1#------------------------------------------------------------------------------ 2# $File: archive,v 1.79 2013/02/08 17:24:06 christos Exp $ 3# archive: file(1) magic for archive formats (see also "msdos" for self- 4# extracting compressed archives) 5# 6# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 7# pre-POSIX "tar" archives are handled in the C code. 8 9# POSIX tar archives 10257 string ustar\0 POSIX tar archive 11!:mime application/x-tar # encoding: posix 12257 string ustar\040\040\0 GNU tar archive 13!:mime application/x-tar # encoding: gnu 14 15# Incremental snapshot gnu-tar format from: 16# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 170 string GNU\ tar- GNU tar incremental snapshot data 18>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 19 20# cpio archives 21# 22# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 23# The idea is to indicate archives produced on machines with the same 24# byte order as the machine running "file" with "cpio archive", and 25# to indicate archives produced on machines with the opposite byte order 26# from the machine running "file" with "byte-swapped cpio archive". 27# 28# The SVR4 "cpio(4)" hints that there are additional formats, but they 29# are defined as "short"s; I think all the new formats are 30# character-header formats and thus are strings, not numbers. 310 short 070707 cpio archive 32!:mime application/x-cpio 330 short 0143561 byte-swapped cpio archive 34!:mime application/x-cpio # encoding: swapped 350 string 070707 ASCII cpio archive (pre-SVR4 or odc) 360 string 070701 ASCII cpio archive (SVR4 with no CRC) 370 string 070702 ASCII cpio archive (SVR4 with CRC) 38 39# 40# Various archive formats used by various versions of the "ar" 41# command. 42# 43 44# 45# Original UNIX archive formats. 46# They were written with binary values in host byte order, and 47# the magic number was a host "int", which might have been 16 bits 48# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 49# been ports to little-endian 16-bit-int or 32-bit-int platforms 50# (x86?) using some of those formats; if none existed, feel free 51# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 52# 32-bit. There might have been big-endian ports of that sort as 53# well. 54# 550 leshort 0177555 very old 16-bit-int little-endian archive 560 beshort 0177555 very old 16-bit-int big-endian archive 570 lelong 0177555 very old 32-bit-int little-endian archive 580 belong 0177555 very old 32-bit-int big-endian archive 59 600 leshort 0177545 old 16-bit-int little-endian archive 61>2 string __.SYMDEF random library 620 beshort 0177545 old 16-bit-int big-endian archive 63>2 string __.SYMDEF random library 640 lelong 0177545 old 32-bit-int little-endian archive 65>4 string __.SYMDEF random library 660 belong 0177545 old 32-bit-int big-endian archive 67>4 string __.SYMDEF random library 68 69# 70# From "pdp" (but why a 4-byte quantity?) 71# 720 lelong 0x39bed PDP-11 old archive 730 lelong 0x39bee PDP-11 4.0 archive 74 75# 76# XXX - what flavor of APL used this, and was it a variant of 77# some ar archive format? It's similar to, but not the same 78# as, the APL workspace magic numbers in pdp. 79# 800 long 0100554 apl workspace 81 82# 83# System V Release 1 portable(?) archive format. 84# 850 string =<ar> System V Release 1 ar archive 86!:mime application/x-archive 87 88# 89# Debian package; it's in the portable archive format, and needs to go 90# before the entry for regular portable archives, as it's recognized as 91# a portable archive whose first member has a name beginning with 92# "debian". 93# 940 string =!<arch>\ndebian 95!:mime application/x-debian-package 96>8 string debian-split part of multipart Debian package 97>8 string debian-binary Debian binary package 98>8 string !debian 99>68 string >\0 (format %s) 100# These next two lines do not work, because a bzip2 Debian archive 101# still uses gzip for the control.tar (first in the archive). Only 102# data.tar varies, and the location of its filename varies too. 103# file/libmagic does not current have support for ascii-string based 104# (offsets) as of 2005-09-15. 105#>81 string bz2 \b, uses bzip2 compression 106#>84 string gz \b, uses gzip compression 107#>136 ledate x created: %s 108 109# 110# MIPS archive; they're in the portable archive format, and need to go 111# before the entry for regular portable archives, as it's recognized as 112# a portable archive whose first member has a name beginning with 113# "__________E". 114# 1150 string =!<arch>\n__________E MIPS archive 116!:mime application/x-archive 117>20 string U with MIPS Ucode members 118>21 string L with MIPSEL members 119>21 string B with MIPSEB members 120>19 string L and an EL hash table 121>19 string B and an EB hash table 122>22 string X -- out of date 123 1240 search/1 -h- Software Tools format archive text 125 126# 127# BSD/SVR2-and-later portable archive formats. 128# 1290 string =!<arch> current ar archive 130!:mime application/x-archive 131>8 string __.SYMDEF random library 132>68 string __.SYMDEF\ SORTED random library 133 134# 135# "Thin" archive, as can be produced by GNU ar. 136# 1370 string =!<thin>\n thin archive with 138>68 belong 0 no symbol entries 139>68 belong 1 %d symbol entry 140>68 belong >1 %d symbol entries 141 142# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 143# 144# The first byte is the magic (0x1a), byte 2 is the compression type for 145# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 146# filename of the first file (null terminated). Since some types collide 147# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 148# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 1490 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 150!:mime application/x-arc 1510 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 152!:mime application/x-arc 1530 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 154!:mime application/x-arc 1550 lelong&0x8080ffff 0x0000031a ARC archive data, packed 156!:mime application/x-arc 1570 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 158!:mime application/x-arc 1590 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 160!:mime application/x-arc 161# [JW] stuff taken from idarc, obviously ARC successors: 1620 lelong&0x8080ffff 0x00000a1a PAK archive data 163!:mime application/x-arc 1640 lelong&0x8080ffff 0x0000141a ARC+ archive data 165!:mime application/x-arc 1660 lelong&0x8080ffff 0x0000481a HYP archive data 167!:mime application/x-arc 168 169# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 170# I can't create either SPARK or ArcFS archives so I have not tested this stuff 171# [GRR: the original entries collide with ARC, above; replaced with combined 172# version (not tested)] 173#0 byte 0x1a RISC OS archive (spark format) 1740 string \032archive RISC OS archive (ArcFS format) 1750 string Archive\000 RISC OS archive (ArcFS format) 176 177# All these were taken from idarc, many could not be verified. Unfortunately, 178# there were many low-quality sigs, i.e. easy to trigger false positives. 179# Please notify me of any real-world fishy/ambiguous signatures and I'll try 180# to get my hands on the actual archiver and see if I find something better. [JW] 181# probably many can be enhanced by finding some 0-byte or control char near the start 182 183# idarc calls this Crush/Uncompressed... *shrug* 1840 string CRUSH Crush archive data 185# Squeeze It (.sqz) 1860 string HLSQZ Squeeze It archive data 187# SQWEZ 1880 string SQWEZ SQWEZ archive data 189# HPack (.hpk) 1900 string HPAK HPack archive data 191# HAP 1920 string \x91\x33HF HAP archive data 193# MD/MDCD 1940 string MDmd MDCD archive data 195# LIM 1960 string LIM\x1a LIM archive data 197# SAR 1983 string LH5 SAR archive data 199# BSArc/BS2 2000 string \212\3SB\020\0 BSArc/BS2 archive data 201# Bethesda Softworks Archive (Oblivion) 2020 string BSA\0 BSArc archive data 203>4 lelong x version %d 204# MAR 2052 string =-ah MAR archive data 206# ACB 207#0 belong&0x00f800ff 0x00800000 ACB archive data 208# CPZ 209# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 210# JRC 2110 string JRchive JRC archive data 212# Quantum 2130 string DS\0 Quantum archive data 214# ReSOF 2150 string PK\3\6 ReSOF archive data 216# QuArk 2170 string 7\4 QuArk archive data 218# YAC 21914 string YC YAC archive data 220# X1 2210 string X1 X1 archive data 2220 string XhDr X1 archive data 223# CDC Codec (.dqt) 2240 belong&0xffffe000 0x76ff2000 CDC Codec archive data 225# AMGC 2260 string \xad6" AMGC archive data 227# NuLIB 2280 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 229# PakLeo 2300 string LEOLZW PAKLeo archive data 231# ChArc 2320 string SChF ChArc archive data 233# PSA 2340 string PSA PSA archive data 235# CrossePAC 2360 string DSIGDCC CrossePAC archive data 237# Freeze 2380 string \x1f\x9f\x4a\x10\x0a Freeze archive data 239# KBoom 2400 string \xc2\xa8MP\xc2\xa8 KBoom archive data 241# NSQ, must go after CDC Codec 2420 string \x76\xff NSQ archive data 243# DPA 2440 string Dirk\ Paehl DPA archive data 245# BA 246# TODO: idarc says "bytes 0-2 == bytes 3-5" 247# TTComp 2480 string \0\6 TTComp archive data 249# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 2500 string ESP ESP archive data 251# ZPack 2520 string \1ZPK\1 ZPack archive data 253# Sky 2540 string \xbc\x40 Sky archive data 255# UFA 2560 string UFA UFA archive data 257# Dry 2580 string =-H2O DRY archive data 259# FoxSQZ 2600 string FOXSQZ FoxSQZ archive data 261# AR7 2620 string ,AR7 AR7 archive data 263# PPMZ 2640 string PPMZ PPMZ archive data 265# MS Compress 2664 string \x88\xf0\x27 MS Compress archive data 267# updated by Joerg Jenderek 268>9 string \0 269>>0 string KWAJ 270>>>7 string \321\003 MS Compress archive data 271>>>>14 ulong >0 \b, original size: %ld bytes 272>>>>18 ubyte >0x65 273>>>>>18 string x \b, was %.8s 274>>>>>(10.b-4) string x \b.%.3s 275# MP3 (archiver, not lossy audio compression) 2760 string MP3\x1a MP3-Archiver archive data 277# ZET 2780 string OZ\xc3\x9d ZET archive data 279# TSComp 2800 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 281# ARQ 2820 string gW\4\1 ARQ archive data 283# Squash 2843 string OctSqu Squash archive data 285# Terse 2860 string \5\1\1\0 Terse archive data 287# PUCrunch 2880 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 289# UHarc 2900 string UHA UHarc archive data 291# ABComp 2920 string \2AB ABComp archive data 2930 string \3AB2 ABComp archive data 294# CMP 2950 string CO\0 CMP archive data 296# Splint 2970 string \x93\xb9\x06 Splint archive data 298# InstallShield 2990 string \x13\x5d\x65\x8c InstallShield Z archive Data 300# Gather 3011 string GTH Gather archive data 302# BOA 3030 string BOA BOA archive data 304# RAX 3050 string ULEB\xa RAX archive data 306# Xtreme 3070 string ULEB\0 Xtreme archive data 308# Pack Magic 3090 string @\xc3\xa2\1\0 Pack Magic archive data 310# BTS 3110 belong&0xfeffffff 0x1a034465 BTS archive data 312# ELI 5750 3130 string Ora\ ELI 5750 archive data 314# QFC 3150 string \x1aFC\x1a QFC archive data 3160 string \x1aQF\x1a QFC archive data 317# PRO-PACK 3180 string RNC PRO-PACK archive data 319# 777 3200 string 777 777 archive data 321# LZS221 3220 string sTaC LZS221 archive data 323# HPA 3240 string HPA HPA archive data 325# Arhangel 3260 string LG Arhangel archive data 327# EXP1, uses bzip2 3280 string 0123456789012345BZh EXP1 archive data 329# IMP 3300 string IMP\xa IMP archive data 331# NRV 3320 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 333# Squish 3340 string \x73\xb2\x90\xf4 Squish archive data 335# Par 3360 string PHILIPP Par archive data 3370 string PAR Par archive data 338# HIT 3390 string UB HIT archive data 340# SBX 3410 belong&0xfffff000 0x53423000 SBX archive data 342# NaShrink 3430 string NSK NaShrink archive data 344# SAPCAR 3450 string #\ CAR\ archive\ header SAPCAR archive data 3460 string CAR\ 2.00RG SAPCAR archive data 347# Disintegrator 3480 string DST Disintegrator archive data 349# ASD 3500 string ASD ASD archive data 351# InstallShield CAB 3520 string ISc( InstallShield CAB 353# TOP4 3540 string T4\x1a TOP4 archive data 355# BatComp left out: sig looks like COM executable 356# so TODO: get real 4dos batcomp file and find sig 357# BlakHole 3580 string BH\5\7 BlakHole archive data 359# BIX 3600 string BIX0 BIX archive data 361# ChiefLZA 3620 string ChfLZ ChiefLZA archive data 363# Blink 3640 string Blink Blink archive data 365# Logitech Compress 3660 string \xda\xfa Logitech Compress archive data 367# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 3681 string (C)\ STEPANYUK ARS-Sfx archive data 369# AKT/AKT32 3700 string AKT32 AKT32 archive data 3710 string AKT AKT archive data 372# NPack 3730 string MSTSM NPack archive data 374# PFT 3750 string \0\x50\0\x14 PFT archive data 376# SemOne 3770 string SEM SemOne archive data 378# PPMD 3790 string \x8f\xaf\xac\x84 PPMD archive data 380# FIZ 3810 string FIZ FIZ archive data 382# MSXiE 3830 belong&0xfffff0f0 0x4d530000 MSXiE archive data 384# DeepFreezer 3850 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 386# DC 3870 string =<DC- DC archive data 388# TPac 3890 string \4TPAC\3 TPac archive data 390# Ai 3910 string Ai\1\1\0 Ai archive data 3920 string Ai\1\0\0 Ai archive data 393# Ai32 3940 string Ai\2\0 Ai32 archive data 3950 string Ai\2\1 Ai32 archive data 396# SBC 3970 string SBC SBC archive data 398# Ybs 3990 string YBS Ybs archive data 400# DitPack 4010 string \x9e\0\0 DitPack archive data 402# DMS 4030 string DMS! DMS archive data 404# EPC 4050 string \x8f\xaf\xac\x8c EPC archive data 406# VSARC 4070 string VS\x1a VSARC archive data 408# PDZ 4090 string PDZ PDZ archive data 410# ReDuq 4110 string rdqx ReDuq archive data 412# GCA 4130 string GCAX GCA archive data 414# PPMN 4150 string pN PPMN archive data 416# WinImage 4173 string WINIMAGE WinImage archive data 418# Compressia 4190 string CMP0CMP Compressia archive data 420# UHBC 4210 string UHB UHBC archive data 422# WinHKI 4230 string \x61\x5C\x04\x05 WinHKI archive data 424# WWPack data file 4250 string WWP WWPack archive data 426# BSN (BSA, PTS-DOS) 4270 string \xffBSG BSN archive data 4281 string \xffBSG BSN archive data 4293 string \xffBSG BSN archive data 4301 string \0\xae\2 BSN archive data 4311 string \0\xae\3 BSN archive data 4321 string \0\xae\7 BSN archive data 433# AIN 4340 string \x33\x18 AIN archive data 4350 string \x33\x17 AIN archive data 436# XPA32 4370 string xpa\0\1 XPA32 archive data 438# SZip (TODO: doesn't catch all versions) 4390 string SZ\x0a\4 SZip archive data 440# XPack DiskImage 4410 string jm XPack DiskImage archive data 442# XPack Data 4430 string xpa XPack archive data 444# XPack Single Data 4450 string \xc3\x8d\ jm XPack single archive data 446 447# TODO: missing due to unknown magic/magic at end of file: 448#DWC 449#ARG 450#ZAR 451#PC/3270 452#InstallIt 453#RKive 454#RK 455#XPack Diskimage 456 457# These were inspired by idarc, but actually verified 458# Dzip archiver (.dz) 4590 string DZ Dzip archive data 460>2 byte x \b, version %i 461>3 byte x \b.%i 462# ZZip archiver (.zz) 4630 string ZZ\ \0\0 ZZip archive data 4640 string ZZ0 ZZip archive data 465# PAQ archiver (.paq) 4660 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 4670 string PAQ PAQ archive data 468>3 byte&0xf0 0x30 469>>3 byte x (v%c) 470# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 4710xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 4720 string JARCS JAR (ARJ Software, Inc.) archive data 473 474# ARJ archiver (jason@jarthur.Claremont.EDU) 4750 leshort 0xea60 ARJ archive data 476!:mime application/x-arj 477>5 byte x \b, v%d, 478>8 byte &0x04 multi-volume, 479>8 byte &0x10 slash-switched, 480>8 byte &0x20 backup, 481>34 string x original name: %s, 482>7 byte 0 os: MS-DOS 483>7 byte 1 os: PRIMOS 484>7 byte 2 os: Unix 485>7 byte 3 os: Amiga 486>7 byte 4 os: Macintosh 487>7 byte 5 os: OS/2 488>7 byte 6 os: Apple ][ GS 489>7 byte 7 os: Atari ST 490>7 byte 8 os: NeXT 491>7 byte 9 os: VAX/VMS 492>3 byte >0 %d] 493# [JW] idarc says this is also possible 4942 leshort 0xea60 ARJ archive data 495 496# HA archiver (Greg Roelofs, newt@uchicago.edu) 497# This is a really bad format. A file containing HAWAII will match this... 498#0 string HA HA archive data, 499#>2 leshort =1 1 file, 500#>2 leshort >1 %u files, 501#>4 byte&0x0f =0 first is type CPY 502#>4 byte&0x0f =1 first is type ASC 503#>4 byte&0x0f =2 first is type HSC 504#>4 byte&0x0f =0x0e first is type DIR 505#>4 byte&0x0f =0x0f first is type SPECIAL 506# suggestion: at least identify small archives (<1024 files) 5070 belong&0xffff00fc 0x48410000 HA archive data 508>2 leshort =1 1 file, 509>2 leshort >1 %u files, 510>4 byte&0x0f =0 first is type CPY 511>4 byte&0x0f =1 first is type ASC 512>4 byte&0x0f =2 first is type HSC 513>4 byte&0x0f =0x0e first is type DIR 514>4 byte&0x0f =0x0f first is type SPECIAL 515 516# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 5170 string HPAK HPACK archive data 518 519# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 5200 string \351,\001JAM\ JAM archive, 521>7 string >\0 version %.4s 522>0x26 byte =0x27 - 523>>0x2b string >\0 label %.11s, 524>>0x27 lelong x serial %08x, 525>>0x36 string >\0 fstype %.8s 526 527# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 5282 string -lh0- LHarc 1.x/ARX archive data [lh0] 529!:mime application/x-lharc 5302 string -lh1- LHarc 1.x/ARX archive data [lh1] 531!:mime application/x-lharc 5322 string -lz4- LHarc 1.x archive data [lz4] 533!:mime application/x-lharc 5342 string -lz5- LHarc 1.x archive data [lz5] 535!:mime application/x-lharc 536# [never seen any but the last; -lh4- reported in comp.compression:] 5372 string -lzs- LHa/LZS archive data [lzs] 538!:mime application/x-lha 5392 string -lh\40- LHa 2.x? archive data [lh ] 540!:mime application/x-lha 5412 string -lhd- LHa 2.x? archive data [lhd] 542!:mime application/x-lha 5432 string -lh2- LHa 2.x? archive data [lh2] 544!:mime application/x-lha 5452 string -lh3- LHa 2.x? archive data [lh3] 546!:mime application/x-lha 5472 string -lh4- LHa (2.x) archive data [lh4] 548!:mime application/x-lha 5492 string -lh5- LHa (2.x) archive data [lh5] 550!:mime application/x-lha 5512 string -lh6- LHa (2.x) archive data [lh6] 552!:mime application/x-lha 5532 string -lh7- LHa (2.x)/LHark archive data [lh7] 554!:mime application/x-lha 555>20 byte x - header level %d 556# taken from idarc [JW] 5572 string -lZ PUT archive data 5582 string -lz LZS archive data 5592 string -sw1- Swag archive data 560 561# RAR archiver (Greg Roelofs, newt@uchicago.edu) 5620 string Rar! RAR archive data, 563!:mime application/x-rar 564>44 byte x v%0x, 565>10 byte >0 flags: 566>>10 byte &0x01 Archive volume, 567>>10 byte &0x02 Commented, 568>>10 byte &0x04 Locked, 569>>10 byte &0x08 Solid, 570>>10 byte &0x20 Authenticated, 571>35 byte 0 os: MS-DOS 572>35 byte 1 os: OS/2 573>35 byte 2 os: Win32 574>35 byte 3 os: Unix 575# some old version? idarc says: 5760 string RE\x7e\x5e RAR archive data 577 578# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 5790 string SQSH squished archive data (Acorn RISCOS) 580 581# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 582# [JW] see exe section for self-extracting version 5830 string UC2\x1a UC2 archive data 584 585# PKZIP multi-volume archive 5860 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 587!:mime application/zip 588 589# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 5900 string PK\005\006 Zip archive data (empty) 5910 string PK\003\004 592 593# Specialised zip formats which start with a member named 'mimetype' 594# (stored uncompressed, with no 'extra field') containing the file's MIME type. 595# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 596# contents starting with "application/": 597>26 string \x8\0\0\0mimetypeapplication/ 598 599# KOffice / OpenOffice & StarOffice / OpenDocument formats 600# From: Abel Cheung <abel@oaka.org> 601 602# KOffice (1.2 or above) formats 603# (mimetype contains "application/vnd.kde.<SUBTYPE>") 604>>50 string vnd.kde. KOffice (>=1.2) 605>>>58 string karbon Karbon document 606>>>58 string kchart KChart document 607>>>58 string kformula KFormula document 608>>>58 string kivio Kivio document 609>>>58 string kontour Kontour document 610>>>58 string kpresenter KPresenter document 611>>>58 string kspread KSpread document 612>>>58 string kword KWord document 613 614# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 615# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 616>>50 string vnd.sun.xml. OpenOffice.org 1.x 617>>>62 string writer Writer 618>>>>68 byte !0x2e document 619>>>>68 string .template template 620>>>>68 string .global global document 621>>>62 string calc Calc 622>>>>66 byte !0x2e spreadsheet 623>>>>66 string .template template 624>>>62 string draw Draw 625>>>>66 byte !0x2e document 626>>>>66 string .template template 627>>>62 string impress Impress 628>>>>69 byte !0x2e presentation 629>>>>69 string .template template 630>>>62 string math Math document 631>>>62 string base Database file 632 633# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 634# http://lists.oasis-open.org/archives/office/200505/msg00006.html 635# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 636>>50 string vnd.oasis.opendocument. OpenDocument 637>>>73 string text 638>>>>77 byte !0x2d Text 639!:mime application/vnd.oasis.opendocument.text 640>>>>77 string -template Text Template 641!:mime application/vnd.oasis.opendocument.text-template 642>>>>77 string -web HTML Document Template 643!:mime application/vnd.oasis.opendocument.text-web 644>>>>77 string -master Master Document 645!:mime application/vnd.oasis.opendocument.text-master 646>>>73 string graphics 647>>>>81 byte !0x2d Drawing 648!:mime application/vnd.oasis.opendocument.graphics 649>>>>81 string -template Template 650!:mime application/vnd.oasis.opendocument.graphics-template 651>>>73 string presentation 652>>>>85 byte !0x2d Presentation 653!:mime application/vnd.oasis.opendocument.presentation 654>>>>85 string -template Template 655!:mime application/vnd.oasis.opendocument.presentation-template 656>>>73 string spreadsheet 657>>>>84 byte !0x2d Spreadsheet 658!:mime application/vnd.oasis.opendocument.spreadsheet 659>>>>84 string -template Template 660!:mime application/vnd.oasis.opendocument.spreadsheet-template 661>>>73 string chart 662>>>>78 byte !0x2d Chart 663!:mime application/vnd.oasis.opendocument.chart 664>>>>78 string -template Template 665!:mime application/vnd.oasis.opendocument.chart-template 666>>>73 string formula 667>>>>80 byte !0x2d Formula 668!:mime application/vnd.oasis.opendocument.formula 669>>>>80 string -template Template 670!:mime application/vnd.oasis.opendocument.formula-template 671>>>73 string database Database 672!:mime application/vnd.oasis.opendocument.database 673>>>73 string image 674>>>>78 byte !0x2d Image 675!:mime application/vnd.oasis.opendocument.image 676>>>>78 string -template Template 677!:mime application/vnd.oasis.opendocument.image-template 678 679# EPUB (OEBPS) books using OCF (OEBPS Container Format) 680# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 681# From: Ralf Brown <ralf.brown@gmail.com> 682>0x1E string mimetypeapplication/epub+zip EPUB document 683!:mime application/epub+zip 684 685# Catch other ZIP-with-mimetype formats 686# In a ZIP file, the bytes immediately after a member's contents are 687# always "PK". The 2 regex rules here print the "mimetype" member's 688# contents up to the first 'P'. Luckily, most MIME types don't contain 689# any capital 'P's. This is a kludge. 690# (mimetype contains "application/<OTHER>") 691>>50 string !epub+zip 692>>>50 string !vnd.oasis.opendocument. 693>>>>50 string !vnd.sun.xml. 694>>>>>50 string !vnd.kde. 695>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 696!:mime application/zip 697# (mimetype contents other than "application/*") 698>26 string \x8\0\0\0mimetype 699>>38 string !application/ 700>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 701!:mime application/zip 702 703# Java Jar files 704>(26.s+30) leshort 0xcafe Java Jar file data (zip) 705!:mime application/jar 706 707# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 708# Next line excludes specialized formats: 709>(26.s+30) leshort !0xcafe 710>>26 string !\x8\0\0\0mimetype Zip archive data 711!:mime application/zip 712>>>4 byte 0x09 \b, at least v0.9 to extract 713>>>4 byte 0x0a \b, at least v1.0 to extract 714>>>4 byte 0x0b \b, at least v1.1 to extract 715>>>4 byte 0x14 \b, at least v2.0 to extract 716>>>4 byte 0x2d \b, at least v3.0 to extract 717>>>0x161 string WINZIP \b, WinZIP self-extracting 718 719# StarView Metafile 720# From Pierre Ducroquet <pinaraf@pinaraf.info> 7210 string VCLMTF StarView MetaFile 722>6 beshort x \b, version %d 723>8 belong x \b, size %d 724 725# Zoo archiver 72620 lelong 0xfdc4a7dc Zoo archive data 727!:mime application/x-zoo 728>4 byte >48 \b, v%c. 729>>6 byte >47 \b%c 730>>>7 byte >47 \b%c 731>32 byte >0 \b, modify: v%d 732>>33 byte x \b.%d+ 733>42 lelong 0xfdc4a7dc \b, 734>>70 byte >0 extract: v%d 735>>>71 byte x \b.%d+ 736 737# Shell archives 73810 string #\ This\ is\ a\ shell\ archive shell archive text 739!:mime application/octet-stream 740 741# 742# LBR. NB: May conflict with the questionable 743# "binary Computer Graphics Metafile" format. 744# 7450 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 746# 747# PMA (CP/M derivative of LHA) 748# 7492 string -pm0- PMarc archive data [pm0] 7502 string -pm1- PMarc archive data [pm1] 7512 string -pm2- PMarc archive data [pm2] 7522 string -pms- PMarc SFX archive (CP/M, DOS) 7535 string -pc1- PopCom compressed executable (CP/M) 754 755# From Rafael Laboissiere <rafael@laboissiere.net> 756# The Project Revision Control System (see 757# http://prcs.sourceforge.net) generates a packaged project 758# file which is recognized by the following entry: 7590 leshort 0xeb81 PRCS packaged project 760 761# Microsoft cabinets 762# by David Necas (Yeti) <yeti@physics.muni.cz> 763#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 764#>25 byte x v%d 765#>24 byte x \b.%d 766# MPi: All CABs have version 1.3, so this is pointless. 767# Better magic in debian-additions. 768 769# GTKtalog catalogs 770# by David Necas (Yeti) <yeti@physics.muni.cz> 7714 string gtktalog\ GTKtalog catalog data, 772>13 string 3 version 3 773>>14 beshort 0x677a (gzipped) 774>>14 beshort !0x677a (not gzipped) 775>13 string >3 version %s 776 777############################################################################ 778# Parity archive reconstruction file, the 'par' file format now used on Usenet. 7790 string PAR\0 PARity archive data 780>48 leshort =0 - Index file 781>48 leshort >0 - file number %d 782 783# Felix von Leitner <felix-file@fefe.de> 7840 string d8:announce BitTorrent file 785!:mime application/x-bittorrent 786 787# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 7880 beshort 0x0e0f Atari MSA archive data 789>2 beshort x \b, %d sectors per track 790>4 beshort 0 \b, 1 sided 791>4 beshort 1 \b, 2 sided 792>6 beshort x \b, starting track: %d 793>8 beshort x \b, ending track: %d 794 795# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 7960 string PK00PK\003\004 Zip archive data 797 798# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 799# by Stefan `Sec` Zehl <sec@42.org> 8007 string **ACE** ACE archive data 801>15 byte >0 version %d 802>16 byte =0x00 \b, from MS-DOS 803>16 byte =0x01 \b, from OS/2 804>16 byte =0x02 \b, from Win/32 805>16 byte =0x03 \b, from Unix 806>16 byte =0x04 \b, from MacOS 807>16 byte =0x05 \b, from WinNT 808>16 byte =0x06 \b, from Primos 809>16 byte =0x07 \b, from AppleGS 810>16 byte =0x08 \b, from Atari 811>16 byte =0x09 \b, from Vax/VMS 812>16 byte =0x0A \b, from Amiga 813>16 byte =0x0B \b, from Next 814>14 byte x \b, version %d to extract 815>5 leshort &0x0080 \b, multiple volumes, 816>>17 byte x \b (part %d), 817>5 leshort &0x0002 \b, contains comment 818>5 leshort &0x0200 \b, sfx 819>5 leshort &0x0400 \b, small dictionary 820>5 leshort &0x0800 \b, multi-volume 821>5 leshort &0x1000 \b, contains AV-String 822>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 823>5 leshort &0x2000 \b, with recovery record 824>5 leshort &0x4000 \b, locked 825>5 leshort &0x8000 \b, solid 826# Date in MS-DOS format (whatever that is) 827#>18 lelong x Created on 828 829# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 830# <doj@cubic.org> 8310x1A string sfArk sfArk compressed Soundfont 832>0x15 string 2 833>>0x1 string >\0 Version %s 834>>0x2A string >\0 : %s 835 836# DR-DOS 7.03 Packed File *.??_ 8370 string Packed\ File\ Personal NetWare Packed File 838>12 string x \b, was "%.12s" 839 840# EET archive 841# From: Tilman Sauerbeck <tilman@code-monkey.de> 8420 belong 0x1ee7ff00 EET archive 843!:mime application/x-eet 844 845# rzip archives 8460 string RZIP rzip compressed data 847>4 byte x - version %d 848>5 byte x \b.%d 849>6 belong x (%d bytes) 850 851# From: "Robert Dale" <robdale@gmail.com> 8520 belong 123 dar archive, 853>4 belong x label "%.8x 854>>8 belong x %.8x 855>>>12 beshort x %.4x" 856>14 byte 0x54 end slice 857>14 beshort 0x4e4e multi-part 858>14 beshort 0x4e53 multi-part, with -S 859 860# Symbian installation files 861# http://www.thouky.co.uk/software/psifs/sis.html 862# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8638 lelong 0x10000419 Symbian installation file 864!:mime application/vnd.symbian.install 865>4 lelong 0x1000006D (EPOC release 3/4/5) 866>4 lelong 0x10003A12 (EPOC release 6) 8670 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 868!:mime x-epoc/x-sisx-app 869 870# From "Nelson A. de Oliveira" <naoliv@gmail.com> 8710 string MPQ\032 MoPaQ (MPQ) archive 872 873# From: Dirk Jagdmann <doj@cubic.org> 874# xar archive format: http://code.google.com/p/xar/ 8750 string xar! xar archive 876>6 beshort x - version %ld 877 878# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 879# .kgb 8800 string KGB_arch KGB Archiver file 881>10 string x with compression level %.1s 882 883# xar (eXtensible ARchiver) archive 884# From: "David Remahl" <dremahl@apple.com> 8850 string xar! xar archive 886#>4 beshort x header size %d 887>6 beshort x version %d, 888#>8 quad x compressed TOC: %d, 889#>16 quad x uncompressed TOC: %d, 890>24 belong 0 no checksum 891>24 belong 1 SHA-1 checksum 892>24 belong 2 MD5 checksum 893 894# Type: Parity Archive 895# From: Daniel van Eeden <daniel_e@dds.nl> 8960 string PAR2 Parity Archive Volume Set 897 898# Bacula volume format. (Volumes always start with a block header.) 899# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 900# From: Adam Buchbinder <adam.buchbinder@gmail.com> 90112 string BB02 Bacula volume 902>20 bedate x \b, started %s 903 904# ePub is XHTML + XML inside a ZIP archive. The first member of the 905# archive must be an uncompressed file called 'mimetype' with contents 906# 'application/epub+zip' 907 908 909# From: "Michael Gorny" <mgorny@gentoo.org> 910# ZPAQ: http://mattmahoney.net/dc/zpaq.html 9110 string zPQ ZPAQ stream 912>3 byte x \b, level %d 913 914# BBeB ebook, unencrypted (LRF format) 915# URL: http://www.sven.de/librie/Librie/LrfFormat 916# From: Adam Buchbinder <adam.buchbinder@gmail.com> 9170 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 918>8 beshort x \b, version %d 919>36 byte 1 \b, front-to-back 920>36 byte 16 \b, back-to-front 921>42 beshort x \b, (%dx, 922>44 beshort x %d) 923