2 #------------------------------------------------------------------------------
3 # apple: file(1) magic for Apple file formats
5 0 string FiLeStArTfIlEsTaRt binscii (apple ][) text
6 0 string \x0aGL Binary II (apple ][) data
7 0 string \x76\xff Squeezed (apple ][) data
8 0 string NuFile NuFile archive (apple ][) data
9 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
10 0 belong 0x00051600 AppleSingle encoded Macintosh file
11 0 belong 0x00051607 AppleDouble encoded Macintosh file
13 # magic for Newton PDA package formats
14 # from Ruda Moura <ruda@helllabs.org>
15 0 string package0 Newton package, NOS 1.x,
16 >12 belong &0x80000000 AutoRemove,
17 >12 belong &0x40000000 CopyProtect,
18 >12 belong &0x10000000 NoCompression,
19 >12 belong &0x04000000 Relocation,
20 >12 belong &0x02000000 UseFasterCompression,
21 >16 belong x version %d
23 0 string package1 Newton package, NOS 2.x,
24 >12 belong &0x80000000 AutoRemove,
25 >12 belong &0x40000000 CopyProtect,
26 >12 belong &0x10000000 NoCompression,
27 >12 belong &0x04000000 Relocation,
28 >12 belong &0x02000000 UseFasterCompression,
29 >16 belong x version %d
31 0 string package4 Newton package,
34 >12 belong &0x80000000 AutoRemove,
35 >12 belong &0x40000000 CopyProtect,
36 >12 belong &0x10000000 NoCompression,
38 # The following entries for the Apple II are for files that have
39 # been transferred as raw binary data from an Apple, without having
40 # been encapsulated by any of the above archivers.
42 # In general, Apple II formats are hard to identify because Apple DOS
43 # and especially Apple ProDOS have strong typing in the file system and
44 # therefore programmers never felt much need to include type information
45 # in the files themselves.
47 # Eric Fischer <enf@pobox.com>
49 # AppleWorks word processor:
51 # This matches the standard tab stops for an AppleWorks file, but if
52 # a file has a tab stop set in the first four columns this will fail.
54 # The "O" is really the magic number, but that's so common that it's
55 # necessary to check the tab stops that follow it to avoid false positives.
57 4 string O==== AppleWorks word processor data
58 >85 byte&0x01 >0 \b, zoomed
59 >90 byte&0x01 >0 \b, paginated
60 >92 byte&0x01 >0 \b, with mail merge
61 #>91 byte x \b, left margin %d
63 # AppleWorks database:
65 # This isn't really a magic number, but it's the closest thing to one
66 # that I could find. The 1 and 2 really mean "order in which you defined
67 # categories" and "left to right, top to bottom," respectively; the D and R
68 # mean that the cursor should move either down or right when you press Return.
70 #30 string \x01D AppleWorks database data
71 #30 string \x02D AppleWorks database data
72 #30 string \x01R AppleWorks database data
73 #30 string \x02R AppleWorks database data
75 # AppleWorks spreadsheet:
77 # Likewise, this isn't really meant as a magic number. The R or C means
78 # row- or column-order recalculation; the A or M means automatic or manual
81 #131 string RA AppleWorks spreadsheet data
82 #131 string RM AppleWorks spreadsheet data
83 #131 string CA AppleWorks spreadsheet data
84 #131 string CM AppleWorks spreadsheet data
88 # This is incredibly sloppy, but will be true if the program was
89 # written at its usual memory location of 2048 and its first line
90 # number is less than 256. Yuck.
92 0 belong&0xff00ff 0x80000 Applesoft BASIC program data
93 #>2 leshort x \b, first line number %d
97 # This will not identify ORCA/M source files, since those have
98 # some sort of date code instead of the two zero bytes at 6 and 7
99 # XXX Conflicts with ELF
100 #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
101 #>5 byte x \b, build number %d
103 # Broderbund Fantavision
105 # I don't know what these values really mean, but they seem to recur.
106 # Will they cause too many conflicts?
109 #2 belong&0xFF00FF 0x040008 Fantavision movie data
111 # Some attempts at images.
113 # These are actually just bit-for-bit dumps of the frame buffer, so
114 # there's really no reasonably way to distinguish them except for their
115 # address (if preserved) -- 8192 or 16384 -- and their length -- 8192
116 # or, occasionally, 8184.
118 # Nevertheless this will manage to catch a lot of images that happen
119 # to have a solid-colored line at the bottom of the screen.
121 8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
122 8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
123 8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
124 8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
125 8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
127 # Beagle Bros. Apple Mechanic fonts
129 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
131 # Apple Universal Disk Image Format (UDIF) - dmg files.
133 # These entries are disabled for now until we fix the following issues.
135 # Note there might be some problems with the "VAX COFF executable"
136 # entry. Note this entry should be placed before the mac filesystem section,
137 # particularly the "Apple Partition data" entry.
139 # The intended meaning of these tests is, that the file is only of the
140 # specified type if both of the lines are correct - i.e. if the first
141 # line matches and the second doesn't then it is not of that type.
144 #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
146 # Note that this entry is recognized correctly by the "Apple Partition
147 # data" entry - however since this entry is more specific - this
148 # information seems to be more useful.
150 #>0x410 string disk\ image UDIF read/write image (UDRW)
152 # From: Toby Peterson <toby@apple.com>
153 0 string bplist00 Apple binary property list
155 # Apple binary property list (bplist)
156 # Assumes version bytes are hex.
157 # Provides content hints for version 0 files. Assumes that the root
158 # object is the first object (true for CoreFoundation implementation).
159 # From: David Remahl <dremahl@apple.com>
161 >6 byte x \bCoreFoundation binary property list data, version 0x%c
164 >>8 byte&0xF0 0x00 \b
165 >>>8 byte&0x0F 0x00 \b, root type: null
166 >>>8 byte&0x0F 0x08 \b, root type: false boolean
167 >>>8 byte&0x0F 0x09 \b, root type: true boolean
168 >>8 byte&0xF0 0x10 \b, root type: integer
169 >>8 byte&0xF0 0x20 \b, root type: real
170 >>8 byte&0xF0 0x30 \b, root type: date
171 >>8 byte&0xF0 0x40 \b, root type: data
172 >>8 byte&0xF0 0x50 \b, root type: ascii string
173 >>8 byte&0xF0 0x60 \b, root type: unicode string
174 >>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
175 >>8 byte&0xF0 0xa0 \b, root type: array
176 >>8 byte&0xF0 0xd0 \b, root type: dictionary
178 # Apple/NeXT typedstream data
179 # Serialization format used by NeXT and Apple for various
180 # purposes in YellowStep/Cocoa, including some nib files.
181 # From: David Remahl <dremahl@apple.com>
182 2 string typedstream NeXT/Apple typedstream data, big endian
183 >0 byte x \b, version %hhd
186 >>>14 ubeshort x \b, system %hd
187 2 string streamtyped NeXT/Apple typedstream data, little endian
188 >0 byte x \b, version %hhd
191 >>>14 uleshort x \b, system %hd
193 #------------------------------------------------------------------------------
194 # CAF: Apple CoreAudio File Format
196 # Container format for high-end audio purposes.
197 # From: David Remahl <dremahl@apple.com>
199 0 string caff CoreAudio Format audio file
200 >4 beshort <10 version %d
204 #------------------------------------------------------------------------------
205 # Keychain database files
206 0 string kych Mac OS X Keychain File
208 #------------------------------------------------------------------------------
209 # Code Signing related file types
210 0 belong 0xfade0c00 Mac OS X Code Requirement
212 >4 belong x - %d bytes
214 0 belong 0xfade0c01 Mac OS X Code Requirement Set
215 >8 belong >1 containing %d items
216 >4 belong x - %d bytes
218 0 belong 0xfade0c02 Mac OS X Code Directory
219 >8 belong x version %x
220 >12 belong >0 flags 0x%x
221 >4 belong x - %d bytes
223 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
224 >4 belong x - %d bytes
226 0 belong 0xfade0cc1 Mac OS X Detached Code Signature
227 >8 belong >1 (%d elements)
228 >4 belong x - %d bytes
230 # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
232 4 string innotek\ VirtualBox\ Disk\ Image %s