1#------------------------------------------------------------------------------ 2# $File: archive,v 1.70 2011/10/26 15:44:47 christos Exp $ 3# archive: file(1) magic for archive formats (see also "msdos" for self- 4# extracting compressed archives) 5# 6# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 7# pre-POSIX "tar" archives are handled in the C code. 8 9# POSIX tar archives 10257 string ustar\0 POSIX tar archive 11!:mime application/x-tar # encoding: posix 12257 string ustar\040\040\0 GNU tar archive 13!:mime application/x-tar # encoding: gnu 14 15# Incremental snapshot gnu-tar format from: 16# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 170 string GNU\ tar- GNU tar incremental snapshot data 18>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 19 20# cpio archives 21# 22# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 23# The idea is to indicate archives produced on machines with the same 24# byte order as the machine running "file" with "cpio archive", and 25# to indicate archives produced on machines with the opposite byte order 26# from the machine running "file" with "byte-swapped cpio archive". 27# 28# The SVR4 "cpio(4)" hints that there are additional formats, but they 29# are defined as "short"s; I think all the new formats are 30# character-header formats and thus are strings, not numbers. 310 short 070707 cpio archive 32!:mime application/x-cpio 330 short 0143561 byte-swapped cpio archive 34!:mime application/x-cpio # encoding: swapped 350 string 070707 ASCII cpio archive (pre-SVR4 or odc) 360 string 070701 ASCII cpio archive (SVR4 with no CRC) 370 string 070702 ASCII cpio archive (SVR4 with CRC) 38 39# Debian package (needs to go before regular portable archives) 40# 410 string =!<arch>\ndebian 42!:mime application/x-debian-package 43>8 string debian-split part of multipart Debian package 44>8 string debian-binary Debian binary package 45>8 string !debian 46>68 string >\0 (format %s) 47# These next two lines do not work, because a bzip2 Debian archive 48# still uses gzip for the control.tar (first in the archive). Only 49# data.tar varies, and the location of its filename varies too. 50# file/libmagic does not current have support for ascii-string based 51# (offsets) as of 2005-09-15. 52#>81 string bz2 \b, uses bzip2 compression 53#>84 string gz \b, uses gzip compression 54#>136 ledate x created: %s 55 56# other archives 570 long 0177555 very old archive 580 short 0177555 very old PDP-11 archive 590 long 0177545 old archive 600 short 0177545 old PDP-11 archive 610 long 0100554 apl workspace 620 string =<ar> archive 63!:mime application/x-archive 64 65# MIPS archive (needs to go before regular portable archives) 66# 670 string =!<arch>\n__________E MIPS archive 68>20 string U with MIPS Ucode members 69>21 string L with MIPSEL members 70>21 string B with MIPSEB members 71>19 string L and an EL hash table 72>19 string B and an EB hash table 73>22 string X -- out of date 74 750 search/1 -h- Software Tools format archive text 76 77# 78# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is 79# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: 80# 81# 0 string =!<arch> current ar archive 82# 0 long 0x213c6172 archive file 83# 84# and for SVR1 archives, we have: 85# 86# 0 string \<ar> System V Release 1 ar archive 87# 0 string =<ar> archive 88# 89# XXX - did Aegis really store shared libraries, breakpointed modules, 90# and absolute code program modules in the same format as new-style 91# "ar" archives? 92# 930 string =!<arch> current ar archive 94!:mime application/x-archive 95>8 string __.SYMDEF random library 96>0 belong =65538 - pre SR9.5 97>0 belong =65539 - post SR9.5 98>0 beshort 2 - object archive 99>0 beshort 3 - shared library module 100>0 beshort 4 - debug break-pointed module 101>0 beshort 5 - absolute code program module 1020 string \<ar> System V Release 1 ar archive 1030 string =<ar> archive 104# 105# XXX - from "vax", which appears to collect a bunch of byte-swapped 106# thingies, to help you recognize VAX files on big-endian machines; 107# with "leshort", "lelong", and "string", that's no longer necessary.... 108# 1090 belong 0x65ff0000 VAX 3.0 archive 1100 belong 0x3c61723e VAX 5.0 archive 111# 1120 long 0x213c6172 archive file 1130 lelong 0177555 very old VAX archive 1140 leshort 0177555 very old PDP-11 archive 115# 116# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus 117# be a random library (it said 0xff65 rather than 0177545). 118# 1190 lelong 0177545 old VAX archive 120>8 string __.SYMDEF random library 1210 leshort 0177545 old PDP-11 archive 122>8 string __.SYMDEF random library 123# 124# From "pdp" (but why a 4-byte quantity?) 125# 1260 lelong 0x39bed PDP-11 old archive 1270 lelong 0x39bee PDP-11 4.0 archive 128 129# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 130# 131# The first byte is the magic (0x1a), byte 2 is the compression type for 132# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 133# filename of the first file (null terminated). Since some types collide 134# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 135# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 1360 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 137!:mime application/x-arc 1380 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 139!:mime application/x-arc 1400 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 141!:mime application/x-arc 1420 lelong&0x8080ffff 0x0000031a ARC archive data, packed 143!:mime application/x-arc 1440 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 145!:mime application/x-arc 1460 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 147!:mime application/x-arc 148# [JW] stuff taken from idarc, obviously ARC successors: 1490 lelong&0x8080ffff 0x00000a1a PAK archive data 150!:mime application/x-arc 1510 lelong&0x8080ffff 0x0000141a ARC+ archive data 152!:mime application/x-arc 1530 lelong&0x8080ffff 0x0000481a HYP archive data 154!:mime application/x-arc 155 156# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 157# I can't create either SPARK or ArcFS archives so I have not tested this stuff 158# [GRR: the original entries collide with ARC, above; replaced with combined 159# version (not tested)] 160#0 byte 0x1a RISC OS archive (spark format) 1610 string \032archive RISC OS archive (ArcFS format) 1620 string Archive\000 RISC OS archive (ArcFS format) 163 164# All these were taken from idarc, many could not be verified. Unfortunately, 165# there were many low-quality sigs, i.e. easy to trigger false positives. 166# Please notify me of any real-world fishy/ambiguous signatures and I'll try 167# to get my hands on the actual archiver and see if I find something better. [JW] 168# probably many can be enhanced by finding some 0-byte or control char near the start 169 170# idarc calls this Crush/Uncompressed... *shrug* 1710 string CRUSH Crush archive data 172# Squeeze It (.sqz) 1730 string HLSQZ Squeeze It archive data 174# SQWEZ 1750 string SQWEZ SQWEZ archive data 176# HPack (.hpk) 1770 string HPAK HPack archive data 178# HAP 1790 string \x91\x33HF HAP archive data 180# MD/MDCD 1810 string MDmd MDCD archive data 182# LIM 1830 string LIM\x1a LIM archive data 184# SAR 1853 string LH5 SAR archive data 186# BSArc/BS2 1870 string \212\3SB \0 BSArc/BS2 archive data 188# MAR 1892 string =-ah MAR archive data 190# ACB 191#0 belong&0x00f800ff 0x00800000 ACB archive data 192# CPZ 193# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 194# JRC 1950 string JRchive JRC archive data 196# Quantum 1970 string DS\0 Quantum archive data 198# ReSOF 1990 string PK\3\6 ReSOF archive data 200# QuArk 2010 string 7\4 QuArk archive data 202# YAC 20314 string YC YAC archive data 204# X1 2050 string X1 X1 archive data 2060 string XhDr X1 archive data 207# CDC Codec (.dqt) 2080 belong&0xffffe000 0x76ff2000 CDC Codec archive data 209# AMGC 2100 string \xad6" AMGC archive data 211# NuLIB 2120 string NõFélå NuLIB archive data 213# PakLeo 2140 string LEOLZW PAKLeo archive data 215# ChArc 2160 string SChF ChArc archive data 217# PSA 2180 string PSA PSA archive data 219# CrossePAC 2200 string DSIGDCC CrossePAC archive data 221# Freeze 2220 string \x1f\x9f\x4a\x10\x0a Freeze archive data 223# KBoom 2240 string ¨MP¨ KBoom archive data 225# NSQ, must go after CDC Codec 2260 string \x76\xff NSQ archive data 227# DPA 2280 string Dirk\ Paehl DPA archive data 229# BA 230# TODO: idarc says "bytes 0-2 == bytes 3-5" 231# TTComp 2320 string \0\6 TTComp archive data 233# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 2340 string ESP ESP archive data 235# ZPack 2360 string \1ZPK\1 ZPack archive data 237# Sky 2380 string \xbc\x40 Sky archive data 239# UFA 2400 string UFA UFA archive data 241# Dry 2420 string =-H2O DRY archive data 243# FoxSQZ 2440 string FOXSQZ FoxSQZ archive data 245# AR7 2460 string ,AR7 AR7 archive data 247# PPMZ 2480 string PPMZ PPMZ archive data 249# MS Compress 2504 string \x88\xf0\x27 MS Compress archive data 251# updated by Joerg Jenderek 252>9 string \0 253>>0 string KWAJ 254>>>7 string \321\003 MS Compress archive data 255>>>>14 ulong >0 \b, original size: %ld bytes 256>>>>18 ubyte >0x65 257>>>>>18 string x \b, was %.8s 258>>>>>(10.b-4) string x \b.%.3s 259# MP3 (archiver, not lossy audio compression) 2600 string MP3\x1a MP3-Archiver archive data 261# ZET 2620 string OZÝ ZET archive data 263# TSComp 2640 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 265# ARQ 2660 string gW\4\1 ARQ archive data 267# Squash 2683 string OctSqu Squash archive data 269# Terse 2700 string \5\1\1\0 Terse archive data 271# PUCrunch 2720 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 273# UHarc 2740 string UHA UHarc archive data 275# ABComp 2760 string \2AB ABComp archive data 2770 string \3AB2 ABComp archive data 278# CMP 2790 string CO\0 CMP archive data 280# Splint 2810 string \x93\xb9\x06 Splint archive data 282# InstallShield 2830 string \x13\x5d\x65\x8c InstallShield Z archive Data 284# Gather 2851 string GTH Gather archive data 286# BOA 2870 string BOA BOA archive data 288# RAX 2890 string ULEB\xa RAX archive data 290# Xtreme 2910 string ULEB\0 Xtreme archive data 292# Pack Magic 2930 string @â\1\0 Pack Magic archive data 294# BTS 2950 belong&0xfeffffff 0x1a034465 BTS archive data 296# ELI 5750 2970 string Ora\ ELI 5750 archive data 298# QFC 2990 string \x1aFC\x1a QFC archive data 3000 string \x1aQF\x1a QFC archive data 301# PRO-PACK 3020 string RNC PRO-PACK archive data 303# 777 3040 string 777 777 archive data 305# LZS221 3060 string sTaC LZS221 archive data 307# HPA 3080 string HPA HPA archive data 309# Arhangel 3100 string LG Arhangel archive data 311# EXP1, uses bzip2 3120 string 0123456789012345BZh EXP1 archive data 313# IMP 3140 string IMP\xa IMP archive data 315# NRV 3160 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 317# Squish 3180 string \x73\xb2\x90\xf4 Squish archive data 319# Par 3200 string PHILIPP Par archive data 3210 string PAR Par archive data 322# HIT 3230 string UB HIT archive data 324# SBX 3250 belong&0xfffff000 0x53423000 SBX archive data 326# NaShrink 3270 string NSK NaShrink archive data 328# SAPCAR 3290 string #\ CAR\ archive\ header SAPCAR archive data 3300 string CAR\ 2.00RG SAPCAR archive data 331# Disintegrator 3320 string DST Disintegrator archive data 333# ASD 3340 string ASD ASD archive data 335# InstallShield CAB 3360 string ISc( InstallShield CAB 337# TOP4 3380 string T4\x1a TOP4 archive data 339# BatComp left out: sig looks like COM executable 340# so TODO: get real 4dos batcomp file and find sig 341# BlakHole 3420 string BH\5\7 BlakHole archive data 343# BIX 3440 string BIX0 BIX archive data 345# ChiefLZA 3460 string ChfLZ ChiefLZA archive data 347# Blink 3480 string Blink Blink archive data 349# Logitech Compress 3500 string \xda\xfa Logitech Compress archive data 351# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 3521 string (C)\ STEPANYUK ARS-Sfx archive data 353# AKT/AKT32 3540 string AKT32 AKT32 archive data 3550 string AKT AKT archive data 356# NPack 3570 string MSTSM NPack archive data 358# PFT 3590 string \0\x50\0\x14 PFT archive data 360# SemOne 3610 string SEM SemOne archive data 362# PPMD 3630 string \x8f\xaf\xac\x84 PPMD archive data 364# FIZ 3650 string FIZ FIZ archive data 366# MSXiE 3670 belong&0xfffff0f0 0x4d530000 MSXiE archive data 368# DeepFreezer 3690 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 370# DC 3710 string =<DC- DC archive data 372# TPac 3730 string \4TPAC\3 TPac archive data 374# Ai 3750 string Ai\1\1\0 Ai archive data 3760 string Ai\1\0\0 Ai archive data 377# Ai32 3780 string Ai\2\0 Ai32 archive data 3790 string Ai\2\1 Ai32 archive data 380# SBC 3810 string SBC SBC archive data 382# Ybs 3830 string YBS Ybs archive data 384# DitPack 3850 string \x9e\0\0 DitPack archive data 386# DMS 3870 string DMS! DMS archive data 388# EPC 3890 string \x8f\xaf\xac\x8c EPC archive data 390# VSARC 3910 string VS\x1a VSARC archive data 392# PDZ 3930 string PDZ PDZ archive data 394# ReDuq 3950 string rdqx ReDuq archive data 396# GCA 3970 string GCAX GCA archive data 398# PPMN 3990 string pN PPMN archive data 400# WinImage 4013 string WINIMAGE WinImage archive data 402# Compressia 4030 string CMP0CMP Compressia archive data 404# UHBC 4050 string UHB UHBC archive data 406# WinHKI 4070 string \x61\x5C\x04\x05 WinHKI archive data 408# WWPack data file 4090 string WWP WWPack archive data 410# BSN (BSA, PTS-DOS) 4110 string \xffBSG BSN archive data 4121 string \xffBSG BSN archive data 4133 string \xffBSG BSN archive data 4141 string \0\xae\2 BSN archive data 4151 string \0\xae\3 BSN archive data 4161 string \0\xae\7 BSN archive data 417# AIN 4180 string \x33\x18 AIN archive data 4190 string \x33\x17 AIN archive data 420# XPA32 4210 string xpa\0\1 XPA32 archive data 422# SZip (TODO: doesn't catch all versions) 4230 string SZ\x0a\4 SZip archive data 424# XPack DiskImage 4250 string jm XPack DiskImage archive data 426# XPack Data 4270 string xpa XPack archive data 428# XPack Single Data 4290 string Í\ jm XPack single archive data 430 431# TODO: missing due to unknown magic/magic at end of file: 432#DWC 433#ARG 434#ZAR 435#PC/3270 436#InstallIt 437#RKive 438#RK 439#XPack Diskimage 440 441# These were inspired by idarc, but actually verified 442# Dzip archiver (.dz) 4430 string DZ Dzip archive data 444>2 byte x \b, version %i 445>3 byte x \b.%i 446# ZZip archiver (.zz) 4470 string ZZ\ \0\0 ZZip archive data 4480 string ZZ0 ZZip archive data 449# PAQ archiver (.paq) 4500 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 4510 string PAQ PAQ archive data 452>3 byte&0xf0 0x30 453>>3 byte x (v%c) 454# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 4550xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 4560 string JARCS JAR (ARJ Software, Inc.) archive data 457 458# ARJ archiver (jason@jarthur.Claremont.EDU) 4590 leshort 0xea60 ARJ archive data 460!:mime application/x-arj 461>5 byte x \b, v%d, 462>8 byte &0x04 multi-volume, 463>8 byte &0x10 slash-switched, 464>8 byte &0x20 backup, 465>34 string x original name: %s, 466>7 byte 0 os: MS-DOS 467>7 byte 1 os: PRIMOS 468>7 byte 2 os: Unix 469>7 byte 3 os: Amiga 470>7 byte 4 os: Macintosh 471>7 byte 5 os: OS/2 472>7 byte 6 os: Apple ][ GS 473>7 byte 7 os: Atari ST 474>7 byte 8 os: NeXT 475>7 byte 9 os: VAX/VMS 476>3 byte >0 %d] 477# [JW] idarc says this is also possible 4782 leshort 0xea60 ARJ archive data 479 480# HA archiver (Greg Roelofs, newt@uchicago.edu) 481# This is a really bad format. A file containing HAWAII will match this... 482#0 string HA HA archive data, 483#>2 leshort =1 1 file, 484#>2 leshort >1 %u files, 485#>4 byte&0x0f =0 first is type CPY 486#>4 byte&0x0f =1 first is type ASC 487#>4 byte&0x0f =2 first is type HSC 488#>4 byte&0x0f =0x0e first is type DIR 489#>4 byte&0x0f =0x0f first is type SPECIAL 490# suggestion: at least identify small archives (<1024 files) 4910 belong&0xffff00fc 0x48410000 HA archive data 492>2 leshort =1 1 file, 493>2 leshort >1 %u files, 494>4 byte&0x0f =0 first is type CPY 495>4 byte&0x0f =1 first is type ASC 496>4 byte&0x0f =2 first is type HSC 497>4 byte&0x0f =0x0e first is type DIR 498>4 byte&0x0f =0x0f first is type SPECIAL 499 500# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 5010 string HPAK HPACK archive data 502 503# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 5040 string \351,\001JAM\ JAM archive, 505>7 string >\0 version %.4s 506>0x26 byte =0x27 - 507>>0x2b string >\0 label %.11s, 508>>0x27 lelong x serial %08x, 509>>0x36 string >\0 fstype %.8s 510 511# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 5122 string -lh0- LHarc 1.x/ARX archive data [lh0] 513!:mime application/x-lharc 5142 string -lh1- LHarc 1.x/ARX archive data [lh1] 515!:mime application/x-lharc 5162 string -lz4- LHarc 1.x archive data [lz4] 517!:mime application/x-lharc 5182 string -lz5- LHarc 1.x archive data [lz5] 519!:mime application/x-lharc 520# [never seen any but the last; -lh4- reported in comp.compression:] 5212 string -lzs- LHa/LZS archive data [lzs] 522!:mime application/x-lha 5232 string -lh\40- LHa 2.x? archive data [lh ] 524!:mime application/x-lha 5252 string -lhd- LHa 2.x? archive data [lhd] 526!:mime application/x-lha 5272 string -lh2- LHa 2.x? archive data [lh2] 528!:mime application/x-lha 5292 string -lh3- LHa 2.x? archive data [lh3] 530!:mime application/x-lha 5312 string -lh4- LHa (2.x) archive data [lh4] 532!:mime application/x-lha 5332 string -lh5- LHa (2.x) archive data [lh5] 534!:mime application/x-lha 5352 string -lh6- LHa (2.x) archive data [lh6] 536!:mime application/x-lha 5372 string -lh7- LHa (2.x)/LHark archive data [lh7] 538!:mime application/x-lha 539>20 byte x - header level %d 540# taken from idarc [JW] 5412 string -lZ PUT archive data 5422 string -lz LZS archive data 5432 string -sw1- Swag archive data 544 545# RAR archiver (Greg Roelofs, newt@uchicago.edu) 5460 string Rar! RAR archive data, 547!:mime application/x-rar 548>44 byte x v%0x, 549>10 byte >0 flags: 550>>10 byte &0x01 Archive volume, 551>>10 byte &0x02 Commented, 552>>10 byte &0x04 Locked, 553>>10 byte &0x08 Solid, 554>>10 byte &0x20 Authenticated, 555>35 byte 0 os: MS-DOS 556>35 byte 1 os: OS/2 557>35 byte 2 os: Win32 558>35 byte 3 os: Unix 559# some old version? idarc says: 5600 string RE\x7e\x5e RAR archive data 561 562# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 5630 string SQSH squished archive data (Acorn RISCOS) 564 565# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 566# [JW] see exe section for self-extracting version 5670 string UC2\x1a UC2 archive data 568 569# PKZIP multi-volume archive 5700 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 571!:mime application/zip 572 573# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 5740 string PK\003\004 575 576# Specialised zip formats which start with a member named 'mimetype' 577# (stored uncompressed, with no 'extra field') containing the file's MIME type. 578# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 579# contents starting with "application/": 580>26 string \x8\0\0\0mimetypeapplication/ 581 582# KOffice / OpenOffice & StarOffice / OpenDocument formats 583# From: Abel Cheung <abel@oaka.org> 584 585# KOffice (1.2 or above) formats 586# (mimetype contains "application/vnd.kde.<SUBTYPE>") 587>>50 string vnd.kde. KOffice (>=1.2) 588>>>58 string karbon Karbon document 589>>>58 string kchart KChart document 590>>>58 string kformula KFormula document 591>>>58 string kivio Kivio document 592>>>58 string kontour Kontour document 593>>>58 string kpresenter KPresenter document 594>>>58 string kspread KSpread document 595>>>58 string kword KWord document 596 597# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 598# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 599>>50 string vnd.sun.xml. OpenOffice.org 1.x 600>>>62 string writer Writer 601>>>>68 byte !0x2e document 602>>>>68 string .template template 603>>>>68 string .global global document 604>>>62 string calc Calc 605>>>>66 byte !0x2e spreadsheet 606>>>>66 string .template template 607>>>62 string draw Draw 608>>>>66 byte !0x2e document 609>>>>66 string .template template 610>>>62 string impress Impress 611>>>>69 byte !0x2e presentation 612>>>>69 string .template template 613>>>62 string math Math document 614>>>62 string base Database file 615 616# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 617# http://lists.oasis-open.org/archives/office/200505/msg00006.html 618# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 619>>50 string vnd.oasis.opendocument. OpenDocument 620>>>73 string text 621>>>>77 byte !0x2d Text 622!:mime application/vnd.oasis.opendocument.text 623>>>>77 string -template Text Template 624!:mime application/vnd.oasis.opendocument.text-template 625>>>>77 string -web HTML Document Template 626!:mime application/vnd.oasis.opendocument.text-web 627>>>>77 string -master Master Document 628!:mime application/vnd.oasis.opendocument.text-master 629>>>73 string graphics 630>>>>81 byte !0x2d Drawing 631!:mime application/vnd.oasis.opendocument.graphics 632>>>>81 string -template Template 633!:mime application/vnd.oasis.opendocument.graphics-template 634>>>73 string presentation 635>>>>85 byte !0x2d Presentation 636!:mime application/vnd.oasis.opendocument.presentation 637>>>>85 string -template Template 638!:mime application/vnd.oasis.opendocument.presentation-template 639>>>73 string spreadsheet 640>>>>84 byte !0x2d Spreadsheet 641!:mime application/vnd.oasis.opendocument.spreadsheet 642>>>>84 string -template Template 643!:mime application/vnd.oasis.opendocument.spreadsheet-template 644>>>73 string chart 645>>>>78 byte !0x2d Chart 646!:mime application/vnd.oasis.opendocument.chart 647>>>>78 string -template Template 648!:mime application/vnd.oasis.opendocument.chart-template 649>>>73 string formula 650>>>>80 byte !0x2d Formula 651!:mime application/vnd.oasis.opendocument.formula 652>>>>80 string -template Template 653!:mime application/vnd.oasis.opendocument.formula-template 654>>>73 string database Database 655!:mime application/vnd.oasis.opendocument.database 656>>>73 string image 657>>>>78 byte !0x2d Image 658!:mime application/vnd.oasis.opendocument.image 659>>>>78 string -template Template 660!:mime application/vnd.oasis.opendocument.image-template 661 662# EPUB (OEBPS) books using OCF (OEBPS Container Format) 663# From: Adam Buchbinder <adam.buchbinder@gmail.com> 664# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 665# (mimetype contains "application/epub+zip") 666>>50 string epub+zip EPUB ebook data 667!:mime application/epub+zip 668 669# Catch other ZIP-with-mimetype formats 670# In a ZIP file, the bytes immediately after a member's contents are 671# always "PK". The 2 regex rules here print the "mimetype" member's 672# contents up to the first 'P'. Luckily, most MIME types don't contain 673# any capital 'P's. This is a kludge. 674# (mimetype contains "application/<OTHER>") 675>>50 string !epub+zip 676>>>50 string !vnd.oasis.opendocument. 677>>>>50 string !vnd.sun.xml. 678>>>>>50 string !vnd.kde. 679>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 680!:mime application/zip 681# (mimetype contents other than "application/*") 682>26 string \x8\0\0\0mimetype 683>>38 string !application/ 684>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 685!:mime application/zip 686 687# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 688# Next line excludes specialized formats: 689>26 string !\x8\0\0\0mimetype Zip archive data 690!:mime application/zip 691>>4 byte 0x09 \b, at least v0.9 to extract 692>>4 byte 0x0a \b, at least v1.0 to extract 693>>4 byte 0x0b \b, at least v1.1 to extract 694>>4 byte 0x14 \b, at least v2.0 to extract 695>>4 byte 0x2d \b, at least v3.0 to extract 696>>0x161 string WINZIP \b, WinZIP self-extracting 697 698# StarView Metafile 699# From Pierre Ducroquet <pinaraf@pinaraf.info> 7000 string VCLMTF StarView MetaFile 701>6 beshort x \b, version %d 702>8 belong x \b, size %d 703 704# Zoo archiver 70520 lelong 0xfdc4a7dc Zoo archive data 706!:mime application/x-zoo 707>4 byte >48 \b, v%c. 708>>6 byte >47 \b%c 709>>>7 byte >47 \b%c 710>32 byte >0 \b, modify: v%d 711>>33 byte x \b.%d+ 712>42 lelong 0xfdc4a7dc \b, 713>>70 byte >0 extract: v%d 714>>>71 byte x \b.%d+ 715 716# Shell archives 71710 string #\ This\ is\ a\ shell\ archive shell archive text 718!:mime application/octet-stream 719 720# 721# LBR. NB: May conflict with the questionable 722# "binary Computer Graphics Metafile" format. 723# 7240 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 725# 726# PMA (CP/M derivative of LHA) 727# 7282 string -pm0- PMarc archive data [pm0] 7292 string -pm1- PMarc archive data [pm1] 7302 string -pm2- PMarc archive data [pm2] 7312 string -pms- PMarc SFX archive (CP/M, DOS) 7325 string -pc1- PopCom compressed executable (CP/M) 733 734# From Rafael Laboissiere <rafael@laboissiere.net> 735# The Project Revision Control System (see 736# http://prcs.sourceforge.net) generates a packaged project 737# file which is recognized by the following entry: 7380 leshort 0xeb81 PRCS packaged project 739 740# Microsoft cabinets 741# by David Necas (Yeti) <yeti@physics.muni.cz> 742#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 743#>25 byte x v%d 744#>24 byte x \b.%d 745# MPi: All CABs have version 1.3, so this is pointless. 746# Better magic in debian-additions. 747 748# GTKtalog catalogs 749# by David Necas (Yeti) <yeti@physics.muni.cz> 7504 string gtktalog\ GTKtalog catalog data, 751>13 string 3 version 3 752>>14 beshort 0x677a (gzipped) 753>>14 beshort !0x677a (not gzipped) 754>13 string >3 version %s 755 756############################################################################ 757# Parity archive reconstruction file, the 'par' file format now used on Usenet. 7580 string PAR\0 PARity archive data 759>48 leshort =0 - Index file 760>48 leshort >0 - file number %d 761 762# Felix von Leitner <felix-file@fefe.de> 7630 string d8:announce BitTorrent file 764!:mime application/x-bittorrent 765 766# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 7670 beshort 0x0e0f Atari MSA archive data 768>2 beshort x \b, %d sectors per track 769>4 beshort 0 \b, 1 sided 770>4 beshort 1 \b, 2 sided 771>6 beshort x \b, starting track: %d 772>8 beshort x \b, ending track: %d 773 774# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 7750 string PK00PK\003\004 Zip archive data 776 777# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 778# by Stefan `Sec` Zehl <sec@42.org> 7797 string **ACE** ACE archive data 780>15 byte >0 version %d 781>16 byte =0x00 \b, from MS-DOS 782>16 byte =0x01 \b, from OS/2 783>16 byte =0x02 \b, from Win/32 784>16 byte =0x03 \b, from Unix 785>16 byte =0x04 \b, from MacOS 786>16 byte =0x05 \b, from WinNT 787>16 byte =0x06 \b, from Primos 788>16 byte =0x07 \b, from AppleGS 789>16 byte =0x08 \b, from Atari 790>16 byte =0x09 \b, from Vax/VMS 791>16 byte =0x0A \b, from Amiga 792>16 byte =0x0B \b, from Next 793>14 byte x \b, version %d to extract 794>5 leshort &0x0080 \b, multiple volumes, 795>>17 byte x \b (part %d), 796>5 leshort &0x0002 \b, contains comment 797>5 leshort &0x0200 \b, sfx 798>5 leshort &0x0400 \b, small dictionary 799>5 leshort &0x0800 \b, multi-volume 800>5 leshort &0x1000 \b, contains AV-String 801>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 802>5 leshort &0x2000 \b, with recovery record 803>5 leshort &0x4000 \b, locked 804>5 leshort &0x8000 \b, solid 805# Date in MS-DOS format (whatever that is) 806#>18 lelong x Created on 807 808# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 809# <doj@cubic.org> 8100x1A string sfArk sfArk compressed Soundfont 811>0x15 string 2 812>>0x1 string >\0 Version %s 813>>0x2A string >\0 : %s 814 815# DR-DOS 7.03 Packed File *.??_ 8160 string Packed\ File\ Personal NetWare Packed File 817>12 string x \b, was "%.12s" 818 819# EET archive 820# From: Tilman Sauerbeck <tilman@code-monkey.de> 8210 belong 0x1ee7ff00 EET archive 822!:mime application/x-eet 823 824# rzip archives 8250 string RZIP rzip compressed data 826>4 byte x - version %d 827>5 byte x \b.%d 828>6 belong x (%d bytes) 829 830# From: "Robert Dale" <robdale@gmail.com> 8310 belong 123 dar archive, 832>4 belong x label "%.8x 833>>8 belong x %.8x 834>>>12 beshort x %.4x" 835>14 byte 0x54 end slice 836>14 beshort 0x4e4e multi-part 837>14 beshort 0x4e53 multi-part, with -S 838 839# Symbian installation files 840# http://www.thouky.co.uk/software/psifs/sis.html 841# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8428 lelong 0x10000419 Symbian installation file 843!:mime application/vnd.symbian.install 844>4 lelong 0x1000006D (EPOC release 3/4/5) 845>4 lelong 0x10003A12 (EPOC release 6) 8460 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 847!:mime x-epoc/x-sisx-app 848 849# From "Nelson A. de Oliveira" <naoliv@gmail.com> 8500 string MPQ\032 MoPaQ (MPQ) archive 851 852# From: Dirk Jagdmann <doj@cubic.org> 853# xar archive format: http://code.google.com/p/xar/ 8540 string xar! xar archive 855>6 beshort x - version %ld 856 857# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 858# .kgb 8590 string KGB_arch KGB Archiver file 860>10 string x with compression level %.1s 861 862# xar (eXtensible ARchiver) archive 863# From: "David Remahl" <dremahl@apple.com> 8640 string xar! xar archive 865#>4 beshort x header size %d 866>6 beshort x version %d, 867#>8 quad x compressed TOC: %d, 868#>16 quad x uncompressed TOC: %d, 869>24 belong 0 no checksum 870>24 belong 1 SHA-1 checksum 871>24 belong 2 MD5 checksum 872 873# Type: Parity Archive 874# From: Daniel van Eeden <daniel_e@dds.nl> 8750 string PAR2 Parity Archive Volume Set 876 877# Bacula volume format. (Volumes always start with a block header.) 878# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 879# From: Adam Buchbinder <adam.buchbinder@gmail.com> 88012 string BB02 Bacula volume 881>20 bedate x \b, started %s 882 883# ePub is XHTML + XML inside a ZIP archive. The first member of the 884# archive must be an uncompressed file called 'mimetype' with contents 885# 'application/epub+zip' 886 887# start by checking that this is a ZIP archive, then check for the 888# proper mimetype file 889# From: Ralf Brown <ralf.brown@gmail.com> 8900 string PK\003\004 891>0x1E string mimetypeapplication/epub+zip EPUB document 892!:mime application/epub+zip 893 894# From: "Michał Górny" <mgorny@gentoo.org> 895# ZPAQ: http://mattmahoney.net/dc/zpaq.html 8960 string zPQ ZPAQ stream 897>3 byte x \b, level %d 898 899# BBeB ebook, unencrypted (LRF format) 900# URL: http://www.sven.de/librie/Librie/LrfFormat 901# From: Adam Buchbinder <adam.buchbinder@gmail.com> 9020 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 903>8 beshort x \b, version %d 904>36 byte 1 \b, front-to-back 905>36 byte 16 \b, back-to-front 906>42 beshort x \b, (%dx, 907>44 beshort x %d) 908