1#------------------------------------------------------------------------------ 2# archive: file(1) magic for archive formats (see also "msdos" for self- 3# extracting compressed archives) 4# 5# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 6# pre-POSIX "tar" archives are handled in the C code. 7 8# POSIX tar archives 9257 string ustar\0 POSIX tar archive 10!:mime application/x-tar # encoding: posix 11257 string ustar\040\040\0 GNU tar archive 12!:mime application/x-tar # encoding: gnu 13 14# cpio archives 15# 16# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 17# The idea is to indicate archives produced on machines with the same 18# byte order as the machine running "file" with "cpio archive", and 19# to indicate archives produced on machines with the opposite byte order 20# from the machine running "file" with "byte-swapped cpio archive". 21# 22# The SVR4 "cpio(4)" hints that there are additional formats, but they 23# are defined as "short"s; I think all the new formats are 24# character-header formats and thus are strings, not numbers. 250 short 070707 cpio archive 26!:mime application/x-cpio 270 short 0143561 byte-swapped cpio archive 28!:mime application/x-cpio # encoding: swapped 290 string 070707 ASCII cpio archive (pre-SVR4 or odc) 300 string 070701 ASCII cpio archive (SVR4 with no CRC) 310 string 070702 ASCII cpio archive (SVR4 with CRC) 32 33# Debian package (needs to go before regular portable archives) 34# 350 string =!<arch>\ndebian 36!:mime application/x-debian-package 37>8 string debian-split part of multipart Debian package 38>8 string debian-binary Debian binary package 39>8 string !debian 40>68 string >\0 (format %s) 41# These next two lines do not work, because a bzip2 Debian archive 42# still uses gzip for the control.tar (first in the archive). Only 43# data.tar varies, and the location of its filename varies too. 44# file/libmagic does not current have support for ascii-string based 45# (offsets) as of 2005-09-15. 46#>81 string bz2 \b, uses bzip2 compression 47#>84 string gz \b, uses gzip compression 48#>136 ledate x created: %s 49 50# other archives 510 long 0177555 very old archive 520 short 0177555 very old PDP-11 archive 530 long 0177545 old archive 540 short 0177545 old PDP-11 archive 550 long 0100554 apl workspace 560 string =<ar> archive 57!:mime application/x-archive 58 59# MIPS archive (needs to go before regular portable archives) 60# 610 string =!<arch>\n__________E MIPS archive 62>20 string U with MIPS Ucode members 63>21 string L with MIPSEL members 64>21 string B with MIPSEB members 65>19 string L and an EL hash table 66>19 string B and an EB hash table 67>22 string X -- out of date 68 690 search/1 -h- Software Tools format archive text 70 71# 72# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is 73# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: 74# 75# 0 string =!<arch> current ar archive 76# 0 long 0x213c6172 archive file 77# 78# and for SVR1 archives, we have: 79# 80# 0 string \<ar> System V Release 1 ar archive 81# 0 string =<ar> archive 82# 83# XXX - did Aegis really store shared libraries, breakpointed modules, 84# and absolute code program modules in the same format as new-style 85# "ar" archives? 86# 870 string =!<arch> current ar archive 88!:mime application/x-archive 89>8 string __.SYMDEF random library 90>0 belong =65538 - pre SR9.5 91>0 belong =65539 - post SR9.5 92>0 beshort 2 - object archive 93>0 beshort 3 - shared library module 94>0 beshort 4 - debug break-pointed module 95>0 beshort 5 - absolute code program module 960 string \<ar> System V Release 1 ar archive 970 string =<ar> archive 98# 99# XXX - from "vax", which appears to collect a bunch of byte-swapped 100# thingies, to help you recognize VAX files on big-endian machines; 101# with "leshort", "lelong", and "string", that's no longer necessary.... 102# 1030 belong 0x65ff0000 VAX 3.0 archive 1040 belong 0x3c61723e VAX 5.0 archive 105# 1060 long 0x213c6172 archive file 1070 lelong 0177555 very old VAX archive 1080 leshort 0177555 very old PDP-11 archive 109# 110# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus 111# be a random library (it said 0xff65 rather than 0177545). 112# 1130 lelong 0177545 old VAX archive 114>8 string __.SYMDEF random library 1150 leshort 0177545 old PDP-11 archive 116>8 string __.SYMDEF random library 117# 118# From "pdp" (but why a 4-byte quantity?) 119# 1200 lelong 0x39bed PDP-11 old archive 1210 lelong 0x39bee PDP-11 4.0 archive 122 123# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 124# 125# The first byte is the magic (0x1a), byte 2 is the compression type for 126# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 127# filename of the first file (null terminated). Since some types collide 128# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 129# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 1300 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 131!:mime application/x-arc 1320 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 133!:mime application/x-arc 1340 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 135!:mime application/x-arc 1360 lelong&0x8080ffff 0x0000031a ARC archive data, packed 137!:mime application/x-arc 1380 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 139!:mime application/x-arc 1400 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 141!:mime application/x-arc 142# [JW] stuff taken from idarc, obviously ARC successors: 1430 lelong&0x8080ffff 0x00000a1a PAK archive data 144!:mime application/x-arc 1450 lelong&0x8080ffff 0x0000141a ARC+ archive data 146!:mime application/x-arc 1470 lelong&0x8080ffff 0x0000481a HYP archive data 148!:mime application/x-arc 149 150# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 151# I can't create either SPARK or ArcFS archives so I have not tested this stuff 152# [GRR: the original entries collide with ARC, above; replaced with combined 153# version (not tested)] 154#0 byte 0x1a RISC OS archive (spark format) 1550 string \032archive RISC OS archive (ArcFS format) 1560 string Archive\000 RISC OS archive (ArcFS format) 157 158# All these were taken from idarc, many could not be verified. Unfortunately, 159# there were many low-quality sigs, i.e. easy to trigger false positives. 160# Please notify me of any real-world fishy/ambiguous signatures and I'll try 161# to get my hands on the actual archiver and see if I find something better. [JW] 162# probably many can be enhanced by finding some 0-byte or control char near the start 163 164# idarc calls this Crush/Uncompressed... *shrug* 1650 string CRUSH Crush archive data 166# Squeeze It (.sqz) 1670 string HLSQZ Squeeze It archive data 168# SQWEZ 1690 string SQWEZ SQWEZ archive data 170# HPack (.hpk) 1710 string HPAK HPack archive data 172# HAP 1730 string \x91\x33HF HAP archive data 174# MD/MDCD 1750 string MDmd MDCD archive data 176# LIM 1770 string LIM\x1a LIM archive data 178# SAR 1793 string LH5 SAR archive data 180# BSArc/BS2 1810 string \212\3SB \0 BSArc/BS2 archive data 182# MAR 1832 string =-ah MAR archive data 184# ACB 1850 belong&0x00f800ff 0x00800000 ACB archive data 186# CPZ 187# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 188# JRC 1890 string JRchive JRC archive data 190# Quantum 1910 string DS\0 Quantum archive data 192# ReSOF 1930 string PK\3\6 ReSOF archive data 194# QuArk 1950 string 7\4 QuArk archive data 196# YAC 19714 string YC YAC archive data 198# X1 1990 string X1 X1 archive data 2000 string XhDr X1 archive data 201# CDC Codec (.dqt) 2020 belong&0xffffe000 0x76ff2000 CDC Codec archive data 203# AMGC 2040 string \xad6" AMGC archive data 205# NuLIB 2060 string NõFélå NuLIB archive data 207# PakLeo 2080 string LEOLZW PAKLeo archive data 209# ChArc 2100 string SChF ChArc archive data 211# PSA 2120 string PSA PSA archive data 213# CrossePAC 2140 string DSIGDCC CrossePAC archive data 215# Freeze 2160 string \x1f\x9f\x4a\x10\x0a Freeze archive data 217# KBoom 2180 string ¨MP¨ KBoom archive data 219# NSQ, must go after CDC Codec 2200 string \x76\xff NSQ archive data 221# DPA 2220 string Dirk\ Paehl DPA archive data 223# BA 224# TODO: idarc says "bytes 0-2 == bytes 3-5" 225# TTComp 2260 string \0\6 TTComp archive data 227# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 2280 string ESP ESP archive data 229# ZPack 2300 string \1ZPK\1 ZPack archive data 231# Sky 2320 string \xbc\x40 Sky archive data 233# UFA 2340 string UFA UFA archive data 235# Dry 2360 string =-H2O DRY archive data 237# FoxSQZ 2380 string FOXSQZ FoxSQZ archive data 239# AR7 2400 string ,AR7 AR7 archive data 241# PPMZ 2420 string PPMZ PPMZ archive data 243# MS Compress 2444 string \x88\xf0\x27 MS Compress archive data 245# updated by Joerg Jenderek 246>9 string \0 247>>0 string KWAJ 248>>>7 string \321\003 MS Compress archive data 249>>>>14 ulong >0 \b, original size: %ld bytes 250>>>>18 ubyte >0x65 251>>>>>18 string x \b, was %.8s 252>>>>>(10.b-4) string x \b.%.3s 253# MP3 (archiver, not lossy audio compression) 2540 string MP3\x1a MP3-Archiver archive data 255# ZET 2560 string OZÝ ZET archive data 257# TSComp 2580 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 259# ARQ 2600 string gW\4\1 ARQ archive data 261# Squash 2623 string OctSqu Squash archive data 263# Terse 2640 string \5\1\1\0 Terse archive data 265# PUCrunch 2660 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 267# UHarc 2680 string UHA UHarc archive data 269# ABComp 2700 string \2AB ABComp archive data 2710 string \3AB2 ABComp archive data 272# CMP 2730 string CO\0 CMP archive data 274# Splint 2750 string \x93\xb9\x06 Splint archive data 276# InstallShield 2770 string \x13\x5d\x65\x8c InstallShield Z archive Data 278# Gather 2791 string GTH Gather archive data 280# BOA 2810 string BOA BOA archive data 282# RAX 2830 string ULEB\xa RAX archive data 284# Xtreme 2850 string ULEB\0 Xtreme archive data 286# Pack Magic 2870 string @â\1\0 Pack Magic archive data 288# BTS 2890 belong&0xfeffffff 0x1a034465 BTS archive data 290# ELI 5750 2910 string Ora\ ELI 5750 archive data 292# QFC 2930 string \x1aFC\x1a QFC archive data 2940 string \x1aQF\x1a QFC archive data 295# PRO-PACK 2960 string RNC PRO-PACK archive data 297# 777 2980 string 777 777 archive data 299# LZS221 3000 string sTaC LZS221 archive data 301# HPA 3020 string HPA HPA archive data 303# Arhangel 3040 string LG Arhangel archive data 305# EXP1, uses bzip2 3060 string 0123456789012345BZh EXP1 archive data 307# IMP 3080 string IMP\xa IMP archive data 309# NRV 3100 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 311# Squish 3120 string \x73\xb2\x90\xf4 Squish archive data 313# Par 3140 string PHILIPP Par archive data 3150 string PAR Par archive data 316# HIT 3170 string UB HIT archive data 318# SBX 3190 belong&0xfffff000 0x53423000 SBX archive data 320# NaShrink 3210 string NSK NaShrink archive data 322# SAPCAR 3230 string #\ CAR\ archive\ header SAPCAR archive data 3240 string CAR\ 2.00RG SAPCAR archive data 325# Disintegrator 3260 string DST Disintegrator archive data 327# ASD 3280 string ASD ASD archive data 329# InstallShield CAB 3300 string ISc( InstallShield CAB 331# TOP4 3320 string T4\x1a TOP4 archive data 333# BatComp left out: sig looks like COM executable 334# so TODO: get real 4dos batcomp file and find sig 335# BlakHole 3360 string BH\5\7 BlakHole archive data 337# BIX 3380 string BIX0 BIX archive data 339# ChiefLZA 3400 string ChfLZ ChiefLZA archive data 341# Blink 3420 string Blink Blink archive data 343# Logitech Compress 3440 string \xda\xfa Logitech Compress archive data 345# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 3461 string (C)\ STEPANYUK ARS-Sfx archive data 347# AKT/AKT32 3480 string AKT32 AKT32 archive data 3490 string AKT AKT archive data 350# NPack 3510 string MSTSM NPack archive data 352# PFT 3530 string \0\x50\0\x14 PFT archive data 354# SemOne 3550 string SEM SemOne archive data 356# PPMD 3570 string \x8f\xaf\xac\x84 PPMD archive data 358# FIZ 3590 string FIZ FIZ archive data 360# MSXiE 3610 belong&0xfffff0f0 0x4d530000 MSXiE archive data 362# DeepFreezer 3630 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 364# DC 3650 string =<DC- DC archive data 366# TPac 3670 string \4TPAC\3 TPac archive data 368# Ai 3690 string Ai\1\1\0 Ai archive data 3700 string Ai\1\0\0 Ai archive data 371# Ai32 3720 string Ai\2\0 Ai32 archive data 3730 string Ai\2\1 Ai32 archive data 374# SBC 3750 string SBC SBC archive data 376# Ybs 3770 string YBS Ybs archive data 378# DitPack 3790 string \x9e\0\0 DitPack archive data 380# DMS 3810 string DMS! DMS archive data 382# EPC 3830 string \x8f\xaf\xac\x8c EPC archive data 384# VSARC 3850 string VS\x1a VSARC archive data 386# PDZ 3870 string PDZ PDZ archive data 388# ReDuq 3890 string rdqx ReDuq archive data 390# GCA 3910 string GCAX GCA archive data 392# PPMN 3930 string pN PPMN archive data 394# WinImage 3953 string WINIMAGE WinImage archive data 396# Compressia 3970 string CMP0CMP Compressia archive data 398# UHBC 3990 string UHB UHBC archive data 400# WinHKI 4010 string \x61\x5C\x04\x05 WinHKI archive data 402# WWPack data file 4030 string WWP WWPack archive data 404# BSN (BSA, PTS-DOS) 4050 string \xffBSG BSN archive data 4061 string \xffBSG BSN archive data 4073 string \xffBSG BSN archive data 4081 string \0\xae\2 BSN archive data 4091 string \0\xae\3 BSN archive data 4101 string \0\xae\7 BSN archive data 411# AIN 4120 string \x33\x18 AIN archive data 4130 string \x33\x17 AIN archive data 414# XPA32 4150 string xpa\0\1 XPA32 archive data 416# SZip (TODO: doesn't catch all versions) 4170 string SZ\x0a\4 SZip archive data 418# XPack DiskImage 4190 string jm XPack DiskImage archive data 420# XPack Data 4210 string xpa XPack archive data 422# XPack Single Data 4230 string Í\ jm XPack single archive data 424 425# TODO: missing due to unknown magic/magic at end of file: 426#DWC 427#ARG 428#ZAR 429#PC/3270 430#InstallIt 431#RKive 432#RK 433#XPack Diskimage 434 435# These were inspired by idarc, but actually verified 436# Dzip archiver (.dz) 4370 string DZ Dzip archive data 438>2 byte x \b, version %i 439>3 byte x \b.%i 440# ZZip archiver (.zz) 4410 string ZZ\ \0\0 ZZip archive data 4420 string ZZ0 ZZip archive data 443# PAQ archiver (.paq) 4440 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 4450 string PAQ PAQ archive data 446>3 byte&0xf0 0x30 447>>3 byte x (v%c) 448# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 4490xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 4500 string JARCS JAR (ARJ Software, Inc.) archive data 451 452# ARJ archiver (jason@jarthur.Claremont.EDU) 4530 leshort 0xea60 ARJ archive data 454!:mime application/x-arj 455>5 byte x \b, v%d, 456>8 byte &0x04 multi-volume, 457>8 byte &0x10 slash-switched, 458>8 byte &0x20 backup, 459>34 string x original name: %s, 460>7 byte 0 os: MS-DOS 461>7 byte 1 os: PRIMOS 462>7 byte 2 os: Unix 463>7 byte 3 os: Amiga 464>7 byte 4 os: Macintosh 465>7 byte 5 os: OS/2 466>7 byte 6 os: Apple ][ GS 467>7 byte 7 os: Atari ST 468>7 byte 8 os: NeXT 469>7 byte 9 os: VAX/VMS 470>3 byte >0 %d] 471# [JW] idarc says this is also possible 4722 leshort 0xea60 ARJ archive data 473 474# HA archiver (Greg Roelofs, newt@uchicago.edu) 475# This is a really bad format. A file containing HAWAII will match this... 476#0 string HA HA archive data, 477#>2 leshort =1 1 file, 478#>2 leshort >1 %u files, 479#>4 byte&0x0f =0 first is type CPY 480#>4 byte&0x0f =1 first is type ASC 481#>4 byte&0x0f =2 first is type HSC 482#>4 byte&0x0f =0x0e first is type DIR 483#>4 byte&0x0f =0x0f first is type SPECIAL 484# suggestion: at least identify small archives (<1024 files) 4850 belong&0xffff00fc 0x48410000 HA archive data 486>2 leshort =1 1 file, 487>2 leshort >1 %u files, 488>4 byte&0x0f =0 first is type CPY 489>4 byte&0x0f =1 first is type ASC 490>4 byte&0x0f =2 first is type HSC 491>4 byte&0x0f =0x0e first is type DIR 492>4 byte&0x0f =0x0f first is type SPECIAL 493 494# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 4950 string HPAK HPACK archive data 496 497# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 4980 string \351,\001JAM\ JAM archive, 499>7 string >\0 version %.4s 500>0x26 byte =0x27 - 501>>0x2b string >\0 label %.11s, 502>>0x27 lelong x serial %08x, 503>>0x36 string >\0 fstype %.8s 504 505# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 5062 string -lh0- LHarc 1.x/ARX archive data [lh0] 507!:mime application/x-lharc 5082 string -lh1- LHarc 1.x/ARX archive data [lh1] 509!:mime application/x-lharc 5102 string -lz4- LHarc 1.x archive data [lz4] 511!:mime application/x-lharc 5122 string -lz5- LHarc 1.x archive data [lz5] 513!:mime application/x-lharc 514# [never seen any but the last; -lh4- reported in comp.compression:] 5152 string -lzs- LHa/LZS archive data [lzs] 516!:mime application/x-lha 5172 string -lh\40- LHa 2.x? archive data [lh ] 518!:mime application/x-lha 5192 string -lhd- LHa 2.x? archive data [lhd] 520!:mime application/x-lha 5212 string -lh2- LHa 2.x? archive data [lh2] 522!:mime application/x-lha 5232 string -lh3- LHa 2.x? archive data [lh3] 524!:mime application/x-lha 5252 string -lh4- LHa (2.x) archive data [lh4] 526!:mime application/x-lha 5272 string -lh5- LHa (2.x) archive data [lh5] 528!:mime application/x-lha 5292 string -lh6- LHa (2.x) archive data [lh6] 530!:mime application/x-lha 5312 string -lh7- LHa (2.x)/LHark archive data [lh7] 532!:mime application/x-lha 533>20 byte x - header level %d 534# taken from idarc [JW] 5352 string -lZ PUT archive data 5362 string -lz LZS archive data 5372 string -sw1- Swag archive data 538 539# RAR archiver (Greg Roelofs, newt@uchicago.edu) 5400 string Rar! RAR archive data, 541!:mime application/x-rar 542>44 byte x v%0x, 543>10 byte >0 flags: 544>>10 byte &0x01 Archive volume, 545>>10 byte &0x02 Commented, 546>>10 byte &0x04 Locked, 547>>10 byte &0x08 Solid, 548>>10 byte &0x20 Authenticated, 549>35 byte 0 os: MS-DOS 550>35 byte 1 os: OS/2 551>35 byte 2 os: Win32 552>35 byte 3 os: Unix 553# some old version? idarc says: 5540 string RE\x7e\x5e RAR archive data 555 556# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 5570 string SQSH squished archive data (Acorn RISCOS) 558 559# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 560# [JW] see exe section for self-extracting version 5610 string UC2\x1a UC2 archive data 562 563# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 5640 string PK\003\004 565>4 byte 0x00 Zip archive data 566!:mime application/zip 567>4 byte 0x09 Zip archive data, at least v0.9 to extract 568!:mime application/zip 569>4 byte 0x0a Zip archive data, at least v1.0 to extract 570!:mime application/zip 571>4 byte 0x0b Zip archive data, at least v1.1 to extract 572!:mime application/zip 573>0x161 string WINZIP Zip archive data, WinZIP self-extracting 574!:mime application/zip 575>4 byte 0x14 576>>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract 577>0x161 string WINZIP Zip archive data, WinZIP self-extracting 578!:mime application/zip 579 580# OpenOffice.org / KOffice / StarOffice documents 581# Listed here because they ARE zip files 582# 583# From: Abel Cheung <abel@oaka.org> 584>4 byte 0x14 585>>30 string mimetype 586 587# KOffice (1.2 or above) formats 588>>>50 string vnd.kde. KOffice (>=1.2) 589>>>>58 string karbon Karbon document 590>>>>58 string kchart KChart document 591>>>>58 string kformula KFormula document 592>>>>58 string kivio Kivio document 593>>>>58 string kontour Kontour document 594>>>>58 string kpresenter KPresenter document 595>>>>58 string kspread KSpread document 596>>>>58 string kword KWord document 597 598# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 599>>>50 string vnd.sun.xml. OpenOffice.org 1.x 600>>>>62 string writer Writer 601>>>>>68 byte !0x2e document 602>>>>>68 string .template template 603>>>>>68 string .global global document 604>>>>62 string calc Calc 605>>>>>66 byte !0x2e spreadsheet 606>>>>>66 string .template template 607>>>>62 string draw Draw 608>>>>>66 byte !0x2e document 609>>>>>66 string .template template 610>>>>62 string impress Impress 611>>>>>69 byte !0x2e presentation 612>>>>>69 string .template template 613>>>>62 string math Math document 614>>>>62 string base Database file 615 616# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 617# http://lists.oasis-open.org/archives/office/200505/msg00006.html 618>>>50 string vnd.oasis.opendocument. OpenDocument 619>>>>73 string text 620>>>>>77 byte !0x2d Text 621!:mime application/vnd.oasis.opendocument.text 622>>>>>77 string -template Text Template 623>>>>>77 string -web HTML Document Template 624>>>>>77 string -master Master Document 625>>>>73 string graphics Drawing 626>>>>>81 string -template Template 627>>>>73 string presentation Presentation 628>>>>>85 string -template Template 629>>>>73 string spreadsheet Spreadsheet 630>>>>>84 string -template Template 631>>>>73 string chart Chart 632>>>>>78 string -template Template 633>>>>73 string formula Formula 634>>>>>80 string -template Template 635>>>>73 string database Database 636>>>>73 string image Image 637 638# Zoo archiver 63920 lelong 0xfdc4a7dc Zoo archive data 640!:mime application/x-zoo 641>4 byte >48 \b, v%c. 642>>6 byte >47 \b%c 643>>>7 byte >47 \b%c 644>32 byte >0 \b, modify: v%d 645>>33 byte x \b.%d+ 646>42 lelong 0xfdc4a7dc \b, 647>>70 byte >0 extract: v%d 648>>>71 byte x \b.%d+ 649 650# Shell archives 65110 string #\ This\ is\ a\ shell\ archive shell archive text 652!:mime application/octet-stream 653 654# 655# LBR. NB: May conflict with the questionable 656# "binary Computer Graphics Metafile" format. 657# 6580 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 659# 660# PMA (CP/M derivative of LHA) 661# 6622 string -pm0- PMarc archive data [pm0] 6632 string -pm1- PMarc archive data [pm1] 6642 string -pm2- PMarc archive data [pm2] 6652 string -pms- PMarc SFX archive (CP/M, DOS) 6665 string -pc1- PopCom compressed executable (CP/M) 667 668# From Rafael Laboissiere <rafael@laboissiere.net> 669# The Project Revision Control System (see 670# http://prcs.sourceforge.net) generates a packaged project 671# file which is recognized by the following entry: 6720 leshort 0xeb81 PRCS packaged project 673 674# Microsoft cabinets 675# by David Necas (Yeti) <yeti@physics.muni.cz> 676#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 677#>25 byte x v%d 678#>24 byte x \b.%d 679# MPi: All CABs have version 1.3, so this is pointless. 680# Better magic in debian-additions. 681 682# GTKtalog catalogs 683# by David Necas (Yeti) <yeti@physics.muni.cz> 6844 string gtktalog\ GTKtalog catalog data, 685>13 string 3 version 3 686>>14 beshort 0x677a (gzipped) 687>>14 beshort !0x677a (not gzipped) 688>13 string >3 version %s 689 690############################################################################ 691# Parity archive reconstruction file, the 'par' file format now used on Usenet. 6920 string PAR\0 PARity archive data 693>48 leshort =0 - Index file 694>48 leshort >0 - file number %d 695 696# Felix von Leitner <felix-file@fefe.de> 6970 string d8:announce BitTorrent file 698!:mime application/x-bittorrent 699 700# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 7010 beshort 0x0e0f Atari MSA archive data 702>2 beshort x \b, %d sectors per track 703>4 beshort 0 \b, 1 sided 704>4 beshort 1 \b, 2 sided 705>6 beshort x \b, starting track: %d 706>8 beshort x \b, ending track: %d 707 708# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 7090 string PK00PK\003\004 Zip archive data 710 711# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 712# by Stefan `Sec` Zehl <sec@42.org> 7137 string **ACE** ACE archive data 714>15 byte >0 version %d 715>16 byte =0x00 \b, from MS-DOS 716>16 byte =0x01 \b, from OS/2 717>16 byte =0x02 \b, from Win/32 718>16 byte =0x03 \b, from Unix 719>16 byte =0x04 \b, from MacOS 720>16 byte =0x05 \b, from WinNT 721>16 byte =0x06 \b, from Primos 722>16 byte =0x07 \b, from AppleGS 723>16 byte =0x08 \b, from Atari 724>16 byte =0x09 \b, from Vax/VMS 725>16 byte =0x0A \b, from Amiga 726>16 byte =0x0B \b, from Next 727>14 byte x \b, version %d to extract 728>5 leshort &0x0080 \b, multiple volumes, 729>>17 byte x \b (part %d), 730>5 leshort &0x0002 \b, contains comment 731>5 leshort &0x0200 \b, sfx 732>5 leshort &0x0400 \b, small dictionary 733>5 leshort &0x0800 \b, multi-volume 734>5 leshort &0x1000 \b, contains AV-String 735>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 736>5 leshort &0x2000 \b, with recovery record 737>5 leshort &0x4000 \b, locked 738>5 leshort &0x8000 \b, solid 739# Date in MS-DOS format (whatever that is) 740#>18 lelong x Created on 741 742# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 743# <doj@cubic.org> 7440x1A string sfArk sfArk compressed Soundfont 745>0x15 string 2 746>>0x1 string >\0 Version %s 747>>0x2A string >\0 : %s 748 749# DR-DOS 7.03 Packed File *.??_ 7500 string Packed\ File\ Personal NetWare Packed File 751>12 string x \b, was "%.12s" 752 753# EET archive 754# From: Tilman Sauerbeck <tilman@code-monkey.de> 7550 belong 0x1ee7ff00 EET archive 756!:mime application/x-eet 757 758# rzip archives 7590 string RZIP rzip compressed data 760>4 byte x - version %d 761>5 byte x \b.%d 762>6 belong x (%d bytes) 763 764# From: "Robert Dale" <robdale@gmail.com> 7650 belong 123 dar archive, 766>4 belong x label "%.8x 767>>8 belong x %.8x 768>>>12 beshort x %.4x" 769>14 byte 0x54 end slice 770>14 beshort 0x4e4e multi-part 771>14 beshort 0x4e53 multi-part, with -S 772 773# Symbian installation files 774# http://www.thouky.co.uk/software/psifs/sis.html 775# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 7768 lelong 0x10000419 Symbian installation file 777!:mime application/vnd.symbian.install 778>4 lelong 0x1000006D (EPOC release 3/4/5) 779>4 lelong 0x10003A12 (EPOC release 6) 7800 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 781!:mime x-epoc/x-sisx-app 782 783# From "Nelson A. de Oliveira" <naoliv@gmail.com> 7840 string MPQ\032 MoPaQ (MPQ) archive 785 786# From: Dirk Jagdmann <doj@cubic.org> 787# xar archive format: http://code.google.com/p/xar/ 7880 string xar! xar archive 789>6 beshort x - version %ld 790 791# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 792# .kgb 7930 string KGB_arch KGB Archiver file 794>10 string x with compression level %.1s 795 796# xar (eXtensible ARchiver) archive 797# From: "David Remahl" <dremahl@apple.com> 7980 string xar! xar archive 799#>4 beshort x header size %d 800>6 beshort x version %d, 801#>8 quad x compressed TOC: %d, 802#>16 quad x uncompressed TOC: %d, 803>24 belong 0 no checksum 804>24 belong 1 SHA-1 checksum 805>24 belong 2 MD5 checksum 806 807