1 2#------------------------------------------------------------------------------ 3# $File: archive,v 1.55 2009/12/04 15:00:47 christos Exp $ 4# archive: file(1) magic for archive formats (see also "msdos" for self- 5# extracting compressed archives) 6# 7# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 8# pre-POSIX "tar" archives are handled in the C code. 9 10# POSIX tar archives 11257 string ustar\0 POSIX tar archive 12!:mime application/x-tar # encoding: posix 13257 string ustar\040\040\0 GNU tar archive 14!:mime application/x-tar # encoding: gnu 15 16# cpio archives 17# 18# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 19# The idea is to indicate archives produced on machines with the same 20# byte order as the machine running "file" with "cpio archive", and 21# to indicate archives produced on machines with the opposite byte order 22# from the machine running "file" with "byte-swapped cpio archive". 23# 24# The SVR4 "cpio(4)" hints that there are additional formats, but they 25# are defined as "short"s; I think all the new formats are 26# character-header formats and thus are strings, not numbers. 270 short 070707 cpio archive 28!:mime application/x-cpio 290 short 0143561 byte-swapped cpio archive 30!:mime application/x-cpio # encoding: swapped 310 string 070707 ASCII cpio archive (pre-SVR4 or odc) 320 string 070701 ASCII cpio archive (SVR4 with no CRC) 330 string 070702 ASCII cpio archive (SVR4 with CRC) 34 35# Debian package (needs to go before regular portable archives) 36# 370 string =!<arch>\ndebian 38!:mime application/x-debian-package 39>8 string debian-split part of multipart Debian package 40>8 string debian-binary Debian binary package 41>8 string !debian 42>68 string >\0 (format %s) 43# These next two lines do not work, because a bzip2 Debian archive 44# still uses gzip for the control.tar (first in the archive). Only 45# data.tar varies, and the location of its filename varies too. 46# file/libmagic does not current have support for ascii-string based 47# (offsets) as of 2005-09-15. 48#>81 string bz2 \b, uses bzip2 compression 49#>84 string gz \b, uses gzip compression 50#>136 ledate x created: %s 51 52# other archives 530 long 0177555 very old archive 540 short 0177555 very old PDP-11 archive 550 long 0177545 old archive 560 short 0177545 old PDP-11 archive 570 long 0100554 apl workspace 580 string =<ar> archive 59!:mime application/x-archive 60 61# MIPS archive (needs to go before regular portable archives) 62# 630 string =!<arch>\n__________E MIPS archive 64>20 string U with MIPS Ucode members 65>21 string L with MIPSEL members 66>21 string B with MIPSEB members 67>19 string L and an EL hash table 68>19 string B and an EB hash table 69>22 string X -- out of date 70 710 search/1 -h- Software Tools format archive text 72 73# 74# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is 75# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: 76# 77# 0 string =!<arch> current ar archive 78# 0 long 0x213c6172 archive file 79# 80# and for SVR1 archives, we have: 81# 82# 0 string \<ar> System V Release 1 ar archive 83# 0 string =<ar> archive 84# 85# XXX - did Aegis really store shared libraries, breakpointed modules, 86# and absolute code program modules in the same format as new-style 87# "ar" archives? 88# 890 string =!<arch> current ar archive 90!:mime application/x-archive 91>8 string __.SYMDEF random library 92>0 belong =65538 - pre SR9.5 93>0 belong =65539 - post SR9.5 94>0 beshort 2 - object archive 95>0 beshort 3 - shared library module 96>0 beshort 4 - debug break-pointed module 97>0 beshort 5 - absolute code program module 980 string \<ar> System V Release 1 ar archive 990 string =<ar> archive 100# 101# XXX - from "vax", which appears to collect a bunch of byte-swapped 102# thingies, to help you recognize VAX files on big-endian machines; 103# with "leshort", "lelong", and "string", that's no longer necessary.... 104# 1050 belong 0x65ff0000 VAX 3.0 archive 1060 belong 0x3c61723e VAX 5.0 archive 107# 1080 long 0x213c6172 archive file 1090 lelong 0177555 very old VAX archive 1100 leshort 0177555 very old PDP-11 archive 111# 112# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus 113# be a random library (it said 0xff65 rather than 0177545). 114# 1150 lelong 0177545 old VAX archive 116>8 string __.SYMDEF random library 1170 leshort 0177545 old PDP-11 archive 118>8 string __.SYMDEF random library 119# 120# From "pdp" (but why a 4-byte quantity?) 121# 1220 lelong 0x39bed PDP-11 old archive 1230 lelong 0x39bee PDP-11 4.0 archive 124 125# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 126# 127# The first byte is the magic (0x1a), byte 2 is the compression type for 128# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 129# filename of the first file (null terminated). Since some types collide 130# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 131# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 1320 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 133!:mime application/x-arc 1340 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 135!:mime application/x-arc 1360 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 137!:mime application/x-arc 1380 lelong&0x8080ffff 0x0000031a ARC archive data, packed 139!:mime application/x-arc 1400 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 141!:mime application/x-arc 1420 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 143!:mime application/x-arc 144# [JW] stuff taken from idarc, obviously ARC successors: 1450 lelong&0x8080ffff 0x00000a1a PAK archive data 146!:mime application/x-arc 1470 lelong&0x8080ffff 0x0000141a ARC+ archive data 148!:mime application/x-arc 1490 lelong&0x8080ffff 0x0000481a HYP archive data 150!:mime application/x-arc 151 152# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 153# I can't create either SPARK or ArcFS archives so I have not tested this stuff 154# [GRR: the original entries collide with ARC, above; replaced with combined 155# version (not tested)] 156#0 byte 0x1a RISC OS archive (spark format) 1570 string \032archive RISC OS archive (ArcFS format) 1580 string Archive\000 RISC OS archive (ArcFS format) 159 160# All these were taken from idarc, many could not be verified. Unfortunately, 161# there were many low-quality sigs, i.e. easy to trigger false positives. 162# Please notify me of any real-world fishy/ambiguous signatures and I'll try 163# to get my hands on the actual archiver and see if I find something better. [JW] 164# probably many can be enhanced by finding some 0-byte or control char near the start 165 166# idarc calls this Crush/Uncompressed... *shrug* 1670 string CRUSH Crush archive data 168# Squeeze It (.sqz) 1690 string HLSQZ Squeeze It archive data 170# SQWEZ 1710 string SQWEZ SQWEZ archive data 172# HPack (.hpk) 1730 string HPAK HPack archive data 174# HAP 1750 string \x91\x33HF HAP archive data 176# MD/MDCD 1770 string MDmd MDCD archive data 178# LIM 1790 string LIM\x1a LIM archive data 180# SAR 1813 string LH5 SAR archive data 182# BSArc/BS2 1830 string \212\3SB \0 BSArc/BS2 archive data 184# MAR 1852 string =-ah MAR archive data 186# ACB 1870 belong&0x00f800ff 0x00800000 ACB archive data 188# CPZ 189# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 190# JRC 1910 string JRchive JRC archive data 192# Quantum 1930 string DS\0 Quantum archive data 194# ReSOF 1950 string PK\3\6 ReSOF archive data 196# QuArk 1970 string 7\4 QuArk archive data 198# YAC 19914 string YC YAC archive data 200# X1 2010 string X1 X1 archive data 2020 string XhDr X1 archive data 203# CDC Codec (.dqt) 2040 belong&0xffffe000 0x76ff2000 CDC Codec archive data 205# AMGC 2060 string \xad6" AMGC archive data 207# NuLIB 2080 string NõFélå NuLIB archive data 209# PakLeo 2100 string LEOLZW PAKLeo archive data 211# ChArc 2120 string SChF ChArc archive data 213# PSA 2140 string PSA PSA archive data 215# CrossePAC 2160 string DSIGDCC CrossePAC archive data 217# Freeze 2180 string \x1f\x9f\x4a\x10\x0a Freeze archive data 219# KBoom 2200 string ¨MP¨ KBoom archive data 221# NSQ, must go after CDC Codec 2220 string \x76\xff NSQ archive data 223# DPA 2240 string Dirk\ Paehl DPA archive data 225# BA 226# TODO: idarc says "bytes 0-2 == bytes 3-5" 227# TTComp 2280 string \0\6 TTComp archive data 229# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 2300 string ESP ESP archive data 231# ZPack 2320 string \1ZPK\1 ZPack archive data 233# Sky 2340 string \xbc\x40 Sky archive data 235# UFA 2360 string UFA UFA archive data 237# Dry 2380 string =-H2O DRY archive data 239# FoxSQZ 2400 string FOXSQZ FoxSQZ archive data 241# AR7 2420 string ,AR7 AR7 archive data 243# PPMZ 2440 string PPMZ PPMZ archive data 245# MS Compress 2464 string \x88\xf0\x27 MS Compress archive data 247# updated by Joerg Jenderek 248>9 string \0 249>>0 string KWAJ 250>>>7 string \321\003 MS Compress archive data 251>>>>14 ulong >0 \b, original size: %ld bytes 252>>>>18 ubyte >0x65 253>>>>>18 string x \b, was %.8s 254>>>>>(10.b-4) string x \b.%.3s 255# MP3 (archiver, not lossy audio compression) 2560 string MP3\x1a MP3-Archiver archive data 257# ZET 2580 string OZÝ ZET archive data 259# TSComp 2600 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 261# ARQ 2620 string gW\4\1 ARQ archive data 263# Squash 2643 string OctSqu Squash archive data 265# Terse 2660 string \5\1\1\0 Terse archive data 267# PUCrunch 2680 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 269# UHarc 2700 string UHA UHarc archive data 271# ABComp 2720 string \2AB ABComp archive data 2730 string \3AB2 ABComp archive data 274# CMP 2750 string CO\0 CMP archive data 276# Splint 2770 string \x93\xb9\x06 Splint archive data 278# InstallShield 2790 string \x13\x5d\x65\x8c InstallShield Z archive Data 280# Gather 2811 string GTH Gather archive data 282# BOA 2830 string BOA BOA archive data 284# RAX 2850 string ULEB\xa RAX archive data 286# Xtreme 2870 string ULEB\0 Xtreme archive data 288# Pack Magic 2890 string @â\1\0 Pack Magic archive data 290# BTS 2910 belong&0xfeffffff 0x1a034465 BTS archive data 292# ELI 5750 2930 string Ora\ ELI 5750 archive data 294# QFC 2950 string \x1aFC\x1a QFC archive data 2960 string \x1aQF\x1a QFC archive data 297# PRO-PACK 2980 string RNC PRO-PACK archive data 299# 777 3000 string 777 777 archive data 301# LZS221 3020 string sTaC LZS221 archive data 303# HPA 3040 string HPA HPA archive data 305# Arhangel 3060 string LG Arhangel archive data 307# EXP1, uses bzip2 3080 string 0123456789012345BZh EXP1 archive data 309# IMP 3100 string IMP\xa IMP archive data 311# NRV 3120 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 313# Squish 3140 string \x73\xb2\x90\xf4 Squish archive data 315# Par 3160 string PHILIPP Par archive data 3170 string PAR Par archive data 318# HIT 3190 string UB HIT archive data 320# SBX 3210 belong&0xfffff000 0x53423000 SBX archive data 322# NaShrink 3230 string NSK NaShrink archive data 324# SAPCAR 3250 string #\ CAR\ archive\ header SAPCAR archive data 3260 string CAR\ 2.00RG SAPCAR archive data 327# Disintegrator 3280 string DST Disintegrator archive data 329# ASD 3300 string ASD ASD archive data 331# InstallShield CAB 3320 string ISc( InstallShield CAB 333# TOP4 3340 string T4\x1a TOP4 archive data 335# BatComp left out: sig looks like COM executable 336# so TODO: get real 4dos batcomp file and find sig 337# BlakHole 3380 string BH\5\7 BlakHole archive data 339# BIX 3400 string BIX0 BIX archive data 341# ChiefLZA 3420 string ChfLZ ChiefLZA archive data 343# Blink 3440 string Blink Blink archive data 345# Logitech Compress 3460 string \xda\xfa Logitech Compress archive data 347# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 3481 string (C)\ STEPANYUK ARS-Sfx archive data 349# AKT/AKT32 3500 string AKT32 AKT32 archive data 3510 string AKT AKT archive data 352# NPack 3530 string MSTSM NPack archive data 354# PFT 3550 string \0\x50\0\x14 PFT archive data 356# SemOne 3570 string SEM SemOne archive data 358# PPMD 3590 string \x8f\xaf\xac\x84 PPMD archive data 360# FIZ 3610 string FIZ FIZ archive data 362# MSXiE 3630 belong&0xfffff0f0 0x4d530000 MSXiE archive data 364# DeepFreezer 3650 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 366# DC 3670 string =<DC- DC archive data 368# TPac 3690 string \4TPAC\3 TPac archive data 370# Ai 3710 string Ai\1\1\0 Ai archive data 3720 string Ai\1\0\0 Ai archive data 373# Ai32 3740 string Ai\2\0 Ai32 archive data 3750 string Ai\2\1 Ai32 archive data 376# SBC 3770 string SBC SBC archive data 378# Ybs 3790 string YBS Ybs archive data 380# DitPack 3810 string \x9e\0\0 DitPack archive data 382# DMS 3830 string DMS! DMS archive data 384# EPC 3850 string \x8f\xaf\xac\x8c EPC archive data 386# VSARC 3870 string VS\x1a VSARC archive data 388# PDZ 3890 string PDZ PDZ archive data 390# ReDuq 3910 string rdqx ReDuq archive data 392# GCA 3930 string GCAX GCA archive data 394# PPMN 3950 string pN PPMN archive data 396# WinImage 3973 string WINIMAGE WinImage archive data 398# Compressia 3990 string CMP0CMP Compressia archive data 400# UHBC 4010 string UHB UHBC archive data 402# WinHKI 4030 string \x61\x5C\x04\x05 WinHKI archive data 404# WWPack data file 4050 string WWP WWPack archive data 406# BSN (BSA, PTS-DOS) 4070 string \xffBSG BSN archive data 4081 string \xffBSG BSN archive data 4093 string \xffBSG BSN archive data 4101 string \0\xae\2 BSN archive data 4111 string \0\xae\3 BSN archive data 4121 string \0\xae\7 BSN archive data 413# AIN 4140 string \x33\x18 AIN archive data 4150 string \x33\x17 AIN archive data 416# XPA32 4170 string xpa\0\1 XPA32 archive data 418# SZip (TODO: doesn't catch all versions) 4190 string SZ\x0a\4 SZip archive data 420# XPack DiskImage 4210 string jm XPack DiskImage archive data 422# XPack Data 4230 string xpa XPack archive data 424# XPack Single Data 4250 string Í\ jm XPack single archive data 426 427# TODO: missing due to unknown magic/magic at end of file: 428#DWC 429#ARG 430#ZAR 431#PC/3270 432#InstallIt 433#RKive 434#RK 435#XPack Diskimage 436 437# These were inspired by idarc, but actually verified 438# Dzip archiver (.dz) 4390 string DZ Dzip archive data 440>2 byte x \b, version %i 441>3 byte x \b.%i 442# ZZip archiver (.zz) 4430 string ZZ\ \0\0 ZZip archive data 4440 string ZZ0 ZZip archive data 445# PAQ archiver (.paq) 4460 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 4470 string PAQ PAQ archive data 448>3 byte&0xf0 0x30 449>>3 byte x (v%c) 450# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 4510xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 4520 string JARCS JAR (ARJ Software, Inc.) archive data 453 454# ARJ archiver (jason@jarthur.Claremont.EDU) 4550 leshort 0xea60 ARJ archive data 456!:mime application/x-arj 457>5 byte x \b, v%d, 458>8 byte &0x04 multi-volume, 459>8 byte &0x10 slash-switched, 460>8 byte &0x20 backup, 461>34 string x original name: %s, 462>7 byte 0 os: MS-DOS 463>7 byte 1 os: PRIMOS 464>7 byte 2 os: Unix 465>7 byte 3 os: Amiga 466>7 byte 4 os: Macintosh 467>7 byte 5 os: OS/2 468>7 byte 6 os: Apple ][ GS 469>7 byte 7 os: Atari ST 470>7 byte 8 os: NeXT 471>7 byte 9 os: VAX/VMS 472>3 byte >0 %d] 473# [JW] idarc says this is also possible 4742 leshort 0xea60 ARJ archive data 475 476# HA archiver (Greg Roelofs, newt@uchicago.edu) 477# This is a really bad format. A file containing HAWAII will match this... 478#0 string HA HA archive data, 479#>2 leshort =1 1 file, 480#>2 leshort >1 %u files, 481#>4 byte&0x0f =0 first is type CPY 482#>4 byte&0x0f =1 first is type ASC 483#>4 byte&0x0f =2 first is type HSC 484#>4 byte&0x0f =0x0e first is type DIR 485#>4 byte&0x0f =0x0f first is type SPECIAL 486# suggestion: at least identify small archives (<1024 files) 4870 belong&0xffff00fc 0x48410000 HA archive data 488>2 leshort =1 1 file, 489>2 leshort >1 %u files, 490>4 byte&0x0f =0 first is type CPY 491>4 byte&0x0f =1 first is type ASC 492>4 byte&0x0f =2 first is type HSC 493>4 byte&0x0f =0x0e first is type DIR 494>4 byte&0x0f =0x0f first is type SPECIAL 495 496# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 4970 string HPAK HPACK archive data 498 499# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 5000 string \351,\001JAM\ JAM archive, 501>7 string >\0 version %.4s 502>0x26 byte =0x27 - 503>>0x2b string >\0 label %.11s, 504>>0x27 lelong x serial %08x, 505>>0x36 string >\0 fstype %.8s 506 507# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 5082 string -lh0- LHarc 1.x/ARX archive data [lh0] 509!:mime application/x-lharc 5102 string -lh1- LHarc 1.x/ARX archive data [lh1] 511!:mime application/x-lharc 5122 string -lz4- LHarc 1.x archive data [lz4] 513!:mime application/x-lharc 5142 string -lz5- LHarc 1.x archive data [lz5] 515!:mime application/x-lharc 516# [never seen any but the last; -lh4- reported in comp.compression:] 5172 string -lzs- LHa/LZS archive data [lzs] 518!:mime application/x-lha 5192 string -lh\40- LHa 2.x? archive data [lh ] 520!:mime application/x-lha 5212 string -lhd- LHa 2.x? archive data [lhd] 522!:mime application/x-lha 5232 string -lh2- LHa 2.x? archive data [lh2] 524!:mime application/x-lha 5252 string -lh3- LHa 2.x? archive data [lh3] 526!:mime application/x-lha 5272 string -lh4- LHa (2.x) archive data [lh4] 528!:mime application/x-lha 5292 string -lh5- LHa (2.x) archive data [lh5] 530!:mime application/x-lha 5312 string -lh6- LHa (2.x) archive data [lh6] 532!:mime application/x-lha 5332 string -lh7- LHa (2.x)/LHark archive data [lh7] 534!:mime application/x-lha 535>20 byte x - header level %d 536# taken from idarc [JW] 5372 string -lZ PUT archive data 5382 string -lz LZS archive data 5392 string -sw1- Swag archive data 540 541# RAR archiver (Greg Roelofs, newt@uchicago.edu) 5420 string Rar! RAR archive data, 543!:mime application/x-rar 544>44 byte x v%0x, 545>10 byte >0 flags: 546>>10 byte &0x01 Archive volume, 547>>10 byte &0x02 Commented, 548>>10 byte &0x04 Locked, 549>>10 byte &0x08 Solid, 550>>10 byte &0x20 Authenticated, 551>35 byte 0 os: MS-DOS 552>35 byte 1 os: OS/2 553>35 byte 2 os: Win32 554>35 byte 3 os: Unix 555# some old version? idarc says: 5560 string RE\x7e\x5e RAR archive data 557 558# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 5590 string SQSH squished archive data (Acorn RISCOS) 560 561# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 562# [JW] see exe section for self-extracting version 5630 string UC2\x1a UC2 archive data 564 565# PKZIP multi-volume archive 5660 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 567!:mime application/zip 568 569# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 5700 string PK\003\004 571>30 ubelong !0x6d696d65 572>>4 byte 0x00 Zip archive data 573!:mime application/zip 574>>4 byte 0x09 Zip archive data, at least v0.9 to extract 575!:mime application/zip 576>>4 byte 0x0a Zip archive data, at least v1.0 to extract 577!:mime application/zip 578>>4 byte 0x0b Zip archive data, at least v1.1 to extract 579!:mime application/zip 580>>0x161 string WINZIP Zip archive data, WinZIP self-extracting 581!:mime application/zip 582>>4 byte 0x14 Zip archive data, at least v2.0 to extract 583!:mime application/zip 584 585# OpenOffice.org / KOffice / StarOffice documents 586# Listed here because they ARE zip files 587# 588# From: Abel Cheung <abel@oaka.org> 589>30 string mimetype 590 591# KOffice (1.2 or above) formats 592>>50 string vnd.kde. KOffice (>=1.2) 593>>>58 string karbon Karbon document 594>>>58 string kchart KChart document 595>>>58 string kformula KFormula document 596>>>58 string kivio Kivio document 597>>>58 string kontour Kontour document 598>>>58 string kpresenter KPresenter document 599>>>58 string kspread KSpread document 600>>>58 string kword KWord document 601 602# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 603>>50 string vnd.sun.xml. OpenOffice.org 1.x 604>>>62 string writer Writer 605>>>>68 byte !0x2e document 606>>>>68 string .template template 607>>>>68 string .global global document 608>>>62 string calc Calc 609>>>>66 byte !0x2e spreadsheet 610>>>>66 string .template template 611>>>62 string draw Draw 612>>>>66 byte !0x2e document 613>>>>66 string .template template 614>>>62 string impress Impress 615>>>>69 byte !0x2e presentation 616>>>>69 string .template template 617>>>62 string math Math document 618>>>62 string base Database file 619 620# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 621# http://lists.oasis-open.org/archives/office/200505/msg00006.html 622>>50 string vnd.oasis.opendocument. OpenDocument 623>>>73 string text 624>>>>77 byte !0x2d Text 625!:mime application/vnd.oasis.opendocument.text 626>>>>77 string -template Text Template 627!:mime application/vnd.oasis.opendocument.text-template 628>>>>77 string -web HTML Document Template 629!:mime application/vnd.oasis.opendocument.text-web 630>>>>77 string -master Master Document 631!:mime application/vnd.oasis.opendocument.text-master 632>>>73 string graphics 633>>>>81 byte !0x2d Drawing 634!:mime application/vnd.oasis.opendocument.graphics 635>>>>81 string -template Template 636!:mime application/vnd.oasis.opendocument.graphics-template 637>>>73 string presentation 638>>>>85 byte !0x2d Presentation 639!:mime application/vnd.oasis.opendocument.presentation 640>>>>85 string -template Template 641!:mime application/vnd.oasis.opendocument.presentation-template 642>>>73 string spreadsheet 643>>>>84 byte !0x2d Spreadsheet 644!:mime application/vnd.oasis.opendocument.spreadsheet 645>>>>84 string -template Template 646!:mime application/vnd.oasis.opendocument.spreadsheet-template 647>>>73 string chart 648>>>>78 byte !0x2d Chart 649!:mime application/vnd.oasis.opendocument.chart 650>>>>78 string -template Template 651!:mime application/vnd.oasis.opendocument.chart-template 652>>>73 string formula 653>>>>80 byte !0x2d Formula 654!:mime application/vnd.oasis.opendocument.formula 655>>>>80 string -template Template 656!:mime application/vnd.oasis.opendocument.formula-template 657>>>73 string database Database 658!:mime application/vnd.oasis.opendocument.database 659>>>73 string image 660>>>>78 byte !0x2d Image 661!:mime application/vnd.oasis.opendocument.image 662>>>>78 string -template Template 663!:mime application/vnd.oasis.opendocument.image-template 664 665# Zoo archiver 66620 lelong 0xfdc4a7dc Zoo archive data 667!:mime application/x-zoo 668>4 byte >48 \b, v%c. 669>>6 byte >47 \b%c 670>>>7 byte >47 \b%c 671>32 byte >0 \b, modify: v%d 672>>33 byte x \b.%d+ 673>42 lelong 0xfdc4a7dc \b, 674>>70 byte >0 extract: v%d 675>>>71 byte x \b.%d+ 676 677# Shell archives 67810 string #\ This\ is\ a\ shell\ archive shell archive text 679!:mime application/octet-stream 680 681# 682# LBR. NB: May conflict with the questionable 683# "binary Computer Graphics Metafile" format. 684# 6850 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 686# 687# PMA (CP/M derivative of LHA) 688# 6892 string -pm0- PMarc archive data [pm0] 6902 string -pm1- PMarc archive data [pm1] 6912 string -pm2- PMarc archive data [pm2] 6922 string -pms- PMarc SFX archive (CP/M, DOS) 6935 string -pc1- PopCom compressed executable (CP/M) 694 695# From Rafael Laboissiere <rafael@laboissiere.net> 696# The Project Revision Control System (see 697# http://prcs.sourceforge.net) generates a packaged project 698# file which is recognized by the following entry: 6990 leshort 0xeb81 PRCS packaged project 700 701# Microsoft cabinets 702# by David Necas (Yeti) <yeti@physics.muni.cz> 703#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 704#>25 byte x v%d 705#>24 byte x \b.%d 706# MPi: All CABs have version 1.3, so this is pointless. 707# Better magic in debian-additions. 708 709# GTKtalog catalogs 710# by David Necas (Yeti) <yeti@physics.muni.cz> 7114 string gtktalog\ GTKtalog catalog data, 712>13 string 3 version 3 713>>14 beshort 0x677a (gzipped) 714>>14 beshort !0x677a (not gzipped) 715>13 string >3 version %s 716 717############################################################################ 718# Parity archive reconstruction file, the 'par' file format now used on Usenet. 7190 string PAR\0 PARity archive data 720>48 leshort =0 - Index file 721>48 leshort >0 - file number %d 722 723# Felix von Leitner <felix-file@fefe.de> 7240 string d8:announce BitTorrent file 725!:mime application/x-bittorrent 726 727# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 7280 beshort 0x0e0f Atari MSA archive data 729>2 beshort x \b, %d sectors per track 730>4 beshort 0 \b, 1 sided 731>4 beshort 1 \b, 2 sided 732>6 beshort x \b, starting track: %d 733>8 beshort x \b, ending track: %d 734 735# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 7360 string PK00PK\003\004 Zip archive data 737 738# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 739# by Stefan `Sec` Zehl <sec@42.org> 7407 string **ACE** ACE archive data 741>15 byte >0 version %d 742>16 byte =0x00 \b, from MS-DOS 743>16 byte =0x01 \b, from OS/2 744>16 byte =0x02 \b, from Win/32 745>16 byte =0x03 \b, from Unix 746>16 byte =0x04 \b, from MacOS 747>16 byte =0x05 \b, from WinNT 748>16 byte =0x06 \b, from Primos 749>16 byte =0x07 \b, from AppleGS 750>16 byte =0x08 \b, from Atari 751>16 byte =0x09 \b, from Vax/VMS 752>16 byte =0x0A \b, from Amiga 753>16 byte =0x0B \b, from Next 754>14 byte x \b, version %d to extract 755>5 leshort &0x0080 \b, multiple volumes, 756>>17 byte x \b (part %d), 757>5 leshort &0x0002 \b, contains comment 758>5 leshort &0x0200 \b, sfx 759>5 leshort &0x0400 \b, small dictionary 760>5 leshort &0x0800 \b, multi-volume 761>5 leshort &0x1000 \b, contains AV-String 762>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 763>5 leshort &0x2000 \b, with recovery record 764>5 leshort &0x4000 \b, locked 765>5 leshort &0x8000 \b, solid 766# Date in MS-DOS format (whatever that is) 767#>18 lelong x Created on 768 769# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 770# <doj@cubic.org> 7710x1A string sfArk sfArk compressed Soundfont 772>0x15 string 2 773>>0x1 string >\0 Version %s 774>>0x2A string >\0 : %s 775 776# DR-DOS 7.03 Packed File *.??_ 7770 string Packed\ File\ Personal NetWare Packed File 778>12 string x \b, was "%.12s" 779 780# EET archive 781# From: Tilman Sauerbeck <tilman@code-monkey.de> 7820 belong 0x1ee7ff00 EET archive 783!:mime application/x-eet 784 785# rzip archives 7860 string RZIP rzip compressed data 787>4 byte x - version %d 788>5 byte x \b.%d 789>6 belong x (%d bytes) 790 791# From: "Robert Dale" <robdale@gmail.com> 7920 belong 123 dar archive, 793>4 belong x label "%.8x 794>>8 belong x %.8x 795>>>12 beshort x %.4x" 796>14 byte 0x54 end slice 797>14 beshort 0x4e4e multi-part 798>14 beshort 0x4e53 multi-part, with -S 799 800# Symbian installation files 801# http://www.thouky.co.uk/software/psifs/sis.html 802# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8038 lelong 0x10000419 Symbian installation file 804!:mime application/vnd.symbian.install 805>4 lelong 0x1000006D (EPOC release 3/4/5) 806>4 lelong 0x10003A12 (EPOC release 6) 8070 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 808!:mime x-epoc/x-sisx-app 809 810# From "Nelson A. de Oliveira" <naoliv@gmail.com> 8110 string MPQ\032 MoPaQ (MPQ) archive 812 813# From: Dirk Jagdmann <doj@cubic.org> 814# xar archive format: http://code.google.com/p/xar/ 8150 string xar! xar archive 816>6 beshort x - version %ld 817 818# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 819# .kgb 8200 string KGB_arch KGB Archiver file 821>10 string x with compression level %.1s 822 823# xar (eXtensible ARchiver) archive 824# From: "David Remahl" <dremahl@apple.com> 8250 string xar! xar archive 826#>4 beshort x header size %d 827>6 beshort x version %d, 828#>8 quad x compressed TOC: %d, 829#>16 quad x uncompressed TOC: %d, 830>24 belong 0 no checksum 831>24 belong 1 SHA-1 checksum 832>24 belong 2 MD5 checksum 833