbinaryii-standard-info.txt 66# 67# Unfortunately MacBinary doesn't really have a magic number prior 68# to the MacBinary III format. 69# 70 71# old version number, must be kept at zero for compatibility 720 byte 0 73# length of filename (must be in the range 1-63) 74>1 ubyte >0 75# skip T.PIC.LZ INSTRUMENT.7T INVENTORY 76>>1 ubyte <64 77# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)" 78# by looking for printable characters at beginning of file name 79>>>2 ubelong >0x1F000000 80# zero fill, must be zero for compatibility 81>>>>74 byte 0 82# zero fill, must be zero for compatibility 83>>>>>82 byte 0 84# MacBinary I test for valid version numbers 85>>>>>>122 ubeshort 0 86# additional check for creation date after 1 Jan 1970 ~ 7C25B080h 87#>>>>>>>91 ubelong >0x7c25b07F 88# additional check for undefined header fields in MacBinary I 89#>>>>>>>101 ulong 0 90>>>>>>>0 use mac-bin 91# MacBinary II the newer versions begins at 129 92>>>>>>122 ubeshort 0x8181 93>>>>>>>0 use mac-bin 94# MacBinary III with MacBinary II to read 95>>>>>122 ubeshort 0x8281 96>>>>>>0 use mac-bin 97 98# display information of MacBinary file 990 name mac-bin 100>122 ubyte x MacBinary 101# versions for MacBinary II/III 102>122 ubyte 129 II 103>122 ubyte 130 III 104# only in MacBinary III 105>>102 string !mBIN with surprising version 106!:mime application/x-macbinary 107!:apple PSPTBINA 108!:ext bin/macbin 109# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary 110#>1 ubyte >63 \b, name length %u too BIG! 111#>122 ubeshort x \b, version 0x%x 112# Finder flags if not 0 113# >73 byte !0 \b, flags 0x 114# >73 byte =0 115# >>101 byte !0 \b, flags 0x 116# # original Finder flags (Bits 8-15) 117# >73 byte !0 \b%x 118# # finder flags, bits 0-7 119# >101 byte !0 \b%x 120>73 byte &0x01 \b, inited 121>73 byte &0x02 \b, changed 122>73 byte &0x04 \b, busy 123>73 byte &0x08 \b, bozo 124>73 byte &0x10 \b, system 125>73 byte &0x20 \b, bundle 126>73 byte &0x40 \b, invisible 127>73 byte &0x80 \b, locked 128 129# 75 beshort # vertical posn in window 130#>75 beshort !0 \b, v.pos %u 131# 77 beshort # horiz posn in window 132#>77 beshort !0 \b, h.pos %u 133# 79 beshort # window or folder ID 134>79 ubeshort !0 \b, ID 0x%x 135# protected flag 136>81 byte !0 \b, protected 0x%x 137# length of comment after resource 138>99 ubeshort !0 \b, comment length %u 139# char. code of file name 140>106 ubyte !0 \b, char. code 0x%x 141# still more Finder flags 142>107 ubyte !0 \b, more flags 0x%x 143# length of total files when unpacked only used when pack and unpack on the fly 144>116 ubelong !0 \b, total length %u 145# 120 beshort # length of add'l header 146>120 ubeshort !0 \b, 2nd header length %u 147# 124 beshort # checksum 148#>124 ubeshort !0 \b, CRC 0x%x 149# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080 150>91 beldate-0x7C25B080 x \b, %s 151# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow 152>91 ubelong <0x7c25b080 INVALID date 153#>91 belong-0x7C25B080 x \b, DEBUG DATE %d 154# last modified date 155>95 beldate-0x7C25B080 x \b, modified %s 156# Apple creator+typ if not null 157# file creator (normally expressed as four characters) 158>69 ulong !0 \b, creator 159# instead 4 character code display full creator name 160>>69 use apple-creator 161# file type (normally expressed as four characters) 162>65 ulong !0 \b, type 163>>65 use apple-type 164# length of data segment 165>83 ubelong !0 \b, %u bytes 166# filename (in the range 1-63) 167>1 pstring x "%s" 168# print 1 space and then at offset 128 inspect data fork content if it has one 169>83 ubelong !0 \b 170>>128 indirect x 171# Afterwards resource fork if length of resource segment not zero 172>87 ubelong !0 173# calculate resource fork offset 174>>83 ubelong+128 x \b, at 0x%x 175# length of resource segment 176>>87 ubelong !0 %u bytes 177>>(83.S+128) ubequad x resource 178# further resource fork content inspection 179>>>&-8 indirect x 180 181# Apple Type/Creator Database 182# URL: https://en.wikipedia.org/wiki/Type_code 183# Reference: http://www.lacikam.co.il/tcdb/ 184# http://www.macdisk.com/macsigen.php 185# Note: classic Mac OS files have two 4 character codes for type and creator. 186# Thereby the Finder attach documents types to applications. 187 188#>65 string x \b, type "%4.4s" 189 190# display information about apple type 1910 name apple-type 192>0 string 8BIM PhotoShop 193>0 string ALB3 PageMaker 3 194>0 string ALB4 PageMaker 4 195>0 string ALT3 PageMaker 3 196>0 string APPL application 197>0 string AWWP AppleWorks word processor 198>0 string CIRC simulated circuit 199>0 string DRWG MacDraw 200>0 string EPSF Encapsulated PostScript 201>0 string FFIL font suitcase 202>0 string FKEY function key 203>0 string FNDR Macintosh Finder 204>0 string GIFf GIF image 205>0 string Gzip GNU gzip 206>0 string INIT system extension 207>0 string LIB\ library 208>0 string LWFN PostScript font 209>0 string MSBC Microsoft BASIC 210>0 string PACT Compact Pro archive 211>0 string PDF\ Portable Document Format 212>0 string PICT picture 213>0 string PNTG MacPaint picture 214>0 string PREF preferences 215>0 string PROJ Think C project 216>0 string QPRJ Think Pascal project 217>0 string SCFL Defender scores 218>0 string SCRN startup screen 219>0 string SITD StuffIt Deluxe 220>0 string SPn3 SuperPaint 221>0 string STAK HyperCard stack 222>0 string Seg\ StuffIt segment 223>0 string TARF Unix tar archive 224>0 string TEXT ASCII 225>0 string TIFF TIFF image 226>0 string TOVF Eudora table of contents 227>0 string WDBN Microsoft Word word processor 228>0 string WORD MacWrite word processor 229>0 string XLS\ Microsoft Excel 230>0 string ZIVM compress (.Z) 231>0 string ZSYS Pre-System 7 system file 232>0 string acf3 Aldus FreeHand 233>0 string cdev control panel 234>0 string dfil Desk Accessory suitcase 235>0 string libr library 236>0 string nX^d WriteNow word processor 237>0 string nX^w WriteNow dictionary 238>0 string rsrc resource 239>0 string scbk Scrapbook 240>0 string shlb shared library 241>0 string ttro SimpleText read-only 242>0 string zsys system file 243 244# additional types added in Dec 2017 245>0 string BINA binary file 246>0 string BMPp BMP image 247>0 string JPEG JPEG image 248#>0 string W4BN Microsoft Word x.y word processor? 249# if type name is not known display 4 character identifier 250>0 default x 251>>0 string x '%4.4s' 252 253#>69 string x \b, creator "%4.4s" 254 255# Now Apple has no repository of registered Creator IDs any more. These are 256# just the ones that I happened to have files from and was able to identify. 257 258# display information about apple creator 2590 name apple-creator 260>0 string 8BIM Adobe Photoshop 261>0 string ALD3 PageMaker 3 262>0 string ALD4 PageMaker 4 263>0 string ALFA Alpha editor 264>0 string APLS Apple Scanner 265>0 string APSC Apple Scanner 266>0 string BRKL Brickles 267>0 string BTFT BitFont 268>0 string CCL2 Common Lisp 2 269>0 string CCL\ Common Lisp 270>0 string CDmo The Talking Moose 271>0 string CPCT Compact Pro 272>0 string CSOm Eudora 273>0 string DMOV Font/DA Mover 274>0 string DSIM DigSim 275>0 string EDIT Macintosh Edit 276>0 string ERIK Macintosh Finder 277>0 string EXTR self-extracting archive 278>0 string Gzip GNU gzip 279>0 string KAHL Think C 280>0 string LWFU LaserWriter Utility 281>0 string LZIV compress 282>0 string MACA MacWrite 283>0 string MACS Macintosh operating system 284>0 string MAcK MacKnowledge terminal emulator 285>0 string MLND Defender 286>0 string MPNT MacPaint 287>0 string MSBB Microsoft BASIC (binary) 288>0 string MSWD Microsoft Word 289>0 string NCSA NCSA Telnet 290>0 string PJMM Think Pascal 291>0 string PSAL Hunt the Wumpus 292#>0 string PSI2 Apple File Exchange 293>0 string R*ch BBEdit 294>0 string RMKR Resource Maker 295>0 string RSED Resource Editor 296>0 string Rich BBEdit 297>0 string SIT! StuffIt 298>0 string SPNT SuperPaint 299>0 string Unix NeXT Mac filesystem 300>0 string VIM! Vim editor 301>0 string WILD HyperCard 302>0 string XCEL Microsoft Excel 303>0 string aCa2 Fontographer 304>0 string aca3 Aldus FreeHand 305>0 string dosa Macintosh MS-DOS file system 306>0 string movr Font/DA Mover 307>0 string nX^n WriteNow 308>0 string pdos Apple ProDOS file system 309>0 string scbk Scrapbook 310>0 string ttxt SimpleText 311>0 string ufox Foreign File Access 312# additional creators added in Dec 2017 313# Claris/Apple Works 314>0 string BOBO Apple Works 315# CU-SeeMe_0.87b3_(68K).bin 316#>0 string CUce bar 317>0 string PSPT Apple File Exchange 318# Disk_Copy_4.2.sea.bin 319#>0 string NCse foo 320# probably StuffIt/Aladdin by Smith Micro Software, Inc. 321>0 string STi0 stuffit 322# MacGzip-1.1.3.sea.bin 323#>0 string aust bar 324# D-Disk_Copy_6.3.3.smi.bin 325>0 string oneb Disk Copy Self Mounting 326# if creator name is not known display 4 character identifier 327>0 default x 328>>0 string x '%4.4s' 329 330# sas magic from Bruce Foster (bef@nwu.edu) 331# 332#0 string SAS SAS 333#>8 string x %s 3340 string SAS SAS 335>24 string DATA data file 336>24 string CATALOG catalog 337>24 string INDEX data file index 338>24 string VIEW data view 339# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 340# 3410x54 string SAS SAS 7+ 342>0x9C string DATA data file 343>0x9C string CATALOG catalog 344>0x9C string INDEX data file index 345>0x9C string VIEW data view 346 347# spss magic for SPSS system and portable files, 348# from Bruce Foster (bef@nwu.edu). 349 3500 long 0xc1e2c3c9 SPSS Portable File 351>40 string x %s 352 3530 string $FL2 SPSS System File 354>24 string x %s 355 3560 string $FL3 SPSS System File 357>24 string x %s 358 359# Macintosh filesystem data 360# From "Tom N Harris" <telliamed@mac.com> 361# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 362# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 363# entries depend on the data arithmetic added after v.35 364# There's also some Pascal strings in here, ditto... 365 366# The boot block signature, according to IM:Files, is 367# "for HFS volumes, this field always contains the value 0x4C4B." 368# But if this is true for MFS or HFS+ volumes, I don't know. 369# Alternatively, the boot block is supposed to be zeroed if it's 370# unused, so a simply >0 should suffice. 371 3720x400 beshort 0xD2D7 Macintosh MFS data 373>0 beshort 0x4C4B (bootable) 374>0x40a beshort &0x8000 (locked) 375>0x402 beldate-0x7C25B080 x created: %s, 376>0x406 beldate-0x7C25B080 >0 last backup: %s, 377>0x414 belong x block size: %d, 378>0x412 beshort x number of blocks: %d, 379>0x424 pstring x volume name: %s 380 381# *.hfs updated by Joerg Jenderek 382# http://en.wikipedia.org/wiki/Hierarchical_File_System 383# "BD" gives many false positives 3840x400 beshort 0x4244 385# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 386# first block of volume bit map (always 3) 387>0x40e ubeshort 0x0003 388# maximal length of volume name is 27 389>>0x424 ubyte <28 Macintosh HFS data 390!:mime application/x-apple-diskimage 391#!:apple hfsdINIT 392#!:apple MACSdisk 393# http://www.macdisk.com/macsigen.php 394#!:apple ddskdevi 395!:apple ????devi 396# https://en.wikipedia.org/wiki/Apple_Disk_Image 397!:ext hfs/dmg 398>>>0 beshort 0x4C4B (bootable) 399#>>>0 beshort 0x0000 (not bootable) 400>>>0x40a beshort &0x8000 (locked) 401>>>0x40a beshort ^0x0100 (mounted) 402>>>0x40a beshort &0x0200 (spared blocks) 403>>>0x40a beshort &0x0800 (unclean) 404>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 405# http://www.epochconverter.com/ 406# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 407# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 408# construct not working 409#>>>0x402 beldate-0x7C25B080 x created: %s, 410#>>>0x406 beldate-0x7C25B080 x last modified: %s, 411#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 412# found block sizes 200h,1200h,2800h 413>>>0x414 belong x block size: %d, 414>>>0x412 beshort x number of blocks: %d, 415>>>0x424 pstring x volume name: %s 416 4170x400 beshort 0x482B Macintosh HFS Extended 418>&0 beshort x version %d data 419>0 beshort 0x4C4B (bootable) 420>0x404 belong ^0x00000100 (mounted) 421>&2 belong &0x00000200 (spared blocks) 422>&2 belong &0x00000800 (unclean) 423>&2 belong &0x00008000 (locked) 424>&6 string x last mounted by: '%.4s', 425# really, that should be treated as a belong and we print a string 426# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 427>&14 beldate-0x7C25B080 x created: %s, 428# only the creation date is local time, all other timestamps in HFS+ are UTC. 429>&18 bedate-0x7C25B080 x last modified: %s, 430>&22 bedate-0x7C25B080 >0 last backup: %s, 431>&26 bedate-0x7C25B080 >0 last checked: %s, 432>&38 belong x block size: %d, 433>&42 belong x number of blocks: %d, 434>&46 belong x free blocks: %d 435 436## AFAIK, only the signature is different 437# same as Apple Partition Map 438# GRR: This magic is too weak, it is just "TS" 439#0x200 beshort 0x5453 Apple Old Partition data 440#>0x2 beshort x block size: %d, 441#>0x230 string x first type: %s, 442#>0x210 string x name: %s, 443#>0x254 belong x number of blocks: %d, 444#>0x400 beshort 0x504D 445#>>0x430 string x second type: %s, 446#>>0x410 string x name: %s, 447#>>0x454 belong x number of blocks: %d, 448#>>0x800 beshort 0x504D 449#>>>0x830 string x third type: %s, 450#>>>0x810 string x name: %s, 451#>>>0x854 belong x number of blocks: %d, 452#>>>0xa00 beshort 0x504D 453#>>>>0xa30 string x fourth type: %s, 454#>>>>0xa10 string x name: %s, 455#>>>>0xa54 belong x number of blocks: %d 456 457# From: Remi Mommsen <mommsen@slac.stanford.edu> 4580 string BOMStore Mac OS X bill of materials (BOM) file 459 460# From: Adam Buchbinder <adam.buchbinder@gmail.com> 461# URL: http://en.wikipedia.org/wiki/Datafork_TrueType 462# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 463# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 464# don't know what they mean. 4650 belong 0x100 466>(0x4.L+24) beshort x 467>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 468>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 469>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 470>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 471