1 2#------------------------------------------------------------------------------ 3# $File: filesystems,v 1.77 2013/03/14 01:38:30 christos Exp $ 4# filesystems: file(1) magic for different filesystems 5# 60 string \366\366\366\366 PC formatted floppy with no filesystem 7# Sun disk labels 8# From /usr/include/sun/dklabel.h: 90774 beshort 0xdabe 10# modified by Joerg Jenderek, because original test 11# succeeds for Cabinet archive dao360.dl_ with negative blocks 12>0770 long >0 Sun disk label 13>>0 string x '%s 14>>>31 string >\0 \b%s 15>>>>63 string >\0 \b%s 16>>>>>95 string >\0 \b%s 17>>0 string x \b' 18>>0734 short >0 %d rpm, 19>>0736 short >0 %d phys cys, 20>>0740 short >0 %d alts/cyl, 21>>0746 short >0 %d interleave, 22>>0750 short >0 %d data cyls, 23>>0752 short >0 %d alt cyls, 24>>0754 short >0 %d heads/partition, 25>>0756 short >0 %d sectors/track, 26>>0764 long >0 start cyl %ld, 27>>0770 long x %ld blocks 28# Is there a boot block written 1 sector in? 29>512 belong&077777777 0600407 \b, boot block present 30 31# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk 32# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 330 string SBMBAKUP_ Smart Boot Manager backup file 34>9 string x \b, version %-5.5s 35>>14 string =_ 36>>>15 string x %-.1s 37>>>>16 string =_ \b. 38>>>>>17 string x \b%-.1s 39>>>>>>18 string =_ \b. 40>>>>>>>19 string x \b%-.1s 41>>>22 ubyte 0 42>>>>21 ubyte x \b, from drive 0x%x 43>>>22 ubyte >0 44>>>>21 string x \b, from drive %s 45>>>535 search/17 \x55\xAA 46>>>>&-512 indirect x \b; contains 47 48# updated by Joerg Jenderek at Nov 2012 49# DOS Emulator image is 128 byte, null right padded header + harddisc image 500 string DOSEMU\0 51>0x27E leshort 0xAA55 52#offset is 128 53>>19 ubyte 128 54>>>(19.b-1) ubyte 0x0 DOS Emulator image 55>>>>7 ulelong >0 \b, %u heads 56>>>>11 ulelong >0 \b, %d sectors/track 57>>>>15 ulelong >0 \b, %d cylinders 58>>>>128 indirect x \b; contains 59 60# x86 boot sector updated by Joerg Jenderek at Sep 2007,May 2011 61# for any allowed sector sizes 6230 search/481 \x55\xAA 63# to display x86 boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) 64# DOS BPB information (70) and after DOS floppy (120) like in previous file version 65!:strength +72 66# for sector sizes < 512 Bytes 67>11 uleshort <512 68>>(11.s-2) uleshort 0xAA55 x86 boot sector 69# for sector sizes with 512 or more Bytes 70>0x1FE leshort 0xAA55 x86 boot sector 71# keep old x86 boot sector as dummy for mbr and bootloader displaying 72# only for sector sizes with 512 or more Bytes 730x1FE leshort 0xAA55 74# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version 75!:strength +21 76>2 string OSBS \b, OS/BS MBR 77# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/ 78# and http://en.wikipedia.org/wiki/Master_Boot_Record 79# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by 80# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 81>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR 82# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) 83# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld 84>>8 ubequad 0x8bf45007501ffbfc 85# http://thestarman.pcministry.com/asm/mbr/200MBR.htm 86>>>0x16 ubyte 0xF3 \b,DOS 2 87>>>>219 regex Author\ -\ Author: 88# found "David Litton" , "A Pehrsson " 89>>>>>&0 string x "%s" 90>>>0x16 ubyte 0xF2 91# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm 92# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz 93>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 94# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) 95>>>>0x22 default x \b,D0S version 3.3-7.0 96# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) 97# where nn is string offset varying for different languages 98# "Invalid partition table" nn=0x8b for english version 99>>>>>(0x49.b) string Invalid\ partition\ table english 100>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german 101>>>>>(0x49.b) string Table\ de\ partition\ invalide french 102>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese 103>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish 104>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian 105>>>>>0x49 ubyte >0 at offset 0x%x 106>>>>>>(0x49.b) string >\0 "%s" 107# "Error loading operating system" nn=0xa3 for english version 108# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version 109# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version 110# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version 111# "Error al cargar sistema operativo" nn=0xa8 for spanish version 112# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version 113>>>>>0x74 ubyte >0 at offset 0x%x 114>>>>>>(0x74.b) string >\0 "%s" 115# "Missing operating system" nn=0xc2 for english version 116# "Betriebssystem fehlt" nn=0xcd for german version 117# "Syst\212me d'exploitation absent" nn=0xd2 for french version 118# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version 119# "Falta sistema operativo" nn=0xca for spanish version 120# "Sistema operativo mancante" nn=0xe2 for italian version 121>>>>>0x79 ubyte >0 at offset 0x%x 122>>>>>>(0x79.b) string >\0 "%s" 123# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) 124# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b 125>>8 ubequad 0x5007501ffcbe1b7c 126# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 127>>>24 ubequad 0xf3a4cbbebe07b104 9M 128# "Invalid partition table" nn=0x10F for english version 129# "Ungültige Partitionstabelle" nn=0x10F for german version 130# "Table de partition erronée" nn=0x10F for french version 131# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version 132>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english 133>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german 134>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french 135>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian 136>>>>0x3C ubyte x at offset 0x%x+0xFF 137>>>>(0x3C.b+0x0FF) string >\0 "%s" 138# "Error loading operating system" nn=0x127 for english version 139# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version 140# "Erreur lors du chargement du système d'exploitation" nn=0x12a for french version 141# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version 142>>>>0xBD ubyte x at offset 0x1%x 143>>>>(0xBD.b+0x100) string >\0 "%s" 144# "Missing operating system" nn=0x146 for english version 145# "Betriebssystem fehlt" nn=0x151 for german version 146# "Système d'exploitation manquant" nn=0x15e for french version 147# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version 148>>>>0xA9 ubyte x at offset 0x1%x 149>>>>(0xA9.b+0x100) string >\0 "%s" 150# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm 151# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 152>>>24 ubequad 0xf3a4cbbdbe07b104 XP 153# where xxyyzz are lower bits from offsets of error messages varying for different languages 154>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english 155>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german 156# "Invalid partition table" xx=0x12C for english version 157# "Ungültige Partitionstabelle" xx=0x12C for german version 158>>>>0x1b5 ubyte >0 at offset 0x1%x 159>>>>(0x1b5.b+0x100) string >\0 "%s" 160# "Error loading operating system" yy=0x144 for english version 161# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version 162>>>>0x1b6 ubyte >0 at offset 0x1%x 163>>>>(0x1b6.b+0x100) string >\0 "%s" 164# "Missing operating system" zz=0x163 for english version 165# "Betriebssystem nicht vorhanden" zz=0x16e for german version 166>>>>0x1b7 ubyte >0 at offset 0x1%x 167>>>>(0x1b7.b+0x100) string >\0 "%s" 168# Microsoft Windows Vista or 7 169# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 170>>8 ubequad 0xc08ed8be007cbf00 171# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) 172# assembler instructions: jnz 0729;cmp ebx,"TCPA" 173>>>0xEC ubequad 0x753b6681fb544350 Vista 174# where xxyyzz are lower bits from offsets of error messages varying for different languages 175>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english 176#>>>>0x1B4 ubelong&0x00FFFFFF ? german 177# "Invalid partition table" xx=0x162 for english version 178# "Ungültige Partitionstabelle" xx=0x1?? for german version 179>>>>0x1b5 ubyte >0 at offset 0x1%x 180>>>>(0x1b5.b+0x100) string >\0 "%s" 181# "Error loading operating system" yy=0x17a for english version 182# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version 183>>>>0x1b6 ubyte >0 at offset 0x1%x 184>>>>(0x1b6.b+0x100) string >\0 "%s" 185# "Missing operating system" zz=0x199 for english version 186# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 187>>>>0x1b7 ubyte >0 at offset 0x1%x 188>>>>(0x1b7.b+0x100) string >\0 "%s" 189# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm) 190# assembler instructions: cmp ebx,"TCPA";cmp 191>>>0xEC ubequad 0x6681fb5443504175 Windows 7 192# where xxyyzz are lower bits from offsets of error messages varying for different languages 193>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english 194#>>>>0x1B4 ubelong&0x00FFFFFF ? german 195# "Invalid partition table" xx=0x163 for english version 196# "Ungültige Partitionstabelle" xx=0x1?? for german version 197>>>>0x1b5 ubyte >0 at offset 0x1%x 198>>>>(0x1b5.b+0x100) string >\0 "%s" 199# "Error loading operating system" yy=0x17b for english version 200# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version 201>>>>0x1b6 ubyte >0 at offset 0x1%x 202>>>>(0x1b6.b+0x100) string >\0 "%s" 203# "Missing operating system" zz=0x19a for english version 204# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 205>>>>0x1b7 ubyte >0 at offset 0x1%x 206>>>>(0x1b7.b+0x100) string >\0 "%s" 207# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs 208# http://en.wikipedia.org/wiki/MBR_disk_signature#ID 209>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x 210# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm 211>>0xDA uleshort 0 212>>>0xDC ulelong >0 \b, created 213# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive 214>>>>0xDC ubyte x with driveID 0x%x 215# hours, minutes and seconds 216>>>>0xDf ubyte x at %x 217>>>>0xDe ubyte x \b:%x 218>>>>0xDd ubyte x \b:%x 219# special case for Microsoft MS-DOS 3.21 spanish 220# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov 221>0 ubequad 0xfab830008ed0bc00 222# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov 223>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish 224# Microsoft MBR IPL end 225 226# dr-dos with some upper-, lowercase variants 227>0x9D string Invalid\ partition\ table$ 228>>181 string No\ Operating\ System$ 229>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 230>0x9D string Invalid\ partition\ table$ 231>>181 string No\ operating\ system$ 232>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 233>342 string Invalid\ partition\ table$ 234>>366 string No\ operating\ system$ 235>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 236>295 string NEWLDR\0 237>>302 string Bad\ PT\ $ 238>>>310 string No\ OS\ $ 239>>>>317 string OS\ load\ err$ 240>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 241>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 242>>>>>>>387 string Copyright\ (c)\ 1984,1998 243>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 244# 245# tests for different MS-DOS Master Boot Records (MBR) moved and merged 246# 247#>0x145 string Default:\ F \b, FREE-DOS MBR 248#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 249>0x145 search/7 Default:\ F \b, FREE-DOS MBR 250#>>313 string F0\ .\ .\ . 251#>>>322 string disk\ 1 252#>>>>382 string FAT3 253>64 string no\ active\ partition\ found 254>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 255# Ranish Partition Manager http://www.ranish.com/part/ 256>387 search/4 \0\ Error!\r 257>>378 search/7 Virus! 258>>>397 search/4 Booting\ 259>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 260>>>>>416 string Writing\ changes... \b2.37 261>>>>>>438 ubyte x \b,0x%x dots 262>>>>>>440 ubyte >0 \b,virus check 263>>>>>>441 ubyte >0 \b,partition %c 264#2.38,2.42,2.44 265>>>>>416 string !Writing\ changes... \b 266>>>>>>418 ubyte 1 \bvirus check, 267>>>>>>419 ubyte x \b0x%x seconds 268>>>>>>420 ubyte&0x0F >0 \b,partition 269>>>>>>>420 ubyte&0x0F <5 \b %x 270>>>>>>>420 ubyte&0x0F 0Xf \b ask 271>>>>>420 ubyte x \b) 272# 273# SYSLINUX MBR moved 274# http://www.acronis.de/ 275>362 string MBR\ Error\ \0\r 276>>376 string ress\ any\ key\ to\ 277>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 278# added by Joerg Jenderek 279# http://www.visopsys.org/ 280# http://partitionlogic.org.uk/ 281>309 string No\ bootable\ partition\ found\r 282>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 283>349 string No\ bootable\ partition\ found\r 284>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 285# bootloader, bootmanager 286>0x40 string SBML 287# label with 11 characters of FAT 12 bit filesystem 288>>43 string SMART\ BTMGR 289>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 290# OEM-ID not always "SBM" 291#>>>>3 strings SBM 292>>>>6 string >\0 \b, version %s 293>382 string XOSLLOADXCF \b, eXtended Operating System Loader 294>6 string LILO \b, LInux i386 boot LOader 295>>120 string LILO \b, version 22.3.4 SuSe 296>>172 string LILO \b, version 22.5.8 Debian 297# updated by Joerg Jenderek at Oct 2008 298# variables according to grub-0.97/stage1/stage1.S or 299# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 300# usual values are marked with comments to get only informations of strange GRUB loaders 301>342 search/60 \0Geom\0 302#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 303>>0x41 ubyte <2 304>>>0x3E ubyte >2 \b; GRand Unified Bootloader 305# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 306>>>>0x3E ubyte x \b, stage1 version 0x%x 307#If it is 0xFF, use a drive passed by BIOS 308>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 309# in most case 0,1,0x2e for GRUB 0.5.95 310>>>>0x41 ubyte >0 \b, LBA flag 0x%x 311>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 312#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 313>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 314#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 315>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 316>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 317#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 318>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 319>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 320>>>>>394 string stage1 \b, GRUB version 0.5.95 321>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 322>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 323>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 324>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 325>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 326>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 327>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 328>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 329#unkown version 330>>>343 string Geom\0Read\0\ Error\0 331>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 332>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 333>>>>374 string GRUB\ \0 \b, GRUB version n.m 334# SYSLINUX bootloader moved 335>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 336# http://www.bcdwb.de/bcdw/index_e.htm 337>3 string BCDL 338>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 339# mbr partition table entries 340# OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs 341>3 string !MS 342>>3 string !SYSLINUX 343>>>3 string !MTOOL 344>>>>3 string !NEWLDR 345>>>>>5 string !DOS 346# not FAT (32 bit) 347>>>>>>82 string !FAT32 348#not Linux kernel 349>>>>>>>514 string !HdrS 350#not BeOS 351>>>>>>>>422 string !Be\ Boot\ Loader 352# active flag 0 or 0x80 and type > 0 353>>>>>>>>>446 ubyte <0x81 354>>>>>>>>>>446 ubyte&0x7F 0 355>>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x 356>>>>>>>>>>>>446 ubyte 0x80 \b, active 357>>>>>>>>>>>>447 ubyte x \b, starthead %u 358#>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x 359#>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d 360>>>>>>>>>>>>454 ulelong x \b, startsector %u 361>>>>>>>>>>>>458 ulelong x \b, %u sectors 362# 363>>>>>>>>>462 ubyte <0x81 364>>>>>>>>>>462 ubyte&0x7F 0 365>>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x 366>>>>>>>>>>>>462 ubyte 0x80 \b, active 367>>>>>>>>>>>>463 ubyte x \b, starthead %u 368#>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x 369#>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d 370>>>>>>>>>>>>470 ulelong x \b, startsector %u 371>>>>>>>>>>>>474 ulelong x \b, %u sectors 372# 373>>>>>>>>>478 ubyte <0x81 374>>>>>>>>>>478 ubyte&0x7F 0 375>>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x 376>>>>>>>>>>>>478 ubyte 0x80 \b, active 377>>>>>>>>>>>>479 ubyte x \b, starthead %u 378#>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x 379#>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x 380#>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d 381>>>>>>>>>>>>486 ulelong x \b, startsector %u 382>>>>>>>>>>>>490 ulelong x \b, %u sectors 383# 384>>>>>>>>>494 ubyte <0x81 385>>>>>>>>>>494 ubyte&0x7F 0 386>>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x 387>>>>>>>>>>>>494 ubyte 0x80 \b, active 388>>>>>>>>>>>>495 ubyte x \b, starthead %u 389#>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x 390#>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d 391>>>>>>>>>>>>502 ulelong x \b, startsector %u 392>>>>>>>>>>>>506 ulelong x \b, %u sectors 393# mbr partition table entries end 394# http://www.acronis.de/ 395#FAT label=ACRONIS\ SZ 396#OEM-ID=BOOTWIZ0 397>442 string Non-system\ disk,\ 398>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 399# updated by Joerg Jenderek at Nov 2012 400# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes 401>>>477 ubyte&0xDF >0 402>>>>477 string x \b %-.3s 403>>>>>480 ubyte&0xDF >0 404>>>>>>480 string x \b%-.4s 405>>>>>>>484 ubyte&0xDF >0 406>>>>>>>>484 string x \b%-.1s 407>>>>485 ubyte&0xDF >0 408>>>>>485 string x \b.%-.3s 409# 410>185 string FDBOOT\ Version\ 411>>204 string \rNo\ Systemdisk.\ 412>>>220 string Booting\ from\ harddisk.\n\r 413>>>245 string Cannot\ load\ from\ harddisk.\n\r 414>>>>273 string Insert\ Systemdisk\ 415>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 416>>>>>>200 string >\0 \b, version %-3s 417>242 string Bootsector\ from\ C.H.\ Hochst\204 418# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c 419# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string 420# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut 421>242 search/127 Bootsector\ from\ C.H.\ Hochst 422>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk 423# followed by variants with point,CR-NL or NL-CR 424>>>208 search/261 Cannot\ load\ from\ harddisk. 425# followed by variants CR-NL or NL-CR 426>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. 427# followed by variants with point,CR-NL or NL-CR 428>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader 429# followed by string like "6.50 (c) 1993-2004 Gilles Vollant" 430>>>>>>&0 string x \b, version %-4.4s 431>(1.b+2) ubyte 0xe 432>>(1.b+3) ubyte 0x1f 433>>>(1.b+4) ubyte 0xbe 434# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others 435>>>>(1.b+5) ubyte&0xd3 0x53 436>>>>>(1.b+6) ubyte 0x7c 437# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, 438>>>>>>(1.b+7) ubyte 0xac 439>>>>>>>(1.b+8) ubyte 0x22 440>>>>>>>>(1.b+9) ubyte 0xc0 441>>>>>>>>>(1.b+10) ubyte 0x74 442>>>>>>>>>>(1.b+11) ubyte 0x0b 443>>>>>>>>>>>(1.b+12) ubyte 0x56 444>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 445# FAT1X version 446>>>>>>>>>>>>>(1.b+5) ubyte 0x5b 447>>>>>>>>>>>>>>0x5b string >\0 "%-s" 448# FAT32 version 449>>>>>>>>>>>>>(1.b+5) ubyte 0x77 450>>>>>>>>>>>>>>0x77 string >\0 "%-s" 451>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 452#>>244 string from\ dosemu-freedos-*-bin.tgz\r 453#>>>170 string Sorry,\ could\ not\ load\ an\ 454#>>>>195 string operating\ system.\r\n 455# 456>103 string This\ is\ not\ a\ bootable\ disk.\ 457>>132 string Please\ insert\ a\ bootable\ 458>>>157 string floppy\ and\r\n 459>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 460# 461>66 string Solaris\ Boot\ Sector 462>>99 string Incomplete\ MDBoot\ load. 463>>>89 string Version \b, Sun Solaris Bootloader 464>>>>97 byte x version %c 465# 466>408 string OS/2\ !!\ SYS01475\r\0 467>>429 string OS/2\ !!\ SYS02025\r\0 468>>>450 string OS/2\ !!\ SYS02027\r\0 469>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 470# 471>409 string OS/2\ !!\ SYS01475\r\0 472>>430 string OS/2\ !!\ SYS02025\r\0 473>>>451 string OS/2\ !!\ SYS02027\r\0 474>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 475>112 string This\ disk\ is\ not\ bootable\r 476>>142 string If\ you\ wish\ to\ make\ it\ bootable 477>>>176 string run\ the\ DOS\ program\ SYS\ 478>>>200 string after\ the\r 479>>>>216 string system\ has\ been\ loaded\r\n 480>>>>>242 string Please\ insert\ a\ DOS\ diskette\ 481>>>>>271 string into\r\n\ the\ drive\ and\ 482>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 483# XP 484>430 string NTLDR\ is\ missing\xFF\r\n 485>>449 string Disk\ error\xFF\r\n 486>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 487# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 488>>>>417 ubyte&0xDF >0 489>>>>>417 string x %-.5s 490>>>>>>422 ubyte&0xDF >0 491>>>>>>>422 string x \b%-.3s 492>>>>>425 ubyte&0xDF >0 493>>>>>>425 string >\ \b.%-.3s 494# 495>>>>371 ubyte >0x20 496>>>>>368 ubyte&0xDF >0 497>>>>>>368 string x %-.5s 498>>>>>>>373 ubyte&0xDF >0 499>>>>>>>>373 string x \b%-.3s 500>>>>>>376 ubyte&0xDF >0 501>>>>>>>376 string x \b.%-.3s 502# 503>430 string NTLDR\ nicht\ gefunden\xFF\r\n 504>>453 string Datentr\204gerfehler\xFF\r\n 505>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 506>>>>417 ubyte&0xDF >0 507>>>>>417 string x %-.5s 508>>>>>>422 ubyte&0xDF >0 509>>>>>>>422 string x \b%-.3s 510>>>>>425 ubyte&0xDF >0 511>>>>>>425 string >\ \b.%-.3s 512# offset variant 513>>>>379 string \0 514>>>>>368 ubyte&0xDF >0 515>>>>>>368 string x %-.5s 516>>>>>>>373 ubyte&0xDF >0 517>>>>>>>>373 string x \b%-.3s 518# 519>430 string NTLDR\ fehlt\xFF\r\n 520>>444 string Datentr\204gerfehler\xFF\r\n 521>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 522>>>>417 ubyte&0xDF >0 523>>>>>417 string x %-.5s 524>>>>>>422 ubyte&0xDF >0 525>>>>>>>422 string x \b%-.3s 526>>>>>425 ubyte&0xDF >0 527>>>>>>425 string >\ \b.%-.3s 528# variant 529>>>>371 ubyte >0x20 530>>>>>368 ubyte&0xDF >0 531>>>>>>368 string x %-.5s 532>>>>>>>373 ubyte&0xDF >0 533>>>>>>>>373 string x \b%-.3s 534>>>>>>376 ubyte&0xDF >0 535>>>>>>>376 string x \b.%-.3s 536# 537>430 string NTLDR\ fehlt\xFF\r\n 538>>444 string Medienfehler\xFF\r\n 539>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 540>>>>371 ubyte >0x20 541>>>>>368 ubyte&0xDF >0 542>>>>>>368 string x %-.5s 543>>>>>>>373 ubyte&0xDF >0 544>>>>>>>>373 string x \b%-.3s 545>>>>>>376 ubyte&0xDF >0 546>>>>>>>376 string x \b.%-.3s 547# variant 548>>>>417 ubyte&0xDF >0 549>>>>>417 string x %-.5s 550>>>>>>422 ubyte&0xDF >0 551>>>>>>>422 string x \b%-.3s 552>>>>>425 ubyte&0xDF >0 553>>>>>>425 string >\ \b.%-.3s 554# 555>430 string Datentr\204ger\ entfernen\xFF\r\n 556>>454 string Medienfehler\xFF\r\n 557>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 558>>>>379 string \0 559>>>>>368 ubyte&0xDF >0 560>>>>>>368 string x %-.5s 561>>>>>>>373 ubyte&0xDF >0 562>>>>>>>>373 string x \b%-.3s 563>>>>>>376 ubyte&0xDF >0 564>>>>>>>376 string x \b.%-.3s 565# variant 566>>>>417 ubyte&0xDF >0 567>>>>>417 string x %-.5s 568>>>>>>422 ubyte&0xDF >0 569>>>>>>>422 string x \b%-.3s 570>>>>>425 ubyte&0xDF >0 571>>>>>>425 string >\ \b.%-.3s 572# 573 574#>3 string NTFS\ \ \ \ 575>389 string Fehler\ beim\ Lesen\ 576>>407 string des\ Datentr\204gers 577>>>426 string NTLDR\ fehlt 578>>>>440 string NTLDR\ ist\ komprimiert 579>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 580#>3 string NTFS\ \ \ \ 581>313 string A\ disk\ read\ error\ occurred.\r 582>>345 string A\ kernel\ file\ is\ missing\ 583>>>370 string from\ the\ disk.\r 584>>>>484 string NTLDR\ is\ compressed 585>>>>>429 string Insert\ a\ system\ diskette\ 586>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 587# DOS loader variants different languages,offsets 588>472 ubyte&0xDF >0 589>>389 string Invalid\ system\ disk\xFF\r\n 590>>>411 string Disk\ I/O\ error 591>>>>428 string Replace\ the\ disk,\ and\ 592>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 593#IO.SYS 594>>>>>>472 ubyte&0xDF >0 595>>>>>>>472 string x \b %-.2s 596>>>>>>>>474 ubyte&0xDF >0 597>>>>>>>>>474 string x \b%-.5s 598>>>>>>>>>>479 ubyte&0xDF >0 599>>>>>>>>>>>479 string x \b%-.1s 600>>>>>>>480 ubyte&0xDF >0 601>>>>>>>>480 string x \b.%-.3s 602#MSDOS.SYS 603>>>>>>>483 ubyte&0xDF >0 \b+ 604>>>>>>>>483 string x \b%-.5s 605>>>>>>>>>488 ubyte&0xDF >0 606>>>>>>>>>>488 string x \b%-.3s 607>>>>>>>>491 ubyte&0xDF >0 608>>>>>>>>>491 string x \b.%-.3s 609# 610>>390 string Invalid\ system\ disk\xFF\r\n 611>>>412 string Disk\ I/O\ error\xFF\r\n 612>>>>429 string Replace\ the\ disk,\ and\ 613>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 614>>388 string Ungueltiges\ System\ \xFF\r\n 615>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 616>>>>427 string Datentraeger\ wechseln\ und\ 617>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 618#WINBOOT.SYS only not spaces (0xDF) 619>>>>>>497 ubyte&0xDF >0 620>>>>>>>497 string x %-.5s 621>>>>>>>>502 ubyte&0xDF >0 622>>>>>>>>>502 string x \b%-.1s 623>>>>>>>>>>503 ubyte&0xDF >0 624>>>>>>>>>>>503 string x \b%-.1s 625>>>>>>>>>>>>504 ubyte&0xDF >0 626>>>>>>>>>>>>>504 string x \b%-.1s 627>>>>>>505 ubyte&0xDF >0 628>>>>>>>505 string x \b.%-.3s 629#IO.SYS 630>>>>>>472 ubyte&0xDF >0 or 631>>>>>>>472 string x \b %-.2s 632>>>>>>>>474 ubyte&0xDF >0 633>>>>>>>>>474 string x \b%-.5s 634>>>>>>>>>>479 ubyte&0xDF >0 635>>>>>>>>>>>479 string x \b%-.1s 636>>>>>>>480 ubyte&0xDF >0 637>>>>>>>>480 string x \b.%-.3s 638#MSDOS.SYS 639>>>>>>>483 ubyte&0xDF >0 \b+ 640>>>>>>>>483 string x \b%-.5s 641>>>>>>>>>488 ubyte&0xDF >0 642>>>>>>>>>>488 string x \b%-.3s 643>>>>>>>>491 ubyte&0xDF >0 644>>>>>>>>>491 string x \b.%-.3s 645# 646>>390 string Ungueltiges\ System\ \xFF\r\n 647>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 648>>>>429 string Datentraeger\ wechseln\ und\ 649>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 650#WINBOOT.SYS only not spaces (0xDF) 651>>>>>>497 ubyte&0xDF >0 652>>>>>>>497 string x %-.7s 653>>>>>>>>504 ubyte&0xDF >0 654>>>>>>>>>504 string x \b%-.1s 655>>>>>>505 ubyte&0xDF >0 656>>>>>>>505 string x \b.%-.3s 657#IO.SYS 658>>>>>>472 ubyte&0xDF >0 or 659>>>>>>>472 string x \b %-.2s 660>>>>>>>>474 ubyte&0xDF >0 661>>>>>>>>>474 string x \b%-.6s 662>>>>>>>480 ubyte&0xDF >0 663>>>>>>>>480 string x \b.%-.3s 664#MSDOS.SYS 665>>>>>>>483 ubyte&0xDF >0 \b+ 666>>>>>>>>483 string x \b%-.5s 667>>>>>>>>>488 ubyte&0xDF >0 668>>>>>>>>>>488 string x \b%-.3s 669>>>>>>>>491 ubyte&0xDF >0 670>>>>>>>>>491 string x \b.%-.3s 671# 672>>389 string Ungueltiges\ System\ \xFF\r\n 673>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 674>>>>428 string Datentraeger\ wechseln\ und\ 675>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 676# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 677>>>>>>472 string x %-.2s 678>>>>>>>474 ubyte&0xDF >0 679>>>>>>>>474 string x \b%-.5s 680>>>>>>>>479 ubyte&0xDF >0 681>>>>>>>>>479 string x \b%-.1s 682>>>>>>480 ubyte&0xDF >0 683>>>>>>>480 string x \b.%-.3s 684>>>>>>483 ubyte&0xDF >0 \b+ 685>>>>>>>483 string x \b%-.5s 686>>>>>>>488 ubyte&0xDF >0 687>>>>>>>>488 string x \b%-.2s 688>>>>>>>>490 ubyte&0xDF >0 689>>>>>>>>>490 string x \b%-.1s 690>>>>>>>491 ubyte&0xDF >0 691>>>>>>>>491 string x \b.%-.3s 692>479 ubyte&0xDF >0 693>>416 string Kein\ System\ oder\ 694>>>433 string Laufwerksfehler 695>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 696#IO.SYS 697>>>>>479 string x \b %-.2s 698>>>>>>481 ubyte&0xDF >0 699>>>>>>>481 string x \b%-.6s 700>>>>>487 ubyte&0xDF >0 701>>>>>>487 string x \b.%-.3s 702#MSDOS.SYS 703>>>>>>490 ubyte&0xDF >0 \b+ 704>>>>>>>490 string x \b%-.5s 705>>>>>>>>495 ubyte&0xDF >0 706>>>>>>>>>495 string x \b%-.3s 707>>>>>>>498 ubyte&0xDF >0 708>>>>>>>>498 string x \b.%-.3s 709# 710>376 search/41 Non-System\ disk\ or\ 711>>395 search/41 disk\ error\r 712>>>407 search/41 Replace\ and\ 713>>>>419 search/41 press\ \b, 714>>>>419 search/41 strike\ \b, old 715>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 716#449 Disk\ Boot\ failure\r MS 3.21 717#466 Boot\ Failure\r MS 3.30 718>>>>>468 search/18 \0 719#IO.SYS,IBMBIO.COM 720>>>>>>&0 string x \b %-.2s 721>>>>>>>&-20 ubyte&0xDF >0 722>>>>>>>>&-1 string x \b%-.4s 723>>>>>>>>>&-16 ubyte&0xDF >0 724>>>>>>>>>>&-1 string x \b%-.2s 725>>>>>>&8 ubyte&0xDF >0 \b. 726>>>>>>>&-1 string x \b%-.3s 727#MSDOS.SYS,IBMDOS.COM 728>>>>>>&11 ubyte&0xDF >0 \b+ 729>>>>>>>&-1 string x \b%-.5s 730>>>>>>>>&-6 ubyte&0xDF >0 731>>>>>>>>>&-1 string x \b%-.1s 732>>>>>>>>>>&-5 ubyte&0xDF >0 733>>>>>>>>>>>&-1 string x \b%-.2s 734>>>>>>>&7 ubyte&0xDF >0 \b. 735>>>>>>>>&-1 string x \b%-.3s 736>441 string Cannot\ load\ from\ harddisk.\n\r 737>>469 string Insert\ Systemdisk\ 738>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 739#>43 string \224R-LOADER\ \ SYS =label 740>54 string SYS 741>>324 string VASKK 742>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 743# 744>98 string Press\ a\ key\ to\ retry\0\r 745>>120 string Cannot\ find\ file\ \0\r 746>>>139 string Disk\ read\ error\0\r 747>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 748#DRBIOS.SYS 749>>>>>44 ubyte&0xDF >0 750>>>>>>44 string x \b %-.6s 751>>>>>>>50 ubyte&0xDF >0 752>>>>>>>>50 string x \b%-.2s 753>>>>>>52 ubyte&0xDF >0 754>>>>>>>52 string x \b.%-.3s 755# 756>70 string IBMBIO\ \ COM 757>>472 string Cannot\ load\ DOS!\ 758>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 759>>471 string Cannot\ load\ DOS\ 760>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 761#?? 762>444 string KERNEL\ \ SYS 763>>314 string BOOT\ error! \b, FREE-DOS Bootloader 764>499 string KERNEL\ \ SYS 765>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 766>449 string KERNEL\ \ SYS 767>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 768# 769>449 string Loading\ FreeDOS 770>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 771>>>497 ubyte&0xDF >0 772>>>>497 string x \b %-.6s 773>>>>>503 ubyte&0xDF >0 774>>>>>>503 string x \b%-.1s 775>>>>>>>504 ubyte&0xDF >0 776>>>>>>>>504 string x \b%-.1s 777>>>>505 ubyte&0xDF >0 778>>>>>505 string x \b.%-.3s 779# 780>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 781# 782>125 string Loading\ FreeDOS...\r 783>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 784>>>441 ubyte&0xDF >0 785>>>>441 string x \b %-.6s 786>>>>>447 ubyte&0xDF >0 787>>>>>>447 string x \b%-.1s 788>>>>>>>448 ubyte&0xDF >0 789>>>>>>>>448 string x \b%-.1s 790>>>>449 ubyte&0xDF >0 791>>>>>449 string x \b.%-.3s 792>124 string FreeDOS\0 793>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 794# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 795>>>497 ubyte&0xDF >0 796>>>>497 string x \b %-.6s 797>>>>>503 ubyte&0xDF >0 798>>>>>>503 string x \b%-.1s 799>>>>>>>504 ubyte&0xDF >0 800>>>>>>>>504 string x \b%-.1s 801>>>>505 ubyte&0xDF >0 802>>>>>505 string x \b.%-.3s 803>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 804>>>497 ubyte&0xDF >0 805>>>>497 string x \b %-.6s 806>>>>>503 ubyte&0xDF >0 807>>>>>>503 string x \b%-.1s 808>>>>>>>504 ubyte&0xDF >0 809>>>>>>>>504 string x \b%-.1s 810>>>>505 ubyte&0xDF >0 811>>>>>505 string x \b.%-.3s 812>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 813>>>497 ubyte&0xDF >0 814>>>>497 string x \b %-.6s 815>>>>>503 ubyte&0xDF >0 816>>>>>>503 string x \b%-.1s 817>>>>>>>504 ubyte&0xDF >0 818>>>>>>>>504 string x \b%-.1s 819>>>>505 ubyte&0xDF >0 820>>>>>505 string x \b.%-.3s 821>336 string Error!\ 822>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 823>>>497 ubyte&0xDF >0 824>>>>497 string x \b %-.6s 825>>>>>503 ubyte&0xDF >0 826>>>>>>503 string x \b%-.1s 827>>>>>>>504 ubyte&0xDF >0 828>>>>>>>>504 string x \b%-.1s 829>>>>505 ubyte&0xDF >0 830>>>>>505 string x \b.%-.3s 831# added by Joerg Jenderek 832# http://www.visopsys.org/ 833# http://partitionlogic.org.uk/ 834# OEM-ID=Visopsys 835>478 ulelong 0 836>>(1.b+326) string I/O\ Error\ reading\ 837>>>(1.b+344) string Visopsys\ loader\r 838>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 839# http://alexfru.chat.ru/epm.html#bootprog 840>494 ubyte >0x4D 841>>495 string >E 842>>>495 string <S 843#OEM-ID is not reliable 844>>>>3 string BootProg 845# It just looks for a program file name at the root directory 846# and loads corresponding file with following execution. 847# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 848>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 849>>>>>499 string x \b %-.1s 850>>>>>>500 ubyte&0xDF >0 851>>>>>>>500 string x \b%-.1s 852>>>>>>>>501 ubyte&0xDF >0 853>>>>>>>>>501 string x \b%-.1s 854>>>>>>>>>>502 ubyte&0xDF >0 855>>>>>>>>>>>502 string x \b%-.1s 856>>>>>>>>>>>>503 ubyte&0xDF >0 857>>>>>>>>>>>>>503 string x \b%-.1s 858>>>>>>>>>>>>>>504 ubyte&0xDF >0 859>>>>>>>>>>>>>>>504 string x \b%-.1s 860>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 861>>>>>>>>>>>>>>>>>505 string x \b%-.1s 862>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 863>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 864#name extension 865>>>>>507 ubyte&0xDF >0 \b. 866>>>>>>507 string x \b%-.1s 867>>>>>>>508 ubyte&0xDF >0 868>>>>>>>>508 string x \b%-.1s 869>>>>>>>>>509 ubyte&0xDF >0 870>>>>>>>>>>509 string x \b%-.1s 871#If the boot sector fails to read any other sector, 872#it prints a very short message ("RE") to the screen and hangs the computer. 873#If the boot sector fails to find needed program in the root directory, 874#it also hangs with another message ("NF"). 875>>>>>492 string RENF \b, FAT (12 bit) 876>>>>>495 string RENF \b, FAT (16 bit) 877# http://alexfru.chat.ru/epm.html#bootprog 878>494 ubyte >0x4D 879>>495 string >E 880>>>495 string <S 881#OEM-ID is not reliable 882>>>>3 string BootProg 883# It just looks for a program file name at the root directory 884# and loads corresponding file with following execution. 885# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 886>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 887>>>>>499 string x \b %-.1s 888>>>>>>500 ubyte&0xDF >0 889>>>>>>>500 string x \b%-.1s 890>>>>>>>>501 ubyte&0xDF >0 891>>>>>>>>>501 string x \b%-.1s 892>>>>>>>>>>502 ubyte&0xDF >0 893>>>>>>>>>>>502 string x \b%-.1s 894>>>>>>>>>>>>503 ubyte&0xDF >0 895>>>>>>>>>>>>>503 string x \b%-.1s 896>>>>>>>>>>>>>>504 ubyte&0xDF >0 897>>>>>>>>>>>>>>>504 string x \b%-.1s 898>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 899>>>>>>>>>>>>>>>>>505 string x \b%-.1s 900>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 901>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 902#name extension 903>>>>>507 ubyte&0xDF >0 \b. 904>>>>>>507 string x \b%-.1s 905>>>>>>>508 ubyte&0xDF >0 906>>>>>>>>508 string x \b%-.1s 907>>>>>>>>>509 ubyte&0xDF >0 908>>>>>>>>>>509 string x \b%-.1s 909#If the boot sector fails to read any other sector, 910#it prints a very short message ("RE") to the screen and hangs the computer. 911#If the boot sector fails to find needed program in the root directory, 912#it also hangs with another message ("NF"). 913>>>>>492 string RENF \b, FAT (12 bit) 914>>>>>495 string RENF \b, FAT (16 bit) 915# x86 bootloader end 916 917# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 918# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector 919>0 string RRaA 920>>0x1E4 string rrAa \b, FSInfosector 921#>>0x1FC uleshort =0 SHOULD BE ZERO 922>>>0x1E8 ulelong <0xffffffff \b, %u free clusters 923>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u 924 925# added by Joerg Jenderek at Nov 2012 926# http://www.thenakedpc.com/articles/v04/08/0408-05.html 927# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 9280 string PNCIHISK\0 Norton Utilities disc image data 929# real x86 boot sector with jump instruction 930>509 search/1026 \x55\xAA\xeb 931>>&-1 indirect x \b; contains 932# http://file-extension.net/seeker/file_extension_dat 9330 string PNCIUNDO Norton Disk Doctor UnDo file 934# 935 936# updated by Joerg Jenderek at Sep 2007 937>3 ubyte 0 938#no active flag 939>>446 ubyte 0 940# partition 1 not empty 941>>>450 ubyte >0 942# partitions 3,4 empty 943>>>>482 ubyte 0 944>>>>>498 ubyte 0 945# partition 2 ID=0,5,15 946>>>>>>466 ubyte <0x10 947>>>>>>>466 ubyte 0x05 \b, extended partition table 948>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 949>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 950 951# DOS x86 sector separated and moved from "x86 boot sector" by Joerg Jenderek at May 2011 952 953>0x200 lelong 0x82564557 \b, BSD disklabel 954# FATX 9550 string FATX FATX filesystem data 956 957# romfs filesystems - Juan Cespedes <cespedes@debian.org> 9580 string -rom1fs- romfs filesystem, version 1 959>8 belong x %d bytes, 960>16 string x named %s. 961 962# netboot image - Juan Cespedes <cespedes@debian.org> 9630 lelong 0x1b031336L Netboot image, 964>4 lelong&0xFFFFFF00 0 965>>4 lelong&0x100 0x000 mode 2 966>>4 lelong&0x100 0x100 mode 3 967>4 lelong&0xFFFFFF00 !0 unknown mode 968 9690x18b string OS/2 OS/2 Boot Manager 970 971# updated by Joerg Jenderek at Oct 2008 and Sep 2012 972# http://syslinux.zytor.com/iso.php 973# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 974# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 9750 ulequad&0x909000007cc0eafa 0x909000007c40eafa 976>631 search/689 ISOLINUX\ isolinux Loader 977>>&0 string x (version %-4.4s) 978# http://syslinux.zytor.com/pxe.php 979# assembler instructions: jmp 7C05 9800 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) 981# assembler instructions: pushfd;pushad 9820 ulelong 0x60669c66 pxelinux loader 983# assembler instructions: jmp 05 9840 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) 985# http://syslinux.zytor.com/wiki/index.php/SYSLINUX 9860 string LDLINUX\ SYS\ SYSLINUX loader 987>12 string x (older version %-4.4s) 9880 string \r\nSYSLINUX\ SYSLINUX loader 989>11 string x (version %-4.4s) 990# syslinux updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 991# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 9920 ulelong&0x80909bEB 0x009018EB 993# OEM-ID not always "SYSLINUX" 994>434 search/47 Boot\ failed 995# followed by \r\n\0 or :\ 996>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) 997>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) 998>459 search/30 Boot\ error\r\n\0 999>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) 1000# SYSLINUX MBR updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 1001# assembler instructions: mov di,0600h;mov cx,0100h 100216 search/4 \xbf\x00\x06\xb9\x00\x01 1003# to display SYSLINUX MBR (36) before old x86 boot sector one with partition table (strength=50+21) 1004!:strength +36 1005>94 search/249 Missing\ operating\ system 1006# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other 1007# skip Ranish MBR 1008>>408 search/4 HD1/\0 1009>>408 default x 1010>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR 1011# followed by "ing " or space 1012>>>>292 search/98 error 1013>>>>>&0 string \r (version 3.35 or older) 1014>>>>>&0 string .\r (version 3.52 or newer) 1015>>>>>&0 default x (version 3.36-3.51 ) 1016>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR 1017>>156 search/10 \0Boot\ partition\ not\ found\r\n 1018>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) 1019>>174 search/10 \0Missing\ OS\r\n 1020>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) 1021# SYSLINUX END 1022 1023# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 1024# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 10250 ubequad 0x31c08ed0bc007c8e 1026# mbr_bootsel magic before partition table not reliable with small ipl fragments 1027#>444 uleshort 0xb5e1 1028>0004 uleshort x 1029# ERRorTeXT 1030>>181 search/166 Error\ \0\r\n NetBSD mbr 1031# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS 1032>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x 1033# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx 1034>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector 1035# BOOT_EXTENDED definitions contains assembler instructions: 1036# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 1037>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended 1038# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al 1039>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO 1040# not TERSE_ERROR 1041>>>196 search/106 No\ active\ partition\0 1042>>>>&0 string Disk\ read\ error\0 1043>>>>>&0 string No\ operating\ system\0 \b,verbose 1044# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 1045>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS 1046# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 1047>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check 1048# assembler instructions: movw nametab,bx 1049>>>0x26 search/21 \xBB\x94\x07 1050# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf 1051>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 1052>>>>>181 search/166 Error\ \0 1053# "a: disk" , "Fn: diskn" or "NetBSD MBR boot" 1054>>>>>>&3 string x \b,"%s" 1055# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html 1056# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 1057# assembler instructions: jmp short 0x58;nop;ASCII 10580 ubequad&0xeb58908000000000 0xeb58900000000000 1059# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, 1060>(1.b+2) ubequad 0xfa31c08ed88ec08e 1061# Error messages at end of code 1062>>376 string No\ operating\ system\r\n\0 1063>>>398 string Disk\ error\r\n\0FDD\0HDD\0 1064>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr 1065 1066# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ 1067# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 1068# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, 1069# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 10700 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC 1071# pointer to the data starting with Neil Turton signature string 1072>(0x1BC.s) string NDTmbr 1073>>&-14 string 1234F\0 Turton mbr ( 1074# parameters also viewed by install-mbr --list 1075>>>(0x1BC.s+7) ubyte x \b%u<= 1076>>>(0x1BC.s+9) ubyte x \bVersion<=%u 1077#>>>(0x1BC.s+8) ubyte x asm_flag_%x 1078>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix 1079# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode 1080>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk 1081#0x1~1,..,0x8~4,0x10~F,0x80~A enabled 1082#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x 1083#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot 1084#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x 1085# for older versions 1086>>>(0x1BC.s+9) ubyte <2 1087#>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds 1088>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds 1089# floppy A: or B: 1090>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x 1091>>>>(0x1BC.s+13) ubyte >1 1092# 1st hard disc 1093#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x 1094# not 1st hard disc 1095>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x 1096# for version >= 2 maximal timeout can be 65534 1097>>>(0x1BC.s+9) ubyte >1 1098#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds 1099>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds 1100# floppy A: or B: 1101>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x 1102>>>>(0x1BC.s+14) ubyte >1 1103# 1st hard disc 1104#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x 1105# not 1st hard disc 1106>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x 1107>>>0 ubyte x \b) 1108 1109# added by Joerg Jenderek 1110# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 1111# grub-1.94/kern/i386/pc/startup.S 1112# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 1113# usual values are marked with comments to get only informations of strange GRUB loaders 11140x200 uleshort 0x70EA 1115# found only version 3.{1,2} 1116>0x206 ubeshort >0x0300 1117# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 1118>>0x212 ubyte >0x29 1119>>>0x213 ubyte >0x29 1120# not iso9660_stage1_5 1121#>>>0 ulelong&0x00BE5652 0x00BE5652 1122>>>>0x213 ubyte >0x29 GRand Unified Bootloader 1123# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 1124>>>>0x217 ubyte 0xFF stage1_5 1125>>>>0x217 ubyte <0xFF stage2 1126>>>>0x206 ubyte x \b version %u 1127>>>>0x207 ubyte x \b.%u 1128# module_size for 1.94 1129>>>>0x208 ulelong <0xffffff \b, installed partition %u 1130#>>>>0x208 ulelong =0xffffff \b, %u (default) 1131>>>>0x208 ulelong >0xffffff \b, installed partition %u 1132# GRUB 0.5.95 unofficial 1133>>>>0x20C ulelong&0x2E300000 0x2E300000 1134# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 1135>>>>>0x20C ubyte x \b, identifier 0x%x 1136#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 1137>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 1138# GRUB version as string 1139>>>>>0x20E string >\0 \b, GRUB version %-s 1140# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 1141>>>>>>0x215 ulong 0xffffffff 1142>>>>>>>0x219 string >\0 \b, configuration file %-s 1143>>>>>>0x215 ulong !0xffffffff 1144>>>>>>>0x215 string >\0 \b, configuration file %-s 1145# newer GRUB versions 1146>>>>0x20C ulelong&0x2E300000 !0x2E300000 1147##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 1148>>>>>0x20C ulelong >0 \b, saved entry %d 1149# for 1.94 contains kernel image size 1150# for 0.93,0.94,0.96,0.97 1151# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 1152>>>>>0x210 ubyte x \b, identifier 0x%x 1153# The flag for LBA forcing is in most cases 0 1154#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 1155>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 1156# GRUB version as string 1157>>>>>0x212 string >\0 \b, GRUB version %-s 1158# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 1159>>>>>0x217 ulong 0xffffffff 1160>>>>>>0x21b string >\0 \b, configuration file %-s 1161>>>>>0x217 ulong !0xffffffff 1162>>>>>>0x217 string >\0 \b, configuration file %-s 1163 1164# DOS x86 sector updated and separated from "x86 boot sector" by Joerg Jenderek at May 2011 1165# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 1166# over BIOS parameter block (BPB) 1167# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD 1168# older drives may use Near JuMP instruction E9 xx xx 1169# minimal short forward jump found 0x29 for bootloaders or 0x0 1170# maximal short forward jump is 0x7f 1171# OEM-ID is empty or contain readable bytes 11720 ulelong&0x804000E9 0x000000E9 1173# mtools-3.9.8/msdos.h 1174# usual values are marked with comments to get only informations of strange FAT systems 1175# valid sectorsize must be a power of 2 from 32 to 32768 1176>11 uleshort&0xf001f 0 1177>>11 uleshort <32769 1178>>>11 uleshort >31 1179>>>>21 ubyte&0xf0 0xF0 1180>>>>>0 ubyte 0xEB 1181>>>>>>1 ubyte x \b, code offset 0x%x+2 1182>>>>>0 ubyte 0xE9 1183>>>>>>1 uleshort x \b, code offset 0x%x+2 1184>>>>>3 string >\0 \b, OEM-ID "%-.8s" 1185#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 1186>>>>>>8 string IHC \b cached by Windows 9M 1187>>>>>11 uleshort >512 \b, Bytes/sector %u 1188#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 1189>>>>>11 uleshort <512 \b, Bytes/sector %u 1190>>>>>13 ubyte >1 \b, sectors/cluster %u 1191#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 1192>>>>>82 string FAT32 1193>>>>>>14 uleshort !32 \b, reserved sectors %u 1194#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 1195>>>>>82 string !FAT32 1196>>>>>>14 uleshort >1 \b, reserved sectors %u 1197#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 1198#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) 1199>>>>>16 ubyte >2 \b, FATs %u 1200#>>>>>16 ubyte =2 \b, FATs %u (usual) 1201>>>>>16 ubyte =1 \b, FAT %u 1202>>>>>16 ubyte >0 1203>>>>>17 uleshort >0 \b, root entries %u 1204#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) 1205>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 1206#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) 1207>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 1208#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 1209>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 1210>>>>>22 uleshort >0 \b, sectors/FAT %u 1211#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) 1212>>>>>24 uleshort x \b, sectors/track %u 1213>>>>>26 ubyte >2 \b, heads %u 1214#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 1215>>>>>26 ubyte =1 \b, heads %u 1216# valid only for sector sizes with more then 32 Bytes 1217>>>>>11 uleshort >32 1218# skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk 1219>>>>>>38 ubyte !0x70 1220>>>>>>>28 ulelong >0 \b, hidden sectors %u 1221#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 1222>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 1223#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 1224# FAT<32 bit specific 1225>>>>>>>82 string !FAT32 1226#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 1227#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 1228>>>>>>>>36 ubyte !0x80 1229>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 1230>>>>>>>>37 ubyte >0 \b, reserved 0x%x 1231#>>>>>>>>37 ubyte =0 \b, reserved 0x%x 1232# value is 0x80 for NTFS 1233>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 1234>>>>>>>>38 ubyte =0x29 1235>>>>>>>>>39 ulelong x \b, serial number 0x%x 1236>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 1237>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 1238>>>>>>>>>43 string =NO\ NAME \b, unlabeled 1239# there exist some old floppies without word FAT at offset 54 1240# a word like "FATnm " is only a hint for a FAT size on nm-bits 1241# Normally the number of clusters is calculated by the values of BPP. 1242# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, 1243# otherwise FAT is 16 bit. 1244# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html 1245>>>>>>54 string FAT \b, FAT 1246>>>>>>>54 string FAT12 \b (12 bit) 1247>>>>>>>54 string FAT16 \b (16 bit) 1248# FAT32 bit specific 1249>>>>>82 string FAT32 \b, FAT (32 bit) 1250>>>>>>36 ulelong x \b, sectors/FAT %u 1251# http://technet.microsoft.com/en-us/library/cc977221.aspx 1252>>>>>>40 uleshort >0 \b, extension flags 0x%x 1253#>>>>>>40 uleshort =0 \b, extension flags %u 1254>>>>>>42 uleshort >0 \b, fsVersion %u 1255#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 1256>>>>>>44 ulelong >2 \b, rootdir cluster %u 1257#>>>>>>44 ulelong =2 \b, rootdir cluster %u 1258#>>>>>>44 ulelong =1 \b, rootdir cluster %u 1259>>>>>>48 uleshort >1 \b, infoSector %u 1260#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 1261>>>>>>48 uleshort <1 \b, infoSector %u 1262>>>>>>50 uleshort >6 \b, Backup boot sector %u 1263#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 1264>>>>>>50 uleshort <6 \b, Backup boot sector %u 1265# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 1266>>>>>>52 ulelong >0 \b, reserved1 0x%x 1267>>>>>>56 ulelong >0 \b, reserved2 0x%x 1268>>>>>>60 ulelong >0 \b, reserved3 0x%x 1269# same structure as FAT1X 1270#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 1271#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 1272>>>>>>64 ubyte !0x80 1273>>>>>>>64 ubyte >0 \b, physical drive 0x%x 1274# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 1275>>>>>>65 ubyte >0 \b, reserved 0x%x 1276>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 1277>>>>>>66 ubyte =0x29 1278>>>>>>>67 ulelong x \b, serial number 0x%x 1279>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 1280>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 1281>>>>>>>71 string =NO\ NAME \b, unlabeled 1282# additional tests for floppy image added by Joerg Jenderek 1283# no fixed disk 1284>>>>>21 ubyte !0xF8 1285# floppy media with 12 bit FAT 1286>>>>>>54 string !FAT16 1287# test for FAT after bootsector 1288>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT 1289# floppy image 1290!:mime application/x-ima 1291# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm 1292# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html 1293# 0 FATs 1294>>>>>16 ubyte =0 1295# 0 root entries 1296>>>>>>17 uleshort =0 1297# 0 DOS sectors 1298>>>>>>>19 uleshort =0 1299# 0 sectors/FAT 1300# dos < 4.0 BootSector value found is 0x80 1301#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) 1302>>>>>>>>22 uleshort =0 \b; NTFS 1303>>>>>>>>>24 uleshort >0 \b, sectors/track %u 1304>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x 1305>>>>>>>>>40 ulequad >0 \b, sectors %lld 1306>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld 1307>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld 1308# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. 1309# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. 1310>>>>>>>>>64 lelong <256 1311>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d 1312>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi) 1313# Values 0 to 127 represent index block sizes of 0 to 127 clusters. 1314# Values 128 to 255 represent index block sizes of 2^(256-N) byte 1315>>>>>>>>>68 ulelong <256 1316>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d 1317#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) 1318>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi) 1319>>>>>>>>>72 ulequad x \b, serial number 0%llx 1320>>>>>>>>>80 ulelong >0 \b, checksum 0x%x 1321#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) 1322>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 1323>>>>>>>>>>&-92 indirect x \b; contains 1324# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 1325# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm 1326# unused assembler instructions JMP y2;NOP;NOP 13270x056 ulelong&0xFFFF0FFF 0x909002EB 1328# unicode loadername terminated by CTRL-D 1329>(0.s*2) ulelong&0xFFFFFF00 0x00040000 1330# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR 1331>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s 1332>>0x12 string $ 1333>>>0x0c lestring16 x \b%-2.2s 1334### DOS,NTFS boot sectors end 1335 13369564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 1337>8404 string x last mounted on %s, 1338#>9504 ledate x last checked at %s, 1339>8224 ledate x last written at %s, 1340>8401 byte x clean flag %d, 1341>8228 lelong x number of blocks %d, 1342>8232 lelong x number of data blocks %d, 1343>8236 lelong x number of cylinder groups %d, 1344>8240 lelong x block size %d, 1345>8244 lelong x fragment size %d, 1346>8252 lelong x minimum percentage of free blocks %d, 1347>8256 lelong x rotational delay %dms, 1348>8260 lelong x disk rotational speed %drps, 1349>8320 lelong 0 TIME optimization 1350>8320 lelong 1 SPACE optimization 1351 135242332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 1353>&-1164 string x last mounted on %s, 1354>&-696 string >\0 volume name %s, 1355>&-304 leqldate x last written at %s, 1356>&-1167 byte x clean flag %d, 1357>&-1168 byte x readonly flag %d, 1358>&-296 lequad x number of blocks %lld, 1359>&-288 lequad x number of data blocks %lld, 1360>&-1332 lelong x number of cylinder groups %d, 1361>&-1328 lelong x block size %d, 1362>&-1324 lelong x fragment size %d, 1363>&-180 lelong x average file size %d, 1364>&-176 lelong x average number of files in dir %d, 1365>&-272 lequad x pending blocks to free %lld, 1366>&-264 lelong x pending inodes to free %ld, 1367>&-664 lequad x system-wide uuid %0llx, 1368>&-1316 lelong x minimum percentage of free blocks %d, 1369>&-1248 lelong 0 TIME optimization 1370>&-1248 lelong 1 SPACE optimization 1371 137266908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 1373>&-1164 string x last mounted on %s, 1374>&-696 string >\0 volume name %s, 1375>&-304 leqldate x last written at %s, 1376>&-1167 byte x clean flag %d, 1377>&-1168 byte x readonly flag %d, 1378>&-296 lequad x number of blocks %lld, 1379>&-288 lequad x number of data blocks %lld, 1380>&-1332 lelong x number of cylinder groups %d, 1381>&-1328 lelong x block size %d, 1382>&-1324 lelong x fragment size %d, 1383>&-180 lelong x average file size %d, 1384>&-176 lelong x average number of files in dir %d, 1385>&-272 lequad x pending blocks to free %lld, 1386>&-264 lelong x pending inodes to free %ld, 1387>&-664 lequad x system-wide uuid %0llx, 1388>&-1316 lelong x minimum percentage of free blocks %d, 1389>&-1248 lelong 0 TIME optimization 1390>&-1248 lelong 1 SPACE optimization 1391 13929564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 1393>7168 belong 0x4c41424c Apple UFS Volume 1394>>7186 string x named %s, 1395>>7176 belong x volume label version %d, 1396>>7180 bedate x created on %s, 1397>8404 string x last mounted on %s, 1398#>9504 bedate x last checked at %s, 1399>8224 bedate x last written at %s, 1400>8401 byte x clean flag %d, 1401>8228 belong x number of blocks %d, 1402>8232 belong x number of data blocks %d, 1403>8236 belong x number of cylinder groups %d, 1404>8240 belong x block size %d, 1405>8244 belong x fragment size %d, 1406>8252 belong x minimum percentage of free blocks %d, 1407>8256 belong x rotational delay %dms, 1408>8260 belong x disk rotational speed %drps, 1409>8320 belong 0 TIME optimization 1410>8320 belong 1 SPACE optimization 1411 141242332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 1413>&-1164 string x last mounted on %s, 1414>&-696 string >\0 volume name %s, 1415>&-304 beqldate x last written at %s, 1416>&-1167 byte x clean flag %d, 1417>&-1168 byte x readonly flag %d, 1418>&-296 bequad x number of blocks %lld, 1419>&-288 bequad x number of data blocks %lld, 1420>&-1332 belong x number of cylinder groups %d, 1421>&-1328 belong x block size %d, 1422>&-1324 belong x fragment size %d, 1423>&-180 belong x average file size %d, 1424>&-176 belong x average number of files in dir %d, 1425>&-272 bequad x pending blocks to free %lld, 1426>&-264 belong x pending inodes to free %ld, 1427>&-664 bequad x system-wide uuid %0llx, 1428>&-1316 belong x minimum percentage of free blocks %d, 1429>&-1248 belong 0 TIME optimization 1430>&-1248 belong 1 SPACE optimization 1431 143266908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 1433>&-1164 string x last mounted on %s, 1434>&-696 string >\0 volume name %s, 1435>&-304 beqldate x last written at %s, 1436>&-1167 byte x clean flag %d, 1437>&-1168 byte x readonly flag %d, 1438>&-296 bequad x number of blocks %lld, 1439>&-288 bequad x number of data blocks %lld, 1440>&-1332 belong x number of cylinder groups %d, 1441>&-1328 belong x block size %d, 1442>&-1324 belong x fragment size %d, 1443>&-180 belong x average file size %d, 1444>&-176 belong x average number of files in dir %d, 1445>&-272 bequad x pending blocks to free %lld, 1446>&-264 belong x pending inodes to free %ld, 1447>&-664 bequad x system-wide uuid %0llx, 1448>&-1316 belong x minimum percentage of free blocks %d, 1449>&-1248 belong 0 TIME optimization 1450>&-1248 belong 1 SPACE optimization 1451 1452# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 1453# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 1454# volume label and UUID Russell Coker 1455# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 14560x438 leshort 0xEF53 Linux 1457>0x44c lelong x rev %d 1458>0x43e leshort x \b.%d 1459# No journal? ext2 1460>0x45c lelong ^0x0000004 ext2 filesystem data 1461>>0x43a leshort ^0x0000001 (mounted or unclean) 1462# Has a journal? ext3 or ext4 1463>0x45c lelong &0x0000004 1464# and small INCOMPAT? 1465>>0x460 lelong <0x0000040 1466# and small RO_COMPAT? 1467>>>0x464 lelong <0x0000008 ext3 filesystem data 1468# else large RO_COMPAT? 1469>>>0x464 lelong >0x0000007 ext4 filesystem data 1470# else large INCOMPAT? 1471>>0x460 lelong >0x000003f ext4 filesystem data 1472>0x468 belong x \b, UUID=%08x 1473>0x46c beshort x \b-%04x 1474>0x46e beshort x \b-%04x 1475>0x470 beshort x \b-%04x 1476>0x472 belong x \b-%08x 1477>0x476 beshort x \b%04x 1478>0x478 string >0 \b, volume name "%s" 1479# General flags for any ext* fs 1480>0x460 lelong &0x0000004 (needs journal recovery) 1481>0x43a leshort &0x0000002 (errors) 1482# INCOMPAT flags 1483>0x460 lelong &0x0000001 (compressed) 1484#>0x460 lelong &0x0000002 (filetype) 1485#>0x460 lelong &0x0000010 (meta bg) 1486>0x460 lelong &0x0000040 (extents) 1487>0x460 lelong &0x0000080 (64bit) 1488#>0x460 lelong &0x0000100 (mmp) 1489#>0x460 lelong &0x0000200 (flex bg) 1490# RO_INCOMPAT flags 1491#>0x464 lelong &0x0000001 (sparse super) 1492>0x464 lelong &0x0000002 (large files) 1493>0x464 lelong &0x0000008 (huge files) 1494#>0x464 lelong &0x0000010 (gdt checksum) 1495#>0x464 lelong &0x0000020 (many subdirs) 1496#>0x463 lelong &0x0000040 (extra isize) 1497 1498# Minix filesystems - Juan Cespedes <cespedes@debian.org> 14990x410 leshort 0x137f 1500!:strength / 2 1501>0x402 beshort < 100 1502>0x402 beshort > -1 Minix filesystem, V1, %d zones 1503>0x1e string minix \b, bootable 15040x410 beshort 0x137f 1505!:strength / 2 1506>0x402 beshort < 100 1507>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones 1508>0x1e string minix \b, bootable 15090x410 leshort 0x138f 1510!:strength / 2 1511>0x402 beshort < 100 1512>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones 1513>0x1e string minix \b, bootable 15140x410 beshort 0x138f 1515!:strength / 2 1516>0x402 beshort < 100 1517>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones 1518>0x1e string minix \b, bootable 15190x410 leshort 0x2468 1520>0x402 beshort < 100 1521>>0x402 beshort > -1 Minix filesystem, V2, %d zones 1522>0x1e string minix \b, bootable 15230x410 beshort 0x2468 1524>0x402 beshort < 100 1525>0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones 1526>0x1e string minix \b, bootable 1527 15280x410 leshort 0x2478 1529>0x402 beshort < 100 1530>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones 1531>0x1e string minix \b, bootable 15320x410 leshort 0x2478 1533>0x402 beshort < 100 1534>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones 1535>0x1e string minix \b, bootable 15360x410 beshort 0x2478 1537>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones 1538>0x1e string minix \b, bootable 15390x410 leshort 0x4d5a 1540>0x402 beshort !0 Minix filesystem, V3, %d zones 1541>0x1e string minix \b, bootable 1542 1543# SGI disk labels - Nathan Scott <nathans@debian.org> 15440 belong 0x0BE5A941 SGI disk label (volume header) 1545 1546# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 15470 belong 0x58465342 SGI XFS filesystem data 1548>0x4 belong x (blksz %d, 1549>0x68 beshort x inosz %d, 1550>0x64 beshort ^0x2004 v1 dirs) 1551>0x64 beshort &0x2004 v2 dirs) 1552 1553############################################################################ 1554# Minix-ST kernel floppy 15550x800 belong 0x46fc2700 Atari-ST Minix kernel image 1556>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy 1557>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy 1558 1559############################################################################ 1560# Hmmm, is this a better way of detecting _standard_ floppy images ? 156119 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k 1562>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 156319 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k 1564>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 156519 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 1566>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 1567 156819 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM 1569>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 157019 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs 1571>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 1572 157319 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k 157419 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k 1575 1576# Valid media descriptor bytes for MS-DOS: 1577# 1578# Byte Capacity Media Size and Type 1579# ------------------------------------------------- 1580# 1581# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 1582# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 1583# F9 720K 3.5-inch, 2-sided, 9-sector 1584# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 1585# FD 360K 5.25-inch, 2-sided, 9-sector 1586# FF 320K 5.25-inch, 2-sided, 8-sector 1587# FC 180K 5.25-inch, 1-sided, 9-sector 1588# FE 160K 5.25-inch, 1-sided, 8-sector 1589# FE 250K 8-inch, 1-sided, single-density 1590# FD 500K 8-inch, 2-sided, single-density 1591# FE 1.2 MB 8-inch, 2-sided, double-density 1592# F8 ----- Fixed disk 1593# 1594# FC xxxK Apricot 70x1x9 boot disk. 1595# 1596# Originally a bitmap: 1597# xxxxxxx0 Not two sided 1598# xxxxxxx1 Double sided 1599# xxxxxx0x Not 8 SPT 1600# xxxxxx1x 8 SPT 1601# xxxxx0xx Not Removable drive 1602# xxxxx1xx Removable drive 1603# 11111xxx Must be one. 1604# 1605# But now it's rather random: 1606# 111111xx Low density disk 1607# 00 SS, Not 8 SPT 1608# 01 DS, Not 8 SPT 1609# 10 SS, 8 SPT 1610# 11 DS, 8 SPT 1611# 1612# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 1613# 11110000 High density 3 1/2 floppy disk 1614# 11111000 Hard disk any format 1615# 1616 1617# CDROM Filesystems 1618# Modified for UDF by gerardo.cacciari@gmail.com 161932769 string CD001 # 1620!:mime application/x-iso9660-image 1621>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 1622>38913 string NSR0 UDF filesystem data 1623>>38917 string 1 (version 1.0) 1624>>38917 string 2 (version 1.5) 1625>>38917 string 3 (version 2.0) 1626>>38917 byte >0x33 (unknown version, ID 0x%X) 1627>>38917 byte <0x31 (unknown version, ID 0x%X) 1628# "application id" which appears to be used as a volume label 1629>32808 string/T >\0 '%s' 1630>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 163137633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 1632!:mime application/x-iso9660-image 163332776 string CDROM High Sierra CD-ROM filesystem data 1634 1635# .cso files 16360 string CISO Compressed ISO CD image 1637 1638# cramfs filesystem - russell@coker.com.au 16390 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 1640>4 lelong x size %lu 1641>8 lelong &1 version #2 1642>8 lelong &2 sorted_dirs 1643>8 lelong &4 hole_support 1644>32 lelong x CRC 0x%x, 1645>36 lelong x edition %lu, 1646>40 lelong x %lu blocks, 1647>44 lelong x %lu files 1648 16490 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 1650>4 belong x size %lu 1651>8 belong &1 version #2 1652>8 belong &2 sorted_dirs 1653>8 belong &4 hole_support 1654>32 belong x CRC 0x%x, 1655>36 belong x edition %lu, 1656>40 belong x %lu blocks, 1657>44 belong x %lu files 1658 1659# reiserfs - russell@coker.com.au 16600x10034 string ReIsErFs ReiserFS V3.5 16610x10034 string ReIsEr2Fs ReiserFS V3.6 16620x10034 string ReIsEr3Fs ReiserFS V3.6.19 1663>0x1002c leshort x block size %d 1664>0x10032 leshort &2 (mounted or unclean) 1665>0x10000 lelong x num blocks %d 1666>0x10040 lelong 1 tea hash 1667>0x10040 lelong 2 yura hash 1668>0x10040 lelong 3 r5 hash 1669 1670# JFFS - russell@coker.com.au 16710 lelong 0x34383931 Linux Journalled Flash File system, little endian 16720 belong 0x34383931 Linux Journalled Flash File system, big endian 1673 1674# EST flat binary format (which isn't, but anyway) 1675# From: Mark Brown <broonie@sirena.org.uk> 16760 string ESTFBINR EST flat binary 1677 1678# Aculab VoIP firmware 1679# From: Mark Brown <broonie@sirena.org.uk> 16800 string VoIP\ Startup\ and Aculab VoIP firmware 1681>35 string x format %s 1682 1683# From: Mark Brown <broonie@sirena.org.uk> [old] 1684# From: Behan Webster <behanw@websterwood.com> 16850 belong 0x27051956 u-boot legacy uImage, 1686>32 string x %s, 1687>28 byte 0 Invalid os/ 1688>28 byte 1 OpenBSD/ 1689>28 byte 2 NetBSD/ 1690>28 byte 3 FreeBSD/ 1691>28 byte 4 4.4BSD/ 1692>28 byte 5 Linux/ 1693>28 byte 6 SVR4/ 1694>28 byte 7 Esix/ 1695>28 byte 8 Solaris/ 1696>28 byte 9 Irix/ 1697>28 byte 10 SCO/ 1698>28 byte 11 Dell/ 1699>28 byte 12 NCR/ 1700>28 byte 13 LynxOS/ 1701>28 byte 14 VxWorks/ 1702>28 byte 15 pSOS/ 1703>28 byte 16 QNX/ 1704>28 byte 17 Firmware/ 1705>28 byte 18 RTEMS/ 1706>28 byte 19 ARTOS/ 1707>28 byte 20 Unity OS/ 1708>28 byte 21 INTEGRITY/ 1709>29 byte 0 \bInvalid CPU, 1710>29 byte 1 \bAlpha, 1711>29 byte 2 \bARM, 1712>29 byte 3 \bIntel x86, 1713>29 byte 4 \bIA64, 1714>29 byte 5 \bMIPS, 1715>29 byte 6 \bMIPS 64-bit, 1716>29 byte 7 \bPowerPC, 1717>29 byte 8 \bIBM S390, 1718>29 byte 9 \bSuperH, 1719>29 byte 10 \bSparc, 1720>29 byte 11 \bSparc 64-bit, 1721>29 byte 12 \bM68K, 1722>29 byte 13 \bNios-32, 1723>29 byte 14 \bMicroBlaze, 1724>29 byte 15 \bNios-II, 1725>29 byte 16 \bBlackfin, 1726>29 byte 17 \bAVR32, 1727>29 byte 18 \bSTMicroelectronics ST200, 1728>30 byte 0 Invalid Image 1729>30 byte 1 Standalone Program 1730>30 byte 2 OS Kernel Image 1731>30 byte 3 RAMDisk Image 1732>30 byte 4 Multi-File Image 1733>30 byte 5 Firmware Image 1734>30 byte 6 Script File 1735>30 byte 7 Filesystem Image (any type) 1736>30 byte 8 Binary Flat Device Tree BLOB 1737>31 byte 0 (Not compressed), 1738>31 byte 1 (gzip), 1739>31 byte 2 (bzip2), 1740>31 byte 3 (lzma), 1741>12 belong x %d bytes, 1742>8 bedate x %s, 1743>16 belong x Load Address: 0x%08X, 1744>20 belong x Entry Point: 0x%08X, 1745>4 belong x Header CRC: 0x%08X, 1746>24 belong x Data CRC: 0x%08X 1747 1748# JFFS2 file system 17490 leshort 0x1984 Linux old jffs2 filesystem data little endian 17500 leshort 0x1985 Linux jffs2 filesystem data little endian 1751 1752# Squashfs 17530 string sqsh Squashfs filesystem, big endian, 1754>28 beshort x version %d. 1755>30 beshort x \b%d, 1756>28 beshort <3 1757>>8 belong x %d bytes, 1758>28 beshort >2 1759>>28 beshort <4 1760>>>63 bequad x %lld bytes, 1761>>28 beshort >3 1762>>>40 bequad x %lld bytes, 1763#>>67 belong x %d bytes, 1764>4 belong x %d inodes, 1765>28 beshort <2 1766>>32 beshort x blocksize: %d bytes, 1767>28 beshort >1 1768>>28 beshort <4 1769>>>51 belong x blocksize: %d bytes, 1770>>28 beshort >3 1771>>>12 belong x blocksize: %d bytes, 1772>28 beshort <4 1773>>39 bedate x created: %s 1774>28 beshort >3 1775>>8 bedate x created: %s 17760 string hsqs Squashfs filesystem, little endian, 1777>28 leshort x version %d. 1778>30 leshort x \b%d, 1779>28 leshort <3 1780>>8 lelong x %d bytes, 1781>28 leshort >2 1782>>28 leshort <4 1783>>>63 lequad x %lld bytes, 1784>>28 leshort >3 1785>>>40 lequad x %lld bytes, 1786#>>63 lelong x %d bytes, 1787>4 lelong x %d inodes, 1788>28 leshort <2 1789>>32 leshort x blocksize: %d bytes, 1790>28 leshort >1 1791>>28 leshort <4 1792>>>51 lelong x blocksize: %d bytes, 1793>>28 leshort >3 1794>>>12 lelong x blocksize: %d bytes, 1795>28 leshort <4 1796>>39 ledate x created: %s 1797>28 leshort >3 1798>>8 ledate x created: %s 1799 1800# AFS Dump Magic 1801# From: Ty Sarna <tsarna@sarna.org> 18020 string \x01\xb3\xa1\x13\x22 AFS Dump 1803>&0 belong x (v%d) 1804>>&0 byte 0x76 1805>>>&0 belong x Vol %d, 1806>>>>&0 byte 0x6e 1807>>>>>&0 string x %s 1808>>>>>>&1 byte 0x74 1809>>>>>>>&0 beshort 2 1810>>>>>>>>&4 bedate x on: %s 1811>>>>>>>>&0 bedate =0 full dump 1812>>>>>>>>&0 bedate !0 incremental since: %s 1813 1814#---------------------------------------------------------- 1815#delta ISO Daniel Novotny (dnovotny@redhat.com) 18160 string DISO Delta ISO data 1817>4 belong x version %d 1818 1819# VMS backup savesets - gerardo.cacciari@gmail.com 1820# 18214 string \x01\x00\x01\x00\x01\x00 1822>(0.s+16) string \x01\x01 1823>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 1824>>>40 lelong x (block size %d, 1825>>>49 string >\0 original name '%s', 1826>>>2 short 1024 VAX generated) 1827>>>2 short 2048 AXP generated) 1828>>>2 short 4096 I64 generated) 1829 1830# Summary: Oracle Clustered Filesystem 1831# Created by: Aaron Botsis <redhat@digitalmafia.org> 18328 string OracleCFS Oracle Clustered Filesystem, 1833>4 long x rev %d 1834>0 long x \b.%d, 1835>560 string x label: %.64s, 1836>136 string x mountpoint: %.128s 1837 1838# Summary: Oracle ASM tagged volume 1839# Created by: Aaron Botsis <redhat@digitalmafia.org> 184032 string ORCLDISK Oracle ASM Volume, 1841>40 string x Disk Name: %0.12s 184232 string ORCLCLRD Oracle ASM Volume (cleared), 1843>40 string x Disk Name: %0.12s 1844 1845# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 18468 string OracleCFS Oracle Clustered Filesystem, 1847>4 long x rev %d 1848>0 long x \b.%d, 1849>560 string x label: %.64s, 1850>136 string x mountpoint: %.128s 1851 1852# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 185332 string ORCLDISK Oracle ASM Volume, 1854>40 string x Disk Name: %0.12s 185532 string ORCLCLRD Oracle ASM Volume (cleared), 1856>40 string x Disk Name: %0.12s 1857 1858# Compaq/HP RILOE floppy image 1859# From: Dirk Jagdmann <doj@cubic.org> 18600 string CPQRFBLO Compaq/HP RILOE floppy image 1861 1862#------------------------------------------------------------------------------ 1863# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). 1864# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, 1865# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com 1866# 18671008 string DECFILE11 Files-11 On-Disk Structure 1868>525 byte x Level %d 1869>525 byte x (ODS-%d); 1870>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; 1871>1017 string B 1872>>525 byte 2 VAX/VMS or OpenVMS file system; 1873>>525 byte 5 OpenVMS Alpha or Itanium file system; 1874>984 string x volume label is '%-12.12s' 1875 1876# From: Thomas Klausner <wiz@NetBSD.org> 1877# http://filext.com/file-extension/DAA 1878# describes the daa file format. The magic would be: 18790 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 1880 1881# From Albert Cahalan <acahalan@gmail.com> 1882# really le32 operation,destination,payloadsize (but quite predictable) 1883# 01 00 00 00 00 00 00 c0 00 02 00 00 18840 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 1885 1886# From Eric Sandeen 1887# GFS2 18880x10000 belong 0x01161970 1889>0x10018 belong 0x0000051d GFS1 Filesystem 1890>>0x10024 belong x (blocksize %d, 1891>>0x10060 string >\0 lockproto %s) 1892>0x10018 belong 0x00000709 GFS2 Filesystem 1893>>0x10024 belong x (blocksize %d, 1894>>0x10060 string >\0 lockproto %s) 1895 1896# BTRFS 18970x10040 string _BHRfS_M BTRFS Filesystem 1898>0x1012b string >\0 (label "%s", 1899>0x10090 lelong x sectorsize %d, 1900>0x10094 lelong x nodesize %d, 1901>0x10098 lelong x leafsize %d) 1902 1903 1904# dvdisaster's .ecc 1905# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 19060 string *dvdisaster* dvdisaster error correction file 1907 1908# xfs metadump image 1909# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 1910# but can we do the << ? For now it's always 512 (0x200) anyway. 19110 string XFSM 1912>0x200 string XFSB XFS filesystem metadump image 1913 1914# Type: CROM filesystem 1915# From: Werner Fink <werner@suse.de> 19160 string CROMFS CROMFS 1917>6 string >\0 \b version %2.2s, 1918>8 ulequad >0 \b block data at %lld, 1919>16 ulequad >0 \b fblock table at %lld, 1920>24 ulequad >0 \b inode table at %lld, 1921>32 ulequad >0 \b root at %lld, 1922>40 ulelong >0 \b fblock size = %ld, 1923>44 ulelong >0 \b block size = %ld, 1924>48 ulequad >0 \b bytes = %lld 1925 1926# Type: xfs metadump image 1927# From: Daniel Novotny <dnovotny@redhat.com> 1928# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 1929# but can we do the << ? For now it's always 512 (0x200) anyway. 19300 string XFSM 1931>0x200 string XFSB XFS filesystem metadump image 1932 1933# Type: delta ISO 1934# From: Daniel Novotny <dnovotny@redhat.com> 19350 string DISO Delta ISO data, 1936>4 belong x version %d 1937 1938# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) 1939# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. 1940# From: Adam Buchbinder <adam.buchbinder@gmail.com> 19410x8000 string JFS1 1942# Because it's text-only magic, check a binary value (version) to be sure. 1943# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be 1944# mountable. 1945>&0 lelong <3 JFS2 filesystem image 1946# Label is followed by a UUID; we have to limit string length to avoid 1947# appending the UUID in the case of a 16-byte label. 1948>>&144 regex [\x20-\x7E]{1,16} (label "%s") 1949>>&0 lequad x \b, %lld blocks 1950>>&8 lelong x \b, blocksize %d 1951>>&32 lelong&0x00000006 >0 (dirty) 1952>>&36 lelong >0 (compressed) 1953 1954# LFS 19550 lelong 0x070162 LFS filesystem image 1956>4 lelong 1 version 1, 1957>>8 lelong x \b blocks %u, 1958>>12 lelong x \b blocks per segment %u, 1959>4 lelong 2 version 2, 1960>>8 lelong x \b fragments %u, 1961>>12 lelong x \b bytes per segment %u, 1962>16 lelong x \b disk blocks %u, 1963>20 lelong x \b block size %u, 1964>24 lelong x \b fragment size %u, 1965>28 lelong x \b fragments per block %u, 1966>32 lelong x \b start for free list %u, 1967>36 lelong x \b number of free blocks %d, 1968>40 lelong x \b number of files %u, 1969>44 lelong x \b blocks available for writing %d, 1970>48 lelong x \b inodes in cache %d, 1971>52 lelong x \b inode file disk address 0x%x, 1972>56 lelong x \b inode file inode number %u, 1973>60 lelong x \b address of last segment written 0x%x, 1974>64 lelong x \b address of next segment to write 0x%x, 1975>68 lelong x \b address of current segment written 0x%x 1976 19770 string td\000 floppy image data (TeleDisk, compressed) 19780 string TD\000 floppy image data (TeleDisk) 1979 19800 string CQ\024 floppy image data (CopyQM, 1981>16 leshort x %d sectors, 1982>18 leshort x %d heads.) 1983 19840 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 1985 19860 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 19870 beshort 0xAA59 floppy image data (IBM SaveDskF) 19880 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) 1989 19900 string \074CPM_Disk\076 disk image data (YAZE) 1991