/
githubmirror
/
file
Обзор
Документация
Войти
/
githubmirror
/
file
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
magic/Magdir/apple
804 строки
31 KB
Christos Zoulas
Pr/758: davidsong: Improve MacPaint
02 июн 2026, 20:32
02 июн 2026, 20:32
4ae752d
Код
Авторство
О чём код?
#------------------------------------------------------------------------------ # $File: apple,v 1.54 2026/06/02 17:32:17 christos Exp $ # apple: file(1) magic for Apple file formats # 0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 0 string \x0aGL Binary II (apple ][) data 0 string \x76\xff Squeezed (apple ][) data 0 string NuFile NuFile archive (apple ][) data 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 0 belong 0x00051600 AppleSingle encoded Macintosh file 0 belong 0x00051607 AppleDouble encoded Macintosh file # Type: Apple Emulator A2R format # From: Greg Wildman <greg@apple2.org.za> # Ref: https://applesaucefdc.com/a2r2-reference/ # Ref: https://applesaucefdc.com/a2r/ 0 string A2R >3 string \x31\xFF\x0A\x0D\x0A Applesauce A2R 1.x Disk Image >>0 use applesauce >3 string \x32\xFF\x0A\x0D\x0A Applesauce A2R 2.x Disk Image >>0 use applesauce >3 string \x33\xFF\x0A\x0D\x0A Applesauce A2R 3.x Disk Image >>0 use applesauce 0 name applesauce >8 string INFO >>49 byte 01 \b, 5.25″ SS 40trk >>49 byte 02 \b, 3.5″ DS 80trk >>49 byte 03 \b, 5.25″ DS 80trk >>49 byte 04 \b, 5.25″ DS 40trk >>49 byte 05 \b, 3.5″ DS 80trk >>49 byte 06 \b, 8″ DS >>50 byte 01 \b, write protected >>51 byte 01 \b, cross track synchronized >>17 string/T x \b, %.32s # Type: Apple Emulator WOZ format # From: Greg Wildman <greg@apple2.org.za> # Ref: https://applesaucefdc.com/woz/reference/ # Ref: https://applesaucefdc.com/woz/reference2/ 0 string WOZ >3 string \x31\xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image >>0 use applewoz >3 string \x32\xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image >>0 use applewoz 0 name applewoz >12 string INFO >>21 byte 01 \b, 5.25 inch >>21 byte 02 \b, 3.5 inch >>22 byte 01 \b, write protected >>23 byte 01 \b, cross track synchronized >>25 string/T x \b, %.32s # Type: Apple Macintosh Emulator MOOF format # From: Greg Wildman <greg@apple2.org.za> # Ref: https://applesaucefdc.com/moof-reference/ 0 string MOOF >4 string \xFF\x0A\x0D\x0A Apple Macintosh MOOF Disk Image >>12 string INFO >>>21 byte 01 \b, SSDD GCR (400K) >>>21 byte 02 \b, DSDD GCR (800K) >>>21 byte 03 \b, DSHD MFM (1.44M) >>>22 byte 01 \b, write protected >>>23 byte 01 \b, cross track synchronized >>>25 string/T x \b, %.32s # Type: Apple Emulator disk images # From: Greg Wildman <greg@apple2.org.za> # ProDOS boot loader? 0 string \x01\x38\xB0\x03\x4C Apple ProDOS Image # Detect Volume Directory block ($02) >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks # ProDOS ordered ? >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks # # Proboot HD 0 string \x01\x8A\x48\xD8\x2C\x82\xC0\x8D\x0E\xC0\x8D\x0C Apple ProDOS ProBoot Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks 0 string \x01\xA8\x8A\x20\x7B\xF8\x29\x07\x09\xC0\x99\x30 Apple ProDOS ProBoot Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks 0 string \x01\x4A\xD0\x34\xE6\x3D\x8A\x20\x7B\xF8\x09\xC0 Apple ProDOS ProBoot Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks # # ProDOS formatted 0 string \x01\xBD\x88\xC0\x20\x2F\xFB\x20\x58\xFC\x20\x40 Apple ProDOS Unbootable Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks 0 string \x01\x38\xB0\x03\x4C\x1C\x09\x78\x86\x43\xC9\x03 Apple ProDOS Unbootable Image >0x400 string \x00\x00\x03\x00 >>0x404 byte &0xF0 >>>0x405 string x \b, Volume /%s >>>0x429 uleshort x \b, %u Blocks >0xb00 string \x00\x00\x03\x00 >>0xb04 byte &0xF0 >>>0xb05 string x \b, Volume /%s >>>0xb29 uleshort x \b, %u Blocks # # DOS3 boot loader 0 string \x01\xA5\x27\xC9\x09\xD0 >0x11001 byte 0x11 >>0x11003 ubyte x Apple DOS 3.%u Image >>0x11006 ubyte x \b, Volume #%03u >>0x11034 ubyte x \b, %u Tracks >>0x11035 ubyte x \b, %u Sectors >>0x11036 uleshort x \b, %u bytes per sector # # DOS3 uninitialized disk 0 string \x01\xA6\x2B\xBD\x88\xC0\x8A\x4A\x4A >0x11001 byte 0x11 >>0x11003 ubyte x Apple DOS 3.%u Unbootable Image >>>0x11006 ubyte x \b, Volume #%03u >>>0x11034 ubyte x \b, %u Tracks >>>0x11035 ubyte x \b, %u Sectors >>>0x11036 uleshort x \b, %u bytes per sector # # Pascal boot loader? 0 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD >0xd6 pstring SYSTEM.APPLE >>0xb00 leshort 0x0000 >>>0xb04 leshort 0x0000 Apple Pascal Image >>>>0xb06 pstring x \b, Volume %s: >>>>0xb0e leshort x \b, %u Blocks >>>>0xb10 leshort x \b, %u Files # # Diversi Dos boot loader? 0 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD >0x11001 string \x11\x0F\x03 Apple Diversi Dos Image >>0x11006 byte x \b, Volume %u >>0x11034 byte x \b, %u Tracks >>0x11035 byte x \b, %u Sectors >>0x11036 leshort x \b, %u bytes per sector # Type: Apple Emulator 2IMG format # From: Radek Vokal <rvokal@redhat.com> # Update: Greg Wildman <greg@apple2.org.za> 0 string 2IMG Apple ][ 2IMG Disk Image >4 clear x >4 string XGS! \b, XGS >4 string CTKG \b, Catakig >4 string ShIm \b, Sheppy's ImageMaker >4 string SHEP \b, Sheppy's ImageMaker >4 string WOOF \b, Sweet 16 >4 string B2TR \b, Bernie ][ the Rescue >4 string \!nfc \b, ASIMOV2 >4 string \>BD\< \b, Brutal Deluxe's Cadius >4 string CdrP \b, CiderPress >4 string Vi][ \b, Virtual ][ >4 string PRFS \b, ProFUSE >4 string FISH \b, FishWings >4 string RVLW \b, Revival for Windows >4 default x >>4 string x \b, Creator tag "%-4.4s" >0xc byte 00 \b, DOS 3.3 sector order >>0x10 byte 00 \b, Volume 254 >>0x10 byte&0x7f x \b, Volume %u >0xc byte 01 \b, ProDOS sector order # Detect Volume Directory block ($02) + 2mg header offset >>0x440 string \x00\x00\x03\x00 >>>0x444 byte &0xF0 >>>>0x445 string x \b, Volume /%s >>>>0x469 uleshort x \b, %u Blocks >0xc byte 02 \b, NIB data # Type: Peter Ferrie QBoot # From: Greg Wildman <greg@apple2.org.za> # Ref: https://github.com/peterferrie/qboot 0 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9 >8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ QBoot Image # Type: Peter Ferrie 0Boot # From: Greg Wildman <greg@apple2.org.za> # Ref: https://github.com/peterferrie/0boot >8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ 0Boot Image # Different proprietary boot sectors 0 string \x01\x0F\x21\x74\x00\x01\x6B\x00\x02\x30\x81\x5D Apple ][ Disk Image 0 string \x01\x20\x58\xFC\xA2\x00\x8E\x78\x04\x8E\xF4\x03 Apple ][ Disk Image 0 string \x01\x20\x58\xFC\xAD\x51\xC0\xAD\x54\xC0\xA6\x2B Apple ][ Disk Image 0 string \x01\x20\x89\xFE\x20\x93\xFE\xA6\x2B\xBD\x88\xC0 Apple ][ Disk Image 0 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x25\x08\x68\x85 Apple ][ Disk Image 0 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x2D\x08\x68\x85 Apple ][ Disk Image 0 string \x01\x38\x90\x2A\xC9\x01\xF0\x33\xA8\xC8\xC0\x10 Apple ][ Disk Image 0 string \x01\x38\xB0\x03\x4C\x32\xA1\x87\x43\xC9\x03\x08 Apple ][ Disk Image 0 string \x01\x4C\x04\x08\xA9\x2A\x8D\x02\x08\x86\x2B\xEE Apple ][ Disk Image 0 string \x01\x4C\x60\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image 0 string \x01\x4C\x92\x08\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image 0 string \x01\x4C\xB3\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image 0 string \x01\x8D\xFB\x03\x8E\xFC\x03\x8C\xFD\x03\x8A\x29 Apple ][ Disk Image 0 string \x01\xA2\xFF\x9A\xD8\x20\x20\x08\x20\x34\x08\xAD Apple ][ Disk Image 0 string \x01\xA5\x27\xBD\x88\xC0\x2C\x10\xC0\xA2\x00\xA9 Apple ][ Disk Image 0 string \x01\xA5\x2B\xAE\x51\xC0\xEA\xAA\xBD\x88\xC0\x20 Apple ][ Disk Image 0 string \x01\xA6\x27\xBD\x0B\x08\x48\xBD\x0A\x08\x48\x85 Apple ][ Disk Image 0 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x01\x85 Apple ][ Disk Image 0 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x25\x85 Apple ][ Disk Image 0 string \x01\xA8\xC0\x0F\x90\x16\xF0\x12\xA0\xFF\x18\xAD Apple ][ Disk Image 0 string \x01\xA9\x00\x85\xF0\xA9\x04\x85\xF1\xA0\x00\xA9 Apple ][ Disk Image 0 string \x01\xA9\x5C\x8D\xF2\x03\xA9\xC6\x8D\xF3\x03\x49 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\x20\x2F\xFB\x20\x58\xFC Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\x20\x49\x08\xA9\x0A\x85 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\x2C\x82\xC0\xBD\x88\xC0 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\x86\x43\x8A\x4A\x4A\x4A Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\x86\xFF\xB5\x00 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\xA9\xB2\x8D\xF2\x03\xA9 Apple ][ Disk Image 0 string \x01\xA9\x60\x8D\x01\x08\xA9\xFF\x8D\xF3\x03\x8D Apple ][ Disk Image 0 string \x01\xAC\x00\x08\xF0\x19\xB9\x30\x08\x85\x3D\xCE Apple ][ Disk Image 0 string \x01\xAC\x23\x08\x30\x2E\xB9\x24\x08\x85\x3D\xCE Apple ][ Disk Image 0 string \x01\xAD\x00\x08\xC9\x09\xB0\x20\x69\x02\x8D\x00 Apple ][ Disk Image 0 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\x86\x2B\x8A\x4A Apple ][ Disk Image 0 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\xA9\xF5\x8D\xF2 Apple ][ Disk Image 0 string \x01\xB0\x00\xA9\x3F\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image 0 string \x01\xB0\x00\xA9\x48\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image 0 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x09\xC0\x8D Apple ][ Disk Image 0 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x8D\x2F\x08 Apple ][ Disk Image 0 string \x01\xD8\x2C\x81\xC0\xA9\x60\x4D\x58\xFF\xD0\xFE Apple ][ Disk Image 0 string \x01\xD8\x78\xBD\x88\xC0\xA9\xFD\x85\x37\x85\x39 Apple ][ Disk Image 0 string \x01\xE0\x60\xF0\x03\x4C\x16\x09\xAD\x00\x08\xC9 Apple ][ Disk Image 0 string \x01\xE0\x60\xF0\x03\x4C\xCB\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 0 string \x01\xE0\x60\xF0\x03\x4C\xEE\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 0 string \x01\xE0\x60\xF0\x03\x4C\xEF\x08\xAD\x00\x08\xC9 Apple ][ Disk Image 0 string \x01\xE0\x70\xB0\x04\xE0\x40\xB0\x39\xBD\x88\xC0 Apple ][ Disk Image 0 string \x01\xEA\x8D\xF4\x03\xA9\x60\x9D\x88\xC0\x8D\x51 Apple ][ Disk Image # magic for Newton PDA package formats # from Ruda Moura <ruda@helllabs.org> 0 string package0 Newton package, NOS 1.x, >12 belong &0x80000000 AutoRemove, >12 belong &0x40000000 CopyProtect, >12 belong &0x10000000 NoCompression, >12 belong &0x04000000 Relocation, >12 belong &0x02000000 UseFasterCompression, >16 belong x version %d 0 string package1 Newton package, NOS 2.x, >12 belong &0x80000000 AutoRemove, >12 belong &0x40000000 CopyProtect, >12 belong &0x10000000 NoCompression, >12 belong &0x04000000 Relocation, >12 belong &0x02000000 UseFasterCompression, >16 belong x version %d 0 string package4 Newton package, >8 byte 8 NOS 1.x, >8 byte 9 NOS 2.x, >12 belong &0x80000000 AutoRemove, >12 belong &0x40000000 CopyProtect, >12 belong &0x10000000 NoCompression, # The following entries for the Apple II are for files that have # been transferred as raw binary data from an Apple, without having # been encapsulated by any of the above archivers. # # In general, Apple II formats are hard to identify because Apple DOS # and especially Apple ProDOS have strong typing in the file system and # therefore programmers never felt much need to include type information # in the files themselves. # # Eric Fischer <enf@pobox.com> # AppleWorks word processor: # URL: https://en.wikipedia.org/wiki/AppleWorks # Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx # Update: Joerg Jenderek # NOTE: # The "O" is really the magic number, but that's so common that it's # necessary to check the tab stops that follow it to avoid false positives. # and/or look for unused bits of booleans bytes like zoom, paginated, mail merge # the newer AppleWorks is from claris with extension CWK 4 string O # test for unused bits of zoom- , paginated-boolean bytes >84 ubequad ^0x00Fe00000000Fe00 # look for tabstop definitions "=" no tab, "|" no tab # "<" left tab,"^" center tab,">" right tab, "." decimal tab, # unofficial "!" other , "\x8a" other # official only if SFMinVers is nonzero >>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor # AppleWorks Word Processor File (Apple II) # ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" # application/x-appleworks is mime type for claris version with cwk extension !:mime application/x-appleworks3 # http://home.earthlink.net/~hughhood/appleiiworksenvoy/ # ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') # $70 $1A $F8 $FF is this the apple type ? #:apple pdosp^Z\xf8\xff !:ext awp # minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) >>>183 ubyte 30 3.0 >>>183 ubyte !30 >>>>183 ubyte !0 %#x # usual tabstop start sequence "=====<" >>>5 string x \b, tabstop ruler "%6.6s" # tabstop ruler #>>>5 string >\0 \b, tabstops "%-79s" # zoom switch >>>85 byte&0x01 >0 \b, zoomed # whether paginated >>>90 byte&0x01 >0 \b, paginated # contains any mail-merge commands >>>92 byte&0x01 >0 \b, with mail merge # left margin in 1/10 inches ( normally 0 or 10 ) >>>91 ubyte >0 >>>>91 ubyte x \b, %d/10 inch left margin # AppleWorks database: # # This isn't really a magic number, but it's the closest thing to one # that I could find. The 1 and 2 really mean "order in which you defined # categories" and "left to right, top to bottom," respectively; the D and R # mean that the cursor should move either down or right when you press Return. #30 string \x01D AppleWorks database data #30 string \x02D AppleWorks database data #30 string \x01R AppleWorks database data #30 string \x02R AppleWorks database data # AppleWorks spreadsheet: # # Likewise, this isn't really meant as a magic number. The R or C means # row- or column-order recalculation; the A or M means automatic or manual # recalculation. #131 string RA AppleWorks spreadsheet data #131 string RM AppleWorks spreadsheet data #131 string CA AppleWorks spreadsheet data #131 string CM AppleWorks spreadsheet data # Applesoft BASIC: # # This is incredibly sloppy, but will be true if the program was # written at its usual memory location of 2048 and its first line # number is less than 256. Yuck. # update by Joerg Jenderek at Feb 2013 # GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) #0 belong&0xff00ff 0x80000 Applesoft BASIC program data 0 belong&0x00ff00ff 0x00080000 # assuming that line number must be positive >2 leshort >0 Applesoft BASIC program data, first line number %d #>2 leshort x \b, first line number %d # ORCA/EZ assembler: # # This will not identify ORCA/M source files, since those have # some sort of date code instead of the two zero bytes at 6 and 7 # XXX Conflicts with ELF #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data #>5 byte x \b, build number %d # Broderbund Fantavision # # I don't know what these values really mean, but they seem to recur. # Will they cause too many conflicts? # Probably :-) #2 belong&0xFF00FF 0x040008 Fantavision movie data # Some attempts at images. # # These are actually just bit-for-bit dumps of the frame buffer, so # there's really no reasonably way to distinguish them except for their # address (if preserved) -- 8192 or 16384 -- and their length -- 8192 # or, occasionally, 8184. # # Nevertheless this will manage to catch a lot of images that happen # to have a solid-colored line at the bottom of the screen. # GRR: Magic too weak #8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background #8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background #8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background #8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background #8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background # Beagle Bros. Apple Mechanic fonts 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font # Apple Universal Disk Image Format (UDIF) - dmg files. # From Johan Gade. # These entries are disabled for now until we fix the following issues. # # Note there might be some problems with the "VAX COFF executable" # entry. Note this entry should be placed before the mac filesystem section, # particularly the "Apple Partition data" entry. # # The intended meaning of these tests is, that the file is only of the # specified type if both of the lines are correct - i.e. if the first # line matches and the second doesn't then it is not of that type. # #0 long 0x7801730d #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) # # Note that this entry is recognized correctly by the "Apple Partition # data" entry - however since this entry is more specific - this # information seems to be more useful. #0 long 0x45520200 #>0x410 string disk\ image UDIF read/write image (UDRW) # From: Toby Peterson <toby@apple.com> # From https://www.nationalarchives.gov.uk/pronom/fmt/866 0 string bplist00 >8 search/500 WebMainResource Apple Safari Webarchive !:mime application/x-webarchive !:strength +50 0 string bplist00 Apple binary property list !:mime application/x-bplist # Apple binary property list (bplist) # Assumes version bytes are hex. # Provides content hints for version 0 files. Assumes that the root # object is the first object (true for CoreFoundation implementation). # From: David Remahl <dremahl@apple.com> 0 string bplist >6 byte x CoreFoundation binary property list data, version %#c >>7 byte x \b%c >>6 string 00 \b >>>8 byte&0xF0 0x00 \b >>>>8 byte&0x0F 0x00 \b, root type: null >>>>8 byte&0x0F 0x08 \b, root type: false boolean >>>>8 byte&0x0F 0x09 \b, root type: true boolean >>>8 byte&0xF0 0x10 \b, root type: integer >>>8 byte&0xF0 0x20 \b, root type: real >>>8 byte&0xF0 0x30 \b, root type: date >>>8 byte&0xF0 0x40 \b, root type: data >>>8 byte&0xF0 0x50 \b, root type: ascii string >>>8 byte&0xF0 0x60 \b, root type: unicode string >>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) >>>8 byte&0xF0 0xa0 \b, root type: array >>>8 byte&0xF0 0xd0 \b, root type: dictionary # Apple/NeXT typedstream data # Serialization format used by NeXT and Apple for various # purposes in YellowStep/Cocoa, including some nib files. # From: David Remahl <dremahl@apple.com> 2 string typedstream NeXT/Apple typedstream data, big endian >0 byte x \b, version %d >0 byte <5 \b >>13 byte 0x81 \b >>>14 ubeshort x \b, system %d 2 string streamtyped NeXT/Apple typedstream data, little endian >0 byte x \b, version %d >0 byte <5 \b >>13 byte 0x81 \b >>>14 uleshort x \b, system %d #------------------------------------------------------------------------------ # CAF: Apple CoreAudio File Format # # Container format for high-end audio purposes. # From: David Remahl <dremahl@apple.com> # 0 string caff CoreAudio Format audio file >4 beshort <10 version %d #------------------------------------------------------------------------------ # Keychain database files 0 string kych Mac OS X Keychain File #------------------------------------------------------------------------------ # Code Signing related file types 0 belong 0xfade0c00 Mac OS X Code Requirement >8 belong 1 (opExpr) >4 belong x - %d bytes 0 belong 0xfade0c01 Mac OS X Code Requirement Set >8 belong >1 containing %d items >4 belong x - %d bytes 0 belong 0xfade0c02 Mac OS X Code Directory >8 belong x version %x >12 belong >0 flags %#x >4 belong x - %d bytes 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) >4 belong x - %d bytes 0 belong 0xfade0cc1 Mac OS X Detached Code Signature >8 belong >1 (%d elements) >4 belong x - %d bytes # From: "Nelson A. de Oliveira" <naoliv@gmail.com> # .vdi 4 string innotek\ VirtualBox\ Disk\ Image %s # Apple disk partition stuff # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map # Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h # Update: Joerg Jenderek # "ER" is APPLE_DRVR_MAP_MAGIC signature 0 beshort 0x4552 # display Apple Driver Map (strength=50) after Syslinux bootloader (71) #!:strength +0 # strengthen the magic by looking for used blocksizes 512 2048 >2 ubeshort&0xf1FF 0 Apple Driver Map # last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid #>>504 ubequad&0x0000FFffFFff0000 0 !:mime application/x-apple-diskimage !:apple ????devr # https://en.wikipedia.org/wiki/Apple_Disk_Image !:ext dmg/iso # sbBlkSize for driver descriptor map 512 2048 >>2 beshort x \b, blocksize %d # sbBlkCount sometimes garbish like # 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg # 0xf2720100 for bunziped Firefox 48.0-2.dmg # 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso # 0x00009090 by syslinux-6.03/utils/isohybrid.c >>4 ubelong x \b, blockcount %u # following device/driver information not very useful # device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>8 ubeshort x \b, devtype %u # device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>10 ubeshort x \b, devid %u # driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>12 ubelong >0 >>>12 ubelong x \b, driver data %u # number of driver descriptors sbDrvrCount <= 61 # (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) >>16 ubeshort x \b, driver count %u # 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map # >>18 use apple-driver-map # >>26 use apple-driver-map # # ... # >>500 use apple-driver-map # number of partitions is always same in every partition (map block count) #>>0x0204 ubelong x \b, %u partitions >>0x0204 ubelong >0 \b, contains[@0x200]: >>>0x0200 use apple-apm >>0x0204 ubelong >1 \b, contains[@0x400]: >>>0x0400 use apple-apm >>0x0204 ubelong >2 \b, contains[@0x600]: >>>0x0600 use apple-apm >>0x0204 ubelong >3 \b, contains[@0x800]: >>>0x0800 use apple-apm >>0x0204 ubelong >4 \b, contains[@0xA00]: >>>0x0A00 use apple-apm >>0x0204 ubelong >5 \b, contains[@0xC00]: >>>0x0C00 use apple-apm >>0x0204 ubelong >6 \b, contains[@0xE00]: >>>0x0E00 use apple-apm >>0x0204 ubelong >7 \b, contains[@0x1000]: >>>0x1000 use apple-apm # display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 0 name apple-driver-map >0 ubequad !0 # descBlock first block of driver >>0 ubelong x \b, driver start block %u # descSize driver size in blocks >>4 ubeshort x \b, size %u # descType driver system type 1 701h F8FFh FFFFh >>6 ubeshort x \b, type %#x # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map # Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h # Update: Joerg Jenderek # Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the # magic stronger. # for apple partition map stored as a single file 0 belong 0x504d0000 # to display Apple Partition Map (strength=70) after Syslinux bootloader (71) #!:strength +0 >0 use apple-apm # magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type # file: could not find any valid magic files! #!:ext bin # display apple partition map. Normally called after Apple driver map 0 name apple-apm >0 belong 0x504d0000 Apple Partition Map # number of partitions >>4 ubelong x \b, map block count %u # logical block (512 bytes) start of partition >>8 ubelong x \b, start block %u >>12 ubelong x \b, block count %u >>16 string >0 \b, name %s >>48 string >0 \b, type %s # processor type dpme_process_id[16] e.g. "68000" "68020" >>120 string >0 \b, processor %s # A/UX boot arguments BootArgs[128] >>136 string >0 \b, boot arguments %s # status of partition dpme_flags >>88 belong & 1 \b, valid >>88 belong & 2 \b, allocated >>88 belong & 4 \b, in use >>88 belong & 8 \b, has boot info >>88 belong & 16 \b, readable >>88 belong & 32 \b, writable >>88 belong & 64 \b, pic boot code >>88 belong & 128 \b, chain compatible driver >>88 belong & 256 \b, real driver >>88 belong & 512 \b, chain driver # mount automatically at startup APPLE_PS_AUTO_MOUNT >>88 ubelong &0x40000000 \b, mount at startup # is the startup partition APPLE_PS_STARTUP >>88 ubelong &0x80000000 \b, is the startup partition #https://wiki.mozilla.org/DS_Store_File_Format #https://en.wikipedia.org/wiki/.DS_Store 0 string \0\0\0\1Bud1\0 Apple Desktop Services Store # HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) # Usually not in separate files, but have either filename rsrc with # no extension, or a filename corresponding to another file, with # extensions rsr/rsrc # URL: http://fileformats.archiveteam.org/wiki/Macintosh_resource_file # https://en.wikipedia.org/wiki/Resource_fork # Reference: https://github.com/kreativekorp/ksfl/wiki/Macintosh-Resource-File-Format # http://developer.apple.com/legacy/mac/library/documentation/mac/pdf/MoreMacintoshToolbox.pdf # https://formats.kaitai.io/resource_fork/ # Update: Joerg Jenderek # Note: verified often by command like `deark -m macrsrc Icon_.rsrc` # offset of resource data; usually starts at offset 0x0100 0 string \000\000\001\000 # skip NPETraceSession.etl with invalid "low" map offset 0 >4 ubelong >0xFF # skip few Atari DEGAS Elite bitmap (eil2.pi1 nastro.pi1) with ivalid "high" 0x6550766 0x7510763 map length >>12 ubelong <0x8001 # most examples with zeroed system reserved field >>>16 lelong =0 >>>>0 use apple-rsr # few samples with not zeroed system reserved field like: Empty.rsrc.rsr OpenSans-CondBold.dfont >>>16 lelong !0 # resource fork variant with not zeroed system reserved field and copy of header >>>>(4.L) ubelong 0x100 # GRR: the line above only works if in ../../src/file.h FILE_BYTES_MAX is raised from 1 MiB above 0x6ab0f4 (HelveticaNeue.dfont) >>>>>0 use apple-rsr # data fork variant with not zeroed system reserved field and no copy of header >>>>(4.L) ubelong 0 >>>>>0 use apple-rsr # Note: moved and merged from ./macintosh # From: Adam Buchbinder <adam.buchbinder@gmail.com> # URL: https://en.wikipedia.org/wiki/Datafork_TrueType # Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is # TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I # don't know what they mean. # display information about Mac OSX datafork font DFONT 0 name apple-dfont >(4.L+30) ubelong x Mac OSX datafork font, # https://en.wikipedia.org/wiki/Datafork_TrueType !:mime application/x-dfont !:ext dfont # https://exiftool.org/TagNames/RSRC.html >(4.L+30) ubelong 0x73666e74 TrueType >(4.L+30) ubelong 0x464f4e54 'FONT' >(4.L+30) ubelong 0x4e464e54 'NFNT' >(4.L+30) ubelong 0x504f5354 PostScript >(4.L+30) ubelong 0x464f4e44 'FOND' >(4.L+30) ubelong 0x76657273 'vers' # display information about Macintosh resource 0 name apple-rsr >(4.L+30) ubelong 0x73666e74 >>0 use apple-dfont >(4.L+30) ubelong 0x464f4e54 >>0 use apple-dfont >(4.L+30) ubelong 0x4e464e54 >>0 use apple-dfont >(4.L+30) ubelong 0x504f5354 >>0 use apple-dfont >(4.L+30) ubelong 0x464f4e44 >>0 use apple-dfont >(4.L+30) ubelong 0x76657273 >>0 use apple-dfont >(4.L+30) default x Apple HFS/HFS+ resource fork #!:mime application/octet-stream !:mime application/x-apple-rsr !:ext rsrc/rsr # offset to resource data; usually starts at offset 0x0100 >0 ubelong !0x100 \b, data offset %#x # offset to resource map; positive but not nil like in NPETraceSession.etl >4 ubelong x \b, map offset %#x # length of resource map; positive with 32K limitation but not # nil like in NPETraceSession.etl or high like 0x7510763 in nastro.pi1 >12 ubelong x \b, map length %#x # length of resource data; positive but not nil like in NPETraceSession.etl >8 ubelong x \b, data length %#x # reserved 112 bytes for system use; apparently often nil, but 8fd20000h in Empty.rsrc.rsr and 0x00768c2b in OpenSans-CondBold.dfont >16 ubelong !0 \b, at 16 %#8.8x # https://fontforge.org/docs/techref/macformats.html # jump to resource map # a copy of resource header or 16 bytes of zeros for data fork #>(4.L) ubelong x \b, DATA offset %#x #>(4.L+4) ubelong x \b, MAP offset %#x #>(4.L+8) ubelong x \b, DATA length %#x #>(4.L+12) ubelong x \b, MAP length %#x # nextResourceMap; handle to next resource map; used by the Resource Manager for internal bookkeeping; should be zero >(4.L+16) ubelong !0 \b, nextResourceMap %#x # fileRef; file reference number; used by the Resource Manager for internal bookkeeping; should be zero >(4.L+20) ubeshort !0 \b, fileRef %#x # attributes; Resource fork attributes (80h~read-only 40h~compression needed 20h~changed); other bits are reserved and should be zero >(4.L+22) ubeshort !0 \b, attributes %#x # typeListOffset; offset from resource map to start of type list like: 1Ch >(4.L+24) ubeshort x \b, list offset %#x # nameListOffset; offset from esource map to start of name list like: 32h 46h 56h (XLISP.RSR XLISPTIN.RSR) 13Eh (HelveticaNeue.dfont) >(4.L+26) ubeshort x \b, name offset %#x # typeCount; number of types in the map minus 1; If there are no resources, this is 0xFFFF >(4.L+28) beshort+1 >0 \b, %u type # plural s >>(4.L+28) beshort+1 >1 \bs # resource type list array; 1st resource type like: ALRT CODE FOND MPSR icns scsz >>(4.L+30) ubelong x \b, %#x >>(4.L+30) string x '%-.4s' # resourceCount; number of this type resources minus one. If there is one resource of this type, this is 0x0000 >>(4.L+34) beshort+1 x * %d # resourceListOffset; offset from type list to resource list like: Ah 12h DAh >(4.L+36) ubeshort x resource offset %#x #https://en.wikipedia.org/wiki/AppleScript 0 string FasdUAS AppleScript compiled # AppleWorks/ClarisWorks # https://github.com/joshenders/appleworks_format # http://fileformats.archiveteam.org/wiki/AppleWorks 0 name appleworks >0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document >0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document >0 default x >>0 belong x AppleWorks/ClarisWorks CWK Document >0 byte x \b, version %d >30 beshort x \b, %d >32 beshort x \bx%d !:ext cwk 4 string BOBO >0 byte >4 >>12 belong 0 >>>26 belong 0 >>>>0 use appleworks >0 belong 0x0481ad00 >>0 use appleworks # magic for Apple File System (APFS) # from Alex Myczko <alex@aiei.ch> 32 string NXSB Apple File System (APFS) >36 ulelong x \b, blocksize %u # iTunes cover art (versions 1 and 2) 4 string itch >24 string artw >>0x1e8 string data iTunes cover art >>>0x1ed string PNG (PNG) >>>0x1ec beshort 0xffd8 (JPEG) # MacPaint image 65 string PNTGMPNT MacPaint image data, MacBinary-wrapped !:mime image/x-macpaint !:ext mac/macp/pntg 0 belong 0x00000002 >4 belong 0xFFFFFFFF MacPaint image data, version 2 !:mime image/x-macpaint !:ext mac/macp/pntg 0 belong 0x00000003 >4 belong 0xFFFFFFFF MacPaint image data, version 3 !:mime image/x-macpaint !:ext mac/macp/pntg # Apple Sparse Disk Image # Located at the start of the file 0 string sprs Apple Sparse Disk Image >4 belong >0 \b, version %d >8 belong &0x01 \b, growable >8 belong &0x02 \b, layout-fixed >8 belong &0x04 \b, encrypted >8 belong &0x08 \b, kernel-managed >8 belong >0 \b, (flags %#x) >12 belong >0 \b, block size: %d >24 bequad >0 \b, capacity: %lld bytes # DMG image -512 string koly >-504 belong 512 Apple DMG >>-508 belong x \b, version %d