1 2#------------------------------------------------------------------------------ 3# $File: apple,v 1.24 2010/11/25 15:00:12 christos Exp $ 4# apple: file(1) magic for Apple file formats 5# 60 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 70 string \x0aGL Binary II (apple ][) data 80 string \x76\xff Squeezed (apple ][) data 90 string NuFile NuFile archive (apple ][) data 100 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 110 belong 0x00051600 AppleSingle encoded Macintosh file 120 belong 0x00051607 AppleDouble encoded Macintosh file 13 14# Type: Apple Emulator 2IMG format 15# From: Radek Vokal <rvokal@redhat.com> 160 string 2IMG Apple ][ 2IMG Disk Image 17>4 string XGS! \b, XGS 18>4 string CTKG \b, Catakig 19>4 string ShIm \b, Sheppy's ImageMaker 20>4 string WOOF \b, Sweet 16 21>4 string B2TR \b, Bernie ][ the Rescue 22>4 string !nfc \b, ASIMOV2 23>4 string x \b, Unknown Format 24>0xc byte 00 \b, DOS 3.3 sector order 25>>0x10 byte 00 \b, Volume 254 26>>0x10 byte&0x7f x \b, Volume %u 27>0xc byte 01 \b, ProDOS sector order 28>>0x14 short x \b, %u Blocks 29>0xc byte 02 \b, NIB data 30 31# magic for Newton PDA package formats 32# from Ruda Moura <ruda@helllabs.org> 330 string package0 Newton package, NOS 1.x, 34>12 belong &0x80000000 AutoRemove, 35>12 belong &0x40000000 CopyProtect, 36>12 belong &0x10000000 NoCompression, 37>12 belong &0x04000000 Relocation, 38>12 belong &0x02000000 UseFasterCompression, 39>16 belong x version %d 40 410 string package1 Newton package, NOS 2.x, 42>12 belong &0x80000000 AutoRemove, 43>12 belong &0x40000000 CopyProtect, 44>12 belong &0x10000000 NoCompression, 45>12 belong &0x04000000 Relocation, 46>12 belong &0x02000000 UseFasterCompression, 47>16 belong x version %d 48 490 string package4 Newton package, 50>8 byte 8 NOS 1.x, 51>8 byte 9 NOS 2.x, 52>12 belong &0x80000000 AutoRemove, 53>12 belong &0x40000000 CopyProtect, 54>12 belong &0x10000000 NoCompression, 55 56# The following entries for the Apple II are for files that have 57# been transferred as raw binary data from an Apple, without having 58# been encapsulated by any of the above archivers. 59# 60# In general, Apple II formats are hard to identify because Apple DOS 61# and especially Apple ProDOS have strong typing in the file system and 62# therefore programmers never felt much need to include type information 63# in the files themselves. 64# 65# Eric Fischer <enf@pobox.com> 66 67# AppleWorks word processor: 68# 69# This matches the standard tab stops for an AppleWorks file, but if 70# a file has a tab stop set in the first four columns this will fail. 71# 72# The "O" is really the magic number, but that's so common that it's 73# necessary to check the tab stops that follow it to avoid false positives. 74 754 string O==== AppleWorks word processor data 76>85 byte&0x01 >0 \b, zoomed 77>90 byte&0x01 >0 \b, paginated 78>92 byte&0x01 >0 \b, with mail merge 79#>91 byte x \b, left margin %d 80 81# AppleWorks database: 82# 83# This isn't really a magic number, but it's the closest thing to one 84# that I could find. The 1 and 2 really mean "order in which you defined 85# categories" and "left to right, top to bottom," respectively; the D and R 86# mean that the cursor should move either down or right when you press Return. 87 88#30 string \x01D AppleWorks database data 89#30 string \x02D AppleWorks database data 90#30 string \x01R AppleWorks database data 91#30 string \x02R AppleWorks database data 92 93# AppleWorks spreadsheet: 94# 95# Likewise, this isn't really meant as a magic number. The R or C means 96# row- or column-order recalculation; the A or M means automatic or manual 97# recalculation. 98 99#131 string RA AppleWorks spreadsheet data 100#131 string RM AppleWorks spreadsheet data 101#131 string CA AppleWorks spreadsheet data 102#131 string CM AppleWorks spreadsheet data 103 104# Applesoft BASIC: 105# 106# This is incredibly sloppy, but will be true if the program was 107# written at its usual memory location of 2048 and its first line 108# number is less than 256. Yuck. 109 1100 belong&0xff00ff 0x80000 Applesoft BASIC program data 111#>2 leshort x \b, first line number %d 112 113# ORCA/EZ assembler: 114# 115# This will not identify ORCA/M source files, since those have 116# some sort of date code instead of the two zero bytes at 6 and 7 117# XXX Conflicts with ELF 118#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 119#>5 byte x \b, build number %d 120 121# Broderbund Fantavision 122# 123# I don't know what these values really mean, but they seem to recur. 124# Will they cause too many conflicts? 125 126# Probably :-) 127#2 belong&0xFF00FF 0x040008 Fantavision movie data 128 129# Some attempts at images. 130# 131# These are actually just bit-for-bit dumps of the frame buffer, so 132# there's really no reasonably way to distinguish them except for their 133# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 134# or, occasionally, 8184. 135# 136# Nevertheless this will manage to catch a lot of images that happen 137# to have a solid-colored line at the bottom of the screen. 138 139# GRR: Magic too weak 140#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 141#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 142#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 143#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 144#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 145 146# Beagle Bros. Apple Mechanic fonts 147 1480 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 149 150# Apple Universal Disk Image Format (UDIF) - dmg files. 151# From Johan Gade. 152# These entries are disabled for now until we fix the following issues. 153# 154# Note there might be some problems with the "VAX COFF executable" 155# entry. Note this entry should be placed before the mac filesystem section, 156# particularly the "Apple Partition data" entry. 157# 158# The intended meaning of these tests is, that the file is only of the 159# specified type if both of the lines are correct - i.e. if the first 160# line matches and the second doesn't then it is not of that type. 161# 162#0 long 0x7801730d 163#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 164# 165# Note that this entry is recognized correctly by the "Apple Partition 166# data" entry - however since this entry is more specific - this 167# information seems to be more useful. 168#0 long 0x45520200 169#>0x410 string disk\ image UDIF read/write image (UDRW) 170 171# From: Toby Peterson <toby@apple.com> 1720 string bplist00 Apple binary property list 173 174# Apple binary property list (bplist) 175# Assumes version bytes are hex. 176# Provides content hints for version 0 files. Assumes that the root 177# object is the first object (true for CoreFoundation implementation). 178# From: David Remahl <dremahl@apple.com> 1790 string bplist 180>6 byte x \bCoreFoundation binary property list data, version 0x%c 181>>7 byte x \b%c 182>6 string 00 \b 183>>8 byte&0xF0 0x00 \b 184>>>8 byte&0x0F 0x00 \b, root type: null 185>>>8 byte&0x0F 0x08 \b, root type: false boolean 186>>>8 byte&0x0F 0x09 \b, root type: true boolean 187>>8 byte&0xF0 0x10 \b, root type: integer 188>>8 byte&0xF0 0x20 \b, root type: real 189>>8 byte&0xF0 0x30 \b, root type: date 190>>8 byte&0xF0 0x40 \b, root type: data 191>>8 byte&0xF0 0x50 \b, root type: ascii string 192>>8 byte&0xF0 0x60 \b, root type: unicode string 193>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 194>>8 byte&0xF0 0xa0 \b, root type: array 195>>8 byte&0xF0 0xd0 \b, root type: dictionary 196 197# Apple/NeXT typedstream data 198# Serialization format used by NeXT and Apple for various 199# purposes in YellowStep/Cocoa, including some nib files. 200# From: David Remahl <dremahl@apple.com> 2012 string typedstream NeXT/Apple typedstream data, big endian 202>0 byte x \b, version %hhd 203>0 byte <5 \b 204>>13 byte 0x81 \b 205>>>14 ubeshort x \b, system %hd 2062 string streamtyped NeXT/Apple typedstream data, little endian 207>0 byte x \b, version %hhd 208>0 byte <5 \b 209>>13 byte 0x81 \b 210>>>14 uleshort x \b, system %hd 211 212#------------------------------------------------------------------------------ 213# CAF: Apple CoreAudio File Format 214# 215# Container format for high-end audio purposes. 216# From: David Remahl <dremahl@apple.com> 217# 2180 string caff CoreAudio Format audio file 219>4 beshort <10 version %d 220>6 beshort x 221 222 223#------------------------------------------------------------------------------ 224# Keychain database files 2250 string kych Mac OS X Keychain File 226 227#------------------------------------------------------------------------------ 228# Code Signing related file types 2290 belong 0xfade0c00 Mac OS X Code Requirement 230>8 belong 1 (opExpr) 231>4 belong x - %d bytes 232 2330 belong 0xfade0c01 Mac OS X Code Requirement Set 234>8 belong >1 containing %d items 235>4 belong x - %d bytes 236 2370 belong 0xfade0c02 Mac OS X Code Directory 238>8 belong x version %x 239>12 belong >0 flags 0x%x 240>4 belong x - %d bytes 241 2420 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 243>4 belong x - %d bytes 244 2450 belong 0xfade0cc1 Mac OS X Detached Code Signature 246>8 belong >1 (%d elements) 247>4 belong x - %d bytes 248 249# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 250# .vdi 2514 string innotek\ VirtualBox\ Disk\ Image %s 252