1#------------------------------------------------------------------------------ 2# $File: archive,v 1.73 2012/11/09 22:59:30 christos Exp $ 3# archive: file(1) magic for archive formats (see also "msdos" for self- 4# extracting compressed archives) 5# 6# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 7# pre-POSIX "tar" archives are handled in the C code. 8 9# POSIX tar archives 10257 string ustar\0 POSIX tar archive 11!:mime application/x-tar # encoding: posix 12257 string ustar\040\040\0 GNU tar archive 13!:mime application/x-tar # encoding: gnu 14 15# Incremental snapshot gnu-tar format from: 16# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 170 string GNU\ tar- GNU tar incremental snapshot data 18>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 19 20# cpio archives 21# 22# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 23# The idea is to indicate archives produced on machines with the same 24# byte order as the machine running "file" with "cpio archive", and 25# to indicate archives produced on machines with the opposite byte order 26# from the machine running "file" with "byte-swapped cpio archive". 27# 28# The SVR4 "cpio(4)" hints that there are additional formats, but they 29# are defined as "short"s; I think all the new formats are 30# character-header formats and thus are strings, not numbers. 310 short 070707 cpio archive 32!:mime application/x-cpio 330 short 0143561 byte-swapped cpio archive 34!:mime application/x-cpio # encoding: swapped 350 string 070707 ASCII cpio archive (pre-SVR4 or odc) 360 string 070701 ASCII cpio archive (SVR4 with no CRC) 370 string 070702 ASCII cpio archive (SVR4 with CRC) 38 39# Debian package (needs to go before regular portable archives) 40# 410 string =!<arch>\ndebian 42!:mime application/x-debian-package 43>8 string debian-split part of multipart Debian package 44>8 string debian-binary Debian binary package 45>8 string !debian 46>68 string >\0 (format %s) 47# These next two lines do not work, because a bzip2 Debian archive 48# still uses gzip for the control.tar (first in the archive). Only 49# data.tar varies, and the location of its filename varies too. 50# file/libmagic does not current have support for ascii-string based 51# (offsets) as of 2005-09-15. 52#>81 string bz2 \b, uses bzip2 compression 53#>84 string gz \b, uses gzip compression 54#>136 ledate x created: %s 55 560 string =!<thin>\n thin archive with 57>68 belong 0 no symbol entries 58>68 belong 1 %d symbol entry 59>68 belong >1 %d symbol entries 60 61# other archives 620 long 0177555 very old archive 630 short 0177555 very old PDP-11 archive 640 long 0177545 old archive 650 short 0177545 old PDP-11 archive 660 long 0100554 apl workspace 670 string =<ar> archive 68!:mime application/x-archive 69 70# MIPS archive (needs to go before regular portable archives) 71# 720 string =!<arch>\n__________E MIPS archive 73>20 string U with MIPS Ucode members 74>21 string L with MIPSEL members 75>21 string B with MIPSEB members 76>19 string L and an EL hash table 77>19 string B and an EB hash table 78>22 string X -- out of date 79 800 search/1 -h- Software Tools format archive text 81 82# 83# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is 84# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: 85# 86# 0 string =!<arch> current ar archive 87# 0 long 0x213c6172 archive file 88# 89# and for SVR1 archives, we have: 90# 91# 0 string \<ar> System V Release 1 ar archive 92# 0 string =<ar> archive 93# 94# XXX - did Aegis really store shared libraries, breakpointed modules, 95# and absolute code program modules in the same format as new-style 96# "ar" archives? 97# 980 string =!<arch> current ar archive 99!:mime application/x-archive 100>8 string __.SYMDEF random library 101>0 belong =65538 - pre SR9.5 102>0 belong =65539 - post SR9.5 103>0 beshort 2 - object archive 104>0 beshort 3 - shared library module 105>0 beshort 4 - debug break-pointed module 106>0 beshort 5 - absolute code program module 1070 string \<ar> System V Release 1 ar archive 1080 string =<ar> archive 109# 110# XXX - from "vax", which appears to collect a bunch of byte-swapped 111# thingies, to help you recognize VAX files on big-endian machines; 112# with "leshort", "lelong", and "string", that's no longer necessary.... 113# 1140 belong 0x65ff0000 VAX 3.0 archive 1150 belong 0x3c61723e VAX 5.0 archive 116# 1170 long 0x213c6172 archive file 1180 lelong 0177555 very old VAX archive 1190 leshort 0177555 very old PDP-11 archive 120# 121# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus 122# be a random library (it said 0xff65 rather than 0177545). 123# 1240 lelong 0177545 old VAX archive 125>8 string __.SYMDEF random library 1260 leshort 0177545 old PDP-11 archive 127>8 string __.SYMDEF random library 128# 129# From "pdp" (but why a 4-byte quantity?) 130# 1310 lelong 0x39bed PDP-11 old archive 1320 lelong 0x39bee PDP-11 4.0 archive 133 134# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 135# 136# The first byte is the magic (0x1a), byte 2 is the compression type for 137# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 138# filename of the first file (null terminated). Since some types collide 139# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 140# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 1410 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 142!:mime application/x-arc 1430 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 144!:mime application/x-arc 1450 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 146!:mime application/x-arc 1470 lelong&0x8080ffff 0x0000031a ARC archive data, packed 148!:mime application/x-arc 1490 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 150!:mime application/x-arc 1510 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 152!:mime application/x-arc 153# [JW] stuff taken from idarc, obviously ARC successors: 1540 lelong&0x8080ffff 0x00000a1a PAK archive data 155!:mime application/x-arc 1560 lelong&0x8080ffff 0x0000141a ARC+ archive data 157!:mime application/x-arc 1580 lelong&0x8080ffff 0x0000481a HYP archive data 159!:mime application/x-arc 160 161# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 162# I can't create either SPARK or ArcFS archives so I have not tested this stuff 163# [GRR: the original entries collide with ARC, above; replaced with combined 164# version (not tested)] 165#0 byte 0x1a RISC OS archive (spark format) 1660 string \032archive RISC OS archive (ArcFS format) 1670 string Archive\000 RISC OS archive (ArcFS format) 168 169# All these were taken from idarc, many could not be verified. Unfortunately, 170# there were many low-quality sigs, i.e. easy to trigger false positives. 171# Please notify me of any real-world fishy/ambiguous signatures and I'll try 172# to get my hands on the actual archiver and see if I find something better. [JW] 173# probably many can be enhanced by finding some 0-byte or control char near the start 174 175# idarc calls this Crush/Uncompressed... *shrug* 1760 string CRUSH Crush archive data 177# Squeeze It (.sqz) 1780 string HLSQZ Squeeze It archive data 179# SQWEZ 1800 string SQWEZ SQWEZ archive data 181# HPack (.hpk) 1820 string HPAK HPack archive data 183# HAP 1840 string \x91\x33HF HAP archive data 185# MD/MDCD 1860 string MDmd MDCD archive data 187# LIM 1880 string LIM\x1a LIM archive data 189# SAR 1903 string LH5 SAR archive data 191# BSArc/BS2 1920 string \212\3SB \0 BSArc/BS2 archive data 193# MAR 1942 string =-ah MAR archive data 195# ACB 196#0 belong&0x00f800ff 0x00800000 ACB archive data 197# CPZ 198# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 199# JRC 2000 string JRchive JRC archive data 201# Quantum 2020 string DS\0 Quantum archive data 203# ReSOF 2040 string PK\3\6 ReSOF archive data 205# QuArk 2060 string 7\4 QuArk archive data 207# YAC 20814 string YC YAC archive data 209# X1 2100 string X1 X1 archive data 2110 string XhDr X1 archive data 212# CDC Codec (.dqt) 2130 belong&0xffffe000 0x76ff2000 CDC Codec archive data 214# AMGC 2150 string \xad6" AMGC archive data 216# NuLIB 2170 string NõFélå NuLIB archive data 218# PakLeo 2190 string LEOLZW PAKLeo archive data 220# ChArc 2210 string SChF ChArc archive data 222# PSA 2230 string PSA PSA archive data 224# CrossePAC 2250 string DSIGDCC CrossePAC archive data 226# Freeze 2270 string \x1f\x9f\x4a\x10\x0a Freeze archive data 228# KBoom 2290 string ¨MP¨ KBoom archive data 230# NSQ, must go after CDC Codec 2310 string \x76\xff NSQ archive data 232# DPA 2330 string Dirk\ Paehl DPA archive data 234# BA 235# TODO: idarc says "bytes 0-2 == bytes 3-5" 236# TTComp 2370 string \0\6 TTComp archive data 238# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 2390 string ESP ESP archive data 240# ZPack 2410 string \1ZPK\1 ZPack archive data 242# Sky 2430 string \xbc\x40 Sky archive data 244# UFA 2450 string UFA UFA archive data 246# Dry 2470 string =-H2O DRY archive data 248# FoxSQZ 2490 string FOXSQZ FoxSQZ archive data 250# AR7 2510 string ,AR7 AR7 archive data 252# PPMZ 2530 string PPMZ PPMZ archive data 254# MS Compress 2554 string \x88\xf0\x27 MS Compress archive data 256# updated by Joerg Jenderek 257>9 string \0 258>>0 string KWAJ 259>>>7 string \321\003 MS Compress archive data 260>>>>14 ulong >0 \b, original size: %ld bytes 261>>>>18 ubyte >0x65 262>>>>>18 string x \b, was %.8s 263>>>>>(10.b-4) string x \b.%.3s 264# MP3 (archiver, not lossy audio compression) 2650 string MP3\x1a MP3-Archiver archive data 266# ZET 2670 string OZÝ ZET archive data 268# TSComp 2690 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 270# ARQ 2710 string gW\4\1 ARQ archive data 272# Squash 2733 string OctSqu Squash archive data 274# Terse 2750 string \5\1\1\0 Terse archive data 276# PUCrunch 2770 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 278# UHarc 2790 string UHA UHarc archive data 280# ABComp 2810 string \2AB ABComp archive data 2820 string \3AB2 ABComp archive data 283# CMP 2840 string CO\0 CMP archive data 285# Splint 2860 string \x93\xb9\x06 Splint archive data 287# InstallShield 2880 string \x13\x5d\x65\x8c InstallShield Z archive Data 289# Gather 2901 string GTH Gather archive data 291# BOA 2920 string BOA BOA archive data 293# RAX 2940 string ULEB\xa RAX archive data 295# Xtreme 2960 string ULEB\0 Xtreme archive data 297# Pack Magic 2980 string @â\1\0 Pack Magic archive data 299# BTS 3000 belong&0xfeffffff 0x1a034465 BTS archive data 301# ELI 5750 3020 string Ora\ ELI 5750 archive data 303# QFC 3040 string \x1aFC\x1a QFC archive data 3050 string \x1aQF\x1a QFC archive data 306# PRO-PACK 3070 string RNC PRO-PACK archive data 308# 777 3090 string 777 777 archive data 310# LZS221 3110 string sTaC LZS221 archive data 312# HPA 3130 string HPA HPA archive data 314# Arhangel 3150 string LG Arhangel archive data 316# EXP1, uses bzip2 3170 string 0123456789012345BZh EXP1 archive data 318# IMP 3190 string IMP\xa IMP archive data 320# NRV 3210 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 322# Squish 3230 string \x73\xb2\x90\xf4 Squish archive data 324# Par 3250 string PHILIPP Par archive data 3260 string PAR Par archive data 327# HIT 3280 string UB HIT archive data 329# SBX 3300 belong&0xfffff000 0x53423000 SBX archive data 331# NaShrink 3320 string NSK NaShrink archive data 333# SAPCAR 3340 string #\ CAR\ archive\ header SAPCAR archive data 3350 string CAR\ 2.00RG SAPCAR archive data 336# Disintegrator 3370 string DST Disintegrator archive data 338# ASD 3390 string ASD ASD archive data 340# InstallShield CAB 3410 string ISc( InstallShield CAB 342# TOP4 3430 string T4\x1a TOP4 archive data 344# BatComp left out: sig looks like COM executable 345# so TODO: get real 4dos batcomp file and find sig 346# BlakHole 3470 string BH\5\7 BlakHole archive data 348# BIX 3490 string BIX0 BIX archive data 350# ChiefLZA 3510 string ChfLZ ChiefLZA archive data 352# Blink 3530 string Blink Blink archive data 354# Logitech Compress 3550 string \xda\xfa Logitech Compress archive data 356# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 3571 string (C)\ STEPANYUK ARS-Sfx archive data 358# AKT/AKT32 3590 string AKT32 AKT32 archive data 3600 string AKT AKT archive data 361# NPack 3620 string MSTSM NPack archive data 363# PFT 3640 string \0\x50\0\x14 PFT archive data 365# SemOne 3660 string SEM SemOne archive data 367# PPMD 3680 string \x8f\xaf\xac\x84 PPMD archive data 369# FIZ 3700 string FIZ FIZ archive data 371# MSXiE 3720 belong&0xfffff0f0 0x4d530000 MSXiE archive data 373# DeepFreezer 3740 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 375# DC 3760 string =<DC- DC archive data 377# TPac 3780 string \4TPAC\3 TPac archive data 379# Ai 3800 string Ai\1\1\0 Ai archive data 3810 string Ai\1\0\0 Ai archive data 382# Ai32 3830 string Ai\2\0 Ai32 archive data 3840 string Ai\2\1 Ai32 archive data 385# SBC 3860 string SBC SBC archive data 387# Ybs 3880 string YBS Ybs archive data 389# DitPack 3900 string \x9e\0\0 DitPack archive data 391# DMS 3920 string DMS! DMS archive data 393# EPC 3940 string \x8f\xaf\xac\x8c EPC archive data 395# VSARC 3960 string VS\x1a VSARC archive data 397# PDZ 3980 string PDZ PDZ archive data 399# ReDuq 4000 string rdqx ReDuq archive data 401# GCA 4020 string GCAX GCA archive data 403# PPMN 4040 string pN PPMN archive data 405# WinImage 4063 string WINIMAGE WinImage archive data 407# Compressia 4080 string CMP0CMP Compressia archive data 409# UHBC 4100 string UHB UHBC archive data 411# WinHKI 4120 string \x61\x5C\x04\x05 WinHKI archive data 413# WWPack data file 4140 string WWP WWPack archive data 415# BSN (BSA, PTS-DOS) 4160 string \xffBSG BSN archive data 4171 string \xffBSG BSN archive data 4183 string \xffBSG BSN archive data 4191 string \0\xae\2 BSN archive data 4201 string \0\xae\3 BSN archive data 4211 string \0\xae\7 BSN archive data 422# AIN 4230 string \x33\x18 AIN archive data 4240 string \x33\x17 AIN archive data 425# XPA32 4260 string xpa\0\1 XPA32 archive data 427# SZip (TODO: doesn't catch all versions) 4280 string SZ\x0a\4 SZip archive data 429# XPack DiskImage 4300 string jm XPack DiskImage archive data 431# XPack Data 4320 string xpa XPack archive data 433# XPack Single Data 4340 string Í\ jm XPack single archive data 435 436# TODO: missing due to unknown magic/magic at end of file: 437#DWC 438#ARG 439#ZAR 440#PC/3270 441#InstallIt 442#RKive 443#RK 444#XPack Diskimage 445 446# These were inspired by idarc, but actually verified 447# Dzip archiver (.dz) 4480 string DZ Dzip archive data 449>2 byte x \b, version %i 450>3 byte x \b.%i 451# ZZip archiver (.zz) 4520 string ZZ\ \0\0 ZZip archive data 4530 string ZZ0 ZZip archive data 454# PAQ archiver (.paq) 4550 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 4560 string PAQ PAQ archive data 457>3 byte&0xf0 0x30 458>>3 byte x (v%c) 459# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 4600xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 4610 string JARCS JAR (ARJ Software, Inc.) archive data 462 463# ARJ archiver (jason@jarthur.Claremont.EDU) 4640 leshort 0xea60 ARJ archive data 465!:mime application/x-arj 466>5 byte x \b, v%d, 467>8 byte &0x04 multi-volume, 468>8 byte &0x10 slash-switched, 469>8 byte &0x20 backup, 470>34 string x original name: %s, 471>7 byte 0 os: MS-DOS 472>7 byte 1 os: PRIMOS 473>7 byte 2 os: Unix 474>7 byte 3 os: Amiga 475>7 byte 4 os: Macintosh 476>7 byte 5 os: OS/2 477>7 byte 6 os: Apple ][ GS 478>7 byte 7 os: Atari ST 479>7 byte 8 os: NeXT 480>7 byte 9 os: VAX/VMS 481>3 byte >0 %d] 482# [JW] idarc says this is also possible 4832 leshort 0xea60 ARJ archive data 484 485# HA archiver (Greg Roelofs, newt@uchicago.edu) 486# This is a really bad format. A file containing HAWAII will match this... 487#0 string HA HA archive data, 488#>2 leshort =1 1 file, 489#>2 leshort >1 %u files, 490#>4 byte&0x0f =0 first is type CPY 491#>4 byte&0x0f =1 first is type ASC 492#>4 byte&0x0f =2 first is type HSC 493#>4 byte&0x0f =0x0e first is type DIR 494#>4 byte&0x0f =0x0f first is type SPECIAL 495# suggestion: at least identify small archives (<1024 files) 4960 belong&0xffff00fc 0x48410000 HA archive data 497>2 leshort =1 1 file, 498>2 leshort >1 %u files, 499>4 byte&0x0f =0 first is type CPY 500>4 byte&0x0f =1 first is type ASC 501>4 byte&0x0f =2 first is type HSC 502>4 byte&0x0f =0x0e first is type DIR 503>4 byte&0x0f =0x0f first is type SPECIAL 504 505# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 5060 string HPAK HPACK archive data 507 508# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 5090 string \351,\001JAM\ JAM archive, 510>7 string >\0 version %.4s 511>0x26 byte =0x27 - 512>>0x2b string >\0 label %.11s, 513>>0x27 lelong x serial %08x, 514>>0x36 string >\0 fstype %.8s 515 516# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 5172 string -lh0- LHarc 1.x/ARX archive data [lh0] 518!:mime application/x-lharc 5192 string -lh1- LHarc 1.x/ARX archive data [lh1] 520!:mime application/x-lharc 5212 string -lz4- LHarc 1.x archive data [lz4] 522!:mime application/x-lharc 5232 string -lz5- LHarc 1.x archive data [lz5] 524!:mime application/x-lharc 525# [never seen any but the last; -lh4- reported in comp.compression:] 5262 string -lzs- LHa/LZS archive data [lzs] 527!:mime application/x-lha 5282 string -lh\40- LHa 2.x? archive data [lh ] 529!:mime application/x-lha 5302 string -lhd- LHa 2.x? archive data [lhd] 531!:mime application/x-lha 5322 string -lh2- LHa 2.x? archive data [lh2] 533!:mime application/x-lha 5342 string -lh3- LHa 2.x? archive data [lh3] 535!:mime application/x-lha 5362 string -lh4- LHa (2.x) archive data [lh4] 537!:mime application/x-lha 5382 string -lh5- LHa (2.x) archive data [lh5] 539!:mime application/x-lha 5402 string -lh6- LHa (2.x) archive data [lh6] 541!:mime application/x-lha 5422 string -lh7- LHa (2.x)/LHark archive data [lh7] 543!:mime application/x-lha 544>20 byte x - header level %d 545# taken from idarc [JW] 5462 string -lZ PUT archive data 5472 string -lz LZS archive data 5482 string -sw1- Swag archive data 549 550# RAR archiver (Greg Roelofs, newt@uchicago.edu) 5510 string Rar! RAR archive data, 552!:mime application/x-rar 553>44 byte x v%0x, 554>10 byte >0 flags: 555>>10 byte &0x01 Archive volume, 556>>10 byte &0x02 Commented, 557>>10 byte &0x04 Locked, 558>>10 byte &0x08 Solid, 559>>10 byte &0x20 Authenticated, 560>35 byte 0 os: MS-DOS 561>35 byte 1 os: OS/2 562>35 byte 2 os: Win32 563>35 byte 3 os: Unix 564# some old version? idarc says: 5650 string RE\x7e\x5e RAR archive data 566 567# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 5680 string SQSH squished archive data (Acorn RISCOS) 569 570# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 571# [JW] see exe section for self-extracting version 5720 string UC2\x1a UC2 archive data 573 574# PKZIP multi-volume archive 5750 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 576!:mime application/zip 577 578# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 5790 string PK\005\006 Zip archive data (empty) 5800 string PK\003\004 581 582# Specialised zip formats which start with a member named 'mimetype' 583# (stored uncompressed, with no 'extra field') containing the file's MIME type. 584# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 585# contents starting with "application/": 586>26 string \x8\0\0\0mimetypeapplication/ 587 588# KOffice / OpenOffice & StarOffice / OpenDocument formats 589# From: Abel Cheung <abel@oaka.org> 590 591# KOffice (1.2 or above) formats 592# (mimetype contains "application/vnd.kde.<SUBTYPE>") 593>>50 string vnd.kde. KOffice (>=1.2) 594>>>58 string karbon Karbon document 595>>>58 string kchart KChart document 596>>>58 string kformula KFormula document 597>>>58 string kivio Kivio document 598>>>58 string kontour Kontour document 599>>>58 string kpresenter KPresenter document 600>>>58 string kspread KSpread document 601>>>58 string kword KWord document 602 603# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 604# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 605>>50 string vnd.sun.xml. OpenOffice.org 1.x 606>>>62 string writer Writer 607>>>>68 byte !0x2e document 608>>>>68 string .template template 609>>>>68 string .global global document 610>>>62 string calc Calc 611>>>>66 byte !0x2e spreadsheet 612>>>>66 string .template template 613>>>62 string draw Draw 614>>>>66 byte !0x2e document 615>>>>66 string .template template 616>>>62 string impress Impress 617>>>>69 byte !0x2e presentation 618>>>>69 string .template template 619>>>62 string math Math document 620>>>62 string base Database file 621 622# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 623# http://lists.oasis-open.org/archives/office/200505/msg00006.html 624# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 625>>50 string vnd.oasis.opendocument. OpenDocument 626>>>73 string text 627>>>>77 byte !0x2d Text 628!:mime application/vnd.oasis.opendocument.text 629>>>>77 string -template Text Template 630!:mime application/vnd.oasis.opendocument.text-template 631>>>>77 string -web HTML Document Template 632!:mime application/vnd.oasis.opendocument.text-web 633>>>>77 string -master Master Document 634!:mime application/vnd.oasis.opendocument.text-master 635>>>73 string graphics 636>>>>81 byte !0x2d Drawing 637!:mime application/vnd.oasis.opendocument.graphics 638>>>>81 string -template Template 639!:mime application/vnd.oasis.opendocument.graphics-template 640>>>73 string presentation 641>>>>85 byte !0x2d Presentation 642!:mime application/vnd.oasis.opendocument.presentation 643>>>>85 string -template Template 644!:mime application/vnd.oasis.opendocument.presentation-template 645>>>73 string spreadsheet 646>>>>84 byte !0x2d Spreadsheet 647!:mime application/vnd.oasis.opendocument.spreadsheet 648>>>>84 string -template Template 649!:mime application/vnd.oasis.opendocument.spreadsheet-template 650>>>73 string chart 651>>>>78 byte !0x2d Chart 652!:mime application/vnd.oasis.opendocument.chart 653>>>>78 string -template Template 654!:mime application/vnd.oasis.opendocument.chart-template 655>>>73 string formula 656>>>>80 byte !0x2d Formula 657!:mime application/vnd.oasis.opendocument.formula 658>>>>80 string -template Template 659!:mime application/vnd.oasis.opendocument.formula-template 660>>>73 string database Database 661!:mime application/vnd.oasis.opendocument.database 662>>>73 string image 663>>>>78 byte !0x2d Image 664!:mime application/vnd.oasis.opendocument.image 665>>>>78 string -template Template 666!:mime application/vnd.oasis.opendocument.image-template 667 668# EPUB (OEBPS) books using OCF (OEBPS Container Format) 669# From: Adam Buchbinder <adam.buchbinder@gmail.com> 670# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 671# (mimetype contains "application/epub+zip") 672>>50 string epub+zip EPUB ebook data 673!:mime application/epub+zip 674 675# Catch other ZIP-with-mimetype formats 676# In a ZIP file, the bytes immediately after a member's contents are 677# always "PK". The 2 regex rules here print the "mimetype" member's 678# contents up to the first 'P'. Luckily, most MIME types don't contain 679# any capital 'P's. This is a kludge. 680# (mimetype contains "application/<OTHER>") 681>>50 string !epub+zip 682>>>50 string !vnd.oasis.opendocument. 683>>>>50 string !vnd.sun.xml. 684>>>>>50 string !vnd.kde. 685>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 686!:mime application/zip 687# (mimetype contents other than "application/*") 688>26 string \x8\0\0\0mimetype 689>>38 string !application/ 690>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 691!:mime application/zip 692 693# Java Jar files 694>(26.s+30) leshort 0xcafe Java Jar file data (zip) 695!:mime application/jar 696 697# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 698# Next line excludes specialized formats: 699>(26.s+30) leshort !0xcafe 700>>26 string !\x8\0\0\0mimetype Zip archive data 701!:mime application/zip 702>>>4 byte 0x09 \b, at least v0.9 to extract 703>>>4 byte 0x0a \b, at least v1.0 to extract 704>>>4 byte 0x0b \b, at least v1.1 to extract 705>>>4 byte 0x14 \b, at least v2.0 to extract 706>>>4 byte 0x2d \b, at least v3.0 to extract 707>>>0x161 string WINZIP \b, WinZIP self-extracting 708 709# StarView Metafile 710# From Pierre Ducroquet <pinaraf@pinaraf.info> 7110 string VCLMTF StarView MetaFile 712>6 beshort x \b, version %d 713>8 belong x \b, size %d 714 715# Zoo archiver 71620 lelong 0xfdc4a7dc Zoo archive data 717!:mime application/x-zoo 718>4 byte >48 \b, v%c. 719>>6 byte >47 \b%c 720>>>7 byte >47 \b%c 721>32 byte >0 \b, modify: v%d 722>>33 byte x \b.%d+ 723>42 lelong 0xfdc4a7dc \b, 724>>70 byte >0 extract: v%d 725>>>71 byte x \b.%d+ 726 727# Shell archives 72810 string #\ This\ is\ a\ shell\ archive shell archive text 729!:mime application/octet-stream 730 731# 732# LBR. NB: May conflict with the questionable 733# "binary Computer Graphics Metafile" format. 734# 7350 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 736# 737# PMA (CP/M derivative of LHA) 738# 7392 string -pm0- PMarc archive data [pm0] 7402 string -pm1- PMarc archive data [pm1] 7412 string -pm2- PMarc archive data [pm2] 7422 string -pms- PMarc SFX archive (CP/M, DOS) 7435 string -pc1- PopCom compressed executable (CP/M) 744 745# From Rafael Laboissiere <rafael@laboissiere.net> 746# The Project Revision Control System (see 747# http://prcs.sourceforge.net) generates a packaged project 748# file which is recognized by the following entry: 7490 leshort 0xeb81 PRCS packaged project 750 751# Microsoft cabinets 752# by David Necas (Yeti) <yeti@physics.muni.cz> 753#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 754#>25 byte x v%d 755#>24 byte x \b.%d 756# MPi: All CABs have version 1.3, so this is pointless. 757# Better magic in debian-additions. 758 759# GTKtalog catalogs 760# by David Necas (Yeti) <yeti@physics.muni.cz> 7614 string gtktalog\ GTKtalog catalog data, 762>13 string 3 version 3 763>>14 beshort 0x677a (gzipped) 764>>14 beshort !0x677a (not gzipped) 765>13 string >3 version %s 766 767############################################################################ 768# Parity archive reconstruction file, the 'par' file format now used on Usenet. 7690 string PAR\0 PARity archive data 770>48 leshort =0 - Index file 771>48 leshort >0 - file number %d 772 773# Felix von Leitner <felix-file@fefe.de> 7740 string d8:announce BitTorrent file 775!:mime application/x-bittorrent 776 777# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 7780 beshort 0x0e0f Atari MSA archive data 779>2 beshort x \b, %d sectors per track 780>4 beshort 0 \b, 1 sided 781>4 beshort 1 \b, 2 sided 782>6 beshort x \b, starting track: %d 783>8 beshort x \b, ending track: %d 784 785# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 7860 string PK00PK\003\004 Zip archive data 787 788# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 789# by Stefan `Sec` Zehl <sec@42.org> 7907 string **ACE** ACE archive data 791>15 byte >0 version %d 792>16 byte =0x00 \b, from MS-DOS 793>16 byte =0x01 \b, from OS/2 794>16 byte =0x02 \b, from Win/32 795>16 byte =0x03 \b, from Unix 796>16 byte =0x04 \b, from MacOS 797>16 byte =0x05 \b, from WinNT 798>16 byte =0x06 \b, from Primos 799>16 byte =0x07 \b, from AppleGS 800>16 byte =0x08 \b, from Atari 801>16 byte =0x09 \b, from Vax/VMS 802>16 byte =0x0A \b, from Amiga 803>16 byte =0x0B \b, from Next 804>14 byte x \b, version %d to extract 805>5 leshort &0x0080 \b, multiple volumes, 806>>17 byte x \b (part %d), 807>5 leshort &0x0002 \b, contains comment 808>5 leshort &0x0200 \b, sfx 809>5 leshort &0x0400 \b, small dictionary 810>5 leshort &0x0800 \b, multi-volume 811>5 leshort &0x1000 \b, contains AV-String 812>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 813>5 leshort &0x2000 \b, with recovery record 814>5 leshort &0x4000 \b, locked 815>5 leshort &0x8000 \b, solid 816# Date in MS-DOS format (whatever that is) 817#>18 lelong x Created on 818 819# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 820# <doj@cubic.org> 8210x1A string sfArk sfArk compressed Soundfont 822>0x15 string 2 823>>0x1 string >\0 Version %s 824>>0x2A string >\0 : %s 825 826# DR-DOS 7.03 Packed File *.??_ 8270 string Packed\ File\ Personal NetWare Packed File 828>12 string x \b, was "%.12s" 829 830# EET archive 831# From: Tilman Sauerbeck <tilman@code-monkey.de> 8320 belong 0x1ee7ff00 EET archive 833!:mime application/x-eet 834 835# rzip archives 8360 string RZIP rzip compressed data 837>4 byte x - version %d 838>5 byte x \b.%d 839>6 belong x (%d bytes) 840 841# From: "Robert Dale" <robdale@gmail.com> 8420 belong 123 dar archive, 843>4 belong x label "%.8x 844>>8 belong x %.8x 845>>>12 beshort x %.4x" 846>14 byte 0x54 end slice 847>14 beshort 0x4e4e multi-part 848>14 beshort 0x4e53 multi-part, with -S 849 850# Symbian installation files 851# http://www.thouky.co.uk/software/psifs/sis.html 852# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8538 lelong 0x10000419 Symbian installation file 854!:mime application/vnd.symbian.install 855>4 lelong 0x1000006D (EPOC release 3/4/5) 856>4 lelong 0x10003A12 (EPOC release 6) 8570 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 858!:mime x-epoc/x-sisx-app 859 860# From "Nelson A. de Oliveira" <naoliv@gmail.com> 8610 string MPQ\032 MoPaQ (MPQ) archive 862 863# From: Dirk Jagdmann <doj@cubic.org> 864# xar archive format: http://code.google.com/p/xar/ 8650 string xar! xar archive 866>6 beshort x - version %ld 867 868# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 869# .kgb 8700 string KGB_arch KGB Archiver file 871>10 string x with compression level %.1s 872 873# xar (eXtensible ARchiver) archive 874# From: "David Remahl" <dremahl@apple.com> 8750 string xar! xar archive 876#>4 beshort x header size %d 877>6 beshort x version %d, 878#>8 quad x compressed TOC: %d, 879#>16 quad x uncompressed TOC: %d, 880>24 belong 0 no checksum 881>24 belong 1 SHA-1 checksum 882>24 belong 2 MD5 checksum 883 884# Type: Parity Archive 885# From: Daniel van Eeden <daniel_e@dds.nl> 8860 string PAR2 Parity Archive Volume Set 887 888# Bacula volume format. (Volumes always start with a block header.) 889# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 890# From: Adam Buchbinder <adam.buchbinder@gmail.com> 89112 string BB02 Bacula volume 892>20 bedate x \b, started %s 893 894# ePub is XHTML + XML inside a ZIP archive. The first member of the 895# archive must be an uncompressed file called 'mimetype' with contents 896# 'application/epub+zip' 897 898# start by checking that this is a ZIP archive, then check for the 899# proper mimetype file 900# From: Ralf Brown <ralf.brown@gmail.com> 9010 string PK\003\004 902>0x1E string mimetypeapplication/epub+zip EPUB document 903!:mime application/epub+zip 904 905# From: "Michał Górny" <mgorny@gentoo.org> 906# ZPAQ: http://mattmahoney.net/dc/zpaq.html 9070 string zPQ ZPAQ stream 908>3 byte x \b, level %d 909 910# BBeB ebook, unencrypted (LRF format) 911# URL: http://www.sven.de/librie/Librie/LrfFormat 912# From: Adam Buchbinder <adam.buchbinder@gmail.com> 9130 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 914>8 beshort x \b, version %d 915>36 byte 1 \b, front-to-back 916>36 byte 16 \b, back-to-front 917>42 beshort x \b, (%dx, 918>44 beshort x %d) 919