diff options
Diffstat (limited to 'magic/Magdir/macintosh')
| -rw-r--r-- | magic/Magdir/macintosh | 505 |
1 files changed, 505 insertions, 0 deletions
diff --git a/magic/Magdir/macintosh b/magic/Magdir/macintosh new file mode 100644 index 0000000..a74aac4 --- /dev/null +++ b/magic/Magdir/macintosh @@ -0,0 +1,505 @@ + +#------------------------------------------------------------------------------ +# $File: macintosh,v 1.36 2022/12/06 18:45:20 christos Exp $ +# macintosh description +# +# BinHex is the Macintosh ASCII-encoded file format (see also "apple") +# Daniel Quinlan, quinlan@yggdrasil.com +# Update: Joerg Jenderek +# URL: https://en.wikipedia.org/wiki/BinHex +# Reference: http://fileformats.archiveteam.org/wiki/BinHex +# Note: only tested with version 4.0 and hqx extension +# Any text/binary before the characteristic comment sentence is to be ignored like in +# http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx +0 search/1602 (This\ file\ +>&0 use binhex +# http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx +0 search/2652/b (This\ file\ +>&0 use binhex +0 name binhex +# keep split search string format similar like in version 5.37 +>0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version +# http://www.macdisk.com/binhexen.php3 +!:apple BNHQTEXT +# http://www.faqs.org/faqs/macintosh/comm-faq/part1/ +>>&0 string 1.0 1.0 +!:mime application/mac-binhex +!:ext hex +>>&0 string 2.0 2.0 +!:mime application/mac-binhex +!:ext hcx +# BinHex 3.0 never existed +>>&0 string 4.0 4.0 +!:mime application/mac-binhex40 +!:ext hqx +# BinHex 5.0 also MacBinary I +>>&0 string 5.0 5.0 +!:mime application/mac-binhex40 +!:ext hqx +# this should never happen +>>&0 default x +>>>&0 string x %.3s +!:mime application/mac-binhex +!:ext hqx + +# Stuffit archives are the de facto standard of compression for Macintosh +# files obtained from most archives. (franklsm@tuns.ca) +0 string SIT! StuffIt Archive (data) +!:mime application/x-stuffit +!:apple SIT!SIT! +>2 string x : %s +0 string SITD StuffIt Deluxe (data) +>2 string x : %s +0 string Seg StuffIt Deluxe Segment (data) +>2 string x : %s + +# Newer StuffIt archives (grant@netbsd.org) +0 string StuffIt StuffIt Archive +!:mime application/x-stuffit +!:apple SIT!SIT! +#>162 string >0 : %s + +# Macintosh Applications and Installation binaries (franklsm@tuns.ca) +# GRR: Too weak +#0 string APPL Macintosh Application (data) +#>2 string x \b: %s + +# Macintosh System files (franklsm@tuns.ca) +# GRR: Too weak +#0 string zsys Macintosh System File (data) +#0 string FNDR Macintosh Finder (data) +#0 string libr Macintosh Library (data) +#>2 string x : %s +#0 string shlb Macintosh Shared Library (data) +#>2 string x : %s +#0 string cdev Macintosh Control Panel (data) +#>2 string x : %s +#0 string INIT Macintosh Extension (data) +#>2 string x : %s +#0 string FFIL Macintosh Truetype Font (data) +#>2 string x : %s +#0 string LWFN Macintosh Postscript Font (data) +#>2 string x : %s + +# Additional Macintosh Files (franklsm@tuns.ca) +# GRR: Too weak +#0 string PACT Macintosh Compact Pro Archive (data) +#>2 string x : %s +#0 string ttro Macintosh TeachText File (data) +#>2 string x : %s +#0 string TEXT Macintosh TeachText File (data) +#>2 string x : %s +#0 string PDF Macintosh PDF File (data) +#>2 string x : %s + +# MacBinary format (Eric Fischer, enf@pobox.com) +# Update: Joerg Jenderek +# URL: https://en.wikipedia.org/wiki/MacBinary +# http://fileformats.archiveteam.org/wiki/MacBinary +# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt +# Note: verified by macutils `macunpack -i -v BBEdit4.0.sit.bin` and +# `deark -l -d -m macbinary G3FirmwareUpdate1.1.smi.bin` +# +# Unfortunately MacBinary doesn't really have a magic number prior +# to the MacBinary III format. +# + +# old version number, must be kept at zero for compatibility +0 byte 0 +# length of filename (must be in the range 1-63) +>1 ubyte >0 +# skip T.PIC.LZ INSTRUMENT.7T INVENTORY +>>1 ubyte <64 +# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)" +# by looking for printable characters at beginning of file name +>>>2 ubelong >0x1F000000 +# zero fill, must be zero for compatibility +>>>>74 byte 0 +# zero fill, must be zero for compatibility +>>>>>82 byte 0 +# skip few DEGAS mid-res uncompressed bitmap (GEMINI03.PI2 CODE_RAM.PI2) with "too high" file names ffffff88 ffff4f00 +>>>>>>2 ubelong <0xffff0000 +# MacBinary I test for valid version numbers +>>>>>>>122 ubeshort 0 +# additional check for undefined header fields in MacBinary I +#>>>>>>>>101 ulong 0 +>>>>>>>>0 use mac-bin +# MacBinary II the newer versions begins at 129 +>>>>>>>122 ubeshort 0x8181 +>>>>>>>>0 use mac-bin +# MacBinary III with MacBinary II to read +>>>>>>122 ubeshort 0x8281 +>>>>>>>0 use mac-bin + +# display information of MacBinary file +0 name mac-bin +>122 ubyte x MacBinary +# versions for MacBinary II/III +>122 ubyte 129 II +>122 ubyte 130 III +# only in MacBinary III +>>102 string !mBIN with surprising version +!:mime application/x-macbinary +!:apple PSPTBINA +!:ext bin/macbin +# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidentified as MacBinary +#>1 ubyte >63 \b, name length %u too BIG! +#>122 ubeshort x \b, version %#x +# Finder flags if not 0 +# >73 byte !0 \b, flags 0x +# >73 byte =0 +# >>101 byte !0 \b, flags 0x +# # original Finder flags (Bits 8-15) +# >73 byte !0 \b%x +# # finder flags, bits 0-7 +# >101 byte !0 \b%x +>73 byte &0x01 \b, inited +>73 byte &0x02 \b, changed +>73 byte &0x04 \b, busy +>73 byte &0x08 \b, bozo +>73 byte &0x10 \b, system +>73 byte &0x20 \b, bundle +>73 byte &0x40 \b, invisible +>73 byte &0x80 \b, locked + +# 75 beshort # vertical posn in window +#>75 beshort !0 \b, v.pos %u +# 77 beshort # horiz posn in window +#>77 beshort !0 \b, h.pos %u +# 79 beshort # window or folder ID +>79 ubeshort !0 \b, ID %#x +# protected flag +>81 byte !0 \b, protected %#x +# length of comment after resource +>99 ubeshort !0 \b, comment length %u +# char. code of file name +>106 ubyte !0 \b, char. code %#x +# still more Finder flags +>107 ubyte !0 \b, more flags %#x +# length of total files when unpacked only used when pack and unpack on the fly +>116 ubelong !0 \b, total length %u +# 120 beshort # length of add'l header +>120 ubeshort !0 \b, 2nd header length %u +# 124 beshort # checksum +#>124 ubeshort !0 \b, CRC %#x +# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080 +# few (31/1247) examples (hinkC4.0.sitx.bin InternetExplorer5.1.smi.bin G3FirmwareUpdate1.1.smi.bin Firewire2.3.3.smi.bin LR2image.bin) contain zeroed date fields +>91 long !0 +>>91 beldate-0x7C25B080 x \b, %s +# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidentified or time overflow +>91 ubelong <0x7c25b080 INVALID date +# reported date seconds by deark +#>91 ubelong x deark-DATE=%u +# last modified date +>95 long !0 +>>95 beldate-0x7C25B080 x \b, modified %s +# Apple creator+typ if not null +# file creator (normally expressed as four characters) +>69 ulong !0 \b, creator +# instead 4 character code display full creator name +>>69 use apple-creator +# file type (normally expressed as four characters) +>65 ulong !0 \b, type +>>65 use apple-type +# length of data segment +>83 ubelong !0 \b, %u bytes +# filename (in the range 1-63) +# like "BBEdit4.0.sit" "Archive.sitx" "MacPGP 2.2 (.sea)" +>1 pstring x "%s" +# print 1 space and then at offset 128 inspect data fork content if it has one +>83 ubelong !0 \b +>>128 indirect x +# Afterwards resource fork if length of resource segment not zero +>87 ubelong !0 +# calculate resource fork offset +>>83 ubelong+128 x \b, at %#x +# length of resource segment +>>87 ubelong !0 %u bytes +>>(83.S+128) ubequad x resource +# further resource fork content inspection +>>>&-8 indirect x + +# Apple Type/Creator Database +# URL: https://en.wikipedia.org/wiki/Type_code +# Reference: https://www.lacikam.co.il/tcdb/ +# https://www.macdisk.com/macsigen.php +# Note: classic Mac OS files have two 4 character codes for type and creator. +# Thereby the Finder attach documents types to applications. + +#>65 string x \b, type "%4.4s" + +# display information about apple type +0 name apple-type +>0 string 8BIM PhotoShop +>0 string ALB3 PageMaker 3 +>0 string ALB4 PageMaker 4 +>0 string ALT3 PageMaker 3 +>0 string APPL application +>0 string AWWP AppleWorks word processor +>0 string CIRC simulated circuit +>0 string DRWG MacDraw +>0 string EPSF Encapsulated PostScript +>0 string FFIL font suitcase +>0 string FKEY function key +>0 string FNDR Macintosh Finder +>0 string GIFf GIF image +>0 string Gzip GNU gzip +>0 string INIT system extension +>0 string LIB\ library +>0 string LWFN PostScript font +>0 string MSBC Microsoft BASIC +>0 string PACT Compact Pro archive +>0 string PDF\ Portable Document Format +>0 string PICT picture +>0 string PNTG MacPaint picture +>0 string PREF preferences +>0 string PROJ Think C project +>0 string QPRJ Think Pascal project +>0 string SCFL Defender scores +>0 string SCRN startup screen +>0 string SITD StuffIt Deluxe +>0 string SPn3 SuperPaint +>0 string STAK HyperCard stack +>0 string Seg\ StuffIt segment +>0 string TARF Unix tar archive +>0 string TEXT ASCII +>0 string TIFF TIFF image +>0 string TOVF Eudora table of contents +>0 string WDBN Microsoft Word word processor +>0 string WORD MacWrite word processor +>0 string XLS\ Microsoft Excel +>0 string ZIVM compress (.Z) +>0 string ZSYS Pre-System 7 system file +>0 string acf3 Aldus FreeHand +>0 string cdev control panel +>0 string dfil Desk Accessory suitcase +>0 string libr library +>0 string nX^d WriteNow word processor +>0 string nX^w WriteNow dictionary +>0 string rsrc resource +>0 string scbk Scrapbook +>0 string shlb shared library +>0 string ttro SimpleText read-only +>0 string zsys system file + +# additional types added in Dec 2017 +>0 string BINA binary file +>0 string BMPp BMP image +>0 string JPEG JPEG image +#>0 string W4BN Microsoft Word x.y word processor? +# if type name is not known display 4 character identifier +>0 default x +>>0 string x '%4.4s' + +#>69 string x \b, creator "%4.4s" + +# Now Apple has no repository of registered Creator IDs any more. These are +# just the ones that I happened to have files from and was able to identify. + +# display information about apple creator +0 name apple-creator +>0 string 8BIM Adobe Photoshop +>0 string ALD3 PageMaker 3 +>0 string ALD4 PageMaker 4 +>0 string ALFA Alpha editor +>0 string APLS Apple Scanner +>0 string APSC Apple Scanner +>0 string BRKL Brickles +>0 string BTFT BitFont +>0 string CCL2 Common Lisp 2 +>0 string CCL\ Common Lisp +>0 string CDmo The Talking Moose +>0 string CPCT Compact Pro +>0 string CSOm Eudora +>0 string DMOV Font/DA Mover +>0 string DSIM DigSim +>0 string EDIT Macintosh Edit +>0 string ERIK Macintosh Finder +>0 string EXTR self-extracting archive +>0 string Gzip GNU gzip +>0 string KAHL Think C +>0 string LWFU LaserWriter Utility +>0 string LZIV compress +>0 string MACA MacWrite +>0 string MACS Macintosh operating system +>0 string MAcK MacKnowledge terminal emulator +>0 string MLND Defender +>0 string MPNT MacPaint +>0 string MSBB Microsoft BASIC (binary) +>0 string MSWD Microsoft Word +>0 string NCSA NCSA Telnet +>0 string PJMM Think Pascal +>0 string PSAL Hunt the Wumpus +#>0 string PSI2 Apple File Exchange +>0 string R*ch BBEdit +>0 string RMKR Resource Maker +>0 string RSED Resource Editor +>0 string Rich BBEdit +>0 string SIT! StuffIt +>0 string SPNT SuperPaint +>0 string Unix NeXT Mac filesystem +>0 string VIM! Vim editor +>0 string WILD HyperCard +>0 string XCEL Microsoft Excel +>0 string aCa2 Fontographer +>0 string aca3 Aldus FreeHand +>0 string dosa Macintosh MS-DOS file system +>0 string movr Font/DA Mover +>0 string nX^n WriteNow +>0 string pdos Apple ProDOS file system +>0 string scbk Scrapbook +>0 string ttxt SimpleText +>0 string ufox Foreign File Access +# additional creators added in Dec 2017 +# Claris/Apple Works +>0 string BOBO Apple Works +# CU-SeeMe_0.87b3_(68K).bin +#>0 string CUce bar +>0 string PSPT Apple File Exchange +# Disk_Copy_4.2.sea.bin +#>0 string NCse foo +# probably StuffIt/Aladdin by Smith Micro Software, Inc. +>0 string STi0 stuffit +# MacGzip-1.1.3.sea.bin +#>0 string aust bar +# D-Disk_Copy_6.3.3.smi.bin +>0 string oneb Disk Copy Self Mounting +# if creator name is not known display 4 character identifier +>0 default x +>>0 string x '%4.4s' + +# sas magic from Bruce Foster (bef@nwu.edu) +# +#0 string SAS SAS +#>8 string x %s +0 string SAS SAS +>24 string DATA data file +>24 string CATALOG catalog +>24 string INDEX data file index +>24 string VIEW data view +# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) +# +0x54 string SAS SAS 7+ +>0x9C string DATA data file +>0x9C string CATALOG catalog +>0x9C string INDEX data file index +>0x9C string VIEW data view + +# spss magic for SPSS system and portable files, +# from Bruce Foster (bef@nwu.edu). + +0 long 0xc1e2c3c9 SPSS Portable File +>40 string x %s + +0 string $FL2 SPSS System File +>24 string x %s + +0 string $FL3 SPSS System File +>24 string x %s + +# Macintosh filesystem data +# From "Tom N Harris" <telliamed@mac.com> +# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> +# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these +# entries depend on the data arithmetic added after v.35 +# There's also some Pascal strings in here, ditto... + +# The boot block signature, according to IM:Files, is +# "for HFS volumes, this field always contains the value 0x4C4B." +# But if this is true for MFS or HFS+ volumes, I don't know. +# Alternatively, the boot block is supposed to be zeroed if it's +# unused, so a simply >0 should suffice. + +0x400 beshort 0xD2D7 Macintosh MFS data +>0 beshort 0x4C4B (bootable) +>0x40a beshort &0x8000 (locked) +>0x402 beldate-0x7C25B080 x created: %s, +>0x406 beldate-0x7C25B080 >0 last backup: %s, +>0x414 belong x block size: %d, +>0x412 beshort x number of blocks: %d, +>0x424 pstring x volume name: %s + +# *.hfs updated by Joerg Jenderek +# https://en.wikipedia.org/wiki/Hierarchical_File_System +# "BD" gives many false positives +0x400 beshort 0x4244 +# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h +# first block of volume bit map (always 3) +>0x40e ubeshort 0x0003 +# maximal length of volume name is 27 +>>0x424 ubyte <28 Macintosh HFS data +!:mime application/x-apple-diskimage +#!:apple hfsdINIT +#!:apple MACSdisk +# https://www.macdisk.com/macsigen.php +#!:apple ddskdevi +!:apple ????devi +# https://en.wikipedia.org/wiki/Apple_Disk_Image +!:ext hfs/dmg +>>>0 beshort 0x4C4B (bootable) +#>>>0 beshort 0x0000 (not bootable) +>>>0x40a beshort &0x8000 (locked) +>>>0x40a beshort ^0x0100 (mounted) +>>>0x40a beshort &0x0200 (spared blocks) +>>>0x40a beshort &0x0800 (unclean) +>>>0x47C beshort 0x482B (Embedded HFS+ Volume) +# https://www.epochconverter.com/ +# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 +# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 +# construct not working +#>>>0x402 beldate-0x7C25B080 x created: %s, +#>>>0x406 beldate-0x7C25B080 x last modified: %s, +#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, +# found block sizes 200h,1200h,2800h +>>>0x414 belong x block size: %d, +>>>0x412 beshort x number of blocks: %d, +>>>0x424 pstring x volume name: %s + +0 name hfsplus +>&0 beshort x version %d data +>0 beshort 0x4C4B (bootable) +>0x404 belong ^0x00000100 (mounted) +>&2 belong &0x00000200 (spared blocks) +>&2 belong &0x00000800 (unclean) +>&2 belong &0x00008000 (locked) +>&6 string x last mounted by: '%.4s', +# really, that should be treated as a belong and we print a string +# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" +>&14 beldate-0x7C25B080 x created: %s, +# only the creation date is local time, all other timestamps in HFS+ are UTC. +>&18 bedate-0x7C25B080 x last modified: %s, +>&22 bedate-0x7C25B080 >0 last backup: %s, +>&26 bedate-0x7C25B080 >0 last checked: %s, +>&38 belong x block size: %d, +>&42 belong x number of blocks: %d, +>&46 belong x free blocks: %d + +0x400 beshort 0x482B Apple HFS Plus +>&0 use hfsplus +0x400 beshort 0x4858 Apple HFS Plus Extended +>&0 use hfsplus + +## AFAIK, only the signature is different +# same as Apple Partition Map +# GRR: This magic is too weak, it is just "TS" +#0x200 beshort 0x5453 Apple Old Partition data +#>0x2 beshort x block size: %d, +#>0x230 string x first type: %s, +#>0x210 string x name: %s, +#>0x254 belong x number of blocks: %d, +#>0x400 beshort 0x504D +#>>0x430 string x second type: %s, +#>>0x410 string x name: %s, +#>>0x454 belong x number of blocks: %d, +#>>0x800 beshort 0x504D +#>>>0x830 string x third type: %s, +#>>>0x810 string x name: %s, +#>>>0x854 belong x number of blocks: %d, +#>>>0xa00 beshort 0x504D +#>>>>0xa30 string x fourth type: %s, +#>>>>0xa10 string x name: %s, +#>>>>0xa54 belong x number of blocks: %d + +# From: Remi Mommsen <mommsen@slac.stanford.edu> +0 string BOMStore Mac OS X bill of materials (BOM) file + |