1#------------------------------------------------------------------------------ 2# $File: archive,v 1.63 2011/04/23 15:02:48 christos Exp $ 3# archive: file(1) magic for archive formats (see also "msdos" for self- 4# extracting compressed archives) 5# 6# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 7# pre-POSIX "tar" archives are handled in the C code. 8 9# POSIX tar archives 10257 string ustar\0 POSIX tar archive 11!:mime application/x-tar # encoding: posix 12257 string ustar\040\040\0 GNU tar archive 13!:mime application/x-tar # encoding: gnu 14 15# cpio archives 16# 17# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 18# The idea is to indicate archives produced on machines with the same 19# byte order as the machine running "file" with "cpio archive", and 20# to indicate archives produced on machines with the opposite byte order 21# from the machine running "file" with "byte-swapped cpio archive". 22# 23# The SVR4 "cpio(4)" hints that there are additional formats, but they 24# are defined as "short"s; I think all the new formats are 25# character-header formats and thus are strings, not numbers. 260 short 070707 cpio archive 27!:mime application/x-cpio 280 short 0143561 byte-swapped cpio archive 29!:mime application/x-cpio # encoding: swapped 300 string 070707 ASCII cpio archive (pre-SVR4 or odc) 310 string 070701 ASCII cpio archive (SVR4 with no CRC) 320 string 070702 ASCII cpio archive (SVR4 with CRC) 33 34# Debian package (needs to go before regular portable archives) 35# 360 string =!<arch>\ndebian 37!:mime application/x-debian-package 38>8 string debian-split part of multipart Debian package 39>8 string debian-binary Debian binary package 40>8 string !debian 41>68 string >\0 (format %s) 42# These next two lines do not work, because a bzip2 Debian archive 43# still uses gzip for the control.tar (first in the archive). Only 44# data.tar varies, and the location of its filename varies too. 45# file/libmagic does not current have support for ascii-string based 46# (offsets) as of 2005-09-15. 47#>81 string bz2 \b, uses bzip2 compression 48#>84 string gz \b, uses gzip compression 49#>136 ledate x created: %s 50 51# other archives 520 long 0177555 very old archive 530 short 0177555 very old PDP-11 archive 540 long 0177545 old archive 550 short 0177545 old PDP-11 archive 560 long 0100554 apl workspace 570 string =<ar> archive 58!:mime application/x-archive 59 60# MIPS archive (needs to go before regular portable archives) 61# 620 string =!<arch>\n__________E MIPS archive 63>20 string U with MIPS Ucode members 64>21 string L with MIPSEL members 65>21 string B with MIPSEB members 66>19 string L and an EL hash table 67>19 string B and an EB hash table 68>22 string X -- out of date 69 700 search/1 -h- Software Tools format archive text 71 72# 73# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is 74# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: 75# 76# 0 string =!<arch> current ar archive 77# 0 long 0x213c6172 archive file 78# 79# and for SVR1 archives, we have: 80# 81# 0 string \<ar> System V Release 1 ar archive 82# 0 string =<ar> archive 83# 84# XXX - did Aegis really store shared libraries, breakpointed modules, 85# and absolute code program modules in the same format as new-style 86# "ar" archives? 87# 880 string =!<arch> current ar archive 89!:mime application/x-archive 90>8 string __.SYMDEF random library 91>0 belong =65538 - pre SR9.5 92>0 belong =65539 - post SR9.5 93>0 beshort 2 - object archive 94>0 beshort 3 - shared library module 95>0 beshort 4 - debug break-pointed module 96>0 beshort 5 - absolute code program module 970 string \<ar> System V Release 1 ar archive 980 string =<ar> archive 99# 100# XXX - from "vax", which appears to collect a bunch of byte-swapped 101# thingies, to help you recognize VAX files on big-endian machines; 102# with "leshort", "lelong", and "string", that's no longer necessary.... 103# 1040 belong 0x65ff0000 VAX 3.0 archive 1050 belong 0x3c61723e VAX 5.0 archive 106# 1070 long 0x213c6172 archive file 1080 lelong 0177555 very old VAX archive 1090 leshort 0177555 very old PDP-11 archive 110# 111# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus 112# be a random library (it said 0xff65 rather than 0177545). 113# 1140 lelong 0177545 old VAX archive 115>8 string __.SYMDEF random library 1160 leshort 0177545 old PDP-11 archive 117>8 string __.SYMDEF random library 118# 119# From "pdp" (but why a 4-byte quantity?) 120# 1210 lelong 0x39bed PDP-11 old archive 1220 lelong 0x39bee PDP-11 4.0 archive 123 124# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 125# 126# The first byte is the magic (0x1a), byte 2 is the compression type for 127# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 128# filename of the first file (null terminated). Since some types collide 129# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 130# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 1310 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 132!:mime application/x-arc 1330 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 134!:mime application/x-arc 1350 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 136!:mime application/x-arc 1370 lelong&0x8080ffff 0x0000031a ARC archive data, packed 138!:mime application/x-arc 1390 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 140!:mime application/x-arc 1410 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 142!:mime application/x-arc 143# [JW] stuff taken from idarc, obviously ARC successors: 1440 lelong&0x8080ffff 0x00000a1a PAK archive data 145!:mime application/x-arc 1460 lelong&0x8080ffff 0x0000141a ARC+ archive data 147!:mime application/x-arc 1480 lelong&0x8080ffff 0x0000481a HYP archive data 149!:mime application/x-arc 150 151# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 152# I can't create either SPARK or ArcFS archives so I have not tested this stuff 153# [GRR: the original entries collide with ARC, above; replaced with combined 154# version (not tested)] 155#0 byte 0x1a RISC OS archive (spark format) 1560 string \032archive RISC OS archive (ArcFS format) 1570 string Archive\000 RISC OS archive (ArcFS format) 158 159# All these were taken from idarc, many could not be verified. Unfortunately, 160# there were many low-quality sigs, i.e. easy to trigger false positives. 161# Please notify me of any real-world fishy/ambiguous signatures and I'll try 162# to get my hands on the actual archiver and see if I find something better. [JW] 163# probably many can be enhanced by finding some 0-byte or control char near the start 164 165# idarc calls this Crush/Uncompressed... *shrug* 1660 string CRUSH Crush archive data 167# Squeeze It (.sqz) 1680 string HLSQZ Squeeze It archive data 169# SQWEZ 1700 string SQWEZ SQWEZ archive data 171# HPack (.hpk) 1720 string HPAK HPack archive data 173# HAP 1740 string \x91\x33HF HAP archive data 175# MD/MDCD 1760 string MDmd MDCD archive data 177# LIM 1780 string LIM\x1a LIM archive data 179# SAR 1803 string LH5 SAR archive data 181# BSArc/BS2 1820 string \212\3SB \0 BSArc/BS2 archive data 183# MAR 1842 string =-ah MAR archive data 185# ACB 1860 belong&0x00f800ff 0x00800000 ACB archive data 187# CPZ 188# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 189# JRC 1900 string JRchive JRC archive data 191# Quantum 1920 string DS\0 Quantum archive data 193# ReSOF 1940 string PK\3\6 ReSOF archive data 195# QuArk 1960 string 7\4 QuArk archive data 197# YAC 19814 string YC YAC archive data 199# X1 2000 string X1 X1 archive data 2010 string XhDr X1 archive data 202# CDC Codec (.dqt) 2030 belong&0xffffe000 0x76ff2000 CDC Codec archive data 204# AMGC 2050 string \xad6" AMGC archive data 206# NuLIB 2070 string NõFélå NuLIB archive data 208# PakLeo 2090 string LEOLZW PAKLeo archive data 210# ChArc 2110 string SChF ChArc archive data 212# PSA 2130 string PSA PSA archive data 214# CrossePAC 2150 string DSIGDCC CrossePAC archive data 216# Freeze 2170 string \x1f\x9f\x4a\x10\x0a Freeze archive data 218# KBoom 2190 string ¨MP¨ KBoom archive data 220# NSQ, must go after CDC Codec 2210 string \x76\xff NSQ archive data 222# DPA 2230 string Dirk\ Paehl DPA archive data 224# BA 225# TODO: idarc says "bytes 0-2 == bytes 3-5" 226# TTComp 2270 string \0\6 TTComp archive data 228# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 2290 string ESP ESP archive data 230# ZPack 2310 string \1ZPK\1 ZPack archive data 232# Sky 2330 string \xbc\x40 Sky archive data 234# UFA 2350 string UFA UFA archive data 236# Dry 2370 string =-H2O DRY archive data 238# FoxSQZ 2390 string FOXSQZ FoxSQZ archive data 240# AR7 2410 string ,AR7 AR7 archive data 242# PPMZ 2430 string PPMZ PPMZ archive data 244# MS Compress 2454 string \x88\xf0\x27 MS Compress archive data 246# updated by Joerg Jenderek 247>9 string \0 248>>0 string KWAJ 249>>>7 string \321\003 MS Compress archive data 250>>>>14 ulong >0 \b, original size: %ld bytes 251>>>>18 ubyte >0x65 252>>>>>18 string x \b, was %.8s 253>>>>>(10.b-4) string x \b.%.3s 254# MP3 (archiver, not lossy audio compression) 2550 string MP3\x1a MP3-Archiver archive data 256# ZET 2570 string OZÝ ZET archive data 258# TSComp 2590 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 260# ARQ 2610 string gW\4\1 ARQ archive data 262# Squash 2633 string OctSqu Squash archive data 264# Terse 2650 string \5\1\1\0 Terse archive data 266# PUCrunch 2670 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 268# UHarc 2690 string UHA UHarc archive data 270# ABComp 2710 string \2AB ABComp archive data 2720 string \3AB2 ABComp archive data 273# CMP 2740 string CO\0 CMP archive data 275# Splint 2760 string \x93\xb9\x06 Splint archive data 277# InstallShield 2780 string \x13\x5d\x65\x8c InstallShield Z archive Data 279# Gather 2801 string GTH Gather archive data 281# BOA 2820 string BOA BOA archive data 283# RAX 2840 string ULEB\xa RAX archive data 285# Xtreme 2860 string ULEB\0 Xtreme archive data 287# Pack Magic 2880 string @â\1\0 Pack Magic archive data 289# BTS 2900 belong&0xfeffffff 0x1a034465 BTS archive data 291# ELI 5750 2920 string Ora\ ELI 5750 archive data 293# QFC 2940 string \x1aFC\x1a QFC archive data 2950 string \x1aQF\x1a QFC archive data 296# PRO-PACK 2970 string RNC PRO-PACK archive data 298# 777 2990 string 777 777 archive data 300# LZS221 3010 string sTaC LZS221 archive data 302# HPA 3030 string HPA HPA archive data 304# Arhangel 3050 string LG Arhangel archive data 306# EXP1, uses bzip2 3070 string 0123456789012345BZh EXP1 archive data 308# IMP 3090 string IMP\xa IMP archive data 310# NRV 3110 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 312# Squish 3130 string \x73\xb2\x90\xf4 Squish archive data 314# Par 3150 string PHILIPP Par archive data 3160 string PAR Par archive data 317# HIT 3180 string UB HIT archive data 319# SBX 3200 belong&0xfffff000 0x53423000 SBX archive data 321# NaShrink 3220 string NSK NaShrink archive data 323# SAPCAR 3240 string #\ CAR\ archive\ header SAPCAR archive data 3250 string CAR\ 2.00RG SAPCAR archive data 326# Disintegrator 3270 string DST Disintegrator archive data 328# ASD 3290 string ASD ASD archive data 330# InstallShield CAB 3310 string ISc( InstallShield CAB 332# TOP4 3330 string T4\x1a TOP4 archive data 334# BatComp left out: sig looks like COM executable 335# so TODO: get real 4dos batcomp file and find sig 336# BlakHole 3370 string BH\5\7 BlakHole archive data 338# BIX 3390 string BIX0 BIX archive data 340# ChiefLZA 3410 string ChfLZ ChiefLZA archive data 342# Blink 3430 string Blink Blink archive data 344# Logitech Compress 3450 string \xda\xfa Logitech Compress archive data 346# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 3471 string (C)\ STEPANYUK ARS-Sfx archive data 348# AKT/AKT32 3490 string AKT32 AKT32 archive data 3500 string AKT AKT archive data 351# NPack 3520 string MSTSM NPack archive data 353# PFT 3540 string \0\x50\0\x14 PFT archive data 355# SemOne 3560 string SEM SemOne archive data 357# PPMD 3580 string \x8f\xaf\xac\x84 PPMD archive data 359# FIZ 3600 string FIZ FIZ archive data 361# MSXiE 3620 belong&0xfffff0f0 0x4d530000 MSXiE archive data 363# DeepFreezer 3640 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 365# DC 3660 string =<DC- DC archive data 367# TPac 3680 string \4TPAC\3 TPac archive data 369# Ai 3700 string Ai\1\1\0 Ai archive data 3710 string Ai\1\0\0 Ai archive data 372# Ai32 3730 string Ai\2\0 Ai32 archive data 3740 string Ai\2\1 Ai32 archive data 375# SBC 3760 string SBC SBC archive data 377# Ybs 3780 string YBS Ybs archive data 379# DitPack 3800 string \x9e\0\0 DitPack archive data 381# DMS 3820 string DMS! DMS archive data 383# EPC 3840 string \x8f\xaf\xac\x8c EPC archive data 385# VSARC 3860 string VS\x1a VSARC archive data 387# PDZ 3880 string PDZ PDZ archive data 389# ReDuq 3900 string rdqx ReDuq archive data 391# GCA 3920 string GCAX GCA archive data 393# PPMN 3940 string pN PPMN archive data 395# WinImage 3963 string WINIMAGE WinImage archive data 397# Compressia 3980 string CMP0CMP Compressia archive data 399# UHBC 4000 string UHB UHBC archive data 401# WinHKI 4020 string \x61\x5C\x04\x05 WinHKI archive data 403# WWPack data file 4040 string WWP WWPack archive data 405# BSN (BSA, PTS-DOS) 4060 string \xffBSG BSN archive data 4071 string \xffBSG BSN archive data 4083 string \xffBSG BSN archive data 4091 string \0\xae\2 BSN archive data 4101 string \0\xae\3 BSN archive data 4111 string \0\xae\7 BSN archive data 412# AIN 4130 string \x33\x18 AIN archive data 4140 string \x33\x17 AIN archive data 415# XPA32 4160 string xpa\0\1 XPA32 archive data 417# SZip (TODO: doesn't catch all versions) 4180 string SZ\x0a\4 SZip archive data 419# XPack DiskImage 4200 string jm XPack DiskImage archive data 421# XPack Data 4220 string xpa XPack archive data 423# XPack Single Data 4240 string Í\ jm XPack single archive data 425 426# TODO: missing due to unknown magic/magic at end of file: 427#DWC 428#ARG 429#ZAR 430#PC/3270 431#InstallIt 432#RKive 433#RK 434#XPack Diskimage 435 436# These were inspired by idarc, but actually verified 437# Dzip archiver (.dz) 4380 string DZ Dzip archive data 439>2 byte x \b, version %i 440>3 byte x \b.%i 441# ZZip archiver (.zz) 4420 string ZZ\ \0\0 ZZip archive data 4430 string ZZ0 ZZip archive data 444# PAQ archiver (.paq) 4450 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 4460 string PAQ PAQ archive data 447>3 byte&0xf0 0x30 448>>3 byte x (v%c) 449# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 4500xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 4510 string JARCS JAR (ARJ Software, Inc.) archive data 452 453# ARJ archiver (jason@jarthur.Claremont.EDU) 4540 leshort 0xea60 ARJ archive data 455!:mime application/x-arj 456>5 byte x \b, v%d, 457>8 byte &0x04 multi-volume, 458>8 byte &0x10 slash-switched, 459>8 byte &0x20 backup, 460>34 string x original name: %s, 461>7 byte 0 os: MS-DOS 462>7 byte 1 os: PRIMOS 463>7 byte 2 os: Unix 464>7 byte 3 os: Amiga 465>7 byte 4 os: Macintosh 466>7 byte 5 os: OS/2 467>7 byte 6 os: Apple ][ GS 468>7 byte 7 os: Atari ST 469>7 byte 8 os: NeXT 470>7 byte 9 os: VAX/VMS 471>3 byte >0 %d] 472# [JW] idarc says this is also possible 4732 leshort 0xea60 ARJ archive data 474 475# HA archiver (Greg Roelofs, newt@uchicago.edu) 476# This is a really bad format. A file containing HAWAII will match this... 477#0 string HA HA archive data, 478#>2 leshort =1 1 file, 479#>2 leshort >1 %u files, 480#>4 byte&0x0f =0 first is type CPY 481#>4 byte&0x0f =1 first is type ASC 482#>4 byte&0x0f =2 first is type HSC 483#>4 byte&0x0f =0x0e first is type DIR 484#>4 byte&0x0f =0x0f first is type SPECIAL 485# suggestion: at least identify small archives (<1024 files) 4860 belong&0xffff00fc 0x48410000 HA archive data 487>2 leshort =1 1 file, 488>2 leshort >1 %u files, 489>4 byte&0x0f =0 first is type CPY 490>4 byte&0x0f =1 first is type ASC 491>4 byte&0x0f =2 first is type HSC 492>4 byte&0x0f =0x0e first is type DIR 493>4 byte&0x0f =0x0f first is type SPECIAL 494 495# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 4960 string HPAK HPACK archive data 497 498# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 4990 string \351,\001JAM\ JAM archive, 500>7 string >\0 version %.4s 501>0x26 byte =0x27 - 502>>0x2b string >\0 label %.11s, 503>>0x27 lelong x serial %08x, 504>>0x36 string >\0 fstype %.8s 505 506# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 5072 string -lh0- LHarc 1.x/ARX archive data [lh0] 508!:mime application/x-lharc 5092 string -lh1- LHarc 1.x/ARX archive data [lh1] 510!:mime application/x-lharc 5112 string -lz4- LHarc 1.x archive data [lz4] 512!:mime application/x-lharc 5132 string -lz5- LHarc 1.x archive data [lz5] 514!:mime application/x-lharc 515# [never seen any but the last; -lh4- reported in comp.compression:] 5162 string -lzs- LHa/LZS archive data [lzs] 517!:mime application/x-lha 5182 string -lh\40- LHa 2.x? archive data [lh ] 519!:mime application/x-lha 5202 string -lhd- LHa 2.x? archive data [lhd] 521!:mime application/x-lha 5222 string -lh2- LHa 2.x? archive data [lh2] 523!:mime application/x-lha 5242 string -lh3- LHa 2.x? archive data [lh3] 525!:mime application/x-lha 5262 string -lh4- LHa (2.x) archive data [lh4] 527!:mime application/x-lha 5282 string -lh5- LHa (2.x) archive data [lh5] 529!:mime application/x-lha 5302 string -lh6- LHa (2.x) archive data [lh6] 531!:mime application/x-lha 5322 string -lh7- LHa (2.x)/LHark archive data [lh7] 533!:mime application/x-lha 534>20 byte x - header level %d 535# taken from idarc [JW] 5362 string -lZ PUT archive data 5372 string -lz LZS archive data 5382 string -sw1- Swag archive data 539 540# RAR archiver (Greg Roelofs, newt@uchicago.edu) 5410 string Rar! RAR archive data, 542!:mime application/x-rar 543>44 byte x v%0x, 544>10 byte >0 flags: 545>>10 byte &0x01 Archive volume, 546>>10 byte &0x02 Commented, 547>>10 byte &0x04 Locked, 548>>10 byte &0x08 Solid, 549>>10 byte &0x20 Authenticated, 550>35 byte 0 os: MS-DOS 551>35 byte 1 os: OS/2 552>35 byte 2 os: Win32 553>35 byte 3 os: Unix 554# some old version? idarc says: 5550 string RE\x7e\x5e RAR archive data 556 557# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 5580 string SQSH squished archive data (Acorn RISCOS) 559 560# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 561# [JW] see exe section for self-extracting version 5620 string UC2\x1a UC2 archive data 563 564# PKZIP multi-volume archive 5650 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 566!:mime application/zip 567 568# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 5690 string PK\003\004 570 571# Specialised zip formats which start with a member named 'mimetype' 572# (stored uncompressed, with no 'extra field') containing the file's MIME type. 573# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 574# contents starting with "application/": 575>26 string \x8\0\0\0mimetypeapplication/ 576 577# KOffice / OpenOffice & StarOffice / OpenDocument formats 578# From: Abel Cheung <abel@oaka.org> 579 580# KOffice (1.2 or above) formats 581# (mimetype contains "application/vnd.kde.<SUBTYPE>") 582>>50 string vnd.kde. KOffice (>=1.2) 583>>>58 string karbon Karbon document 584>>>58 string kchart KChart document 585>>>58 string kformula KFormula document 586>>>58 string kivio Kivio document 587>>>58 string kontour Kontour document 588>>>58 string kpresenter KPresenter document 589>>>58 string kspread KSpread document 590>>>58 string kword KWord document 591 592# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 593# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 594>>50 string vnd.sun.xml. OpenOffice.org 1.x 595>>>62 string writer Writer 596>>>>68 byte !0x2e document 597>>>>68 string .template template 598>>>>68 string .global global document 599>>>62 string calc Calc 600>>>>66 byte !0x2e spreadsheet 601>>>>66 string .template template 602>>>62 string draw Draw 603>>>>66 byte !0x2e document 604>>>>66 string .template template 605>>>62 string impress Impress 606>>>>69 byte !0x2e presentation 607>>>>69 string .template template 608>>>62 string math Math document 609>>>62 string base Database file 610 611# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 612# http://lists.oasis-open.org/archives/office/200505/msg00006.html 613# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 614>>50 string vnd.oasis.opendocument. OpenDocument 615>>>73 string text 616>>>>77 byte !0x2d Text 617!:mime application/vnd.oasis.opendocument.text 618>>>>77 string -template Text Template 619!:mime application/vnd.oasis.opendocument.text-template 620>>>>77 string -web HTML Document Template 621!:mime application/vnd.oasis.opendocument.text-web 622>>>>77 string -master Master Document 623!:mime application/vnd.oasis.opendocument.text-master 624>>>73 string graphics 625>>>>81 byte !0x2d Drawing 626!:mime application/vnd.oasis.opendocument.graphics 627>>>>81 string -template Template 628!:mime application/vnd.oasis.opendocument.graphics-template 629>>>73 string presentation 630>>>>85 byte !0x2d Presentation 631!:mime application/vnd.oasis.opendocument.presentation 632>>>>85 string -template Template 633!:mime application/vnd.oasis.opendocument.presentation-template 634>>>73 string spreadsheet 635>>>>84 byte !0x2d Spreadsheet 636!:mime application/vnd.oasis.opendocument.spreadsheet 637>>>>84 string -template Template 638!:mime application/vnd.oasis.opendocument.spreadsheet-template 639>>>73 string chart 640>>>>78 byte !0x2d Chart 641!:mime application/vnd.oasis.opendocument.chart 642>>>>78 string -template Template 643!:mime application/vnd.oasis.opendocument.chart-template 644>>>73 string formula 645>>>>80 byte !0x2d Formula 646!:mime application/vnd.oasis.opendocument.formula 647>>>>80 string -template Template 648!:mime application/vnd.oasis.opendocument.formula-template 649>>>73 string database Database 650!:mime application/vnd.oasis.opendocument.database 651>>>73 string image 652>>>>78 byte !0x2d Image 653!:mime application/vnd.oasis.opendocument.image 654>>>>78 string -template Template 655!:mime application/vnd.oasis.opendocument.image-template 656 657# StarView Metafile 658# From Pierre Ducroquet <pinaraf@pinaraf.info> 6590 string VCLMTF StarView MetaFile 660>6 beshort x \b, version %d 661>8 belong x \b, size %d 662 663# EPUB (OEBPS) books using OCF (OEBPS Container Format) 664# From: Adam Buchbinder <adam.buchbinder@gmail.com> 665# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 666# (mimetype contains "application/epub+zip") 667>>50 string epub+zip EPUB ebook data 668!:mime application/epub+zip 669 670# Catch other ZIP-with-mimetype formats 671# In a ZIP file, the bytes immediately after a member's contents are 672# always "PK". The 2 regex rules here print the "mimetype" member's 673# contents up to the first 'P'. Luckily, most MIME types don't contain 674# any capital 'P's. This is a kludge. 675# (mimetype contains "application/<OTHER>") 676>>50 string !epub+zip 677>>>50 string !vnd.oasis.opendocument. 678>>>>50 string !vnd.sun.xml. 679>>>>>50 string !vnd.kde. 680>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 681!:mime application/zip 682# (mimetype contents other than "application/*") 683>26 string \x8\0\0\0mimetype 684>>38 string !application/ 685>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 686!:mime application/zip 687 688# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 689# Next line excludes specialized formats: 690>26 string !\x8\0\0\0mimetype Zip archive data 691!:mime application/zip 692>>4 byte 0x09 \b, at least v0.9 to extract 693>>4 byte 0x0a \b, at least v1.0 to extract 694>>4 byte 0x0b \b, at least v1.1 to extract 695>>0x161 string WINZIP \b, WinZIP self-extracting 696>>4 byte 0x14 \b, at least v2.0 to extract 697 698# Zoo archiver 69920 lelong 0xfdc4a7dc Zoo archive data 700!:mime application/x-zoo 701>4 byte >48 \b, v%c. 702>>6 byte >47 \b%c 703>>>7 byte >47 \b%c 704>32 byte >0 \b, modify: v%d 705>>33 byte x \b.%d+ 706>42 lelong 0xfdc4a7dc \b, 707>>70 byte >0 extract: v%d 708>>>71 byte x \b.%d+ 709 710# Shell archives 71110 string #\ This\ is\ a\ shell\ archive shell archive text 712!:mime application/octet-stream 713 714# 715# LBR. NB: May conflict with the questionable 716# "binary Computer Graphics Metafile" format. 717# 7180 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 719# 720# PMA (CP/M derivative of LHA) 721# 7222 string -pm0- PMarc archive data [pm0] 7232 string -pm1- PMarc archive data [pm1] 7242 string -pm2- PMarc archive data [pm2] 7252 string -pms- PMarc SFX archive (CP/M, DOS) 7265 string -pc1- PopCom compressed executable (CP/M) 727 728# From Rafael Laboissiere <rafael@laboissiere.net> 729# The Project Revision Control System (see 730# http://prcs.sourceforge.net) generates a packaged project 731# file which is recognized by the following entry: 7320 leshort 0xeb81 PRCS packaged project 733 734# Microsoft cabinets 735# by David Necas (Yeti) <yeti@physics.muni.cz> 736#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 737#>25 byte x v%d 738#>24 byte x \b.%d 739# MPi: All CABs have version 1.3, so this is pointless. 740# Better magic in debian-additions. 741 742# GTKtalog catalogs 743# by David Necas (Yeti) <yeti@physics.muni.cz> 7444 string gtktalog\ GTKtalog catalog data, 745>13 string 3 version 3 746>>14 beshort 0x677a (gzipped) 747>>14 beshort !0x677a (not gzipped) 748>13 string >3 version %s 749 750############################################################################ 751# Parity archive reconstruction file, the 'par' file format now used on Usenet. 7520 string PAR\0 PARity archive data 753>48 leshort =0 - Index file 754>48 leshort >0 - file number %d 755 756# Felix von Leitner <felix-file@fefe.de> 7570 string d8:announce BitTorrent file 758!:mime application/x-bittorrent 759 760# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 7610 beshort 0x0e0f Atari MSA archive data 762>2 beshort x \b, %d sectors per track 763>4 beshort 0 \b, 1 sided 764>4 beshort 1 \b, 2 sided 765>6 beshort x \b, starting track: %d 766>8 beshort x \b, ending track: %d 767 768# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 7690 string PK00PK\003\004 Zip archive data 770 771# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 772# by Stefan `Sec` Zehl <sec@42.org> 7737 string **ACE** ACE archive data 774>15 byte >0 version %d 775>16 byte =0x00 \b, from MS-DOS 776>16 byte =0x01 \b, from OS/2 777>16 byte =0x02 \b, from Win/32 778>16 byte =0x03 \b, from Unix 779>16 byte =0x04 \b, from MacOS 780>16 byte =0x05 \b, from WinNT 781>16 byte =0x06 \b, from Primos 782>16 byte =0x07 \b, from AppleGS 783>16 byte =0x08 \b, from Atari 784>16 byte =0x09 \b, from Vax/VMS 785>16 byte =0x0A \b, from Amiga 786>16 byte =0x0B \b, from Next 787>14 byte x \b, version %d to extract 788>5 leshort &0x0080 \b, multiple volumes, 789>>17 byte x \b (part %d), 790>5 leshort &0x0002 \b, contains comment 791>5 leshort &0x0200 \b, sfx 792>5 leshort &0x0400 \b, small dictionary 793>5 leshort &0x0800 \b, multi-volume 794>5 leshort &0x1000 \b, contains AV-String 795>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 796>5 leshort &0x2000 \b, with recovery record 797>5 leshort &0x4000 \b, locked 798>5 leshort &0x8000 \b, solid 799# Date in MS-DOS format (whatever that is) 800#>18 lelong x Created on 801 802# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 803# <doj@cubic.org> 8040x1A string sfArk sfArk compressed Soundfont 805>0x15 string 2 806>>0x1 string >\0 Version %s 807>>0x2A string >\0 : %s 808 809# DR-DOS 7.03 Packed File *.??_ 8100 string Packed\ File\ Personal NetWare Packed File 811>12 string x \b, was "%.12s" 812 813# EET archive 814# From: Tilman Sauerbeck <tilman@code-monkey.de> 8150 belong 0x1ee7ff00 EET archive 816!:mime application/x-eet 817 818# rzip archives 8190 string RZIP rzip compressed data 820>4 byte x - version %d 821>5 byte x \b.%d 822>6 belong x (%d bytes) 823 824# From: "Robert Dale" <robdale@gmail.com> 8250 belong 123 dar archive, 826>4 belong x label "%.8x 827>>8 belong x %.8x 828>>>12 beshort x %.4x" 829>14 byte 0x54 end slice 830>14 beshort 0x4e4e multi-part 831>14 beshort 0x4e53 multi-part, with -S 832 833# Symbian installation files 834# http://www.thouky.co.uk/software/psifs/sis.html 835# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8368 lelong 0x10000419 Symbian installation file 837!:mime application/vnd.symbian.install 838>4 lelong 0x1000006D (EPOC release 3/4/5) 839>4 lelong 0x10003A12 (EPOC release 6) 8400 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 841!:mime x-epoc/x-sisx-app 842 843# From "Nelson A. de Oliveira" <naoliv@gmail.com> 8440 string MPQ\032 MoPaQ (MPQ) archive 845 846# From: Dirk Jagdmann <doj@cubic.org> 847# xar archive format: http://code.google.com/p/xar/ 8480 string xar! xar archive 849>6 beshort x - version %ld 850 851# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 852# .kgb 8530 string KGB_arch KGB Archiver file 854>10 string x with compression level %.1s 855 856# xar (eXtensible ARchiver) archive 857# From: "David Remahl" <dremahl@apple.com> 8580 string xar! xar archive 859#>4 beshort x header size %d 860>6 beshort x version %d, 861#>8 quad x compressed TOC: %d, 862#>16 quad x uncompressed TOC: %d, 863>24 belong 0 no checksum 864>24 belong 1 SHA-1 checksum 865>24 belong 2 MD5 checksum 866 867# Type: Parity Archive 868# From: Daniel van Eeden <daniel_e@dds.nl> 8690 string PAR2 Parity Archive Volume Set 870 871# Bacula volume format. (Volumes always start with a block header.) 872# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 873# From: Adam Buchbinder <adam.buchbinder@gmail.com> 87412 string BB02 Bacula volume 875>20 bedate x \b, started %s 876 877# ePub is XHTML + XML inside a ZIP archive. The first member of the 878# archive must be an uncompressed file called 'mimetype' with contents 879# 'application/epub+zip' 880 881# start by checking that this is a ZIP archive, then check for the 882# proper mimetype file 883# From: Ralf Brown <ralf.brown@gmail.com> 8840 string PK\003\004 885>0x1E string mimetypeapplication/epub+zip EPUB document 886!:mime application/epub+zip 887 888# From: "Michał Górny" <mgorny@gentoo.org> 889# ZPAQ: http://mattmahoney.net/dc/zpaq.html 8900 string zPQ ZPAQ stream 891>3 byte x \b, level %d 892