Lines Matching +full:android +full:- +full:24
1 #------------------------------------------------------------------------------
3 # archive: file(1) magic for archive formats (see also "msdos" for self-
7 # pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c.
11 # Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current
18 # last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad
19 # at https://sourceforge.net/projects/s-tar/files/testscripts/
21 # nul, space or ascii digit 0-7 at start of mode
29 #>>>>>>>>0 regex \^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp) NAME "%s"
32 >>>>>>>>0 regex \^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp)
33 >>>>>>>>>0 use tar-cbt
36 >>>>>>>>>0 use tar-ova
39 >>>>>>>>>0 use tar-file
41 # embedded inside others like Android Backup, Clam AntiVirus database
42 0 name tar-file
47 # creates misleading V7 header for Long path, Multi-volume, Volume type
49 !:mime application/x-gtar
52 !:mime application/x-gtar
55 !:mime application/x-gtar
58 !:mime application/x-tar
62 # created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option
64 !:mime application/x-tar
71 !:mime application/x-gtar
75 # gLOBAL and ExTENSION type only found in POSIX.1-2001 format
76 >>>156 ubyte 0x67 \b.1-2001
77 >>>156 ubyte 0x78 \b.1-2001
79 !:mime application/x-ustar
81 # version with 2 binary nuls embedded in Android Backup like com.android.settings.ab
83 !:mime application/x-ustar
87 !:mime application/x-ustar
90 #>156 ubyte x \b, %c-type
109 >0 string >\0 %-.60s
111 >100 string >\0 \b, mode %-.7s
113 >108 string >\0 \b, uid %-.7s
115 >116 string >\0 \b, gid %-.7s
118 >>124 string >\0 \b, size %-.12s
119 # coding indicated by setting the high-order bit of the leftmost byte
134 >136 string >\0 \b, seconds %-.11s
138 >157 string >\0 \b, linkname %-.40s
142 >>265 string >\0 \b, user %-.32s
144 >>297 string >\0 \b, group %-.32s
147 >>>329 string x \b, devmaj %-.7s
149 >>>337 string x \b, devmin %-.7s
151 >>345 string >\0 \b, prefix %-.155s
156 >>>257 string >\0 \b, padding: %-.40s
159 >>>257 string >\0 \b, comment: %-.40s
164 0 name tar-cbt
166 #!:mime application/x-tar
172 >0 string >\0 \b, 1st image %-.60s
180 0 name tar-ova
182 #!:mime application/x-ustar
184 !:mime application/x-virtualbox-ova
186 # assuming name[100] like: DOS-0.9.ovf FreeDOS_1.ovf Win98SE_DE.ovf
187 >0 string >\0 \b, with %-.60s
189 # Incremental snapshot gnu-tar format from:
190 # https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
191 0 string GNU\ tar- GNU tar incremental snapshot data
192 >&0 regex [0-9]\\.[0-9]+-[0-9]+ version %s
200 # from the machine running "file" with "byte-swapped cpio archive".
204 # character-header formats and thus are strings, not numbers.
210 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cpio-bin.trid.xml
211 # Note: called "CPIO archive (binary)" by TrID, "cpio/Binary LE" by 7-Zip and "CPIO" by DROID via …
213 # skip DROID fmt-635-signature-id-960.cpio by looking for pathname of 1st entry
215 !:mime application/x-cpio
216 # https://download.opensuse.org/distribution/leap/15.4/iso/openSUSE-Leap-15.4-NET-x86_64-Media.iso
220 >>0 use cpio-bin
221 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cpio-bin-sw.trid.xml
222 # Note: called "CPIO archive (byte swapped binary)" by TrID and "Cpio/Binary BE" by 7-Zip
223 0 short 0143561 byte-swapped cpio archive
224 !:mime application/x-cpio # encoding: swapped
227 >0 use cpio-bin-be
228 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cpio.trid.xml
229 # Note: called "CPIO archive (portable)" by TrID, "cpio/Portable ASCII" by 7-Zip and "cpio/odc" by…
230 0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
231 !:mime application/x-cpio
232 # https://telparia.com/fileFormatSamples/archive/cpio/ pthreads-1.60B5.osr5src.cpio cinema.cpi VOL.…
234 # Note: called "CPIO archive (portable)" by TrID, "cpio/New ASCII" by 7-Zip and "cpio/newc" by GNU…
236 !:mime application/x-cpio
237 # https://telparia.com/fileFormatSamples/archive/cpio/MainActor-2.06.3.cpio
239 # Note: called "CPIO archive (portable)" by TrID, "cpio/New CRC" by 7-Zip and "cpio/crc" by GNU cp…
241 !:mime application/x-cpio
242 # http://ftp.gnu.org/gnu/tar/tar-1.27.cpio.gz
246 # Note: verfied by 7-Zip `7z l -tcpio -slt *.cpio` and
247 # `cpio -ivt --numeric-uid-gid --file=clam.bin-le.cpio`
248 0 name cpio-bin
251 # c_ino; truncated inode number; use `ls --inode`
253 # c_mode; mode specifies permissions and file type like: ?622~?rw-r--r-- by `ls -l`
255 # c_uid; numeric user id; use `ls --numeric-uid-gid`
264 # c_mtime[2]; modification time in seconds since 1 January 1970; most-significant 16 bits first
266 # c_filesize[2]; size of pathname; most-significant 16 bits first like: 544
273 # Note: verfied by 7-Zip `7z l -tcpio -slt *.cpio` and
274 # `LANGUAGE=C cpio -ivt --numeric-uid-gid --file=clam.bin-be.cpio`
275 0 name cpio-bin-be
297 # or 32 bits. We don't say "PDP-11" or "VAX", as there might have
298 # been ports to little-endian 16-bit-int or 32-bit-int platforms
300 # to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
301 # 32-bit. There might have been big-endian ports of that sort as
304 0 leshort 0177555 very old 16-bit-int little-endian archive
305 0 beshort 0177555 very old 16-bit-int big-endian archive
306 0 lelong 0177555 very old 32-bit-int little-endian archive
307 0 belong 0177555 very old 32-bit-int big-endian archive
309 0 leshort 0177545 old 16-bit-int little-endian archive
311 0 beshort 0177545 old 16-bit-int big-endian archive
313 0 lelong 0177545 old 32-bit-int little-endian archive
315 0 belong 0177545 old 32-bit-int big-endian archive
319 # From "pdp" (but why a 4-byte quantity?)
321 0 lelong 0x39bed PDP-11 old archive
322 0 lelong 0x39bee PDP-11 4.0 archive
325 # XXX - what flavor of APL used this, and was it a variant of
335 !:mime application/x-archive
346 # https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html
347 >14 string -split part of multipart Debian package
348 !:mime application/vnd.debian.binary-package
351 >14 string -binary Debian binary package
352 !:mime application/vnd.debian.binary-package
368 # for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb
372 >>>>&-1 ubyte !0x2f
374 >>>>>&-1 ubyte x \b%c
376 >>>>>>>&-1 ubyte !0x2f
378 >>>>>>>>&-1 ubyte x \b%c
381 # dpkg-1.18.25/dpkg-split/info.c
384 # NL terminated package version like 302-5.3
404 !:mime application/x-archive
410 >22 string X -- out of date
413 # BSD/SVR2-and-later portable archive formats.
417 # Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/
418 # Note: Mach-O universal binary in ./cafebabe is dependent
420 # distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR;
426 !:mime application/x-archive
432 # Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf
434 # LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture
436 >68 belong 0x020b0619 - PA-RISC1.0 relocatable library
437 >68 belong 0x02100619 - PA-RISC1.1 relocatable library
438 >68 belong 0x02110619 - PA-RISC1.2 relocatable library
439 >68 belong 0x02140619 - PA-RISC2.0 relocatable library
450 0 search/1 -h- Software Tools format archive text
455 # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
460 !:mime application/x-arc
462 !:mime application/x-arc
464 !:mime application/x-arc
466 !:mime application/x-arc
468 !:mime application/x-arc
470 !:mime application/x-arc
473 !:mime application/x-arc
475 !:mime application/x-arc
477 !:mime application/x-arc
488 # there were many low-quality sigs, i.e. easy to trigger false positives.
489 # Please notify me of any real-world fishy/ambiguous signatures and I'll try
491 # probably many can be enhanced by finding some 0-byte or control char near the start
515 2 string =-ah MAR archive data
556 # TODO: idarc says "bytes 0-2 == bytes 3-5"
560 # GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", othe…
569 # variant ASCII, 4K dictionary (strength=48=50-2). With strength=49 wrong order! WHY?
572 # skip VAX-order 68k Blit mpx/mux executable (strength=50) handled by ./blit
573 !:strength -2
581 # variant ASCII, 2K dictionary (strength=48=50-2). With strength=49 wrong order! WHY?
584 !:strength -2
593 # skip DOS 2.0-3.2 backed up sequence 4 with many nils like LOTUS5.RAR handled by ./msdos
600 !:strength -2
602 #>-4 ubelong x LAST_BYTES=%8.8x
603 >-4 ubelong&0x00FFffFF !0
609 !:mime application/x-compress-ttcomp
631 #>-3 ubyte x \b, last 3 bytes 0x%2.2x
632 #>-2 ubeshort x \b%4.4x
646 # 00064000 for 400k GCR disks dc42-400k-gcr.trid.xml
647 # 000c8000 for 800k GCR disks dc42-800k-gcr.trid.xml
648 # 000b4000 for 720k MFM disks dc42-720k-mfm.trid.xml
649 # 00168000 for 1440k MFM disks dc42-1440k-mfm.trid.xml
653 # 01800000 24M possible
660 >>>>>0 use dc42-floppy
662 0 name dc42-floppy
667 # "-lisaem.sunder.net hd-" (dc42-lisaem.trid.xml) "-not a Macintosh disk" (dc42-nonmac.trid.xml)
669 #!:mime application/octet-stream
670 !:mime application/x-dc42-floppy-image
690 # format byte like: 12h (Lisa 400K) 24h (400K Macintosh) 96h (800K Apple II disk)
692 # 22h (double-sided MFM or Mac 800k "Disco 12.image" "IIe Installer Disk.image")
704 0 string =-H2O DRY archive data
713 # URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
719 !:mime application/x-ms-compress-kwaj
724 # compression method (0-4)
729 #>>>&-6 string x \b, TEST extension %-.3s
737 # 1-9 bytes: null-terminated file name
738 # 1-4 bytes: null-terminated file extension
744 >>>>>>>14 string x \b, %-.8s
746 >>>>>>>14 string x \b, %-.8s
747 >>>>>>>>&1 string x \b.%-.3s
751 >>>>>>>>&14 string x \b, %-.8s
754 >>>>>>>>&14 string x \b, %-.8s
755 >>>>>>>>>&1 string x \b.%-.3s
759 >>>>>>>16 string x \b, %-.8s
761 >>>>>>>16 string x \b, %-.8s
762 >>>>>>>>&1 string x \b.%-.3s
766 >>>>>>>>&16 string x \b, %-.8s
769 >>>>>>>&16 string x %-.8s
770 >>>>>>>>&1 string x \b.%-.3s
775 >>>>>>>18 string x \b, %-.8s
777 >>>>>>>18 string x \b, %-.8s
778 >>>>>>>>&1 string x \b.%-.3s
782 >>>>>>>>&18 string x \b, %-.8s
785 >>>>>>>>&18 string x \b, %-.8s
786 >>>>>>>>>&1 string x \b.%-.3s
790 >>>>>>>20 string x \b, %-.8s
792 >>>>>>>20 string x \b, %-.8s
793 >>>>>>>>&1 string x \b.%-.3s
797 >>>>>>>>&20 string x \b, %-.8s
800 >>>>>>>>&20 string x \b, %-.8s
801 >>>>>>>>>&1 string x \b.%-.3s
805 # URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
809 # verfied by 7-Zip `7z l -tMsLZ -slt *.??_` as MsLZ
810 # `deark -l -m lzss_oku -d2 setup-1-41.bin` as "LZSS.C by Haruhiko Okumura"
814 !:mime application/x-ms-compress-szdd
817 >>9 string >\0 \b, %-.1s is last character of original name
820 >>8 string !A \b, %-.1s method
823 …: https://community.flexera.com/t5/InstallShield-Knowledge-Base/InstallShield-Redistributable-Fil…
826 #!:mime application/octet-stream
827 !:mime application/x-installshield-compress-szdd
843 !:mime application/x-ms-compress-sz
851 # command like `deark -l -m edi_pack -d2 BOOK01A.IC$` as "EDI Pack LZSS1"
860 >>>>0 use edi-lzs
867 >>>>>0 use edi-pack
873 >>>>>>0 use edi-pack
878 >>>>>>>0 use edi-pack
881 >>>>>>>0 use edi-lzs
884 >>>>>>0 use edi-lzs
887 >>>>>0 use edi-lzs
890 >>>0 use edi-lzs
891 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/e/edi-lzss2.trid.xml
893 # command like `deark -l -m edi_pack -d2 4WAY.WA$` as "EDI Pack LZSS2"
895 #!:mime application/octet-stream
896 !:mime application/x-edi-pack-lzss
899 # original filename, NUL-terminated, padded to 13 bytes like: mci.vbx 4way.wav skymap.exe cmdialog.…
900 >>8 string x "%-0.13s"
901 # original file size, as a 4-byte integer.
905 0 name edi-pack
906 # Note: verified by command like `deark -l -d2 SPELMATE.H$` as "EDI Pack LZSS1"
907 # original filename, NUL-terminated, padded to 13 bytes like: ctl3d.dll spelmate.h filemenu.rc owl.…
909 >8 string x EDI LZSS packed "%-.13s"
910 #!:mime application/octet-stream
911 !:mime application/x-edi-pack-lzss
917 # Note: verified partly by command like `deark -l -m edi_pack -d2 GUNSHOT.LZS` as "EDI LZSSLib"
918 0 name edi-lzs
919 # Note: verified by command like `deark -l -d2 GUNSHOT.LZS` as "EDI LZSSLib"
922 #!:mime application/octet-stream
923 !:mime application/x-edi-pack-lzss
935 #!:mime application/octet-stream
936 !:mime application/x-compress-cazip
943 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-ftcomp.trid.xml
946 24 string/b FTCOMP FTCOMP compressed archive
947 #!:mime application/octet-stream
948 !:mime application/x-compress-ftcomp
956 0 string MP3\x1a MP3-Archiver archive data
995 # PRO-PACK https://www.segaretro.org/Rob_Northen_compression
997 >3 byte 1 PRO-PACK archive data (compression 1)
998 >3 byte 2 PRO-PACK archive data (compression 2)
1028 #!:mime application/octet-stream
1040 # http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cab-ishield.trid.xml
1043 #!:mime application/octet-stream
1044 !:mime application/x-installshield
1045 # http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cab-ishield-hdr.trid.xml
1077 # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
1078 1 string (C)\ STEPANYUK ARS-Sfx archive data
1097 0 string =<DC- DC archive data
1104 #!:mime application/octet-stream
1105 !:mime application/x-compress-ai
1108 #!:mime application/octet-stream
1109 !:mime application/x-compress-ai
1112 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-ai.trid.xml
1115 #!:mime application/octet-stream
1116 !:mime application/x-compress-ai
1127 #!:mime application/octet-stream
1128 !:mime application/x-compress-ai
1164 # BSN (BSA, PTS-DOS)
1200 #!:mime application/x-xpa-compressed
1222 !:mime application/x-dzip
1239 # reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-jar.trid.xml
1243 #!:mime application/octet-stream
1244 !:mime application/x-compress-j
1249 # reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-jarcs.trid.xml
1252 #!:mime application/octet-stream
1253 !:mime application/x-compress-jar
1258 # reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-arj.trid.xml
1263 # verified by `7z l -tarj PHRACK1.ARJ` and
1264 # `arj.exe l TEST-hk9.ARJ`
1266 # skip DROID fmt-610-signature-id-946.arj by check for valid file type of main header
1268 >>0 use arj-archive
1269 0 name arj-archive
1271 !:mime application/x-arj
1272 # look for terminating 0-character of filename
1275 #>>&-5 string x extension %.4s
1276 >>&-5 string/c .arj data
1278 >>&-5 default x
1283 >>>8 byte ^0x04 data, SFX multi-volume
1298 >8 byte &0x01 \b, password-protected
1305 >8 byte &0x04 \b, multi-volume
1306 #>8 byte &0x08 \b, file-offset
1309 # arj protection factor; maximal 10; switch hky -> factor=y+1
1311 >8 byte &0x10 \b, slash-switched
1316 # ALTNAME_FLAG; indicates dual-name archive
1317 >8 byte &0x80 \b, dual-name
1321 # file type; 2 in main header; 0~binary 1~7-bitText 2~comment 3~directory 4~VolumeLabel 5=ChapterLa…
1323 # date+time when original archive was created in MS-DOS format via ./msdos
1325 >0xC use dos-date
1335 #>>0x10 use dos-date
1349 # filename (null-terminated string); sometimes at 0x26 when 4 bytes for extra data
1358 >7 byte 0 \b, os: MS-DOS
1373 #>2 use arj-archive
1401 >0x26 byte =0x27 -
1412 0 name lharc-file
1413 # check 1st character of method id like -lz4- -lh5- or -pm2-
1414 >2 string -
1416 >>6 string -
1420 >>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b
1421 !:mime application/x-lzh-compressed
1425 >>>>>2 string -lz \b
1427 # already known -lzs- -lz4- -lz5- with old names
1428 >>>>>>2 string -lzs LHa/LZS archive data
1430 # missing -lz?- with wikipedia names
1433 >>>>>2 string -lh \b
1434 # already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
1439 >>>>>>>2 string -lh1 \b
1444 >>>>>>>2 string -lh5 \b
1449 # missing -lh?- variants (Joe Jared)
1450 >>>>>>3 regex \^lh[89a-ce] LHa (Joe Jared) archive
1452 >>>>>>2 string -lhx LHa (UNLHA32) archive
1456 # this should not happen if all -lh variants are described
1464 >>>>>>0 use lharc-header
1467 0 name lharc-header
1468 # header size 0x4 , 0x1b-0x61
1481 >>(21.b+24) ubyte <0x21 \b, %#x OS
1483 >>(21.b+24) ubyte >0x20 \b, '%c' OS
1496 #2 string -lh0- LHarc 1.x/ARX archive data [lh0]
1497 #!:mime application/x-lharc
1498 2 string -lh0-
1499 >0 use lharc-file
1500 #2 string -lh1- LHarc 1.x/ARX archive data [lh1]
1501 #!:mime application/x-lharc
1502 2 string -lh1-
1503 >0 use lharc-file
1504 # NEW -lz2- ... -lz8-
1505 2 string -lz2-
1506 >0 use lharc-file
1507 2 string -lz3-
1508 >0 use lharc-file
1509 2 string -lz4-
1510 >0 use lharc-file
1511 2 string -lz5-
1512 >0 use lharc-file
1513 2 string -lz7-
1514 >0 use lharc-file
1515 2 string -lz8-
1516 >0 use lharc-file
1517 # [never seen any but the last; -lh4- reported in comp.compression:]
1518 #2 string -lzs- LHa/LZS archive data [lzs]
1519 2 string -lzs-
1520 >0 use lharc-file
1522 #2 string -lh\40- LHa 2.x? archive data [lh ]
1523 #2 string -lhd- LHa 2.x? archive data [lhd]
1524 2 string -lhd-
1525 >0 use lharc-file
1526 #2 string -lh2- LHa 2.x? archive data [lh2]
1527 2 string -lh2-
1528 >0 use lharc-file
1529 #2 string -lh3- LHa 2.x? archive data [lh3]
1530 2 string -lh3-
1531 >0 use lharc-file
1532 #2 string -lh4- LHa (2.x) archive data [lh4]
1533 2 string -lh4-
1534 >0 use lharc-file
1535 #2 string -lh5- LHa (2.x) archive data [lh5]
1536 2 string -lh5-
1537 >0 use lharc-file
1538 #2 string -lh6- LHa (2.x) archive data [lh6]
1539 2 string -lh6-
1540 >0 use lharc-file
1541 #2 string -lh7- LHa (2.x)/LHark archive data [lh7]
1542 2 string -lh7-
1543 # !:mime application/x-lha
1544 # >20 byte x - header level %d
1545 >0 use lharc-file
1546 # NEW -lh8- ... -lhe- , -lhx-
1547 2 string -lh8-
1548 >0 use lharc-file
1549 2 string -lh9-
1550 >0 use lharc-file
1551 2 string -lha-
1552 >0 use lharc-file
1553 2 string -lhb-
1554 >0 use lharc-file
1555 2 string -lhc-
1556 >0 use lharc-file
1557 2 string -lhe-
1558 >0 use lharc-file
1559 2 string -lhx-
1560 >0 use lharc-file
1562 2 string -lZ PUT archive data
1565 #2 string -lz LZS archive data
1566 2 string -sw1- Swag archive data
1568 0 name rar-file-header
1569 >24 byte 15 \b, v1.5
1570 >24 byte 20 \b, v2.0
1571 >24 byte 29 \b, v4
1572 >15 byte 0 \b, os: MS-DOS
1579 0 name rar-archive-header
1593 !:mime application/x-rar
1597 >>(0xc.l+7) use rar-file-header
1600 >>(0xc.l+7) use rar-file-header
1602 >>7 use rar-archive-header
1605 !:mime application/x-rar
1609 # https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
1611 !:mime application/x-rar
1618 # [JW] see exe section for self-extracting version
1621 # PKZIP multi-volume archive
1622 0 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract
1626 # Android APK file (Zip archive)
1631 >>30 string AndroidManifest.xml Android package (APK), with AndroidManifest.xml
1632 !:mime application/vnd.android.package-archive
1634 >>>-22 string PK\005\006
1635 >>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1636 # Starts with META-INF/com/android/build/gradle/app-metadata.properties
1638 >>30 string META-INF/com/android/build/gradle/
1639 >>>&0 string app-metadata.properties Android package (APK), with gradle app-metadata.properties
1640 !:mime application/vnd.android.package-archive
1642 >>>>-22 string PK\005\006
1643 >>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1646 >>30 string classes.dex Android package (APK), with classes.dex
1647 !:mime application/vnd.android.package-archive
1649 >>>-22 string PK\005\006
1650 >>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1651 # Starts with META-INF/MANIFEST.MF (file name length = 20)
1654 >>30 string META-INF/MANIFEST.MF
1656 >>>-512 search resources.arsc Android package (APK), with MANIFEST.MF and resources.arsc
1657 !:mime application/vnd.android.package-archive
1659 >>>>-22 string PK\005\006
1660 >>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1661 >>>-512 default x
1663 >>>>-512 search classes.dex Android package (APK), with MANIFEST.MF and classes.dex
1664 !:mime application/vnd.android.package-archive
1666 >>>>>-22 string PK\005\006
1667 >>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1668 >>>>-512 default x
1670 >>>>>-512 search lib/armeabi Android package (APK), with MANIFEST.MF and armeabi lib
1671 !:mime application/vnd.android.package-archive
1673 >>>>>>-22 string PK\005\006
1674 >>>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1675 >>>>>-512 default x
1677 >>>>>>-512 search res/drawable Android package (APK), with MANIFEST.MF and drawables
1678 !:mime application/vnd.android.package-archive
1680 >>>>>>>-22 string PK\005\006
1681 >>>>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1683 >>>>>>-512 default x Java archive data (JAR)
1684 !:mime application/java-archive
1691 >>>>&0 string \x00\x00 Android package (APK), with zipflinger virtual entry
1692 !:mime application/vnd.android.package-archive
1694 >>>>>-22 string PK\005\006
1695 >>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
1698 >>-22 string PK\005\006
1699 >>>(-6.l-16) string APK\x20Sig\x20Block\x2042 Android package (APK), with APK Signing Block
1700 !:mime application/vnd.android.package-archive
1703 # Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
1713 # Check for have 8-byte name, 0-byte extra field, name "mimetype", and
1782 # verified by `unzip -Zv *.oxt` or `7z l -slt *.oxt`
1787 # like: Gallery-Puzzle.2.1.0.1.oxt
1792 # https://lists.oasis-open.org/archives/office/200505/msg00006.html
1799 >>>>77 string -template Text Template
1800 !:mime application/vnd.oasis.opendocument.text-template
1802 >>>>77 string -web HTML Document Template
1803 !:mime application/vnd.oasis.opendocument.text-web
1805 >>>>77 string -master
1807 !:mime application/vnd.oasis.opendocument.text-master
1809 >>>>>84 string -template Master Template
1810 !:mime application/vnd.oasis.opendocument.text-master-template
1816 >>>>81 string -template Drawing Template
1817 !:mime application/vnd.oasis.opendocument.graphics-template
1823 >>>>85 string -template Presentation Template
1824 !:mime application/vnd.oasis.opendocument.presentation-template
1830 >>>>84 string -template Spreadsheet Template
1831 !:mime application/vnd.oasis.opendocument.spreadsheet-template
1837 >>>>78 string -template Chart Template
1838 !:mime application/vnd.oasis.opendocument.chart-template
1844 >>>>80 string -template Formula Template
1845 !:mime application/vnd.oasis.opendocument.formula-template
1860 >>>>78 string -template Image Template
1861 !:mime application/vnd.oasis.opendocument.image-template
1875 # https://e-ks.kr/streamdocs/view/sd;streamdocsId=72059197557727331
1877 !:mime application/x-hwp+zip
1882 # NOTE: version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based
1883 >>50 string x-vnd.corel. Corel
1884 >>>62 string draw.document+zip Draw drawing, version 14-16
1885 !:mime application/x-vnd.corel.draw.document+zip
1887 >>>62 string draw.template+zip Draw template, version 14-16
1888 !:mime application/x-vnd.corel.draw.template+zip
1890 >>>62 string zcf.draw.document+zip Draw drawing, version 17-22
1891 !:mime application/x-vnd.corel.zcf.draw.document+zip
1893 >>>62 string zcf.draw.template+zip Draw template, version 17-22
1894 !:mime application/x-vnd.corel.zcf.draw.template+zip
1896 # URL: http://product.corel.com/help/CorelDRAW/540240626/Main/EN/Doc/CorelDRAW-Other-file-formats.h…
1898 !:mime application/x-vnd.corel.zcf.pattern+zip
1903 >>>62 string designer.document+zip DESIGNER graphics, version 14-16
1904 !:mime application/x-vnd.corel.designer.document+zip
1906 >>>62 string zcf.designer.document+zip DESIGNER graphics, version 17-21
1907 !:mime application/x-vnd.corel.zcf.designer.document+zip
1910 # CorelDRAW-Corel-Symbol-Library-CSL.html
1911 >>>62 string symbol.library+zip Symbol Library, version 6-16.3
1912 !:mime application/x-vnd.corel.symbol.library+zip
1914 >>>62 string zcf.symbol.library+zip Symbol Library, version 17-22
1915 !:mime application/x-vnd.corel.zcf.symbol.library+zip
1918 # Catch other ZIP-with-mimetype formats
1925 >>>38 regex [!-OQ-~]+ (MIME type "%s"?)
1930 >>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
1935 !:mime application/java-archive
1943 !:mime application/x-ios-app
1949 # Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
1960 >>>>0x161 string WINZIP \b, WinZIP self-extracting
1972 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-zoo-strict.trid.xml
1973 # http://distcache.freebsd.org/ports-distfiles/zoo-2.10pl1.tar.gz/zoo.h
1974 …"ZOO compressed archive (strict)" by TrID and "ZOO Compressed Archive" by DROID via PUID x-fmt/269
1975 # verified by command like `deark -m zoo -l -d2 WHRCGA.ZOO`
1977 # skip DROID x-fmt-269-signature-id-621.zoo by looking for valid major version to manipulate archive
1979 !:mime application/x-zoo
1980 # bak is extension of backup-ed zoo
1993 >>(24.l+28) ubyte x \b, extract: v%u
1994 >>(24.l+29) ubyte x \b.%u+
2015 # vdata; archive-level versioning byte like: 1 3
2018 >>24 lelong x \b; at %u
2019 # zoo_minus; zoo_start -1 for consistency checking
2022 #>>(24.l+0) ulelong !0xfdc4a7dc \b, zoo_tag=%8.8x
2024 >>(24.l+4) ubyte !2 type=%u
2026 >>(24.l+5) ubyte x method=
2027 >>>(24.l+5) ubyte 0 \bnot-compressed
2028 >>>(24.l+5) ubyte 1 \blzd
2029 >>>(24.l+5) ubyte 2 \blzh
2031 >>(24.l+6) ulelong x \b, next entry at %u
2033 #>>(24.l+10) ulelong x \b, data at %u
2034 # file_crc; CRC-16 of file data
2035 >>(24.l+18) uleshort x \b, CRC %#4.4x
2037 >>(24.l+32) lelong >0 \b, at %#x
2039 >>>(24.l+36) uleshort >0 %u bytes comment
2041 >>>>(&-6.l) string x "%s"
2043 >>(24.l+20) ulelong x \b, size %u
2045 >>(24.l+24) ulelong x (%u compressed)
2048 >>(24.l+30) ubyte =1 \b, deleted
2050 >>(24.l+31) ubyte !0 \b, structured
2052 >>(24.l+38) string x \b, %0.13s
2054 >>(24.l+4) ubyte =2
2056 >>>(24.l+51) uleshort >0
2057 #>>>(24.l+51) uleshort >0 \b, variable part length %u
2059 #>>>>(24.l+56) ubyte x \b, namlen %u
2061 #>>>>(24.l+57) ubyte x \b, dirlen %u
2063 >>>>(24.l+56) ubyte >0
2064 # lfname[256]; long file name \0-terminated
2065 >>>>>(24.l+58) string x "%s"
2066 …n jump before file name field and then jump this addtional length plus 2 (\0-terminator + dirlen f…
2067 >>>>(24.l+57) ubyte >0
2068 >>>>>(24.l+55) ubyte x
2069 # dirname[256]; directory name \0-terminated
2072 #>>>(24.l+54) uleshort x \b, entry CRC %#4.4x
2073 …; 7Fh~unknown 4~1.00hoursWestOfUTC 12 16 20~5.00hoursWestOfUTC -107~26.75hoursEastOfUTC -4~1.00hou…
2074 >>>(24.l+53) byte !0x7f \b, time zone %d/4
2076 >>>(24.l+14) lemsdosdate x \b, modified %s
2078 >>>(24.l+16) lemsdostime x %s
2082 !:mime application/octet-stream
2094 #2 string -pm0- PMarc archive data [pm0]
2095 2 string -pm0-
2096 >0 use lharc-file
2097 #2 string -pm1- PMarc archive data [pm1]
2098 2 string -pm1-
2099 >0 use lharc-file
2100 #2 string -pm2- PMarc archive data [pm2]
2101 2 string -pm2-
2102 >0 use lharc-file
2103 2 string -pms- PMarc SFX archive (CP/M, DOS)
2104 #!:mime application/x-foobar-exec
2106 5 string -pc1- PopCom compressed executable (CP/M)
2107 #!:mime application/x-
2120 #>24 byte x \b.%d
2122 # Better magic in debian-additions.
2135 >48 leshort =0 - Index file
2136 >48 leshort >0 - file number %d
2138 # Felix von Leitner <felix-file@fefe.de>
2140 !:mime application/x-bittorrent
2143 0 string d13:announce-list BitTorrent file
2144 !:mime application/x-bittorrent
2147 !:mime application/x-bittorrent
2150 !:mime application/x-bittorrent
2153 # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
2155 # Reference: http://info-coach.fr/atari/documents/_mydoc/FD_Image_File_Format.pdf
2159 # command like `deark -l -m msa -d2 PDATS578.msa` as " Atari ST floppy disk image"
2164 #!:mime application/octet-stream
2165 !:mime application/x-atari-msa
2184 # Recognize ZIP archives with prepended data by end-of-central-directory record
2187 -2 uleshort 0
2188 >&-22 string PK\005\006
2195 >>>&-1 string/T x %s script executable (Zip archive)
2200 !:mime application/x-ace-compressed
2203 >16 byte =0x00 \b, from MS-DOS
2221 >5 leshort &0x0800 \b, multi-volume
2222 >5 leshort &0x1000 \b, contains AV-String
2227 # Date in MS-DOS format (whatever that is)
2237 # DR-DOS 7.03 Packed File *.??_
2238 # Reference: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm
2241 # by looking for Control-Z skip ASCII text starting with Packed File
2243 !:mime application/x-novell-compress
2251 # From: Tilman Sauerbeck <tilman@code-monkey.de>
2253 !:mime application/x-eet
2257 >4 byte x - version %d
2262 # URL: https://help.foxitsoftware.com/kb/install-fzip-file.php
2267 0 ubequad 0x2506781901010000 Foxit add-on/update
2268 !:mime application/x-fzip
2277 >14 beshort 0x4e4e multi-part
2278 >14 beshort 0x4e53 multi-part, with -S
2288 !:mime x-epoc/x-sisx-app
2304 # Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or
2305 # 7z t -txar Xcode_10.2_beta_4.xip`
2307 !:mime application/x-xar
2317 # cksum_alg 0-2 in older and also 3-4 in newer
2318 >24 belong 0 no checksum
2319 >24 belong 1 SHA-1 checksum
2320 >24 belong 2 MD5 checksum
2321 >24 belong 3 SHA-256 checksum
2322 >24 belong 4 SHA-512 checksum
2323 >24 belong >4 unknown %#x checksum
2324 #>24 belong >4 checksum
2326 >24 belong 0
2334 >>>>>&-3 indirect x \b, contains
2335 # For SHA-1 jump 20 minus 2 bytes
2336 >24 belong 1
2343 >>>>>&-1 indirect x \b, contains
2344 # For SHA-256 jump 32 minus 2 bytes
2345 >24 belong 3
2351 >>>>>&-1 indirect x \b, contains
2352 # For SHA-512 jump 64 minus 2 bytes
2353 >24 belong 4
2359 >>>>>&-1 indirect x \b, contains
2366 # URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
2381 # https://encode.ru/threads/456-zpaq-updates/page32
2389 >36 byte 1 \b, front-to-back
2390 >36 byte 16 \b, back-to-front
2400 # *.GHS or *.[0-9] with cns program option
2404 # compression tag minus one equals numeric compression command line switch z[1-9]
2409 >>3 ubyte <11 \b, compression (Z%d-1)
2414 # 1~Image All, sector-by-sector only for *.gho
2421 >>0xff string >\0 "%-.254s"
2424 >>&-512 indirect x \b; contains
2430 !:mime application/x-chrome-extension
2433 # SeqBox - Sequenced container
2444 # http://mark0.net/download/triddefs_xml.7z/defs/a/ark-lnx.trid.xml
2450 #!:mime application/octet-stream
2451 !:mime application/x-commodore-lnx
2458 >>&0 regex [0-9]{1,5} %s directory blocks
2460 >>>&2 regex [^\r]{1,24} \b, signature "%s"
2462 >>>>&1 regex [0-9]{1,3} \b, %s files
2469 !:mime application/x-acronis-tib
2475 # strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0"
2479 #>>&-1 pstring x \b, %s
2482 #>>>>&-1 pstring x \b, %s
2493 -4 string STOP
2494 >-16 string XPAKSTOP Gentoo binary package (XPAK)
2499 # Reference: https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz
2500 # /xbmc-Krypton/xbmc/guilib/XBTF.h
2501 # /xbmc-Krypton/xbmc/guilib/XBTF.cpp
2505 !:mime application/x-xbmc-xbt
2508 >>4 string !2 \b, version %-.1s
2509 # nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp
2519 # https://salsa.debian.org/l10n-korean-team/unalz
2523 # https://cf-aldn.altools.co.kr/setup/EGG_Specification.zip
2575 >>>>3 string =a \b, for Android