1# $OpenBSD: archive,v 1.6 2009/04/24 18:54:34 chl Exp $ 2 3#------------------------------------------------------------------------------ 4# archive: file(1) magic for archive formats (see also "msdos" for self- 5# extracting compressed archives) 6# 7# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 8# pre-POSIX "tar" archives are handled in the C code. 9 10# POSIX tar archives 11257 string ustar\0 POSIX tar archive 12!:mime application/x-tar # encoding: posix 13257 string ustar\040\040\0 GNU tar archive 14!:mime application/x-tar # encoding: gnu 15 16# cpio archives 17# 18# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 19# The idea is to indicate archives produced on machines with the same 20# byte order as the machine running "file" with "cpio archive", and 21# to indicate archives produced on machines with the opposite byte order 22# from the machine running "file" with "byte-swapped cpio archive". 23# 24# The SVR4 "cpio(4)" hints that there are additional formats, but they 25# are defined as "short"s; I think all the new formats are 26# character-header formats and thus are strings, not numbers. 270 short 070707 cpio archive 28!:mime application/x-cpio 290 short 0143561 byte-swapped cpio archive 30!:mime application/x-cpio # encoding: swapped 310 string 070707 ASCII cpio archive (pre-SVR4 or odc) 320 string 070701 ASCII cpio archive (SVR4 with no CRC) 330 string 070702 ASCII cpio archive (SVR4 with CRC) 34 35# Debian package (needs to go before regular portable archives) 36# 370 string =!<arch>\ndebian 38!:mime application/x-debian-package 39>8 string debian-split part of multipart Debian package 40>8 string debian-binary Debian binary package 41>8 string !debian 42>68 string >\0 (format %s) 43# These next two lines do not work, because a bzip2 Debian archive 44# still uses gzip for the control.tar (first in the archive). Only 45# data.tar varies, and the location of its filename varies too. 46# file/libmagic does not current have support for ascii-string based 47# (offsets) as of 2005-09-15. 48#>81 string bz2 \b, uses bzip2 compression 49#>84 string gz \b, uses gzip compression 50#>136 ledate x created: %s 51 52# other archives 530 long 0177555 very old archive 540 short 0177555 very old PDP-11 archive 550 long 0177545 old archive 560 short 0177545 old PDP-11 archive 570 long 0100554 apl workspace 580 string =<ar> archive 59!:mime application/x-archive 60 61# MIPS archive (needs to go before regular portable archives) 62# 630 string =!<arch>\n__________E MIPS archive 64>20 string U with MIPS Ucode members 65>21 string L with MIPSEL members 66>21 string B with MIPSEB members 67>19 string L and an EL hash table 68>19 string B and an EB hash table 69>22 string X -- out of date 70 710 search/1 -h- Software Tools format archive text 72 73# 74# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is 75# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: 76# 77# 0 string =!<arch> current ar archive 78# 0 long 0x213c6172 archive file 79# 80# and for SVR1 archives, we have: 81# 82# 0 string \<ar> System V Release 1 ar archive 83# 0 string =<ar> archive 84# 85# XXX - did Aegis really store shared libraries, breakpointed modules, 86# and absolute code program modules in the same format as new-style 87# "ar" archives? 88# 890 string =!<arch> current ar archive 90!:mime application/x-archive 91>8 string __.SYMDEF random library 92>0 belong =65538 - pre SR9.5 93>0 belong =65539 - post SR9.5 94>0 beshort 2 - object archive 95>0 beshort 3 - shared library module 96>0 beshort 4 - debug break-pointed module 97>0 beshort 5 - absolute code program module 980 string \<ar> System V Release 1 ar archive 990 string =<ar> archive 100# 101# XXX - from "vax", which appears to collect a bunch of byte-swapped 102# thingies, to help you recognize VAX files on big-endian machines; 103# with "leshort", "lelong", and "string", that's no longer necessary.... 104# 1050 belong 0x65ff0000 VAX 3.0 archive 1060 belong 0x3c61723e VAX 5.0 archive 107# 1080 long 0x213c6172 archive file 1090 lelong 0177555 very old VAX archive 1100 leshort 0177555 very old PDP-11 archive 111# 112# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus 113# be a random library (it said 0xff65 rather than 0177545). 114# 1150 lelong 0177545 old VAX archive 116>8 string __.SYMDEF random library 1170 leshort 0177545 old PDP-11 archive 118>8 string __.SYMDEF random library 119# 120# From "pdp" (but why a 4-byte quantity?) 121# 1220 lelong 0x39bed PDP-11 old archive 1230 lelong 0x39bee PDP-11 4.0 archive 124 125# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 126# 127# The first byte is the magic (0x1a), byte 2 is the compression type for 128# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 129# filename of the first file (null terminated). Since some types collide 130# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 131# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 1320 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 133!:mime application/x-arc 1340 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 135!:mime application/x-arc 1360 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 137!:mime application/x-arc 1380 lelong&0x8080ffff 0x0000031a ARC archive data, packed 139!:mime application/x-arc 1400 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 141!:mime application/x-arc 1420 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 143!:mime application/x-arc 144# [JW] stuff taken from idarc, obviously ARC successors: 1450 lelong&0x8080ffff 0x00000a1a PAK archive data 146!:mime application/x-arc 1470 lelong&0x8080ffff 0x0000141a ARC+ archive data 148!:mime application/x-arc 1490 lelong&0x8080ffff 0x0000481a HYP archive data 150!:mime application/x-arc 151 152# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 153# I can't create either SPARK or ArcFS archives so I have not tested this stuff 154# [GRR: the original entries collide with ARC, above; replaced with combined 155# version (not tested)] 156#0 byte 0x1a RISC OS archive (spark format) 1570 string \032archive RISC OS archive (ArcFS format) 1580 string Archive\000 RISC OS archive (ArcFS format) 159 160# All these were taken from idarc, many could not be verified. Unfortunately, 161# there were many low-quality sigs, i.e. easy to trigger false positives. 162# Please notify me of any real-world fishy/ambiguous signatures and I'll try 163# to get my hands on the actual archiver and see if I find something better. [JW] 164# probably many can be enhanced by finding some 0-byte or control char near the start 165 166# idarc calls this Crush/Uncompressed... *shrug* 1670 string CRUSH Crush archive data 168# Squeeze It (.sqz) 1690 string HLSQZ Squeeze It archive data 170# SQWEZ 1710 string SQWEZ SQWEZ archive data 172# HPack (.hpk) 1730 string HPAK HPack archive data 174# HAP 1750 string \x91\x33HF HAP archive data 176# MD/MDCD 1770 string MDmd MDCD archive data 178# LIM 1790 string LIM\x1a LIM archive data 180# SAR 1813 string LH5 SAR archive data 182# BSArc/BS2 1830 string \212\3SB \0 BSArc/BS2 archive data 184# MAR 1852 string =-ah MAR archive data 186# ACB 1870 belong&0x00f800ff 0x00800000 ACB archive data 188# CPZ 189# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 190# JRC 1910 string JRchive JRC archive data 192# Quantum 1930 string DS\0 Quantum archive data 194# ReSOF 1950 string PK\3\6 ReSOF archive data 196# QuArk 1970 string 7\4 QuArk archive data 198# YAC 19914 string YC YAC archive data 200# X1 2010 string X1 X1 archive data 2020 string XhDr X1 archive data 203# CDC Codec (.dqt) 2040 belong&0xffffe000 0x76ff2000 CDC Codec archive data 205# AMGC 2060 string \xad6" AMGC archive data 207# NuLIB 2080 string NõFélå NuLIB archive data 209# PakLeo 2100 string LEOLZW PAKLeo archive data 211# ChArc 2120 string SChF ChArc archive data 213# PSA 2140 string PSA PSA archive data 215# CrossePAC 2160 string DSIGDCC CrossePAC archive data 217# Freeze 2180 string \x1f\x9f\x4a\x10\x0a Freeze archive data 219# KBoom 2200 string ¨MP¨ KBoom archive data 221# NSQ, must go after CDC Codec 2220 string \x76\xff NSQ archive data 223# DPA 2240 string Dirk\ Paehl DPA archive data 225# BA 226# TODO: idarc says "bytes 0-2 == bytes 3-5" 227# TTComp 2280 string \0\6 TTComp archive data 229# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 2300 string ESP ESP archive data 231# ZPack 2320 string \1ZPK\1 ZPack archive data 233# Sky 2340 string \xbc\x40 Sky archive data 235# UFA 2360 string UFA UFA archive data 237# Dry 2380 string =-H2O DRY archive data 239# FoxSQZ 2400 string FOXSQZ FoxSQZ archive data 241# AR7 2420 string ,AR7 AR7 archive data 243# PPMZ 2440 string PPMZ PPMZ archive data 245# MS Compress 2464 string \x88\xf0\x27 MS Compress archive data 247# updated by Joerg Jenderek 248>9 string \0 249>>0 string KWAJ 250>>>7 string \321\003 MS Compress archive data 251>>>>14 ulong >0 \b, original size: %ld bytes 252>>>>18 ubyte >0x65 253>>>>>18 string x \b, was %.8s 254>>>>>(10.b-4) string x \b.%.3s 255# MP3 (archiver, not lossy audio compression) 2560 string MP3\x1a MP3-Archiver archive data 257# ZET 2580 string OZÝ ZET archive data 259# TSComp 2600 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 261# ARQ 2620 string gW\4\1 ARQ archive data 263# Squash 2643 string OctSqu Squash archive data 265# Terse 2660 string \5\1\1\0 Terse archive data 267# PUCrunch 2680 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 269# UHarc 2700 string UHA UHarc archive data 271# ABComp 2720 string \2AB ABComp archive data 2730 string \3AB2 ABComp archive data 274# CMP 2750 string CO\0 CMP archive data 276# Splint 2770 string \x93\xb9\x06 Splint archive data 278# InstallShield 2790 string \x13\x5d\x65\x8c InstallShield Z archive Data 280# Gather 2811 string GTH Gather archive data 282# BOA 2830 string BOA BOA archive data 284# RAX 2850 string ULEB\xa RAX archive data 286# Xtreme 2870 string ULEB\0 Xtreme archive data 288# Pack Magic 2890 string @â\1\0 Pack Magic archive data 290# BTS 2910 belong&0xfeffffff 0x1a034465 BTS archive data 292# ELI 5750 2930 string Ora\ ELI 5750 archive data 294# QFC 2950 string \x1aFC\x1a QFC archive data 2960 string \x1aQF\x1a QFC archive data 297# PRO-PACK 2980 string RNC PRO-PACK archive data 299# 777 3000 string 777 777 archive data 301# LZS221 3020 string sTaC LZS221 archive data 303# HPA 3040 string HPA HPA archive data 305# Arhangel 3060 string LG Arhangel archive data 307# EXP1, uses bzip2 3080 string 0123456789012345BZh EXP1 archive data 309# IMP 3100 string IMP\xa IMP archive data 311# NRV 3120 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 313# Squish 3140 string \x73\xb2\x90\xf4 Squish archive data 315# Par 3160 string PHILIPP Par archive data 3170 string PAR Par archive data 318# HIT 3190 string UB HIT archive data 320# SBX 3210 belong&0xfffff000 0x53423000 SBX archive data 322# NaShrink 3230 string NSK NaShrink archive data 324# SAPCAR 3250 string #\ CAR\ archive\ header SAPCAR archive data 3260 string CAR\ 2.00RG SAPCAR archive data 327# Disintegrator 3280 string DST Disintegrator archive data 329# ASD 3300 string ASD ASD archive data 331# InstallShield CAB 3320 string ISc( InstallShield CAB 333# TOP4 3340 string T4\x1a TOP4 archive data 335# BatComp left out: sig looks like COM executable 336# so TODO: get real 4dos batcomp file and find sig 337# BlakHole 3380 string BH\5\7 BlakHole archive data 339# BIX 3400 string BIX0 BIX archive data 341# ChiefLZA 3420 string ChfLZ ChiefLZA archive data 343# Blink 3440 string Blink Blink archive data 345# Logitech Compress 3460 string \xda\xfa Logitech Compress archive data 347# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 3481 string (C)\ STEPANYUK ARS-Sfx archive data 349# AKT/AKT32 3500 string AKT32 AKT32 archive data 3510 string AKT AKT archive data 352# NPack 3530 string MSTSM NPack archive data 354# PFT 3550 string \0\x50\0\x14 PFT archive data 356# SemOne 3570 string SEM SemOne archive data 358# PPMD 3590 string \x8f\xaf\xac\x84 PPMD archive data 360# FIZ 3610 string FIZ FIZ archive data 362# MSXiE 3630 belong&0xfffff0f0 0x4d530000 MSXiE archive data 364# DeepFreezer 3650 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 366# DC 3670 string =<DC- DC archive data 368# TPac 3690 string \4TPAC\3 TPac archive data 370# Ai 3710 string Ai\1\1\0 Ai archive data 3720 string Ai\1\0\0 Ai archive data 373# Ai32 3740 string Ai\2\0 Ai32 archive data 3750 string Ai\2\1 Ai32 archive data 376# SBC 3770 string SBC SBC archive data 378# Ybs 3790 string YBS Ybs archive data 380# DitPack 3810 string \x9e\0\0 DitPack archive data 382# DMS 3830 string DMS! DMS archive data 384# EPC 3850 string \x8f\xaf\xac\x8c EPC archive data 386# VSARC 3870 string VS\x1a VSARC archive data 388# PDZ 3890 string PDZ PDZ archive data 390# ReDuq 3910 string rdqx ReDuq archive data 392# GCA 3930 string GCAX GCA archive data 394# PPMN 3950 string pN PPMN archive data 396# WinImage 3973 string WINIMAGE WinImage archive data 398# Compressia 3990 string CMP0CMP Compressia archive data 400# UHBC 4010 string UHB UHBC archive data 402# WinHKI 4030 string \x61\x5C\x04\x05 WinHKI archive data 404# WWPack data file 4050 string WWP WWPack archive data 406# BSN (BSA, PTS-DOS) 4070 string \xffBSG BSN archive data 4081 string \xffBSG BSN archive data 4093 string \xffBSG BSN archive data 4101 string \0\xae\2 BSN archive data 4111 string \0\xae\3 BSN archive data 4121 string \0\xae\7 BSN archive data 413# AIN 4140 string \x33\x18 AIN archive data 4150 string \x33\x17 AIN archive data 416# XPA32 4170 string xpa\0\1 XPA32 archive data 418# SZip (TODO: doesn't catch all versions) 4190 string SZ\x0a\4 SZip archive data 420# XPack DiskImage 4210 string jm XPack DiskImage archive data 422# XPack Data 4230 string xpa XPack archive data 424# XPack Single Data 4250 string Í\ jm XPack single archive data 426 427# TODO: missing due to unknown magic/magic at end of file: 428#DWC 429#ARG 430#ZAR 431#PC/3270 432#InstallIt 433#RKive 434#RK 435#XPack Diskimage 436 437# These were inspired by idarc, but actually verified 438# Dzip archiver (.dz) 4390 string DZ Dzip archive data 440>2 byte x \b, version %i 441>3 byte x \b.%i 442# ZZip archiver (.zz) 4430 string ZZ\ \0\0 ZZip archive data 4440 string ZZ0 ZZip archive data 445# PAQ archiver (.paq) 4460 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 4470 string PAQ PAQ archive data 448>3 byte&0xf0 0x30 449>>3 byte x (v%c) 450# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 4510xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 4520 string JARCS JAR (ARJ Software, Inc.) archive data 453 454# ARJ archiver (jason@jarthur.Claremont.EDU) 4550 leshort 0xea60 ARJ archive data 456!:mime application/x-arj 457>5 byte x \b, v%d, 458>8 byte &0x04 multi-volume, 459>8 byte &0x10 slash-switched, 460>8 byte &0x20 backup, 461>34 string x original name: %s, 462>7 byte 0 os: MS-DOS 463>7 byte 1 os: PRIMOS 464>7 byte 2 os: Unix 465>7 byte 3 os: Amiga 466>7 byte 4 os: Macintosh 467>7 byte 5 os: OS/2 468>7 byte 6 os: Apple ][ GS 469>7 byte 7 os: Atari ST 470>7 byte 8 os: NeXT 471>7 byte 9 os: VAX/VMS 472>3 byte >0 %d] 473# [JW] idarc says this is also possible 4742 leshort 0xea60 ARJ archive data 475 476# HA archiver (Greg Roelofs, newt@uchicago.edu) 477# This is a really bad format. A file containing HAWAII will match this... 478#0 string HA HA archive data, 479#>2 leshort =1 1 file, 480#>2 leshort >1 %u files, 481#>4 byte&0x0f =0 first is type CPY 482#>4 byte&0x0f =1 first is type ASC 483#>4 byte&0x0f =2 first is type HSC 484#>4 byte&0x0f =0x0e first is type DIR 485#>4 byte&0x0f =0x0f first is type SPECIAL 486# suggestion: at least identify small archives (<1024 files) 4870 belong&0xffff00fc 0x48410000 HA archive data 488>2 leshort =1 1 file, 489>2 leshort >1 %u files, 490>4 byte&0x0f =0 first is type CPY 491>4 byte&0x0f =1 first is type ASC 492>4 byte&0x0f =2 first is type HSC 493>4 byte&0x0f =0x0e first is type DIR 494>4 byte&0x0f =0x0f first is type SPECIAL 495 496# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 4970 string HPAK HPACK archive data 498 499# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 5000 string \351,\001JAM\ JAM archive, 501>7 string >\0 version %.4s 502>0x26 byte =0x27 - 503>>0x2b string >\0 label %.11s, 504>>0x27 lelong x serial %08x, 505>>0x36 string >\0 fstype %.8s 506 507# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 5082 string -lh0- LHarc 1.x/ARX archive data [lh0] 509!:mime application/x-lharc 5102 string -lh1- LHarc 1.x/ARX archive data [lh1] 511!:mime application/x-lharc 5122 string -lz4- LHarc 1.x archive data [lz4] 513!:mime application/x-lharc 5142 string -lz5- LHarc 1.x archive data [lz5] 515!:mime application/x-lharc 516# [never seen any but the last; -lh4- reported in comp.compression:] 5172 string -lzs- LHa/LZS archive data [lzs] 518!:mime application/x-lha 5192 string -lh\40- LHa 2.x? archive data [lh ] 520!:mime application/x-lha 5212 string -lhd- LHa 2.x? archive data [lhd] 522!:mime application/x-lha 5232 string -lh2- LHa 2.x? archive data [lh2] 524!:mime application/x-lha 5252 string -lh3- LHa 2.x? archive data [lh3] 526!:mime application/x-lha 5272 string -lh4- LHa (2.x) archive data [lh4] 528!:mime application/x-lha 5292 string -lh5- LHa (2.x) archive data [lh5] 530!:mime application/x-lha 5312 string -lh6- LHa (2.x) archive data [lh6] 532!:mime application/x-lha 5332 string -lh7- LHa (2.x)/LHark archive data [lh7] 534!:mime application/x-lha 535>20 byte x - header level %d 536# taken from idarc [JW] 5372 string -lZ PUT archive data 5382 string -lz LZS archive data 5392 string -sw1- Swag archive data 540 541# RAR archiver (Greg Roelofs, newt@uchicago.edu) 5420 string Rar! RAR archive data, 543!:mime application/x-rar 544>44 byte x v%0x, 545>10 byte >0 flags: 546>>10 byte &0x01 Archive volume, 547>>10 byte &0x02 Commented, 548>>10 byte &0x04 Locked, 549>>10 byte &0x08 Solid, 550>>10 byte &0x20 Authenticated, 551>35 byte 0 os: MS-DOS 552>35 byte 1 os: OS/2 553>35 byte 2 os: Win32 554>35 byte 3 os: Unix 555# some old version? idarc says: 5560 string RE\x7e\x5e RAR archive data 557 558# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 5590 string SQSH squished archive data (Acorn RISCOS) 560 561# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 562# [JW] see exe section for self-extracting version 5630 string UC2\x1a UC2 archive data 564 565# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 5660 string PK\003\004 567>4 byte 0x00 Zip archive data 568!:mime application/zip 569>4 byte 0x09 Zip archive data, at least v0.9 to extract 570!:mime application/zip 571>4 byte 0x0a Zip archive data, at least v1.0 to extract 572!:mime application/zip 573>4 byte 0x0b Zip archive data, at least v1.1 to extract 574!:mime application/zip 575>0x161 string WINZIP Zip archive data, WinZIP self-extracting 576!:mime application/zip 577>4 byte 0x14 578>>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract 579!:mime application/zip 580 581# OpenOffice.org / KOffice / StarOffice documents 582# From: Abel Cheung <abel@oaka.org> 583# Listed here because they are basically zip files 584>>30 string mimetype 585 586# KOffice (1.2 or above) formats 587>>>50 string vnd.kde. KOffice (>=1.2) 588>>>>58 string karbon Karbon document 589>>>>58 string kchart KChart document 590>>>>58 string kformula KFormula document 591>>>>58 string kivio Kivio document 592>>>>58 string kontour Kontour document 593>>>>58 string kpresenter KPresenter document 594>>>>58 string kspread KSpread document 595>>>>58 string kword KWord document 596 597# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 598>>>50 string vnd.sun.xml. OpenOffice.org 1.x 599>>>>62 string writer Writer 600>>>>>68 byte !0x2e document 601>>>>>68 string .template template 602>>>>>68 string .global global document 603>>>>62 string calc Calc 604>>>>>66 byte !0x2e spreadsheet 605>>>>>66 string .template template 606>>>>62 string draw Draw 607>>>>>66 byte !0x2e document 608>>>>>66 string .template template 609>>>>62 string impress Impress 610>>>>>69 byte !0x2e presentation 611>>>>>69 string .template template 612>>>>62 string math Math document 613 614# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 615# http://lists.oasis-open.org/archives/office/200505/msg00006.html 616>>>50 string vnd.oasis.opendocument. OpenDocument 617>>>>73 string text 618>>>>>77 byte !0x2d Text 619!:mime application/vnd.oasis.opendocument.text 620>>>>>77 string -template Text Template 621>>>>>77 string -web HTML Document Template 622>>>>>77 string -master Master Document 623>>>>73 string graphics Drawing 624>>>>>81 string -template Template 625>>>>73 string presentation Presentation 626>>>>>85 string -template Template 627>>>>73 string spreadsheet Spreadsheet 628>>>>>84 string -template Template 629>>>>73 string chart Chart 630>>>>>78 string -template Template 631>>>>73 string formula Formula 632>>>>>80 string -template Template 633>>>>73 string database Database 634>>>>73 string image Image 635 636# Zoo archiver 63720 lelong 0xfdc4a7dc Zoo archive data 638!:mime application/x-zoo 639>4 byte >48 \b, v%c. 640>>6 byte >47 \b%c 641>>>7 byte >47 \b%c 642>32 byte >0 \b, modify: v%d 643>>33 byte x \b.%d+ 644>42 lelong 0xfdc4a7dc \b, 645>>70 byte >0 extract: v%d 646>>>71 byte x \b.%d+ 647 648# Shell archives 64910 string #\ This\ is\ a\ shell\ archive shell archive text 650!:mime application/octet-stream 651 652# 653# LBR. NB: May conflict with the questionable 654# "binary Computer Graphics Metafile" format. 655# 6560 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 657# 658# PMA (CP/M derivative of LHA) 659# 6602 string -pm0- PMarc archive data [pm0] 6612 string -pm1- PMarc archive data [pm1] 6622 string -pm2- PMarc archive data [pm2] 6632 string -pms- PMarc SFX archive (CP/M, DOS) 6645 string -pc1- PopCom compressed executable (CP/M) 665 666# From Rafael Laboissiere <rafael@laboissiere.net> 667# The Project Revision Control System (see 668# http://prcs.sourceforge.net) generates a packaged project 669# file which is recognized by the following entry: 6700 leshort 0xeb81 PRCS packaged project 671 672# Microsoft cabinets 673# by David Necas (Yeti) <yeti@physics.muni.cz> 674#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 675#>25 byte x v%d 676#>24 byte x \b.%d 677# MPi: All CABs have version 1.3, so this is pointless. 678# Better magic in debian-additions. 679 680# GTKtalog catalogs 681# by David Necas (Yeti) <yeti@physics.muni.cz> 6824 string gtktalog\ GTKtalog catalog data, 683>13 string 3 version 3 684>>14 beshort 0x677a (gzipped) 685>>14 beshort !0x677a (not gzipped) 686>13 string >3 version %s 687 688############################################################################ 689# Parity archive reconstruction file, the 'par' file format now used on Usenet. 6900 string PAR\0 PARity archive data 691>48 leshort =0 - Index file 692>48 leshort >0 - file number %d 693 694# Felix von Leitner <felix-file@fefe.de> 6950 string d8:announce BitTorrent file 696!:mime application/x-bittorrent 697 698# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 6990 beshort 0x0e0f Atari MSA archive data 700>2 beshort x \b, %d sectors per track 701>4 beshort 0 \b, 1 sided 702>4 beshort 1 \b, 2 sided 703>6 beshort x \b, starting track: %d 704>8 beshort x \b, ending track: %d 705 706# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 7070 string PK00PK\003\004 Zip archive data 708 709# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 710# by Stefan `Sec` Zehl <sec@42.org> 7117 string **ACE** ACE archive data 712>15 byte >0 version %d 713>16 byte =0x00 \b, from MS-DOS 714>16 byte =0x01 \b, from OS/2 715>16 byte =0x02 \b, from Win/32 716>16 byte =0x03 \b, from Unix 717>16 byte =0x04 \b, from MacOS 718>16 byte =0x05 \b, from WinNT 719>16 byte =0x06 \b, from Primos 720>16 byte =0x07 \b, from AppleGS 721>16 byte =0x08 \b, from Atari 722>16 byte =0x09 \b, from Vax/VMS 723>16 byte =0x0A \b, from Amiga 724>16 byte =0x0B \b, from Next 725>14 byte x \b, version %d to extract 726>5 leshort &0x0080 \b, multiple volumes, 727>>17 byte x \b (part %d), 728>5 leshort &0x0002 \b, contains comment 729>5 leshort &0x0200 \b, sfx 730>5 leshort &0x0400 \b, small dictionary 731>5 leshort &0x0800 \b, multi-volume 732>5 leshort &0x1000 \b, contains AV-String 733>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 734>5 leshort &0x2000 \b, with recovery record 735>5 leshort &0x4000 \b, locked 736>5 leshort &0x8000 \b, solid 737# Date in MS-DOS format (whatever that is) 738#>18 lelong x Created on 739 740# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 741# <doj@cubic.org> 7420x1A string sfArk sfArk compressed Soundfont 743>0x15 string 2 744>>0x1 string >\0 Version %s 745>>0x2A string >\0 : %s 746 747# DR-DOS 7.03 Packed File *.??_ 7480 string Packed\ File\ Personal NetWare Packed File 749>12 string x \b, was "%.12s" 750 751# EET archive 752# From: Tilman Sauerbeck <tilman@code-monkey.de> 7530 belong 0x1ee7ff00 EET archive 754!:mime application/x-eet 755 756# rzip archives 7570 string RZIP rzip compressed data 758>4 byte x - version %d 759>5 byte x \b.%d 760>6 belong x (%d bytes) 761 762# From: "Robert Dale" <robdale@gmail.com> 7630 belong 123 dar archive, 764>4 belong x label "%.8x 765>>8 belong x %.8x 766>>>12 beshort x %.4x" 767>14 byte 0x54 end slice 768>14 beshort 0x4e4e multi-part 769>14 beshort 0x4e53 multi-part, with -S 770 771# Symbian installation files 772# http://www.thouky.co.uk/software/psifs/sis.html 773# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 7748 lelong 0x10000419 Symbian installation file 775!:mime application/vnd.symbian.install 776>4 lelong 0x1000006D (EPOC release 3/4/5) 777>4 lelong 0x10003A12 (EPOC release 6) 7780 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 779!:mime x-epoc/x-sisx-app 780 781# Pack200 Java archives, http://jcp.org/en/jsr/detail?id=200 7820 belong 0xcafed00d Pack200 Java archive 783 784# From "Nelson A. de Oliveira" <naoliv@gmail.com> 7850 string MPQ\032 MoPaQ (MPQ) archive 786 787# From: Dirk Jagdmann <doj@cubic.org> 788# xar archive format: http://code.google.com/p/xar/ 7890 string xar! xar archive 790>6 beshort x - version %ld 791 792# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 793# .kgb 7940 string KGB_arch KGB Archiver file 795>10 string x with compression level %.1s 796 797# xar (eXtensible ARchiver) archive 798# From: "David Remahl" <dremahl@apple.com> 7990 string xar! xar archive 800#>4 beshort x header size %d 801>6 beshort x version %d, 802#>8 quad x compressed TOC: %d, 803#>16 quad x uncompressed TOC: %d, 804>24 belong 0 no checksum 805>24 belong 1 SHA-1 checksum 806>24 belong 2 MD5 checksum 807 808