2 #------------------------------------------------------------------------------
3 # $File: macintosh,v 1.28 2017/12/05 02:17:48 christos Exp $
4 # macintosh description
6 # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
7 # Daniel Quinlan, quinlan@yggdrasil.com
8 11 string must\ be\ converted\ with\ BinHex BinHex binary text
9 !:mime application/mac-binhex40
10 >41 string x \b, version %.3s
12 # Stuffit archives are the de facto standard of compression for Macintosh
13 # files obtained from most archives. (franklsm@tuns.ca)
14 0 string SIT! StuffIt Archive (data)
15 !:mime application/x-stuffit
18 0 string SITD StuffIt Deluxe (data)
20 0 string Seg StuffIt Deluxe Segment (data)
23 # Newer StuffIt archives (grant@netbsd.org)
24 0 string StuffIt StuffIt Archive
25 !:mime application/x-stuffit
29 # Macintosh Applications and Installation binaries (franklsm@tuns.ca)
31 #0 string APPL Macintosh Application (data)
34 # Macintosh System files (franklsm@tuns.ca)
36 #0 string zsys Macintosh System File (data)
37 #0 string FNDR Macintosh Finder (data)
38 #0 string libr Macintosh Library (data)
40 #0 string shlb Macintosh Shared Library (data)
42 #0 string cdev Macintosh Control Panel (data)
44 #0 string INIT Macintosh Extension (data)
46 #0 string FFIL Macintosh Truetype Font (data)
48 #0 string LWFN Macintosh Postscript Font (data)
51 # Additional Macintosh Files (franklsm@tuns.ca)
53 #0 string PACT Macintosh Compact Pro Archive (data)
55 #0 string ttro Macintosh TeachText File (data)
57 #0 string TEXT Macintosh TeachText File (data)
59 #0 string PDF Macintosh PDF File (data)
62 # MacBinary format (Eric Fischer, enf@pobox.com)
63 # Update: Joerg Jenderek
64 # URL: https://en.wikipedia.org/wiki/MacBinary
65 # Reference: http://files.stairways.com/other/macbinaryii-standard-info.txt
67 # Unfortunately MacBinary doesn't really have a magic number prior
68 # to the MacBinary III format.
71 # old version number, must be kept at zero for compatibility
73 # length of filename (must be in the range 1-63)
75 # skip T.PIC.LZ INSTRUMENT.7T INVENTORY
77 # skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)"
78 # by looking for printable characters at beginning of file name
79 >>>2 ubelong >0x1F000000
80 # zero fill, must be zero for compatibility
82 # zero fill, must be zero for compatibility
84 # MacBinary I test for valid version numbers
86 # additional check for creation date after 1 Jan 1970 ~ 7C25B080h
87 #>>>>>>>91 ubelong >0x7c25b07F
88 # additional check for undefined header fields in MacBinary I
91 # MacBinary II the newer versions begins at 129
92 >>>>>>122 ubeshort 0x8181
94 # MacBinary III with MacBinary II to read
95 >>>>>122 ubeshort 0x8281
98 # display information of MacBinary file
100 >122 ubyte x MacBinary
101 # versions for MacBinary II/III
104 # only in MacBinary III
105 >>102 string !mBIN with surprising version
106 !:mime application/x-macbinary
109 # THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary
110 #>1 ubyte >63 \b, name length %u too BIG!
111 #>122 ubeshort x \b, version 0x%x
112 # Finder flags if not 0
113 # >73 byte !0 \b, flags 0x
115 # >>101 byte !0 \b, flags 0x
116 # # original Finder flags (Bits 8-15)
118 # # finder flags, bits 0-7
120 >73 byte &0x01 \b, inited
121 >73 byte &0x02 \b, changed
122 >73 byte &0x04 \b, busy
123 >73 byte &0x08 \b, bozo
124 >73 byte &0x10 \b, system
125 >73 byte &0x20 \b, bundle
126 >73 byte &0x40 \b, invisible
127 >73 byte &0x80 \b, locked
129 # 75 beshort # vertical posn in window
130 #>75 beshort !0 \b, v.pos %u
131 # 77 beshort # horiz posn in window
132 #>77 beshort !0 \b, h.pos %u
133 # 79 beshort # window or folder ID
134 >79 ubeshort !0 \b, ID 0x%x
136 >81 byte !0 \b, protected 0x%x
137 # length of comment after resource
138 >99 ubeshort !0 \b, comment length %u
139 # char. code of file name
140 >106 ubyte !0 \b, char. code 0x%x
141 # still more Finder flags
142 >107 ubyte !0 \b, more flags 0x%x
143 # length of total files when unpacked only used when pack and unpack on the fly
144 >116 ubelong !0 \b, total length %u
145 # 120 beshort # length of add'l header
146 >120 ubeshort !0 \b, 2nd header length %u
147 # 124 beshort # checksum
148 #>124 ubeshort !0 \b, CRC 0x%x
149 # creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080
150 >91 beldate-0x7C25B080 x \b, %s
151 # THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow
152 >91 ubelong <0x7c25b080 INVALID date
153 #>91 belong-0x7C25B080 x \b, DEBUG DATE %d
155 >95 beldate-0x7C25B080 x \b, modified %s
156 # Apple creator+typ if not null
157 # file creator (normally expressed as four characters)
158 >69 ulong !0 \b, creator
159 # instead 4 character code display full creator name
160 >>69 use apple-creator
161 # file type (normally expressed as four characters)
162 >65 ulong !0 \b, type
164 # length of data segment
165 >83 ubelong !0 \b, %u bytes
166 # filename (in the range 1-63)
168 # print 1 space and then at offset 128 inspect data fork content if it has one
171 # Afterwards resource fork if length of resource segment not zero
173 # calculate resource fork offset
174 >>83 ubelong+128 x \b, at 0x%x
175 # length of resource segment
176 >>87 ubelong !0 %u bytes
177 >>(83.S+128) ubequad x resource
178 # further resource fork content inspection
181 # Apple Type/Creator Database
182 # URL: https://en.wikipedia.org/wiki/Type_code
183 # Reference: http://www.lacikam.co.il/tcdb/
184 # http://www.macdisk.com/macsigen.php
185 # Note: classic Mac OS files have two 4 character codes for type and creator.
186 # Thereby the Finder attach documents types to applications.
188 #>65 string x \b, type "%4.4s"
190 # display information about apple type
192 >0 string 8BIM PhotoShop
193 >0 string ALB3 PageMaker 3
194 >0 string ALB4 PageMaker 4
195 >0 string ALT3 PageMaker 3
196 >0 string APPL application
197 >0 string AWWP AppleWorks word processor
198 >0 string CIRC simulated circuit
199 >0 string DRWG MacDraw
200 >0 string EPSF Encapsulated PostScript
201 >0 string FFIL font suitcase
202 >0 string FKEY function key
203 >0 string FNDR Macintosh Finder
204 >0 string GIFf GIF image
205 >0 string Gzip GNU gzip
206 >0 string INIT system extension
207 >0 string LIB\ library
208 >0 string LWFN PostScript font
209 >0 string MSBC Microsoft BASIC
210 >0 string PACT Compact Pro archive
211 >0 string PDF\ Portable Document Format
212 >0 string PICT picture
213 >0 string PNTG MacPaint picture
214 >0 string PREF preferences
215 >0 string PROJ Think C project
216 >0 string QPRJ Think Pascal project
217 >0 string SCFL Defender scores
218 >0 string SCRN startup screen
219 >0 string SITD StuffIt Deluxe
220 >0 string SPn3 SuperPaint
221 >0 string STAK HyperCard stack
222 >0 string Seg\ StuffIt segment
223 >0 string TARF Unix tar archive
225 >0 string TIFF TIFF image
226 >0 string TOVF Eudora table of contents
227 >0 string WDBN Microsoft Word word processor
228 >0 string WORD MacWrite word processor
229 >0 string XLS\ Microsoft Excel
230 >0 string ZIVM compress (.Z)
231 >0 string ZSYS Pre-System 7 system file
232 >0 string acf3 Aldus FreeHand
233 >0 string cdev control panel
234 >0 string dfil Desk Accessory suitcase
235 >0 string libr library
236 >0 string nX^d WriteNow word processor
237 >0 string nX^w WriteNow dictionary
238 >0 string rsrc resource
239 >0 string scbk Scrapbook
240 >0 string shlb shared library
241 >0 string ttro SimpleText read-only
242 >0 string zsys system file
244 # additional types added in Dec 2017
245 >0 string BINA binary file
246 >0 string BMPp BMP image
247 >0 string JPEG JPEG image
248 #>0 string W4BN Microsoft Word x.y word processor?
249 # if type name is not known display 4 character identifier
253 #>69 string x \b, creator "%4.4s"
255 # Now Apple has no repository of registered Creator IDs any more. These are
256 # just the ones that I happened to have files from and was able to identify.
258 # display information about apple creator
260 >0 string 8BIM Adobe Photoshop
261 >0 string ALD3 PageMaker 3
262 >0 string ALD4 PageMaker 4
263 >0 string ALFA Alpha editor
264 >0 string APLS Apple Scanner
265 >0 string APSC Apple Scanner
266 >0 string BRKL Brickles
267 >0 string BTFT BitFont
268 >0 string CCL2 Common Lisp 2
269 >0 string CCL\ Common Lisp
270 >0 string CDmo The Talking Moose
271 >0 string CPCT Compact Pro
272 >0 string CSOm Eudora
273 >0 string DMOV Font/DA Mover
274 >0 string DSIM DigSim
275 >0 string EDIT Macintosh Edit
276 >0 string ERIK Macintosh Finder
277 >0 string EXTR self-extracting archive
278 >0 string Gzip GNU gzip
279 >0 string KAHL Think C
280 >0 string LWFU LaserWriter Utility
281 >0 string LZIV compress
282 >0 string MACA MacWrite
283 >0 string MACS Macintosh operating system
284 >0 string MAcK MacKnowledge terminal emulator
285 >0 string MLND Defender
286 >0 string MPNT MacPaint
287 >0 string MSBB Microsoft BASIC (binary)
288 >0 string MSWD Microsoft Word
289 >0 string NCSA NCSA Telnet
290 >0 string PJMM Think Pascal
291 >0 string PSAL Hunt the Wumpus
292 #>0 string PSI2 Apple File Exchange
293 >0 string R*ch BBEdit
294 >0 string RMKR Resource Maker
295 >0 string RSED Resource Editor
296 >0 string Rich BBEdit
297 >0 string SIT! StuffIt
298 >0 string SPNT SuperPaint
299 >0 string Unix NeXT Mac filesystem
300 >0 string VIM! Vim editor
301 >0 string WILD HyperCard
302 >0 string XCEL Microsoft Excel
303 >0 string aCa2 Fontographer
304 >0 string aca3 Aldus FreeHand
305 >0 string dosa Macintosh MS-DOS file system
306 >0 string movr Font/DA Mover
307 >0 string nX^n WriteNow
308 >0 string pdos Apple ProDOS file system
309 >0 string scbk Scrapbook
310 >0 string ttxt SimpleText
311 >0 string ufox Foreign File Access
312 # additional creators added in Dec 2017
314 >0 string BOBO Apple Works
315 # CU-SeeMe_0.87b3_(68K).bin
317 >0 string PSPT Apple File Exchange
318 # Disk_Copy_4.2.sea.bin
320 # probably StuffIt/Aladdin by Smith Micro Software, Inc.
321 >0 string STi0 stuffit
322 # MacGzip-1.1.3.sea.bin
324 # D-Disk_Copy_6.3.3.smi.bin
325 >0 string oneb Disk Copy Self Mounting
326 # if creator name is not known display 4 character identifier
330 # sas magic from Bruce Foster (bef@nwu.edu)
335 >24 string DATA data file
336 >24 string CATALOG catalog
337 >24 string INDEX data file index
338 >24 string VIEW data view
339 # sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
341 0x54 string SAS SAS 7+
342 >0x9C string DATA data file
343 >0x9C string CATALOG catalog
344 >0x9C string INDEX data file index
345 >0x9C string VIEW data view
347 # spss magic for SPSS system and portable files,
348 # from Bruce Foster (bef@nwu.edu).
350 0 long 0xc1e2c3c9 SPSS Portable File
353 0 string $FL2 SPSS System File
356 0 string $FL3 SPSS System File
359 # Macintosh filesystem data
360 # From "Tom N Harris" <telliamed@mac.com>
361 # Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
362 # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
363 # entries depend on the data arithmetic added after v.35
364 # There's also some Pascal strings in here, ditto...
366 # The boot block signature, according to IM:Files, is
367 # "for HFS volumes, this field always contains the value 0x4C4B."
368 # But if this is true for MFS or HFS+ volumes, I don't know.
369 # Alternatively, the boot block is supposed to be zeroed if it's
370 # unused, so a simply >0 should suffice.
372 0x400 beshort 0xD2D7 Macintosh MFS data
373 >0 beshort 0x4C4B (bootable)
374 >0x40a beshort &0x8000 (locked)
375 >0x402 beldate-0x7C25B080 x created: %s,
376 >0x406 beldate-0x7C25B080 >0 last backup: %s,
377 >0x414 belong x block size: %d,
378 >0x412 beshort x number of blocks: %d,
379 >0x424 pstring x volume name: %s
381 # *.hfs updated by Joerg Jenderek
382 # http://en.wikipedia.org/wiki/Hierarchical_File_System
383 # "BD" gives many false positives
385 # ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
386 # first block of volume bit map (always 3)
387 >0x40e ubeshort 0x0003
388 # maximal length of volume name is 27
389 >>0x424 ubyte <28 Macintosh HFS data
390 !:mime application/x-apple-diskimage
393 # http://www.macdisk.com/macsigen.php
396 # https://en.wikipedia.org/wiki/Apple_Disk_Image
398 >>>0 beshort 0x4C4B (bootable)
399 #>>>0 beshort 0x0000 (not bootable)
400 >>>0x40a beshort &0x8000 (locked)
401 >>>0x40a beshort ^0x0100 (mounted)
402 >>>0x40a beshort &0x0200 (spared blocks)
403 >>>0x40a beshort &0x0800 (unclean)
404 >>>0x47C beshort 0x482B (Embedded HFS+ Volume)
405 # http://www.epochconverter.com/
406 # 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970
407 # 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00
408 # construct not working
409 #>>>0x402 beldate-0x7C25B080 x created: %s,
410 #>>>0x406 beldate-0x7C25B080 x last modified: %s,
411 #>>>0x440 beldate-0x7C25B080 >0 last backup: %s,
412 # found block sizes 200h,1200h,2800h
413 >>>0x414 belong x block size: %d,
414 >>>0x412 beshort x number of blocks: %d,
415 >>>0x424 pstring x volume name: %s
417 0x400 beshort 0x482B Macintosh HFS Extended
418 >&0 beshort x version %d data
419 >0 beshort 0x4C4B (bootable)
420 >0x404 belong ^0x00000100 (mounted)
421 >&2 belong &0x00000200 (spared blocks)
422 >&2 belong &0x00000800 (unclean)
423 >&2 belong &0x00008000 (locked)
424 >&6 string x last mounted by: '%.4s',
425 # really, that should be treated as a belong and we print a string
426 # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
427 >&14 beldate-0x7C25B080 x created: %s,
428 # only the creation date is local time, all other timestamps in HFS+ are UTC.
429 >&18 bedate-0x7C25B080 x last modified: %s,
430 >&22 bedate-0x7C25B080 >0 last backup: %s,
431 >&26 bedate-0x7C25B080 >0 last checked: %s,
432 >&38 belong x block size: %d,
433 >&42 belong x number of blocks: %d,
434 >&46 belong x free blocks: %d
436 ## AFAIK, only the signature is different
437 # same as Apple Partition Map
438 # GRR: This magic is too weak, it is just "TS"
439 #0x200 beshort 0x5453 Apple Old Partition data
440 #>0x2 beshort x block size: %d,
441 #>0x230 string x first type: %s,
442 #>0x210 string x name: %s,
443 #>0x254 belong x number of blocks: %d,
444 #>0x400 beshort 0x504D
445 #>>0x430 string x second type: %s,
446 #>>0x410 string x name: %s,
447 #>>0x454 belong x number of blocks: %d,
448 #>>0x800 beshort 0x504D
449 #>>>0x830 string x third type: %s,
450 #>>>0x810 string x name: %s,
451 #>>>0x854 belong x number of blocks: %d,
452 #>>>0xa00 beshort 0x504D
453 #>>>>0xa30 string x fourth type: %s,
454 #>>>>0xa10 string x name: %s,
455 #>>>>0xa54 belong x number of blocks: %d
457 # From: Remi Mommsen <mommsen@slac.stanford.edu>
458 0 string BOMStore Mac OS X bill of materials (BOM) file
460 # From: Adam Buchbinder <adam.buchbinder@gmail.com>
461 # URL: http://en.wikipedia.org/wiki/Datafork_TrueType
462 # Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
463 # TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
464 # don't know what they mean.
466 >(0x4.L+24) beshort x
467 >>&4 belong 0x73666e74 Mac OSX datafork font, TrueType
468 >>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT'
469 >>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT'
470 >>&4 belong 0x504f5354 Mac OSX datafork font, PostScript