1#------------------------------------------------------------------------------ 2# apple: file(1) magic for Apple file formats 3# 40 search/1 FiLeStArTfIlEsTaRt binscii (apple ][) text 50 string \x0aGL Binary II (apple ][) data 60 string \x76\xff Squeezed (apple ][) data 70 string NuFile NuFile archive (apple ][) data 80 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 90 belong 0x00051600 AppleSingle encoded Macintosh file 100 belong 0x00051607 AppleDouble encoded Macintosh file 11 12# Type: Apple Emulator 2IMG format 13# From: Radek Vokal <rvokal@redhat.com> 140 string 2IMG Apple ][ 2IMG Disk Image 15>4 string XGS! \b, XGS 16>4 string CTKG \b, Catakig 17>4 string ShIm \b, Sheppy's ImageMaker 18>4 string WOOF \b, Sweet 16 19>4 string B2TR \b, Bernie ][ the Rescue 20>4 string !nfc \b, ASIMOV2 21>4 string x \b, Unknown Format 22>0xc byte 00 \b, DOS 3.3 sector order 23>>0x10 byte 00 \b, Volume 254 24>>0x10 byte&0x7f x \b, Volume %u 25>0xc byte 01 \b, ProDOS sector order 26>>0x14 short x \b, %u Blocks 27>0xc byte 02 \b, NIB data 28 29# magic for Newton PDA package formats 30# from Ruda Moura <ruda@helllabs.org> 310 string package0 Newton package, NOS 1.x, 32>12 belong &0x80000000 AutoRemove, 33>12 belong &0x40000000 CopyProtect, 34>12 belong &0x10000000 NoCompression, 35>12 belong &0x04000000 Relocation, 36>12 belong &0x02000000 UseFasterCompression, 37>16 belong x version %d 38 390 string package1 Newton package, NOS 2.x, 40>12 belong &0x80000000 AutoRemove, 41>12 belong &0x40000000 CopyProtect, 42>12 belong &0x10000000 NoCompression, 43>12 belong &0x04000000 Relocation, 44>12 belong &0x02000000 UseFasterCompression, 45>16 belong x version %d 46 470 string package4 Newton package, 48>8 byte 8 NOS 1.x, 49>8 byte 9 NOS 2.x, 50>12 belong &0x80000000 AutoRemove, 51>12 belong &0x40000000 CopyProtect, 52>12 belong &0x10000000 NoCompression, 53 54# The following entries for the Apple II are for files that have 55# been transferred as raw binary data from an Apple, without having 56# been encapsulated by any of the above archivers. 57# 58# In general, Apple II formats are hard to identify because Apple DOS 59# and especially Apple ProDOS have strong typing in the file system and 60# therefore programmers never felt much need to include type information 61# in the files themselves. 62# 63# Eric Fischer <enf@pobox.com> 64 65# AppleWorks word processor: 66# 67# This matches the standard tab stops for an AppleWorks file, but if 68# a file has a tab stop set in the first four columns this will fail. 69# 70# The "O" is really the magic number, but that's so common that it's 71# necessary to check the tab stops that follow it to avoid false positives. 72 734 string O==== AppleWorks word processor data 74>85 byte&0x01 >0 \b, zoomed 75>90 byte&0x01 >0 \b, paginated 76>92 byte&0x01 >0 \b, with mail merge 77#>91 byte x \b, left margin %d 78 79# AppleWorks database: 80# 81# This isn't really a magic number, but it's the closest thing to one 82# that I could find. The 1 and 2 really mean "order in which you defined 83# categories" and "left to right, top to bottom," respectively; the D and R 84# mean that the cursor should move either down or right when you press Return. 85 86#30 string \x01D AppleWorks database data 87#30 string \x02D AppleWorks database data 88#30 string \x01R AppleWorks database data 89#30 string \x02R AppleWorks database data 90 91# AppleWorks spreadsheet: 92# 93# Likewise, this isn't really meant as a magic number. The R or C means 94# row- or column-order recalculation; the A or M means automatic or manual 95# recalculation. 96 97#131 string RA AppleWorks spreadsheet data 98#131 string RM AppleWorks spreadsheet data 99#131 string CA AppleWorks spreadsheet data 100#131 string CM AppleWorks spreadsheet data 101 102# Applesoft BASIC: 103# 104# This is incredibly sloppy, but will be true if the program was 105# written at its usual memory location of 2048 and its first line 106# number is less than 256. Yuck. 107 1080 belong&0xff00ff 0x80000 Applesoft BASIC program data 109#>2 leshort x \b, first line number %d 110 111# ORCA/EZ assembler: 112# 113# This will not identify ORCA/M source files, since those have 114# some sort of date code instead of the two zero bytes at 6 and 7 115# XXX Conflicts with ELF 116#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 117#>5 byte x \b, build number %d 118 119# Broderbund Fantavision 120# 121# I don't know what these values really mean, but they seem to recur. 122# Will they cause too many conflicts? 123 124# Probably :-) 125#2 belong&0xFF00FF 0x040008 Fantavision movie data 126 127# Some attempts at images. 128# 129# These are actually just bit-for-bit dumps of the frame buffer, so 130# there's really no reasonably way to distinguish them except for their 131# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 132# or, occasionally, 8184. 133# 134# Nevertheless this will manage to catch a lot of images that happen 135# to have a solid-colored line at the bottom of the screen. 136 137# GRR: Magic too weak 138#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 139#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 140#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 141#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 142#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 143 144# Beagle Bros. Apple Mechanic fonts 145 1460 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 147 148# Apple Universal Disk Image Format (UDIF) - dmg files. 149# From Johan Gade. 150# These entries are disabled for now until we fix the following issues. 151# 152# Note there might be some problems with the "VAX COFF executable" 153# entry. Note this entry should be placed before the mac filesystem section, 154# particularly the "Apple Partition data" entry. 155# 156# The intended meaning of these tests is, that the file is only of the 157# specified type if both of the lines are correct - i.e. if the first 158# line matches and the second doesn't then it is not of that type. 159# 160#0 long 0x7801730d 161#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 162# 163# Note that this entry is recognized correctly by the "Apple Partition 164# data" entry - however since this entry is more specific - this 165# information seems to be more useful. 166#0 long 0x45520200 167#>0x410 string disk\ image UDIF read/write image (UDRW) 168 169# From: Toby Peterson <toby@apple.com> 1700 string bplist00 Apple binary property list 171 172# Apple binary property list (bplist) 173# Assumes version bytes are hex. 174# Provides content hints for version 0 files. Assumes that the root 175# object is the first object (true for CoreFoundation implementation). 176# From: David Remahl <dremahl@apple.com> 1770 string bplist 178>6 byte x \bCoreFoundation binary property list data, version 0x%c 179>>7 byte x \b%c 180>6 string 00 \b 181>>8 byte&0xF0 0x00 \b 182>>>8 byte&0x0F 0x00 \b, root type: null 183>>>8 byte&0x0F 0x08 \b, root type: false boolean 184>>>8 byte&0x0F 0x09 \b, root type: true boolean 185>>8 byte&0xF0 0x10 \b, root type: integer 186>>8 byte&0xF0 0x20 \b, root type: real 187>>8 byte&0xF0 0x30 \b, root type: date 188>>8 byte&0xF0 0x40 \b, root type: data 189>>8 byte&0xF0 0x50 \b, root type: ascii string 190>>8 byte&0xF0 0x60 \b, root type: unicode string 191>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 192>>8 byte&0xF0 0xa0 \b, root type: array 193>>8 byte&0xF0 0xd0 \b, root type: dictionary 194 195# Apple/NeXT typedstream data 196# Serialization format used by NeXT and Apple for various 197# purposes in YellowStep/Cocoa, including some nib files. 198# From: David Remahl <dremahl@apple.com> 1992 string typedstream NeXT/Apple typedstream data, big endian 200>0 byte x \b, version %hhd 201>0 byte <5 \b 202>>13 byte 0x81 \b 203>>>14 ubeshort x \b, system %hd 2042 string streamtyped NeXT/Apple typedstream data, little endian 205>0 byte x \b, version %hhd 206>0 byte <5 \b 207>>13 byte 0x81 \b 208>>>14 uleshort x \b, system %hd 209 210#------------------------------------------------------------------------------ 211# CAF: Apple CoreAudio File Format 212# 213# Container format for high-end audio purposes. 214# From: David Remahl <dremahl@apple.com> 215# 2160 string caff CoreAudio Format audio file 217>4 beshort <10 version %d 218>6 beshort x 219 220 221#------------------------------------------------------------------------------ 222# Keychain database files 2230 string kych Mac OS X Keychain File 224 225#------------------------------------------------------------------------------ 226# Code Signing related file types 2270 belong 0xfade0c00 Mac OS X Code Requirement 228>8 belong 1 (opExpr) 229>4 belong x - %d bytes 230 2310 belong 0xfade0c01 Mac OS X Code Requirement Set 232>8 belong >1 containing %d items 233>4 belong x - %d bytes 234 2350 belong 0xfade0c02 Mac OS X Code Directory 236>8 belong x version %x 237>12 belong >0 flags 0x%x 238>4 belong x - %d bytes 239 2400 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 241>4 belong x - %d bytes 242 2430 belong 0xfade0cc1 Mac OS X Detached Code Signature 244>8 belong >1 (%d elements) 245>4 belong x - %d bytes 246 247# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 248# .vdi 2494 string innotek\ VirtualBox\ Disk\ Image %s 250