diff options
Diffstat (limited to 'contrib/file/Magdir/macintosh')
| -rw-r--r-- | contrib/file/Magdir/macintosh | 337 |
1 files changed, 179 insertions, 158 deletions
diff --git a/contrib/file/Magdir/macintosh b/contrib/file/Magdir/macintosh index 277cb6b..91364a0 100644 --- a/contrib/file/Magdir/macintosh +++ b/contrib/file/Magdir/macintosh @@ -88,7 +88,8 @@ # that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second # be 0x81. This works for the files I have, but maybe not for everyone's. -122 beshort&0xFCFF 0x8081 Macintosh MacBinary data +# Unfortunately, this magic is quite weak - MPi +#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data # MacBinary I doesn't have the version number field at all, but MacBinary II # has been in use since 1987 so I hope there aren't many really old files @@ -111,117 +112,117 @@ # >73 byte&0x10 0x40 \b, invisible # >73 byte&0x10 0x80 \b, locked ->65 string x \b, type "%4.4s" +#>65 string x \b, type "%4.4s" ->65 string 8BIM (PhotoShop) ->65 string ALB3 (PageMaker 3) ->65 string ALB4 (PageMaker 4) ->65 string ALT3 (PageMaker 3) ->65 string APPL (application) ->65 string AWWP (AppleWorks word processor) ->65 string CIRC (simulated circuit) ->65 string DRWG (MacDraw) ->65 string EPSF (Encapsulated PostScript) ->65 string FFIL (font suitcase) ->65 string FKEY (function key) ->65 string FNDR (Macintosh Finder) ->65 string GIFf (GIF image) ->65 string Gzip (GNU gzip) ->65 string INIT (system extension) ->65 string LIB\ (library) ->65 string LWFN (PostScript font) ->65 string MSBC (Microsoft BASIC) ->65 string PACT (Compact Pro archive) ->65 string PDF\ (Portable Document Format) ->65 string PICT (picture) ->65 string PNTG (MacPaint picture) ->65 string PREF (preferences) ->65 string PROJ (Think C project) ->65 string QPRJ (Think Pascal project) ->65 string SCFL (Defender scores) ->65 string SCRN (startup screen) ->65 string SITD (StuffIt Deluxe) ->65 string SPn3 (SuperPaint) ->65 string STAK (HyperCard stack) ->65 string Seg\ (StuffIt segment) ->65 string TARF (Unix tar archive) ->65 string TEXT (ASCII) ->65 string TIFF (TIFF image) ->65 string TOVF (Eudora table of contents) ->65 string WDBN (Microsoft Word word processor) ->65 string WORD (MacWrite word processor) ->65 string XLS\ (Microsoft Excel) ->65 string ZIVM (compress (.Z)) ->65 string ZSYS (Pre-System 7 system file) ->65 string acf3 (Aldus FreeHand) ->65 string cdev (control panel) ->65 string dfil (Desk Acessory suitcase) ->65 string libr (library) ->65 string nX^d (WriteNow word processor) ->65 string nX^w (WriteNow dictionary) ->65 string rsrc (resource) ->65 string scbk (Scrapbook) ->65 string shlb (shared library) ->65 string ttro (SimpleText read-only) ->65 string zsys (system file) +#>65 string 8BIM (PhotoShop) +#>65 string ALB3 (PageMaker 3) +#>65 string ALB4 (PageMaker 4) +#>65 string ALT3 (PageMaker 3) +#>65 string APPL (application) +#>65 string AWWP (AppleWorks word processor) +#>65 string CIRC (simulated circuit) +#>65 string DRWG (MacDraw) +#>65 string EPSF (Encapsulated PostScript) +#>65 string FFIL (font suitcase) +#>65 string FKEY (function key) +#>65 string FNDR (Macintosh Finder) +#>65 string GIFf (GIF image) +#>65 string Gzip (GNU gzip) +#>65 string INIT (system extension) +#>65 string LIB\ (library) +#>65 string LWFN (PostScript font) +#>65 string MSBC (Microsoft BASIC) +#>65 string PACT (Compact Pro archive) +#>65 string PDF\ (Portable Document Format) +#>65 string PICT (picture) +#>65 string PNTG (MacPaint picture) +#>65 string PREF (preferences) +#>65 string PROJ (Think C project) +#>65 string QPRJ (Think Pascal project) +#>65 string SCFL (Defender scores) +#>65 string SCRN (startup screen) +#>65 string SITD (StuffIt Deluxe) +#>65 string SPn3 (SuperPaint) +#>65 string STAK (HyperCard stack) +#>65 string Seg\ (StuffIt segment) +#>65 string TARF (Unix tar archive) +#>65 string TEXT (ASCII) +#>65 string TIFF (TIFF image) +#>65 string TOVF (Eudora table of contents) +#>65 string WDBN (Microsoft Word word processor) +#>65 string WORD (MacWrite word processor) +#>65 string XLS\ (Microsoft Excel) +#>65 string ZIVM (compress (.Z)) +#>65 string ZSYS (Pre-System 7 system file) +#>65 string acf3 (Aldus FreeHand) +#>65 string cdev (control panel) +#>65 string dfil (Desk Acessory suitcase) +#>65 string libr (library) +#>65 string nX^d (WriteNow word processor) +#>65 string nX^w (WriteNow dictionary) +#>65 string rsrc (resource) +#>65 string scbk (Scrapbook) +#>65 string shlb (shared library) +#>65 string ttro (SimpleText read-only) +#>65 string zsys (system file) ->69 string x \b, creator "%4.4s" +#>69 string x \b, creator "%4.4s" # Somewhere, Apple has a repository of registered Creator IDs. These are # just the ones that I happened to have files from and was able to identify. ->69 string 8BIM (Adobe Photoshop) ->69 string ALD3 (PageMaker 3) ->69 string ALD4 (PageMaker 4) ->69 string ALFA (Alpha editor) ->69 string APLS (Apple Scanner) ->69 string APSC (Apple Scanner) ->69 string BRKL (Brickles) ->69 string BTFT (BitFont) ->69 string CCL2 (Common Lisp 2) ->69 string CCL\ (Common Lisp) ->69 string CDmo (The Talking Moose) ->69 string CPCT (Compact Pro) ->69 string CSOm (Eudora) ->69 string DMOV (Font/DA Mover) ->69 string DSIM (DigSim) ->69 string EDIT (Macintosh Edit) ->69 string ERIK (Macintosh Finder) ->69 string EXTR (self-extracting archive) ->69 string Gzip (GNU gzip) ->69 string KAHL (Think C) ->69 string LWFU (LaserWriter Utility) ->69 string LZIV (compress) ->69 string MACA (MacWrite) ->69 string MACS (Macintosh operating system) ->69 string MAcK (MacKnowledge terminal emulator) ->69 string MLND (Defender) ->69 string MPNT (MacPaint) ->69 string MSBB (Microsoft BASIC (binary)) ->69 string MSWD (Microsoft Word) ->69 string NCSA (NCSA Telnet) ->69 string PJMM (Think Pascal) ->69 string PSAL (Hunt the Wumpus) ->69 string PSI2 (Apple File Exchange) ->69 string R*ch (BBEdit) ->69 string RMKR (Resource Maker) ->69 string RSED (Resource Editor) ->69 string Rich (BBEdit) ->69 string SIT! (StuffIt) ->69 string SPNT (SuperPaint) ->69 string Unix (NeXT Mac filesystem) ->69 string VIM! (Vim editor) ->69 string WILD (HyperCard) ->69 string XCEL (Microsoft Excel) ->69 string aCa2 (Fontographer) ->69 string aca3 (Aldus FreeHand) ->69 string dosa (Macintosh MS-DOS file system) ->69 string movr (Font/DA Mover) ->69 string nX^n (WriteNow) ->69 string pdos (Apple ProDOS file system) ->69 string scbk (Scrapbook) ->69 string ttxt (SimpleText) ->69 string ufox (Foreign File Access) +#>69 string 8BIM (Adobe Photoshop) +#>69 string ALD3 (PageMaker 3) +#>69 string ALD4 (PageMaker 4) +#>69 string ALFA (Alpha editor) +#>69 string APLS (Apple Scanner) +#>69 string APSC (Apple Scanner) +#>69 string BRKL (Brickles) +#>69 string BTFT (BitFont) +#>69 string CCL2 (Common Lisp 2) +#>69 string CCL\ (Common Lisp) +#>69 string CDmo (The Talking Moose) +#>69 string CPCT (Compact Pro) +#>69 string CSOm (Eudora) +#>69 string DMOV (Font/DA Mover) +#>69 string DSIM (DigSim) +#>69 string EDIT (Macintosh Edit) +#>69 string ERIK (Macintosh Finder) +#>69 string EXTR (self-extracting archive) +#>69 string Gzip (GNU gzip) +#>69 string KAHL (Think C) +#>69 string LWFU (LaserWriter Utility) +#>69 string LZIV (compress) +#>69 string MACA (MacWrite) +#>69 string MACS (Macintosh operating system) +#>69 string MAcK (MacKnowledge terminal emulator) +#>69 string MLND (Defender) +#>69 string MPNT (MacPaint) +#>69 string MSBB (Microsoft BASIC (binary)) +#>69 string MSWD (Microsoft Word) +#>69 string NCSA (NCSA Telnet) +#>69 string PJMM (Think Pascal) +#>69 string PSAL (Hunt the Wumpus) +#>69 string PSI2 (Apple File Exchange) +#>69 string R*ch (BBEdit) +#>69 string RMKR (Resource Maker) +#>69 string RSED (Resource Editor) +#>69 string Rich (BBEdit) +#>69 string SIT! (StuffIt) +#>69 string SPNT (SuperPaint) +#>69 string Unix (NeXT Mac filesystem) +#>69 string VIM! (Vim editor) +#>69 string WILD (HyperCard) +#>69 string XCEL (Microsoft Excel) +#>69 string aCa2 (Fontographer) +#>69 string aca3 (Aldus FreeHand) +#>69 string dosa (Macintosh MS-DOS file system) +#>69 string movr (Font/DA Mover) +#>69 string nX^n (WriteNow) +#>69 string pdos (Apple ProDOS file system) +#>69 string scbk (Scrapbook) +#>69 string ttxt (SimpleText) +#>69 string ufox (Foreign File Access) # Just in case... @@ -236,6 +237,14 @@ >24 string CATALOG catalog >24 string INDEX data file index >24 string VIEW data view +# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) +# +0x54 string SAS SAS 7+ +>0x9C string DATA data file +>0x9C string CATALOG catalog +>0x9C string INDEX data file index +>0x9C string VIEW data view + # spss magic for SPSS system and portable files, # from Bruce Foster (bef@nwu.edu). @@ -247,6 +256,7 @@ # Macintosh filesystem data # From "Tom N Harris" <telliamed@mac.com> +# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these # entries depend on the data arithmetic added after v.35 # There's also some Pascal strings in here, ditto... @@ -266,39 +276,39 @@ >0x412 beshort x number of blocks: %d, >0x424 pstring x volume name: %s -0x400 beshort 0x4244 Macintosh HFS data ->0 beshort 0x4C4B (bootable) ->0x40a beshort &0x8000 (locked) ->0x40a beshort ^0x0100 (mounted) ->0x40a beshort &0x0800 (unclean) ->0x402 beldate-0x7C25B080 x created: %s, ->0x406 beldate-0x7C25B080 x last modified: %s, ->0x440 beldate-0x7C25B080 >0 last backup: %s, ->0x414 belong x block size: %d, ->0x412 beshort x number of blocks: %d, ->0x424 pstring x volume name: %s -#>0x480 beshort =0x482B Embedded HFS+ Volume: -#>>((0x482*(0x414))+(0x41c*512)) x \b -# Well, this is (theoretically) how we could do this. But it occurs to -# me that we likely don't read in a large enough chunk. I don't have any -# HFS+ volumes to see what a typical offset would be. +# "BD" is has many false positives +#0x400 beshort 0x4244 Macintosh HFS data +#>0 beshort 0x4C4B (bootable) +#>0x40a beshort &0x8000 (locked) +#>0x40a beshort ^0x0100 (mounted) +#>0x40a beshort &0x0200 (spared blocks) +#>0x40a beshort &0x0800 (unclean) +#>0x47C beshort 0x482B (Embedded HFS+ Volume) +#>0x402 beldate-0x7C25B080 x created: %s, +#>0x406 beldate-0x7C25B080 x last modified: %s, +#>0x440 beldate-0x7C25B080 >0 last backup: %s, +#>0x414 belong x block size: %d, +#>0x412 beshort x number of blocks: %d, +#>0x424 pstring x volume name: %s 0x400 beshort 0x482B Macintosh HFS Extended ->&2 beshort x version %d data +>&0 beshort x version %d data >0 beshort 0x4C4B (bootable) ->&4 belong ^0x00000100 (mounted) ->&4 belong &0x00000800 (unclean) ->&4 belong &0x00008000 (locked) ->&8 string x last mounted by: '%.4s', +>0x404 belong ^0x00000100 (mounted) +>&2 belong &0x00000200 (spared blocks) +>&2 belong &0x00000800 (unclean) +>&2 belong &0x00008000 (locked) +>&6 string x last mounted by: '%.4s', # really, that should be treated as a belong and we print a string # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" ->&16 beldate-0x7C25B080 x created: %s, ->&20 beldate-0x7C25B080 x last modified: %s, ->&24 beldate-0x7C25B080 >0 last backup: %s, ->&28 beldate-0x7C25B080 >0 last checked: %s, ->&40 belong x block size: %d, ->&44 belong x number of blocks: %d, ->&48 belong x free blocks: %d +>&14 beldate-0x7C25B080 x created: %s, +# only the creation date is local time, all other timestamps in HFS+ are UTC. +>&18 bedate-0x7C25B080 x last modified: %s, +>&22 bedate-0x7C25B080 >0 last backup: %s, +>&26 bedate-0x7C25B080 >0 last checked: %s, +>&38 belong x block size: %d, +>&42 belong x number of blocks: %d, +>&46 belong x free blocks: %d # I don't think this is really necessary since it doesn't do much and # anything with a valid driver descriptor will also have a valid @@ -311,29 +321,40 @@ # cstring. Of course, partitions can contain more than four entries, but # what're you gonna do? 0x200 beshort 0x504D Apple Partition data ->&2 beshort x block size: %d ->&48 string x first type: %s, ->&12 belong x number of blocks: %d, ->(&0x2.S) beshort 0x504D ->>&48 string x second type: %s ->>&12 belong x number of blocks: %d, ->>(&0x2.S) beshort 0x504D ->>>&48 string x third type: %s ->>>&12 belong x number of blocks: %d, ->>>(&0x2.S) beshort 0x504D ->>>>&48 string x fourth type: %s ->>>>&12 belong x number of blocks: %d, +>0x2 beshort x block size: %d, +>0x230 string x first type: %s, +>0x210 string x name: %s, +>0x254 belong x number of blocks: %d, +>0x400 beshort 0x504D +>>0x430 string x second type: %s, +>>0x410 string x name: %s, +>>0x454 belong x number of blocks: %d, +>>0x800 beshort 0x504D +>>>0x830 string x third type: %s, +>>>0x810 string x name: %s, +>>>0x854 belong x number of blocks: %d, +>>>0xa00 beshort 0x504D +>>>>0xa30 string x fourth type: %s, +>>>>0xa10 string x name: %s, +>>>>0xa54 belong x number of blocks: %d # AFAIK, only the signature is different 0x200 beshort 0x5453 Apple Old Partition data ->&2 beshort x block size: %d ->&48 string x first type: %s, ->&12 belong x number of blocks: %d, ->(&0x2.S) beshort 0x504D ->>&48 string x second type: %s ->>&12 belong x number of blocks: %d, ->>(&0x2.S) beshort 0x504D ->>>&48 string x third type: %s ->>>&12 belong x number of blocks: %d, ->>>(&0x2.S) beshort 0x504D ->>>>&48 string x fourth type: %s ->>>>&12 belong x number of blocks: %d, +>0x2 beshort x block size: %d, +>0x230 string x first type: %s, +>0x210 string x name: %s, +>0x254 belong x number of blocks: %d, +>0x400 beshort 0x504D +>>0x430 string x second type: %s, +>>0x410 string x name: %s, +>>0x454 belong x number of blocks: %d, +>>0x800 beshort 0x504D +>>>0x830 string x third type: %s, +>>>0x810 string x name: %s, +>>>0x854 belong x number of blocks: %d, +>>>0xa00 beshort 0x504D +>>>>0xa30 string x fourth type: %s, +>>>>0xa10 string x name: %s, +>>>>0xa54 belong x number of blocks: %d + +# From: Remi Mommsen <mommsen@slac.stanford.edu> +0 string BOMStore Mac OS X bill of materials (BOM) fil |
