168349Sobrien 268349Sobrien#------------------------------------------------------------------------------ 3298192Sdelphij# $File: macintosh,v 1.26 2015/11/25 00:36:02 christos Exp $ 468349Sobrien# macintosh description 568349Sobrien# 668349Sobrien# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 768349Sobrien# Daniel Quinlan, quinlan@yggdrasil.com 868349Sobrien11 string must\ be\ converted\ with\ BinHex BinHex binary text 9186690Sobrien!:mime application/mac-binhex40 1068349Sobrien>41 string x \b, version %.3s 1168349Sobrien 1268349Sobrien# Stuffit archives are the de facto standard of compression for Macintosh 1368349Sobrien# files obtained from most archives. (franklsm@tuns.ca) 1468349Sobrien0 string SIT! StuffIt Archive (data) 15191736Sobrien!:mime application/x-stuffit 16191736Sobrien!:apple SIT!SIT! 1768349Sobrien>2 string x : %s 1868349Sobrien0 string SITD StuffIt Deluxe (data) 1968349Sobrien>2 string x : %s 2068349Sobrien0 string Seg StuffIt Deluxe Segment (data) 2168349Sobrien>2 string x : %s 2268349Sobrien 23111658Sobrien# Newer StuffIt archives (grant@netbsd.org) 24111658Sobrien0 string StuffIt StuffIt Archive 25186690Sobrien!:mime application/x-stuffit 26191736Sobrien!:apple SIT!SIT! 27159764Sobrien#>162 string >0 : %s 28111658Sobrien 2968349Sobrien# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 30186690Sobrien# GRR: Too weak 31186690Sobrien#0 string APPL Macintosh Application (data) 32186690Sobrien#>2 string x \b: %s 3368349Sobrien 3468349Sobrien# Macintosh System files (franklsm@tuns.ca) 35186690Sobrien# GRR: Too weak 36186690Sobrien#0 string zsys Macintosh System File (data) 37186690Sobrien#0 string FNDR Macintosh Finder (data) 38186690Sobrien#0 string libr Macintosh Library (data) 39186690Sobrien#>2 string x : %s 40186690Sobrien#0 string shlb Macintosh Shared Library (data) 41186690Sobrien#>2 string x : %s 42186690Sobrien#0 string cdev Macintosh Control Panel (data) 43186690Sobrien#>2 string x : %s 44186690Sobrien#0 string INIT Macintosh Extension (data) 45186690Sobrien#>2 string x : %s 46186690Sobrien#0 string FFIL Macintosh Truetype Font (data) 47186690Sobrien#>2 string x : %s 48186690Sobrien#0 string LWFN Macintosh Postscript Font (data) 49186690Sobrien#>2 string x : %s 5068349Sobrien 5168349Sobrien# Additional Macintosh Files (franklsm@tuns.ca) 52186690Sobrien# GRR: Too weak 53186690Sobrien#0 string PACT Macintosh Compact Pro Archive (data) 54186690Sobrien#>2 string x : %s 55186690Sobrien#0 string ttro Macintosh TeachText File (data) 56186690Sobrien#>2 string x : %s 57186690Sobrien#0 string TEXT Macintosh TeachText File (data) 58186690Sobrien#>2 string x : %s 59186690Sobrien#0 string PDF Macintosh PDF File (data) 60186690Sobrien#>2 string x : %s 6168349Sobrien 6268349Sobrien# MacBinary format (Eric Fischer, enf@pobox.com) 6368349Sobrien# 6468349Sobrien# Unfortunately MacBinary doesn't really have a magic number prior 6568349Sobrien# to the MacBinary III format. The checksum is really the way to 6668349Sobrien# do it, but the magic file format isn't up to the challenge. 6768349Sobrien# 6868349Sobrien# 0 byte 0 6968349Sobrien# 1 byte # filename length 7068349Sobrien# 2 string # filename 7168349Sobrien# 65 string # file type 7268349Sobrien# 69 string # file creator 7368349Sobrien# 73 byte # Finder flags 7468349Sobrien# 74 byte 0 7568349Sobrien# 75 beshort # vertical posn in window 7668349Sobrien# 77 beshort # horiz posn in window 7768349Sobrien# 79 beshort # window or folder ID 7868349Sobrien# 81 byte # protected? 7968349Sobrien# 82 byte 0 8068349Sobrien# 83 belong # length of data segment 8168349Sobrien# 87 belong # length of resource segment 8268349Sobrien# 91 belong # file creation date 8368349Sobrien# 95 belong # file modification date 8468349Sobrien# 99 beshort # length of comment after resource 8568349Sobrien# 101 byte # new Finder flags 8668349Sobrien# 102 string mBIN # (only in MacBinary III) 8768349Sobrien# 106 byte # char. code of file name 8868349Sobrien# 107 byte # still more Finder flags 8968349Sobrien# 116 belong # total file length 9068349Sobrien# 120 beshort # length of add'l header 9168349Sobrien# 122 byte 129 # for MacBinary II 9268349Sobrien# 122 byte 130 # for MacBinary III 9368349Sobrien# 123 byte 129 # minimum version that can read fmt 9468349Sobrien# 124 beshort # checksum 9568349Sobrien# 9668349Sobrien# This attempts to use the version numbers as a magic number, requiring 9768349Sobrien# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second 9868349Sobrien# be 0x81. This works for the files I have, but maybe not for everyone's. 9968349Sobrien 100133359Sobrien# Unfortunately, this magic is quite weak - MPi 101133359Sobrien#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data 10268349Sobrien 10368349Sobrien# MacBinary I doesn't have the version number field at all, but MacBinary II 10468349Sobrien# has been in use since 1987 so I hope there aren't many really old files 10568349Sobrien# floating around that this will miss. The original spec calls for using 10668349Sobrien# the nulls in 0, 74, and 82 as the magic number. 10768349Sobrien# 10868349Sobrien# Another possibility, that would also work for MacBinary I, is to use 10968349Sobrien# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will 11068349Sobrien# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, 11168349Sobrien# and that 74 will be 0. So something like 11268349Sobrien# 11368349Sobrien# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data 11468349Sobrien# 11568349Sobrien# >73 byte&0x01 0x01 \b, inited 11668349Sobrien# >73 byte&0x02 0x02 \b, changed 11768349Sobrien# >73 byte&0x04 0x04 \b, busy 11868349Sobrien# >73 byte&0x08 0x08 \b, bozo 11968349Sobrien# >73 byte&0x10 0x10 \b, system 12068349Sobrien# >73 byte&0x10 0x20 \b, bundle 12168349Sobrien# >73 byte&0x10 0x40 \b, invisible 12268349Sobrien# >73 byte&0x10 0x80 \b, locked 12368349Sobrien 124133359Sobrien#>65 string x \b, type "%4.4s" 12568349Sobrien 126133359Sobrien#>65 string 8BIM (PhotoShop) 127133359Sobrien#>65 string ALB3 (PageMaker 3) 128133359Sobrien#>65 string ALB4 (PageMaker 4) 129133359Sobrien#>65 string ALT3 (PageMaker 3) 130133359Sobrien#>65 string APPL (application) 131133359Sobrien#>65 string AWWP (AppleWorks word processor) 132133359Sobrien#>65 string CIRC (simulated circuit) 133133359Sobrien#>65 string DRWG (MacDraw) 134133359Sobrien#>65 string EPSF (Encapsulated PostScript) 135133359Sobrien#>65 string FFIL (font suitcase) 136133359Sobrien#>65 string FKEY (function key) 137133359Sobrien#>65 string FNDR (Macintosh Finder) 138133359Sobrien#>65 string GIFf (GIF image) 139133359Sobrien#>65 string Gzip (GNU gzip) 140133359Sobrien#>65 string INIT (system extension) 141133359Sobrien#>65 string LIB\ (library) 142133359Sobrien#>65 string LWFN (PostScript font) 143133359Sobrien#>65 string MSBC (Microsoft BASIC) 144133359Sobrien#>65 string PACT (Compact Pro archive) 145133359Sobrien#>65 string PDF\ (Portable Document Format) 146133359Sobrien#>65 string PICT (picture) 147133359Sobrien#>65 string PNTG (MacPaint picture) 148133359Sobrien#>65 string PREF (preferences) 149133359Sobrien#>65 string PROJ (Think C project) 150133359Sobrien#>65 string QPRJ (Think Pascal project) 151133359Sobrien#>65 string SCFL (Defender scores) 152133359Sobrien#>65 string SCRN (startup screen) 153133359Sobrien#>65 string SITD (StuffIt Deluxe) 154133359Sobrien#>65 string SPn3 (SuperPaint) 155133359Sobrien#>65 string STAK (HyperCard stack) 156133359Sobrien#>65 string Seg\ (StuffIt segment) 157133359Sobrien#>65 string TARF (Unix tar archive) 158133359Sobrien#>65 string TEXT (ASCII) 159133359Sobrien#>65 string TIFF (TIFF image) 160133359Sobrien#>65 string TOVF (Eudora table of contents) 161133359Sobrien#>65 string WDBN (Microsoft Word word processor) 162133359Sobrien#>65 string WORD (MacWrite word processor) 163133359Sobrien#>65 string XLS\ (Microsoft Excel) 164133359Sobrien#>65 string ZIVM (compress (.Z)) 165133359Sobrien#>65 string ZSYS (Pre-System 7 system file) 166133359Sobrien#>65 string acf3 (Aldus FreeHand) 167133359Sobrien#>65 string cdev (control panel) 168275698Sdelphij#>65 string dfil (Desk Accessory suitcase) 169133359Sobrien#>65 string libr (library) 170133359Sobrien#>65 string nX^d (WriteNow word processor) 171133359Sobrien#>65 string nX^w (WriteNow dictionary) 172133359Sobrien#>65 string rsrc (resource) 173133359Sobrien#>65 string scbk (Scrapbook) 174133359Sobrien#>65 string shlb (shared library) 175133359Sobrien#>65 string ttro (SimpleText read-only) 176133359Sobrien#>65 string zsys (system file) 17768349Sobrien 178133359Sobrien#>69 string x \b, creator "%4.4s" 17968349Sobrien 18068349Sobrien# Somewhere, Apple has a repository of registered Creator IDs. These are 18168349Sobrien# just the ones that I happened to have files from and was able to identify. 18268349Sobrien 183133359Sobrien#>69 string 8BIM (Adobe Photoshop) 184133359Sobrien#>69 string ALD3 (PageMaker 3) 185133359Sobrien#>69 string ALD4 (PageMaker 4) 186133359Sobrien#>69 string ALFA (Alpha editor) 187133359Sobrien#>69 string APLS (Apple Scanner) 188133359Sobrien#>69 string APSC (Apple Scanner) 189133359Sobrien#>69 string BRKL (Brickles) 190133359Sobrien#>69 string BTFT (BitFont) 191133359Sobrien#>69 string CCL2 (Common Lisp 2) 192133359Sobrien#>69 string CCL\ (Common Lisp) 193133359Sobrien#>69 string CDmo (The Talking Moose) 194133359Sobrien#>69 string CPCT (Compact Pro) 195133359Sobrien#>69 string CSOm (Eudora) 196133359Sobrien#>69 string DMOV (Font/DA Mover) 197133359Sobrien#>69 string DSIM (DigSim) 198133359Sobrien#>69 string EDIT (Macintosh Edit) 199133359Sobrien#>69 string ERIK (Macintosh Finder) 200133359Sobrien#>69 string EXTR (self-extracting archive) 201133359Sobrien#>69 string Gzip (GNU gzip) 202133359Sobrien#>69 string KAHL (Think C) 203133359Sobrien#>69 string LWFU (LaserWriter Utility) 204133359Sobrien#>69 string LZIV (compress) 205133359Sobrien#>69 string MACA (MacWrite) 206133359Sobrien#>69 string MACS (Macintosh operating system) 207133359Sobrien#>69 string MAcK (MacKnowledge terminal emulator) 208133359Sobrien#>69 string MLND (Defender) 209133359Sobrien#>69 string MPNT (MacPaint) 210133359Sobrien#>69 string MSBB (Microsoft BASIC (binary)) 211133359Sobrien#>69 string MSWD (Microsoft Word) 212133359Sobrien#>69 string NCSA (NCSA Telnet) 213133359Sobrien#>69 string PJMM (Think Pascal) 214133359Sobrien#>69 string PSAL (Hunt the Wumpus) 215133359Sobrien#>69 string PSI2 (Apple File Exchange) 216133359Sobrien#>69 string R*ch (BBEdit) 217133359Sobrien#>69 string RMKR (Resource Maker) 218133359Sobrien#>69 string RSED (Resource Editor) 219133359Sobrien#>69 string Rich (BBEdit) 220133359Sobrien#>69 string SIT! (StuffIt) 221133359Sobrien#>69 string SPNT (SuperPaint) 222133359Sobrien#>69 string Unix (NeXT Mac filesystem) 223133359Sobrien#>69 string VIM! (Vim editor) 224133359Sobrien#>69 string WILD (HyperCard) 225133359Sobrien#>69 string XCEL (Microsoft Excel) 226133359Sobrien#>69 string aCa2 (Fontographer) 227133359Sobrien#>69 string aca3 (Aldus FreeHand) 228133359Sobrien#>69 string dosa (Macintosh MS-DOS file system) 229133359Sobrien#>69 string movr (Font/DA Mover) 230133359Sobrien#>69 string nX^n (WriteNow) 231133359Sobrien#>69 string pdos (Apple ProDOS file system) 232133359Sobrien#>69 string scbk (Scrapbook) 233133359Sobrien#>69 string ttxt (SimpleText) 234133359Sobrien#>69 string ufox (Foreign File Access) 23568349Sobrien 23668349Sobrien# Just in case... 23768349Sobrien 23868349Sobrien102 string mBIN MacBinary III data with surprising version number 23969216Sobrien 24069216Sobrien# sas magic from Bruce Foster (bef@nwu.edu) 24169216Sobrien# 24269216Sobrien#0 string SAS SAS 24369216Sobrien#>8 string x %s 24469216Sobrien0 string SAS SAS 24569216Sobrien>24 string DATA data file 24669216Sobrien>24 string CATALOG catalog 24769216Sobrien>24 string INDEX data file index 24869216Sobrien>24 string VIEW data view 249133359Sobrien# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 250133359Sobrien# 251133359Sobrien0x54 string SAS SAS 7+ 252133359Sobrien>0x9C string DATA data file 253133359Sobrien>0x9C string CATALOG catalog 254133359Sobrien>0x9C string INDEX data file index 255133359Sobrien>0x9C string VIEW data view 256133359Sobrien 25769216Sobrien# spss magic for SPSS system and portable files, 25869216Sobrien# from Bruce Foster (bef@nwu.edu). 25969216Sobrien 26069216Sobrien0 long 0xc1e2c3c9 SPSS Portable File 26169216Sobrien>40 string x %s 26269216Sobrien 26369216Sobrien0 string $FL2 SPSS System File 26469216Sobrien>24 string x %s 26580588Sobrien 266267843Sdelphij0 string $FL3 SPSS System File 267267843Sdelphij>24 string x %s 268267843Sdelphij 26980588Sobrien# Macintosh filesystem data 27080588Sobrien# From "Tom N Harris" <telliamed@mac.com> 271133359Sobrien# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 27280588Sobrien# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 27380588Sobrien# entries depend on the data arithmetic added after v.35 27480588Sobrien# There's also some Pascal strings in here, ditto... 27580588Sobrien 27680588Sobrien# The boot block signature, according to IM:Files, is 27780588Sobrien# "for HFS volumes, this field always contains the value 0x4C4B." 27880588Sobrien# But if this is true for MFS or HFS+ volumes, I don't know. 27980588Sobrien# Alternatively, the boot block is supposed to be zeroed if it's 28080588Sobrien# unused, so a simply >0 should suffice. 28180588Sobrien 28280588Sobrien0x400 beshort 0xD2D7 Macintosh MFS data 28380588Sobrien>0 beshort 0x4C4B (bootable) 28480588Sobrien>0x40a beshort &0x8000 (locked) 28580588Sobrien>0x402 beldate-0x7C25B080 x created: %s, 28680588Sobrien>0x406 beldate-0x7C25B080 >0 last backup: %s, 28780588Sobrien>0x414 belong x block size: %d, 28880588Sobrien>0x412 beshort x number of blocks: %d, 28980588Sobrien>0x424 pstring x volume name: %s 29080588Sobrien 291275698Sdelphij# *.hfs updated by Joerg Jenderek 292275698Sdelphij# http://en.wikipedia.org/wiki/Hierarchical_File_System 293226048Sobrien# "BD" gives many false positives 294275698Sdelphij0x400 beshort 0x4244 295275698Sdelphij# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 296275698Sdelphij# first block of volume bit map (always 3) 297275698Sdelphij>0x40e ubeshort 0x0003 298275698Sdelphij# maximal length of volume name is 27 299275698Sdelphij>>0x424 ubyte <28 Macintosh HFS data 300275698Sdelphij!:mime application/x-apple-diskimage 301275698Sdelphij#!:apple hfsdINIT 302275698Sdelphij#!:apple MACSdisk 303298192Sdelphij# http://www.macdisk.com/macsigen.php 304298192Sdelphij#!:apple ddskdevi 305298192Sdelphij!:apple ????devi 306298192Sdelphij# https://en.wikipedia.org/wiki/Apple_Disk_Image 307298192Sdelphij!:ext hfs/dmg 308275698Sdelphij>>>0 beshort 0x4C4B (bootable) 309275698Sdelphij#>>>0 beshort 0x0000 (not bootable) 310275698Sdelphij>>>0x40a beshort &0x8000 (locked) 311275698Sdelphij>>>0x40a beshort ^0x0100 (mounted) 312275698Sdelphij>>>0x40a beshort &0x0200 (spared blocks) 313275698Sdelphij>>>0x40a beshort &0x0800 (unclean) 314275698Sdelphij>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 315275698Sdelphij# http://www.epochconverter.com/ 316275698Sdelphij# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 317275698Sdelphij# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 318275698Sdelphij# construct not working 319275698Sdelphij#>>>0x402 beldate-0x7C25B080 x created: %s, 320275698Sdelphij#>>>0x406 beldate-0x7C25B080 x last modified: %s, 321275698Sdelphij#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 322275698Sdelphij# found block sizes 200h,1200h,2800h 323275698Sdelphij>>>0x414 belong x block size: %d, 324275698Sdelphij>>>0x412 beshort x number of blocks: %d, 325275698Sdelphij>>>0x424 pstring x volume name: %s 32680588Sobrien 32780588Sobrien0x400 beshort 0x482B Macintosh HFS Extended 328133359Sobrien>&0 beshort x version %d data 32980588Sobrien>0 beshort 0x4C4B (bootable) 330133359Sobrien>0x404 belong ^0x00000100 (mounted) 331133359Sobrien>&2 belong &0x00000200 (spared blocks) 332133359Sobrien>&2 belong &0x00000800 (unclean) 333133359Sobrien>&2 belong &0x00008000 (locked) 334133359Sobrien>&6 string x last mounted by: '%.4s', 33580588Sobrien# really, that should be treated as a belong and we print a string 33680588Sobrien# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 337133359Sobrien>&14 beldate-0x7C25B080 x created: %s, 338133359Sobrien# only the creation date is local time, all other timestamps in HFS+ are UTC. 339133359Sobrien>&18 bedate-0x7C25B080 x last modified: %s, 340133359Sobrien>&22 bedate-0x7C25B080 >0 last backup: %s, 341133359Sobrien>&26 bedate-0x7C25B080 >0 last checked: %s, 342133359Sobrien>&38 belong x block size: %d, 343133359Sobrien>&42 belong x number of blocks: %d, 344133359Sobrien>&46 belong x free blocks: %d 34580588Sobrien 346186690Sobrien## AFAIK, only the signature is different 347275698Sdelphij# same as Apple Partition Map 348275698Sdelphij# GRR: This magic is too weak, it is just "TS" 349186690Sobrien#0x200 beshort 0x5453 Apple Old Partition data 350186690Sobrien#>0x2 beshort x block size: %d, 351186690Sobrien#>0x230 string x first type: %s, 352186690Sobrien#>0x210 string x name: %s, 353186690Sobrien#>0x254 belong x number of blocks: %d, 354186690Sobrien#>0x400 beshort 0x504D 355186690Sobrien#>>0x430 string x second type: %s, 356186690Sobrien#>>0x410 string x name: %s, 357186690Sobrien#>>0x454 belong x number of blocks: %d, 358186690Sobrien#>>0x800 beshort 0x504D 359186690Sobrien#>>>0x830 string x third type: %s, 360186690Sobrien#>>>0x810 string x name: %s, 361186690Sobrien#>>>0x854 belong x number of blocks: %d, 362186690Sobrien#>>>0xa00 beshort 0x504D 363186690Sobrien#>>>>0xa30 string x fourth type: %s, 364186690Sobrien#>>>>0xa10 string x name: %s, 365186690Sobrien#>>>>0xa54 belong x number of blocks: %d 366133359Sobrien 367133359Sobrien# From: Remi Mommsen <mommsen@slac.stanford.edu> 368175296Sobrien0 string BOMStore Mac OS X bill of materials (BOM) file 369226048Sobrien 370226048Sobrien# From: Adam Buchbinder <adam.buchbinder@gmail.com> 371226048Sobrien# URL: http://en.wikipedia.org/wiki/Datafork_TrueType 372226048Sobrien# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 373226048Sobrien# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 374226048Sobrien# don't know what they mean. 375226048Sobrien0 belong 0x100 376226048Sobrien>(0x4.L+24) beshort x 377226048Sobrien>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 378226048Sobrien>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 379226048Sobrien>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 380226048Sobrien>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 381