1 2#------------------------------------------------------------------------------ 3# $File: msdos,v 1.134 2019/10/18 15:16:18 christos Exp $ 4# msdos: file(1) magic for MS-DOS files 5# 6 7# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 8# updated by Joerg Jenderek at Oct 2008,Apr 2011 90 string/t @ 10>1 string/cW \ echo\ off DOS batch file text 11!:mime text/x-msdos-batch 12!:ext bat 13>1 string/cW echo\ off DOS batch file text 14!:mime text/x-msdos-batch 15!:ext bat 16>1 string/cW rem DOS batch file text 17!:mime text/x-msdos-batch 18!:ext bat 19>1 string/cW set\ DOS batch file text 20!:mime text/x-msdos-batch 21!:ext bat 22 23 24# OS/2 batch files are REXX. the second regex is a bit generic, oh well 25# the matched commands seem to be common in REXX and uncommon elsewhere 26100 search/0xffff rxfuncadd 27>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 28100 search/0xffff say 29>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 30 31# updated by Joerg Jenderek at Oct 2015 32# https://de.wikipedia.org/wiki/Common_Object_File_Format 33# http://www.delorie.com/djgpp/doc/coff/filhdr.html 34# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable" 35#0 leshort 0x14c MS Windows COFF Intel 80386 object file 36#>4 ledate x stamp %s 370 leshort 0x166 MS Windows COFF MIPS R4000 object file 38#>4 ledate x stamp %s 390 leshort 0x184 MS Windows COFF Alpha object file 40#>4 ledate x stamp %s 410 leshort 0x268 MS Windows COFF Motorola 68000 object file 42#>4 ledate x stamp %s 430 leshort 0x1f0 MS Windows COFF PowerPC object file 44#>4 ledate x stamp %s 450 leshort 0x290 MS Windows COFF PA-RISC object file 46#>4 ledate x stamp %s 47 48# Tests for various EXE types. 49# 50# Many of the compressed formats were extraced from IDARC 1.23 source code. 51# 520 string/b MZ 53# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 54>0x18 leshort <0x40 MS-DOS executable 55!:mime application/x-dosexec 56# Windows and later versions of DOS will allow .EXEs to be named with a .COM 57# extension, mostly for compatibility's sake. 58!:ext exe/com 59# These traditional tests usually work but not always. When test quality support is 60# implemented these can be turned on. 61#>>0x18 leshort 0x1c (Borland compiler) 62#>>0x18 leshort 0x1e (MS compiler) 63 64# Maybe it's a PE? 65>(0x3c.l) string PE\0\0 PE 66!:mime application/x-dosexec 67>>(0x3c.l+24) leshort 0x010b \b32 executable 68>>(0x3c.l+24) leshort 0x020b \b32+ executable 69>>(0x3c.l+24) leshort 0x0107 ROM image 70>>(0x3c.l+24) default x Unknown PE signature 71>>>&0 leshort x 0x%x 72>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 73>>(0x3c.l+92) leshort 1 74# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the 75# drivers in Windows/System32/drivers/*.sys. 76>>>(0x3c.l+22) leshort&0x2000 >0 (native) 77!:ext dll/sys 78>>>(0x3c.l+22) leshort&0x2000 0 (native) 79!:ext exe/sys 80>>(0x3c.l+92) leshort 2 81>>>(0x3c.l+22) leshort&0x2000 >0 (GUI) 82# These could probably be at least partially distinguished from one another by 83# looking for specific exported functions. 84# CPL: Control Panel item 85# TLB: Type library 86# OCX: OLE/ActiveX control 87# ACM: Audio compression manager codec 88# AX: DirectShow source filter 89# IME: Input method editor 90!:ext dll/cpl/tlb/ocx/acm/ax/ime 91>>>(0x3c.l+22) leshort&0x2000 0 (GUI) 92# Screen savers typically include code from the scrnsave.lib static library, but 93# that's not guaranteed. 94!:ext exe/scr 95>>(0x3c.l+92) leshort 3 96>>>(0x3c.l+22) leshort&0x2000 >0 (console) 97!:ext dll/cpl/tlb/ocx/acm/ax/ime 98>>>(0x3c.l+22) leshort&0x2000 0 (console) 99!:ext exe/com 100# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format 101>>(0x3c.l+92) leshort 7 (POSIX) 102>>(0x3c.l+92) leshort 9 (Windows CE) 103>>(0x3c.l+92) leshort 10 (EFI application) 104>>(0x3c.l+92) leshort 11 (EFI boot service driver) 105>>(0x3c.l+92) leshort 12 (EFI runtime driver) 106>>(0x3c.l+92) leshort 13 (EFI ROM) 107>>(0x3c.l+92) leshort 14 (XBOX) 108>>(0x3c.l+92) leshort 15 (Windows boot application) 109>>(0x3c.l+92) default x (Unknown subsystem 110>>>&0 leshort x 0x%x) 111>>(0x3c.l+4) leshort 0x14c Intel 80386 112>>(0x3c.l+4) leshort 0x166 MIPS R4000 113>>(0x3c.l+4) leshort 0x168 MIPS R10000 114>>(0x3c.l+4) leshort 0x184 Alpha 115>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 116>>(0x3c.l+4) leshort 0x1a3 Hitachi SH3 DSP 117>>(0x3c.l+4) leshort 0x1a8 Hitachi SH5 118>>(0x3c.l+4) leshort 0x169 MIPS WCE v2 119>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 120>>(0x3c.l+4) leshort 0x1c0 ARM 121>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 122>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 123>>(0x3c.l+4) leshort 0x1d3 Matsushita AM33 124>>(0x3c.l+4) leshort 0x1f0 PowerPC 125>>(0x3c.l+4) leshort 0x1f1 PowerPC with FPU 126>>(0x3c.l+4) leshort 0x200 Intel Itanium 127>>(0x3c.l+4) leshort 0x266 MIPS16 128>>(0x3c.l+4) leshort 0x268 Motorola 68000 129>>(0x3c.l+4) leshort 0x290 PA-RISC 130>>(0x3c.l+4) leshort 0x366 MIPSIV 131>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 132>>(0x3c.l+4) leshort 0xebc EFI byte code 133>>(0x3c.l+4) leshort 0x5032 RISC-V 32-bit 134>>(0x3c.l+4) leshort 0x5064 RISC-V 64-bit 135>>(0x3c.l+4) leshort 0x5128 RISC-V 128-bit 136>>(0x3c.l+4) leshort 0x9041 Mitsubishi M32R 137>>(0x3c.l+4) leshort 0x8664 x86-64 138>>(0x3c.l+4) leshort 0xaa64 Aarch64 139>>(0x3c.l+4) leshort 0xc0ee MSIL 140>>(0x3c.l+4) default x Unknown processor type 141>>>&0 leshort x 0x%x 142>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 143>>(0x3c.l+22) leshort&0x1000 >0 system file 144>>(0x3c.l+24) leshort 0x010b 145>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 146>>(0x3c.l+24) leshort 0x020b 147>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 148 149# hooray, there's a DOS extender using the PE format, with a valid PE 150# executable inside (which just prints a message and exits if run in win) 151>>(8.s*16) string 32STUB \b, 32rtm DOS extender 152>>(8.s*16) string !32STUB \b, for MS Windows 153>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 154>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 155>>(0x3c.l+0xf8) search/0x140 UPX2 156>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 157>>(0x3c.l+0xf8) search/0x140 .idata 158>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 159>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 160>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 161>>(0x3c.l+0xf8) search/0x140 .rsrc 162>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 163>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 164>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 165>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 166>>(0x3c.l+0xf8) search/0x140 .data 167>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 168>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 169>>>(0x3c.l+0xf7) byte x 170>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 171>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 172>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 173>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 174>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 175>>0x30 string Inno \b, InnoSetup self-extracting archive 176 177# If the relocation table is 0x40 or more bytes into the file, it's definitely 178# not a DOS EXE. 179>0x18 leshort >0x3f 180 181# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 182# must be one of the unusual subformats. 183>>(0x3c.l) string !PE\0\0 MS-DOS executable 184!:mime application/x-dosexec 185 186>>(0x3c.l) string NE \b, NE 187!:mime application/x-dosexec 188>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 189>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 190>>>(0x3c.l+0x36) byte 3 for MS-DOS 191>>>(0x3c.l+0x36) byte 4 for Windows 386 192>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 193>>>(0x3c.l+0x36) default x 194>>>>(0x3c.l+0x36) byte x (unknown OS %x) 195>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 196>>>(0x3c.l+0x0c) leshort&0x8000 0x8000 (DLL or font) 197# DRV: Driver 198# 3GR: Grabber device driver 199# CPL: Control Panel Item 200# VBX: Visual Basic Extension 201# FON: Bitmap font 202# FOT: Font resource file 203!:ext dll/drv/3gr/cpl/vbx/fon/fot 204>>>(0x3c.l+0x0c) leshort&0x8000 0 (EXE) 205!:ext exe/scr 206>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 207>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 208 209>>(0x3c.l) string LX\0\0 \b, LX 210!:mime application/x-dosexec 211>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 212>>>(0x3c.l+0x0a) leshort 1 for OS/2 213>>>(0x3c.l+0x0a) leshort 2 for MS Windows 214>>>(0x3c.l+0x0a) leshort 3 for DOS 215>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 216>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 217>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 218>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 219>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 220>>>(0x3c.l+0x08) leshort 1 i80286 221>>>(0x3c.l+0x08) leshort 2 i80386 222>>>(0x3c.l+0x08) leshort 3 i80486 223>>>(8.s*16) string emx \b, emx 224>>>>&1 string x %s 225>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 226 227# MS Windows system file, supposedly a collection of LE executables 228>>(0x3c.l) string W3 \b, W3 for MS Windows 229!:mime application/x-dosexec 230 231>>(0x3c.l) string LE\0\0 \b, LE executable 232!:mime application/x-dosexec 233>>>(0x3c.l+0x0a) leshort 1 234# some DOS extenders use LE files with OS/2 header 235>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 236>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 237>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 238>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 239>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 240>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 241>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 242# this is a wild guess; hopefully it is a specific signature 243>>>>&0x24 lelong <0x50 244>>>>>(&0x4c.l) string \xfc\xb8WATCOM 245>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 246# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 247#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 248# fails with DOS-Extenders. 249>>>(0x3c.l+0x0a) leshort 2 for MS Windows 250>>>(0x3c.l+0x0a) leshort 3 for DOS 251>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 252# VXD: VxD for Windows 95/98/Me 253# 386: VxD for Windows 2.10, 3.0, 3.1x 254# PDR: Port driver 255# MPD: Miniport driver (?) 256!:ext vxd/386/pdr/mpd 257>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 258>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 259 260# looks like ASCII, probably some embedded copyright message. 261# and definitely not NE/LE/LX/PE 262>>0x3c lelong >0x20000000 263>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 264!:mime application/x-dosexec 265!:ext exe/com 266# header data too small for extended executable 267>2 long !0 268>>0x18 leshort <0x40 269>>>(4.s*512) leshort !0x014c 270 271>>>>&(2.s-514) string !LE 272>>>>>&-2 string !BW \b, MZ for MS-DOS 273!:mime application/x-dosexec 274>>>>&(2.s-514) string LE \b, LE 275>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 276# educated guess since indirection is still not capable enough for complex offset 277# calculations (next embedded executable would be at &(&2*512+&0-2) 278# I suspect there are only LE executables in these multi-exe files 279>>>>&(2.s-514) string BW 280>>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded) 281>>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS 282 283# This sequence skips to the first COFF segment, usually .text 284>(4.s*512) leshort 0x014c \b, COFF 285!:mime application/x-dosexec 286>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 287>>(8.s*16) string emx 288>>>&1 string x for DOS, Win or OS/2, emx %s 289>>&(&0x42.l-3) byte x 290>>>&0x26 string UPX \b, UPX compressed 291# and yet another guess: small .text, and after large .data is unusal, could be 32lite 292>>&0x2c search/0xa0 .text 293>>>&0x0b lelong <0x2000 294>>>>&0 lelong >0x6000 \b, 32lite compressed 295 296>(8.s*16) string $WdX \b, WDos/X DOS extender 297 298# By now an executable type should have been printed out. The executable 299# may be a self-uncompressing archive, so look for evidence of that and 300# print it out. 301# 302# Some signatures below from Greg Roelofs, newt@uchicago.edu. 303# 304>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 305>0xe7 string LH/2\ Self-Extract \b, %s 306>0x1c string UC2X \b, UCEXE compressed 307>0x1c string WWP\ \b, WWPACK compressed 308>0x1c string RJSX \b, ARJ self-extracting archive 309>0x1c string diet \b, diet compressed 310>0x1c string LZ09 \b, LZEXE v0.90 compressed 311>0x1c string LZ91 \b, LZEXE v0.91 compressed 312>0x1c string tz \b, TinyProg compressed 313>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 314!:mime application/zip 315# Yes, this really is "Copr", not "Corp." 316>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 317!:mime application/zip 318# winarj stores a message in the stub instead of the sig in the MZ header 319>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 320>0x20 string AIN 321>>0x23 string 2 \b, AIN 2.x compressed 322>>0x23 string <2 \b, AIN 1.x compressed 323>>0x23 string >2 \b, AIN 1.x compressed 324>0x24 string LHa's\ SFX \b, LHa self-extracting archive 325!:mime application/x-lha 326>0x24 string LHA's\ SFX \b, LHa self-extracting archive 327!:mime application/x-lha 328>0x24 string \ $ARX \b, ARX self-extracting archive 329>0x24 string \ $LHarc \b, LHarc self-extracting archive 330>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 331>0x40 string aPKG \b, aPackage self-extracting archive 332>0x64 string W\ Collis\0\0 \b, Compack compressed 333>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 334>>&0xf4 search/0x140 \x0\x40\x1\x0 335>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 336>1638 string -lh5- \b, LHa self-extracting archive v2.13S 337>0x17888 string Rar! \b, RAR self-extracting archive 338 339# Skip to the end of the EXE. This will usually work fine in the PE case 340# because the MZ image is hardcoded into the toolchain and almost certainly 341# won't match any of these signatures. 342>(4.s*512) long x 343>>&(2.s-517) byte x 344>>>&0 string PK\3\4 \b, ZIP self-extracting archive 345>>>&0 string Rar! \b, RAR self-extracting archive 346>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 347>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 348>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 349>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 350>>>&7 search/400 **ACE** \b, ACE self-extracting archive 351>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 352 353# a few unknown ZIP sfxes, no idea if they are needed or if they are 354# already captured by the generic patterns above 355>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 356# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 357# 358 359# TELVOX Teleinformatica CODEC self-extractor for OS/2: 360>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 361>>49824 leshort =1 \b, 1 file 362>>49824 leshort >1 \b, %u files 363 364# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc 365# and https://www.freedos.org/software/?prog=kpdos 366# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 3670 string/b KCF FreeDOS KEYBoard Layout collection 368# only version=0x100 found 369>3 uleshort x \b, version 0x%x 370# length of string containing author,info and special characters 371>6 ubyte >0 372#>>6 pstring x \b, name=%s 373>>7 string >\0 \b, author=%-.14s 374>>7 search/254 \xff \b, info= 375#>>>&0 string x \b%-s 376>>>&0 string x \b%-.15s 377# for FreeDOS *.KL files 3780 string/b KLF FreeDOS KEYBoard Layout file 379# only version=0x100 or 0x101 found 380>3 uleshort x \b, version 0x%x 381# stringlength 382>5 ubyte >0 383>>8 string x \b, name=%-.2s 3840 string \xffKEYB\ \ \ \0\0\0\0 385>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 386 387# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017 388# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 3890 ulequad&0x07a0ffffffff 0xffffffff 390>0 use msdos-driver 3910 name msdos-driver DOS executable ( 392#!:mime application/octet-stream 393!:mime application/x-dosdriver 394# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN 395!:ext sys/dev/bin 396>40 search/7 UPX! \bUPX compressed 397# DOS device driver attributes 398>4 uleshort&0x8000 0x0000 \bblock device driver 399# character device 400>4 uleshort&0x8000 0x8000 \b 401>>4 uleshort&0x0008 0x0008 \bclock 402# fast video output by int 29h 403>>4 uleshort&0x0010 0x0010 \bfast 404# standard input/output device 405>>4 uleshort&0x0003 >0 \bstandard 406>>>4 uleshort&0x0001 0x0001 \binput 407>>>4 uleshort&0x0003 0x0003 \b/ 408>>>4 uleshort&0x0002 0x0002 \boutput 409>>4 uleshort&0x8000 0x8000 \bcharacter device driver 410>0 ubyte x 411# upx compressed device driver has garbage instead of real in name field of header 412>>40 search/7 UPX! 413>>40 default x 414# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 415>>>12 ubyte >0x2E \b 416>>>>10 ubyte >0x20 417>>>>>10 ubyte !0x2E 418>>>>>>10 ubyte !0x2A \b%c 419>>>>11 ubyte >0x20 420>>>>>11 ubyte !0x2E \b%c 421>>>>12 ubyte >0x20 422>>>>>12 ubyte !0x39 423>>>>>>12 ubyte !0x2E \b%c 424>>>13 ubyte >0x20 425>>>>13 ubyte !0x2E \b%c 426>>>>14 ubyte >0x20 427>>>>>14 ubyte !0x2E \b%c 428>>>>15 ubyte >0x20 429>>>>>15 ubyte !0x2E \b%c 430>>>>16 ubyte >0x20 431>>>>>16 ubyte !0x2E 432>>>>>>16 ubyte <0xCB \b%c 433>>>>17 ubyte >0x20 434>>>>>17 ubyte !0x2E 435>>>>>>17 ubyte <0x90 \b%c 436# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 437>>>12 ubyte <0x2F 438# they have their real name at offset 22 439# also block device drivers like DUMBDRV.SYS 440>>>>22 string >\056 %-.6s 441>4 uleshort&0x8000 0x0000 442# 32 bit sector addressing ( > 32 MB) for block devices 443>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 444# support by driver functions 13h, 17h, 18h 445>4 uleshort&0x0040 0x0040 \b,IOCTL- 446# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 447>4 uleshort&0x0800 0x0800 \b,close media- 448# output until busy support by int 10h for character device driver 449>4 uleshort&0x8000 0x8000 450>>4 uleshort&0x2000 0x2000 \b,until busy- 451# direct read/write support by driver functions 03h,0Ch 452>4 uleshort&0x4000 0x4000 \b,control strings- 453>4 uleshort&0x8000 0x8000 454>>4 uleshort&0x6840 >0 \bsupport 455>4 uleshort&0x8000 0x0000 456>>4 uleshort&0x4842 >0 \bsupport 457>0 ubyte x \b) 458# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 4590 ulequad 0x0513c00000000012 460>0 use msdos-driver 461# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field 4620 ulequad 0x32f28000ffff0016 463>0 use msdos-driver 4640 ulequad 0x007f00000000ffff 465>0 use msdos-driver 4660 ulequad 0x001600000000ffff 467>0 use msdos-driver 468# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field 4690 ulequad 0x0bf708c2ffffffff 470>0 use msdos-driver 4710 ulequad 0x07bd08c2ffffffff 472>0 use msdos-driver 473 474# updated by Joerg Jenderek 475# GRR: line below too general as it catches also 476# rt.lib DYADISKS.PIC and many more 477# start with assembler instruction MOV 4780 ubyte 0x8c 479# skip "AppleWorks word processor data" like ARTICLE.1 ./apple 480>4 string !O==== 481# skip some unknown basic binaries like RocketRnger.SHR 482>>5 string !MAIN 483# skip "GPG symmetrically encrypted data" ./gnu 484# skip "PGP symmetric key encrypted data" ./pgp 485# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type 486>>>4 ubyte >13 DOS executable (COM, 0x8C-variant) 487# the remaining files should be DOS *.COM executables 488# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd 489# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4 490# UNDELETE.COM 8cca 2e8916 6503 b430 cd21 8b 2e0200 8b 491# BOOTFIX.COM 8cca 2e8916 9603 b430 cd21 8b 2e0200 8b 492# RAWRITE3.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 493# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 494# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e 495# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e 496!:mime application/x-dosexec 497!:ext com 498 499# updated by Joerg Jenderek at Oct 2008 5000 ulelong 0xffff10eb DR-DOS executable (COM) 501# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 5020 ubeshort&0xeb8d >0xeb00 503# DR-DOS STACKER.COM SCREATE.SYS missed 504 5050 name msdos-com 506>0 byte x DOS executable (COM) 507!:mime application/x-dosexec 508!:ext com 509>6 string SFX\ of\ LHarc \b, %s 510>0x1FE leshort 0xAA55 \b, boot code 511>85 string UPX \b, UPX compressed 512>4 string \ $ARX \b, ARX self-extracting archive 513>4 string \ $LHarc \b, LHarc self-extracting archive 514>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 515 516# JMP 8bit 5170 byte 0xeb 518# allow forward jumps only 519>1 byte >-1 520# that offset must be accessible 521>>(1.b+2) byte x 522>>>0 use msdos-com 523 524# JMP 16bit 5250 byte 0xe9 526# forward jumps 527>1 short >-1 528# that offset must be accessible 529>>(1.s+3) byte x 530>>>0 use msdos-com 531# negative offset, must not lead into PSP 532>1 short <-259 533# that offset must be accessible 534>>(1,s+65539) byte x 535>>>0 use msdos-com 536 537# updated by Joerg Jenderek at Oct 2008,2015 538# following line is too general 5390 ubyte 0xb8 540# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux 541>0 string !\xb8\xc0\x07\x8e 542# modified by Joerg Jenderek 543# syslinux COM32 or COM32R executable 544>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT 545# https://www.syslinux.org/wiki/index.php/Comboot_API 546# Since version 5.00 c32 modules switched from the COM32 object format to ELF 547!:mime application/x-c32-comboot-syslinux-exec 548!:ext c32 549# https://syslinux.zytor.com/comboot.php 550# older syslinux version ( <4 ) 551# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 552# start with assembler instructions mov eax,21cd4cffh 553>>>1 lelong 0x21CD4CFf \b) 554# syslinux:doc/comboot.txt 555# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 556# eax,21cd4cfeh) as a magic number. 557# syslinux version (4.x) 558# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID 559>>>1 lelong 0x21CD4CFe \b, relocatable) 560# remaining are DOS COM executables starting with assembler instruction MOV 561# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM 562# MS-DOS SYS.COM RESTART.COM 563# SYSLINUX.COM (version 1.40 - 2.13) 564# GFXBOOT.COM (version 3.75) 565# COPYBS.COM POWEROFF.COM INT18.COM 566>>1 default x COM executable for DOS 567!:mime application/x-dosexec 568#!:mime application/x-ms-dos-executable 569#!:mime application/x-msdos-program 570!:ext com 571 5720 string/b \x81\xfc 573>4 string \x77\x02\xcd\x20\xb9 574>>36 string UPX! FREE-DOS executable (COM), UPX compressed 575!:mime application/x-dosexec 576!:ext com 577252 string Must\ have\ DOS\ version DR-DOS executable (COM) 578!:mime application/x-dosexec 579!:ext com 580# added by Joerg Jenderek at Oct 2008 581# GRR search is not working 582#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed 58334 string UPX! FREE-DOS executable (COM), UPX compressed 584!:mime application/x-dosexec 585!:ext com 58635 string UPX! FREE-DOS executable (COM), UPX compressed 587!:mime application/x-dosexec 588!:ext com 589# GRR search is not working 590#2 search/28 \xcd\x21 COM executable for MS-DOS 591#WHICHFAT.cOM 5922 string \xcd\x21 COM executable for DOS 593!:mime application/x-dosexec 594!:ext com 595#DELTREE.cOM DELTREE2.cOM 5964 string \xcd\x21 COM executable for DOS 597!:mime application/x-dosexec 598!:ext com 599#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 6005 string \xcd\x21 COM executable for DOS 601!:mime application/x-dosexec 602!:ext com 603#DELTMP.COm HASFAT32.cOM 6047 string \xcd\x21 605>0 byte !0xb8 COM executable for DOS 606!:mime application/x-dosexec 607!:ext com 608#COMP.cOM MORE.COm 60910 string \xcd\x21 610>5 string !\xcd\x21 COM executable for DOS 611!:mime application/x-dosexec 612!:ext com 613#comecho.com 61413 string \xcd\x21 COM executable for DOS 615!:mime application/x-dosexec 616!:ext com 617#HELP.COm EDIT.coM 61818 string \xcd\x21 COM executable for MS-DOS 619!:mime application/x-dosexec 620!:ext com 621#NWRPLTRM.COm 62223 string \xcd\x21 COM executable for MS-DOS 623!:mime application/x-dosexec 624!:ext com 625#LOADFIX.cOm LOADFIX.cOm 62630 string \xcd\x21 COM executable for MS-DOS 627!:mime application/x-dosexec 628!:ext com 629#syslinux.com 3.11 63070 string \xcd\x21 COM executable for DOS 631!:mime application/x-dosexec 632!:ext com 633# many compressed/converted COMs start with a copy loop instead of a jump 6340x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 635!:mime application/x-dosexec 636!:ext com 6370x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 638!:mime application/x-dosexec 639!:ext com 640>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 6410x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 642!:mime application/x-dosexec 643!:ext com 644# FIXME: missing diet .com compression 645 646# miscellaneous formats 6470 string/b LZ MS-DOS executable (built-in) 648#0 byte 0xf0 MS-DOS program library data 649# 650 651# AAF files: 652# <stuartc@rd.bbc.co.uk> Stuart Cunningham 6530 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 654>30 byte 9 (512B sectors) 655>30 byte 12 (4kB sectors) 6560 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 657>30 byte 9 (512B sectors) 658>30 byte 12 (4kB sectors) 659 660# Popular applications 661# 662# Update: Joerg Jenderek 663# URL: http://fileformats.archiveteam.org/wiki/DOC 664# Reference: https://web.archive.org/web/20170206041048/ 665# http://www.msxnet.org/word2rtf/formats/ffh-dosword5 666# wIdent+dty 6670 belong 0x31be0000 668# skip droid skeleton like x-fmt-274-signature-id-488.doc 669>128 ubyte >0 Microsoft 670>>96 uleshort =0 Word 671!:mime application/msword 672!:apple MSWDWDBN 673# DCX is used in the Unix version. 674!:ext doc/dcx 675>>>0x6E ulequad =0 1.0-4.0 676>>>0x6E ulequad !0 5.0-6.0 677>>>0x6E ulequad x (DOS) Document 678# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt 679>>96 uleshort !0 Write 3.0 (Windows) Document 680!:mime application/x-mswrite 681!:apple MSWDWDBN 682# sometimes also doc like in splitter.doc srchtest.doc 683!:ext wri/doc 684# wTool must be 0125400 octal 685#>>4 uleshort !0xAB00 \b, wTool %o 686# reserved; must be zero 687#>>6 ulelong !0 \b, reserved %u 688# block pointer to the block containing optional file manager information 689#>>0x1C uleshort x \b, at 0x%x info block 690# jump to File manager information block 691>>(0x1C.s*128) uleshort x 692# test for valid information start; maybe also 0012h 693>>>&-2 uleshort =0x0014 694# Document ASCIIZ name 695>>>>&0x12 string x %s 696# author name 697>>>>>&1 string x \b, author %s 698# reviser name 699>>>>>>&1 string x \b, reviser %s 700# keywords 701>>>>>>>&1 string x \b, keywords %s 702# comment 703>>>>>>>>&1 string x \b, comment %s 704# version number 705>>>>>>>>>&1 string x \b, version %s 706# date of last change MM/DD/YY 707>>>>>>>>>>&1 string x \b, %-.8s 708# creation date MM/DD/YY 709>>>>>>>>>>&9 string x created %-.8s 710# file name of print format like NORMAL.STY 711>>0x1E string >0 \b, formatted by %-.66s 712# count of pages in whole file for write variant; maybe some times wrong 713>>96 uleshort >0 \b, %u pages 714# name of the printer driver like HPLASMS 715>>0x62 string >0 \b, %-.8s printer 716# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0 717>>0x6A uleshort >0 \b, %u blocks 718# bit field for corrected text areas 719#>>0x6C uleshort x \b, 0x%x bit field 720# text of document; some times start with 4 non printable characters like CR LF 721>>128 ubyte x \b, 722>>>128 ubyte >0x1F 723>>>>128 string x %s 724>>>128 ubyte <0x20 725>>>>129 ubyte >0x1F 726>>>>>129 string x %s 727>>>>129 ubyte <0x20 728>>>>>130 ubyte >0x1F 729>>>>>>130 string x %s 730>>>>>130 ubyte <0x20 731>>>>>>131 ubyte >0x1F 732>>>>>>>131 string x %s 733>>>>>>131 ubyte <0x20 734>>>>>>>132 ubyte >0x1F 735>>>>>>>>132 string x %s 736>>>>>>>132 ubyte <0x20 737>>>>>>>>133 ubyte >0x1F 738>>>>>>>>>133 string x %s 739# 7400 string/b PO^Q` Microsoft Word 6.0 Document 741!:mime application/msword 742# 7434 long 0 744>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0 745!:mime application/msword 746!:ext mcw 747>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0 748!:mime application/msword 749!:ext mcw 750>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0 751!:mime application/msword 752!:ext mcw 753>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0 754!:mime application/msword 755!:ext mcw 756 7570 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document 758!:mime application/msword 759!:ext doc 760# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs 761#512 string/b \354\245\301 Microsoft Word Document 762#!:mime application/msword 763 764# 7650 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 766!:mime application/msword 767# 7680 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 769!:mime application/msword 770 771# 7720 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 773!:mime application/vnd.ms-excel 774# https://www.macdisk.com/macsigen.php 775!:apple XCELXLS4 776!:ext xls 777# 778# Update: Joerg Jenderek 779# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3 780# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf 781# Note: newer Lotus versions >2 use longer BOF record 782# record type (BeginningOfFile=0000h) + length (001Ah) 7830 belong 0x00001a00 784# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3 785#>18 uleshort&0x73E0 0 786# Lotus Multi Byte Character Set (LMBCS=1-31) 787>20 ubyte >0 788>>20 ubyte <32 Lotus 1-2-3 789#!:mime application/x-123 790!:mime application/vnd.lotus-1-2-3 791!:apple ????L123 792# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data" 793>>>4 uleshort 0x1000 WorKsheet, version 3 794!:ext wk3 795# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data" 796>>>4 uleshort 0x1002 WorKsheet, version 4 797# also worksheet template 4 (.wt4) 798!:ext wk4/wt4 799# no example or documentation for wk5 800#>>4 uleshort 0x???? WorKsheet, version 4 801#!:ext wk5 802# only MacrotoScript.123 example 803>>>4 uleshort 0x1003 WorKsheet, version 97 804# also worksheet template Smartmaster (.12M)? 805!:ext 123 806# only Set_Y2K.123 example 807>>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium 808!:ext 123 809# no example for this version 810>>>4 uleshort 0x8001 FoRMatting data 811!:ext frm 812# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data" 813# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet" 814>>>4 uleshort 0x8007 ForMatting data, version 3 815!:ext fm3 816>>>4 default x unknown 817# file revision sub code 0004h for worksheets 818>>>>6 uleshort =0x0004 worksheet 819!:ext wXX 820>>>>6 uleshort !0x0004 formatting data 821!:ext fXX 822# main revision number 823>>>>4 uleshort x \b, revision 0x%x 824>>>6 uleshort =0x0004 \b, cell range 825# active cellcoord range (start row, page,column ; end row, page, column) 826# start values normally 0~1st sheet A1 827>>>>8 ulelong !0 828>>>>>10 ubyte >0 \b%d* 829>>>>>8 uleshort x \b%d, 830>>>>>11 ubyte x \b%d- 831# end page mostly 0 832>>>>14 ubyte >0 \b%d* 833# end raw, column normally not 0 834>>>>12 uleshort x \b%d, 835>>>>15 ubyte x \b%d 836# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??) 837>>>>20 ubyte >1 \b, character set 0x%x 838# flags 839>>>>21 ubyte x \b, flags 0x%x 840>>>6 uleshort !0x0004 841# record type (FONTNAME=00AEh) 842>>>>30 search/29 \0\xAE 843# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n) 844>>>>>&4 string >\0 \b, 1st font "%s" 845# 846# Update: Joerg Jenderek 847# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3 848# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT 849# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x 850# record type (BeginningOfFile=0000h) + length (0002h) 8510 belong 0x00000200 852# GRR: line above is too general as it catches also MS Windows CURsor 853# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1) 854!:strength -1 855# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h 856>7 ubyte 0 857# skip Windows cursors with image width 256 and keep Lotus with positiv opcode 858>>6 ubyte >0 Lotus 859# !:mime application/x-123 860!:mime application/vnd.lotus-1-2-3 861!:apple ????L123 862# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...) 863# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3" 864>>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF) 865!:ext cnf 866>>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J 867!:ext cnf 868>>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1 869!:ext cnf 870>>>4 uleshort 0x0802 Symphony CoNFiguration 871!:ext cnf 872>>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2 873!:ext cnf 874>>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4 875!:ext cnf 876>>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x 877!:ext cnf 878>>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x 879!:ext cnf 880# (version 5.26) labeled the entry as "Lotus 123" 881# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 882>>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1 883# extension "wks" also for Microsoft Works document 884!:ext wks 885# (version 5.26) labeled the entry as "Lotus 123" 886# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 887>>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0 888!:ext wrk/wr1 889# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data" 890# TrID labeles the entry as "Lotus 123 Worksheet (V2)" 891>>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2 892# Symphony (.wr1) 893!:ext wk1/wr1 894# no example for this japan version 895>>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ 896!:ext wj1 897# no example or documentation for wk2 898#>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2 899#!:ext wk2 900# undocumented japan version 901>>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J 902!:ext wj3 903# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data" 904>>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x 905# japan version 2.4J (fj3) 906!:ext fmt/fj3 907# no example for this version 908>>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0 909!:ext frm 910# (version 5.26) labeled the entry as "Lotus 1-2-3" 911>>>4 default x unknown worksheet or configuration 912!:ext cnf 913>>>>4 uleshort x \b, revision 0x%x 914# 2nd record for most worksheets describes cells range 915>>>6 use lotus-cells 916# 3nd record for most japan worksheets describes cells range 917>>>(8.s+10) use lotus-cells 918# check and then display Lotus worksheet cells range 9190 name lotus-cells 920# look for type (RANGE=0006h) + length (0008h) at record begin 921>0 ubelong 0x06000800 \b, cell range 922# cell range (start column, row, end column, row) start values normally 0,0~A1 cell 923>>4 ulong !0 924>>>4 uleshort x \b%d, 925>>>6 uleshort x \b%d- 926# end of cell range 927>>8 uleshort x \b%d, 928>>10 uleshort x \b%d 929# EndOfLotus123 9300 string/b WordPro\0 Lotus WordPro 931!:mime application/vnd.lotus-wordpro 9320 string/b WordPro\r\373 Lotus WordPro 933!:mime application/vnd.lotus-wordpro 934 935 936# Summary: Script used by InstallScield to uninstall applications 937# Extension: .isu 938# Submitted by: unknown 939# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 9400 string \x71\xa8\x00\x00\x01\x02 941>12 string Stirling\ Technologies, InstallShield Uninstall Script 942 943# Winamp .avs 944#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 9450 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 946 947# Windows Metafile .WMF 9480 string/b \327\315\306\232 Windows metafile 949!:mime image/wmf 950!:ext wmf 9510 string/b \002\000\011\000 Windows metafile 952!:mime image/wmf 953!:ext wmf 9540 string/b \001\000\011\000 Windows metafile 955!:mime image/wmf 956!:ext wmf 957 958#tz3 files whatever that is (MS Works files) 9590 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 9600 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 9610 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 962 963# PGP sig files .sig 964#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 9650 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 9660 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 9670 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 9680 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 9690 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 9700 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 971 972# windows zips files .dmf 9730 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 974 975# Windows icons 976# Update: Joerg Jenderek 977# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 978# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG 9790 belong 0x00000100 980>9 byte 0 981>>0 byte x 982>>0 use cur-ico-dir 983>9 ubyte 0xff 984>>0 byte x 985>>0 use cur-ico-dir 986# displays number of icons and information for icon or cursor 9870 name cur-ico-dir 988# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with 989# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h 990>18 ulelong &0x00000006 991# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG) 992>>(18.l) ulelong x MS Windows 993>>>0 ubelong 0x00000100 icon resource 994# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon 995!:mime image/vnd.microsoft.icon 996#!:mime image/x-icon 997!:ext ico 998>>>>4 uleshort x - %d icon 999# plural s 1000>>>>4 uleshort >1 \bs 1001# 1st icon 1002>>>>0x06 use ico-entry 1003# 2nd icon 1004>>>>4 uleshort >1 1005>>>>>0x16 use ico-entry 1006>>>0 ubelong 0x00000200 cursor resource 1007#!:mime image/x-cur 1008!:mime image/x-win-bitmap 1009!:ext cur 1010>>>>4 uleshort x - %d icon 1011>>>>4 uleshort >1 \bs 1012# 1st cursor 1013>>>>0x06 use cur-entry 1014#>>>>0x16 use cur-entry 1015# display information of one cursor entry 10160 name cur-entry 1017>0 use cur-ico-entry 1018>4 uleshort x \b, hotspot @%dx 1019>6 uleshort x \b%d 1020# display information of one icon entry 10210 name ico-entry 1022>0 use cur-ico-entry 1023# normally 0 1 but also found 14 1024>4 uleshort >1 \b, %d planes 1025# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256 1026>6 uleshort >1 \b, %d bits/pixel 1027# display shared information of cursor or icon entry 10280 name cur-ico-entry 1029>0 byte =0 \b, 256x 1030>0 byte !0 \b, %dx 1031>1 byte =0 \b256 1032>1 byte !0 \b%d 1033# number of colors in palette 1034>2 ubyte !0 \b, %d colors 1035# reserved 0 FFh 1036#>3 ubyte x \b, reserved %x 1037#>8 ulelong x \b, image size %d 1038# offset of PNG or DIB image 1039#>12 ulelong x \b, offset 0x%x 1040# PNG header (\x89PNG) 1041>(12.l) ubelong =0x89504e47 1042# 1 space char after "with" to get phrase "with PNG image" by magic in ./images 1043>>&-4 indirect x \b with 1044# DIB image 1045>(12.l) ubelong !0x89504e47 1046#>>&-4 use dib-image 1047 1048# Windows non-animated cursors 1049# Update: Joerg Jenderek 1050# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 1051# Note: similar to Windows ICOn. container for BMP ( only DIB part) 1052# GRR: line below is too general as it catches also Lotus 1-2-3 files 10530 belong 0x00000200 1054>9 byte 0 1055>>0 use cur-ico-dir 1056>9 ubyte 0xff 1057>>0 use cur-ico-dir 1058 1059# .chr files 10600 string/b PK\010\010BGI Borland font 1061>4 string >\0 %s 1062# then there is a copyright notice 1063 1064 1065# .bgi files 10660 string/b pk\010\010BGI Borland device 1067>4 string >\0 %s 1068# then there is a copyright notice 1069 1070 1071# Windows Recycle Bin record file (named INFO2) 1072# By Abel Cheung (abelcheung AT gmail dot com) 1073# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 1074# Since Vista uses another structure, INFO2 structure probably won't change 1075# anymore. Detailed analysis in: 1076# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 10770 lelong 0x00000004 1078>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 1079 10800 lelong 0x00000005 1081>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 1082 1083# From Doug Lee via a FreeBSD pr 10849 string GERBILDOC First Choice document 10859 string GERBILDB First Choice database 10869 string GERBILCLIP First Choice database 10870 string GERBIL First Choice device file 10889 string RABBITGRAPH RabbitGraph file 10890 string DCU1 Borland Delphi .DCU file 10900 string =!<spell> MKS Spell hash list (old format) 10910 string =!<spell2> MKS Spell hash list 1092# Too simple - MPi 1093#0 string AH Halo(TM) bitmapped font file 10940 lelong 0x08086b70 TurboC BGI file 10950 lelong 0x08084b50 TurboC Font file 1096 1097# Debian#712046: The magic below identifies "Delphi compiled form data". 1098# An additional source of information is available at: 1099# http://www.woodmann.com/fravia/dafix_t1.htm 11000 string TPF0 1101>4 pstring >\0 Delphi compiled form '%s' 1102 1103# tests for DBase files moved, updated and merged to database 1104 11050 string PMCC Windows 3.x .GRP file 11061 string RDC-meg MegaDots 1107>8 byte >0x2F version %c 1108>9 byte >0x2F \b.%c file 11090 lelong 0x4C 1110>4 lelong 0x00021401 Windows shortcut file 1111 1112# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm 1113# only for windows versions equal or greater 3.0 11140x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 1115!:mime application/x-dosexec 1116!:ext pif 1117#>2 string >\0 \b, Title:%.30s 1118>0x24 string >\0 \b for %.63s 1119>0x65 string >\0 \b, directory=%.64s 1120>0xA5 string >\0 \b, parameters=%.64s 1121#>0x181 leshort x \b, offset %x 1122#>0x183 leshort x \b, offsetdata %x 1123#>0x185 leshort x \b, section length %x 1124>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 1125>>&0x5e ubyte >0 1126>>>&-1 string <PIFMGR.DLL \b, icon=%s 1127#>>>&-1 string PIFMGR.DLL \b, icon=%s 1128>>>&-1 string >PIFMGR.DLL \b, icon=%s 1129>>&0xF0 ubyte >0 1130>>>&-1 string <Terminal \b, font=%.32s 1131#>>>&-1 string =Terminal \b, font=%.32s 1132>>>&-1 string >Terminal \b, font=%.32s 1133>>&0x110 ubyte >0 1134>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 1135#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 1136>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 1137#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 1138#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 1139>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 1140#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 1141>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 1142#>>&06 string x \b:%s 1143>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 1144#>>&06 string x \b:%s 1145 1146# DOS EPS Binary File Header 1147# From: Ed Sznyter <ews@Black.Market.NET> 11480 belong 0xC5D0D3C6 DOS EPS Binary File 1149!:mime image/x-eps 1150>4 long >0 Postscript starts at byte %d 1151>>8 long >0 length %d 1152>>>12 long >0 Metafile starts at byte %d 1153>>>>16 long >0 length %d 1154>>>20 long >0 TIFF starts at byte %d 1155>>>>24 long >0 length %d 1156 1157# TNEF magic From "Joomy" <joomy@se-ed.net> 1158# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 11590 lelong 0x223e9f78 TNEF 1160!:mime application/vnd.ms-tnef 1161 1162# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C 1163# of http://www.davep.org/norton-guides/ng2h-105.tgz 1164# https://en.wikipedia.org/wiki/Norton_Guides 11650 string NG\0\001 1166# only value 0x100 found at offset 2 1167>2 ulelong 0x00000100 Norton Guide 1168# Title[40] 1169>>8 string >\0 "%-.40s" 1170#>>6 uleshort x \b, MenuCount=%u 1171# szCredits[5][66] 1172>>48 string >\0 \b, %-.66s 1173>>114 string >\0 %-.66s 1174 1175# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 1176# of https://www.4dos.info/ 1177# pointer,HelpID[8]=4DHnnnmm 11780 ulelong 0x48443408 4DOS help file 1179>4 string x \b, version %-4.4s 1180 1181# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 11820 ulequad 0x3a000000024e4c MS Advisor help file 1183 1184# HtmlHelp files (.chm) 11850 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data 1186 1187# GFA-BASIC (Wolfram Kleff) 11882 string/b GFA-BASIC3 GFA-BASIC 3 data 1189 1190#------------------------------------------------------------------------------ 1191# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 1192# Update: Joerg Jenderek 1193# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format) 1194# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx 1195# Note: verified by `7z l *.cab` 1196# Microsoft Cabinet files 11970 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 1198# 1199# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool 1200# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE 1201# because some archive does not have *.diag* as 1st or 2nd archive member like 1202# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab 1203# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section 1204>0x2c search/980/c .diag \b, Diagnostic 1205!:mime application/vnd.ms-cab-compressed 1206!:ext diagcab 1207# http://fileformats.archiveteam.org/wiki/PUZ 1208# Microsoft Publisher version about 2003 has a "Pack and Go" feature that 1209# bundles a Publisher document *PNG.pub with all links into a CAB 1210>0x2c search/300/c png.pub\0 \b, Publisher Packed and Go 1211!:mime application/vnd.ms-cab-compressed 1212!:ext puz 1213# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation 1214>0x2c search/17/c ppview32.exe\0 \b, PowerPoint Viewer Packed and Go 1215!:mime application/vnd.ms-powerpoint 1216#!:mime application/mspowerpoint 1217!:ext ppz 1218# http://www.incredimail.com/ 1219# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims 1220>0x2c search/3369/c content.ini\0 \b, IncrediMail 1221!:mime application/x-incredimail 1222# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf 1223>>0x2c search/83/c Flavor.htm\0 ecard 1224!:ext imf 1225# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims 1226>>0x2c search/211/c .swf\0 skin 1227!:ext ims 1228# member anim.im3 implies IncrediMail animation like in letter_fold.ima 1229>>0x2c search/92/c anim.im3\0 animation 1230!:ext ima 1231# other IncrediMail cab archive 1232>>0x2c default x 1233>>>0x2c search/116/c thumb ecard, image, notifier or skin 1234!:ext imf/imi/imn/ims 1235# http://file-extension.net/seeker/file_extension_ime 1236>>>0x2c default x emoticons or sound 1237!:ext ime/imw 1238# no Diagnostic and IncrediMail 1239>0x2c default x 1240# look for 1st member name 1241>>(16.l+16) ubyte x 1242# https://en.wikipedia.org/wiki/SNP_file_format 1243>>>&-1 string/c _accrpt_.snp \b, Access report snapshot 1244!:mime application/msaccess 1245!:ext snp 1246# https://www.cabextract.org.uk/wince_cab_format/ 1247# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer 1248>>>&7 string =.000 \b, WinCE install 1249!:mime application/vnd.ms-cab-compressed 1250!:ext cab 1251 1252# https://support.microsoft.com/kb/934307/en-US 1253# All inspected MSU contain a file with name WSUSSCAN.cab 1254# that is called "Windows Update meta data" by Microsoft 1255>>>&-1 string/c wsusscan.cab \b, Microsoft Standalone Update 1256!:mime application/vnd.ms-cab-compressed 1257!:ext msu 1258>>>&-1 default x 1259# look at point charcter of 1st archive member name for file name extension 1260>>>>&-1 search/255 . 1261# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm 1262# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002 1263# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB 1264>>>>>&0 string/c ppt\0 \b, PowerPoint Packed and Go 1265!:mime application/vnd.ms-powerpoint 1266#!:mime application/mspowerpoint 1267!:ext ppz 1268# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx 1269# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack 1270# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack 1271>>>>>&0 string/c theme \b, Windows 1272!:mime application/x-windows-themepack 1273# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8 1274# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack 1275# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme 1276>>>>>>(16.l+16) string =Panoram 8 1277!:ext deskthemepack 1278>>>>>>(16.l+16) string !Panoram 7 or 8 1279!:ext themepack/deskthemepack 1280>>>>>>(16.l+16) ubyte x Theme Pack 1281>>>>>&0 default x 1282# look for null terminator of 1st member name 1283>>>>>>&0 search/255 \0 1284# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu 1285>>>>>>>&16 string/c wsusscan.cab \b, Microsoft Standalone Update 1286!:mime application/vnd.ms-cab-compressed 1287!:ext msu 1288>>>>>>>&16 default x 1289# archive with more then one file need some output in version 5.32 to avoid error message like 1290# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type 1291# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type 1292# file: could not find any valid magic files! 1293>>>>>>>>28 uleshort >1 \b, many 1294!:mime application/vnd.ms-cab-compressed 1295!:ext cab 1296# remaining archives with just one file 1297>>>>>>>>28 uleshort =1 1298# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386 1299>>>>>>>>>30 uleshort =0x0000 \b, Windows 2000/XP setup 1300# cut of last char of source extension and add underscore to generate extension 1301# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_ 1302!:mime application/vnd.ms-cab-compressed 1303!:ext _/?_/??_ 1304# archive need some output like "single" in version 5.32 to avoid error messages 1305>>>>>>>>>30 uleshort !0x0000 \b, single 1306!:mime application/vnd.ms-cab-compressed 1307!:ext cab 1308# TODO: additional extensions like 1309# .xsn InfoPath Dynamic Form 1310# .xtp InfoPath Template Part 1311# .lvf Logitech Video Effects Face Accessory 1312>8 ulelong x \b, %u bytes 1313>28 uleshort 1 \b, 1 file 1314>28 uleshort >1 \b, %u files 1315# Reserved fields, set to zero 1316#>4 belong !0 \b, reserved1 %x 1317#>12 belong !0 \b, reserved2 %x 1318# offset of the first CFFILE entry coffFiles: minimal 2Ch 1319>16 ulelong x \b, at 0x%x 1320>(16.l) use cab-file 1321# at least also 2nd member 1322>28 uleshort >1 1323>>(16.l+16) ubyte x 1324>>>&0 search/255 \0 1325# second member info 1326>>>>&0 use cab-file 1327#>20 belong !0 \b, reserved %x 1328# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3 1329>24 ubeshort !0x0301 \b version 0x%x 1330# number of CFFOLDER entries 1331>26 uleshort >1 \b, %u cffolders 1332# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields 1333# only found for flags 0 1 2 3 4 not 7 1334>30 uleshort >0 \b, flags 0x%x 1335# Cabinet files have a 16-bit cabinet setID field that is designed for application use. 1336# default is zero, however, the -i option of cabarc can be used to set this field 1337>32 uleshort >0 \b, ID %u 1338# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet 1339#>34 uleshort x \b, iCabinet %u 1340# add one for display because humans start numbering by 1 and also fit to name of disk szDisk* 1341>34 uleshort+1 x \b, number %u 1342>30 uleshort &0x0004 \b, extra bytes 1343# cbCFHeader optional size of per-cabinet reserved area 14h 1800h 1344>>36 uleshort >0 %u in head 1345# cbCFFolder is optional size of per-folder reserved area 1346>>38 ubyte >0 %u in folder 1347# cbCFData is optional size of per-datablock reserved area 1348>>39 ubyte >0 %u in data block 1349# optional per-cabinet reserved area abReserve[cbCFHeader] 1350>>36 uleshort >0 1351# 1st CFFOLDER after reserved area in header 1352>>>(36.s+40) use cab-folder 1353# no reserved area in header 1354>30 uleshort ^0x0004 1355# no previous and next cab archive 1356>>30 uleshort =0x0000 1357>>>36 use cab-folder 1358# only previous cab archive 1359>>30 uleshort =0x0001 \b, previous 1360>>>36 use cab-anchor 1361# only next cab archive 1362>>30 uleshort =0x0002 \b, next 1363>>>36 use cab-anchor 1364# previous+next cab archive 1365# can not use sub routine cab-anchor to display previous and next cabinet together 1366#>>>36 use cab-anchor 1367#>>>>&0 use cab-anchor 1368>>30 uleshort =0x0003 \b, previous 1369>>>36 string x %s 1370# optional name of previous disk szDisk* 1371>>>>&1 string x disk %s 1372>>>>>&1 string x \b, next %s 1373# optional name of previous disk szDisk* 1374>>>>>>&1 string x disk %s 1375>>>>>>>&1 use cab-folder 1376# display filename and disk name of previous or next cabinet 13770 name cab-anchor 1378# optional name of previous/next cabinet file szCabinet*[255] 1379>&0 string x %s 1380# optional name of previous/next disk szDisk*[255] 1381>>&1 string x disk %s 1382# display folder structure CFFOLDER information like compression of cabinet 13830 name cab-folder 1384# offset of the CFDATA block in this folder 1385#>0 ulelong x \b, coffCabStart 0x%x 1386# number of CFDATA blocks in folder 1387>4 uleshort x \b, %u datablock 1388# plural s 1389>4 uleshort >1 \bs 1390# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15 1391>6 uleshort x \b, 0x%x compression 1392# optional per-folder reserved area 1393#>8 ubequad x \b, abReserve 0x%llx 1394# display member structure CFFILE information like member name of cabinet 13950 name cab-file 1396# cbFile is uncompressed size of file in bytes 1397#>0 ulelong x \b, cbFile %u 1398# uoffFolderStart is uncompressed offset of file in folder 1399#>4 ulelong >0 \b, uoffFolderStart 0x%x 1400# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet 1401# define ifoldCONTINUED_FROM_PREV (0xFFFD) 1402# define ifoldCONTINUED_TO_NEXT (0xFFFE) 1403# define ifoldCONTINUED_PREV_AND_NEXT (0xFFFF) 1404>8 uleshort >0 \b, iFolder 0x%x 1405# date stamp for file 1406#>10 uleshort x \b, date 0x%x 1407# time stamp for file 1408#>12 uleshort x \b, time 0x%x 1409# attribs is attribute flags for file 1410# define _A_RDONLY (0x01) file is read-only 1411# define _A_HIDDEN (0x02) file is hidden 1412# define _A_SYSTEM (0x04) file is a system file 1413# define _A_ARCH (0x20) file modified since last backup 1414# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab 1415# define _A_EXEC (0x40) run after extraction 1416# define _A_NAME_IS_UTF (0x80) szName[] contains UTF 1417# define UNKNOWN (0x0100) undocumented or accident 1418#>14 uleshort x \b, attribs 0x%x 1419>14 uleshort >0 + 1420>>14 uleshort &0x0001 \bR 1421>>14 uleshort &0x0002 \bH 1422>>14 uleshort &0x0004 \bS 1423>>14 uleshort &0x0020 \bA 1424>>14 uleshort &0x0040 \bX 1425>>14 uleshort &0x0080 \bUtf 1426# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB 1427>>14 uleshort &0x0100 \b? 1428# szName is name of archive member 1429>16 string x "%s" 1430# next archive member name if more files 1431#>>&17 string >\0 \b, NEXT NAME %-.50s 1432 1433# InstallShield Cabinet files 14340 string/b ISc( InstallShield Cabinet archive data 1435>5 byte&0xf0 =0x60 version 6, 1436>5 byte&0xf0 !0x60 version 4/5, 1437>(12.l+40) lelong x %u files 1438 1439# Windows CE package files 14400 string/b MSCE\0\0\0\0 Microsoft WinCE install header 1441>20 lelong 0 \b, architecture-independent 1442>20 lelong 103 \b, Hitachi SH3 1443>20 lelong 104 \b, Hitachi SH4 1444>20 lelong 0xA11 \b, StrongARM 1445>20 lelong 4000 \b, MIPS R4000 1446>20 lelong 10003 \b, Hitachi SH3 1447>20 lelong 10004 \b, Hitachi SH3E 1448>20 lelong 10005 \b, Hitachi SH4 1449>20 lelong 70001 \b, ARM 7TDMI 1450>52 leshort 1 \b, 1 file 1451>52 leshort >1 \b, %u files 1452>56 leshort 1 \b, 1 registry entry 1453>56 leshort >1 \b, %u registry entries 1454 1455 1456# Windows Enhanced Metafile (EMF) 1457# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 1458# for further information. 14590 ulelong 1 1460>40 string \ EMF Windows Enhanced Metafile (EMF) image data 1461>>44 ulelong x version 0x%x 1462 1463 14640 string/b \224\246\056 Microsoft Word Document 1465!:mime application/msword 1466 1467# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 1468# Magic type for Dell's BIOS .hdr files 1469# Dell's .hdr 14700 string/b $RBU 1471>23 string Dell %s system BIOS 1472>5 byte 2 1473>>48 byte x version %d. 1474>>49 byte x \b%d. 1475>>50 byte x \b%d 1476>5 byte <2 1477>>48 string x version %.3s 1478 1479# Type: Microsoft Document Imaging Format (.mdi) 1480# URL: https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 1481# From: Daniele Sempione <scrows@oziosi.org> 1482# Too weak (EP) 1483#0 short 0x5045 Microsoft Document Imaging Format 1484 1485# MS eBook format (.lit) 14860 string/b ITOLITLS Microsoft Reader eBook Data 1487>8 lelong x \b, version %u 1488!:mime application/x-ms-reader 1489 1490# Windows CE Binary Image Data Format 1491# From: Dr. Jesus <j@hug.gs> 14920 string/b B000FF\n Windows Embedded CE binary image 1493 1494# The second byte of these signatures is a file version; I don't know what, 1495# if anything, produced files with version numbers 0-2. 1496# From: John Elliott <johne@seasip.demon.co.uk> 14970 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 14980 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 14990 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 15000 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 1501 15020 string MIOPEN Mallard BASIC Jetsam data 15030 string Jetsam0 Mallard BASIC Jetsam index data 1504 1505# DOS backup 2.0 to 3.2 1506 1507# backupid.@@@ 1508 1509# plausibility check for date 15100x3 ushort >1979 1511>0x5 ubyte-1 <31 1512>>0x6 ubyte-1 <12 1513# actually 121 nul bytes 1514>>>0x7 string \0\0\0\0\0\0\0\0 1515>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d 1516!:ext @@@ 1517>>>>0x0 ubyte 0xff \b, last disk 1518 1519# backed up file 1520 1521# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd 1522# by looking for trailing nul of maximal file name string 15230x52 ubyte 0 1524# test for flag byte: FFh~complete file, 00h~split file 1525# FFh -127 = -1 -127 = -128 1526# 00h -127 = 0 -127 = -127 1527>0 byte-127 <-126 1528# plausibility check for file name length 1529>>0x53 ubyte-1 <78 1530# looking for terminating nul of file name string 1531>>>(0x53.b+4) ubyte 0 1532# looking if last char of string is valid DOS file name 1533>>>>(0x53.b+3) ubyte >0x1F 1534# actually 44 nul bytes 1535# but sometimes garbage according to Ralf Quint. So can not be used as test 1536#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 1537# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator 1538# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 1539>>>>>5 ubyte&0x8C 0x0C 1540# ./msdos (version 5.30) labeled the entry as 1541# "DOS 2.0 backed up file %s, split file, sequence %d" or 1542# "DOS 2.0 backed up file %s, complete file" 1543>>>>>>0 ubyte x DOS 2.0-3.2 backed up 1544#>>>>>>0 ubyte 0xff complete 1545>>>>>>0 ubyte 0 1546>>>>>>>1 uleshort x sequence %d of 1547# full file name with path but without drive letter and colon stored from 0x05 til 0x52 1548>>>>>>0x5 string x file %s 1549# backup name is original filename 1550#!:ext * 1551# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*' 1552# file: line 1169: Bad magic entry ' *' 1553# after header original file content 1554>>>>>>128 indirect x \b; 1555 1556 1557# DOS backup 3.3 to 5.x 1558 1559# CONTROL.nnn files 15600 string \x8bBACKUP\x20 1561# actually 128 nul bytes 1562>0xa string \0\0\0\0\0\0\0\0 1563>>0x9 ubyte x DOS 3.3 backup control file, sequence %d 1564>>0x8a ubyte 0xff \b, last disk 1565 1566# NB: The BACKUP.nnn files consist of the files backed up, 1567# concatenated. 1568