1#------------------------------------------------------------------------------
2# $File: filesystems,v 1.131 2019/11/15 23:49:38 christos Exp $
3# filesystems:  file(1) magic for different filesystems
4#
50	name	partid
6>0	ubyte	0x00	Unused
7>0	ubyte	0x01	12-bit FAT
8>0	ubyte	0x02	XENIX /
9>0	ubyte	0x03	XENIX /usr
10>0	ubyte	0x04	16-bit FAT, less than 32M
11>0	ubyte	0x05	extended partition
12>0	ubyte	0x06	16-bit FAT, more than 32M
13>0	ubyte	0x07	OS/2 HPFS, NTFS, QNX2, Adv. UNIX
14>0	ubyte	0x08	AIX or os, or etc.
15>0	ubyte	0x09	AIX boot partition or Coherent
16>0	ubyte	0x0a	O/2 boot manager or Coherent swap
17>0	ubyte	0x0b	32-bit FAT
18>0	ubyte	0x0c	32-bit FAT, LBA-mapped
19>0	ubyte	0x0d	7XXX, LBA-mapped
20>0	ubyte	0x0e	16-bit FAT, LBA-mapped
21>0	ubyte	0x0f	extended partition, LBA-mapped
22>0	ubyte	0x10	OPUS
23>0	ubyte	0x11 	OS/2 DOS 12-bit FAT
24>0	ubyte	0x12 	Compaq diagnostics
25>0	ubyte	0x14 	OS/2 DOS 16-bit FAT <32M
26>0	ubyte	0x16 	OS/2 DOS 16-bit FAT >=32M
27>0	ubyte	0x17 	OS/2 hidden IFS
28>0	ubyte	0x18 	AST Windows swapfile
29>0	ubyte	0x19 	Willowtech Photon coS
30>0	ubyte	0x1b 	hidden win95 fat 32
31>0	ubyte	0x1c 	hidden win95 fat 32 lba
32>0	ubyte	0x1d	hidden win95 fat 16 lba
33>0	ubyte	0x20 	Willowsoft OFS1
34>0	ubyte	0x21 	reserved
35>0	ubyte	0x23 	reserved
36>0	ubyte	0x24	NEC DOS
37>0	ubyte	0x26 	reserved
38>0	ubyte	0x31 	reserved
39>0	ubyte	0x32	Alien Internet Services NOS
40>0	ubyte	0x33 	reserved
41>0	ubyte	0x34 	reserved
42>0	ubyte	0x35 	JFS on OS2
43>0	ubyte	0x36 	reserved
44>0	ubyte	0x38 	Theos
45>0	ubyte	0x39 	Plan 9, or Theos spanned
46>0	ubyte	0x3a 	Theos ver 4 4gb partition
47>0	ubyte	0x3b 	Theos ve 4 extended partition
48>0	ubyte	0x3c 	PartitionMagic recovery
49>0	ubyte	0x3d 	Hidden Netware
50>0	ubyte	0x40 	VENIX 286 or LynxOS
51>0	ubyte	0x41	PReP
52>0	ubyte	0x42	linux swap sharing DRDOS disk
53>0	ubyte	0x43	linux sharing DRDOS disk
54>0	ubyte	0x44	GoBack change utility
55>0	ubyte	0x45	Boot US Boot manager
56>0	ubyte	0x46	EUMEL/Elan or Ergos 3
57>0	ubyte	0x47	EUMEL/Elan or Ergos 3
58>0	ubyte	0x48	EUMEL/Elan or Ergos 3
59>0	ubyte	0x4a	ALFX/THIN filesystem for DOS
60>0	ubyte	0x4c	Oberon partition
61>0	ubyte	0x4d 	QNX4.x
62>0	ubyte	0x4e 	QNX4.x 2nd part
63>0	ubyte	0x4f 	QNX4.x 3rd part
64>0	ubyte	0x50 	DM (disk manager)
65>0	ubyte	0x51 	DM6 Aux1 (or Novell)
66>0	ubyte	0x52 	CP/M or Microport SysV/AT
67>0	ubyte	0x53 	DM6 Aux3
68>0	ubyte	0x54	DM6 DDO
69>0	ubyte	0x55	EZ-Drive (disk manager)
70>0	ubyte	0x56	Golden Bow (disk manager)
71>0	ubyte	0x57	Drive PRO
72>0	ubyte	0x5c	Priam Edisk (disk manager)
73>0	ubyte	0x61	SpeedStor
74>0	ubyte	0x63	GNU HURD or Mach or Sys V/386
75>0	ubyte	0x64	Novell Netware 2.xx or Speedstore
76>0	ubyte	0x65	Novell Netware 3.xx
77>0	ubyte	0x66	Novell 386 Netware
78>0	ubyte	0x67	Novell
79>0	ubyte	0x68	Novell
80>0	ubyte	0x69	Novell
81>0	ubyte	0x70	DiskSecure Multi-Boot
82>0	ubyte	0x71	reserved
83>0	ubyte	0x73	reserved
84>0	ubyte	0x74	reserved
85>0	ubyte	0x75	PC/IX
86>0	ubyte	0x76	reserved
87>0	ubyte	0x77	M2FS/M2CS partition
88>0	ubyte	0x78	XOSL boot loader filesystem
89>0	ubyte	0x80	MINIX until 1.4a
90>0	ubyte	0x81	MINIX since 1.4b
91>0	ubyte	0x82	Linux swap or Solaris
92>0	ubyte	0x83	Linux native
93>0	ubyte	0x84	OS/2 hidden C: drive
94>0	ubyte	0x85	Linux extended partition
95>0	ubyte	0x86	NT FAT volume set
96>0	ubyte	0x87	NTFS volume set or HPFS mirrored
97>0	ubyte	0x8a	Linux Kernel AiR-BOOT partition
98>0	ubyte	0x8b	Legacy Fault tolerant FAT32
99>0	ubyte	0x8c	Legacy Fault tolerant FAT32 ext
100>0	ubyte	0x8d	Hidden free FDISK FAT12
101>0	ubyte	0x8e	Linux Logical Volume Manager
102>0	ubyte	0x90	Hidden free FDISK FAT16
103>0	ubyte	0x91	Hidden free FDISK DOS EXT
104>0	ubyte	0x92	Hidden free FDISK FAT16 Big
105>0	ubyte	0x93	Amoeba filesystem
106>0	ubyte	0x94	Amoeba bad block table
107>0	ubyte	0x95	MIT EXOPC native partitions
108>0	ubyte	0x97	Hidden free FDISK FAT32
109>0	ubyte	0x98	Datalight ROM-DOS Super-Boot
110>0	ubyte	0x99	Mylex EISA SCSI
111>0	ubyte	0x9a	Hidden free FDISK FAT16 LBA
112>0	ubyte	0x9b	Hidden free FDISK EXT LBA
113>0	ubyte	0x9f	BSDI?
114>0	ubyte	0xa0	IBM Thinkpad hibernation
115>0	ubyte	0xa1	HP Volume expansion (SpeedStor)
116>0	ubyte	0xa3	HP Volume expansion (SpeedStor)
117>0	ubyte	0xa4	HP Volume expansion (SpeedStor)
118>0	ubyte	0xa5	386BSD partition type
119>0	ubyte	0xa6	OpenBSD partition type
120>0	ubyte	0xa7	NeXTSTEP 486
121>0	ubyte	0xa8	Apple UFS
122>0	ubyte	0xa9	NetBSD partition type
123>0	ubyte	0xaa	Olivetty Fat12 1.44MB Service part
124>0	ubyte	0xab	Apple Boot
125>0	ubyte	0xae	SHAG OS filesystem
126>0	ubyte	0xaf	Apple HFS
127>0	ubyte	0xb0	BootStar Dummy
128>0	ubyte	0xb1	reserved
129>0	ubyte	0xb3	reserved
130>0	ubyte	0xb4	reserved
131>0	ubyte	0xb6	reserved
132>0	ubyte	0xb7	BSDI BSD/386 filesystem
133>0	ubyte	0xb8	BSDI BSD/386 swap
134>0	ubyte	0xbb	Boot Wizard Hidden
135>0	ubyte	0xbe	Solaris 8 partition type
136>0	ubyte	0xbf	Solaris partition type
137>0	ubyte	0xc0 	CTOS
138>0	ubyte	0xc1 	DRDOS/sec (FAT-12)
139>0	ubyte	0xc2 	Hidden Linux
140>0	ubyte	0xc3 	Hidden Linux swap
141>0	ubyte	0xc4 	DRDOS/sec (FAT-16, < 32M)
142>0	ubyte	0xc5 	DRDOS/sec (EXT)
143>0	ubyte	0xc6 	DRDOS/sec (FAT-16, >= 32M)
144>0	ubyte	0xc7 	Syrinx (Cyrnix?) or HPFS disabled
145>0	ubyte	0xc8 	Reserved for DR-DOS 8.0+
146>0	ubyte	0xc9 	Reserved for DR-DOS 8.0+
147>0	ubyte	0xca 	Reserved for DR-DOS 8.0+
148>0	ubyte	0xcb 	DR-DOS 7.04+ Secured FAT32 CHS
149>0	ubyte	0xcc 	DR-DOS 7.04+ Secured FAT32 LBA
150>0	ubyte	0xcd	CTOS Memdump
151>0	ubyte	0xce 	DR-DOS 7.04+ FAT16X LBA
152>0	ubyte	0xcf 	DR-DOS 7.04+ EXT LBA
153>0	ubyte	0xd0 	REAL/32 secure big partition
154>0	ubyte	0xd1 	Old Multiuser DOS FAT12
155>0	ubyte	0xd4 	Old Multiuser DOS FAT16 Small
156>0	ubyte	0xd5 	Old Multiuser DOS Extended
157>0	ubyte	0xd6 	Old Multiuser DOS FAT16 Big
158>0	ubyte	0xd8 	CP/M 86
159>0	ubyte	0xdb 	CP/M or Concurrent CP/M
160>0	ubyte	0xdd 	Hidden CTOS Memdump
161>0	ubyte	0xde 	Dell PowerEdge Server utilities
162>0	ubyte	0xdf 	DG/UX virtual disk manager
163>0	ubyte	0xe0 	STMicroelectronics ST AVFS
164>0	ubyte	0xe1 	DOS access or SpeedStor 12-bit
165>0	ubyte	0xe3 	DOS R/O or Storage Dimensions
166>0	ubyte	0xe4 	SpeedStor 16-bit FAT < 1024 cyl.
167>0	ubyte	0xe5	reserved
168>0	ubyte	0xe6	reserved
169>0	ubyte	0xeb 	BeOS
170>0	ubyte	0xee	GPT Protective MBR
171>0	ubyte	0xef	EFI system partition
172>0	ubyte	0xf0 	Linux PA-RISC boot loader
173>0	ubyte	0xf1 	SpeedStor or Storage Dimensions
174>0	ubyte	0xf2 	DOS 3.3+ Secondary
175>0	ubyte	0xf3	reserved
176>0	ubyte	0xf4	SpeedStor large partition
177>0	ubyte	0xf5	Prologue multi-volumen partition
178>0	ubyte	0xf6 	reserved
179>0	ubyte	0xf9 	pCache: ext2/ext3 persistent cache
180>0	ubyte	0xfa 	Bochs x86 emulator
181>0	ubyte	0xfb 	VMware File System
182>0	ubyte	0xfc 	VMware Swap
183>0	ubyte	0xfd 	Linux RAID partition persistent sb
184>0	ubyte	0xfe	LANstep or IBM PS/2 IML
185>0	ubyte	0xff 	Xenix Bad Block Table
186
1870	string	\366\366\366\366	PC formatted floppy with no filesystem
188# Sun disk labels
189# From /usr/include/sun/dklabel.h:
1900774	beshort		0xdabe
191# modified by Joerg Jenderek, because original test
192# succeeds for Cabinet archive dao360.dl_ with negative blocks
193>0770	long		>0		Sun disk label
194>>0	string		x		'%s
195>>>31	string		>\0		\b%s
196>>>>63	string		>\0		\b%s
197>>>>>95	string		>\0		\b%s
198>>0	string		x		\b'
199>>0734	short		>0		%d rpm,
200>>0736	short		>0		%d phys cys,
201>>0740	short		>0		%d alts/cyl,
202>>0746	short		>0		%d interleave,
203>>0750	short		>0		%d data cyls,
204>>0752	short		>0		%d alt cyls,
205>>0754	short		>0		%d heads/partition,
206>>0756	short		>0		%d sectors/track,
207>>0764	long		>0		start cyl %d,
208>>0770	long		x		%d blocks
209# Is there a boot block written 1 sector in?
210>512    belong&077777777	0600407	\b, boot block present
211
212# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
213# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
2140		string	SBMBAKUP_	Smart Boot Manager backup file
215>9		string	x		\b, version %-5.5s
216>>14		string	=_
217>>>15		string	x		%-.1s
218>>>>16		string	=_		\b.
219>>>>>17		string	x		\b%-.1s
220>>>>>>18	string	=_		\b.
221>>>>>>>19	string	x		\b%-.1s
222>>>22		ubyte	0
223>>>>21		ubyte	x		\b, from drive 0x%x
224>>>22		ubyte	>0
225>>>>21		string	x		\b, from drive %s
226>>>535		search/17	\x55\xAA
227>>>>&-512	indirect	x	\b; contains
228
229# updated by Joerg Jenderek at Nov 2012
230# DOS Emulator image is 128 byte, null right padded header + harddisc image
2310	string	DOSEMU\0
232>0x27E	leshort	0xAA55
233#offset is 128
234>>19	ubyte	128
235>>>(19.b-1)	ubyte	0x0	DOS Emulator image
236>>>>7	ulelong	>0		\b, %u heads
237>>>>11	ulelong	>0		\b, %d sectors/track
238>>>>15	ulelong	>0		\b, %d cylinders
239>>>>128	indirect	x	\b; contains
240
241# added by Joerg Jenderek at Nov 2012
242# http://www.thenakedpc.com/articles/v04/08/0408-05.html
243# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
2440	string	PNCIHISK\0		Norton Utilities disc image data
245# real x86 boot sector with jump instruction
246>509	search/1026	\x55\xAA\xeb
247>>&-1	indirect	x		\b; contains
248# http://file-extension.net/seeker/file_extension_dat
2490	string	PNCIUNDO		Norton Disk Doctor UnDo file
250#
251
252# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
253# for any allowed sector sizes
25430		search/481	\x55\xAA
255# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
256# DOS BPB information (70) and after DOS floppy (120) like in previous file version
257!:strength +65
258# for sector sizes < 512 Bytes
259>11		uleshort	<512
260>>(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
261# for sector sizes with 512 or more Bytes
262>0x1FE		leshort		0xAA55		DOS/MBR boot sector
263
264# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
265# only for sector sizes with 512 or more Bytes
2660x1FE          leshort         0xAA55         	DOS/MBR boot sector
267#
268# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
269!:strength +65
270>2		string		OSBS		OS/BS MBR
271# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/
272# and https://en.wikipedia.org/wiki/Master_Boot_Record
273# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
274# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
275>0	search/2	\x33\xc0\x8e\xd0\xbc\x00\x7c	MS-MBR
276# Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
277# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
278>>8	ubequad		0x8bf45007501ffbfc
279# https://thestarman.pcministry.com/asm/mbr/200MBR.htm
280>>>0x16	ubyte		0xF3				\b,DOS 2
281>>>>219	regex		Author\ -\ 			Author:
282# found "David Litton" , "A Pehrsson  "
283>>>>>&0	string		x				"%s"
284>>>0x16	ubyte		0xF2
285# NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
286# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
287>>>>0x22	ubequad	0xbf7c07813d5aa575		\b,NEC 3.3
288# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
289>>>>0x22	default	x				\b,D0S version 3.3-7.0
290# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
291# where nn is string offset varying for different languages
292# "Invalid partition table"				nn=0x8b for english version
293>>>>>(0x49.b)	string		Invalid\ partition\ table		english
294>>>>>(0x49.b)	string		Ung\201ltige\ Partitionstabelle		german
295>>>>>(0x49.b)	string		Table\ de\ partition\ invalide		french
296>>>>>(0x49.b)	string		Tabela\ de\ parti\207ao\ inv\240lida	portuguese
297>>>>>(0x49.b)	string		Tabla\ de\ partici\242n\ no\ v\240lida	spanish
298>>>>>(0x49.b)	string		Tavola\ delle\ partizioni\ non\ valida	italian
299>>>>>0x49	ubyte		>0			at offset 0x%x
300>>>>>>(0x49.b)	string		>\0			"%s"
301# "Error loading operating system"			nn=0xa3 for english version
302# "Fehler beim Laden des Betriebssystems"		nn=0xa7 for german version
303# "Erreur en chargeant syst\212me d'exploitation"	nn=0xa7 for french version
304# "Erro na inicializa\207ao do sistema operacional"	nn=0xa7 for portuguese Brazilian version
305# "Error al cargar sistema operativo"			nn=0xa8 for spanish version
306# "Errore durante il caricamento del sistema operativo"	nn=0xae for italian version
307>>>>>0x74	ubyte		>0			at offset 0x%x
308>>>>>>(0x74.b)	string		>\0			"%s"
309# "Missing operating system"				nn=0xc2 for english version
310# "Betriebssystem fehlt"				nn=0xcd for german version
311# "Syst\212me d'exploitation absent"			nn=0xd2 for french version
312# "Sistema operacional nao encontrado"			nn=0xd4 for portuguese Brazilian version
313# "Falta sistema operativo"				nn=0xca for spanish version
314# "Sistema operativo mancante"				nn=0xe2 for italian version
315>>>>>0x79	ubyte		>0			at offset 0x%x
316>>>>>>(0x79.b)	string		>\0			"%s"
317# Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
318# assembler instructions: push ax;pop es;push  ax;pop ds;cld;mov si,7c1b
319>>8	ubequad		0x5007501ffcbe1b7c
320# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
321>>>24		ubequad	0xf3a4cbbebe07b104		9M
322# "Invalid partition table"				nn=0x10F for english version
323# "Ung\201ltige Partitionstabelle"				nn=0x10F for german version
324# "Table de partition erron\202e"				nn=0x10F for french version
325# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x10F for russian version
326>>>>(0x3C.b+0x0FF)	string	Invalid\ partition\ table		english
327>>>>(0x3C.b+0x0FF)	string	Ung\201ltige\ Partitionstabelle		german
328>>>>(0x3C.b+0x0FF)	string	Table\ de\ partition\ erron\202e	french
329>>>>(0x3C.b+0x0FF)	string	\215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240	russian
330>>>>0x3C		ubyte	x			at offset 0x%x+0xFF
331>>>>(0x3C.b+0x0FF)	string	>\0			"%s"
332# "Error loading operating system"			nn=0x127 for english version
333# "Fehler beim Laden des Betriebssystems"		nn=0x12b for german version
334# "Erreur lors du chargement du syst\212me d'exploitation"	nn=0x12a for french version
335# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353"	nn=0x12d for russian version
336>>>>0xBD		ubyte	x			at offset 0x1%x
337>>>>(0xBD.b+0x100)	string	>\0			"%s"
338# "Missing operating system"				nn=0x146 for english version
339# "Betriebssystem fehlt"				nn=0x151 for german version
340# "Syst\212me d'exploitation manquant"			nn=0x15e for french version
341# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x156 for russian version
342>>>>0xA9		ubyte	x			at offset 0x1%x
343>>>>(0xA9.b+0x100)	string	>\0			"%s"
344# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
345# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
346>>>24		ubequad	0xf3a4cbbdbe07b104		XP
347# where xxyyzz are lower bits from offsets of error messages varying for different languages
348>>>>0x1B4	ubelong&0x00FFFFFF	0x002c4463	english
349>>>>0x1B4	ubelong&0x00FFFFFF	0x002c486e	german
350# "Invalid partition table"				xx=0x12C for english version
351# "Ung\201ltige Partitionstabelle"				xx=0x12C for german version
352>>>>0x1b5	ubyte		>0			at offset 0x1%x
353>>>>(0x1b5.b+0x100)	string	>\0			"%s"
354# "Error loading operating system"			yy=0x144 for english version
355# "Fehler beim Laden des Betriebssystems"		yy=0x148 for german version
356>>>>0x1b6	ubyte		>0			at offset 0x1%x
357>>>>(0x1b6.b+0x100)	string	>\0			"%s"
358# "Missing operating system"				zz=0x163 for english version
359# "Betriebssystem nicht vorhanden"			zz=0x16e for german version
360>>>>0x1b7	ubyte		>0			at offset 0x1%x
361>>>>(0x1b7.b+0x100)	string	>\0			"%s"
362# Microsoft Windows Vista or 7
363# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
364>>8	ubequad		0xc08ed8be007cbf00
365# Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
366# assembler instructions: jnz 0729;cmp ebx,"TCPA"
367>>>0xEC		ubequad	0x753b6681fb544350		Vista
368# where xxyyzz are lower bits from offsets of error messages varying for different languages
369>>>>0x1B4	ubelong&0x00FFFFFF	0x00627a99	english
370#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
371# "Invalid partition table"				xx=0x162 for english version
372# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
373>>>>0x1b5	ubyte		>0			at offset 0x1%x
374>>>>(0x1b5.b+0x100)	string	>\0			"%s"
375# "Error loading operating system"			yy=0x17a for english version
376# "Fehler beim Laden des Betriebssystems"		yy= 0x1?? for german version
377>>>>0x1b6	ubyte		>0			at offset 0x1%x
378>>>>(0x1b6.b+0x100)	string	>\0			"%s"
379# "Missing operating system"				zz=0x199 for english version
380# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
381>>>>0x1b7	ubyte		>0			at offset 0x1%x
382>>>>(0x1b7.b+0x100)	string	>\0			"%s"
383# Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
384# assembler instructions: cmp ebx,"TCPA";cmp
385>>>0xEC		ubequad	0x6681fb5443504175		Windows 7
386# where xxyyzz are lower bits from offsets of error messages varying for different languages
387>>>>0x1B4	ubelong&0x00FFFFFF	0x00637b9a	english
388#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
389# "Invalid partition table"				xx=0x163 for english version
390# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
391>>>>0x1b5	ubyte		>0			at offset 0x1%x
392>>>>(0x1b5.b+0x100)	string	>\0			"%s"
393# "Error loading operating system"			yy=0x17b for english version
394# "Fehler beim Laden des Betriebssystems"		yy=0x1?? for german version
395>>>>0x1b6	ubyte		>0			at offset 0x1%x
396>>>>(0x1b6.b+0x100)	string	>\0			"%s"
397# "Missing operating system"				zz=0x19a for english version
398# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
399>>>>0x1b7	ubyte		>0			at offset 0x1%x
400>>>>(0x1b7.b+0x100)	string	>\0			"%s"
401# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
402# https://en.wikipedia.org/wiki/MBR_disk_signature#ID
403>>0x1b8	ulelong		>0				\b, disk signature 0x%-.4x
404# driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm
405>>0xDA	uleshort		0
406>>>0xDC 	ulelong		>0			\b, created
407# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
408>>>>0xDC	ubyte		x			with driveID 0x%x
409# hours, minutes and seconds
410>>>>0xDf	ubyte		x			at %x
411>>>>0xDe	ubyte		x			\b:%x
412>>>>0xDd	ubyte		x			\b:%x
413# special case for Microsoft MS-DOS 3.21 spanish
414# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
415>0	ubequad		0xfab830008ed0bc00
416# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
417>>8	ubequad		0x1fbfcb800008ed8		MS-MBR,D0S version 3.21 spanish
418# Microsoft MBR IPL end
419
420# dr-dos with some upper-, lowercase variants
421>0x9D	string	Invalid\ partition\ table$
422>>181	string	No\ Operating\ System$
423>>>201	string	Operating\ System\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
424>0x9D	string	Invalid\ partition\ table$
425>>181	string	No\ operating\ system$
426>>>201	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
427>342	string	Invalid\ partition\ table$
428>>366	string	No\ operating\ system$
429>>>386	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, version 7.01 to 7.03
430>295	string	NEWLDR\0
431>>302	string	Bad\ PT\ $
432>>>310	string	No\ OS\ $
433>>>>317	string	OS\ load\ err$
434>>>>>329	string	Moved\ or\ missing\ IBMBIO.LDR\n\r
435>>>>>>358	string	Press\ any\ key\ to\ continue.\n\r$
436>>>>>>>387	string	Copyright\ (c)\ 1984,1998
437>>>>>>>>411	string	Caldera\ Inc.\0		\b, DR-DOS MBR (IBMBIO.LDR)
438#
439# tests for different MS-DOS Master Boot Records (MBR) moved and merged
440#
441#>0x145	string	Default:\ F				\b, FREE-DOS MBR
442#>0x14B	string	Default:\ F				\b, FREE-DOS 1.0 MBR
443>0x145	search/7	Default:\ F			\b, FREE-DOS MBR
444#>>313		string	F0\ .\ .\ .
445#>>>322		string	disk\ 1
446#>>>>382	string	FAT3
447>64	string	no\ active\ partition\ found
448>>96	string	read\ error\ while\ reading\ drive	\b, FREE-DOS Beta 0.9 MBR
449# Ranish Partition Manager http://www.ranish.com/part/
450>387	search/4	\0\ Error!\r
451>>378	search/7	Virus!
452>>>397	search/4	Booting\040
453>>>>408	search/4	HD1/\0	 			\b, Ranish MBR (
454>>>>>416	string	Writing\ changes...		\b2.37
455>>>>>>438	ubyte		x			\b,0x%x dots
456>>>>>>440	ubyte		>0			\b,virus check
457>>>>>>441	ubyte		>0			\b,partition %c
458#2.38,2.42,2.44
459>>>>>416	string	!Writing\ changes...		\b
460>>>>>>418	ubyte	1				\bvirus check,
461>>>>>>419	ubyte	x				\b0x%x seconds
462>>>>>>420	ubyte&0x0F	>0			\b,partition
463>>>>>>>420	ubyte&0x0F	<5			\b %x
464>>>>>>>420	ubyte&0x0F	0Xf			\b ask
465>>>>>420	ubyte		x			\b)
466#
467# SYSLINUX MBR moved
468# https://www.acronis.de/
469>362	string	MBR\ Error\ \0\r
470>>376	string	ress\ any\ key\ to\040
471>>>392	string	boot\ from\ floppy...\0			\b, Acronis MBR
472# added by Joerg Jenderek
473# https://www.visopsys.org/
474# https://partitionlogic.org.uk/
475>309	string	No\ bootable\ partition\ found\r
476>>339	string	I/O\ Error\ reading\ boot\ sector\r	\b, Visopsys MBR
477>349	string	No\ bootable\ partition\ found\r
478>>379	string	I/O\ Error\ reading\ boot\ sector\r	\b, simple Visopsys MBR
479# bootloader, bootmanager
480>0x40	string	SBML
481# label with 11 characters of FAT 12 bit filesystem
482>>43	string	SMART\ BTMGR
483>>>430	string	SBMK\ Bad!\r			\b, Smart Boot Manager
484# OEM-ID not always "SBM"
485#>>>>3	strings	SBM
486>>>>6	string	>\0                             \b, version %s
487>382	string	XOSLLOADXCF			\b, eXtended Operating System Loader
488>6	string	LILO				\b, LInux i386 boot LOader
489>>120	string	LILO				\b, version 22.3.4 SuSe
490>>172	string	LILO				\b, version 22.5.8 Debian
491# updated by Joerg Jenderek at Oct 2008
492# variables according to grub-0.97/stage1/stage1.S or
493# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
494# usual values are marked with comments to get only informations of strange GRUB loaders
495>342		search/60	\0Geom\0
496#>0		ulelong		x		%x=0x009048EB ,	0x2a9048EB  0
497>>0x41		ubyte		<2
498>>>0x3E		ubyte		>2		\b; GRand Unified Bootloader
499# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
500>>>>0x3E	ubyte		x		\b, stage1 version 0x%x
501#If it is 0xFF, use a drive passed by BIOS
502>>>>0x40	ubyte		<0xFF		\b, boot drive 0x%x
503# in most case 0,1,0x2e for GRUB 0.5.95
504>>>>0x41	ubyte		>0		\b, LBA flag 0x%x
505>>>>0x42	uleshort	<0x8000		\b, stage2 address 0x%x
506#>>>>0x42	uleshort	=0x8000		\b, stage2 address 0x%x (usual)
507>>>>0x42	uleshort	>0x8000		\b, stage2 address 0x%x
508#>>>>0x44	ulelong		=1		\b, 1st sector stage2 0x%x (default)
509>>>>0x44	ulelong		>1		\b, 1st sector stage2 0x%x
510>>>>0x48	uleshort	<0x800		\b, stage2 segment 0x%x
511#>>>>0x48	uleshort	=0x800		\b, stage2 segment 0x%x (usual)
512>>>>0x48	uleshort	>0x800		\b, stage2 segment 0x%x
513>>>>402		string	Geom\0Hard\ Disk\0Read\0\ Error\0
514>>>>>394	string	stage1			\b, GRUB version 0.5.95
515>>>>382		string	Geom\0Hard\ Disk\0Read\0\ Error\0
516>>>>>376	string	GRUB\ \0		\b, GRUB version 0.93 or 1.94
517>>>>383		string	Geom\0Hard\ Disk\0Read\0\ Error\0
518>>>>>377	string	GRUB\ \0		\b, GRUB version 0.94
519>>>>385		string	Geom\0Hard\ Disk\0Read\0\ Error\0
520>>>>>379	string	GRUB\ \0		\b, GRUB version 0.95 or 0.96
521>>>>391		string	Geom\0Hard\ Disk\0Read\0\ Error\0
522>>>>>385	string	GRUB\ \0		\b, GRUB version 0.97
523# unknown version
524>>>343		string	Geom\0Read\0\ Error\0
525>>>>321		string	Loading\ stage1.5	\b, GRUB version x.y
526>>>380		string	Geom\0Hard\ Disk\0Read\0\ Error\0
527>>>>374		string	GRUB\ \0		\b, GRUB version n.m
528# SYSLINUX bootloader moved
529>395	string	chksum\0\ ERROR!\0		\b, Gujin bootloader
530# http://www.bcdwb.de/bcdw/index_e.htm
531>3	string	BCDL
532>>498	string	BCDL\ \ \ \ BIN			\b, Bootable CD Loader (1.50Z)
533# mbr partition table entries updated by Joerg Jenderek at Sep 2013
534# skip Norton Utilities disc image data
535>3		string		!IHISK
536# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
537>>0		belong		!0xb8c0078e
538# not Linux kernel
539>>>514		string		!HdrS
540# not BeOS
541>>>>422		string		!Be\ Boot\ Loader
542# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
543>>>>>0		ubelong&0xFD000000	=0xE9000000
544# AdvanceMAME mbr
545>>>>>>(1.b+2)	ubequad		0xfa31c08ed88ec08e
546>>>>>>>446	use		partition-table
547# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
548>>>>>0		ubelong&0xFD000000	!0xE9000000
549# skip FSInfosector
550>>>>>>0		string		!RRaA
551# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
552# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
553>>>>>>>0	ubequad		!0xfa660fb64610668b
554# skip 13rd sector of MS x86 bootloader
555>>>>>>>>0	ubequad		!0x660fb64610668b4e
556# skip sector starting with DOS new line
557>>>>>>>>>0	string		!\r\n
558# allowed active flag 0,80h-FFh
559>>>>>>>>>>446	ubyte		0
560>>>>>>>>>>>446	use		partition-table
561>>>>>>>>>>446	ubyte		>0x7F
562>>>>>>>>>>>446	use		partition-table
563# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
564# mbr partition table entries end
565# https://www.acronis.de/
566#FAT label=ACRONIS\ SZ
567#OEM-ID=BOOTWIZ0
568>442	string	Non-system\ disk,\040
569>>459	string	press\ any\ key...\x7\0		\b, Acronis Startup Recovery Loader
570# updated by Joerg Jenderek at Nov 2012, Sep 2013
571# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
572# display 1 space
573>>>447	ubyte	x		\b
574>>>477	use	DOS-filename
575#
576>185	string	FDBOOT\ Version\040
577>>204	string	\rNo\ Systemdisk.\040
578>>>220	string	Booting\ from\ harddisk.\n\r
579>>>245	string	Cannot\ load\ from\ harddisk.\n\r
580>>>>273 string	Insert\ Systemdisk\040
581>>>>>291 string and\ press\ any\ key.\n\r		\b, FDBOOT harddisk Bootloader
582>>>>>>200 string	>\0                             \b, version %-3s
583>242	string	Bootsector\ from\ C.H.\ Hochst\204
584# http://freecode.com/projects/dosfstools	dosfstools-n.m/src/mkdosfs.c
585# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
586# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
587>242	search/127	Bootsector\ from\ C.H.\ Hochst
588>>278	search/127	No\ Systemdisk.\ Booting\ from\ harddisk
589# followed by variants with point,CR-NL or NL-CR
590>>>208	search/261	Cannot\ load\ from\ harddisk.
591# followed by variants CR-NL or NL-CR
592>>>>236	search/235	Insert\ Systemdisk\ and\ press\ any\ key.
593# followed by variants with point,CR-NL or NL-CR
594>>>>>180	search/96	Disk\ formatted\ with\ WinImage\ 	\b, WinImage harddisk Bootloader
595# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
596>>>>>>&0	string		x 					\b, version %-4.4s
597>(1.b+2)	ubyte		0xe
598>>(1.b+3)	ubyte		0x1f
599>>>(1.b+4)	ubyte		0xbe
600# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
601>>>>(1.b+5)	ubyte&0xd3	0x53
602>>>>>(1.b+6)	ubyte		0x7c
603# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
604>>>>>>(1.b+7)	ubyte		0xac
605>>>>>>>(1.b+8)	ubyte		0x22
606>>>>>>>>(1.b+9)	ubyte		0xc0
607>>>>>>>>>(1.b+10)	ubyte	0x74
608>>>>>>>>>>(1.b+11)	ubyte	0x0b
609>>>>>>>>>>>(1.b+12)	ubyte	0x56
610>>>>>>>>>>>>(1.b+13)	ubyte	0xb4			\b, mkdosfs boot message display
611# FAT1X version
612>>>>>>>>>>>>>(1.b+5)	ubyte	0x5b
613>>>>>>>>>>>>>>0x5b	string	>\0			"%-s"
614# FAT32 version
615>>>>>>>>>>>>>(1.b+5)	ubyte	0x77
616>>>>>>>>>>>>>>0x77	string	>\0			"%-s"
617>214	string	Please\ try\ to\ install\ FreeDOS\ 	\b, DOS Emulator boot message display
618#>>244	string	from\ dosemu-freedos-*-bin.tgz\r
619#>>>170	string	Sorry,\ could\ not\ load\ an\040
620#>>>>195	string	operating\ system.\r\n
621#
622>103	string	This\ is\ not\ a\ bootable\ disk.\040
623>>132	string	Please\ insert\ a\ bootable\040
624>>>157	string	floppy\ and\r\n
625>>>>169	string	press\ any\ key\ to\ try\ again...\r	\b, FREE-DOS message display
626#
627>66	string	Solaris\ Boot\ Sector
628>>99	string	Incomplete\ MDBoot\ load.
629>>>89	string	Version 				\b, Sun Solaris Bootloader
630>>>>97	byte	x					version %c
631#
632>408	string	OS/2\ !!\ SYS01475\r\0
633>>429	string	OS/2\ !!\ SYS02025\r\0
634>>>450	string	OS/2\ !!\ SYS02027\r\0
635>>>469	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp bootloader
636#
637>409	string	OS/2\ !!\ SYS01475\r\0
638>>430	string	OS/2\ !!\ SYS02025\r\0
639>>>451	string	OS/2\ !!\ SYS02027\r\0
640>>>470	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp Bootloader
641>112		string	This\ disk\ is\ not\ bootable\r
642>>142		string	If\ you\ wish\ to\ make\ it\ bootable
643>>>176		string	run\ the\ DOS\ program\ SYS\040
644>>>200		string	after\ the\r
645>>>>216		string	system\ has\ been\ loaded\r\n
646>>>>>242	string	Please\ insert\ a\ DOS\ diskette\040
647>>>>>271	string	into\r\n\ the\ drive\ and\040
648>>>>>>292	string	strike\ any\ key...\0		\b, IBM OS/2 Warp message display
649# XP
650>430	string	NTLDR\ is\ missing\xFF\r\n
651>>449	string	Disk\ error\xFF\r\n
652>>>462	string	Press\ any\ key\ to\ restart\r		\b, Microsoft Windows XP Bootloader
653# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
654>>>>417		ubyte&0xDF	>0
655>>>>>417	string		x			%-.5s
656>>>>>>422	ubyte&0xDF	>0
657>>>>>>>422	string		x 			\b%-.3s
658>>>>>425	ubyte&0xDF	>0
659>>>>>>425	string		>\ 			\b.%-.3s
660#
661>>>>371		ubyte		>0x20
662>>>>>368	ubyte&0xDF	>0
663>>>>>>368	string		x 			%-.5s
664>>>>>>>373	ubyte&0xDF	>0
665>>>>>>>>373	string		x 			\b%-.3s
666>>>>>>376	ubyte&0xDF	>0
667>>>>>>>376	string		x 			\b.%-.3s
668#
669>430	string	NTLDR\ nicht\ gefunden\xFF\r\n
670>>453	string	Datentr\204gerfehler\xFF\r\n
671>>>473	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (german)
672>>>>417		ubyte&0xDF	>0
673>>>>>417	string		x			%-.5s
674>>>>>>422	ubyte&0xDF	>0
675>>>>>>>422	string		x 			\b%-.3s
676>>>>>425	ubyte&0xDF	>0
677>>>>>>425	string		>\ 			\b.%-.3s
678# offset variant
679>>>>379	string	\0
680>>>>>368	ubyte&0xDF	>0
681>>>>>>368	string		x 			%-.5s
682>>>>>>>373	ubyte&0xDF	>0
683>>>>>>>>373	string		x 			\b%-.3s
684#
685>430	string	NTLDR\ fehlt\xFF\r\n
686>>444	string	Datentr\204gerfehler\xFF\r\n
687>>>464	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (2.german)
688>>>>417		ubyte&0xDF	>0
689>>>>>417	string		x			%-.5s
690>>>>>>422	ubyte&0xDF	>0
691>>>>>>>422	string		x 			\b%-.3s
692>>>>>425	ubyte&0xDF	>0
693>>>>>>425	string		>\ 			\b.%-.3s
694# variant
695>>>>371		ubyte		>0x20
696>>>>>368	ubyte&0xDF	>0
697>>>>>>368	string		x 			%-.5s
698>>>>>>>373	ubyte&0xDF	>0
699>>>>>>>>373	string		x 			\b%-.3s
700>>>>>>376	ubyte&0xDF	>0
701>>>>>>>376	string		x 			\b.%-.3s
702#
703>430	string	NTLDR\ fehlt\xFF\r\n
704>>444	string	Medienfehler\xFF\r\n
705>>>459	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (3.german)
706>>>>371		ubyte		>0x20
707>>>>>368	ubyte&0xDF	>0
708>>>>>>368	string		x 			%-.5s
709>>>>>>>373	ubyte&0xDF	>0
710>>>>>>>>373	string		x 			\b%-.3s
711>>>>>>376	ubyte&0xDF	>0
712>>>>>>>376	string		x 			\b.%-.3s
713# variant
714>>>>417		ubyte&0xDF	>0
715>>>>>417	string		x			%-.5s
716>>>>>>422	ubyte&0xDF	>0
717>>>>>>>422	string		x 			\b%-.3s
718>>>>>425	ubyte&0xDF	>0
719>>>>>>425	string		>\ 			\b.%-.3s
720#
721>430	string	Datentr\204ger\ entfernen\xFF\r\n
722>>454	string	Medienfehler\xFF\r\n
723>>>469	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (4.german)
724>>>>379		string		\0
725>>>>>368	ubyte&0xDF	>0
726>>>>>>368	string		x 			%-.5s
727>>>>>>>373	ubyte&0xDF	>0
728>>>>>>>>373	string		x 			\b%-.3s
729>>>>>>376	ubyte&0xDF	>0
730>>>>>>>376	string		x 			\b.%-.3s
731# variant
732>>>>417		ubyte&0xDF	>0
733>>>>>417	string		x			%-.5s
734>>>>>>422	ubyte&0xDF	>0
735>>>>>>>422	string		x 			\b%-.3s
736>>>>>425	ubyte&0xDF	>0
737>>>>>>425	string		>\ 			\b.%-.3s
738#
739
740#>3	string	NTFS\ \ \ \040
741>389	string	Fehler\ beim\ Lesen\040
742>>407	string	des\ Datentr\204gers
743>>>426	string	NTLDR\ fehlt
744>>>>440	string	NTLDR\ ist\ komprimiert
745>>>>>464 string	Neustart\ mit\ Strg+Alt+Entf\r		\b, Microsoft Windows XP Bootloader NTFS (german)
746#>3	string	NTFS\ \ \ \040
747>313	string	A\ disk\ read\ error\ occurred.\r
748>>345	string	A\ kernel\ file\ is\ missing\040
749>>>370	string	from\ the\ disk.\r
750>>>>484	string	NTLDR\ is\ compressed
751>>>>>429 string	Insert\ a\ system\ diskette\040
752>>>>>>454 string and\ restart\r\nthe\ system.\r		\b, Microsoft Windows XP Bootloader NTFS
753# DOS loader variants different languages,offsets
754>472	ubyte&0xDF	>0
755>>389	string	Invalid\ system\ disk\xFF\r\n
756>>>411	string	Disk\ I/O\ error
757>>>>428	string	Replace\ the\ disk,\ and\040
758>>>>>455 string	press\ any\ key				\b, Microsoft Windows 98 Bootloader
759#IO.SYS
760>>>>>>472	ubyte&0xDF	>0
761>>>>>>>472	string		x 			\b %-.2s
762>>>>>>>>474	ubyte&0xDF	>0
763>>>>>>>>>474	string		x 			\b%-.5s
764>>>>>>>>>>479	ubyte&0xDF	>0
765>>>>>>>>>>>479 string		x 			\b%-.1s
766>>>>>>>480	ubyte&0xDF	>0
767>>>>>>>>480	string		x 			\b.%-.3s
768#MSDOS.SYS
769>>>>>>>483	ubyte&0xDF	>0			\b+
770>>>>>>>>483	string		x 			\b%-.5s
771>>>>>>>>>488	ubyte&0xDF	>0
772>>>>>>>>>>488	string		x 			\b%-.3s
773>>>>>>>>491	ubyte&0xDF	>0
774>>>>>>>>>491	string		x 			\b.%-.3s
775#
776>>390	string	Invalid\ system\ disk\xFF\r\n
777>>>412	string	Disk\ I/O\ error\xFF\r\n
778>>>>429	string	Replace\ the\ disk,\ and\040
779>>>>>451 string	then\ press\ any\ key\r			\b, Microsoft Windows 98 Bootloader
780>>388	string	Ungueltiges\ System\ \xFF\r\n
781>>>410	string	E/A-Fehler\ \ \ \ \xFF\r\n
782>>>>427	string	Datentraeger\ wechseln\ und\040
783>>>>>453 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (german)
784#WINBOOT.SYS only not spaces (0xDF)
785>>>>>>497	ubyte&0xDF	>0
786>>>>>>>497	string		x 			%-.5s
787>>>>>>>>502	ubyte&0xDF	>0
788>>>>>>>>>502	string		x 			\b%-.1s
789>>>>>>>>>>503	ubyte&0xDF	>0
790>>>>>>>>>>>503	string		x 			\b%-.1s
791>>>>>>>>>>>>504	ubyte&0xDF	>0
792>>>>>>>>>>>>>504 string		x 			\b%-.1s
793>>>>>>505	ubyte&0xDF	>0
794>>>>>>>505	string		x 			\b.%-.3s
795#IO.SYS
796>>>>>>472	ubyte&0xDF	>0			or
797>>>>>>>472	string		x 			\b %-.2s
798>>>>>>>>474	ubyte&0xDF	>0
799>>>>>>>>>474	string		x 			\b%-.5s
800>>>>>>>>>>479	ubyte&0xDF	>0
801>>>>>>>>>>>479 string		x 			\b%-.1s
802>>>>>>>480	ubyte&0xDF	>0
803>>>>>>>>480	string		x 			\b.%-.3s
804#MSDOS.SYS
805>>>>>>>483	ubyte&0xDF	>0			\b+
806>>>>>>>>483	string		x 			\b%-.5s
807>>>>>>>>>488	ubyte&0xDF	>0
808>>>>>>>>>>488	string		x 			\b%-.3s
809>>>>>>>>491	ubyte&0xDF	>0
810>>>>>>>>>491	string		x 			\b.%-.3s
811#
812>>390	string	Ungueltiges\ System\ \xFF\r\n
813>>>412	string	E/A-Fehler\ \ \ \ \xFF\r\n
814>>>>429	string	Datentraeger\ wechseln\ und\040
815>>>>>455 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (German)
816#WINBOOT.SYS only not spaces (0xDF)
817>>>>>>497	ubyte&0xDF	>0
818>>>>>>>497	string		x 			%-.7s
819>>>>>>>>504	ubyte&0xDF	>0
820>>>>>>>>>504	string		x 			\b%-.1s
821>>>>>>505	ubyte&0xDF	>0
822>>>>>>>505	string		x 			\b.%-.3s
823#IO.SYS
824>>>>>>472	ubyte&0xDF	>0			or
825>>>>>>>472	string		x 			\b %-.2s
826>>>>>>>>474	ubyte&0xDF	>0
827>>>>>>>>>474	string		x 			\b%-.6s
828>>>>>>>480	ubyte&0xDF	>0
829>>>>>>>>480	string		x 			\b.%-.3s
830#MSDOS.SYS
831>>>>>>>483	ubyte&0xDF	>0			\b+
832>>>>>>>>483	string		x 			\b%-.5s
833>>>>>>>>>488	ubyte&0xDF	>0
834>>>>>>>>>>488	string		x 			\b%-.3s
835>>>>>>>>491	ubyte&0xDF	>0
836>>>>>>>>>491	string		x 			\b.%-.3s
837#
838>>389	string	Ungueltiges\ System\ \xFF\r\n
839>>>411	string	E/A-Fehler\ \ \ \ \xFF\r\n
840>>>>428	string	Datentraeger\ wechseln\ und\040
841>>>>>454 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
842# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
843>>>>>>472	string		x 			%-.2s
844>>>>>>>474	ubyte&0xDF	>0
845>>>>>>>>474	string		x 			\b%-.5s
846>>>>>>>>479	ubyte&0xDF	>0
847>>>>>>>>>479	string		x 			\b%-.1s
848>>>>>>480	ubyte&0xDF	>0
849>>>>>>>480	string		x 			\b.%-.3s
850>>>>>>483	ubyte&0xDF	>0			\b+
851>>>>>>>483	string		x 			\b%-.5s
852>>>>>>>488	ubyte&0xDF	>0
853>>>>>>>>488	string		x 			\b%-.2s
854>>>>>>>>490	ubyte&0xDF	>0
855>>>>>>>>>490	string		x 			\b%-.1s
856>>>>>>>491	ubyte&0xDF	>0
857>>>>>>>>491	string		x 			\b.%-.3s
858>479	ubyte&0xDF	>0
859>>416	string	Kein\ System\ oder\040
860>>>433	string	Laufwerksfehler
861>>>>450	string	Wechseln\ und\ Taste\ dr\201cken	\b, Microsoft DOS Bootloader (german)
862#IO.SYS
863>>>>>479	string		x 			\b %-.2s
864>>>>>>481	ubyte&0xDF	>0
865>>>>>>>481	string		x 			\b%-.6s
866>>>>>487	ubyte&0xDF	>0
867>>>>>>487	string		x 			\b.%-.3s
868#MSDOS.SYS
869>>>>>>490	ubyte&0xDF	>0			\b+
870>>>>>>>490	string		x 			\b%-.5s
871>>>>>>>>495	ubyte&0xDF	>0
872>>>>>>>>>495	string		x 			\b%-.3s
873>>>>>>>498	ubyte&0xDF	>0
874>>>>>>>>498	string		x 			\b.%-.3s
875#
876>376	search/41	Non-System\ disk\ or\040
877>>395	search/41	disk\ error\r
878>>>407	search/41	Replace\ and\040
879>>>>419	search/41	press\ 				\b,
880>>>>419	search/41	strike\ 			\b, old
881>>>>426	search/41	any\ key\ when\ ready\r		MS or PC-DOS bootloader
882#449			Disk\ Boot\ failure\r		MS 3.21
883#466			Boot\ Failure\r			MS 3.30
884>>>>>468 search/18	\0
885#IO.SYS,IBMBIO.COM
886>>>>>>&0	string		x 			\b %-.2s
887>>>>>>>&-20	ubyte&0xDF	>0
888>>>>>>>>&-1	string		x 			\b%-.4s
889>>>>>>>>>&-16	ubyte&0xDF	>0
890>>>>>>>>>>&-1	string		x 			\b%-.2s
891>>>>>>&8	ubyte&0xDF	>0			\b.
892>>>>>>>&-1	string		x 			\b%-.3s
893#MSDOS.SYS,IBMDOS.COM
894>>>>>>&11	ubyte&0xDF	>0			\b+
895>>>>>>>&-1	string		x 			\b%-.5s
896>>>>>>>>&-6	ubyte&0xDF	>0
897>>>>>>>>>&-1	string		x 			\b%-.1s
898>>>>>>>>>>&-5	ubyte&0xDF	>0
899>>>>>>>>>>>&-1	string		x 			\b%-.2s
900>>>>>>>&7	ubyte&0xDF	>0			\b.
901>>>>>>>>&-1	string		x 			\b%-.3s
902>441	string	Cannot\ load\ from\ harddisk.\n\r
903>>469	string	Insert\ Systemdisk\040
904>>>487	string	and\ press\ any\ key.\n\r		\b, MS (2.11) DOS bootloader
905#>43	string	\224R-LOADER\ \ SYS			=label
906>54	string	SYS
907>>324	string	VASKK
908>>>495	string	NEWLDR\0				\b, DR-DOS Bootloader (LOADER.SYS)
909#
910>98	string	Press\ a\ key\ to\ retry\0\r
911>>120	string	Cannot\ find\ file\ \0\r
912>>>139	string	Disk\ read\ error\0\r
913>>>>156	string	Loading\ ...\0				\b, DR-DOS (3.41) Bootloader
914#DRBIOS.SYS
915>>>>>44		ubyte&0xDF	>0
916>>>>>>44	string		x			\b %-.6s
917>>>>>>>50	ubyte&0xDF	>0
918>>>>>>>>50	string		x 			\b%-.2s
919>>>>>>52	ubyte&0xDF	>0
920>>>>>>>52	string		x 			\b.%-.3s
921#
922>70	string	IBMBIO\ \ COM
923>>472	string	Cannot\ load\ DOS!\040
924>>>489	string	Any\ key\ to\ retry			\b, DR-DOS Bootloader
925>>471	string	Cannot\ load\ DOS\040
926>>487	string	press\ key\ to\ retry			\b, Open-DOS Bootloader
927#??
928>444	string	KERNEL\ \ SYS
929>>314	string	BOOT\ error!				\b, FREE-DOS Bootloader
930>499	string	KERNEL\ \ SYS
931>>305	string	BOOT\ err!\0				\b, Free-DOS Bootloader
932>449	string	KERNEL\ \ SYS
933>>319	string	BOOT\ error!				\b, FREE-DOS 0.5 Bootloader
934#
935>449	string	Loading\ FreeDOS
936>>0x1AF		ulelong		>0			\b, FREE-DOS 0.95,1.0 Bootloader
937>>>497		ubyte&0xDF	>0
938>>>>497		string		x 			\b %-.6s
939>>>>>503	ubyte&0xDF	>0
940>>>>>>503	string		x 			\b%-.1s
941>>>>>>>504	ubyte&0xDF	>0
942>>>>>>>>504	string		x 			\b%-.1s
943>>>>505		ubyte&0xDF	>0
944>>>>>505	string		x 			\b.%-.3s
945#
946>331	string	Error!.0				\b, FREE-DOS 1.0 bootloader
947#
948>125	string	Loading\ FreeDOS...\r
949>>311	string	BOOT\ error!\r				\b, FREE-DOS bootloader
950>>>441		ubyte&0xDF	>0
951>>>>441		string		x 			\b %-.6s
952>>>>>447	ubyte&0xDF	>0
953>>>>>>447	string		x 			\b%-.1s
954>>>>>>>448	ubyte&0xDF	>0
955>>>>>>>>448	string		x 			\b%-.1s
956>>>>449		ubyte&0xDF	>0
957>>>>>449	string		x 			\b.%-.3s
958>124	string	FreeDOS\0
959>>331	string	\ err\0					\b, FREE-DOS BETa 0.9 Bootloader
960# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
961>>>497		ubyte&0xDF	>0
962>>>>497		string		x 			\b %-.6s
963>>>>>503	ubyte&0xDF	>0
964>>>>>>503	string		x 			\b%-.1s
965>>>>>>>504	ubyte&0xDF	>0
966>>>>>>>>504	string		x 			\b%-.1s
967>>>>505		ubyte&0xDF	>0
968>>>>>505	string		x 			\b.%-.3s
969>>333	string	\ err\0					\b, FREE-DOS BEta 0.9 Bootloader
970>>>497		ubyte&0xDF	>0
971>>>>497		string		x 			\b %-.6s
972>>>>>503	ubyte&0xDF	>0
973>>>>>>503	string		x 			\b%-.1s
974>>>>>>>504	ubyte&0xDF	>0
975>>>>>>>>504	string		x 			\b%-.1s
976>>>>505		ubyte&0xDF	>0
977>>>>>505	string		x 			\b.%-.3s
978>>334	string	\ err\0					\b, FREE-DOS Beta 0.9 Bootloader
979>>>497		ubyte&0xDF	>0
980>>>>497		string		x 			\b %-.6s
981>>>>>503	ubyte&0xDF	>0
982>>>>>>503	string		x 			\b%-.1s
983>>>>>>>504	ubyte&0xDF	>0
984>>>>>>>>504	string		x 			\b%-.1s
985>>>>505		ubyte&0xDF	>0
986>>>>>505	string		x 			\b.%-.3s
987>336	string	Error!\040
988>>343	string	Hit\ a\ key\ to\ reboot.		\b, FREE-DOS Beta 0.9sr1 Bootloader
989>>>497		ubyte&0xDF	>0
990>>>>497		string		x 			\b %-.6s
991>>>>>503	ubyte&0xDF	>0
992>>>>>>503	string		x 			\b%-.1s
993>>>>>>>504	ubyte&0xDF	>0
994>>>>>>>>504	string		x 			\b%-.1s
995>>>>505		ubyte&0xDF	>0
996>>>>>505	string		x 			\b.%-.3s
997# added by Joerg Jenderek
998# https://www.visopsys.org/
999# https://partitionlogic.org.uk/
1000# OEM-ID=Visopsys
1001>478		ulelong	0
1002>>(1.b+326)	string	I/O\ Error\ reading\040
1003>>>(1.b+344)	string	Visopsys\ loader\r
1004>>>>(1.b+361)	string	Press\ any\ key\ to\ continue.\r	\b, Visopsys loader
1005# http://alexfru.chat.ru/epm.html#bootprog
1006>494	ubyte	>0x4D
1007>>495	string	>E
1008>>>495	string	<S
1009#OEM-ID is not reliable
1010>>>>3	string	BootProg
1011# It just looks for a program file name at the root directory
1012# and loads corresponding file with following execution.
1013# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
1014>>>>499			ubyte&0xDF	>0		\b, COM/EXE Bootloader
1015>>>>>499		use		DOS-filename
1016#If the boot sector fails to read any other sector,
1017#it prints a very short message ("RE") to the screen and hangs the computer.
1018#If the boot sector fails to find needed program in the root directory,
1019#it also hangs with another message ("NF").
1020>>>>>492		string		RENF		\b, FAT (12 bit)
1021>>>>>495		string		RENF		\b, FAT (16 bit)
1022#If the boot sector fails to read any other sector,
1023#it prints a very short message ("RE") to the screen and hangs the computer.
1024# x86 bootloader end
1025
1026# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
1027# and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
1028>0		string		RRaA
1029>>0x1E4		string		rrAa		\b, FSInfosector
1030#>>0x1FC	uleshort	=0		SHOULD BE ZERO
1031>>>0x1E8	ulelong		<0xffffffff	\b, %u free clusters
1032>>>0x1EC	ulelong		<0xffffffff	\b, last allocated cluster %u
1033
1034# updated by Joerg Jenderek at Sep 2007
1035>3	ubyte	0
1036#no active flag
1037>>446	ubyte	0
1038# partition 1 not empty
1039>>>450	ubyte	>0
1040# partitions 3,4 empty
1041>>>>482		ubyte	0
1042>>>>>498	ubyte	0
1043# partition 2 ID=0,5,15
1044>>>>>>466	ubyte	<0x10
1045>>>>>>>466	ubyte	0x05			\b, extended partition table
1046>>>>>>>466	ubyte	0x0F			\b, extended partition table (LBA)
1047>>>>>>>466	ubyte	0x0			\b, extended partition table (last)
1048
1049# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
1050
1051>0x200	lelong	0x82564557		\b, BSD disklabel
1052
1053# by Joerg Jenderek at Apr 2013
1054#	Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
1055#	like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
10560	name			DOS-filename
1057# space=0x20 (00100000b) means empty
1058>0			ubyte&0xDF	>0
1059>>0			ubyte		x 		\b%c
1060>>>1			ubyte&0xDF	>0
1061>>>>1			ubyte		x 		\b%c
1062>>>>>2			ubyte&0xDF	>0
1063>>>>>>2			ubyte		x 		\b%c
1064>>>>>>>3		ubyte&0xDF	>0
1065>>>>>>>>3		ubyte		x 		\b%c
1066>>>>>>>>>4		ubyte&0xDF	>0
1067>>>>>>>>>>4		ubyte		x 		\b%c
1068>>>>>>>>>>>5		ubyte&0xDF	>0
1069>>>>>>>>>>>>5		ubyte		x 		\b%c
1070>>>>>>>>>>>>>6		ubyte&0xDF	>0
1071>>>>>>>>>>>>>>6		ubyte		x 		\b%c
1072>>>>>>>>>>>>>>>7	ubyte&0xDF	>0
1073>>>>>>>>>>>>>>>>7	ubyte		x 		\b%c
1074# DOS filename extension
1075>>8			ubyte&0xDF	>0		\b.
1076>>>8			ubyte		x 		\b%c
1077>>>>9			ubyte&0xDF	>0
1078>>>>>9			ubyte		x 		\b%c
1079>>>>>>10		ubyte&0xDF	>0
1080>>>>>>>10		ubyte		x 		\b%c
1081#	Print 2 following DOS filenames from directory entry form
1082#	like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
10830	name			2xDOS-filename
1084# display 1 space
1085>0			ubyte		x		\b
1086>0			use		DOS-filename
1087>11			ubyte		x		\b+
1088>11			use		DOS-filename
1089
1090# https://en.wikipedia.org/wiki/Master_boot_record#PTE
1091# display standard partition table
10920	name				partition-table
1093#>0		ubyte		x	PARTITION-TABLE
1094# test and display 1st til 4th partition table entry
1095>0		use			partition-entry-test
1096>16		use			partition-entry-test
1097>32		use			partition-entry-test
1098>48		use			partition-entry-test
1099#		test for entry of partition table
11000	name				partition-entry-test
1101# partition type ID > 0
1102>4		ubyte		>0
1103# active flag 0
1104>>0		ubyte		0
1105>>>0		use		partition-entry
1106# active flag 0x80, 0x81, ...
1107>>0		ubyte		>0x7F
1108>>>0		use		partition-entry
1109#		Print entry of partition table
11100	name				partition-entry
1111# partition type ID > 0
1112>4		ubyte		>0	\b; partition
1113>>64		leshort		0xAA55	1
1114>>48		leshort		0xAA55	2
1115>>32		leshort		0xAA55	3
1116>>16		leshort		0xAA55	4
1117>>4		ubyte		x	: ID=0x%x
1118>>0		ubyte&0x80	0x80	\b, active
1119>>0		ubyte		>0x80	0x%x
1120>>1		ubyte		x	\b, start-CHS (
1121>>1		use		partition-chs
1122>>5		ubyte		x	\b), end-CHS (
1123>>5		use		partition-chs
1124>>8		ulelong		x	\b), startsector %u
1125>>12		ulelong		x	\b, %u sectors
1126#		Print cylinder,head,sector (CHS) of partition entry
11270	name				partition-chs
1128# cylinder
1129>1		ubyte		x	\b0x
1130>1		ubyte&0xC0	0x40	\b1
1131>1		ubyte&0xC0	0x80	\b2
1132>1		ubyte&0xC0	0xC0	\b3
1133>2		ubyte		x	\b%x
1134# head
1135>0		ubyte		x	\b,%u
1136# sector
1137>1		ubyte&0x3F	x	\b,%u
1138
1139# FATX
11400		string		FATX		FATX filesystem data
1141
1142# romfs filesystems - Juan Cespedes <cespedes@debian.org>
11430	string		-rom1fs-	romfs filesystem, version 1
1144>8	belong	x			%d bytes,
1145>16	string	x			named %s.
1146
1147# netboot image - Juan Cespedes <cespedes@debian.org>
11480	lelong		0x1b031336L	Netboot image,
1149>4	lelong&0xFFFFFF00	0
1150>>4	lelong&0x100	0x000		mode 2
1151>>4	lelong&0x100	0x100		mode 3
1152>4	lelong&0xFFFFFF00	!0	unknown mode
1153
11540x18b	string	OS/2	OS/2 Boot Manager
1155
1156# updated by Joerg Jenderek at Oct 2008 and Sep 2012
1157# https://syslinux.zytor.com/iso.php
1158# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
1159# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
11600	ulequad&0x909000007cc0eafa	0x909000007c40eafa
1161>631	search/689	ISOLINUX\ 	isolinux Loader
1162>>&0	string		x		(version %-4.4s)
1163# https://syslinux.zytor.com/pxe.php
1164# assembler instructions: jmp 7C05
11650	ulelong	0x007c05ea		pxelinux loader (version 2.13 or older)
1166# assembler instructions: pushfd;pushad
11670	ulelong	0x60669c66		pxelinux loader
1168# assembler instructions: jmp 05
11690	ulelong	0xc00005ea		pxelinux loader (version 3.70 or newer)
1170# https://syslinux.zytor.com/wiki/index.php/SYSLINUX
11710	string	LDLINUX\ SYS\ 		SYSLINUX loader
1172>12	string	x			(older version %-4.4s)
11730	string	\r\nSYSLINUX\ 		SYSLINUX loader
1174>11	string	x			(version %-4.4s)
1175# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
1176# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
11770	ulelong&0x80909bEB	0x009018EB
1178# OEM-ID not always "SYSLINUX"
1179>434	search/47	Boot\ failed
1180# followed by \r\n\0 or :\
1181>>482	search/132	\0LDLINUX\ SYS		Syslinux bootloader (version 2.13 or older)
1182>>1	ubyte		0x58			Syslinux bootloader (version 3.0-3.9)
1183>459	search/30	Boot\ error\r\n\0
1184>>1	ubyte		0x58			Syslinux bootloader (version 3.10 or newer)
1185# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
1186# assembler instructions: mov di,0600h;mov cx,0100h
118716	search/4	\xbf\x00\x06\xb9\x00\x01
1188# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
1189!:strength +36
1190>94	search/249	Missing\ operating\ system
1191# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
1192# skip Ranish MBR
1193>>408	search/4	HD1/\0
1194>>408	default		x
1195>>>250	search/118	\0Operating\ system\ load		SYSLINUX MBR
1196# followed by "ing " or space
1197>>>>292	search/98	error
1198>>>>>&0	string		\r		    			(version 3.35 or older)
1199>>>>>&0	string		.\r					(version 3.52 or newer)
1200>>>>>&0	default		x					(version 3.36-3.51 )
1201>368	search/106	\0Disk\ error\ on\ boot\r\n		SYSLINUX GPT-MBR
1202>>156	search/10	\0Boot\ partition\ not\ found\r\n
1203>>>270	search/10	\0OS\ not\ bootable\r\n			(version 3.86 or older)
1204>>174	search/10	\0Missing\ OS\r\n
1205>>>189	search/10	\0Multiple\ active\ partitions\r\n	(version 4.00 or newer)
1206# SYSLINUX END
1207
1208# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
1209# assembler instructions: xor ax,ax;mov	ax,ss;mov sp,0x7c00;mov	ax,
12100	ubequad		0x31c08ed0bc007c8e
1211# mbr_bootsel magic before partition table not reliable with small ipl fragments
1212#>444	uleshort	0xb5e1
1213>0004	uleshort	x
1214# ERRorTeXT
1215>>181	search/166		Error\ \0\r\n				NetBSD mbr
1216# NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
1217>>>0x1B8	ubelong		>0					\b,Serial 0x%-.8x
1218# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
1219>>>0xbb		search/71	\xcd\x13\x5a\x52\x52			\b,bootselector
1220# BOOT_EXTENDED definitions contains assembler instructions:
1221# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
1222>>>0x96	search/1	\x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13	\b,boot extended
1223# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
1224>>>0x130	search/55	\xee\x80\xc2\x05\xec\xa8\x40		\b,serial IO
1225# not TERSE_ERROR
1226>>>196		search/106	No\ active\ partition\0
1227>>>>&0		string		Disk\ read\ error\0
1228>>>>>&0		string		No\ operating\ system\0			\b,verbose
1229# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
1230>>>0x7d		search/7	\x5a\x52\xb4\x08\xcd\x13		\b,CHS
1231# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop	dx;push	dx;int 0x13
1232>>>0xa4		search/84	\xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13	\b,LBA-check
1233# assembler instructions: movw nametab,bx
1234>>>0x26	    search/21	\xBB\x94\x07
1235# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
1236>>>>&-9	ubequad&0xBE00f0E800febb94	0xBE0000E80000bb94
1237>>>>>181	search/166		Error\ \0
1238# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
1239>>>>>>&3	string			x				\b,"%s"
1240>>>446	use		partition-table
1241# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
1242# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
1243# assembler instructions: jmp short 0x58;nop;ASCII
12440	ubequad&0xeb58908000000000	0xeb58900000000000
1245# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
1246>(1.b+2)	ubequad			0xfa31c08ed88ec08e
1247# Error messages at end of code
1248>>376		string	No\ operating\ system\r\n\0
1249>>>398		string	Disk\ error\r\n\0FDD\0HDD\0
1250>>>>419		string	\ EBIOS\r\n\0				AdvanceMAME mbr
1251
1252# Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/
1253# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
1254# for 1st version assembler instructions:	cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
1255# or  	  	  	    			cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
12560	ulequad&0xcE1b40D48EC031FC	0x8E0000D08EC031FC
1257# pointer to the data starting with Neil Turton signature string
1258>(0x1BC.s)		string		NDTmbr
1259>>&-14			string		1234F\0			Turton mbr (
1260# parameters also viewed by install-mbr --list
1261>>>(0x1BC.s+7)		ubyte		x			\b%u<=
1262>>>(0x1BC.s+9)		ubyte		x			\bVersion<=%u
1263#>>>(0x1BC.s+8)		ubyte		x			asm_flag_%x
1264>>>(0x1BC.s+8)		ubyte&1		1			\b,Y2K-Fix
1265# variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode
1266>>>(0x1BC.s+8)		ubyte&2		2			\b,TestDisk
1267#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
1268#>>>(0x1BC.s+10)		ubyte		x			\b,flags 0x%x
1269#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
1270#>>>(0x1BC.s+11)		ubyte		x			\b,cfg_def 0x%x
1271# for older versions
1272>>>(0x1BC.s+9)		ubyte		<2
1273#>>>>(0x1BC.s+12)	ubyte		18			\b,%hhu/18 seconds
1274>>>>(0x1BC.s+12)	ubyte		!18			\b,%u/18 seconds
1275# floppy A: or B:
1276>>>>(0x1BC.s+13)	ubyte		<2			\b,floppy 0x%x
1277>>>>(0x1BC.s+13)	ubyte		>1
1278# 1st hard disc
1279#>>>>>(0x1BC.s+13)	ubyte		0x80			\b,drive 0x%x
1280# not 1st hard disc
1281>>>>>(0x1BC.s+13)	ubyte		!0x80			\b,drive 0x%x
1282# for version >= 2 maximal timeout can be 65534
1283>>>(0x1BC.s+9)		ubyte		>1
1284#>>>>(0x1BC.s+12)	uleshort	18			\b,%u/18 seconds
1285>>>>(0x1BC.s+12)	uleshort	!18			\b,%u/18 seconds
1286# floppy A: or B:
1287>>>>(0x1BC.s+14)	ubyte		<2			\b,floppy 0x%x
1288>>>>(0x1BC.s+14)	ubyte		>1
1289# 1st hard disc
1290#>>>>>(0x1BC.s+14)	ubyte		0x80			\b,drive 0x%x
1291# not 1st hard disc
1292>>>>>(0x1BC.s+14)	ubyte		!0x80			\b,drive 0x%x
1293>>>0	ubyte		x					\b)
1294
1295# added by Joerg Jenderek
1296# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
1297# grub-1.94/kern/i386/pc/startup.S
1298# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
1299# usual values are marked with comments to get only informations of strange GRUB loaders
13000x200	uleshort		0x70EA
1301# found only version 3.{1,2}
1302>0x206		ubeshort	>0x0300
1303# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
1304>>0x212 	ubyte		>0x29
1305>>>0x213 	ubyte		>0x29
1306# not iso9660_stage1_5
1307#>>>0	ulelong&0x00BE5652	0x00BE5652
1308>>>>0x213 	ubyte		>0x29		GRand Unified Bootloader
1309# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
1310>>>>0x217 	ubyte		0xFF		stage1_5
1311>>>>0x217 	ubyte		<0xFF		stage2
1312>>>>0x206	ubyte		x		\b version %u
1313>>>>0x207	ubyte		x		\b.%u
1314# module_size for 1.94
1315>>>>0x208	ulelong		<0xffffff	\b, installed partition %u
1316#>>>>0x208	ulelong		=0xffffff	\b, %lu (default)
1317>>>>0x208	ulelong		>0xffffff	\b, installed partition %u
1318# GRUB 0.5.95 unofficial
1319>>>>0x20C	ulelong&0x2E300000 0x2E300000
1320# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs
1321>>>>>0x20C	ubyte		x		\b, identifier 0x%x
1322#>>>>>0x20D	ubyte		=0		\b, LBA flag 0x%x (default)
1323>>>>>0x20D	ubyte		>0		\b, LBA flag 0x%x
1324# GRUB version as string
1325>>>>>0x20E 	string		>\0		\b, GRUB version %-s
1326# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
1327>>>>>>0x215 	ulong		0xffffffff
1328>>>>>>>0x219 	string		>\0		\b, configuration file %-s
1329>>>>>>0x215 	ulong		!0xffffffff
1330>>>>>>>0x215 	string		>\0		\b, configuration file %-s
1331# newer GRUB versions
1332>>>>0x20C	ulelong&0x2E300000 !0x2E300000
1333##>>>>>0x20C	ulelong		=0		\b, saved entry %d (usual)
1334>>>>>0x20C	ulelong		>0		\b, saved entry %d
1335# for 1.94 contains kernel image size
1336# for 0.93,0.94,0.96,0.97
1337# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs	6=vstafs	7=jfs	8=xfs	9=iso9660	a=ufs2
1338>>>>>0x210	ubyte		x		\b, identifier 0x%x
1339# The flag for LBA forcing is in most cases 0
1340#>>>>>0x211	ubyte		=0		\b, LBA flag 0x%x (default)
1341>>>>>0x211	ubyte		>0		\b, LBA flag 0x%x
1342# GRUB version as string
1343>>>>>0x212 	string		>\0		\b, GRUB version %-s
1344# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
1345>>>>>0x217 	ulong		0xffffffff
1346>>>>>>0x21b 	string		>\0		\b, configuration file %-s
1347>>>>>0x217 	ulong		!0xffffffff
1348>>>>>>0x217 	string		>\0		\b, configuration file %-s
1349
1350# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
1351# JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
1352# over BIOS parameter block (BPB)
1353# https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
1354# older drives may use Near JuMP instruction E9 xx xx
1355# minimal short forward jump found 0x29 for bootloaders or 0x0
1356# maximal short forward jump is 0x7f
1357# OEM-ID is empty or contain readable bytes
13580		ulelong&0x804000E9	0x000000E9
1359!:strength	+60
1360# mtools-3.9.8/msdos.h
1361# usual values are marked with comments to get only informations of strange FAT systems
1362# valid sectorsize must be a power of 2 from 32 to 32768
1363>11		uleshort&0x001f	0
1364>>11		uleshort	<32769
1365>>>11		uleshort	>31
1366>>>>21		ubyte&0xf0	0xF0
1367>>>>>0		ubyte		0xEB		DOS/MBR boot sector
1368>>>>>>1		ubyte		x		\b, code offset 0x%x+2
1369>>>>>0		ubyte		0xE9
1370>>>>>>1		uleshort	x		\b, code offset 0x%x+3
1371>>>>>3		string		>\0		\b, OEM-ID "%-.8s"
1372#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
1373>>>>>>8		string		IHC		\b cached by Windows 9M
1374>>>>>11		uleshort	>512		\b, Bytes/sector %u
1375#>>>>>11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
1376>>>>>11		uleshort	<512		\b, Bytes/sector %u
1377>>>>>13		ubyte		>1		\b, sectors/cluster %u
1378#>>>>>13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
1379# for lazy FAT32 implementation like Transcend digital photo frame PF830
1380>>>>>82		string/c	fat32
1381>>>>>>14	uleshort	!32		\b, reserved sectors %u
1382#>>>>>>14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
1383>>>>>82		string/c	!fat32
1384>>>>>>14	uleshort	>1		\b, reserved sectors %u
1385#>>>>>>14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
1386#>>>>>>14	uleshort	0		\b, reserved sectors %u (usual NTFS)
1387>>>>>16		ubyte		>2		\b, FATs %u
1388#>>>>>16	ubyte		=2		\b, FATs %u (usual)
1389>>>>>16		ubyte		=1		\b, FAT  %u
1390>>>>>16		ubyte		>0
1391>>>>>17		uleshort	>0		\b, root entries %u
1392#>>>>>17	uleshort	=0		\b, root entries %hu=0 (usual Fat32)
1393>>>>>19		uleshort	>0		\b, sectors %u (volumes <=32 MB)
1394#>>>>>19	uleshort	=0		\b, sectors %hu=0 (usual Fat32)
1395>>>>>21		ubyte		>0xF0		\b, Media descriptor 0x%x
1396#>>>>>21	ubyte		=0xF0		\b, Media descriptor 0x%x (usual floppy)
1397>>>>>21		ubyte		<0xF0		\b, Media descriptor 0x%x
1398>>>>>22		uleshort	>0		\b, sectors/FAT %u
1399#>>>>>22	uleshort	=0		\b, sectors/FAT %hu=0 (usual Fat32)
1400>>>>>24		uleshort	x		\b, sectors/track %u
1401>>>>>26		ubyte		>2		\b, heads %u
1402#>>>>>26	ubyte		=2		\b, heads %u (usual floppy)
1403>>>>>26		ubyte		=1		\b, heads %u
1404# valid only for sector sizes with more then 32 Bytes
1405>>>>>11		uleshort	>32
1406# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
1407# skip for values 2,2Ah,70h,73h,DFh
1408# and continue for extended boot signature values 0,28h,29h,80h
1409>>>>>>38	ubyte&0x56	=0
1410>>>>>>>28	ulelong		>0		\b, hidden sectors %u
1411#>>>>>>>28	ulelong		=0		\b, hidden sectors %u (usual floppy)
1412>>>>>>>32	ulelong		>0		\b, sectors %u (volumes > 32 MB)
1413#>>>>>>>32	ulelong		=0		\b, sectors %u (volumes > 32 MB)
1414# FAT<32 bit specific
1415>>>>>>>82	string/c	!fat32
1416#>>>>>>>>36	ubyte		0x80		\b, physical drive 0x%x=0x80 (usual harddisk)
1417#>>>>>>>>36	ubyte		0		\b, physical drive 0x%x=0 (usual floppy)
1418>>>>>>>>36	ubyte		!0x80
1419>>>>>>>>>36	ubyte		!0		\b, physical drive 0x%x
1420# VGA-copy CRC or
1421# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
1422>>>>>>>>37	ubyte		>0		\b, reserved 0x%x
1423#>>>>>>>>37	ubyte		=0		\b, reserved 0x%x
1424# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others
1425>>>>>>>>38	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
1426>>>>>>>>38	ubyte&0xFE	=0x28
1427>>>>>>>>>39	ulelong		x		\b, serial number 0x%x
1428>>>>>>>>38	ubyte		=0x29
1429>>>>>>>>>43	string		<NO\ NAME	\b, label: "%11.11s"
1430>>>>>>>>>43	string		>NO\ NAME	\b, label: "%11.11s"
1431>>>>>>>>>43	string		=NO\ NAME	\b, unlabeled
1432# there exist some old floppies without word FAT at offset 54
1433# a word like "FATnm   " is only a hint for a FAT size on nm-bits
1434# Normally the number of clusters is calculated by the values of BPP.
1435# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
1436# otherwise FAT is 16 bit.
1437# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
1438>>>>>82		string/c	!fat32
1439>>>>>>54	string		FAT12		\b, FAT (12 bit)
1440>>>>>>54	string		FAT16		\b, FAT (16 bit)
1441>>>>>>54	default		x
1442# determinate FAT bit size by media descriptor
1443# small floppies implies FAT12
1444>>>>>>>21	ubyte		<0xF0		\b, FAT (12 bit by descriptor)
1445# with media descriptor F0h floppy or maybe superfloppy with FAT16
1446>>>>>>>21	ubyte		=0xF0
1447# superfloppy (many sectors) implies FAT16
1448>>>>>>>>32	ulelong		>0xFFFF		\b, FAT (16 bit by descriptor+sectors)
1449# no superfloppy with media descriptor F0h implies FAT12
1450>>>>>>>>32	default		x		\b, FAT (12 bit by descriptor+sectors)
1451# with media descriptor F8h floppy or hard disc with FAT12 or FAT16
1452>>>>>>>21	ubyte		=0xF8
1453# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
1454>>>>>>>>19	ubequad	0xd002f80300090001	\b, FAT (12 bit by descriptor+geometry)
1455# hard disc with FAT12 or FAT16
1456>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
1457# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
1458>>>>>>>21	ubyte		=0xFA
1459# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
1460>>>>>>>>19	ubequad	0x8002fa0200080001	\b, FAT (12 bit by descriptor+geometry)
1461# RAM disc with FAT12 or FAT16 or Tandy hard disc
1462>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
1463# others are floppy
1464>>>>>>>21	default		x		\b, FAT (12 bit by descriptor)
1465# FAT32 bit specific
1466>>>>>82		string/c	fat32		\b, FAT (32 bit)
1467>>>>>>36	ulelong		x		\b, sectors/FAT %u
1468# https://technet.microsoft.com/en-us/library/cc977221.aspx
1469>>>>>>40	uleshort	>0		\b, extension flags 0x%x
1470#>>>>>>40	uleshort	=0		\b, extension flags %hu
1471>>>>>>42	uleshort	>0		\b, fsVersion %u
1472#>>>>>>42	uleshort	=0		\b, fsVersion %u (usual)
1473>>>>>>44	ulelong		>2		\b, rootdir cluster %u
1474#>>>>>>44	ulelong		=2		\b, rootdir cluster %u
1475#>>>>>>44	ulelong		=1		\b, rootdir cluster %u
1476>>>>>>48	uleshort	>1		\b, infoSector %u
1477#>>>>>>48	uleshort	=1		\b, infoSector %u (usual)
1478>>>>>>48	uleshort	<1		\b, infoSector %u
1479# 0 or 0xFFFF instead of usual 6 means no backup sector
1480>>>>>>50	uleshort	=0xFFFF		\b, no Backup boot sector
1481>>>>>>50	uleshort	=0		\b, no Backup boot sector
1482#>>>>>>50	uleshort	=6		\b, Backup boot sector %u (usual)
1483>>>>>>50	default		x
1484>>>>>>>50	uleshort	x		\b, Backup boot sector %u
1485# corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
1486>>>>>>52	ulelong		>0		\b, reserved1 0x%x
1487>>>>>>56	ulelong		>0		\b, reserved2 0x%x
1488>>>>>>60	ulelong		>0		\b, reserved3 0x%x
1489# same structure as FAT1X
1490#>>>>>>64	ubyte		=0x80		\b, physical drive 0x%x=80 (usual harddisk)
1491#>>>>>>64	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
1492>>>>>>64	ubyte		!0x80
1493>>>>>>>64	ubyte		>0		\b, physical drive 0x%x
1494# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
1495>>>>>>65	ubyte		>0		\b, reserved 0x%x
1496>>>>>>66	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
1497>>>>>>66	ubyte		=0x29
1498>>>>>>>67	ulelong		x		\b, serial number 0x%x
1499>>>>>>>71	string		<NO\ NAME	\b, label: "%11.11s"
1500>>>>>>>71	string		>NO\ NAME	\b, label: "%11.11s"
1501>>>>>>>71	string		=NO\ NAME	\b, unlabeled
1502# additional tests for floppy image added by Joerg Jenderek
1503# no fixed disk
1504>>>>>21		ubyte		!0xF8
1505# floppy media with 12 bit FAT
1506>>>>>>54	string		!FAT16
1507# test for FAT after bootsector
1508>>>>>>>(11.s)	ulelong&0x00ffffF0	0x00ffffF0	\b, followed by FAT
1509# floppy image
1510!:mime application/x-ima
1511# NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
1512# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
1513# 0 FATs
1514>>>>>16	ubyte		=0
1515# 0 root entries
1516>>>>>>17	uleshort	=0
1517# 0 DOS sectors
1518>>>>>>>19	uleshort	=0
1519# 0 sectors/FAT
1520# dos < 4.0 BootSector value found is 0x80
1521#38	ubyte		=0x80			\b, dos < 4.0 BootSector (0x%x)
1522>>>>>>>>22	uleshort	=0		\b; NTFS
1523>>>>>>>>>24	uleshort	>0		\b, sectors/track %u
1524>>>>>>>>>36	ulelong		!0x800080	\b, physical drive 0x%x
1525>>>>>>>>>40	ulequad		>0		\b, sectors %lld
1526>>>>>>>>>48	ulequad		>0		\b, $MFT start cluster %lld
1527>>>>>>>>>56	ulequad		>0		\b, $MFTMirror start cluster %lld
1528# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
1529# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
1530>>>>>>>>>64	lelong		<256
1531>>>>>>>>>>64	lelong		<128		\b, clusters/RecordSegment %d
1532>>>>>>>>>>64	ubyte		>127		\b, bytes/RecordSegment 2^(-1*%i)
1533# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
1534# Values 128 to 255 represent index block sizes of 2^(256-N) byte
1535>>>>>>>>>68	ulelong		<256
1536>>>>>>>>>>68	ulelong		<128		\b, clusters/index block %d
1537#>>>>>>>>>>68	ulelong		>127		\b, bytes/index block 2^(256-%d)
1538>>>>>>>>>>68	ubyte		>127		\b, bytes/index block 2^(-1*%i)
1539>>>>>>>>>72	ulequad		x		\b, serial number 0%llx
1540>>>>>>>>>80	ulelong		>0		\b, checksum 0x%x
1541#>>>>>>>>>80	ulelong		=0		\b, checksum 0x%x=0 (usual)
1542# unicode loadername size jump
1543>>>>>>>>>(0x200.s*2)	ubyte				x
1544# in next sector loadername terminated by unicode CTRL-D and $
1545>>>>>>>>>>&0x1FF	ulequad&0x0000FFffFFffFF00	0x0000002400040000 \b; contains
1546# if 2nd NTFS sectors is found then assume whole filesystem
1547#!:mime		application/x-raw-disk-image
1548!:ext		img/bin/ntfs
1549>>>>>>>>>>>0x200	use				ntfs-sector2
1550
1551# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019
1552# https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
1553# unused assembler instructions short JMP y2;NOP;NOP
15540x056		ulelong&0xFFFF0FFF	0x909002EB	NTFS
1555#!:mime		application/octet-stream
1556!:ext		bin
1557>0		use		ntfs-sector2
1558# https://memory.dataram.com/products-and-services/software/ramdisk
1559# assembler instructions JMP C000;NOP
15600x056		ulelong			0x9000c0e9	NTFS
1561#!:mime		application/octet-stream
1562!:ext		bin
1563>0		use		ntfs-sector2
1564# check for characteristics of second NTFS sector and then display loader name
15650		name		ntfs-sector2
1566# number of utf16 characters of loadername
1567>0		uleshort	<8
1568# unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP
1569>>0x056		ulelong&0xFF0000FD	0x900000E9
1570# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
1571>>>0x002		lestring16	x	bootstrap %-5.5s
1572# check for 7 character length of loader name like BOOTMGR
1573>>>0		uleshort	7
1574>>>>0x0c	lestring16	x	\b%-2.2s
1575### DOS,NTFS boot sectors end
1576
1577# ntfsclone-image is a special save format for NTFS volumes,
1578# created and restored by the ntfsclone program
15790	string	\0ntfsclone-image	ntfsclone image,
1580>0x10	byte	x			version %d.
1581>0x11	byte	x			\b%d,
1582>0x12	lelong	x			cluster size %d,
1583>0x16	lequad	x			device size %lld,
1584>0x1e	lequad	x			%lld total clusters,
1585>0x26	lequad	x			%lld clusters in use
1586
15879564	lelong		0x00011954	Unix Fast File system [v1] (little-endian),
1588>8404	string		x		last mounted on %s,
1589#>9504	ledate		x		last checked at %s,
1590>8224	ledate		x		last written at %s,
1591>8401	byte		x		clean flag %d,
1592>8228	lelong		x		number of blocks %d,
1593>8232	lelong		x		number of data blocks %d,
1594>8236	lelong		x		number of cylinder groups %d,
1595>8240	lelong		x		block size %d,
1596>8244	lelong		x		fragment size %d,
1597>8252	lelong		x		minimum percentage of free blocks %d,
1598>8256	lelong		x		rotational delay %dms,
1599>8260	lelong		x		disk rotational speed %drps,
1600>8320	lelong		0		TIME optimization
1601>8320	lelong		1		SPACE optimization
1602
160342332	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
1604>&-1164	string		x		last mounted on %s,
1605>&-696	string		>\0		volume name %s,
1606>&-304	leqldate	x		last written at %s,
1607>&-1167	byte		x		clean flag %d,
1608>&-1168	byte		x		readonly flag %d,
1609>&-296	lequad		x		number of blocks %lld,
1610>&-288	lequad		x		number of data blocks %lld,
1611>&-1332	lelong		x		number of cylinder groups %d,
1612>&-1328	lelong		x		block size %d,
1613>&-1324	lelong		x		fragment size %d,
1614>&-180	lelong		x		average file size %d,
1615>&-176	lelong		x		average number of files in dir %d,
1616>&-272	lequad		x		pending blocks to free %lld,
1617>&-264	lelong		x		pending inodes to free %d,
1618>&-664	lequad		x		system-wide uuid %0llx,
1619>&-1316	lelong		x		minimum percentage of free blocks %d,
1620>&-1248	lelong		0		TIME optimization
1621>&-1248	lelong		1		SPACE optimization
1622
162366908	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
1624>&-1164	string		x		last mounted on %s,
1625>&-696	string		>\0		volume name %s,
1626>&-304	leqldate	x		last written at %s,
1627>&-1167	byte		x		clean flag %d,
1628>&-1168	byte		x		readonly flag %d,
1629>&-296	lequad		x		number of blocks %lld,
1630>&-288	lequad		x		number of data blocks %lld,
1631>&-1332	lelong		x		number of cylinder groups %d,
1632>&-1328	lelong		x		block size %d,
1633>&-1324	lelong		x		fragment size %d,
1634>&-180	lelong		x		average file size %d,
1635>&-176	lelong		x		average number of files in dir %d,
1636>&-272	lequad		x		pending blocks to free %lld,
1637>&-264	lelong		x		pending inodes to free %d,
1638>&-664	lequad		x		system-wide uuid %0llx,
1639>&-1316	lelong		x		minimum percentage of free blocks %d,
1640>&-1248	lelong		0		TIME optimization
1641>&-1248	lelong		1		SPACE optimization
1642
16439564	belong		0x00011954	Unix Fast File system [v1] (big-endian),
1644>7168   belong		0x4c41424c	Apple UFS Volume
1645>>7186  string		x		named %s,
1646>>7176  belong		x		volume label version %d,
1647>>7180  bedate		x		created on %s,
1648>8404	string		x		last mounted on %s,
1649#>9504	bedate		x		last checked at %s,
1650>8224	bedate		x		last written at %s,
1651>8401	byte		x		clean flag %d,
1652>8228	belong		x		number of blocks %d,
1653>8232	belong		x		number of data blocks %d,
1654>8236	belong		x		number of cylinder groups %d,
1655>8240	belong		x		block size %d,
1656>8244	belong		x		fragment size %d,
1657>8252	belong		x		minimum percentage of free blocks %d,
1658>8256	belong		x		rotational delay %dms,
1659>8260	belong		x		disk rotational speed %drps,
1660>8320	belong		0		TIME optimization
1661>8320	belong		1		SPACE optimization
1662
166342332	belong		0x19540119	Unix Fast File system [v2] (big-endian)
1664>&-1164	string		x		last mounted on %s,
1665>&-696	string		>\0		volume name %s,
1666>&-304	beqldate	x		last written at %s,
1667>&-1167	byte		x		clean flag %d,
1668>&-1168	byte		x		readonly flag %d,
1669>&-296	bequad		x		number of blocks %lld,
1670>&-288	bequad		x		number of data blocks %lld,
1671>&-1332	belong		x		number of cylinder groups %d,
1672>&-1328	belong		x		block size %d,
1673>&-1324	belong		x		fragment size %d,
1674>&-180	belong		x		average file size %d,
1675>&-176	belong		x		average number of files in dir %d,
1676>&-272	bequad		x		pending blocks to free %lld,
1677>&-264	belong		x		pending inodes to free %d,
1678>&-664	bequad		x		system-wide uuid %0llx,
1679>&-1316	belong		x		minimum percentage of free blocks %d,
1680>&-1248	belong		0		TIME optimization
1681>&-1248	belong		1		SPACE optimization
1682
168366908	belong		0x19540119	Unix Fast File system [v2] (big-endian)
1684>&-1164	string		x		last mounted on %s,
1685>&-696	string		>\0		volume name %s,
1686>&-304	beqldate	x		last written at %s,
1687>&-1167	byte		x		clean flag %d,
1688>&-1168	byte		x		readonly flag %d,
1689>&-296	bequad		x		number of blocks %lld,
1690>&-288	bequad		x		number of data blocks %lld,
1691>&-1332	belong		x		number of cylinder groups %d,
1692>&-1328	belong		x		block size %d,
1693>&-1324	belong		x		fragment size %d,
1694>&-180	belong		x		average file size %d,
1695>&-176	belong		x		average number of files in dir %d,
1696>&-272	bequad		x		pending blocks to free %lld,
1697>&-264	belong		x		pending inodes to free %d,
1698>&-664	bequad		x		system-wide uuid %0llx,
1699>&-1316	belong		x		minimum percentage of free blocks %d,
1700>&-1248	belong		0		TIME optimization
1701>&-1248	belong		1		SPACE optimization
1702
17030	ulequad		0xc8414d4dc5523031	HAMMER filesystem (little-endian),
1704>0x90	lelong+1	x			volume %d
1705>0x94	lelong		x			(of %d),
1706>0x50	string		x			name %s,
1707>0x98	ulelong		x			version %u,
1708>0xa0	ulelong		x			flags 0x%x
1709
1710# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
1711# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
1712# volume label and UUID Russell Coker
1713# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
17140x438   leshort         0xEF53          Linux
1715>0x44c  lelong          x               rev %d
1716>0x43e  leshort         x               \b.%d
1717# No journal?  ext2
1718>0x45c  lelong          ^0x0000004      ext2 filesystem data
1719>>0x43a leshort         ^0x0000001      (mounted or unclean)
1720# Has a journal?  ext3 or ext4
1721>0x45c  lelong          &0x0000004
1722#  and small INCOMPAT?
1723>>0x460 lelong          <0x0000040
1724#   and small RO_COMPAT?
1725>>>0x464 lelong         <0x0000008      ext3 filesystem data
1726#   else large RO_COMPAT?
1727>>>0x464 lelong         >0x0000007      ext4 filesystem data
1728#  else large INCOMPAT?
1729>>0x460	lelong          >0x000003f      ext4 filesystem data
1730>0x468	belong		x		\b, UUID=%08x
1731>0x46c	beshort		x		\b-%04x
1732>0x46e	beshort		x		\b-%04x
1733>0x470	beshort		x		\b-%04x
1734>0x472	belong		x		\b-%08x
1735>0x476	beshort		x		\b%04x
1736>0x478	string		>0		\b, volume name "%s"
1737# General flags for any ext* fs
1738>0x460	lelong          &0x0000004      (needs journal recovery)
1739>0x43a	leshort         &0x0000002      (errors)
1740# INCOMPAT flags
1741>0x460	lelong          &0x0000001      (compressed)
1742#>0x460	lelong          &0x0000002      (filetype)
1743#>0x460	lelong          &0x0000010      (meta bg)
1744>0x460	lelong          &0x0000040      (extents)
1745>0x460	lelong          &0x0000080      (64bit)
1746#>0x460	lelong          &0x0000100      (mmp)
1747#>0x460	lelong          &0x0000200      (flex bg)
1748# RO_INCOMPAT flags
1749#>0x464	lelong          &0x0000001      (sparse super)
1750>0x464	lelong          &0x0000002      (large files)
1751>0x464	lelong          &0x0000008      (huge files)
1752#>0x464	lelong          &0x0000010      (gdt checksum)
1753#>0x464	lelong          &0x0000020      (many subdirs)
1754#>0x463	lelong          &0x0000040      (extra isize)
1755
1756# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
17570x400	lelong		0xF2F52010	F2FS filesystem
1758>0x46c	belong		x		\b, UUID=%08x
1759>0x470	beshort		x		\b-%04x
1760>0x472	beshort		x		\b-%04x
1761>0x474	beshort		x		\b-%04x
1762>0x476	belong		x		\b-%08x
1763>0x47a	beshort		x		\b%04x
1764>0x147c	lestring16	x		\b, volume name "%s"
1765
1766# Minix filesystems - Juan Cespedes <cespedes@debian.org>
17670x410	leshort		0x137f
1768!:strength / 2
1769>0x402	beshort		< 100
1770>0x402	beshort		> -1		Minix filesystem, V1, 14 char names, %d zones
1771>0x1e	string		minix		\b, bootable
17720x410	beshort		0x137f
1773!:strength / 2
1774>0x402	beshort		< 100
1775>0x402	beshort		> -1		Minix filesystem, V1 (big endian), %d zones
1776>0x1e	string		minix		\b, bootable
17770x410	leshort		0x138f
1778!:strength / 2
1779>0x402	beshort		< 100
1780>0x402	beshort		> -1		Minix filesystem, V1, 30 char names, %d zones
1781>0x1e	string		minix		\b, bootable
17820x410	beshort		0x138f
1783!:strength / 2
1784>0x402	beshort		< 100
1785>0x402	beshort		> -1		Minix filesystem, V1, 30 char names (big endian), %d zones
1786>0x1e	string		minix		\b, bootable
1787# Weak Magic: this is $x
1788#0x410	leshort		0x2468
1789#>0x402	beshort		< 100
1790#>>0x402	beshort		> -1		Minix filesystem, V2, 14 char names
1791#>0x1e	string		minix		\b, bootable
1792#0x410	beshort		0x2468
1793#>0x402	beshort		< 100
1794#>0x402	beshort		> -1		Minix filesystem, V2 (big endian)
1795#>0x1e	string		minix		\b, bootable
1796#0x410	leshort		0x2478
1797#>0x402	beshort		< 100
1798#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
1799#>0x1e	string		minix		\b, bootable
1800#0x410	leshort		0x2478
1801#>0x402	beshort		< 100
1802#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
1803#>0x1e	string		minix		\b, bootable
1804#0x410	beshort		0x2478
1805#>0x402	beshort		!0		Minix filesystem, V2, 30 char names (big endian)
1806#>0x1e	string		minix		\b, bootable
1807# Weak Magic! this is MD
1808#0x418	leshort		0x4d5a
1809#>0x402	beshort		<100
1810#>>0x402	beshort		> -1		Minix filesystem, V3, 60 char names
1811
1812# SGI disk labels - Nathan Scott <nathans@debian.org>
18130	belong		0x0BE5A941	SGI disk label (volume header)
1814
1815# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
18160	belong		0x58465342	SGI XFS filesystem data
1817>0x4	belong		x		(blksz %d,
1818>0x68	beshort		x		inosz %d,
1819>0x64	beshort		^0x2004		v1 dirs)
1820>0x64	beshort		&0x2004		v2 dirs)
1821
1822############################################################################
1823# Minix-ST kernel floppy
18240x800	belong		0x46fc2700	Atari-ST Minix kernel image
1825# https://en.wikipedia.org/wiki/BIOS_parameter_block
1826# floppies with valid BPB and any instruction at beginning
1827>19	string		\240\005\371\005\0\011\0\2\0	\b, 720k floppy
1828>19	string		\320\002\370\005\0\011\0\1\0	\b, 360k floppy
1829
1830############################################################################
1831# Hmmm, is this a better way of detecting _standard_ floppy images ?
183219	string		\320\002\360\003\0\011\0\1\0	DOS floppy 360k
1833>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
183419	string		\240\005\371\003\0\011\0\2\0	DOS floppy 720k
1835>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
183619	string		\100\013\360\011\0\022\0\2\0	DOS floppy 1440k
1837>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1838
183919	string		\240\005\371\005\0\011\0\2\0	DOS floppy 720k, IBM
1840>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
184119	string		\100\013\371\005\0\011\0\2\0	DOS floppy 1440k, mkdosfs
1842>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1843
184419	string		\320\002\370\005\0\011\0\1\0	Atari-ST floppy 360k
184519	string		\240\005\371\005\0\011\0\2\0	Atari-ST floppy 720k
1846#			|       |   |     |     |
1847#			|       |   |     |     heads
1848#			|       |   |     sectors/track
1849#			|       |   sectors/FAT
1850#			|       media descriptor
1851#		BPB:	sectors
1852
1853#  Valid media descriptor bytes for MS-DOS:
1854#
1855#     Byte   Capacity   Media Size and Type
1856#     -------------------------------------------------
1857#
1858#     F0     2.88 MB    3.5-inch, 2-sided, 36-sector
1859#     F0     1.44 MB    3.5-inch, 2-sided, 18-sector
1860#     F9     720K       3.5-inch, 2-sided, 9-sector
1861#     F9     1.2 MB     5.25-inch, 2-sided, 15-sector
1862#     FD     360K       5.25-inch, 2-sided, 9-sector
1863#     FF     320K       5.25-inch, 2-sided, 8-sector
1864#     FC     180K       5.25-inch, 1-sided, 9-sector
1865#     FE     160K       5.25-inch, 1-sided, 8-sector
1866#     FE     250K       8-inch, 1-sided, single-density
1867#     FD     500K       8-inch, 2-sided, single-density
1868#     FE     1.2 MB     8-inch, 2-sided, double-density
1869#     F8     -----      Fixed disk
1870#
1871#     FC     xxxK       Apricot 70x1x9 boot disk.
1872#
1873# Originally a bitmap:
1874#  xxxxxxx0	Not two sided
1875#  xxxxxxx1	Double sided
1876#  xxxxxx0x	Not 8 SPT
1877#  xxxxxx1x	8 SPT
1878#  xxxxx0xx	Not Removable drive
1879#  xxxxx1xx	Removable drive
1880#  11111xxx	Must be one.
1881#
1882# But now it's rather random:
1883#  111111xx	Low density disk
1884#        00	SS, Not 8 SPT
1885#        01	DS, Not 8 SPT
1886#        10	SS, 8 SPT
1887#        11	DS, 8 SPT
1888#
1889#  11111001	Double density 3 1/2 floppy disk, high density 5 1/4
1890#  11110000	High density 3 1/2 floppy disk
1891#  11111000	Hard disk any format
1892#
1893
1894# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
1895# https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
1896# Too Weak.
1897#512		ubelong&0xE0ffff00	0xE0ffff00
1898# without valid Media descriptor in place of BPB, cases with are done at other places
1899#>21		ubyte			<0xE5			floppy with old FAT filesystem
1900# but valid Media descriptor at begin of FAT
1901#>>512		ubyte			=0xed			720k
1902#>>512		ubyte			=0xf0			1440k
1903#>>512		ubyte			=0xf8			720k
1904#>>512		ubyte			=0xf9			1220k
1905#>>512		ubyte			=0xfa			320k
1906#>>512		ubyte			=0xfb			640k
1907#>>512		ubyte			=0xfc			180k
1908# look like an old DOS directory entry
1909#>>>0xA0E	ubequad			0
1910#>>>>0xA00	ubequad			!0
1911#!:mime application/x-ima
1912#>>512		ubyte			=0xfd
1913# look for 2nd FAT at different location to distinguish between 360k and 500k
1914#>>>0x600	ubelong&0xE0ffff00	0xE0ffff00		360k
1915#>>>0x500	ubelong&0xE0ffff00	0xE0ffff00		500k
1916#>>>0xA0E	ubequad			0
1917#!:mime application/x-ima
1918#>>512		ubyte			=0xfe
1919#>>>0x400	ubelong&0xE0ffff00	0xE0ffff00		160k
1920#>>>>0x60E	ubequad			0
1921#>>>>>0x600	ubequad			!0
1922#!:mime application/x-ima
1923#>>>0xC00	ubelong&0xE0ffff00	0xE0ffff00		1200k
1924#>>512		ubyte			=0xff			320k
1925#>>>0x60E	ubequad			0
1926#>>>>0x600	ubequad			!0
1927#!:mime application/x-ima
1928#>>512		ubyte			x			\b, Media descriptor 0x%x
1929# without x86 jump instruction
1930#>>0		ulelong&0x804000E9	!0x000000E9
1931# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
1932#>>>0	ubequad				0xfabce701b8c0078e	\b, MS-DOS 1.12 bootloader
1933# IOSYS.COM+MSDOS.COM
1934#>>>>0xc4	use			2xDOS-filename
1935#>>0		ulelong&0x804000E9	=0x000000E9
1936# only x86 short jump instruction found
1937#>>>0		ubyte			=0xEB
1938#>>>>1		ubyte			x			\b, code offset 0x%x+2
1939# https://thestarman.pcministry.com/DOS/ibm100/Boot.htm
1940# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
1941#>>>>(1.b+2)	ubequad			0xfa8cc88ed8ba0000	\b, PC-DOS 1.0 bootloader
1942# ibmbio.com+ibmdos.com
1943#>>>>>0x176	use			DOS-filename
1944#>>>>>0x181	ubyte			x			\b+
1945#>>>>>0x182	use			DOS-filename
1946# https://thestarman.pcministry.com/DOS/ibm110/Boot.htm
1947# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
1948#>>>>(1.b+2)	ubequad			0xfa8cc88ed833d28e	\b, PC-DOS 1.1 bootloader
1949# ibmbio.com+ibmdos.com
1950#>>>>>0x18b	use			DOS-filename
1951#>>>>>0x196	ubyte			x			\b+
1952#>>>>>0x197	use			DOS-filename
1953# https://en.wikipedia.org/wiki/Zenith_Data_Systems
1954# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
1955#>>>>(1.b+2)	ubequad			0xbbc0078ed3bcc601	\b, Zenith Data Systems MS-DOS 1.25 bootloader
1956# IO.SYS+MSDOS.SYS
1957#>>>>>0x20	use			2xDOS-filename
1958# https://en.wikipedia.org/wiki/Corona_Data_Systems
1959# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
1960#>>>>(1.b+2)	ubequad			0x8cc88ed8fa8ed0bc	\b, MS-DOS 1.25 bootloader
1961# IO.SYS+MSDOS.SYS
1962#>>>>>0x69	use			2xDOS-filename
1963# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
1964#>>>>(1.b+2)	ubequad			0xfa0e17bc007cb860	\b, MS-DOS 2.11 bootloader
1965# defect IO.SYS+MSDOS.SYS ?
1966#>>>>>0x162	use			2xDOS-filename
1967
19680	name				cdrom
1969>38913	string   !NSR0      ISO 9660 CD-ROM filesystem data
1970!:mime	application/x-iso9660-image
1971!:ext	iso/iso9660
1972>38913	string    NSR0      UDF filesystem data
1973!:mime	application/x-iso9660-image
1974!:ext	iso/udf
1975>>38917	string    1         (version 1.0)
1976>>38917	string    2         (version 1.5)
1977>>38917	string    3         (version 2.0)
1978>>38917	byte     >0x33      (unknown version, ID 0x%X)
1979>>38917	byte     <0x31      (unknown version, ID 0x%X)
1980# The next line is not necessary because the MBR staff is done looking for boot signature
1981>0x1FE	leshort  0xAA55     (DOS/MBR boot sector)
1982# "application id" which appears to be used as a volume label
1983>32808	string/T  >\0       '%s'
1984>34816	string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
198537633	string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
1986!:mime	application/x-iso9660-image
198732777	string    CDROM     High Sierra CD-ROM filesystem data
1988
1989# CDROM Filesystems
1990# https://en.wikipedia.org/wiki/ISO_9660
1991# Modified for UDF by gerardo.cacciari@gmail.com
199232769	string    CD001
1993# mime line at that position does not work
1994# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
1995#!:strength -11
1996# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
1997!:strength +34
1998>0	use	cdrom
1999
2000# URL: https://en.wikipedia.org/wiki/NRG_(file_format)
2001# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/
2002#	11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh
2003# From: Joerg Jenderek
2004# Note:	Only for nero disc with once (DAO) type after 300 KB header
2005339969	string    CD001	Nero CD image at 0x4B000
2006!:mime	application/x-nrg
2007!:ext	nrg
2008>307200	use cdrom
2009
2010# .cso files
2011# Reference: https://pismotec.com/ciso/ciso.h
2012# NOTE: There are two other formats with the same magic but
2013# completely incompatible specifications:
2014# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
2015# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
20160    string    CISO
2017# Other fields are used to determine what type of CISO this is:
2018# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
2019# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
2020# - 0x10 == 0x00004000: For >2GB files using maxcso...
2021# 			https://github.com/unknownbrackets/maxcso/issues/26
2022# - None of the above: Compact ISO.
2023>4	lelong	!0
2024>>4	lelong	!0x200000
2025>>>16	lelong	!0x800
2026>>>>16	lelong	!0x4000		Compressed ISO CD image
2027
2028# cramfs filesystem - russell@coker.com.au
20290       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
2030>4      lelong  x size %u
2031>8      lelong  &1 version #2
2032>8      lelong  &2 sorted_dirs
2033>8      lelong  &4 hole_support
2034>32     lelong  x CRC 0x%x,
2035>36     lelong  x edition %u,
2036>40     lelong  x %u blocks,
2037>44     lelong  x %u files
2038
20390       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
2040>4      belong  x size %u
2041>8      belong  &1 version #2
2042>8      belong  &2 sorted_dirs
2043>8      belong  &4 hole_support
2044>32     belong  x CRC 0x%x,
2045>36     belong  x edition %u,
2046>40     belong  x %u blocks,
2047>44     belong  x %u files
2048
2049# reiserfs - russell@coker.com.au
20500x10034		string	ReIsErFs	ReiserFS V3.5
20510x10034		string	ReIsEr2Fs	ReiserFS V3.6
20520x10034		string	ReIsEr3Fs	ReiserFS V3.6.19
2053>0x1002c 	leshort	x		block size %d
2054>0x10032	leshort	&2		(mounted or unclean)
2055>0x10000	lelong	x		num blocks %d
2056>0x10040	lelong	1		tea hash
2057>0x10040	lelong	2		yura hash
2058>0x10040	lelong	3		r5 hash
2059
2060# EST flat binary format (which isn't, but anyway)
2061# From: Mark Brown <broonie@sirena.org.uk>
20620	string	ESTFBINR	EST flat binary
2063
2064# Aculab VoIP firmware
2065# From: Mark Brown <broonie@sirena.org.uk>
20660	string	VoIP\ Startup\ and	Aculab VoIP firmware
2067>35	string	x	format %s
2068
2069# From: Mark Brown <broonie@sirena.org.uk> [old]
2070# From: Behan Webster <behanw@websterwood.com>
20710	belong	0x27051956	u-boot legacy uImage,
2072>32	string	x		%s,
2073>28	byte	0		Invalid os/
2074>28	byte	1		OpenBSD/
2075>28	byte	2		NetBSD/
2076>28	byte	3		FreeBSD/
2077>28	byte	4		4.4BSD/
2078>28	byte	5		Linux/
2079>28	byte	6		SVR4/
2080>28	byte	7		Esix/
2081>28	byte	8		Solaris/
2082>28	byte	9		Irix/
2083>28	byte	10		SCO/
2084>28	byte	11		Dell/
2085>28	byte	12		NCR/
2086>28	byte	13		LynxOS/
2087>28	byte	14		VxWorks/
2088>28	byte	15		pSOS/
2089>28	byte	16		QNX/
2090>28	byte	17		Firmware/
2091>28	byte	18		RTEMS/
2092>28	byte	19		ARTOS/
2093>28	byte	20		Unity OS/
2094>28	byte	21		INTEGRITY/
2095>29	byte	0		\bInvalid CPU,
2096>29	byte	1		\bAlpha,
2097>29	byte	2		\bARM,
2098>29	byte	3		\bIntel x86,
2099>29	byte	4		\bIA64,
2100>29	byte	5		\bMIPS,
2101>29	byte	6		\bMIPS 64-bit,
2102>29	byte	7		\bPowerPC,
2103>29	byte	8		\bIBM S390,
2104>29	byte	9		\bSuperH,
2105>29	byte	10		\bSparc,
2106>29	byte	11		\bSparc 64-bit,
2107>29	byte	12		\bM68K,
2108>29	byte	13		\bNios-32,
2109>29	byte	14		\bMicroBlaze,
2110>29	byte	15		\bNios-II,
2111>29	byte	16		\bBlackfin,
2112>29	byte	17		\bAVR32,
2113>29	byte	18		\bSTMicroelectronics ST200,
2114>29	byte	19		\bSandbox architecture,
2115>29	byte	20		\bANDES Technology NDS32,
2116>29	byte	21		\bOpenRISC 1000,
2117>29	byte	22		\bARM 64-bit,
2118>29	byte	23		\bDesignWare ARC,
2119>29	byte	24		\bx86_64,
2120>29	byte	25		\bXtensa,
2121>29	byte	26		\bRISC-V,
2122>30	byte	0		Invalid Image
2123>30	byte	1		Standalone Program
2124>30	byte	2		OS Kernel Image
2125>30	byte	3		RAMDisk Image
2126>30	byte	4		Multi-File Image
2127>30	byte	5		Firmware Image
2128>30	byte	6		Script File
2129>30	byte	7		Filesystem Image (any type)
2130>30	byte	8		Binary Flat Device Tree BLOB
2131>31	byte	0		(Not compressed),
2132>31	byte	1		(gzip),
2133>31	byte	2		(bzip2),
2134>31	byte	3		(lzma),
2135>12	belong	x		%d bytes,
2136>8	bedate	x		%s,
2137>16	belong	x		Load Address: 0x%08X,
2138>20	belong	x		Entry Point: 0x%08X,
2139>4	belong	x		Header CRC: 0x%08X,
2140>24	belong	x		Data CRC: 0x%08X
2141
2142# JFFS2 file system
21430	leshort	0x1984		Linux old jffs2 filesystem data little endian
21440	beshort	0x1984		Linux old jffs2 filesystem data big endian
21450	leshort	0x1985		Linux jffs2 filesystem data little endian
21460	beshort	0x1985		Linux jffs2 filesystem data big endian
2147
2148# Squashfs
21490	name	squashfs
2150>28	beshort	x	version %d.
2151>30	beshort	x	\b%d,
2152>20	beshort 0	uncompressed,
2153>20	beshort 1	zlib
2154>20	beshort 2	lzma
2155>20	beshort 3	lzo
2156>20	beshort 4	xz
2157>20	beshort 5	lz4
2158>20	beshort 6	zstd
2159>20	beshort >0	compressed,
2160>28	beshort <3
2161>>8	belong	x	%d bytes,
2162>28	beshort >2
2163>>28	beshort <4
2164>>>63	bequad x	%lld bytes,
2165>>28	beshort >3
2166>>>40	bequad x	%lld bytes,
2167#>>67	belong	x	%d bytes,
2168>4	belong	x	%d inodes,
2169>28	beshort <2
2170>>32	beshort	x	blocksize: %d bytes,
2171>28	beshort >1
2172>>28	beshort <4
2173>>>51	belong	x	blocksize: %d bytes,
2174>>28	beshort >3
2175>>>12	belong	x	blocksize: %d bytes,
2176>28	beshort <4
2177>>39	bedate	x	created: %s
2178>28	beshort >3
2179>>8	bedate	x	created: %s
2180
21810	string	sqsh	Squashfs filesystem, big endian,
2182>0	use	squashfs
2183
21840	string	hsqs	Squashfs filesystem, little endian,
2185>0	use	^squashfs
2186
2187# AFS Dump Magic
2188# From: Ty Sarna <tsarna@sarna.org>
21890       string                  \x01\xb3\xa1\x13\x22    AFS Dump
2190>&0     belong                  x                       (v%d)
2191>>&0    byte                    0x76
2192>>>&0   belong                  x                       Vol %d,
2193>>>>&0  byte                    0x6e
2194>>>>>&0 string                  x                       %s
2195>>>>>>&1        byte            0x74
2196>>>>>>>&0       beshort         2
2197>>>>>>>>&4      bedate          x                       on: %s
2198>>>>>>>>&0      bedate          =0                      full dump
2199>>>>>>>>&0      bedate          !0                      incremental since: %s
2200
2201#----------------------------------------------------------
2202#delta ISO    Daniel Novotny (dnovotny@redhat.com)
22030	string  DISO	Delta ISO data
2204!:strength +50
2205>4	belong  x	version %d
2206
2207# VMS backup savesets - gerardo.cacciari@gmail.com
2208#
22094            string  \x01\x00\x01\x00\x01\x00
2210>(0.s+16)    string  \x01\x01
2211>>&(&0.b+8)  byte    0x42       OpenVMS backup saveset data
2212>>>40        lelong  x          (block size %d,
2213>>>49        string  >\0        original name '%s',
2214>>>2         short   1024       VAX generated)
2215>>>2         short   2048       AXP generated)
2216>>>2         short   4096       I64 generated)
2217
2218# Summary: Oracle Clustered Filesystem
2219# Created by: Aaron Botsis <redhat@digitalmafia.org>
22208	string		OracleCFS	Oracle Clustered Filesystem,
2221>4	long		x		rev %d
2222>0	long		x		\b.%d,
2223>560	string		x		label: %.64s,
2224>136	string		x		mountpoint: %.128s
2225
2226# Summary: Oracle ASM tagged volume
2227# Created by: Aaron Botsis <redhat@digitalmafia.org>
222832	string		ORCLDISK	Oracle ASM Volume,
2229>40	string		x		Disk Name: %0.12s
223032	string		ORCLCLRD	Oracle ASM Volume (cleared),
2231>40	string		x		Disk Name: %0.12s
2232
2233# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
22348	string		OracleCFS	Oracle Clustered Filesystem,
2235>4	long		x		rev %d
2236>0	long		x		\b.%d,
2237>560	string		x		label: %.64s,
2238>136	string		x		mountpoint: %.128s
2239
2240# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
224132	string		ORCLDISK	Oracle ASM Volume,
2242>40	string		x		Disk Name: %0.12s
224332	string		ORCLCLRD	Oracle ASM Volume (cleared),
2244>40	string		x		Disk Name: %0.12s
2245
2246# Compaq/HP RILOE floppy image
2247# From: Dirk Jagdmann <doj@cubic.org>
22480	string	CPQRFBLO	Compaq/HP RILOE floppy image
2249
2250#------------------------------------------------------------------------------
2251# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
2252# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
2253# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
2254#
22551008    string          DECFILE11       Files-11 On-Disk Structure
2256>525    byte            x               (ODS-%d);
2257>1017   string          A               RSX-11, VAX/VMS or OpenVMS VAX file system;
2258>1017   string          B
2259>>525   byte            2               VAX/VMS or OpenVMS file system;
2260>>525   byte            5               OpenVMS Alpha or Itanium file system;
2261>984    string          x               volume label is '%-12.12s'
2262
2263# From: Thomas Klausner <wiz@NetBSD.org>
2264# https://filext.com/file-extension/DAA
2265# describes the daa file format. The magic would be:
22660	string		DAA\x0\x0\x0\x0\x0	PowerISO Direct-Access-Archive
2267
2268# From Albert Cahalan <acahalan@gmail.com>
2269# really le32 operation,destination,payloadsize (but quite predictable)
2270# 01 00 00 00 00 00 00 c0 00 02 00 00
22710	string		\1\0\0\0\0\0\0\300\0\2\0\0	Marvell Libertas firmware
2272
2273# From Eric Sandeen
2274# GFS2
22750x10000         belong          0x01161970
2276>0x10018        belong          0x0000051d      GFS1 Filesystem
2277>>0x10024        belong          x               (blocksize %d,
2278>>0x10060        string          >\0             lockproto %s)
2279>0x10018        belong          0x00000709      GFS2 Filesystem
2280>>0x10024        belong          x               (blocksize %d,
2281>>0x10060        string          >\0             lockproto %s)
2282
2283# Russell Coker <russell@coker.com.au>
22840x10040		string	_BHRfS_M	BTRFS Filesystem
2285>0x1012b	string	>\0		label "%s",
2286>0x10090	lelong	x		sectorsize %d,
2287>0x10094	lelong	x		nodesize %d,
2288>0x10098	lelong	x		leafsize %d,
2289>0x10020	belong	x		UUID=%08x-
2290>0x10024	beshort	x		\b%04x-
2291>0x10026	beshort	x		\b%04x-
2292>0x10028	beshort	x		\b%04x-
2293>0x1002a	beshort	x		\b%04x
2294>0x1002c	belong	x		\b%08x,
2295>0x10078	lequad	x		%lld/
2296>0x10070	lequad	x		\b%lld bytes used,
2297>0x10088	lequad	x		%lld devices
2298
2299# dvdisaster's .ecc
2300# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
23010	string	*dvdisaster*	dvdisaster error correction file
2302
2303# xfs metadump image
2304# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
2305# but can we do the << ?  For now it's always 512 (0x200) anyway.
23060	string XFSM
2307>0x200	string XFSB	XFS filesystem metadump image
2308
2309# Type:	CROM filesystem
2310# From:	Werner Fink <werner@suse.de>
23110	string	CROMFS	CROMFS
2312>6	string	>\0	\b version %2.2s,
2313>8	ulequad	>0	\b block data at %lld,
2314>16	ulequad	>0	\b fblock table at %lld,
2315>24	ulequad	>0	\b inode table at %lld,
2316>32	ulequad	>0	\b root at %lld,
2317>40	ulelong	>0	\b fblock size = %d,
2318>44	ulelong	>0	\b block size = %d,
2319>48	ulequad	>0	\b bytes = %lld
2320
2321# Type:	xfs metadump image
2322# From:	Daniel Novotny <dnovotny@redhat.com>
2323# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
2324# but can we do the << ? For now it's always 512 (0x200) anyway.
23250	string	XFSM
2326>0x200	string	XFSB	XFS filesystem metadump image
2327
2328# Type:	delta ISO
2329# From:	Daniel Novotny <dnovotny@redhat.com>
23300	string	DISO	Delta ISO data,
2331>4	belong	x	version %d
2332
2333# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
2334# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
2335# From: Adam Buchbinder <adam.buchbinder@gmail.com>
23360x8000	string	JFS1
2337# Because it's text-only magic, check a binary value (version) to be sure.
2338# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
2339# mountable.
2340>&0	lelong	<3	JFS2 filesystem image
2341# Label is followed by a UUID; we have to limit string length to avoid
2342# appending the UUID in the case of a 16-byte label.
2343>>&144	regex	[\x20-\x7E]{1,16}	(label "%s")
2344>>&0	lequad	x	\b, %lld blocks
2345>>&8	lelong	x	\b, blocksize %d
2346>>&32	lelong&0x00000006	>0	(dirty)
2347>>&36	lelong	>0	(compressed)
2348
2349# LFS
23500	lelong	0x070162	LFS filesystem image
2351>4	lelong	1		version 1,
2352>>8	lelong	x		\b blocks %u,
2353>>12	lelong	x		\b blocks per segment %u,
2354>4	lelong	2		version 2,
2355>>8	lelong	x		\b fragments %u,
2356>>12	lelong	x		\b bytes per segment %u,
2357>16	lelong	x		\b disk blocks %u,
2358>20	lelong	x		\b block size %u,
2359>24	lelong	x		\b fragment size %u,
2360>28	lelong	x		\b fragments per block %u,
2361>32	lelong	x		\b start for free list %u,
2362>36	lelong	x		\b number of free blocks %d,
2363>40	lelong	x		\b number of files %u,
2364>44	lelong	x		\b blocks available for writing %d,
2365>48	lelong	x		\b inodes in cache %d,
2366>52	lelong	x		\b inode file disk address 0x%x,
2367>56	lelong	x		\b inode file inode number %u,
2368>60	lelong	x		\b address of last segment written 0x%x,
2369>64	lelong	x		\b address of next segment to write 0x%x,
2370>68	lelong	x		\b address of current segment written 0x%x
2371
23720	string	td\000		floppy image data (TeleDisk, compressed)
23730	string	TD\000		floppy image data (TeleDisk)
2374
23750	string	CQ\024		floppy image data (CopyQM,
2376>16	leshort	x		%d sectors,
2377>18	leshort	x		%d heads.)
2378
23790	string	ACT\020Apricot\020disk\020image\032\004	floppy image data (ApriDisk)
2380
23810	beshort	0xAA58		floppy image data (IBM SaveDskF, old)
23820	beshort	0xAA59		floppy image data (IBM SaveDskF)
23830	beshort	0xAA5A		floppy image data (IBM SaveDskF, compressed)
2384
23850	string	\074CPM_Disk\076	disk image data (YAZE)
2386
2387# ReFS
2388# Richard W.M. Jones <rjones@redhat.com>
23890	string	\0\0\0ReFS\0	ReFS filesystem image
2390
2391# EFW encase image file format:
2392# Gregoire Passault
2393# http://www.forensicswiki.org/wiki/Encase_image_file_format
23940	string	EVF\x09\x0d\x0a\xff\x00	EWF/Expert Witness/EnCase image file format
2395
2396# UBIfs
2397# Linux kernel sources: fs/ubifs/ubifs-media.h
23980	lelong	0x06101831
2399>0x16	leshort	0		UBIfs image
2400>0x08	lequad	x		\b, sequence number %llu
2401>0x10	leshort x		\b, length %u
2402>0x04	lelong	x		\b, CRC 0x%08x
2403
24040	lelong	0x23494255
2405>0x04	leshort	<2
2406>0x05	string	\0\0\0
2407>0x1c	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
2408>0x04	leshort	x		UBI image, version %u
2409
2410# NEC PC-88 2D disk image
2411# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
24120x20		ulelong&0xFFFFFEFF	0x2A0
2413>0x10		string			\0\0\0\0\0\0\0\0\0\0
2414>>0x280		string			\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
2415>>>0x1A		ubyte&0xEF		0
2416>>>>0x1B	ubyte&0x8F		0
2417>>>>>0x1B	ubyte&70		<0x40
2418>>>>>>0x1C	ulelong			>0x21
2419>>>>>>>0	regex	[[:print:]]*	NEC PC-88 disk image, name=%s
2420>>>>>>>>0x1B	ubyte	0		\b, media=2D
2421>>>>>>>>0x1B	ubyte	0x10		\b, media=2DD
2422>>>>>>>>0x1B	ubyte	0x20		\b, media=2HD
2423>>>>>>>>0x1B	ubyte	0x30		\b, media=1D
2424>>>>>>>>0x1B	ubyte	0x40		\b, media=1DD
2425>>>>>>>>0x1A	ubyte	0x10		\b, write-protected
2426
2427# HDD Raw Copy Tool disk image, file extension: .imgc
2428# From Benjamin Vanheuverzwijn <bvanheu@gmail.com>
24290	pstring	HDD\ Raw\ Copy\ Tool	%s
2430>0x100	pstring	x			%s
2431>0x200	pstring	x			- HD model: %s
2432#>0x300	pstring	x			unknown %s
2433>0x400	pstring	x			serial: %s
2434#>0x500	pstring	x			unknown: %s
2435!:ext	imgc
2436