Adding upstream version 1:5.45.upstream/1%5.45upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 773 insertions, 0 deletions

diff --git a/magic/Magdir/apple b/magic/Magdir/apple
new file mode 100644
index 0000000..547b0ac
--- /dev/null
+++ b/magic/Magdir/apple
@@ -0,0 +1,773 @@
+
+#------------------------------------------------------------------------------
+# $File: apple,v 1.48 2023/05/01 14:20:21 christos Exp $
+# apple:  file(1) magic for Apple file formats
+#
+0	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
+0	string		\x0aGL			Binary II (apple ][) data
+0	string		\x76\xff		Squeezed (apple ][) data
+0	string		NuFile			NuFile archive (apple ][) data
+0	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
+0	belong		0x00051600		AppleSingle encoded Macintosh file
+0	belong		0x00051607		AppleDouble encoded Macintosh file
+
+# Type: Apple Emulator A2R format
+# From: Greg Wildman <greg@apple2.org.za>
+# Ref: https://applesaucefdc.com/a2r2-reference/
+# Ref: https://applesaucefdc.com/a2r/
+0	string		A2R
+>3	string		\x31\xFF\x0A\x0D\x0A	Applesauce A2R 1.x Disk Image
+>3	string		\x32\xFF\x0A\x0D\x0A	Applesauce A2R 2.x Disk Image
+>3	string		\x33\xFF\x0A\x0D\x0A	Applesauce A2R 3.x Disk Image
+>8	string		INFO
+>>49	byte		01			\b, 5.25″ SS 40trk
+>>49	byte		02			\b, 3.5″ DS 80trk
+>>49	byte		03			\b, 5.25″ DS 80trk
+>>49	byte		04			\b, 5.25″ DS 40trk
+>>49	byte		05			\b, 3.5″ DS 80trk
+>>49	byte		06			\b, 8″ DS
+>>50	byte		01			\b, write protected
+>>51	byte		01			\b, cross track synchronized
+>>17	string/T	x			\b, %.32s
+
+# Type: Apple Emulator WOZ format
+# From: Greg Wildman <greg@apple2.org.za>
+# Ref: https://applesaucefdc.com/woz/reference/
+# Ref: https://applesaucefdc.com/woz/reference2/
+0	string		WOZ
+>3	string		\x31\xFF\x0A\x0D\x0A	Apple ][ WOZ 1.0 Disk Image
+>3	string		\x32\xFF\x0A\x0D\x0A	Apple ][ WOZ 2.0 Disk Image
+>12	string		INFO
+>>21	byte		01			\b, 5.25 inch
+>>21	byte		02			\b, 3.5 inch
+>>22	byte		01			\b, write protected
+>>23	byte		01			\b, cross track synchronized
+>>25	string/T	x			\b, %.32s
+
+# Type: Apple Macintosh Emulator MOOF format
+# From: Greg Wildman <greg@apple2.org.za>
+# Ref: https://applesaucefdc.com/moof-reference/
+0	string		MOOF
+>4	string		\xFF\x0A\x0D\x0A	Apple Macintosh MOOF Disk Image
+>12	string		INFO
+>>21	byte		01			\b, SSDD GCR (400K)
+>>21	byte		02			\b, DSDD GCR (800K)
+>>21	byte		03			\b, DSHD MFM (1.44M)
+>>22	byte		01			\b, write protected
+>>23	byte		01			\b, cross track synchronized
+>>25	string/T	x			\b, %.32s
+
+# Type: Apple Emulator disk images
+# From: Greg Wildman <greg@apple2.org.za>
+# ProDOS boot loader?
+0		string	\x01\x38\xB0\x03\x4C	Apple ProDOS Image
+# Detect Volume Directory block ($02)
+>0x400		string	\x00\x00\x03\x00
+>>0x404		byte	&0xF0
+>>>0x405	string	x			\b, Volume /%s
+>>>0x429	uleshort	x		\b, %u Blocks
+# ProDOS ordered ?
+>0xb00		string	\x00\x00\x03\x00
+>>0xb04		byte	&0xF0
+>>>0xb05	string	x			\b, Volume /%s
+>>>0xb29	uleshort	x		\b, %u Blocks
+#
+# Proboot HD
+0		string	\x01\x8A\x48\xD8\x2C\x82\xC0\x8D\x0E\xC0\x8D\x0C	Apple ProDOS ProBoot Image
+>0x400		string	\x00\x00\x03\x00
+>>0x404		byte	&0xF0
+>>>0x405	string	x			\b, Volume /%s
+>>>0x429	uleshort	x		\b, %u Blocks
+>0xb00		string	\x00\x00\x03\x00
+>>0xb04		byte	&0xF0
+>>>0xb05	string	x			\b, Volume /%s
+>>>0xb29	uleshort	x		\b, %u Blocks
+0		string	\x01\xA8\x8A\x20\x7B\xF8\x29\x07\x09\xC0\x99\x30	Apple ProDOS ProBoot Image
+>0x400		string	\x00\x00\x03\x00
+>>0x404		byte	&0xF0
+>>>0x405	string	x			\b, Volume /%s
+>>>0x429	uleshort	x		\b, %u Blocks
+>0xb00		string	\x00\x00\x03\x00
+>>0xb04		byte	&0xF0
+>>>0xb05	string	x			\b, Volume /%s
+>>>0xb29	uleshort	x		\b, %u Blocks
+0		string	\x01\x4A\xD0\x34\xE6\x3D\x8A\x20\x7B\xF8\x09\xC0	Apple ProDOS ProBoot Image
+>0x400		string	\x00\x00\x03\x00
+>>0x404		byte	&0xF0
+>>>0x405	string	x			\b, Volume /%s
+>>>0x429	uleshort	x		\b, %u Blocks
+>0xb00		string	\x00\x00\x03\x00
+>>0xb04		byte	&0xF0
+>>>0xb05	string	x			\b, Volume /%s
+>>>0xb29	uleshort	x		\b, %u Blocks
+#
+# ProDOS formatted
+0		string	\x01\xBD\x88\xC0\x20\x2F\xFB\x20\x58\xFC\x20\x40	Apple ProDOS Unbootable Image
+>0x400		string	\x00\x00\x03\x00
+>>0x404		byte	&0xF0
+>>>0x405	string	x			\b, Volume /%s
+>>>0x429	uleshort	x		\b, %u Blocks
+>0xb00		string	\x00\x00\x03\x00
+>>0xb04		byte	&0xF0
+>>>0xb05	string	x			\b, Volume /%s
+>>>0xb29	uleshort	x		\b, %u Blocks
+0		string	\x01\x38\xB0\x03\x4C\x1C\x09\x78\x86\x43\xC9\x03	Apple ProDOS Unbootable Image
+>0x400		string	\x00\x00\x03\x00
+>>0x404		byte	&0xF0
+>>>0x405	string	x			\b, Volume /%s
+>>>0x429	uleshort	x		\b, %u Blocks
+>0xb00		string	\x00\x00\x03\x00
+>>0xb04		byte	&0xF0
+>>>0xb05	string	x			\b, Volume /%s
+>>>0xb29	uleshort	x		\b, %u Blocks
+#
+# DOS3 boot loader
+0		string	\x01\xA5\x27\xC9\x09\xD0
+>0x11001	byte	0x11
+>>0x11003	ubyte	x		Apple DOS 3.%u Image
+>>0x11006	ubyte	x		\b, Volume #%03u
+>>0x11034	ubyte	x		\b, %u Tracks
+>>0x11035	ubyte	x		\b, %u Sectors
+>>0x11036	uleshort	x		\b, %u bytes per sector
+#
+# DOS3 uninitialized disk
+0		string	\x01\xA6\x2B\xBD\x88\xC0\x8A\x4A\x4A
+>0x11001	byte	0x11
+>>0x11003	ubyte	x	Apple DOS 3.%u Unbootable Image
+>>>0x11006	ubyte	x		\b, Volume #%03u
+>>>0x11034	ubyte	x		\b, %u Tracks
+>>>0x11035	ubyte	x		\b, %u Sectors
+>>>0x11036	uleshort	x		\b, %u bytes per sector
+#
+# Pascal boot loader?
+0		string	\x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD
+>0xd6		pstring SYSTEM.APPLE
+>>0xb00		leshort	0x0000
+>>>0xb04	leshort 0x0000		Apple Pascal Image
+>>>>0xb06	pstring x		\b, Volume %s:
+>>>>0xb0e	leshort x		\b, %u Blocks
+>>>>0xb10	leshort x		\b, %u Files
+#
+# Diversi Dos boot loader?
+0		string	\x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD
+>0x11001	string	\x11\x0F\x03	Apple Diversi Dos Image
+>>0x11006	byte	x		\b, Volume %u
+>>0x11034	byte	x		\b, %u Tracks
+>>0x11035	byte	x		\b, %u Sectors
+>>0x11036	leshort	x		\b, %u bytes per sector
+
+# Type: Apple Emulator 2IMG format
+# From: Radek Vokal <rvokal@redhat.com>
+# Update: Greg Wildman <greg@apple2.org.za>
+0		string	2IMG		Apple ][ 2IMG Disk Image
+>4		clear	x
+>4		string	XGS!		\b, XGS
+>4		string	CTKG		\b, Catakig
+>4		string	ShIm		\b, Sheppy's ImageMaker
+>4		string	SHEP		\b, Sheppy's ImageMaker
+>4		string	WOOF		\b, Sweet 16
+>4		string	B2TR		\b, Bernie ][ the Rescue
+>4		string	\!nfc		\b, ASIMOV2
+>4		string	\>BD\<		\b, Brutal Deluxe's Cadius
+>4		string	CdrP		\b, CiderPress
+>4		string	Vi][		\b, Virtual ][
+>4		string	PRFS		\b, ProFUSE
+>4		string	FISH		\b, FishWings
+>4		string	RVLW		\b, Revival for Windows
+>4		default	x
+>>4		string	x		\b, Creator tag "%-4.4s"
+>0xc		byte	00		\b, DOS 3.3 sector order
+>>0x10		byte	00		\b, Volume 254
+>>0x10		byte&0x7f x		\b, Volume %u
+>0xc		byte	01		\b, ProDOS sector order
+# Detect Volume Directory block ($02) + 2mg header offset
+>>0x440		string	\x00\x00\x03\x00
+>>>0x444	byte	&0xF0
+>>>>0x445	string	x		\b, Volume /%s
+>>>>0x469	uleshort	x		\b, %u Blocks
+>0xc		byte	02		\b, NIB data
+
+# Type: Peter Ferrie QBoot
+# From: Greg Wildman <greg@apple2.org.za>
+# Ref: https://github.com/peterferrie/qboot
+0	string	\x01\x4A\xA8\x69\x0F\x85\x27\xC9
+>8	string	\x12\xF0\x10\xE6\x3D\x86\xDA\x8A	Apple ][ QBoot Image
+
+# Type: Peter Ferrie 0Boot
+# From: Greg Wildman <greg@apple2.org.za>
+# Ref: https://github.com/peterferrie/0boot
+0	string	\x01\x4A\xA8\x69\x0F\x85\x27\xC9
+>8	string	\x12\xF0\x10\xE6\x3D\x86\xDA\x8A	Apple ][ 0Boot Image
+
+# Different proprietary boot sectors
+0	string	\x01\x0F\x21\x74\x00\x01\x6B\x00\x02\x30\x81\x5D	Apple ][ Disk Image
+0	string	\x01\x20\x58\xFC\xA2\x00\x8E\x78\x04\x8E\xF4\x03	Apple ][ Disk Image
+0	string	\x01\x20\x58\xFC\xAD\x51\xC0\xAD\x54\xC0\xA6\x2B	Apple ][ Disk Image
+0	string	\x01\x20\x89\xFE\x20\x93\xFE\xA6\x2B\xBD\x88\xC0	Apple ][ Disk Image
+0	string	\x01\x20\x93\xFE\x20\x89\xFE\x4C\x25\x08\x68\x85	Apple ][ Disk Image
+0	string	\x01\x20\x93\xFE\x20\x89\xFE\x4C\x2D\x08\x68\x85	Apple ][ Disk Image
+0	string	\x01\x38\x90\x2A\xC9\x01\xF0\x33\xA8\xC8\xC0\x10	Apple ][ Disk Image
+0	string	\x01\x38\xB0\x03\x4C\x32\xA1\x87\x43\xC9\x03\x08	Apple ][ Disk Image
+0	string	\x01\x4C\x04\x08\xA9\x2A\x8D\x02\x08\x86\x2B\xEE	Apple ][ Disk Image
+0	string	\x01\x4C\x60\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A	Apple ][ Disk Image
+0	string	\x01\x4C\x92\x08\x01\x08\xA2\x00\xB5\x00\x9D\x00	Apple ][ Disk Image
+0	string	\x01\x4C\xB3\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A	Apple ][ Disk Image
+0	string	\x01\x8D\xFB\x03\x8E\xFC\x03\x8C\xFD\x03\x8A\x29	Apple ][ Disk Image
+0	string	\x01\xA2\xFF\x9A\xD8\x20\x20\x08\x20\x34\x08\xAD	Apple ][ Disk Image
+0	string	\x01\xA5\x27\xBD\x88\xC0\x2C\x10\xC0\xA2\x00\xA9	Apple ][ Disk Image
+0	string	\x01\xA5\x2B\xAE\x51\xC0\xEA\xAA\xBD\x88\xC0\x20	Apple ][ Disk Image
+0	string	\x01\xA6\x27\xBD\x0B\x08\x48\xBD\x0A\x08\x48\x85	Apple ][ Disk Image
+0	string	\x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x01\x85	Apple ][ Disk Image
+0	string	\x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x25\x85	Apple ][ Disk Image
+0	string	\x01\xA8\xC0\x0F\x90\x16\xF0\x12\xA0\xFF\x18\xAD	Apple ][ Disk Image
+0	string	\x01\xA9\x00\x85\xF0\xA9\x04\x85\xF1\xA0\x00\xA9	Apple ][ Disk Image
+0	string	\x01\xA9\x5C\x8D\xF2\x03\xA9\xC6\x8D\xF3\x03\x49	Apple ][ Disk Image
+0	string	\x01\xA9\x60\x8D\x01\x08\x20\x2F\xFB\x20\x58\xFC	Apple ][ Disk Image
+0	string	\x01\xA9\x60\x8D\x01\x08\x20\x49\x08\xA9\x0A\x85	Apple ][ Disk Image
+0	string	\x01\xA9\x60\x8D\x01\x08\x2C\x82\xC0\xBD\x88\xC0	Apple ][ Disk Image
+0	string	\x01\xA9\x60\x8D\x01\x08\x86\x43\x8A\x4A\x4A\x4A	Apple ][ Disk Image
+0	string	\x01\xA9\x60\x8D\x01\x08\xA2\x00\x86\xFF\xB5\x00	Apple ][ Disk Image
+0	string	\x01\xA9\x60\x8D\x01\x08\xA2\x00\xB5\x00\x9D\x00	Apple ][ Disk Image
+0	string	\x01\xA9\x60\x8D\x01\x08\xA9\xB2\x8D\xF2\x03\xA9	Apple ][ Disk Image
+0	string	\x01\xA9\x60\x8D\x01\x08\xA9\xFF\x8D\xF3\x03\x8D	Apple ][ Disk Image
+0	string	\x01\xAC\x00\x08\xF0\x19\xB9\x30\x08\x85\x3D\xCE	Apple ][ Disk Image
+0	string	\x01\xAC\x23\x08\x30\x2E\xB9\x24\x08\x85\x3D\xCE	Apple ][ Disk Image
+0	string	\x01\xAD\x00\x08\xC9\x09\xB0\x20\x69\x02\x8D\x00	Apple ][ Disk Image
+0	string	\x01\xB0\x00\xA9\x3C\x8D\x02\x08\x86\x2B\x8A\x4A	Apple ][ Disk Image
+0	string	\x01\xB0\x00\xA9\x3C\x8D\x02\x08\xA9\xF5\x8D\xF2	Apple ][ Disk Image
+0	string	\x01\xB0\x00\xA9\x3F\x8D\x02\x08\x86\x2B\x8E\xF4	Apple ][ Disk Image
+0	string	\x01\xB0\x00\xA9\x48\x8D\x02\x08\x86\x2B\x8E\xF4	Apple ][ Disk Image
+0	string	\x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x09\xC0\x8D	Apple ][ Disk Image
+0	string	\x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x8D\x2F\x08	Apple ][ Disk Image
+0	string	\x01\xD8\x2C\x81\xC0\xA9\x60\x4D\x58\xFF\xD0\xFE	Apple ][ Disk Image
+0	string	\x01\xD8\x78\xBD\x88\xC0\xA9\xFD\x85\x37\x85\x39	Apple ][ Disk Image
+0	string	\x01\xE0\x60\xF0\x03\x4C\x16\x09\xAD\x00\x08\xC9	Apple ][ Disk Image
+0	string	\x01\xE0\x60\xF0\x03\x4C\xCB\x08\xAD\x00\x08\xC9	Apple ][ Disk Image
+0	string	\x01\xE0\x60\xF0\x03\x4C\xEE\x08\xAD\x00\x08\xC9	Apple ][ Disk Image
+0	string	\x01\xE0\x60\xF0\x03\x4C\xEF\x08\xAD\x00\x08\xC9	Apple ][ Disk Image
+0	string	\x01\xE0\x70\xB0\x04\xE0\x40\xB0\x39\xBD\x88\xC0	Apple ][ Disk Image
+0	string	\x01\xEA\x8D\xF4\x03\xA9\x60\x9D\x88\xC0\x8D\x51	Apple ][ Disk Image
+
+# magic for Newton PDA package formats
+# from Ruda Moura <ruda@helllabs.org>
+0	string	package0	Newton package, NOS 1.x,
+>12	belong	&0x80000000	AutoRemove,
+>12	belong	&0x40000000	CopyProtect,
+>12	belong	&0x10000000	NoCompression,
+>12	belong	&0x04000000	Relocation,
+>12	belong	&0x02000000	UseFasterCompression,
+>16	belong	x		version %d
+
+0	string	package1	Newton package, NOS 2.x,
+>12	belong	&0x80000000	AutoRemove,
+>12	belong	&0x40000000	CopyProtect,
+>12	belong	&0x10000000	NoCompression,
+>12	belong	&0x04000000	Relocation,
+>12	belong	&0x02000000	UseFasterCompression,
+>16	belong	x		version %d
+
+0	string	package4	Newton package,
+>8	byte	8		NOS 1.x,
+>8	byte	9		NOS 2.x,
+>12	belong	&0x80000000	AutoRemove,
+>12	belong	&0x40000000	CopyProtect,
+>12	belong	&0x10000000	NoCompression,
+
+# The following entries for the Apple II are for files that have
+# been transferred as raw binary data from an Apple, without having
+# been encapsulated by any of the above archivers.
+#
+# In general, Apple II formats are hard to identify because Apple DOS
+# and especially Apple ProDOS have strong typing in the file system and
+# therefore programmers never felt much need to include type information
+# in the files themselves.
+#
+# Eric Fischer <enf@pobox.com>
+
+# AppleWorks word processor:
+# URL: https://en.wikipedia.org/wiki/AppleWorks
+# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
+# Update: Joerg Jenderek
+# NOTE:
+# The "O" is really the magic number, but that's so common that it's
+# necessary to check the tab stops that follow it to avoid false positives.
+# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
+# the newer AppleWorks is from claris with extension CWK
+4	string		O
+# test for unused bits of zoom- , paginated-boolean bytes
+>84	ubequad		^0x00Fe00000000Fe00
+# look for tabstop definitions "=" no tab, "|" no tab
+# "<" left tab,"^" center tab,">" right tab, "." decimal tab,
+# unofficial "!" other , "\x8a" other
+# official only if SFMinVers is nonzero
+>>5	regex/s	[=.<>|!^\x8a]{79}	AppleWorks Word Processor
+# AppleWorks Word Processor File (Apple II)
+# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data"
+# application/x-appleworks is mime type for claris version with cwk extension
+!:mime	application/x-appleworks3
+# http://home.earthlink.net/~hughhood/appleiiworksenvoy/
+# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
+# $70 $1A $F8 $FF is this the apple type ?
+#:apple pdosp^Z\xf8\xff
+!:ext awp
+# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
+>>>183	ubyte		30	3.0
+>>>183	ubyte		!30
+>>>>183	ubyte		!0	%#x
+# usual tabstop start sequence "=====<"
+>>>5	string		x	\b, tabstop ruler "%6.6s"
+# tabstop ruler
+#>>>5	string		>\0	\b, tabstops "%-79s"
+# zoom switch
+>>>85	  byte&0x01	>0	\b, zoomed
+# whether paginated
+>>>90	  byte&0x01	>0	\b, paginated
+# contains any mail-merge commands
+>>>92	  byte&0x01	>0	\b, with mail merge
+# left margin in 1/10 inches ( normally 0 or 10 )
+>>>91	ubyte		>0
+>>>>91	ubyte		x	\b, %d/10 inch left margin
+
+# AppleWorks database:
+#
+# This isn't really a magic number, but it's the closest thing to one
+# that I could find.  The 1 and 2 really mean "order in which you defined
+# categories" and "left to right, top to bottom," respectively; the D and R
+# mean that the cursor should move either down or right when you press Return.
+
+#30	string		\x01D	AppleWorks database data
+#30	string		\x02D	AppleWorks database data
+#30	string		\x01R	AppleWorks database data
+#30	string		\x02R	AppleWorks database data
+
+# AppleWorks spreadsheet:
+#
+# Likewise, this isn't really meant as a magic number.  The R or C means
+# row- or column-order recalculation; the A or M means automatic or manual
+# recalculation.
+
+#131	string		RA	AppleWorks spreadsheet data
+#131	string		RM	AppleWorks spreadsheet data
+#131	string		CA	AppleWorks spreadsheet data
+#131	string		CM	AppleWorks spreadsheet data
+
+# Applesoft BASIC:
+#
+# This is incredibly sloppy, but will be true if the program was
+# written at its usual memory location of 2048 and its first line
+# number is less than 256.  Yuck.
+# update by Joerg Jenderek at Feb 2013
+
+# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
+#0       belong&0xff00ff 0x80000 Applesoft BASIC program data
+0	belong&0x00ff00ff	0x00080000
+# assuming that line number must be positive
+>2	leshort			>0		Applesoft BASIC program data, first line number %d
+#>2     leshort         x       \b, first line number %d
+
+# ORCA/EZ assembler:
+#
+# This will not identify ORCA/M source files, since those have
+# some sort of date code instead of the two zero bytes at 6 and 7
+# XXX Conflicts with ELF
+#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
+#>5      byte                    x               \b, build number %d
+
+# Broderbund Fantavision
+#
+# I don't know what these values really mean, but they seem to recur.
+# Will they cause too many conflicts?
+
+# Probably :-)
+#2	belong&0xFF00FF		0x040008	Fantavision movie data
+
+# Some attempts at images.
+#
+# These are actually just bit-for-bit dumps of the frame buffer, so
+# there's really no reasonably way to distinguish them except for their
+# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
+# or, occasionally, 8184.
+#
+# Nevertheless this will manage to catch a lot of images that happen
+# to have a solid-colored line at the bottom of the screen.
+
+# GRR: Magic too weak
+#8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
+#8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
+#8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
+#8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
+#8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background
+
+# Beagle Bros. Apple Mechanic fonts
+
+0	belong&0xFF00FFFF	0x6400D000	Apple Mechanic font
+
+# Apple Universal Disk Image Format (UDIF) - dmg files.
+# From Johan Gade.
+# These entries are disabled for now until we fix the following issues.
+#
+# Note there might be some problems with the "VAX COFF executable"
+# entry. Note this entry should be placed before the mac filesystem section,
+# particularly the "Apple Partition data" entry.
+#
+# The intended meaning of these tests is, that the file is only of the
+# specified type if both of the lines are correct - i.e. if the first
+# line matches and the second doesn't then it is not of that type.
+#
+#0	long	0x7801730d
+#>4	long	0x62626060	UDIF read-only zlib-compressed image (UDZO)
+#
+# Note that this entry is recognized correctly by the "Apple Partition
+# data" entry - however since this entry is more specific - this
+# information seems to be more useful.
+#0	long	0x45520200
+#>0x410	string	disk\ image	UDIF read/write image (UDRW)
+
+# From: Toby Peterson <toby@apple.com>
+# From https://www.nationalarchives.gov.uk/pronom/fmt/866
+0	string	bplist00
+>8	search/500	WebMainResource	Apple Safari Webarchive
+!:mime	application/x-webarchive
+!:strength +50
+0	string	bplist00	Apple binary property list
+!:mime	application/x-bplist
+
+# Apple binary property list (bplist)
+#  Assumes version bytes are hex.
+#  Provides content hints for version 0 files. Assumes that the root
+#  object is the first object (true for CoreFoundation implementation).
+# From: David Remahl <dremahl@apple.com>
+0		string	bplist
+>6		byte	x	\bCoreFoundation binary property list data, version %#c
+>>7		byte	x	\b%c
+>6		string		00		\b
+>>8		byte&0xF0	0x00	\b
+>>>8	byte&0x0F	0x00	\b, root type: null
+>>>8	byte&0x0F	0x08	\b, root type: false boolean
+>>>8	byte&0x0F	0x09	\b, root type: true boolean
+>>8		byte&0xF0	0x10	\b, root type: integer
+>>8		byte&0xF0	0x20	\b, root type: real
+>>8		byte&0xF0	0x30	\b, root type: date
+>>8		byte&0xF0	0x40    \b, root type: data
+>>8		byte&0xF0	0x50	\b, root type: ascii string
+>>8		byte&0xF0	0x60	\b, root type: unicode string
+>>8		byte&0xF0	0x80	\b, root type: uid (CORRUPT)
+>>8		byte&0xF0	0xa0	\b, root type: array
+>>8		byte&0xF0	0xd0	\b, root type: dictionary
+
+# Apple/NeXT typedstream data
+#  Serialization format used by NeXT and Apple for various
+#  purposes in YellowStep/Cocoa, including some nib files.
+# From: David Remahl <dremahl@apple.com>
+2		string		typedstream	NeXT/Apple typedstream data, big endian
+>0		byte		x		\b, version %d
+>0		byte		<5		\b
+>>13	byte		0x81	\b
+>>>14	ubeshort	x		\b, system %d
+2		string		streamtyped NeXT/Apple typedstream data, little endian
+>0		byte		x		\b, version %d
+>0		byte		<5		\b
+>>13	byte		0x81	\b
+>>>14	uleshort	x		\b, system %d
+
+#------------------------------------------------------------------------------
+# CAF: Apple CoreAudio File Format
+#
+# Container format for high-end audio purposes.
+# From: David Remahl <dremahl@apple.com>
+#
+0	string		caff		CoreAudio Format audio file
+>4	beshort		<10		version %d
+>6	beshort		x
+
+
+#------------------------------------------------------------------------------
+# Keychain database files
+0	string		kych		Mac OS X Keychain File
+
+#------------------------------------------------------------------------------
+# Code Signing related file types
+0	belong		0xfade0c00	Mac OS X Code Requirement
+>8	belong		1			(opExpr)
+>4	belong		x			- %d bytes
+
+0	belong		0xfade0c01	Mac OS X Code Requirement Set
+>8	belong		>1			containing %d items
+>4	belong		x			- %d bytes
+
+0	belong		0xfade0c02	Mac OS X Code Directory
+>8	belong		x			version %x
+>12	belong		>0			flags %#x
+>4	belong		x			- %d bytes
+
+0	belong		0xfade0cc0	Mac OS X Detached Code Signature (non-executable)
+>4	belong		x			- %d bytes
+
+0	belong		0xfade0cc1	Mac OS X Detached Code Signature
+>8	belong		>1			(%d elements)
+>4	belong		x			- %d bytes
+
+# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
+# .vdi
+4	string innotek\ VirtualBox\ Disk\ Image %s
+
+# Apple disk partition stuff
+# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
+# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
+# Update: Joerg Jenderek
+# "ER" is APPLE_DRVR_MAP_MAGIC signature
+0	beshort	0x4552
+# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
+#!:strength +0
+# strengthen the magic by looking for used blocksizes 512 2048
+>2	ubeshort&0xf1FF		0	Apple Driver Map
+# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
+#>>504	ubequad&0x0000FFffFFff0000	0
+!:mime	application/x-apple-diskimage
+!:apple	????devr
+# https://en.wikipedia.org/wiki/Apple_Disk_Image
+!:ext	dmg/iso
+# sbBlkSize for driver descriptor map 512 2048
+>>2	beshort	x			\b, blocksize %d
+# sbBlkCount sometimes garbish like
+# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
+# 0xf2720100 for bunziped Firefox 48.0-2.dmg
+# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
+# 0x00009090 by syslinux-6.03/utils/isohybrid.c
+>>4	ubelong	x			\b, blockcount %u
+# following device/driver information not very useful
+# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
+>>8	ubeshort	x		\b, devtype %u
+# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
+>>10	ubeshort	x		\b, devid %u
+# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
+>>12	ubelong		>0
+>>>12	ubelong		x		\b, driver data %u
+# number of driver descriptors sbDrvrCount <= 61
+# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
+>>16	ubeshort	x		\b, driver count %u
+# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
+# >>18	use		apple-driver-map
+# >>26	use		apple-driver-map
+# # ...
+# >>500	use		apple-driver-map
+# number of partitions is always same in every partition (map block count)
+#>>0x0204	ubelong		x	\b, %u partitions
+>>0x0204	ubelong		>0	\b, contains[@0x200]:
+>>>0x0200	use		apple-apm
+>>0x0204	ubelong		>1	\b, contains[@0x400]:
+>>>0x0400	use		apple-apm
+>>0x0204	ubelong		>2	\b, contains[@0x600]:
+>>>0x0600	use		apple-apm
+>>0x0204	ubelong		>3	\b, contains[@0x800]:
+>>>0x0800	use		apple-apm
+>>0x0204	ubelong		>4	\b, contains[@0xA00]:
+>>>0x0A00	use		apple-apm
+>>0x0204	ubelong		>5	\b, contains[@0xC00]:
+>>>0x0C00	use		apple-apm
+>>0x0204	ubelong		>6	\b, contains[@0xE00]:
+>>>0x0E00	use		apple-apm
+>>0x0204	ubelong		>7	\b, contains[@0x1000]:
+>>>0x1000	use		apple-apm
+#	display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
+0	name				apple-driver-map
+>0	ubequad		!0
+# descBlock first block of driver
+>>0	ubelong	x			\b, driver start block %u
+# descSize driver size in blocks
+>>4	ubeshort	x		\b, size %u
+# descType driver system type 1 701h F8FFh FFFFh
+>>6	ubeshort	x		\b, type %#x
+
+# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
+# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
+# Update: Joerg Jenderek
+# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
+# magic stronger.
+# for apple partition map stored as a single file
+0	belong	0x504d0000
+# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
+#!:strength +0
+>0	use		apple-apm
+# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
+# file: could not find any valid magic files!
+#!:ext	bin
+#	display apple partition map. Normally called after Apple driver map
+0	name				apple-apm
+>0	belong	0x504d0000		Apple Partition Map
+# number of partitions
+>>4	ubelong	x			\b, map block count %u
+# logical block (512 bytes) start of partition
+>>8	ubelong	x			\b, start block %u
+>>12	ubelong	x			\b, block count %u
+>>16	string >0			\b, name %s
+>>48	string >0			\b, type %s
+# processor type dpme_process_id[16] e.g. "68000" "68020"
+>>120	string >0			\b, processor %s
+# A/UX boot arguments BootArgs[128]
+>>136	string >0			\b, boot arguments %s
+# status of partition dpme_flags
+>>88	belong	& 1			\b, valid
+>>88	belong	& 2			\b, allocated
+>>88	belong	& 4			\b, in use
+>>88	belong	& 8			\b, has boot info
+>>88	belong	& 16			\b, readable
+>>88	belong	& 32			\b, writable
+>>88	belong	& 64			\b, pic boot code
+>>88	belong	& 128			\b, chain compatible driver
+>>88	belong	& 256			\b, real driver
+>>88	belong	& 512			\b, chain driver
+# mount automatically at startup APPLE_PS_AUTO_MOUNT
+>>88	ubelong	&0x40000000		\b, mount at startup
+# is the startup partition APPLE_PS_STARTUP
+>>88	ubelong	&0x80000000		\b, is the startup partition
+
+#https://wiki.mozilla.org/DS_Store_File_Format
+#https://en.wikipedia.org/wiki/.DS_Store
+0	string	\0\0\0\1Bud1\0		Apple Desktop Services Store
+
+# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
+# Usually not in separate files, but have either filename rsrc with
+# no extension, or a filename corresponding to another file, with
+# extensions rsr/rsrc
+# URL:		http://fileformats.archiveteam.org/wiki/Macintosh_resource_file
+#		https://en.wikipedia.org/wiki/Resource_fork
+# Reference:	https://github.com/kreativekorp/ksfl/wiki/Macintosh-Resource-File-Format
+#		http://developer.apple.com/legacy/mac/library/documentation/mac/pdf/MoreMacintoshToolbox.pdf
+#		https://formats.kaitai.io/resource_fork/
+# Update:	Joerg Jenderek
+# Note:		verified often by command like `deark -m macrsrc Icon_.rsrc`
+# offset of resource data; usually starts at offset 0x0100
+0	string  \000\000\001\000
+# skip NPETraceSession.etl with invalid "low" map offset 0
+>4	ubelong	>0xFF
+# skip few Atari DEGAS Elite bitmap (eil2.pi1 nastro.pi1) with ivalid "high" 0x6550766 0x7510763 map length
+>>12	ubelong	<0x8001
+# most examples with zeroed system reserved field
+>>>16	lelong  =0
+>>>>0	use	apple-rsr
+# few samples with not zeroed system reserved field like: Empty.rsrc.rsr OpenSans-CondBold.dfont
+>>>16	lelong  !0
+# resource fork variant with not zeroed system reserved field and copy of header 
+>>>>(4.L)	ubelong	0x100
+# GRR: the line above only works if in ../../src/file.h FILE_BYTES_MAX is raised from 1 MiB above 0x6ab0f4 (HelveticaNeue.dfont)
+>>>>>0	use	apple-rsr
+# data fork variant with not zeroed system reserved field and no copy of header 
+>>>>(4.L)	ubelong	0
+>>>>>0	use	apple-rsr
+# Note: moved and merged from ./macintosh
+# From: Adam Buchbinder <adam.buchbinder@gmail.com>
+# URL: https://en.wikipedia.org/wiki/Datafork_TrueType
+# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
+# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
+# don't know what they mean.
+#	display information about Mac OSX datafork font DFONT
+0	name		apple-dfont
+>(4.L+30)	ubelong x		Mac OSX datafork font,
+# https://en.wikipedia.org/wiki/Datafork_TrueType
+!:mime		application/x-dfont
+!:ext		dfont
+# https://exiftool.org/TagNames/RSRC.html
+>(4.L+30)	ubelong	0x73666e74	TrueType
+>(4.L+30)	ubelong	0x464f4e54	'FONT'
+>(4.L+30)	ubelong	0x4e464e54	'NFNT'
+>(4.L+30)	ubelong	0x504f5354	PostScript
+>(4.L+30)	ubelong	0x464f4e44	'FOND'
+>(4.L+30)	ubelong	0x76657273	'vers'
+#	display information about Macintosh resource
+0	name		apple-rsr
+>(4.L+30)	ubelong	0x73666e74
+>>0	use	apple-dfont
+>(4.L+30)	ubelong	0x464f4e54
+>>0	use	apple-dfont
+>(4.L+30)	ubelong	0x4e464e54
+>>0	use	apple-dfont
+>(4.L+30)	ubelong	0x504f5354
+>>0	use	apple-dfont
+>(4.L+30)	ubelong	0x464f4e44
+>>0	use	apple-dfont
+>(4.L+30)	ubelong	0x76657273
+>>0	use	apple-dfont
+>(4.L+30)	default	x		Apple HFS/HFS+ resource fork
+#!:mime		application/octet-stream
+!:mime		application/x-apple-rsr
+!:ext		rsrc/rsr
+# offset to resource data; usually starts at offset 0x0100
+>0		ubelong		!0x100	\b, data offset %#x
+# offset to resource map; positive but not nil like in NPETraceSession.etl
+>4		ubelong		x	\b, map offset %#x
+# length of resource map; positive with 32K limitation but not
+# nil like in NPETraceSession.etl or high like 0x7510763 in nastro.pi1
+>12		ubelong		x	\b, map length %#x
+# length of resource data; positive but not nil like in NPETraceSession.etl
+>8		ubelong		x	\b, data length %#x
+# reserved 112 bytes for system use; apparently often nil, but 8fd20000h in Empty.rsrc.rsr and 0x00768c2b in OpenSans-CondBold.dfont
+>16		ubelong		!0	\b, at 16 %#8.8x
+# https://fontforge.org/docs/techref/macformats.html
+# jump to resource map
+# a copy of resource header or 16 bytes of zeros for data fork
+#>(4.L)		ubelong		x	\b, DATA offset %#x
+#>(4.L+4) 	ubelong 	x	\b, MAP offset %#x
+#>(4.L+8) 	ubelong 	x	\b, DATA length %#x
+#>(4.L+12) 	ubelong 	x	\b, MAP length %#x
+# nextResourceMap; handle to next resource map; used by the Resource Manager for internal bookkeeping; should be zero
+>(4.L+16) 	ubelong		!0	\b, nextResourceMap %#x
+# fileRef; file reference number; used by the Resource Manager for internal bookkeeping; should be zero
+>(4.L+20)	ubeshort	!0	\b, fileRef %#x
+# attributes; Resource fork attributes (80h~read-only 40h~compression needed 20h~changed); other bits are reserved and should be zero
+>(4.L+22)	ubeshort	!0	\b, attributes %#x
+# typeListOffset; offset from resource map to start of type list like: 1Ch
+>(4.L+24)	ubeshort	x	\b, list offset %#x
+# nameListOffset; offset from esource map to start of name list like: 32h 46h 56h (XLISP.RSR XLISPTIN.RSR) 13Eh (HelveticaNeue.dfont)
+>(4.L+26)	ubeshort	x	\b, name offset %#x
+# typeCount; number of types in the map minus 1; If there are no resources, this is 0xFFFF
+>(4.L+28)	beshort+1	>0	\b, %u type
+# plural s 
+>>(4.L+28)	beshort+1	>1	\bs
+# resource type list array; 1st resource type like: ALRT CODE FOND MPSR icns scsz
+>>(4.L+30)	ubelong		x	\b, %#x
+>>(4.L+30)	string		x	'%-.4s'
+# resourceCount; number of this type resources minus one. If there is one resource of this type, this is 0x0000
+>>(4.L+34)	beshort+1	x	* %d
+# resourceListOffset; offset from type list to resource list like: Ah 12h DAh
+>(4.L+36)	ubeshort	x	resource offset %#x
+
+#https://en.wikipedia.org/wiki/AppleScript
+0	string	FasdUAS			AppleScript compiled
+
+# AppleWorks/ClarisWorks
+# https://github.com/joshenders/appleworks_format
+# http://fileformats.archiveteam.org/wiki/AppleWorks
+0	name			appleworks
+>0	belong&0x00ffffff	0x07e100	AppleWorks CWK Document
+>0	belong&0x00ffffff	0x008803	ClarisWorks CWK Document
+>0	default			x
+>>0	belong			x		AppleWorks/ClarisWorks CWK Document
+>0	byte			x		\b, version %d
+>30	beshort			x		\b, %d
+>32	beshort			x		\bx%d
+!:ext cwk
+
+4	string	BOBO
+>0	byte	>4
+>>12	belong	0
+>>>26	belong	0
+>>>>0	use	appleworks
+>0	belong	0x0481ad00
+>>0	use 	appleworks
+
+# magic for Apple File System (APFS)
+# from Alex Myczko <alex@aiei.ch>
+32		string	NXSB		Apple File System (APFS)
+>36		ulelong	x		\b, blocksize %u
+
+# iTunes cover art (versions 1 and 2)
+4		string	itch
+>24		string	artw
+>>0x1e8		string	data		iTunes cover art
+>>>0x1ed	string	PNG		(PNG)
+>>>0x1ec	beshort 0xffd8		(JPEG)
+
+# MacPaint image
+65		string	PNTGMPNT	MacPaint image data
+#0		belong	2		MacPaint image data