summaryrefslogtreecommitdiffstats
path: root/magic/Magdir/apple
blob: 547b0ac20aba07f01b01155f45700e4bd485712b (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
#------------------------------------------------------------------------------
# $File: apple,v 1.48 2023/05/01 14:20:21 christos Exp $
# apple:  file(1) magic for Apple file formats
#
0	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
0	string		\x0aGL			Binary II (apple ][) data
0	string		\x76\xff		Squeezed (apple ][) data
0	string		NuFile			NuFile archive (apple ][) data
0	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
0	belong		0x00051600		AppleSingle encoded Macintosh file
0	belong		0x00051607		AppleDouble encoded Macintosh file

# Type: Apple Emulator A2R format
# From: Greg Wildman <greg@apple2.org.za>
# Ref: https://applesaucefdc.com/a2r2-reference/
# Ref: https://applesaucefdc.com/a2r/
0	string		A2R
>3	string		\x31\xFF\x0A\x0D\x0A	Applesauce A2R 1.x Disk Image
>3	string		\x32\xFF\x0A\x0D\x0A	Applesauce A2R 2.x Disk Image
>3	string		\x33\xFF\x0A\x0D\x0A	Applesauce A2R 3.x Disk Image
>8	string		INFO
>>49	byte		01			\b, 5.25″ SS 40trk
>>49	byte		02			\b, 3.5″ DS 80trk
>>49	byte		03			\b, 5.25″ DS 80trk
>>49	byte		04			\b, 5.25″ DS 40trk
>>49	byte		05			\b, 3.5″ DS 80trk
>>49	byte		06			\b, 8″ DS
>>50	byte		01			\b, write protected
>>51	byte		01			\b, cross track synchronized
>>17	string/T	x			\b, %.32s

# Type: Apple Emulator WOZ format
# From: Greg Wildman <greg@apple2.org.za>
# Ref: https://applesaucefdc.com/woz/reference/
# Ref: https://applesaucefdc.com/woz/reference2/
0	string		WOZ
>3	string		\x31\xFF\x0A\x0D\x0A	Apple ][ WOZ 1.0 Disk Image
>3	string		\x32\xFF\x0A\x0D\x0A	Apple ][ WOZ 2.0 Disk Image
>12	string		INFO
>>21	byte		01			\b, 5.25 inch
>>21	byte		02			\b, 3.5 inch
>>22	byte		01			\b, write protected
>>23	byte		01			\b, cross track synchronized
>>25	string/T	x			\b, %.32s

# Type: Apple Macintosh Emulator MOOF format
# From: Greg Wildman <greg@apple2.org.za>
# Ref: https://applesaucefdc.com/moof-reference/
0	string		MOOF
>4	string		\xFF\x0A\x0D\x0A	Apple Macintosh MOOF Disk Image
>12	string		INFO
>>21	byte		01			\b, SSDD GCR (400K)
>>21	byte		02			\b, DSDD GCR (800K)
>>21	byte		03			\b, DSHD MFM (1.44M)
>>22	byte		01			\b, write protected
>>23	byte		01			\b, cross track synchronized
>>25	string/T	x			\b, %.32s

# Type: Apple Emulator disk images
# From: Greg Wildman <greg@apple2.org.za>
# ProDOS boot loader?
0		string	\x01\x38\xB0\x03\x4C	Apple ProDOS Image
# Detect Volume Directory block ($02)
>0x400		string	\x00\x00\x03\x00
>>0x404		byte	&0xF0
>>>0x405	string	x			\b, Volume /%s
>>>0x429	uleshort	x		\b, %u Blocks
# ProDOS ordered ?
>0xb00		string	\x00\x00\x03\x00
>>0xb04		byte	&0xF0
>>>0xb05	string	x			\b, Volume /%s
>>>0xb29	uleshort	x		\b, %u Blocks
#
# Proboot HD
0		string	\x01\x8A\x48\xD8\x2C\x82\xC0\x8D\x0E\xC0\x8D\x0C	Apple ProDOS ProBoot Image
>0x400		string	\x00\x00\x03\x00
>>0x404		byte	&0xF0
>>>0x405	string	x			\b, Volume /%s
>>>0x429	uleshort	x		\b, %u Blocks
>0xb00		string	\x00\x00\x03\x00
>>0xb04		byte	&0xF0
>>>0xb05	string	x			\b, Volume /%s
>>>0xb29	uleshort	x		\b, %u Blocks
0		string	\x01\xA8\x8A\x20\x7B\xF8\x29\x07\x09\xC0\x99\x30	Apple ProDOS ProBoot Image
>0x400		string	\x00\x00\x03\x00
>>0x404		byte	&0xF0
>>>0x405	string	x			\b, Volume /%s
>>>0x429	uleshort	x		\b, %u Blocks
>0xb00		string	\x00\x00\x03\x00
>>0xb04		byte	&0xF0
>>>0xb05	string	x			\b, Volume /%s
>>>0xb29	uleshort	x		\b, %u Blocks
0		string	\x01\x4A\xD0\x34\xE6\x3D\x8A\x20\x7B\xF8\x09\xC0	Apple ProDOS ProBoot Image
>0x400		string	\x00\x00\x03\x00
>>0x404		byte	&0xF0
>>>0x405	string	x			\b, Volume /%s
>>>0x429	uleshort	x		\b, %u Blocks
>0xb00		string	\x00\x00\x03\x00
>>0xb04		byte	&0xF0
>>>0xb05	string	x			\b, Volume /%s
>>>0xb29	uleshort	x		\b, %u Blocks
#
# ProDOS formatted
0		string	\x01\xBD\x88\xC0\x20\x2F\xFB\x20\x58\xFC\x20\x40	Apple ProDOS Unbootable Image
>0x400		string	\x00\x00\x03\x00
>>0x404		byte	&0xF0
>>>0x405	string	x			\b, Volume /%s
>>>0x429	uleshort	x		\b, %u Blocks
>0xb00		string	\x00\x00\x03\x00
>>0xb04		byte	&0xF0
>>>0xb05	string	x			\b, Volume /%s
>>>0xb29	uleshort	x		\b, %u Blocks
0		string	\x01\x38\xB0\x03\x4C\x1C\x09\x78\x86\x43\xC9\x03	Apple ProDOS Unbootable Image
>0x400		string	\x00\x00\x03\x00
>>0x404		byte	&0xF0
>>>0x405	string	x			\b, Volume /%s
>>>0x429	uleshort	x		\b, %u Blocks
>0xb00		string	\x00\x00\x03\x00
>>0xb04		byte	&0xF0
>>>0xb05	string	x			\b, Volume /%s
>>>0xb29	uleshort	x		\b, %u Blocks
#
# DOS3 boot loader
0		string	\x01\xA5\x27\xC9\x09\xD0
>0x11001	byte	0x11
>>0x11003	ubyte	x		Apple DOS 3.%u Image
>>0x11006	ubyte	x		\b, Volume #%03u
>>0x11034	ubyte	x		\b, %u Tracks
>>0x11035	ubyte	x		\b, %u Sectors
>>0x11036	uleshort	x		\b, %u bytes per sector
#
# DOS3 uninitialized disk
0		string	\x01\xA6\x2B\xBD\x88\xC0\x8A\x4A\x4A
>0x11001	byte	0x11
>>0x11003	ubyte	x	Apple DOS 3.%u Unbootable Image
>>>0x11006	ubyte	x		\b, Volume #%03u
>>>0x11034	ubyte	x		\b, %u Tracks
>>>0x11035	ubyte	x		\b, %u Sectors
>>>0x11036	uleshort	x		\b, %u bytes per sector
#
# Pascal boot loader?
0		string	\x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD
>0xd6		pstring SYSTEM.APPLE
>>0xb00		leshort	0x0000
>>>0xb04	leshort 0x0000		Apple Pascal Image
>>>>0xb06	pstring x		\b, Volume %s:
>>>>0xb0e	leshort x		\b, %u Blocks
>>>>0xb10	leshort x		\b, %u Files
#
# Diversi Dos boot loader?
0		string	\x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD
>0x11001	string	\x11\x0F\x03	Apple Diversi Dos Image
>>0x11006	byte	x		\b, Volume %u
>>0x11034	byte	x		\b, %u Tracks
>>0x11035	byte	x		\b, %u Sectors
>>0x11036	leshort	x		\b, %u bytes per sector

# Type: Apple Emulator 2IMG format
# From: Radek Vokal <rvokal@redhat.com>
# Update: Greg Wildman <greg@apple2.org.za>
0		string	2IMG		Apple ][ 2IMG Disk Image
>4		clear	x
>4		string	XGS!		\b, XGS
>4		string	CTKG		\b, Catakig
>4		string	ShIm		\b, Sheppy's ImageMaker
>4		string	SHEP		\b, Sheppy's ImageMaker
>4		string	WOOF		\b, Sweet 16
>4		string	B2TR		\b, Bernie ][ the Rescue
>4		string	\!nfc		\b, ASIMOV2
>4		string	\>BD\<		\b, Brutal Deluxe's Cadius
>4		string	CdrP		\b, CiderPress
>4		string	Vi][		\b, Virtual ][
>4		string	PRFS		\b, ProFUSE
>4		string	FISH		\b, FishWings
>4		string	RVLW		\b, Revival for Windows
>4		default	x
>>4		string	x		\b, Creator tag "%-4.4s"
>0xc		byte	00		\b, DOS 3.3 sector order
>>0x10		byte	00		\b, Volume 254
>>0x10		byte&0x7f x		\b, Volume %u
>0xc		byte	01		\b, ProDOS sector order
# Detect Volume Directory block ($02) + 2mg header offset
>>0x440		string	\x00\x00\x03\x00
>>>0x444	byte	&0xF0
>>>>0x445	string	x		\b, Volume /%s
>>>>0x469	uleshort	x		\b, %u Blocks
>0xc		byte	02		\b, NIB data

# Type: Peter Ferrie QBoot
# From: Greg Wildman <greg@apple2.org.za>
# Ref: https://github.com/peterferrie/qboot
0	string	\x01\x4A\xA8\x69\x0F\x85\x27\xC9
>8	string	\x12\xF0\x10\xE6\x3D\x86\xDA\x8A	Apple ][ QBoot Image

# Type: Peter Ferrie 0Boot
# From: Greg Wildman <greg@apple2.org.za>
# Ref: https://github.com/peterferrie/0boot
0	string	\x01\x4A\xA8\x69\x0F\x85\x27\xC9
>8	string	\x12\xF0\x10\xE6\x3D\x86\xDA\x8A	Apple ][ 0Boot Image

# Different proprietary boot sectors
0	string	\x01\x0F\x21\x74\x00\x01\x6B\x00\x02\x30\x81\x5D	Apple ][ Disk Image
0	string	\x01\x20\x58\xFC\xA2\x00\x8E\x78\x04\x8E\xF4\x03	Apple ][ Disk Image
0	string	\x01\x20\x58\xFC\xAD\x51\xC0\xAD\x54\xC0\xA6\x2B	Apple ][ Disk Image
0	string	\x01\x20\x89\xFE\x20\x93\xFE\xA6\x2B\xBD\x88\xC0	Apple ][ Disk Image
0	string	\x01\x20\x93\xFE\x20\x89\xFE\x4C\x25\x08\x68\x85	Apple ][ Disk Image
0	string	\x01\x20\x93\xFE\x20\x89\xFE\x4C\x2D\x08\x68\x85	Apple ][ Disk Image
0	string	\x01\x38\x90\x2A\xC9\x01\xF0\x33\xA8\xC8\xC0\x10	Apple ][ Disk Image
0	string	\x01\x38\xB0\x03\x4C\x32\xA1\x87\x43\xC9\x03\x08	Apple ][ Disk Image
0	string	\x01\x4C\x04\x08\xA9\x2A\x8D\x02\x08\x86\x2B\xEE	Apple ][ Disk Image
0	string	\x01\x4C\x60\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A	Apple ][ Disk Image
0	string	\x01\x4C\x92\x08\x01\x08\xA2\x00\xB5\x00\x9D\x00	Apple ][ Disk Image
0	string	\x01\x4C\xB3\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A	Apple ][ Disk Image
0	string	\x01\x8D\xFB\x03\x8E\xFC\x03\x8C\xFD\x03\x8A\x29	Apple ][ Disk Image
0	string	\x01\xA2\xFF\x9A\xD8\x20\x20\x08\x20\x34\x08\xAD	Apple ][ Disk Image
0	string	\x01\xA5\x27\xBD\x88\xC0\x2C\x10\xC0\xA2\x00\xA9	Apple ][ Disk Image
0	string	\x01\xA5\x2B\xAE\x51\xC0\xEA\xAA\xBD\x88\xC0\x20	Apple ][ Disk Image
0	string	\x01\xA6\x27\xBD\x0B\x08\x48\xBD\x0A\x08\x48\x85	Apple ][ Disk Image
0	string	\x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x01\x85	Apple ][ Disk Image
0	string	\x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x25\x85	Apple ][ Disk Image
0	string	\x01\xA8\xC0\x0F\x90\x16\xF0\x12\xA0\xFF\x18\xAD	Apple ][ Disk Image
0	string	\x01\xA9\x00\x85\xF0\xA9\x04\x85\xF1\xA0\x00\xA9	Apple ][ Disk Image
0	string	\x01\xA9\x5C\x8D\xF2\x03\xA9\xC6\x8D\xF3\x03\x49	Apple ][ Disk Image
0	string	\x01\xA9\x60\x8D\x01\x08\x20\x2F\xFB\x20\x58\xFC	Apple ][ Disk Image
0	string	\x01\xA9\x60\x8D\x01\x08\x20\x49\x08\xA9\x0A\x85	Apple ][ Disk Image
0	string	\x01\xA9\x60\x8D\x01\x08\x2C\x82\xC0\xBD\x88\xC0	Apple ][ Disk Image
0	string	\x01\xA9\x60\x8D\x01\x08\x86\x43\x8A\x4A\x4A\x4A	Apple ][ Disk Image
0	string	\x01\xA9\x60\x8D\x01\x08\xA2\x00\x86\xFF\xB5\x00	Apple ][ Disk Image
0	string	\x01\xA9\x60\x8D\x01\x08\xA2\x00\xB5\x00\x9D\x00	Apple ][ Disk Image
0	string	\x01\xA9\x60\x8D\x01\x08\xA9\xB2\x8D\xF2\x03\xA9	Apple ][ Disk Image
0	string	\x01\xA9\x60\x8D\x01\x08\xA9\xFF\x8D\xF3\x03\x8D	Apple ][ Disk Image
0	string	\x01\xAC\x00\x08\xF0\x19\xB9\x30\x08\x85\x3D\xCE	Apple ][ Disk Image
0	string	\x01\xAC\x23\x08\x30\x2E\xB9\x24\x08\x85\x3D\xCE	Apple ][ Disk Image
0	string	\x01\xAD\x00\x08\xC9\x09\xB0\x20\x69\x02\x8D\x00	Apple ][ Disk Image
0	string	\x01\xB0\x00\xA9\x3C\x8D\x02\x08\x86\x2B\x8A\x4A	Apple ][ Disk Image
0	string	\x01\xB0\x00\xA9\x3C\x8D\x02\x08\xA9\xF5\x8D\xF2	Apple ][ Disk Image
0	string	\x01\xB0\x00\xA9\x3F\x8D\x02\x08\x86\x2B\x8E\xF4	Apple ][ Disk Image
0	string	\x01\xB0\x00\xA9\x48\x8D\x02\x08\x86\x2B\x8E\xF4	Apple ][ Disk Image
0	string	\x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x09\xC0\x8D	Apple ][ Disk Image
0	string	\x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x8D\x2F\x08	Apple ][ Disk Image
0	string	\x01\xD8\x2C\x81\xC0\xA9\x60\x4D\x58\xFF\xD0\xFE	Apple ][ Disk Image
0	string	\x01\xD8\x78\xBD\x88\xC0\xA9\xFD\x85\x37\x85\x39	Apple ][ Disk Image
0	string	\x01\xE0\x60\xF0\x03\x4C\x16\x09\xAD\x00\x08\xC9	Apple ][ Disk Image
0	string	\x01\xE0\x60\xF0\x03\x4C\xCB\x08\xAD\x00\x08\xC9	Apple ][ Disk Image
0	string	\x01\xE0\x60\xF0\x03\x4C\xEE\x08\xAD\x00\x08\xC9	Apple ][ Disk Image
0	string	\x01\xE0\x60\xF0\x03\x4C\xEF\x08\xAD\x00\x08\xC9	Apple ][ Disk Image
0	string	\x01\xE0\x70\xB0\x04\xE0\x40\xB0\x39\xBD\x88\xC0	Apple ][ Disk Image
0	string	\x01\xEA\x8D\xF4\x03\xA9\x60\x9D\x88\xC0\x8D\x51	Apple ][ Disk Image

# magic for Newton PDA package formats
# from Ruda Moura <ruda@helllabs.org>
0	string	package0	Newton package, NOS 1.x,
>12	belong	&0x80000000	AutoRemove,
>12	belong	&0x40000000	CopyProtect,
>12	belong	&0x10000000	NoCompression,
>12	belong	&0x04000000	Relocation,
>12	belong	&0x02000000	UseFasterCompression,
>16	belong	x		version %d

0	string	package1	Newton package, NOS 2.x,
>12	belong	&0x80000000	AutoRemove,
>12	belong	&0x40000000	CopyProtect,
>12	belong	&0x10000000	NoCompression,
>12	belong	&0x04000000	Relocation,
>12	belong	&0x02000000	UseFasterCompression,
>16	belong	x		version %d

0	string	package4	Newton package,
>8	byte	8		NOS 1.x,
>8	byte	9		NOS 2.x,
>12	belong	&0x80000000	AutoRemove,
>12	belong	&0x40000000	CopyProtect,
>12	belong	&0x10000000	NoCompression,

# The following entries for the Apple II are for files that have
# been transferred as raw binary data from an Apple, without having
# been encapsulated by any of the above archivers.
#
# In general, Apple II formats are hard to identify because Apple DOS
# and especially Apple ProDOS have strong typing in the file system and
# therefore programmers never felt much need to include type information
# in the files themselves.
#
# Eric Fischer <enf@pobox.com>

# AppleWorks word processor:
# URL: https://en.wikipedia.org/wiki/AppleWorks
# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
# Update: Joerg Jenderek
# NOTE:
# The "O" is really the magic number, but that's so common that it's
# necessary to check the tab stops that follow it to avoid false positives.
# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
# the newer AppleWorks is from claris with extension CWK
4	string		O
# test for unused bits of zoom- , paginated-boolean bytes
>84	ubequad		^0x00Fe00000000Fe00
# look for tabstop definitions "=" no tab, "|" no tab
# "<" left tab,"^" center tab,">" right tab, "." decimal tab,
# unofficial "!" other , "\x8a" other
# official only if SFMinVers is nonzero
>>5	regex/s	[=.<>|!^\x8a]{79}	AppleWorks Word Processor
# AppleWorks Word Processor File (Apple II)
# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data"
# application/x-appleworks is mime type for claris version with cwk extension
!:mime	application/x-appleworks3
# http://home.earthlink.net/~hughhood/appleiiworksenvoy/
# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
# $70 $1A $F8 $FF is this the apple type ?
#:apple pdosp^Z\xf8\xff
!:ext awp
# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
>>>183	ubyte		30	3.0
>>>183	ubyte		!30
>>>>183	ubyte		!0	%#x
# usual tabstop start sequence "=====<"
>>>5	string		x	\b, tabstop ruler "%6.6s"
# tabstop ruler
#>>>5	string		>\0	\b, tabstops "%-79s"
# zoom switch
>>>85	  byte&0x01	>0	\b, zoomed
# whether paginated
>>>90	  byte&0x01	>0	\b, paginated
# contains any mail-merge commands
>>>92	  byte&0x01	>0	\b, with mail merge
# left margin in 1/10 inches ( normally 0 or 10 )
>>>91	ubyte		>0
>>>>91	ubyte		x	\b, %d/10 inch left margin

# AppleWorks database:
#
# This isn't really a magic number, but it's the closest thing to one
# that I could find.  The 1 and 2 really mean "order in which you defined
# categories" and "left to right, top to bottom," respectively; the D and R
# mean that the cursor should move either down or right when you press Return.

#30	string		\x01D	AppleWorks database data
#30	string		\x02D	AppleWorks database data
#30	string		\x01R	AppleWorks database data
#30	string		\x02R	AppleWorks database data

# AppleWorks spreadsheet:
#
# Likewise, this isn't really meant as a magic number.  The R or C means
# row- or column-order recalculation; the A or M means automatic or manual
# recalculation.

#131	string		RA	AppleWorks spreadsheet data
#131	string		RM	AppleWorks spreadsheet data
#131	string		CA	AppleWorks spreadsheet data
#131	string		CM	AppleWorks spreadsheet data

# Applesoft BASIC:
#
# This is incredibly sloppy, but will be true if the program was
# written at its usual memory location of 2048 and its first line
# number is less than 256.  Yuck.
# update by Joerg Jenderek at Feb 2013

# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
#0       belong&0xff00ff 0x80000 Applesoft BASIC program data
0	belong&0x00ff00ff	0x00080000
# assuming that line number must be positive
>2	leshort			>0		Applesoft BASIC program data, first line number %d
#>2     leshort         x       \b, first line number %d

# ORCA/EZ assembler:
#
# This will not identify ORCA/M source files, since those have
# some sort of date code instead of the two zero bytes at 6 and 7
# XXX Conflicts with ELF
#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
#>5      byte                    x               \b, build number %d

# Broderbund Fantavision
#
# I don't know what these values really mean, but they seem to recur.
# Will they cause too many conflicts?

# Probably :-)
#2	belong&0xFF00FF		0x040008	Fantavision movie data

# Some attempts at images.
#
# These are actually just bit-for-bit dumps of the frame buffer, so
# there's really no reasonably way to distinguish them except for their
# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
# or, occasionally, 8184.
#
# Nevertheless this will manage to catch a lot of images that happen
# to have a solid-colored line at the bottom of the screen.

# GRR: Magic too weak
#8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
#8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
#8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
#8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
#8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background

# Beagle Bros. Apple Mechanic fonts

0	belong&0xFF00FFFF	0x6400D000	Apple Mechanic font

# Apple Universal Disk Image Format (UDIF) - dmg files.
# From Johan Gade.
# These entries are disabled for now until we fix the following issues.
#
# Note there might be some problems with the "VAX COFF executable"
# entry. Note this entry should be placed before the mac filesystem section,
# particularly the "Apple Partition data" entry.
#
# The intended meaning of these tests is, that the file is only of the
# specified type if both of the lines are correct - i.e. if the first
# line matches and the second doesn't then it is not of that type.
#
#0	long	0x7801730d
#>4	long	0x62626060	UDIF read-only zlib-compressed image (UDZO)
#
# Note that this entry is recognized correctly by the "Apple Partition
# data" entry - however since this entry is more specific - this
# information seems to be more useful.
#0	long	0x45520200
#>0x410	string	disk\ image	UDIF read/write image (UDRW)

# From: Toby Peterson <toby@apple.com>
# From https://www.nationalarchives.gov.uk/pronom/fmt/866
0	string	bplist00
>8	search/500	WebMainResource	Apple Safari Webarchive
!:mime	application/x-webarchive
!:strength +50
0	string	bplist00	Apple binary property list
!:mime	application/x-bplist

# Apple binary property list (bplist)
#  Assumes version bytes are hex.
#  Provides content hints for version 0 files. Assumes that the root
#  object is the first object (true for CoreFoundation implementation).
# From: David Remahl <dremahl@apple.com>
0		string	bplist
>6		byte	x	\bCoreFoundation binary property list data, version %#c
>>7		byte	x	\b%c
>6		string		00		\b
>>8		byte&0xF0	0x00	\b
>>>8	byte&0x0F	0x00	\b, root type: null
>>>8	byte&0x0F	0x08	\b, root type: false boolean
>>>8	byte&0x0F	0x09	\b, root type: true boolean
>>8		byte&0xF0	0x10	\b, root type: integer
>>8		byte&0xF0	0x20	\b, root type: real
>>8		byte&0xF0	0x30	\b, root type: date
>>8		byte&0xF0	0x40    \b, root type: data
>>8		byte&0xF0	0x50	\b, root type: ascii string
>>8		byte&0xF0	0x60	\b, root type: unicode string
>>8		byte&0xF0	0x80	\b, root type: uid (CORRUPT)
>>8		byte&0xF0	0xa0	\b, root type: array
>>8		byte&0xF0	0xd0	\b, root type: dictionary

# Apple/NeXT typedstream data
#  Serialization format used by NeXT and Apple for various
#  purposes in YellowStep/Cocoa, including some nib files.
# From: David Remahl <dremahl@apple.com>
2		string		typedstream	NeXT/Apple typedstream data, big endian
>0		byte		x		\b, version %d
>0		byte		<5		\b
>>13	byte		0x81	\b
>>>14	ubeshort	x		\b, system %d
2		string		streamtyped NeXT/Apple typedstream data, little endian
>0		byte		x		\b, version %d
>0		byte		<5		\b
>>13	byte		0x81	\b
>>>14	uleshort	x		\b, system %d

#------------------------------------------------------------------------------
# CAF: Apple CoreAudio File Format
#
# Container format for high-end audio purposes.
# From: David Remahl <dremahl@apple.com>
#
0	string		caff		CoreAudio Format audio file
>4	beshort		<10		version %d
>6	beshort		x


#------------------------------------------------------------------------------
# Keychain database files
0	string		kych		Mac OS X Keychain File

#------------------------------------------------------------------------------
# Code Signing related file types
0	belong		0xfade0c00	Mac OS X Code Requirement
>8	belong		1			(opExpr)
>4	belong		x			- %d bytes

0	belong		0xfade0c01	Mac OS X Code Requirement Set
>8	belong		>1			containing %d items
>4	belong		x			- %d bytes

0	belong		0xfade0c02	Mac OS X Code Directory
>8	belong		x			version %x
>12	belong		>0			flags %#x
>4	belong		x			- %d bytes

0	belong		0xfade0cc0	Mac OS X Detached Code Signature (non-executable)
>4	belong		x			- %d bytes

0	belong		0xfade0cc1	Mac OS X Detached Code Signature
>8	belong		>1			(%d elements)
>4	belong		x			- %d bytes

# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
# .vdi
4	string innotek\ VirtualBox\ Disk\ Image %s

# Apple disk partition stuff
# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
# Update: Joerg Jenderek
# "ER" is APPLE_DRVR_MAP_MAGIC signature
0	beshort	0x4552
# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
#!:strength +0
# strengthen the magic by looking for used blocksizes 512 2048
>2	ubeshort&0xf1FF		0	Apple Driver Map
# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
#>>504	ubequad&0x0000FFffFFff0000	0
!:mime	application/x-apple-diskimage
!:apple	????devr
# https://en.wikipedia.org/wiki/Apple_Disk_Image
!:ext	dmg/iso
# sbBlkSize for driver descriptor map 512 2048
>>2	beshort	x			\b, blocksize %d
# sbBlkCount sometimes garbish like
# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
# 0xf2720100 for bunziped Firefox 48.0-2.dmg
# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
# 0x00009090 by syslinux-6.03/utils/isohybrid.c
>>4	ubelong	x			\b, blockcount %u
# following device/driver information not very useful
# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>8	ubeshort	x		\b, devtype %u
# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>10	ubeshort	x		\b, devid %u
# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>12	ubelong		>0
>>>12	ubelong		x		\b, driver data %u
# number of driver descriptors sbDrvrCount <= 61
# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>16	ubeshort	x		\b, driver count %u
# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
# >>18	use		apple-driver-map
# >>26	use		apple-driver-map
# # ...
# >>500	use		apple-driver-map
# number of partitions is always same in every partition (map block count)
#>>0x0204	ubelong		x	\b, %u partitions
>>0x0204	ubelong		>0	\b, contains[@0x200]:
>>>0x0200	use		apple-apm
>>0x0204	ubelong		>1	\b, contains[@0x400]:
>>>0x0400	use		apple-apm
>>0x0204	ubelong		>2	\b, contains[@0x600]:
>>>0x0600	use		apple-apm
>>0x0204	ubelong		>3	\b, contains[@0x800]:
>>>0x0800	use		apple-apm
>>0x0204	ubelong		>4	\b, contains[@0xA00]:
>>>0x0A00	use		apple-apm
>>0x0204	ubelong		>5	\b, contains[@0xC00]:
>>>0x0C00	use		apple-apm
>>0x0204	ubelong		>6	\b, contains[@0xE00]:
>>>0x0E00	use		apple-apm
>>0x0204	ubelong		>7	\b, contains[@0x1000]:
>>>0x1000	use		apple-apm
#	display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
0	name				apple-driver-map
>0	ubequad		!0
# descBlock first block of driver
>>0	ubelong	x			\b, driver start block %u
# descSize driver size in blocks
>>4	ubeshort	x		\b, size %u
# descType driver system type 1 701h F8FFh FFFFh
>>6	ubeshort	x		\b, type %#x

# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
# Update: Joerg Jenderek
# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
# magic stronger.
# for apple partition map stored as a single file
0	belong	0x504d0000
# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
#!:strength +0
>0	use		apple-apm
# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
# file: could not find any valid magic files!
#!:ext	bin
#	display apple partition map. Normally called after Apple driver map
0	name				apple-apm
>0	belong	0x504d0000		Apple Partition Map
# number of partitions
>>4	ubelong	x			\b, map block count %u
# logical block (512 bytes) start of partition
>>8	ubelong	x			\b, start block %u
>>12	ubelong	x			\b, block count %u
>>16	string >0			\b, name %s
>>48	string >0			\b, type %s
# processor type dpme_process_id[16] e.g. "68000" "68020"
>>120	string >0			\b, processor %s
# A/UX boot arguments BootArgs[128]
>>136	string >0			\b, boot arguments %s
# status of partition dpme_flags
>>88	belong	& 1			\b, valid
>>88	belong	& 2			\b, allocated
>>88	belong	& 4			\b, in use
>>88	belong	& 8			\b, has boot info
>>88	belong	& 16			\b, readable
>>88	belong	& 32			\b, writable
>>88	belong	& 64			\b, pic boot code
>>88	belong	& 128			\b, chain compatible driver
>>88	belong	& 256			\b, real driver
>>88	belong	& 512			\b, chain driver
# mount automatically at startup APPLE_PS_AUTO_MOUNT
>>88	ubelong	&0x40000000		\b, mount at startup
# is the startup partition APPLE_PS_STARTUP
>>88	ubelong	&0x80000000		\b, is the startup partition

#https://wiki.mozilla.org/DS_Store_File_Format
#https://en.wikipedia.org/wiki/.DS_Store
0	string	\0\0\0\1Bud1\0		Apple Desktop Services Store

# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
# Usually not in separate files, but have either filename rsrc with
# no extension, or a filename corresponding to another file, with
# extensions rsr/rsrc
# URL:		http://fileformats.archiveteam.org/wiki/Macintosh_resource_file
#		https://en.wikipedia.org/wiki/Resource_fork
# Reference:	https://github.com/kreativekorp/ksfl/wiki/Macintosh-Resource-File-Format
#		http://developer.apple.com/legacy/mac/library/documentation/mac/pdf/MoreMacintoshToolbox.pdf
#		https://formats.kaitai.io/resource_fork/
# Update:	Joerg Jenderek
# Note:		verified often by command like `deark -m macrsrc Icon_.rsrc`
# offset of resource data; usually starts at offset 0x0100
0	string  \000\000\001\000
# skip NPETraceSession.etl with invalid "low" map offset 0
>4	ubelong	>0xFF
# skip few Atari DEGAS Elite bitmap (eil2.pi1 nastro.pi1) with ivalid "high" 0x6550766 0x7510763 map length
>>12	ubelong	<0x8001
# most examples with zeroed system reserved field
>>>16	lelong  =0
>>>>0	use	apple-rsr
# few samples with not zeroed system reserved field like: Empty.rsrc.rsr OpenSans-CondBold.dfont
>>>16	lelong  !0
# resource fork variant with not zeroed system reserved field and copy of header 
>>>>(4.L)	ubelong	0x100
# GRR: the line above only works if in ../../src/file.h FILE_BYTES_MAX is raised from 1 MiB above 0x6ab0f4 (HelveticaNeue.dfont)
>>>>>0	use	apple-rsr
# data fork variant with not zeroed system reserved field and no copy of header 
>>>>(4.L)	ubelong	0
>>>>>0	use	apple-rsr
# Note: moved and merged from ./macintosh
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
# URL: https://en.wikipedia.org/wiki/Datafork_TrueType
# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
# don't know what they mean.
#	display information about Mac OSX datafork font DFONT
0	name		apple-dfont
>(4.L+30)	ubelong x		Mac OSX datafork font,
# https://en.wikipedia.org/wiki/Datafork_TrueType
!:mime		application/x-dfont
!:ext		dfont
# https://exiftool.org/TagNames/RSRC.html
>(4.L+30)	ubelong	0x73666e74	TrueType
>(4.L+30)	ubelong	0x464f4e54	'FONT'
>(4.L+30)	ubelong	0x4e464e54	'NFNT'
>(4.L+30)	ubelong	0x504f5354	PostScript
>(4.L+30)	ubelong	0x464f4e44	'FOND'
>(4.L+30)	ubelong	0x76657273	'vers'
#	display information about Macintosh resource
0	name		apple-rsr
>(4.L+30)	ubelong	0x73666e74
>>0	use	apple-dfont
>(4.L+30)	ubelong	0x464f4e54
>>0	use	apple-dfont
>(4.L+30)	ubelong	0x4e464e54
>>0	use	apple-dfont
>(4.L+30)	ubelong	0x504f5354
>>0	use	apple-dfont
>(4.L+30)	ubelong	0x464f4e44
>>0	use	apple-dfont
>(4.L+30)	ubelong	0x76657273
>>0	use	apple-dfont
>(4.L+30)	default	x		Apple HFS/HFS+ resource fork
#!:mime		application/octet-stream
!:mime		application/x-apple-rsr
!:ext		rsrc/rsr
# offset to resource data; usually starts at offset 0x0100
>0		ubelong		!0x100	\b, data offset %#x
# offset to resource map; positive but not nil like in NPETraceSession.etl
>4		ubelong		x	\b, map offset %#x
# length of resource map; positive with 32K limitation but not
# nil like in NPETraceSession.etl or high like 0x7510763 in nastro.pi1
>12		ubelong		x	\b, map length %#x
# length of resource data; positive but not nil like in NPETraceSession.etl
>8		ubelong		x	\b, data length %#x
# reserved 112 bytes for system use; apparently often nil, but 8fd20000h in Empty.rsrc.rsr and 0x00768c2b in OpenSans-CondBold.dfont
>16		ubelong		!0	\b, at 16 %#8.8x
# https://fontforge.org/docs/techref/macformats.html
# jump to resource map
# a copy of resource header or 16 bytes of zeros for data fork
#>(4.L)		ubelong		x	\b, DATA offset %#x
#>(4.L+4) 	ubelong 	x	\b, MAP offset %#x
#>(4.L+8) 	ubelong 	x	\b, DATA length %#x
#>(4.L+12) 	ubelong 	x	\b, MAP length %#x
# nextResourceMap; handle to next resource map; used by the Resource Manager for internal bookkeeping; should be zero
>(4.L+16) 	ubelong		!0	\b, nextResourceMap %#x
# fileRef; file reference number; used by the Resource Manager for internal bookkeeping; should be zero
>(4.L+20)	ubeshort	!0	\b, fileRef %#x
# attributes; Resource fork attributes (80h~read-only 40h~compression needed 20h~changed); other bits are reserved and should be zero
>(4.L+22)	ubeshort	!0	\b, attributes %#x
# typeListOffset; offset from resource map to start of type list like: 1Ch
>(4.L+24)	ubeshort	x	\b, list offset %#x
# nameListOffset; offset from esource map to start of name list like: 32h 46h 56h (XLISP.RSR XLISPTIN.RSR) 13Eh (HelveticaNeue.dfont)
>(4.L+26)	ubeshort	x	\b, name offset %#x
# typeCount; number of types in the map minus 1; If there are no resources, this is 0xFFFF
>(4.L+28)	beshort+1	>0	\b, %u type
# plural s 
>>(4.L+28)	beshort+1	>1	\bs
# resource type list array; 1st resource type like: ALRT CODE FOND MPSR icns scsz
>>(4.L+30)	ubelong		x	\b, %#x
>>(4.L+30)	string		x	'%-.4s'
# resourceCount; number of this type resources minus one. If there is one resource of this type, this is 0x0000
>>(4.L+34)	beshort+1	x	* %d
# resourceListOffset; offset from type list to resource list like: Ah 12h DAh
>(4.L+36)	ubeshort	x	resource offset %#x

#https://en.wikipedia.org/wiki/AppleScript
0	string	FasdUAS			AppleScript compiled

# AppleWorks/ClarisWorks
# https://github.com/joshenders/appleworks_format
# http://fileformats.archiveteam.org/wiki/AppleWorks
0	name			appleworks
>0	belong&0x00ffffff	0x07e100	AppleWorks CWK Document
>0	belong&0x00ffffff	0x008803	ClarisWorks CWK Document
>0	default			x
>>0	belong			x		AppleWorks/ClarisWorks CWK Document
>0	byte			x		\b, version %d
>30	beshort			x		\b, %d
>32	beshort			x		\bx%d
!:ext cwk

4	string	BOBO
>0	byte	>4
>>12	belong	0
>>>26	belong	0
>>>>0	use	appleworks
>0	belong	0x0481ad00
>>0	use 	appleworks

# magic for Apple File System (APFS)
# from Alex Myczko <alex@aiei.ch>
32		string	NXSB		Apple File System (APFS)
>36		ulelong	x		\b, blocksize %u

# iTunes cover art (versions 1 and 2)
4		string	itch
>24		string	artw
>>0x1e8		string	data		iTunes cover art
>>>0x1ed	string	PNG		(PNG)
>>>0x1ec	beshort 0xffd8		(JPEG)

# MacPaint image
65		string	PNTGMPNT	MacPaint image data
#0		belong	2		MacPaint image data