1# $OpenBSD: filesystems,v 1.5 2009/12/23 02:24:39 krw Exp $ 2 3#------------------------------------------------------------------------------ 4# filesystems: file(1) magic for different filesystems 5# 6#0 string \366\366\366\366 PC formatted floppy with no filesystem 7## Sun disk labels 8## From /usr/include/sun/dklabel.h: 9#0774 beshort 0xdabe 10## modified by Joerg Jenderek, because original test 11## succeeds for Cabinet archive dao360.dl_ with negative blocks 12#>0770 long >0 Sun disk label 13#>>0 string x '%s 14#>>>31 string >\0 \b%s 15#>>>>63 string >\0 \b%s 16#>>>>>95 string >\0 \b%s 17#>>0 string x \b' 18#>>0734 short >0 %d rpm, 19#>>0736 short >0 %d phys cys, 20#>>0740 short >0 %d alts/cyl, 21#>>0746 short >0 %d interleave, 22#>>0750 short >0 %d data cyls, 23#>>0752 short >0 %d alt cyls, 24#>>0754 short >0 %d heads/partition, 25#>>0756 short >0 %d sectors/track, 26#>>0764 long >0 start cyl %ld, 27#>>0770 long x %ld blocks 28## Is there a boot block written 1 sector in? 29#>512 belong&077777777 0600407 \b, boot block present 30## Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc 31## (http://btmgr.sourceforge.net/docs/user-guide-3.html) 32#0 string SBMBAKUP_ Smart Boot Manager backup file 33#>9 string x \b, version %-5.5s 34#>>14 string =_ 35#>>>15 string x %-.1s 36#>>>>16 string =_ \b. 37#>>>>>17 string x \b%-.1s 38#>>>>>>18 string =_ \b. 39#>>>>>>>19 string x \b%-.1s 40#>>>22 ubyte 0 41#>>>>21 ubyte x \b, from drive 0x%x 42#>>>22 ubyte >0 43#>>>>21 string x \b, from drive %s 44 45# Joerg Jenderek 46# DOS Emulator image is 128 byte, null right padded header + harddisc image 470 string DOSEMU\0 48>0x27E leshort 0xAA55 49#offset is 128 50>>19 ubyte 128 51>>>(19.b-1) ubyte 0x0 DOS Emulator image 52>>>>7 ulelong >0 \b, %u heads 53>>>>11 ulelong >0 \b, %d sectors/track 54>>>>15 ulelong >0 \b, %d cylinders 55 56# updated by Joerg Jenderek at Sep 2007 57# only for sector sizes with 512 or more Bytes 580x1FE leshort 0xAA55 x86 boot sector 59# to do also for sectors < than 512 Bytes and some other files, GRR 60#30 search/481 \x55\xAA x86 boot sector 61# not for BeOS floppy 1440k, MBRs 62#(11.s-2) uleshort 0xAA55 x86 boot sector 63>2 string OSBS \b, OS/BS MBR 64# J\xf6rg Jenderek <joerg dot jenderek at web dot de> 65>0x8C string Invalid\ partition\ table \b, MS-DOS MBR 66# dr-dos with some upper-, lowercase variants 67>0x9D string Invalid\ partition\ table$ 68>>181 string No\ Operating\ System$ 69>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 70>0x9D string Invalid\ partition\ table$ 71>>181 string No\ operating\ system$ 72>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 73>342 string Invalid\ partition\ table$ 74>>366 string No\ operating\ system$ 75>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 76>295 string NEWLDR\0 77>>302 string Bad\ PT\ $ 78>>>310 string No\ OS\ $ 79>>>>317 string OS\ load\ err$ 80>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 81>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 82>>>>>>>387 string Copyright\ (c)\ 1984,1998 83>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 84>0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222 85>>0x1B8 ubelong >0 \b, Serial 0x%-.4x 86>0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950 87>271 string Invalid\ partition\ table\0 88>>295 string Error\ loading\ operating\ system\0 89>>>326 string Missing\ operating\ system\0 \b, mbr 90# 91>139 string Invalid\ partition\ table\0 92>>163 string Error\ loading\ operating\ system\0 93>>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr 94# http://www.heise.de/ct/05/09/006/ page 184 95#HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes 96>>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x 97>300 string Invalid\ partition\ table\0 98>>324 string Error\ loading\ operating\ system\0 99>>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR 100#??>>>389 string Invalid\ system\ disk 101>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x 102>300 string Ung\201ltige\ Partitionstabelle 103#split string to avoid error: String too long 104>>328 string Fehler\ beim\ Laden\ 105>>>346 string des\ Betriebssystems 106>>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german) 107>>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x 108>0x145 string Default:\ F \b, FREE-DOS MBR 109>64 string no\ active\ partition\ found 110>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 111>271 string Operating\ system\ loading 112>>296 string error\r \b, SYSLINUX MBR (2.10) 113# http://www.acronis.de/ 114>362 string MBR\ Error\ \0\r 115>>376 string ress\ any\ key\ to\ 116>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 117# added by Joerg Jenderek 118# http://www.visopsys.org/ 119# http://partitionlogic.org.uk/ 120>309 string No\ bootable\ partition\ found\r 121>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 122>349 string No\ bootable\ partition\ found\r 123>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 124# bootloader, bootmanager 125>0x40 string SBML 126# label with 11 characters of FAT 12 bit filesystem 127>>43 string SMART\ BTMGR 128>>>430 string SBMK\ Bad!\r 129>>>>3 string SBM \b, Smart Boot Manager 130>>>>>6 string >\0 \b, version %s 131>382 string XOSLLOADXCF \b, eXtended Operating System Loader 132>6 string LILO \b, LInux i386 boot LOader 133>>120 string LILO \b, version 22.3.4 SuSe 134>>172 string LILO \b, version 22.5.8 Debian 135# updated by Joerg Jenderek 136# variables according to grub-0.97/stage1/stage1.S or 137# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 138# usual values are marked with comments to get only informations of strange GRUB loaders 139>0 ulelong 0x009048EB 140>>0x41 ubyte <2 141>>>0x3E ubyte >2 \b; GRand Unified Bootloader 142# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 143>>>>0x3E ubyte x \b, stage1 version 0x%x 144#If it is 0xFF, use a drive passed by BIOS 145>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 146# in most case 0,1,0x2e for GRUB 0.5.95 147>>>>0x41 ubyte >0 \b, LBA flag 0x%x 148>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 149#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 150>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 151#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 152>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 153>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 154#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 155>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 156>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 157>>>>>394 string stage1 \b, GRUB version 0.5.95 158>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 159>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 160>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 161>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 162>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 163>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 164>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 165>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 166#unknown version 167>>>343 string Geom\0Read\0\ Error\0 168>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 169>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 170>>>>374 string GRUB\ \0 \b, GRUB version n.m 171# http://syslinux.zytor.com/ 172>478 string Boot\ failed\r 173>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62) 174>480 string Boot\ failed\r 175>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11) 176>484 string Boot\ error\r \b, SYSLINUX bootloader (3.11) 177>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 178# http://www.bcdwb.de/bcdw/index_e.htm 179>3 string BCDL 180>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 181# mbr partition table entries 182# OEM-ID not Microsoft,SYSLINUX,or MTOOLs 183>3 string !MS 184>>3 string !SYSLINUX 185>>>3 string !MTOOL 186# not FAT (32 bit) 187>>>>82 string !FAT32 188#not IO.SYS 189>>>>>472 string !IO\ \ \ \ \ \ SYS 190>>>>>>480 string !IO\ \ \ \ \ \ SYS 191#not Linux kernel 192>>>>>>>514 string !HdrS 193#not BeOS 194>>>>>>>>422 string !Be\ Boot\ Loader 195# active flag 0 or 0x80 and type > 0 196>>>>>>>>>446 ubyte <0x81 197>>>>>>>>>>446 ubyte&0x7F 0 198>>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x 199>>>>>>>>>>>>446 ubyte 0x80 \b, active 200>>>>>>>>>>>>447 ubyte x \b, starthead %u 201#>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x 202#>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d 203>>>>>>>>>>>>454 ulelong x \b, startsector %u 204>>>>>>>>>>>>458 ulelong x \b, %u sectors 205# 206>>>>>>>>>462 ubyte <0x81 207>>>>>>>>>>462 ubyte&0x7F 0 208>>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x 209>>>>>>>>>>>>462 ubyte 0x80 \b, active 210>>>>>>>>>>>>463 ubyte x \b, starthead %u 211#>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x 212#>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d 213>>>>>>>>>>>>470 ulelong x \b, startsector %u 214>>>>>>>>>>>>474 ulelong x \b, %u sectors 215# 216>>>>>>>>>478 ubyte <0x81 217>>>>>>>>>>478 ubyte&0x7F 0 218>>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x 219>>>>>>>>>>>>478 ubyte 0x80 \b, active 220>>>>>>>>>>>>479 ubyte x \b, starthead %u 221#>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x 222#>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x 223#>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d 224>>>>>>>>>>>>486 ulelong x \b, startsector %u 225>>>>>>>>>>>>490 ulelong x \b, %u sectors 226# 227>>>>>>>>>494 ubyte <0x81 228>>>>>>>>>>494 ubyte&0x7F 0 229>>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x 230>>>>>>>>>>>>494 ubyte 0x80 \b, active 231>>>>>>>>>>>>495 ubyte x \b, starthead %u 232#>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x 233#>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d 234>>>>>>>>>>>>502 ulelong x \b, startsector %u 235>>>>>>>>>>>>506 ulelong x \b, %u sectors 236# mbr partition table entries end 237# http://www.acronis.de/ 238#FAT label=ACRONIS\ SZ 239#OEM-ID=BOOTWIZ0 240>442 string Non-system\ disk,\ 241>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 242# DOS names like F11.SYS are 8 right space padded bytes+3 bytes 243>>>477 ubyte&0xDF >0 244>>>>477 string x \b %-.3s 245>>>>>480 ubyte&0xDF >0 246>>>>>>480 string x \b%-.5s 247>>>>485 ubyte&0xDF >0 248>>>>>485 string x \b.%-.3s 249# 250>185 string FDBOOT\ Version\ 251>>204 string \rNo\ Systemdisk.\ 252>>>220 string Booting\ from\ harddisk.\n\r 253>>>245 string Cannot\ load\ from\ harddisk.\n\r 254>>>>273 string Insert\ Systemdisk\ 255>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 256>>>>>>200 string >\0 \b, version %-3s 257>242 string Bootsector\ from\ C.H.\ Hochst\204 258>>278 string No\ Systemdisk.\ 259>>>293 string Booting\ from\ harddisk.\n\r 260>>>441 string Cannot\ load\ from\ harddisk.\n\r 261>>>>469 string Insert\ Systemdisk\ 262>>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader 263>>>>>>209 string >\0 \b, version %-4.4s 264>(1.b+2) ubyte 0xe 265>>(1.b+3) ubyte 0x1f 266>>>(1.b+4) ubyte 0xbe 267>>>>(1.b+5) ubyte 0x77 268>>>>(1.b+6) ubyte 0x7c 269>>>>>(1.b+7) ubyte 0xac 270>>>>>>(1.b+8) ubyte 0x22 271>>>>>>>(1.b+9) ubyte 0xc0 272>>>>>>>>(1.b+10) ubyte 0x74 273>>>>>>>>>(1.b+11) ubyte 0xb 274>>>>>>>>>>(1.b+12) ubyte 0x56 275>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 276>103 string This\ is\ not\ a\ bootable\ disk.\ 277>>132 string Please\ insert\ a\ bootable\ 278>>>157 string floppy\ and\r\n 279>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 280# 281>66 string Solaris\ Boot\ Sector 282>>99 string Incomplete\ MDBoot\ load. 283>>>89 string Version \b, Sun Solaris Bootloader 284>>>>97 byte x version %c 285# 286>408 string OS/2\ !!\ SYS01475\r\0 287>>429 string OS/2\ !!\ SYS02025\r\0 288>>>450 string OS/2\ !!\ SYS02027\r\0 289>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 290# 291>409 string OS/2\ !!\ SYS01475\r\0 292>>430 string OS/2\ !!\ SYS02025\r\0 293>>>451 string OS/2\ !!\ SYS02027\r\0 294>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 295>112 string This\ disk\ is\ not\ bootable\r 296>>142 string If\ you\ wish\ to\ make\ it\ bootable 297>>>176 string run\ the\ DOS\ program\ SYS\ 298>>>200 string after\ the\r 299>>>>216 string system\ has\ been\ loaded\r\n 300>>>>>242 string Please\ insert\ a\ DOS\ diskette\ 301>>>>>271 string into\r\n\ the\ drive\ and\ 302>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 303# XP 304>430 string NTLDR\ is\ missing\xFF\r\n 305>>449 string Disk\ error\xFF\r\n 306>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 307# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 308>>>>417 ubyte&0xDF >0 309>>>>>417 string x %-.5s 310>>>>>>422 ubyte&0xDF >0 311>>>>>>>422 string x \b%-.3s 312>>>>>425 ubyte&0xDF >0 313>>>>>>425 string >\ \b.%-.3s 314# 315>>>>371 ubyte >0x20 316>>>>>368 ubyte&0xDF >0 317>>>>>>368 string x %-.5s 318>>>>>>>373 ubyte&0xDF >0 319>>>>>>>>373 string x \b%-.3s 320>>>>>>376 ubyte&0xDF >0 321>>>>>>>376 string x \b.%-.3s 322# 323>430 string NTLDR\ nicht\ gefunden\xFF\r\n 324>>453 string Datentr\204gerfehler\xFF\r\n 325>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 326>>>>417 ubyte&0xDF >0 327>>>>>417 string x %-.5s 328>>>>>>422 ubyte&0xDF >0 329>>>>>>>422 string x \b%-.3s 330>>>>>425 ubyte&0xDF >0 331>>>>>>425 string >\ \b.%-.3s 332# offset variant 333>>>>379 string \0 334>>>>>368 ubyte&0xDF >0 335>>>>>>368 string x %-.5s 336>>>>>>>373 ubyte&0xDF >0 337>>>>>>>>373 string x \b%-.3s 338# 339>430 string NTLDR\ fehlt\xFF\r\n 340>>444 string Datentr\204gerfehler\xFF\r\n 341>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 342>>>>417 ubyte&0xDF >0 343>>>>>417 string x %-.5s 344>>>>>>422 ubyte&0xDF >0 345>>>>>>>422 string x \b%-.3s 346>>>>>425 ubyte&0xDF >0 347>>>>>>425 string >\ \b.%-.3s 348# variant 349>>>>371 ubyte >0x20 350>>>>>368 ubyte&0xDF >0 351>>>>>>368 string x %-.5s 352>>>>>>>373 ubyte&0xDF >0 353>>>>>>>>373 string x \b%-.3s 354>>>>>>376 ubyte&0xDF >0 355>>>>>>>376 string x \b.%-.3s 356# 357>430 string NTLDR\ fehlt\xFF\r\n 358>>444 string Medienfehler\xFF\r\n 359>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 360>>>>371 ubyte >0x20 361>>>>>368 ubyte&0xDF >0 362>>>>>>368 string x %-.5s 363>>>>>>>373 ubyte&0xDF >0 364>>>>>>>>373 string x \b%-.3s 365>>>>>>376 ubyte&0xDF >0 366>>>>>>>376 string x \b.%-.3s 367# variant 368>>>>417 ubyte&0xDF >0 369>>>>>417 string x %-.5s 370>>>>>>422 ubyte&0xDF >0 371>>>>>>>422 string x \b%-.3s 372>>>>>425 ubyte&0xDF >0 373>>>>>>425 string >\ \b.%-.3s 374# 375>430 string Datentr\204ger\ entfernen\xFF\r\n 376>>454 string Medienfehler\xFF\r\n 377>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 378>>>>368 ubyte&0xDF >0 379>>>>>368 string x %-.5s 380>>>>>>373 ubyte&0xDF >0 381>>>>>>>373 string x \b%-.3s 382>>>>>376 ubyte&0xDF >0 383>>>>>>376 string x \b.%-.3s 384#>3 string NTFS\ \ \ \ 385>389 string Fehler\ beim\ Lesen\ 386>>407 string des\ Datentr\204gers 387>>>426 string NTLDR\ fehlt 388>>>>440 string NTLDR\ ist\ komprimiert 389>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 390#>3 string NTFS\ \ \ \ 391>313 string A\ disk\ read\ error\ occurred.\r 392>>345 string A\ kernel\ file\ is\ missing\ 393>>>370 string from\ the\ disk.\r 394>>>>484 string NTLDR\ is\ compressed 395>>>>>429 string Insert\ a\ system\ diskette\ 396>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 397# DOS loader variants different languages,offsets 398>472 ubyte&0xDF >0 399>>389 string Invalid\ system\ disk\xFF\r\n 400>>>411 string Disk\ I/O\ error 401>>>>428 string Replace\ the\ disk,\ and\ 402>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 403#IO.SYS 404>>>>>>472 ubyte&0xDF >0 405>>>>>>>472 string x \b %-.2s 406>>>>>>>>474 ubyte&0xDF >0 407>>>>>>>>>474 string x \b%-.5s 408>>>>>>>>>>479 ubyte&0xDF >0 409>>>>>>>>>>>479 string x \b%-.1s 410>>>>>>>480 ubyte&0xDF >0 411>>>>>>>>480 string x \b.%-.3s 412#MSDOS.SYS 413>>>>>>>483 ubyte&0xDF >0 \b+ 414>>>>>>>>483 string x \b%-.5s 415>>>>>>>>>488 ubyte&0xDF >0 416>>>>>>>>>>488 string x \b%-.3s 417>>>>>>>>491 ubyte&0xDF >0 418>>>>>>>>>491 string x \b.%-.3s 419# 420>>390 string Invalid\ system\ disk\xFF\r\n 421>>>412 string Disk\ I/O\ error\xFF\r\n 422>>>>429 string Replace\ the\ disk,\ and\ 423>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 424>>388 string Ungueltiges\ System\ \xFF\r\n 425>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 426>>>>427 string Datentraeger\ wechseln\ und\ 427>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 428#WINBOOT.SYS only not spaces (0xDF) 429>>>>>>497 ubyte&0xDF >0 430>>>>>>>497 string x %-.5s 431>>>>>>>>502 ubyte&0xDF >0 432>>>>>>>>>502 string x \b%-.1s 433>>>>>>>>>>503 ubyte&0xDF >0 434>>>>>>>>>>>503 string x \b%-.1s 435>>>>>>>>>>>>504 ubyte&0xDF >0 436>>>>>>>>>>>>>504 string x \b%-.1s 437>>>>>>505 ubyte&0xDF >0 438>>>>>>>505 string x \b.%-.3s 439#IO.SYS 440>>>>>>472 ubyte&0xDF >0 or 441>>>>>>>472 string x \b %-.2s 442>>>>>>>>474 ubyte&0xDF >0 443>>>>>>>>>474 string x \b%-.5s 444>>>>>>>>>>479 ubyte&0xDF >0 445>>>>>>>>>>>479 string x \b%-.1s 446>>>>>>>480 ubyte&0xDF >0 447>>>>>>>>480 string x \b.%-.3s 448#MSDOS.SYS 449>>>>>>>483 ubyte&0xDF >0 \b+ 450>>>>>>>>483 string x \b%-.5s 451>>>>>>>>>488 ubyte&0xDF >0 452>>>>>>>>>>488 string x \b%-.3s 453>>>>>>>>491 ubyte&0xDF >0 454>>>>>>>>>491 string x \b.%-.3s 455# 456>>390 string Ungueltiges\ System\ \xFF\r\n 457>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 458>>>>429 string Datentraeger\ wechseln\ und\ 459>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 460#WINBOOT.SYS only not spaces (0xDF) 461>>>>>>497 ubyte&0xDF >0 462>>>>>>>497 string x %-.7s 463>>>>>>>>504 ubyte&0xDF >0 464>>>>>>>>>504 string x \b%-.1s 465>>>>>>505 ubyte&0xDF >0 466>>>>>>>505 string x \b.%-.3s 467#IO.SYS 468>>>>>>472 ubyte&0xDF >0 or 469>>>>>>>472 string x \b %-.2s 470>>>>>>>>474 ubyte&0xDF >0 471>>>>>>>>>474 string x \b%-.6s 472>>>>>>>480 ubyte&0xDF >0 473>>>>>>>>480 string x \b.%-.3s 474#MSDOS.SYS 475>>>>>>>483 ubyte&0xDF >0 \b+ 476>>>>>>>>483 string x \b%-.5s 477>>>>>>>>>488 ubyte&0xDF >0 478>>>>>>>>>>488 string x \b%-.3s 479>>>>>>>>491 ubyte&0xDF >0 480>>>>>>>>>491 string x \b.%-.3s 481# 482>>389 string Ungueltiges\ System\ \xFF\r\n 483>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 484>>>>428 string Datentraeger\ wechseln\ und\ 485>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 486# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 487>>>>>>472 string x %-.2s 488>>>>>>>474 ubyte&0xDF >0 489>>>>>>>>474 string x \b%-.5s 490>>>>>>>>479 ubyte&0xDF >0 491>>>>>>>>>479 string x \b%-.1s 492>>>>>>480 ubyte&0xDF >0 493>>>>>>>480 string x \b.%-.3s 494>>>>>>483 ubyte&0xDF >0 \b+ 495>>>>>>>483 string x \b%-.5s 496>>>>>>>488 ubyte&0xDF >0 497>>>>>>>>488 string x \b%-.2s 498>>>>>>>>490 ubyte&0xDF >0 499>>>>>>>>>490 string x \b%-.1s 500>>>>>>>491 ubyte&0xDF >0 501>>>>>>>>491 string x \b.%-.3s 502>479 ubyte&0xDF >0 503>>416 string Kein\ System\ oder\ 504>>>433 string Laufwerksfehler 505>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 506#IO.SYS 507>>>>>479 string x \b %-.2s 508>>>>>>481 ubyte&0xDF >0 509>>>>>>>481 string x \b%-.6s 510>>>>>487 ubyte&0xDF >0 511>>>>>>487 string x \b.%-.3s 512#MSDOS.SYS 513>>>>>>490 ubyte&0xDF >0 \b+ 514>>>>>>>490 string x \b%-.5s 515>>>>>>>>495 ubyte&0xDF >0 516>>>>>>>>>495 string x \b%-.3s 517>>>>>>>498 ubyte&0xDF >0 518>>>>>>>>498 string x \b.%-.3s 519# 520>376 search/41 Non-System\ disk\ or\ 521>>395 search/41 disk\ error\r 522>>>407 search/41 Replace\ and\ 523>>>>419 search/41 press\ \b, 524>>>>419 search/41 strike\ \b, old 525>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 526#449 Disk\ Boot\ failure\r MS 3.21 527#466 Boot\ Failure\r MS 3.30 528>>>>>468 search/18 \0 529#IO.SYS,IBMBIO.COM 530>>>>>>&0 string x \b %-.2s 531>>>>>>>&-20 ubyte&0xDF >0 532>>>>>>>>&-1 string x \b%-.4s 533>>>>>>>>>&-16 ubyte&0xDF >0 534>>>>>>>>>>&-1 string x \b%-.2s 535>>>>>>&8 ubyte&0xDF >0 \b. 536>>>>>>>&-1 string x \b%-.3s 537#MSDOS.SYS,IBMDOS.COM 538>>>>>>&11 ubyte&0xDF >0 \b+ 539>>>>>>>&-1 string x \b%-.5s 540>>>>>>>>&-6 ubyte&0xDF >0 541>>>>>>>>>&-1 string x \b%-.1s 542>>>>>>>>>>&-5 ubyte&0xDF >0 543>>>>>>>>>>>&-1 string x \b%-.2s 544>>>>>>>&7 ubyte&0xDF >0 \b. 545>>>>>>>>&-1 string x \b%-.3s 546>441 string Cannot\ load\ from\ harddisk.\n\r 547>>469 string Insert\ Systemdisk\ 548>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 549#>43 string \224R-LOADER\ \ SYS =label 550>54 string SYS 551>>324 string VASKK 552>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 553# 554>98 string Press\ a\ key\ to\ retry\0\r 555>>120 string Cannot\ find\ file\ \0\r 556>>>139 string Disk\ read\ error\0\r 557>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 558#DRBIOS.SYS 559>>>>>44 ubyte&0xDF >0 560>>>>>>44 string x \b %-.6s 561>>>>>>>50 ubyte&0xDF >0 562>>>>>>>>50 string x \b%-.2s 563>>>>>>52 ubyte&0xDF >0 564>>>>>>>52 string x \b.%-.3s 565# 566>70 string IBMBIO\ \ COM 567>>472 string Cannot\ load\ DOS!\ 568>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 569>>471 string Cannot\ load\ DOS\ 570>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 571>444 string KERNEL\ \ SYS 572>>314 string BOOT\ error! \b, FREE-DOS Bootloader 573>499 string KERNEL\ \ SYS 574>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 575>449 string KERNEL\ \ SYS 576>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 577>125 string Loading\ FreeDOS...\r 578>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 579>>>441 ubyte&0xDF >0 580>>>>441 string x \b %-.6s 581>>>>>447 ubyte&0xDF >0 582>>>>>>447 string x \b%-.1s 583>>>>>>>448 ubyte&0xDF >0 584>>>>>>>>448 string x \b%-.1s 585>>>>449 ubyte&0xDF >0 586>>>>>449 string x \b.%-.3s 587>124 string FreeDOS\0 588>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 589# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 590>>>497 ubyte&0xDF >0 591>>>>497 string x \b %-.6s 592>>>>>503 ubyte&0xDF >0 593>>>>>>503 string x \b%-.1s 594>>>>>>>504 ubyte&0xDF >0 595>>>>>>>>504 string x \b%-.1s 596>>>>505 ubyte&0xDF >0 597>>>>>505 string x \b.%-.3s 598>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 599>>>497 ubyte&0xDF >0 600>>>>497 string x \b %-.6s 601>>>>>503 ubyte&0xDF >0 602>>>>>>503 string x \b%-.1s 603>>>>>>>504 ubyte&0xDF >0 604>>>>>>>>504 string x \b%-.1s 605>>>>505 ubyte&0xDF >0 606>>>>>505 string x \b.%-.3s 607>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 608>>>497 ubyte&0xDF >0 609>>>>497 string x \b %-.6s 610>>>>>503 ubyte&0xDF >0 611>>>>>>503 string x \b%-.1s 612>>>>>>>504 ubyte&0xDF >0 613>>>>>>>>504 string x \b%-.1s 614>>>>505 ubyte&0xDF >0 615>>>>>505 string x \b.%-.3s 616>336 string Error!\ 617>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 618>>>497 ubyte&0xDF >0 619>>>>497 string x \b %-.6s 620>>>>>503 ubyte&0xDF >0 621>>>>>>503 string x \b%-.1s 622>>>>>>>504 ubyte&0xDF >0 623>>>>>>>>504 string x \b%-.1s 624>>>>505 ubyte&0xDF >0 625>>>>>505 string x \b.%-.3s 626# added by Joerg Jenderek 627# http://www.visopsys.org/ 628# http://partitionlogic.org.uk/ 629# OEM-ID=Visopsys 630>478 ulelong 0 631>>(1.b+326) string I/O\ Error\ reading\ 632>>>(1.b+344) string Visopsys\ loader\r 633>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 634# http://alexfru.chat.ru/epm.html#bootprog 635>494 ubyte >0x4D 636>>495 string >E 637>>>495 string <S 638#OEM-ID is not reliable 639>>>>3 string BootProg 640# It just looks for a program file name at the root directory 641# and loads corresponding file with following execution. 642# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 643>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 644>>>>>499 string x \b %-.1s 645>>>>>>500 ubyte&0xDF >0 646>>>>>>>500 string x \b%-.1s 647>>>>>>>>501 ubyte&0xDF >0 648>>>>>>>>>501 string x \b%-.1s 649>>>>>>>>>>502 ubyte&0xDF >0 650>>>>>>>>>>>502 string x \b%-.1s 651>>>>>>>>>>>>503 ubyte&0xDF >0 652>>>>>>>>>>>>>503 string x \b%-.1s 653>>>>>>>>>>>>>>504 ubyte&0xDF >0 654>>>>>>>>>>>>>>>504 string x \b%-.1s 655>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 656>>>>>>>>>>>>>>>>>505 string x \b%-.1s 657>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 658>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 659#name extension 660>>>>>507 ubyte&0xDF >0 \b. 661>>>>>>507 string x \b%-.1s 662>>>>>>>508 ubyte&0xDF >0 663>>>>>>>>508 string x \b%-.1s 664>>>>>>>>>509 ubyte&0xDF >0 665>>>>>>>>>>509 string x \b%-.1s 666#If the boot sector fails to read any other sector, 667#it prints a very short message ("RE") to the screen and hangs the computer. 668#If the boot sector fails to find needed program in the root directory, 669#it also hangs with another message ("NF"). 670>>>>>492 string RENF \b, FAT (12 bit) 671>>>>>495 string RENF \b, FAT (16 bit) 672# http://alexfru.chat.ru/epm.html#bootprog 673>494 ubyte >0x4D 674>>495 string >E 675>>>495 string <S 676#OEM-ID is not reliable 677>>>>3 string BootProg 678# It just looks for a program file name at the root directory 679# and loads corresponding file with following execution. 680# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 681>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 682>>>>>499 string x \b %-.1s 683>>>>>>500 ubyte&0xDF >0 684>>>>>>>500 string x \b%-.1s 685>>>>>>>>501 ubyte&0xDF >0 686>>>>>>>>>501 string x \b%-.1s 687>>>>>>>>>>502 ubyte&0xDF >0 688>>>>>>>>>>>502 string x \b%-.1s 689>>>>>>>>>>>>503 ubyte&0xDF >0 690>>>>>>>>>>>>>503 string x \b%-.1s 691>>>>>>>>>>>>>>504 ubyte&0xDF >0 692>>>>>>>>>>>>>>>504 string x \b%-.1s 693>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 694>>>>>>>>>>>>>>>>>505 string x \b%-.1s 695>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 696>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 697#name extension 698>>>>>507 ubyte&0xDF >0 \b. 699>>>>>>507 string x \b%-.1s 700>>>>>>>508 ubyte&0xDF >0 701>>>>>>>>508 string x \b%-.1s 702>>>>>>>>>509 ubyte&0xDF >0 703>>>>>>>>>>509 string x \b%-.1s 704#If the boot sector fails to read any other sector, 705#it prints a very short message ("RE") to the screen and hangs the computer. 706#If the boot sector fails to find needed program in the root directory, 707#it also hangs with another message ("NF"). 708>>>>>492 string RENF \b, FAT (12 bit) 709>>>>>495 string RENF \b, FAT (16 bit) 710# added by Joerg Jenderek 711# http://syslinux.zytor.com/iso.php 7120 ulelong 0x7c40eafa isolinux Loader 713# http://syslinux.zytor.com/pxe.php 7140 ulelong 0x007c05ea pxelinux Loader 7150 ulelong 0x60669c66 pxelinux Loader 716# loader end 717# updated by Joerg Jenderek at Sep 2007 718>3 ubyte 0 719#no active flag 720>>446 ubyte 0 721# partition 1 not empty 722>>>450 ubyte >0 723# partitions 3,4 empty 724>>>>482 ubyte 0 725>>>>>498 ubyte 0 726# partition 2 ID=0,5,15 727>>>>>>466 ubyte <0x10 728>>>>>>>466 ubyte 0x05 \b, extended partition table 729>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 730>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 731# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 732# http://mirror.href.com/thestarman/asm/2bytejumps.htmm#FWD 733# older drives may use Near JuMP instruction E9 xx xx 734>0 lelong&0x009000EB 0x009000EB 735>0 lelong&0x000000E9 0x000000E9 736# maximal short forward jump is 07fx 737>1 ubyte <0xff \b, code offset 0x%x 738# mtools-3.9.8/msdos.h 739# usual values are marked with comments to get only informations of strange FAT systems 740# valid sectorsize must be a power of 2 from 32 to 32768 741>>11 uleshort&0x000f x 742>>>11 uleshort <32769 743>>>>11 uleshort >31 744>>>>>3 string >\0 \b, OEM-ID "%8.8s" 745#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 746>>>>>>8 string IHC \b cached by Windows 9M 747>>>>>11 uleshort >512 \b, Bytes/sector %u 748#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 749>>>>>11 uleshort <512 \b, Bytes/sector %u 750>>>>>13 ubyte >1 \b, sectors/cluster %u 751#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 752>>>>>14 uleshort >32 \b, reserved sectors %u 753#>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 754#>>>>>14 uleshort >1 \b, reserved sectors %u 755#>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 756>>>>>14 uleshort <1 \b, reserved sectors %u 757>>>>>16 ubyte >2 \b, FATs %u 758#>>>>>16 ubyte =2 \b, FATs %u (usual) 759>>>>>16 ubyte =1 \b, FAT %u 760>>>>>16 ubyte >0 761>>>>>17 uleshort >0 \b, root entries %u 762#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) 763>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 764#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) 765>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 766#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 767>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 768>>>>>22 uleshort >0 \b, sectors/FAT %u 769#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) 770>>>>>26 ubyte >2 \b, heads %u 771#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 772>>>>>26 ubyte =1 \b, heads %u 773#skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk 774>>>>>38 ubyte !0x70 775>>>>>>28 ulelong >0 \b, hidden sectors %u 776#>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 777>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 778#>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 779# FAT<32 specific 780>>>>>82 string !FAT32 781#>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 782#>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 783>>>>>>36 ubyte !0x80 784>>>>>>>36 ubyte !0 \b, physical drive 0x%x 785>>>>>>37 ubyte >0 \b, reserved 0x%x 786#>>>>>>37 ubyte =0 \b, reserved 0x%x 787>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) 788>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) 789>>>>>>38 ubyte =0x29 790>>>>>>>39 ulelong x \b, serial number 0x%x 791>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 792>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 793>>>>>>>43 string =NO\ NAME \b, unlabeled 794>>>>>>54 string FAT \b, FAT 795>>>>>>>54 string FAT12 \b (12 bit) 796>>>>>>>54 string FAT16 \b (16 bit) 797# FAT32 specific 798>>>>>82 string FAT32 \b, FAT (32 bit) 799>>>>>>36 ulelong x \b, sectors/FAT %u 800>>>>>>40 uleshort >0 \b, extension flags %u 801#>>>>>>40 uleshort =0 \b, extension flags %u 802>>>>>>42 uleshort >0 \b, fsVersion %u 803#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 804>>>>>>44 ulelong >2 \b, rootdir cluster %u 805#>>>>>>44 ulelong =2 \b, rootdir cluster %u 806#>>>>>>44 ulelong =1 \b, rootdir cluster %u 807>>>>>>48 uleshort >1 \b, infoSector %u 808#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 809>>>>>>48 uleshort <1 \b, infoSector %u 810>>>>>>50 uleshort >6 \b, Backup boot sector %u 811#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 812>>>>>>50 uleshort <6 \b, Backup boot sector %u 813>>>>>>54 ulelong >0 \b, reserved1 0x%x 814>>>>>>58 ulelong >0 \b, reserved2 0x%x 815>>>>>>62 ulelong >0 \b, reserved3 0x%x 816# same structure as FAT1X 817>>>>>>64 ubyte >0x80 \b, physical drive 0x%x 818#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 819>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x 820#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 821>>>>>>65 ubyte >0 \b, reserved 0x%x 822>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) 823>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) 824>>>>>>66 ubyte =0x29 825>>>>>>>67 ulelong x \b, serial number 0x%x 826>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 827>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 828>>>>>>71 string =NO\ NAME \b, unlabeled 829### FATs end 830>0x200 lelong 0x82564557 \b, BSD disklabel 831# FATX 8320 string FATX FATX filesystem data 833 834 835# romfs filesystems - Juan Cespedes <cespedes@debian.org> 8360 string -rom1fs-\0 romfs filesystem, version 1 837>8 belong x %d byte(s), 838>16 string x named %s. 839 840# netboot image - Juan Cespedes <cespedes@debian.org> 8410 lelong 0x1b031336L Netboot image, 842>4 lelong&0xFFFFFF00 0 843>>4 lelong&0x100 0x000 mode 2 844>>4 lelong&0x100 0x100 mode 3 845>4 lelong&0xFFFFFF00 !0 unknown mode 846 8470x18b string OS/2 OS/2 Boot Manager 848 849# added by Joerg Jenderek 850# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 851# grub-1.94/kern/i386/pc/startup.S 852# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 853# usual values are marked with comments to get only informations of strange GRUB loaders 8540x200 uleshort 0x70EA 855# found only version 3.{1,2} 856>0x206 ubeshort >0x0300 857# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 858>>0x212 ubyte >0x29 859>>>0x213 ubyte >0x29 860# not iso9660_stage1_5 861#>>>0 ulelong&0x00BE5652 0x00BE5652 862>>>>0x213 ubyte >0x29 GRand Unified Bootloader 863# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 864>>>>0x217 ubyte 0xFF stage1_5 865>>>>0x217 ubyte <0xFF stage2 866>>>>0x206 ubyte x \b version %u 867>>>>0x207 ubyte x \b.%u 868# module_size for 1.94 869>>>>0x208 ulelong <0xffffff \b, installed partition %u 870#>>>>0x208 ulelong =0xffffff \b, %u (default) 871>>>>0x208 ulelong >0xffffff \b, installed partition %u 872# GRUB 0.5.95 unofficial 873>>>>0x20C ulelong&0x2E300000 0x2E300000 874# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 875>>>>>0x20C ubyte x \b, identifier 0x%x 876#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 877>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 878# GRUB version as string 879>>>>>0x20E string >\0 \b, GRUB version %-s 880# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 881>>>>>>0x215 ulong 0xffffffff 882>>>>>>>0x219 string >\0 \b, configuration file %-s 883>>>>>>0x215 ulong !0xffffffff 884>>>>>>>0x215 string >\0 \b, configuration file %-s 885# newer GRUB versions 886>>>>0x20C ulelong&0x2E300000 !0x2E300000 887##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 888>>>>>0x20C ulelong >0 \b, saved entry %d 889# for 1.94 contains kernel image size 890# for 0.93,0.94,0.96,0.97 891# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 892>>>>>0x210 ubyte x \b, identifier 0x%x 893# The flag for LBA forcing is in most cases 0 894#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 895>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 896# GRUB version as string 897>>>>>0x212 string >\0 \b, GRUB version %-s 898# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 899>>>>>0x217 ulong 0xffffffff 900>>>>>>0x21b string >\0 \b, configuration file %-s 901>>>>>0x217 ulong !0xffffffff 902>>>>>>0x217 string >\0 \b, configuration file %-s 903 9049564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 905>8404 string x last mounted on %s, 906#>9504 ledate x last checked at %s, 907>8224 ledate x last written at %s, 908>8401 byte x clean flag %d, 909>8228 lelong x number of blocks %d, 910>8232 lelong x number of data blocks %d, 911>8236 lelong x number of cylinder groups %d, 912>8240 lelong x block size %d, 913>8244 lelong x fragment size %d, 914>8252 lelong x minimum percentage of free blocks %d, 915>8256 lelong x rotational delay %dms, 916>8260 lelong x disk rotational speed %drps, 917>8320 lelong 0 TIME optimization 918>8320 lelong 1 SPACE optimization 919 92042332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 921>&-1164 string x last mounted on %s, 922>&-696 string >\0 volume name %s, 923>&-304 leqldate x last written at %s, 924>&-1167 byte x clean flag %d, 925>&-1168 byte x readonly flag %d, 926>&-296 lequad x number of blocks %lld, 927>&-288 lequad x number of data blocks %lld, 928>&-1332 lelong x number of cylinder groups %d, 929>&-1328 lelong x block size %d, 930>&-1324 lelong x fragment size %d, 931>&-180 lelong x average file size %d, 932>&-176 lelong x average number of files in dir %d, 933>&-272 lequad x pending blocks to free %lld, 934>&-264 lelong x pending inodes to free %d, 935>&-664 lequad x system-wide uuid %0llx, 936>&-1316 lelong x minimum percentage of free blocks %d, 937>&-1248 lelong 0 TIME optimization 938>&-1248 lelong 1 SPACE optimization 939 94066908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 941>&-1164 string x last mounted on %s, 942>&-696 string >\0 volume name %s, 943>&-304 leqldate x last written at %s, 944>&-1167 byte x clean flag %d, 945>&-1168 byte x readonly flag %d, 946>&-296 lequad x number of blocks %lld, 947>&-288 lequad x number of data blocks %lld, 948>&-1332 lelong x number of cylinder groups %d, 949>&-1328 lelong x block size %d, 950>&-1324 lelong x fragment size %d, 951>&-180 lelong x average file size %d, 952>&-176 lelong x average number of files in dir %d, 953>&-272 lequad x pending blocks to free %lld, 954>&-264 lelong x pending inodes to free %d, 955>&-664 lequad x system-wide uuid %0llx, 956>&-1316 lelong x minimum percentage of free blocks %d, 957>&-1248 lelong 0 TIME optimization 958>&-1248 lelong 1 SPACE optimization 959 9609564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 961>7168 belong 0x4c41424c Apple UFS Volume 962>>7186 string x named %s, 963>>7176 belong x volume label version %d, 964>>7180 bedate x created on %s, 965>8404 string x last mounted on %s, 966#>9504 bedate x last checked at %s, 967>8224 bedate x last written at %s, 968>8401 byte x clean flag %d, 969>8228 belong x number of blocks %d, 970>8232 belong x number of data blocks %d, 971>8236 belong x number of cylinder groups %d, 972>8240 belong x block size %d, 973>8244 belong x fragment size %d, 974>8252 belong x minimum percentage of free blocks %d, 975>8256 belong x rotational delay %dms, 976>8260 belong x disk rotational speed %drps, 977>8320 belong 0 TIME optimization 978>8320 belong 1 SPACE optimization 979 98042332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 981>&-1164 string x last mounted on %s, 982>&-696 string >\0 volume name %s, 983>&-304 beqldate x last written at %s, 984>&-1167 byte x clean flag %d, 985>&-1168 byte x readonly flag %d, 986>&-296 bequad x number of blocks %lld, 987>&-288 bequad x number of data blocks %lld, 988>&-1332 belong x number of cylinder groups %d, 989>&-1328 belong x block size %d, 990>&-1324 belong x fragment size %d, 991>&-180 belong x average file size %d, 992>&-176 belong x average number of files in dir %d, 993>&-272 bequad x pending blocks to free %lld, 994>&-264 belong x pending inodes to free %d, 995>&-664 bequad x system-wide uuid %0llx, 996>&-1316 belong x minimum percentage of free blocks %d, 997>&-1248 belong 0 TIME optimization 998>&-1248 belong 1 SPACE optimization 999 100066908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 1001>&-1164 string x last mounted on %s, 1002>&-696 string >\0 volume name %s, 1003>&-304 beqldate x last written at %s, 1004>&-1167 byte x clean flag %d, 1005>&-1168 byte x readonly flag %d, 1006>&-296 bequad x number of blocks %lld, 1007>&-288 bequad x number of data blocks %lld, 1008>&-1332 belong x number of cylinder groups %d, 1009>&-1328 belong x block size %d, 1010>&-1324 belong x fragment size %d, 1011>&-180 belong x average file size %d, 1012>&-176 belong x average number of files in dir %d, 1013>&-272 bequad x pending blocks to free %lld, 1014>&-264 belong x pending inodes to free %d, 1015>&-664 bequad x system-wide uuid %0llx, 1016>&-1316 belong x minimum percentage of free blocks %d, 1017>&-1248 belong 0 TIME optimization 1018>&-1248 belong 1 SPACE optimization 1019 1020# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 1021# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 10220x438 leshort 0xEF53 Linux 1023>0x44c lelong x rev %d 1024>0x43e leshort x \b.%d 1025# No journal? ext2 1026>0x45c lelong ^0x0000004 ext2 filesystem data 1027>>0x43a leshort ^0x0000001 (mounted or unclean) 1028# Has a journal? ext3 or ext4 1029>0x45c lelong &0x0000004 1030# and small INCOMPAT? 1031>>0x460 lelong <0x0000040 1032# and small RO_COMPAT? 1033>>>0x464 lelong <0x0000008 ext3 filesystem data 1034# else large RO_COMPAT? 1035>>>0x464 lelong >0x0000007 ext4 filesystem data 1036# else large INCOMPAT? 1037>>0x460 lelong >0x000003f ext4 filesystem data 1038# General flags for any ext* fs 1039>0x460 lelong &0x0000004 (needs journal recovery) 1040>0x43a leshort &0x0000002 (errors) 1041# INCOMPAT flags 1042>0x460 lelong &0x0000001 (compressed) 1043#>0x460 lelong &0x0000002 (filetype) 1044#>0x460 lelong &0x0000010 (meta bg) 1045>0x460 lelong &0x0000040 (extents) 1046>0x460 lelong &0x0000080 (64bit) 1047#>0x460 lelong &0x0000100 (mmp) 1048#>0x460 lelong &0x0000200 (flex bg) 1049# RO_INCOMPAT flags 1050#>0x464 lelong &0x0000001 (sparse super) 1051>0x464 lelong &0x0000002 (large files) 1052>0x464 lelong &0x0000008 (huge files) 1053#>0x464 lelong &0x0000010 (gdt checksum) 1054#>0x464 lelong &0x0000020 (many subdirs) 1055#>0x463 lelong &0x0000040 (extra isize) 1056 1057# SGI disk labels - Nathan Scott <nathans@debian.org> 10580 belong 0x0BE5A941 SGI disk label (volume header) 1059 1060# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 10610 belong 0x58465342 SGI XFS filesystem data 1062>0x4 belong x (blksz %d, 1063>0x68 beshort x inosz %d, 1064>0x64 beshort ^0x2004 v1 dirs) 1065>0x64 beshort &0x2004 v2 dirs) 1066 1067############################################################################ 1068# Minix-ST kernel floppy 10690x800 belong 0x46fc2700 Atari-ST Minix kernel image 1070>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy 1071>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy 1072 1073############################################################################ 1074# Hmmm, is this a better way of detecting _standard_ floppy images ? 107519 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k 1076>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 107719 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k 1078>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 107919 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 1080>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 1081 108219 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM 1083>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 108419 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs 1085>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 1086 108719 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k 108819 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k 1089 1090# Valid media descriptor bytes for MS-DOS: 1091# 1092# Byte Capacity Media Size and Type 1093# ------------------------------------------------- 1094# 1095# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 1096# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 1097# F9 720K 3.5-inch, 2-sided, 9-sector 1098# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 1099# FD 360K 5.25-inch, 2-sided, 9-sector 1100# FF 320K 5.25-inch, 2-sided, 8-sector 1101# FC 180K 5.25-inch, 1-sided, 9-sector 1102# FE 160K 5.25-inch, 1-sided, 8-sector 1103# FE 250K 8-inch, 1-sided, single-density 1104# FD 500K 8-inch, 2-sided, single-density 1105# FE 1.2 MB 8-inch, 2-sided, double-density 1106# F8 ----- Fixed disk 1107# 1108# FC xxxK Apricot 70x1x9 boot disk. 1109# 1110# Originally a bitmap: 1111# xxxxxxx0 Not two sided 1112# xxxxxxx1 Double sided 1113# xxxxxx0x Not 8 SPT 1114# xxxxxx1x 8 SPT 1115# xxxxx0xx Not Removable drive 1116# xxxxx1xx Removable drive 1117# 11111xxx Must be one. 1118# 1119# But now it's rather random: 1120# 111111xx Low density disk 1121# 00 SS, Not 8 SPT 1122# 01 DS, Not 8 SPT 1123# 10 SS, 8 SPT 1124# 11 DS, 8 SPT 1125# 1126# 11111001 Double density 3� floppy disk, high density 5� 1127# 11110000 High density 3� floppy disk 1128# 11111000 Hard disk any format 1129# 1130 1131# CDROM Filesystems 1132# Modified for UDF by gerardo.cacciari@gmail.com 113332769 string CD001 1134>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 1135!:mime application/x-iso9660-image 1136>38913 string NSR0 UDF filesystem data 1137!:mime application/x-iso9660-image 1138>>38917 string 1 (version 1.0) 1139>>38917 string 2 (version 1.5) 1140>>38917 string 3 (version 2.0) 1141>>38917 byte >0x33 (unknown version, ID 0x%X) 1142>>38917 byte <0x31 (unknown version, ID 0x%X) 1143# "application id" which appears to be used as a volume label 1144>32808 string >\0 '%s' 1145>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 114637633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 1147!:mime application/x-iso9660-image 114832776 string CDROM High Sierra CD-ROM filesystem data 1149 1150# cramfs filesystem - russell@coker.com.au 11510 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 1152>4 lelong x size %u 1153>8 lelong &1 version #2 1154>8 lelong &2 sorted_dirs 1155>8 lelong &4 hole_support 1156>32 lelong x CRC 0x%x, 1157>36 lelong x edition %u, 1158>40 lelong x %u blocks, 1159>44 lelong x %u files 1160 11610 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 1162>4 belong x size %u 1163>8 belong &1 version #2 1164>8 belong &2 sorted_dirs 1165>8 belong &4 hole_support 1166>32 belong x CRC 0x%x, 1167>36 belong x edition %u, 1168>40 belong x %u blocks, 1169>44 belong x %u files 1170 1171# reiserfs - russell@coker.com.au 11720x10034 string ReIsErFs ReiserFS V3.5 11730x10034 string ReIsEr2Fs ReiserFS V3.6 1174>0x1002c leshort x block size %d 1175>0x10032 leshort &2 (mounted or unclean) 1176>0x10000 lelong x num blocks %d 1177>0x10040 lelong 1 tea hash 1178>0x10040 lelong 2 yura hash 1179>0x10040 lelong 3 r5 hash 1180 1181# JFFS - russell@coker.com.au 11820 lelong 0x34383931 Linux Journalled Flash File system, little endian 11830 belong 0x34383931 Linux Journalled Flash File system, big endian 1184 1185# EST flat binary format (which isn't, but anyway) 1186# From: Mark Brown <broonie@sirena.org.uk> 11870 string ESTFBINR EST flat binary 1188 1189# Aculab VoIP firmware 1190# From: Mark Brown <broonie@sirena.org.uk> 11910 string VoIP\ Startup\ and Aculab VoIP firmware 1192>35 string x format %s 1193 1194# u-boot/PPCBoot image file 1195# From: Mark Brown <broonie@sirena.org.uk> 11960 belong 0x27051956 u-boot/PPCBoot image 1197>4 string PPCBoot 1198>>12 string x version %s 1199 1200# JFFS2 file system 1201#0 leshort 0x1984 Linux old jffs2 filesystem data little endian 1202#0 leshort 0x1985 Linux jffs2 filesystem data little endian 1203 1204# Squashfs 12050 string sqsh Squashfs filesystem, big endian, 1206>28 beshort x version %d. 1207>30 beshort x \b%d, 1208>28 beshort <3 1209>>8 belong x %d byte(s), 1210>28 beshort >2 1211>>63 bequad x %lld bytes, 1212#>>67 belong x %d byte(s), 1213>4 belong x %d inodes, 1214>28 beshort <2 1215>>32 beshort x blocksize: %d byte(s), 1216>28 beshort >1 1217>>51 belong x blocksize: %d byte(s), 1218>39 bedate x created: %s 1219 12200 string hsqs Squashfs filesystem, little endian, 1221>28 leshort x version %d. 1222>30 leshort x \b%d, 1223>28 leshort <3 1224>>8 lelong x %d byte(s), 1225>28 leshort >2 1226>>63 lequad x %lld bytes, 1227#>>63 lelong x %d byte(s), 1228>4 lelong x %d inodes, 1229>28 leshort <2 1230>>32 leshort x blocksize: %d byte(s), 1231>28 leshort >1 1232>>51 lelong x blocksize: %d byte(s), 1233>39 ledate x created: %s 1234 1235# Squashfs 12360 string hsqt Squashfs filesystem, little endian, 1237>28 leshort x version %d. 1238>30 leshort x \b%d, 1239>28 leshort <3 1240>>8 lelong x %d byte(s), 1241>28 leshort >2 1242>>63 lequad x %lld bytes, 1243#>>63 lelong x %d byte(s), 1244>4 lelong x %d inodes, 1245>28 leshort <2 1246>>32 leshort x blocksize: %d byte(s), 1247>28 leshort >1 1248>>51 lelong x blocksize: %d byte(s), 1249>39 ledate x created: %s 12500 string hsqt Squashfs filesystem, little endian, 1251>28 beshort x version %d. 1252>30 beshort x \b%d, 1253>28 beshort <3 1254>>8 belong x %d byte(s), 1255>28 beshort >2 1256>>63 bequad x %lld bytes, 1257#>>67 belong x %d byte(s), 1258>4 belong x %d inodes, 1259>28 beshort <2 1260>>32 beshort x blocksize: %d byte(s), 1261>28 beshort >1 1262>>51 belong x blocksize: %d byte(s), 1263>39 bedate x created: %s 1264 1265# 0 string hsqs Squashfs filesystem, little endian, 1266# >28 leshort x version %d. 1267# >30 leshort x \b%d, 1268# >28 leshort <3 1269# >>8 lelong x %d byte(s), 1270# >28 leshort >2 1271# >>63 lequad x %lld bytes, 1272# #>>63 lelong x %d byte(s), 1273# >4 lelong x %d inodes, 1274# >28 leshort <2 1275# >>32 leshort x blocksize: %d byte(s), 1276# >28 leshort >1 1277# >>51 lelong x blocksize: %d byte(s), 1278# >39 ledate x created: %s 1279 1280#0 string td\000 floppy image data (TeleDisk) 1281 1282# AFS Dump Magic 1283# From: Ty Sarna <tsarna@sarna.org> 12840 string \x01\xb3\xa1\x13\x22 AFS Dump 1285>&0 belong x (v%d) 1286>>&0 byte 0x76 1287>>>&0 belong x Vol %d, 1288>>>>&0 byte 0x6e 1289>>>>>&0 string x %s 1290>>>>>>&1 byte 0x74 1291>>>>>>>&0 beshort 2 1292>>>>>>>>&4 bedate x on: %s 1293>>>>>>>>&0 bedate =0 full dump 1294>>>>>>>>&0 bedate !0 incremental since: %s 1295 1296#---------------------------------------------------------- 1297# VMS backup savesets - gerardo.cacciari@gmail.com 1298# 12994 string \x01\x00\x01\x00\x01\x00 1300>(0.s+16) string \x01\x01 1301>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 1302>>>40 lelong x (block size %d, 1303>>>49 string >\0 original name '%s', 1304>>>2 short 1024 VAX generated) 1305>>>2 short 2048 AXP generated) 1306>>>2 short 4096 I64 generated) 1307 1308# Compaq/HP RILOE floppy image 1309# From: Dirk Jagdmann <doj@cubic.org> 13100 string CPQRFBLO Compaq/HP RILOE floppy image 1311 1312#------------------------------------------------------------------------------ 1313# Files-11 On-Disk Structure (OpenVMS file system) - gerardo.cacciari@gmail.com 1314# These bits come from LBN 1 (home block) of ODS-2 and ODS-5 volumes, which is 1315# mapped to VBN 2 of [000000]INDEXF.SYS;1 1316# 13171008 string DECFILE11B Files-11 On-Disk Structure 1318>525 byte x Level %d 1319>525 byte x (ODS-%d OpenVMS file system), 1320>984 string x volume label is '%-12.12s' 1321 1322# From: Thomas Klausner <wiz@NetBSD.org> 1323# http://filext.com/file-extension/DAA 1324# describes the daa file format. The magic would be: 13250 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 1326 1327# From Albert Cahalan <acahalan@gmail.com> 1328# really le32 operation,destination,payloadsize (but quite predictable) 1329# 01 00 00 00 00 00 00 c0 00 02 00 00 13300 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 1331 1332 1333# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 1334# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 1335# over BIOS parameter block (BPB) 1336# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD 1337# older drives may use Near JuMP instruction E9 xx xx 1338# minimal short forward jump found 0x29 for bootloaders or 0x0 1339# maximal short forward jump is 0x7f 1340# OEM-ID is empty or contain readable bytes 13410 ulelong&0x804000E9 0x000000E9 1342# reduce false positives with this check 1343>54 string FAT 1344# !:strength +60 1345# mtools-3.9.8/msdos.h 1346# usual values are marked with comments to get only informations of strange FAT systems 1347# valid sectorsize must be a power of 2 from 32 to 32768 1348#>11 uleshort&0x001f 0 1349>>11 uleshort <32769 1350>>>11 uleshort >31 1351>>>>21 ubyte&0xf0 0xF0 1352>>>>>0 ubyte 0xEB DOS/MBR boot sector 1353>>>>>>1 ubyte x \b, code offset 0x%x+2 1354>>>>>0 ubyte 0xE9 1355>>>>>>1 uleshort x \b, code offset 0x%x+3 1356>>>>>3 string >\0 \b, OEM-ID "%-.8s" 1357#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 1358>>>>>>8 string IHC \b cached by Windows 9M 1359>>>>>11 uleshort >512 \b, Bytes/sector %u 1360#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 1361>>>>>11 uleshort <512 \b, Bytes/sector %u 1362>>>>>13 ubyte >1 \b, sectors/cluster %u 1363#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 1364# for lazy FAT32 implementation like Transcend digital photo frame PF830 1365>>>>>82 string/c fat32 1366>>>>>>14 uleshort !32 \b, reserved sectors %u 1367#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 1368>>>>>82 string/c !fat32 1369>>>>>>14 uleshort >1 \b, reserved sectors %u 1370#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 1371#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) 1372>>>>>16 ubyte >2 \b, FATs %u 1373#>>>>>16 ubyte =2 \b, FATs %u (usual) 1374>>>>>16 ubyte =1 \b, FAT %u 1375>>>>>16 ubyte >0 1376>>>>>17 uleshort >0 \b, root entries %u 1377#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) 1378>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 1379#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) 1380>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 1381#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 1382>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 1383>>>>>22 uleshort >0 \b, sectors/FAT %u 1384#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) 1385>>>>>24 uleshort x \b, sectors/track %u 1386>>>>>26 ubyte >2 \b, heads %u 1387#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 1388>>>>>26 ubyte =1 \b, heads %u 1389# valid only for sector sizes with more then 32 Bytes 1390>>>>>11 uleshort >32 1391# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block 1392# skip for values 2,2Ah,70h,73h,DFh 1393# and continue for extended boot signature values 0,28h,29h,80h 1394>>>>>>38 ubyte&0x56 =0 1395>>>>>>>28 ulelong >0 \b, hidden sectors %u 1396#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 1397>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 1398#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 1399# FAT<32 bit specific 1400>>>>>>>82 string/c !fat32 1401#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 1402#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 1403>>>>>>>>36 ubyte !0x80 1404>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 1405# VGA-copy CRC or 1406# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 1407>>>>>>>>37 ubyte >0 \b, reserved 0x%x 1408#>>>>>>>>37 ubyte =0 \b, reserved 0x%x 1409# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others 1410>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 1411>>>>>>>>38 ubyte&0xFE =0x28 1412>>>>>>>>>39 ulelong x \b, serial number 0x%x 1413>>>>>>>>38 ubyte =0x29 1414>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 1415>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 1416>>>>>>>>>43 string =NO\ NAME \b, unlabeled 1417# there exist some old floppies without word FAT at offset 54 1418# a word like "FATnm " is only a hint for a FAT size on nm-bits 1419# Normally the number of clusters is calculated by the values of BPP. 1420# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, 1421# otherwise FAT is 16 bit. 1422# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html 1423>>>>>82 string/c !fat32 1424>>>>>>54 string FAT12 \b, FAT (12 bit) 1425>>>>>>54 string FAT16 \b, FAT (16 bit) 1426>>>>>>54 default x 1427# determinate FAT bit size by media descriptor 1428# small floppies implies FAT12 1429>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor) 1430# with media descriptor F0h floppy or maybe superfloppy with FAT16 1431>>>>>>>21 ubyte =0xF0 1432# superfloppy (many sectors) implies FAT16 1433>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors) 1434# no superfloppy with media descriptor F0h implies FAT12 1435>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors) 1436# with media descriptor F8h floppy or hard disc with FAT12 or FAT16 1437>>>>>>>21 ubyte =0xF8 1438# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12 1439>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry) 1440# hard disc with FAT12 or FAT16 1441>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 1442# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc 1443>>>>>>>21 ubyte =0xFA 1444# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12 1445>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry) 1446# RAM disc with FAT12 or FAT16 or Tandy hard disc 1447>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 1448# others are floppy 1449>>>>>>>21 default x \b, FAT (12 bit by descriptor) 1450# FAT32 bit specific 1451>>>>>82 string/c fat32 \b, FAT (32 bit) 1452>>>>>>36 ulelong x \b, sectors/FAT %u 1453# http://technet.microsoft.com/en-us/library/cc977221.aspx 1454>>>>>>40 uleshort >0 \b, extension flags 0x%x 1455#>>>>>>40 uleshort =0 \b, extension flags %hu 1456>>>>>>42 uleshort >0 \b, fsVersion %u 1457#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 1458>>>>>>44 ulelong >2 \b, rootdir cluster %u 1459#>>>>>>44 ulelong =2 \b, rootdir cluster %u 1460#>>>>>>44 ulelong =1 \b, rootdir cluster %u 1461>>>>>>48 uleshort >1 \b, infoSector %u 1462#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 1463>>>>>>48 uleshort <1 \b, infoSector %u 1464# 0 or 0xFFFF instead of usual 6 means no backup sector 1465>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector 1466>>>>>>50 uleshort =0 \b, no Backup boot sector 1467#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 1468>>>>>>50 default x 1469>>>>>>>50 uleshort x \b, Backup boot sector %u 1470# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 1471>>>>>>52 ulelong >0 \b, reserved1 0x%x 1472>>>>>>56 ulelong >0 \b, reserved2 0x%x 1473>>>>>>60 ulelong >0 \b, reserved3 0x%x 1474# same structure as FAT1X 1475#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 1476#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 1477>>>>>>64 ubyte !0x80 1478>>>>>>>64 ubyte >0 \b, physical drive 0x%x 1479# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 1480>>>>>>65 ubyte >0 \b, reserved 0x%x 1481>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 1482>>>>>>66 ubyte =0x29 1483>>>>>>>67 ulelong x \b, serial number 0x%x 1484>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 1485>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 1486>>>>>>>71 string =NO\ NAME \b, unlabeled 1487# additional tests for floppy image added by Joerg Jenderek 1488# no fixed disk 1489>>>>>21 ubyte !0xF8 1490# floppy media with 12 bit FAT 1491>>>>>>54 string !FAT16 1492# test for FAT after bootsector 1493>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT 1494# floppy image 1495!:mime application/x-ima 1496# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm 1497# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html 1498# 0 FATs 1499>>>>>16 ubyte =0 1500# 0 root entries 1501>>>>>>17 uleshort =0 1502# 0 DOS sectors 1503>>>>>>>19 uleshort =0 1504# 0 sectors/FAT 1505# dos < 4.0 BootSector value found is 0x80 1506#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) 1507>>>>>>>>22 uleshort =0 \b; NTFS 1508>>>>>>>>>24 uleshort >0 \b, sectors/track %u 1509>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x 1510>>>>>>>>>40 ulequad >0 \b, sectors %lld 1511>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld 1512>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld 1513# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. 1514# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. 1515>>>>>>>>>64 lelong <256 1516>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d 1517>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) 1518# Values 0 to 127 represent index block sizes of 0 to 127 clusters. 1519# Values 128 to 255 represent index block sizes of 2^(256-N) byte 1520>>>>>>>>>68 ulelong <256 1521>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d 1522#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) 1523>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) 1524>>>>>>>>>72 ulequad x \b, serial number 0%llx 1525>>>>>>>>>80 ulelong >0 \b, checksum 0x%x 1526#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) 1527>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 1528#>>>>>>>>>>&-92 indirect x \b; contains 1529# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 1530# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm 1531# unused assembler instructions JMP y2;NOP;NOP 15320x056 ulelong&0xFFFF0FFF 0x909002EB 1533# unicode loadername terminated by CTRL-D 1534>(0.s*2) ulelong&0xFFFFFF00 0x00040000 1535# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR 1536>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s 1537>>0x12 string $ 1538>>>0x0c lestring16 x \b%-2.2s 1539