1 2#------------------------------------------------------------------------------ 3# $File: msdos,v 1.125 2018/07/25 06:05:34 christos Exp $ 4# msdos: file(1) magic for MS-DOS files 5# 6 7# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 8# updated by Joerg Jenderek at Oct 2008,Apr 2011 90 string/t @ 10>1 string/cW \ echo\ off DOS batch file text 11!:mime text/x-msdos-batch 12!:ext bat 13>1 string/cW echo\ off DOS batch file text 14!:mime text/x-msdos-batch 15!:ext bat 16>1 string/cW rem DOS batch file text 17!:mime text/x-msdos-batch 18!:ext bat 19>1 string/cW set\ DOS batch file text 20!:mime text/x-msdos-batch 21!:ext bat 22 23 24# OS/2 batch files are REXX. the second regex is a bit generic, oh well 25# the matched commands seem to be common in REXX and uncommon elsewhere 26100 search/0xffff rxfuncadd 27>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 28100 search/0xffff say 29>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 30 31# updated by Joerg Jenderek at Oct 2015 32# https://de.wikipedia.org/wiki/Common_Object_File_Format 33# http://www.delorie.com/djgpp/doc/coff/filhdr.html 34# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable" 35#0 leshort 0x14c MS Windows COFF Intel 80386 object file 36#>4 ledate x stamp %s 370 leshort 0x166 MS Windows COFF MIPS R4000 object file 38#>4 ledate x stamp %s 390 leshort 0x184 MS Windows COFF Alpha object file 40#>4 ledate x stamp %s 410 leshort 0x268 MS Windows COFF Motorola 68000 object file 42#>4 ledate x stamp %s 430 leshort 0x1f0 MS Windows COFF PowerPC object file 44#>4 ledate x stamp %s 450 leshort 0x290 MS Windows COFF PA-RISC object file 46#>4 ledate x stamp %s 47 48# Tests for various EXE types. 49# 50# Many of the compressed formats were extraced from IDARC 1.23 source code. 51# 520 string/b MZ 53# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 54>0x18 leshort <0x40 MS-DOS executable 55!:mime application/x-dosexec 56# Windows and later versions of DOS will allow .EXEs to be named with a .COM 57# extension, mostly for compatibility's sake. 58!:ext exe/com 59# These traditional tests usually work but not always. When test quality support is 60# implemented these can be turned on. 61#>>0x18 leshort 0x1c (Borland compiler) 62#>>0x18 leshort 0x1e (MS compiler) 63 64# If the relocation table is 0x40 or more bytes into the file, it's definitely 65# not a DOS EXE. 66>0x18 leshort >0x3f 67 68# Maybe it's a PE? 69>>(0x3c.l) string PE\0\0 PE 70!:mime application/x-dosexec 71>>>(0x3c.l+24) leshort 0x010b \b32 executable 72>>>(0x3c.l+24) leshort 0x020b \b32+ executable 73>>>(0x3c.l+24) leshort 0x0107 ROM image 74>>>(0x3c.l+24) default x Unknown PE signature 75>>>>&0 leshort x 0x%x 76>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 77>>>(0x3c.l+92) leshort 1 78# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the 79# drivers in Windows/System32/drivers/*.sys. 80>>>>(0x3c.l+22) leshort&0x2000 >0 (native) 81!:ext dll/sys 82>>>>(0x3c.l+22) leshort&0x2000 0 (native) 83!:ext exe/sys 84>>>(0x3c.l+92) leshort 2 85>>>>(0x3c.l+22) leshort&0x2000 >0 (GUI) 86# These could probably be at least partially distinguished from one another by 87# looking for specific exported functions. 88# CPL: Control Panel item 89# TLB: Type library 90# OCX: OLE/ActiveX control 91# ACM: Audio compression manager codec 92# AX: DirectShow source filter 93# IME: Input method editor 94!:ext dll/cpl/tlb/ocx/acm/ax/ime 95>>>>(0x3c.l+22) leshort&0x2000 0 (GUI) 96# Screen savers typically include code from the scrnsave.lib static library, but 97# that's not guaranteed. 98!:ext exe/scr 99>>>(0x3c.l+92) leshort 3 100>>>>(0x3c.l+22) leshort&0x2000 >0 (console) 101!:ext dll/cpl/tlb/ocx/acm/ax/ime 102>>>>(0x3c.l+22) leshort&0x2000 0 (console) 103!:ext exe/com 104>>>(0x3c.l+92) leshort 7 (POSIX) 105>>>(0x3c.l+92) leshort 9 (Windows CE) 106>>>(0x3c.l+92) leshort 10 (EFI application) 107>>>(0x3c.l+92) leshort 11 (EFI boot service driver) 108>>>(0x3c.l+92) leshort 12 (EFI runtime driver) 109>>>(0x3c.l+92) leshort 13 (EFI ROM) 110>>>(0x3c.l+92) leshort 14 (XBOX) 111>>>(0x3c.l+92) leshort 15 (Windows boot application) 112>>>(0x3c.l+92) default x (Unknown subsystem 113>>>>&0 leshort x 0x%x) 114>>>(0x3c.l+4) leshort 0x14c Intel 80386 115>>>(0x3c.l+4) leshort 0x166 MIPS R4000 116>>>(0x3c.l+4) leshort 0x168 MIPS R10000 117>>>(0x3c.l+4) leshort 0x184 Alpha 118>>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 119>>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 120>>>(0x3c.l+4) leshort 0x1c0 ARM 121>>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 122>>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 123>>>(0x3c.l+4) leshort 0x1f0 PowerPC 124>>>(0x3c.l+4) leshort 0x200 Intel Itanium 125>>>(0x3c.l+4) leshort 0x266 MIPS16 126>>>(0x3c.l+4) leshort 0x268 Motorola 68000 127>>>(0x3c.l+4) leshort 0x290 PA-RISC 128>>>(0x3c.l+4) leshort 0x366 MIPSIV 129>>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 130>>>(0x3c.l+4) leshort 0xebc EFI byte code 131>>>(0x3c.l+4) leshort 0x8664 x86-64 132>>>(0x3c.l+4) leshort 0xc0ee MSIL 133>>>(0x3c.l+4) default x Unknown processor type 134>>>>&0 leshort x 0x%x 135>>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 136>>>(0x3c.l+22) leshort&0x1000 >0 system file 137>>>(0x3c.l+24) leshort 0x010b 138>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 139>>>(0x3c.l+24) leshort 0x020b 140>>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 141 142# hooray, there's a DOS extender using the PE format, with a valid PE 143# executable inside (which just prints a message and exits if run in win) 144>>>(8.s*16) string 32STUB \b, 32rtm DOS extender 145>>>(8.s*16) string !32STUB \b, for MS Windows 146>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 147>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 148>>>(0x3c.l+0xf8) search/0x140 UPX2 149>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 150>>>(0x3c.l+0xf8) search/0x140 .idata 151>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 152>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 153>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 154>>>(0x3c.l+0xf8) search/0x140 .rsrc 155>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 156>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 157>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 158>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 159>>>(0x3c.l+0xf8) search/0x140 .data 160>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 161>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 162>>>>(0x3c.l+0xf7) byte x 163>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 164>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 165>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 166>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 167>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 168>>>0x30 string Inno \b, InnoSetup self-extracting archive 169 170# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 171# must be one of the unusual subformats. 172>>(0x3c.l) string !PE\0\0 MS-DOS executable 173!:mime application/x-dosexec 174 175>>(0x3c.l) string NE \b, NE 176!:mime application/x-dosexec 177>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 178>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 179>>>(0x3c.l+0x36) byte 3 for MS-DOS 180>>>(0x3c.l+0x36) byte 4 for Windows 386 181>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 182>>>(0x3c.l+0x36) default x 183>>>>(0x3c.l+0x36) byte x (unknown OS %x) 184>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 185>>>(0x3c.l+0x0c) leshort&0x8000 0x8000 (DLL or font) 186# DRV: Driver 187# 3GR: Grabber device driver 188# CPL: Control Panel Item 189# VBX: Visual Basic Extension 190# FON: Bitmap font 191# FOT: Font resource file 192!:ext dll/drv/3gr/cpl/vbx/fon/fot 193>>>(0x3c.l+0x0c) leshort&0x8000 0 (EXE) 194!:ext exe/scr 195>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 196>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 197 198>>(0x3c.l) string LX\0\0 \b, LX 199!:mime application/x-dosexec 200>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 201>>>(0x3c.l+0x0a) leshort 1 for OS/2 202>>>(0x3c.l+0x0a) leshort 2 for MS Windows 203>>>(0x3c.l+0x0a) leshort 3 for DOS 204>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 205>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 206>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 207>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 208>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 209>>>(0x3c.l+0x08) leshort 1 i80286 210>>>(0x3c.l+0x08) leshort 2 i80386 211>>>(0x3c.l+0x08) leshort 3 i80486 212>>>(8.s*16) string emx \b, emx 213>>>>&1 string x %s 214>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 215 216# MS Windows system file, supposedly a collection of LE executables 217>>(0x3c.l) string W3 \b, W3 for MS Windows 218!:mime application/x-dosexec 219 220>>(0x3c.l) string LE\0\0 \b, LE executable 221!:mime application/x-dosexec 222>>>(0x3c.l+0x0a) leshort 1 223# some DOS extenders use LE files with OS/2 header 224>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 225>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 226>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 227>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 228>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 229>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 230>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 231# this is a wild guess; hopefully it is a specific signature 232>>>>&0x24 lelong <0x50 233>>>>>(&0x4c.l) string \xfc\xb8WATCOM 234>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 235# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 236#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 237# fails with DOS-Extenders. 238>>>(0x3c.l+0x0a) leshort 2 for MS Windows 239>>>(0x3c.l+0x0a) leshort 3 for DOS 240>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 241# VXD: VxD for Windows 95/98/Me 242# 386: VxD for Windows 2.10, 3.0, 3.1x 243# PDR: Port driver 244# MPD: Miniport driver (?) 245!:ext vxd/386/pdr/mpd 246>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 247>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 248 249# looks like ASCII, probably some embedded copyright message. 250# and definitely not NE/LE/LX/PE 251>>0x3c lelong >0x20000000 252>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 253!:mime application/x-dosexec 254!:ext exe/com 255# header data too small for extended executable 256>2 long !0 257>>0x18 leshort <0x40 258>>>(4.s*512) leshort !0x014c 259 260>>>>&(2.s-514) string !LE 261>>>>>&-2 string !BW \b, MZ for MS-DOS 262!:mime application/x-dosexec 263>>>>&(2.s-514) string LE \b, LE 264>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 265# educated guess since indirection is still not capable enough for complex offset 266# calculations (next embedded executable would be at &(&2*512+&0-2) 267# I suspect there are only LE executables in these multi-exe files 268>>>>&(2.s-514) string BW 269>>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded) 270>>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS 271 272# This sequence skips to the first COFF segment, usually .text 273>(4.s*512) leshort 0x014c \b, COFF 274!:mime application/x-dosexec 275>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 276>>(8.s*16) string emx 277>>>&1 string x for DOS, Win or OS/2, emx %s 278>>&(&0x42.l-3) byte x 279>>>&0x26 string UPX \b, UPX compressed 280# and yet another guess: small .text, and after large .data is unusal, could be 32lite 281>>&0x2c search/0xa0 .text 282>>>&0x0b lelong <0x2000 283>>>>&0 lelong >0x6000 \b, 32lite compressed 284 285>(8.s*16) string $WdX \b, WDos/X DOS extender 286 287# By now an executable type should have been printed out. The executable 288# may be a self-uncompressing archive, so look for evidence of that and 289# print it out. 290# 291# Some signatures below from Greg Roelofs, newt@uchicago.edu. 292# 293>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 294>0xe7 string LH/2\ Self-Extract \b, %s 295>0x1c string UC2X \b, UCEXE compressed 296>0x1c string WWP\ \b, WWPACK compressed 297>0x1c string RJSX \b, ARJ self-extracting archive 298>0x1c string diet \b, diet compressed 299>0x1c string LZ09 \b, LZEXE v0.90 compressed 300>0x1c string LZ91 \b, LZEXE v0.91 compressed 301>0x1c string tz \b, TinyProg compressed 302>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 303!:mime application/zip 304# Yes, this really is "Copr", not "Corp." 305>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 306!:mime application/zip 307# winarj stores a message in the stub instead of the sig in the MZ header 308>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 309>0x20 string AIN 310>>0x23 string 2 \b, AIN 2.x compressed 311>>0x23 string <2 \b, AIN 1.x compressed 312>>0x23 string >2 \b, AIN 1.x compressed 313>0x24 string LHa's\ SFX \b, LHa self-extracting archive 314!:mime application/x-lha 315>0x24 string LHA's\ SFX \b, LHa self-extracting archive 316!:mime application/x-lha 317>0x24 string \ $ARX \b, ARX self-extracting archive 318>0x24 string \ $LHarc \b, LHarc self-extracting archive 319>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 320>0x40 string aPKG \b, aPackage self-extracting archive 321>0x64 string W\ Collis\0\0 \b, Compack compressed 322>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 323>>&0xf4 search/0x140 \x0\x40\x1\x0 324>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 325>1638 string -lh5- \b, LHa self-extracting archive v2.13S 326>0x17888 string Rar! \b, RAR self-extracting archive 327 328# Skip to the end of the EXE. This will usually work fine in the PE case 329# because the MZ image is hardcoded into the toolchain and almost certainly 330# won't match any of these signatures. 331>(4.s*512) long x 332>>&(2.s-517) byte x 333>>>&0 string PK\3\4 \b, ZIP self-extracting archive 334>>>&0 string Rar! \b, RAR self-extracting archive 335>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 336>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 337>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 338>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 339>>>&7 search/400 **ACE** \b, ACE self-extracting archive 340>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 341 342# a few unknown ZIP sfxes, no idea if they are needed or if they are 343# already captured by the generic patterns above 344>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 345# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 346# 347 348# TELVOX Teleinformatica CODEC self-extractor for OS/2: 349>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 350>>49824 leshort =1 \b, 1 file 351>>49824 leshort >1 \b, %u files 352 353# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc 354# and http://www.freedos.org/software/?prog=kpdos 355# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 3560 string/b KCF FreeDOS KEYBoard Layout collection 357# only version=0x100 found 358>3 uleshort x \b, version 0x%x 359# length of string containing author,info and special characters 360>6 ubyte >0 361#>>6 pstring x \b, name=%s 362>>7 string >\0 \b, author=%-.14s 363>>7 search/254 \xff \b, info= 364#>>>&0 string x \b%-s 365>>>&0 string x \b%-.15s 366# for FreeDOS *.KL files 3670 string/b KLF FreeDOS KEYBoard Layout file 368# only version=0x100 or 0x101 found 369>3 uleshort x \b, version 0x%x 370# stringlength 371>5 ubyte >0 372>>8 string x \b, name=%-.2s 3730 string \xffKEYB\ \ \ \0\0\0\0 374>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 375 376# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017 377# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 3780 ulequad&0x07a0ffffffff 0xffffffff 379>0 use msdos-driver 3800 name msdos-driver DOS executable ( 381#!:mime application/octet-stream 382!:mime application/x-dosdriver 383# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN 384!:ext sys/dev/bin 385>40 search/7 UPX! \bUPX compressed 386# DOS device driver attributes 387>4 uleshort&0x8000 0x0000 \bblock device driver 388# character device 389>4 uleshort&0x8000 0x8000 \b 390>>4 uleshort&0x0008 0x0008 \bclock 391# fast video output by int 29h 392>>4 uleshort&0x0010 0x0010 \bfast 393# standard input/output device 394>>4 uleshort&0x0003 >0 \bstandard 395>>>4 uleshort&0x0001 0x0001 \binput 396>>>4 uleshort&0x0003 0x0003 \b/ 397>>>4 uleshort&0x0002 0x0002 \boutput 398>>4 uleshort&0x8000 0x8000 \bcharacter device driver 399>0 ubyte x 400# upx compressed device driver has garbage instead of real in name field of header 401>>40 search/7 UPX! 402>>40 default x 403# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 404>>>12 ubyte >0x2E \b 405>>>>10 ubyte >0x20 406>>>>>10 ubyte !0x2E 407>>>>>>10 ubyte !0x2A \b%c 408>>>>11 ubyte >0x20 409>>>>>11 ubyte !0x2E \b%c 410>>>>12 ubyte >0x20 411>>>>>12 ubyte !0x39 412>>>>>>12 ubyte !0x2E \b%c 413>>>13 ubyte >0x20 414>>>>13 ubyte !0x2E \b%c 415>>>>14 ubyte >0x20 416>>>>>14 ubyte !0x2E \b%c 417>>>>15 ubyte >0x20 418>>>>>15 ubyte !0x2E \b%c 419>>>>16 ubyte >0x20 420>>>>>16 ubyte !0x2E 421>>>>>>16 ubyte <0xCB \b%c 422>>>>17 ubyte >0x20 423>>>>>17 ubyte !0x2E 424>>>>>>17 ubyte <0x90 \b%c 425# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 426>>>12 ubyte <0x2F 427# they have their real name at offset 22 428# also block device drivers like DUMBDRV.SYS 429>>>>22 string >\056 %-.6s 430>4 uleshort&0x8000 0x0000 431# 32 bit sector addressing ( > 32 MB) for block devices 432>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 433# support by driver functions 13h, 17h, 18h 434>4 uleshort&0x0040 0x0040 \b,IOCTL- 435# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 436>4 uleshort&0x0800 0x0800 \b,close media- 437# output until busy support by int 10h for character device driver 438>4 uleshort&0x8000 0x8000 439>>4 uleshort&0x2000 0x2000 \b,until busy- 440# direct read/write support by driver functions 03h,0Ch 441>4 uleshort&0x4000 0x4000 \b,control strings- 442>4 uleshort&0x8000 0x8000 443>>4 uleshort&0x6840 >0 \bsupport 444>4 uleshort&0x8000 0x0000 445>>4 uleshort&0x4842 >0 \bsupport 446>0 ubyte x \b) 447# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 4480 ulequad 0x0513c00000000012 449>0 use msdos-driver 450# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field 4510 ulequad 0x32f28000ffff0016 452>0 use msdos-driver 4530 ulequad 0x007f00000000ffff 454>0 use msdos-driver 4550 ulequad 0x001600000000ffff 456>0 use msdos-driver 457# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field 4580 ulequad 0x0bf708c2ffffffff 459>0 use msdos-driver 4600 ulequad 0x07bd08c2ffffffff 461>0 use msdos-driver 462 463# updated by Joerg Jenderek 464# GRR: line below too general as it catches also 465# rt.lib DYADISKS.PIC and many more 466# start with assembler instruction MOV 4670 ubyte 0x8c 468# skip "AppleWorks word processor data" like ARTICLE.1 ./apple 469>4 string !O==== 470# skip some unknown basic binaries like RocketRnger.SHR 471>>5 string !MAIN 472# skip "GPG symmetrically encrypted data" ./gnu 473# skip "PGP symmetric key encrypted data" ./pgp 474# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type 475>>>4 ubyte >13 DOS executable (COM, 0x8C-variant) 476# the remaining files should be DOS *.COM executables 477# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd 478# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4 479# UNDELETE.COM 8cca 2e8916 6503 b430 cd21 8b 2e0200 8b 480# BOOTFIX.COM 8cca 2e8916 9603 b430 cd21 8b 2e0200 8b 481# RAWRITE3.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 482# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 483# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e 484# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e 485!:mime application/x-dosexec 486!:ext com 487 488# updated by Joerg Jenderek at Oct 2008 4890 ulelong 0xffff10eb DR-DOS executable (COM) 490# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 4910 ubeshort&0xeb8d >0xeb00 492# DR-DOS STACKER.COM SCREATE.SYS missed 493 4940 name msdos-com 495>0 byte x DOS executable (COM) 496!:mime application/x-dosexec 497!:ext com 498>6 string SFX\ of\ LHarc \b, %s 499>0x1FE leshort 0xAA55 \b, boot code 500>85 string UPX \b, UPX compressed 501>4 string \ $ARX \b, ARX self-extracting archive 502>4 string \ $LHarc \b, LHarc self-extracting archive 503>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 504 505# JMP 8bit 5060 byte 0xeb 507# allow forward jumps only 508>1 byte >-1 509# that offset must be accessible 510>>(1.b+2) byte x 511>>>0 use msdos-com 512 513# JMP 16bit 5140 byte 0xe9 515# forward jumps 516>1 short >-1 517# that offset must be accessible 518>>(1.s+3) byte x 519>>>0 use msdos-com 520# negative offset, must not lead into PSP 521>1 short <-259 522# that offset must be accessible 523>>(1,s+65539) byte x 524>>>0 use msdos-com 525 526# updated by Joerg Jenderek at Oct 2008,2015 527# following line is too general 5280 ubyte 0xb8 529# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux 530>0 string !\xb8\xc0\x07\x8e 531# modified by Joerg Jenderek 532# syslinux COM32 or COM32R executable 533>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT 534# http://www.syslinux.org/wiki/index.php/Comboot_API 535# Since version 5.00 c32 modules switched from the COM32 object format to ELF 536!:mime application/x-c32-comboot-syslinux-exec 537!:ext c32 538# http://syslinux.zytor.com/comboot.php 539# older syslinux version ( <4 ) 540# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 541# start with assembler instructions mov eax,21cd4cffh 542>>>1 lelong 0x21CD4CFf \b) 543# syslinux:doc/comboot.txt 544# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 545# eax,21cd4cfeh) as a magic number. 546# syslinux version (4.x) 547# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID 548>>>1 lelong 0x21CD4CFe \b, relocatable) 549# remaining are DOS COM executables starting with assembler instruction MOV 550# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM 551# MS-DOS SYS.COM RESTART.COM 552# SYSLINUX.COM (version 1.40 - 2.13) 553# GFXBOOT.COM (version 3.75) 554# COPYBS.COM POWEROFF.COM INT18.COM 555>>1 default x COM executable for DOS 556!:mime application/x-dosexec 557#!:mime application/x-ms-dos-executable 558#!:mime application/x-msdos-program 559!:ext com 560 5610 string/b \x81\xfc 562>4 string \x77\x02\xcd\x20\xb9 563>>36 string UPX! FREE-DOS executable (COM), UPX compressed 564!:mime application/x-dosexec 565!:ext com 566252 string Must\ have\ DOS\ version DR-DOS executable (COM) 567!:mime application/x-dosexec 568!:ext com 569# added by Joerg Jenderek at Oct 2008 570# GRR search is not working 571#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed 57234 string UPX! FREE-DOS executable (COM), UPX compressed 573!:mime application/x-dosexec 574!:ext com 57535 string UPX! FREE-DOS executable (COM), UPX compressed 576!:mime application/x-dosexec 577!:ext com 578# GRR search is not working 579#2 search/28 \xcd\x21 COM executable for MS-DOS 580#WHICHFAT.cOM 5812 string \xcd\x21 COM executable for DOS 582!:mime application/x-dosexec 583!:ext com 584#DELTREE.cOM DELTREE2.cOM 5854 string \xcd\x21 COM executable for DOS 586!:mime application/x-dosexec 587!:ext com 588#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 5895 string \xcd\x21 COM executable for DOS 590!:mime application/x-dosexec 591!:ext com 592#DELTMP.COm HASFAT32.cOM 5937 string \xcd\x21 594>0 byte !0xb8 COM executable for DOS 595!:mime application/x-dosexec 596!:ext com 597#COMP.cOM MORE.COm 59810 string \xcd\x21 599>5 string !\xcd\x21 COM executable for DOS 600!:mime application/x-dosexec 601!:ext com 602#comecho.com 60313 string \xcd\x21 COM executable for DOS 604!:mime application/x-dosexec 605!:ext com 606#HELP.COm EDIT.coM 60718 string \xcd\x21 COM executable for MS-DOS 608!:mime application/x-dosexec 609!:ext com 610#NWRPLTRM.COm 61123 string \xcd\x21 COM executable for MS-DOS 612!:mime application/x-dosexec 613!:ext com 614#LOADFIX.cOm LOADFIX.cOm 61530 string \xcd\x21 COM executable for MS-DOS 616!:mime application/x-dosexec 617!:ext com 618#syslinux.com 3.11 61970 string \xcd\x21 COM executable for DOS 620!:mime application/x-dosexec 621!:ext com 622# many compressed/converted COMs start with a copy loop instead of a jump 6230x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 624!:mime application/x-dosexec 625!:ext com 6260x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 627!:mime application/x-dosexec 628!:ext com 629>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 6300x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 631!:mime application/x-dosexec 632!:ext com 633# FIXME: missing diet .com compression 634 635# miscellaneous formats 6360 string/b LZ MS-DOS executable (built-in) 637#0 byte 0xf0 MS-DOS program library data 638# 639 640# AAF files: 641# <stuartc@rd.bbc.co.uk> Stuart Cunningham 6420 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 643>30 byte 9 (512B sectors) 644>30 byte 12 (4kB sectors) 6450 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 646>30 byte 9 (512B sectors) 647>30 byte 12 (4kB sectors) 648 649# Popular applications 6502080 string Microsoft\ Word\ 6.0\ Document %s 651!:mime application/msword 6522080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data 653!:mime application/msword 654# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 6552112 string MSWordDoc Microsoft Word document data 656!:mime application/msword 657# 6580 belong 0x31be0000 Microsoft Word Document 659!:mime application/msword 660# 6610 string/b PO^Q` Microsoft Word 6.0 Document 662!:mime application/msword 663# 6644 long 0 665>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0 666!:mime application/msword 667!:ext mcw 668>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0 669!:mime application/msword 670!:ext mcw 671>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0 672!:mime application/msword 673!:ext mcw 674>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0 675!:mime application/msword 676!:ext mcw 677 6780 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document 679!:mime application/msword 680!:ext doc 681# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs 682#512 string/b \354\245\301 Microsoft Word Document 683#!:mime application/msword 684 685# 6860 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 687!:mime application/msword 688# 6892080 string Microsoft\ Excel\ 5.0\ Worksheet %s 690!:mime application/vnd.ms-excel 691# 6920 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 693!:mime application/msword 694 6952080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s 696!:mime application/vnd.ms-excel 697# 698# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 6992114 string Biff5 Microsoft Excel 5.0 Worksheet 700!:mime application/vnd.ms-excel 701# Italian MS-Excel 7022121 string Biff5 Microsoft Excel 5.0 Worksheet 703!:mime application/vnd.ms-excel 7040 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 705!:mime application/vnd.ms-excel 706# 707# Update: Joerg Jenderek 708# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3 709# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf 710# Note: newer Lotus versions >2 use longer BOF record 711# record type (BeginningOfFile=0000h) + length (001Ah) 7120 belong 0x00001a00 713# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3 714#>18 uleshort&0x73E0 0 715# Lotus Multi Byte Character Set (LMBCS=1-31) 716>20 ubyte >0 717>>20 ubyte <32 Lotus 1-2-3 718#!:mime application/x-123 719!:mime application/vnd.lotus-1-2-3 720!:apple ????L123 721# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data" 722>>>4 uleshort 0x1000 WorKsheet, version 3 723!:ext wk3 724# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data" 725>>>4 uleshort 0x1002 WorKsheet, version 4 726# also worksheet template 4 (.wt4) 727!:ext wk4/wt4 728# no example or documentation for wk5 729#>>4 uleshort 0x???? WorKsheet, version 4 730#!:ext wk5 731# only MacrotoScript.123 example 732>>>4 uleshort 0x1003 WorKsheet, version 97 733# also worksheet template Smartmaster (.12M)? 734!:ext 123 735# only Set_Y2K.123 example 736>>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium 737!:ext 123 738# no example for this version 739>>>4 uleshort 0x8001 FoRMatting data 740!:ext frm 741# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data" 742# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet" 743>>>4 uleshort 0x8007 ForMatting data, version 3 744!:ext fm3 745>>>4 default x unknown 746# file revision sub code 0004h for worksheets 747>>>>6 uleshort =0x0004 worksheet 748!:ext wXX 749>>>>6 uleshort !0x0004 formatting data 750!:ext fXX 751# main revision number 752>>>>4 uleshort x \b, revision 0x%x 753>>>6 uleshort =0x0004 \b, cell range 754# active cellcoord range (start row, page,column ; end row, page, column) 755# start values normally 0~1st sheet A1 756>>>>8 ulelong !0 757>>>>>10 ubyte >0 \b%d* 758>>>>>8 uleshort x \b%d, 759>>>>>11 ubyte x \b%d- 760# end page mostly 0 761>>>>14 ubyte >0 \b%d* 762# end raw, column normally not 0 763>>>>12 uleshort x \b%d, 764>>>>15 ubyte x \b%d 765# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??) 766>>>>20 ubyte >1 \b, character set 0x%x 767# flags 768>>>>21 ubyte x \b, flags 0x%x 769>>>6 uleshort !0x0004 770# record type (FONTNAME=00AEh) 771>>>>30 search/29 \0\xAE 772# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n) 773>>>>>&4 string >\0 \b, 1st font "%s" 774# 775# Update: Joerg Jenderek 776# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3 777# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT 778# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x 779# record type (BeginningOfFile=0000h) + length (0002h) 7800 belong 0x00000200 781# GRR: line above is too general as it catches also MS Windows CURsor 782# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1) 783!:strength -1 784# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h 785>7 ubyte 0 786# skip Windows cursors with image width 256 and keep Lotus with positiv opcode 787>>6 ubyte >0 Lotus 788# !:mime application/x-123 789!:mime application/vnd.lotus-1-2-3 790!:apple ????L123 791# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...) 792# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3" 793>>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF) 794!:ext cnf 795>>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J 796!:ext cnf 797>>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1 798!:ext cnf 799>>>4 uleshort 0x0802 Symphony CoNFiguration 800!:ext cnf 801>>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2 802!:ext cnf 803>>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4 804!:ext cnf 805>>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x 806!:ext cnf 807>>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x 808!:ext cnf 809# (version 5.26) labeled the entry as "Lotus 123" 810# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 811>>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1 812# extension "wks" also for Microsoft Works document 813!:ext wks 814# (version 5.26) labeled the entry as "Lotus 123" 815# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 816>>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0 817!:ext wrk/wr1 818# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data" 819# TrID labeles the entry as "Lotus 123 Worksheet (V2)" 820>>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2 821# Symphony (.wr1) 822!:ext wk1/wr1 823# no example for this japan version 824>>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ 825!:ext wj1 826# no example or documentation for wk2 827#>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2 828#!:ext wk2 829# undocumented japan version 830>>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J 831!:ext wj3 832# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data" 833>>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x 834# japan version 2.4J (fj3) 835!:ext fmt/fj3 836# no example for this version 837>>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0 838!:ext frm 839# (version 5.26) labeled the entry as "Lotus 1-2-3" 840>>>4 default x unknown worksheet or configuration 841!:ext cnf 842>>>>4 uleshort x \b, revision 0x%x 843# 2nd record for most worksheets describes cells range 844>>>6 use lotus-cells 845# 3nd record for most japan worksheets describes cells range 846>>>(8.s+10) use lotus-cells 847# check and then display Lotus worksheet cells range 8480 name lotus-cells 849# look for type (RANGE=0006h) + length (0008h) at record begin 850>0 ubelong 0x06000800 \b, cell range 851# cell range (start column, row, end column, row) start values normally 0,0~A1 cell 852>>4 ulong !0 853>>>4 uleshort x \b%d, 854>>>6 uleshort x \b%d- 855# end of cell range 856>>8 uleshort x \b%d, 857>>10 uleshort x \b%d 858# EndOfLotus123 8590 string/b WordPro\0 Lotus WordPro 860!:mime application/vnd.lotus-wordpro 8610 string/b WordPro\r\373 Lotus WordPro 862!:mime application/vnd.lotus-wordpro 863 864 865# Summary: Script used by InstallScield to uninstall applications 866# Extension: .isu 867# Submitted by: unknown 868# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 8690 string \x71\xa8\x00\x00\x01\x02 870>12 string Stirling\ Technologies, InstallShield Uninstall Script 871 872# Winamp .avs 873#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 8740 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 875 876# Windows Metafile .WMF 8770 string/b \327\315\306\232 Windows metafile 878!:mime image/wmf 879!:ext wmf 8800 string/b \002\000\011\000 Windows metafile 881!:mime image/wmf 882!:ext wmf 8830 string/b \001\000\011\000 Windows metafile 884!:mime image/wmf 885!:ext wmf 886 887#tz3 files whatever that is (MS Works files) 8880 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 8890 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 8900 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 891 892# PGP sig files .sig 893#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 8940 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 8950 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 8960 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 8970 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 8980 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 8990 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 900 901# windows zips files .dmf 9020 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 903 904 905#ico files 9060 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows 907 908# Windows icons 909# Update: Joerg Jenderek 910# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 911# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG 9120 belong 0x00000100 913>9 byte 0 914>>0 byte x 915>>0 use cur-ico-dir 916>9 ubyte 0xff 917>>0 byte x 918>>0 use cur-ico-dir 919# displays number of icons and information for icon or cursor 9200 name cur-ico-dir 921# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with 922# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h 923>18 ulelong &0x00000006 924# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG) 925>>(18.l) ulelong x MS Windows 926>>>0 ubelong 0x00000100 icon resource 927#!:mime image/vnd.microsoft.icon 928!:mime image/x-icon 929!:ext ico 930>>>>4 uleshort x - %d icon 931# plural s 932>>>>4 uleshort >1 \bs 933# 1st icon 934>>>>0x06 use ico-entry 935# 2nd icon 936>>>>4 uleshort >1 937>>>>>0x16 use ico-entry 938>>>0 ubelong 0x00000200 cursor resource 939#!:mime image/x-cur 940!:mime image/x-win-bitmap 941!:ext cur 942>>>>4 uleshort x - %d icon 943>>>>4 uleshort >1 \bs 944# 1st cursor 945>>>>0x06 use cur-entry 946#>>>>0x16 use cur-entry 947# display information of one cursor entry 9480 name cur-entry 949>0 use cur-ico-entry 950>4 uleshort x \b, hotspot @%dx 951>6 uleshort x \b%d 952# display information of one icon entry 9530 name ico-entry 954>0 use cur-ico-entry 955# normally 0 1 but also found 14 956>4 uleshort >1 \b, %d planes 957# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256 958>6 uleshort >1 \b, %d bits/pixel 959# display shared information of cursor or icon entry 9600 name cur-ico-entry 961>0 byte =0 \b, 256x 962>0 byte !0 \b, %dx 963>1 byte =0 \b256 964>1 byte !0 \b%d 965# number of colors in palette 966>2 ubyte !0 \b, %d colors 967# reserved 0 FFh 968#>3 ubyte x \b, reserved %x 969#>8 ulelong x \b, image size %d 970# offset of PNG or DIB image 971#>12 ulelong x \b, offset 0x%x 972# PNG header (\x89PNG) 973>(12.l) ubelong =0x89504e47 974>>&-4 indirect x \b with 975# DIB image 976>(12.l) ubelong !0x89504e47 977#>>&-4 use dib-image 978 979# Windows non-animated cursors 980# Update: Joerg Jenderek 981# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 982# Note: similar to Windows ICOn. container for BMP ( only DIB part) 983# GRR: line below is too general as it catches also Lotus 1-2-3 files 9840 belong 0x00000200 985>9 byte 0 986>>0 use cur-ico-dir 987>9 ubyte 0xff 988>>0 use cur-ico-dir 989 990# .chr files 9910 string/b PK\010\010BGI Borland font 992>4 string >\0 %s 993# then there is a copyright notice 994 995 996# .bgi files 9970 string/b pk\010\010BGI Borland device 998>4 string >\0 %s 999# then there is a copyright notice 1000 1001 1002# Windows Recycle Bin record file (named INFO2) 1003# By Abel Cheung (abelcheung AT gmail dot com) 1004# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 1005# Since Vista uses another structure, INFO2 structure probably won't change 1006# anymore. Detailed analysis in: 1007# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 10080 lelong 0x00000004 1009>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 1010 10110 lelong 0x00000005 1012>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 1013 1014# From Doug Lee via a FreeBSD pr 10159 string GERBILDOC First Choice document 10169 string GERBILDB First Choice database 10179 string GERBILCLIP First Choice database 10180 string GERBIL First Choice device file 10199 string RABBITGRAPH RabbitGraph file 10200 string DCU1 Borland Delphi .DCU file 10210 string =!<spell> MKS Spell hash list (old format) 10220 string =!<spell2> MKS Spell hash list 1023# Too simple - MPi 1024#0 string AH Halo(TM) bitmapped font file 10250 lelong 0x08086b70 TurboC BGI file 10260 lelong 0x08084b50 TurboC Font file 1027 1028# Debian#712046: The magic below identifies "Delphi compiled form data". 1029# An additional source of information is available at: 1030# http://www.woodmann.com/fravia/dafix_t1.htm 10310 string TPF0 1032>4 pstring >\0 Delphi compiled form '%s' 1033 1034# tests for DBase files moved, updated and merged to database 1035 10360 string PMCC Windows 3.x .GRP file 10371 string RDC-meg MegaDots 1038>8 byte >0x2F version %c 1039>9 byte >0x2F \b.%c file 10400 lelong 0x4C 1041>4 lelong 0x00021401 Windows shortcut file 1042 1043# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm 1044# only for windows versions equal or greater 3.0 10450x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 1046!:mime application/x-dosexec 1047!:ext pif 1048#>2 string >\0 \b, Title:%.30s 1049>0x24 string >\0 \b for %.63s 1050>0x65 string >\0 \b, directory=%.64s 1051>0xA5 string >\0 \b, parameters=%.64s 1052#>0x181 leshort x \b, offset %x 1053#>0x183 leshort x \b, offsetdata %x 1054#>0x185 leshort x \b, section length %x 1055>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 1056>>&0x5e ubyte >0 1057>>>&-1 string <PIFMGR.DLL \b, icon=%s 1058#>>>&-1 string PIFMGR.DLL \b, icon=%s 1059>>>&-1 string >PIFMGR.DLL \b, icon=%s 1060>>&0xF0 ubyte >0 1061>>>&-1 string <Terminal \b, font=%.32s 1062#>>>&-1 string =Terminal \b, font=%.32s 1063>>>&-1 string >Terminal \b, font=%.32s 1064>>&0x110 ubyte >0 1065>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 1066#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 1067>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 1068#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 1069#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 1070>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 1071#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 1072>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 1073#>>&06 string x \b:%s 1074>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 1075#>>&06 string x \b:%s 1076 1077# DOS EPS Binary File Header 1078# From: Ed Sznyter <ews@Black.Market.NET> 10790 belong 0xC5D0D3C6 DOS EPS Binary File 1080!:mime image/x-eps 1081>4 long >0 Postscript starts at byte %d 1082>>8 long >0 length %d 1083>>>12 long >0 Metafile starts at byte %d 1084>>>>16 long >0 length %d 1085>>>20 long >0 TIFF starts at byte %d 1086>>>>24 long >0 length %d 1087 1088# TNEF magic From "Joomy" <joomy@se-ed.net> 1089# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 10900 lelong 0x223e9f78 TNEF 1091!:mime application/vnd.ms-tnef 1092 1093# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C 1094# of http://www.davep.org/norton-guides/ng2h-105.tgz 1095# http://en.wikipedia.org/wiki/Norton_Guides 10960 string NG\0\001 1097# only value 0x100 found at offset 2 1098>2 ulelong 0x00000100 Norton Guide 1099# Title[40] 1100>>8 string >\0 "%-.40s" 1101#>>6 uleshort x \b, MenuCount=%u 1102# szCredits[5][66] 1103>>48 string >\0 \b, %-.66s 1104>>114 string >\0 %-.66s 1105 1106# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 1107# of http://www.4dos.info/ 1108# pointer,HelpID[8]=4DHnnnmm 11090 ulelong 0x48443408 4DOS help file 1110>4 string x \b, version %-4.4s 1111 1112# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 11130 ulequad 0x3a000000024e4c MS Advisor help file 1114 1115# HtmlHelp files (.chm) 11160 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data 1117 1118# GFA-BASIC (Wolfram Kleff) 11192 string/b GFA-BASIC3 GFA-BASIC 3 data 1120 1121#------------------------------------------------------------------------------ 1122# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 1123# Update: Joerg Jenderek 1124# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format) 1125# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx 1126# Note: verified by `7z l *.cab` 1127# Microsoft Cabinet files 11280 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 1129# 1130# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool 1131# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE 1132# because some archive does not have *.diag* as 1st or 2nd archive member like 1133# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab 1134# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section 1135>0x2c search/980/c .diag \b, Diagnostic 1136!:mime application/vnd.ms-cab-compressed 1137!:ext diagcab 1138# http://fileformats.archiveteam.org/wiki/PUZ 1139# Microsoft Publisher version about 2003 has a "Pack and Go" feature that 1140# bundles a Publisher document *PNG.pub with all links into a CAB 1141>0x2c search/300/c png.pub\0 \b, Publisher Packed and Go 1142!:mime application/vnd.ms-cab-compressed 1143!:ext puz 1144# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation 1145>0x2c search/17/c ppview32.exe\0 \b, PowerPoint Viewer Packed and Go 1146!:mime application/vnd.ms-powerpoint 1147#!:mime application/mspowerpoint 1148!:ext ppz 1149# http://www.incredimail.com/ 1150# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims 1151>0x2c search/3369/c content.ini\0 \b, IncrediMail 1152!:mime application/x-incredimail 1153# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf 1154>>0x2c search/83/c Flavor.htm\0 ecard 1155!:ext imf 1156# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims 1157>>0x2c search/211/c .swf\0 skin 1158!:ext ims 1159# member anim.im3 implies IncrediMail animation like in letter_fold.ima 1160>>0x2c search/92/c anim.im3\0 animation 1161!:ext ima 1162# other IncrediMail cab archive 1163>>0x2c default x 1164>>>0x2c search/116/c thumb ecard, image, notifier or skin 1165!:ext imf/imi/imn/ims 1166# http://file-extension.net/seeker/file_extension_ime 1167>>>0x2c default x emoticons or sound 1168!:ext ime/imw 1169# no Diagnostic and IncrediMail 1170>0x2c default x 1171# look for 1st member name 1172>>(16.l+16) ubyte x 1173# https://en.wikipedia.org/wiki/SNP_file_format 1174>>>&-1 string/c _accrpt_.snp \b, Access report snapshot 1175!:mime application/msaccess 1176!:ext snp 1177# https://www.cabextract.org.uk/wince_cab_format/ 1178# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer 1179>>>&7 string =.000 \b, WinCE install 1180!:mime application/vnd.ms-cab-compressed 1181!:ext cab 1182 1183# http://support.microsoft.com/kb/934307/en-US 1184# All inspected MSU contain a file with name WSUSSCAN.cab 1185# that is called "Windows Update meta data" by Microsoft 1186>>>&-1 string/c wsusscan.cab \b, Microsoft Standalone Update 1187!:mime application/vnd.ms-cab-compressed 1188!:ext msu 1189>>>&-1 default x 1190# look at point charcter of 1st archive member name for file name extension 1191>>>>&-1 search/255 . 1192# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm 1193# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002 1194# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB 1195>>>>>&0 string/c ppt\0 \b, PowerPoint Packed and Go 1196!:mime application/vnd.ms-powerpoint 1197#!:mime application/mspowerpoint 1198!:ext ppz 1199# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx 1200# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack 1201# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack 1202>>>>>&0 string/c theme \b, Windows 1203!:mime application/x-windows-themepack 1204# http://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8 1205# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack 1206# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme 1207>>>>>>(16.l+16) string =Panoram 8 1208!:ext deskthemepack 1209>>>>>>(16.l+16) string !Panoram 7 or 8 1210!:ext themepack/deskthemepack 1211>>>>>>(16.l+16) ubyte x Theme Pack 1212>>>>>&0 default x 1213# look for null terminator of 1st member name 1214>>>>>>&0 search/255 \0 1215# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu 1216>>>>>>>&16 string/c wsusscan.cab \b, Microsoft Standalone Update 1217!:mime application/vnd.ms-cab-compressed 1218!:ext msu 1219>>>>>>>&16 default x 1220# archive with more then one file need some output in version 5.32 to avoid error message like 1221# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type 1222# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type 1223# file: could not find any valid magic files! 1224>>>>>>>>28 uleshort >1 \b, many 1225!:mime application/vnd.ms-cab-compressed 1226!:ext cab 1227# remaining archives with just one file 1228>>>>>>>>28 uleshort =1 1229# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386 1230>>>>>>>>>30 uleshort =0x0000 \b, Windows 2000/XP setup 1231# cut of last char of source extension and add underscore to generate extension 1232# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_ 1233!:mime application/vnd.ms-cab-compressed 1234!:ext _/?_/??_ 1235# archive need some output like "single" in version 5.32 to avoid error messages 1236>>>>>>>>>30 uleshort !0x0000 \b, single 1237!:mime application/vnd.ms-cab-compressed 1238!:ext cab 1239# TODO: additional extensions like 1240# .xsn InfoPath Dynamic Form 1241# .xtp InfoPath Template Part 1242# .lvf Logitech Video Effects Face Accessory 1243>8 ulelong x \b, %u bytes 1244>28 uleshort 1 \b, 1 file 1245>28 uleshort >1 \b, %u files 1246# Reserved fields, set to zero 1247#>4 belong !0 \b, reserved1 %x 1248#>12 belong !0 \b, reserved2 %x 1249# offset of the first CFFILE entry coffFiles: minimal 2Ch 1250>16 ulelong x \b, at 0x%x 1251>(16.l) use cab-file 1252# at least also 2nd member 1253>28 uleshort >1 1254>>(16.l+16) ubyte x 1255>>>&0 search/255 \0 1256# second member info 1257>>>>&0 use cab-file 1258#>20 belong !0 \b, reserved %x 1259# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3 1260>24 ubeshort !0x0301 \b version 0x%x 1261# number of CFFOLDER entries 1262>26 uleshort >1 \b, %u cffolders 1263# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields 1264# only found for flags 0 1 2 3 4 not 7 1265>30 uleshort >0 \b, flags 0x%x 1266# Cabinet files have a 16-bit cabinet setID field that is designed for application use. 1267# default is zero, however, the -i option of cabarc can be used to set this field 1268>32 uleshort >0 \b, ID %u 1269# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet 1270#>34 uleshort x \b, iCabinet %u 1271# add one for display because humans start numbering by 1 and also fit to name of disk szDisk* 1272>34 uleshort+1 x \b, number %u 1273>30 uleshort &0x0004 \b, extra bytes 1274# cbCFHeader optional size of per-cabinet reserved area 14h 1800h 1275>>36 uleshort >0 %u in head 1276# cbCFFolder is optional size of per-folder reserved area 1277>>38 ubyte >0 %u in folder 1278# cbCFData is optional size of per-datablock reserved area 1279>>39 ubyte >0 %u in data block 1280# optional per-cabinet reserved area abReserve[cbCFHeader] 1281>>36 uleshort >0 1282# 1st CFFOLDER after reserved area in header 1283>>>(36.s+40) use cab-folder 1284# no reserved area in header 1285>30 uleshort ^0x0004 1286# no previous and next cab archive 1287>>30 uleshort =0x0000 1288>>>36 use cab-folder 1289# only previous cab archive 1290>>30 uleshort =0x0001 \b, previous 1291>>>36 use cab-anchor 1292# only next cab archive 1293>>30 uleshort =0x0002 \b, next 1294>>>36 use cab-anchor 1295# previous+next cab archive 1296# can not use sub routine cab-anchor to display previous and next cabinet together 1297#>>>36 use cab-anchor 1298#>>>>&0 use cab-anchor 1299>>30 uleshort =0x0003 \b, previous 1300>>>36 string x %s 1301# optional name of previous disk szDisk* 1302>>>>&1 string x disk %s 1303>>>>>&1 string x \b, next %s 1304# optional name of previous disk szDisk* 1305>>>>>>&1 string x disk %s 1306>>>>>>>&1 use cab-folder 1307# display filename and disk name of previous or next cabinet 13080 name cab-anchor 1309# optional name of previous/next cabinet file szCabinet*[255] 1310>&0 string x %s 1311# optional name of previous/next disk szDisk*[255] 1312>>&1 string x disk %s 1313# display folder structure CFFOLDER information like compression of cabinet 13140 name cab-folder 1315# offset of the CFDATA block in this folder 1316#>0 ulelong x \b, coffCabStart 0x%x 1317# number of CFDATA blocks in folder 1318>4 uleshort x \b, %u datablock 1319# plural s 1320>4 uleshort >1 \bs 1321# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15 1322>6 uleshort x \b, 0x%x compression 1323# optional per-folder reserved area 1324#>8 ubequad x \b, abReserve 0x%llx 1325# display member structure CFFILE information like member name of cabinet 13260 name cab-file 1327# cbFile is uncompressed size of file in bytes 1328#>0 ulelong x \b, cbFile %u 1329# uoffFolderStart is uncompressed offset of file in folder 1330#>4 ulelong >0 \b, uoffFolderStart 0x%x 1331# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet 1332# define ifoldCONTINUED_FROM_PREV (0xFFFD) 1333# define ifoldCONTINUED_TO_NEXT (0xFFFE) 1334# define ifoldCONTINUED_PREV_AND_NEXT (0xFFFF) 1335>8 uleshort >0 \b, iFolder 0x%x 1336# date stamp for file 1337#>10 uleshort x \b, date 0x%x 1338# time stamp for file 1339#>12 uleshort x \b, time 0x%x 1340# attribs is attribute flags for file 1341# define _A_RDONLY (0x01) file is read-only 1342# define _A_HIDDEN (0x02) file is hidden 1343# define _A_SYSTEM (0x04) file is a system file 1344# define _A_ARCH (0x20) file modified since last backup 1345# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab 1346# define _A_EXEC (0x40) run after extraction 1347# define _A_NAME_IS_UTF (0x80) szName[] contains UTF 1348# define UNKNOWN (0x0100) undocumented or accident 1349#>14 uleshort x \b, attribs 0x%x 1350>14 uleshort >0 + 1351>>14 uleshort &0x0001 \bR 1352>>14 uleshort &0x0002 \bH 1353>>14 uleshort &0x0004 \bS 1354>>14 uleshort &0x0020 \bA 1355>>14 uleshort &0x0040 \bX 1356>>14 uleshort &0x0080 \bUtf 1357# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB 1358>>14 uleshort &0x0100 \b? 1359# szName is name of archive member 1360>16 string x "%s" 1361# next archive member name if more files 1362#>>&17 string >\0 \b, NEXT NAME %-.50s 1363 1364# InstallShield Cabinet files 13650 string/b ISc( InstallShield Cabinet archive data 1366>5 byte&0xf0 =0x60 version 6, 1367>5 byte&0xf0 !0x60 version 4/5, 1368>(12.l+40) lelong x %u files 1369 1370# Windows CE package files 13710 string/b MSCE\0\0\0\0 Microsoft WinCE install header 1372>20 lelong 0 \b, architecture-independent 1373>20 lelong 103 \b, Hitachi SH3 1374>20 lelong 104 \b, Hitachi SH4 1375>20 lelong 0xA11 \b, StrongARM 1376>20 lelong 4000 \b, MIPS R4000 1377>20 lelong 10003 \b, Hitachi SH3 1378>20 lelong 10004 \b, Hitachi SH3E 1379>20 lelong 10005 \b, Hitachi SH4 1380>20 lelong 70001 \b, ARM 7TDMI 1381>52 leshort 1 \b, 1 file 1382>52 leshort >1 \b, %u files 1383>56 leshort 1 \b, 1 registry entry 1384>56 leshort >1 \b, %u registry entries 1385 1386 1387# Windows Enhanced Metafile (EMF) 1388# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 1389# for further information. 13900 ulelong 1 1391>40 string \ EMF Windows Enhanced Metafile (EMF) image data 1392>>44 ulelong x version 0x%x 1393 1394 13950 string/b \224\246\056 Microsoft Word Document 1396!:mime application/msword 1397 1398512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document 1399!:mime application/msword 1400 1401# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 1402# Magic type for Dell's BIOS .hdr files 1403# Dell's .hdr 14040 string/b $RBU 1405>23 string Dell %s system BIOS 1406>5 byte 2 1407>>48 byte x version %d. 1408>>49 byte x \b%d. 1409>>50 byte x \b%d 1410>5 byte <2 1411>>48 string x version %.3s 1412 1413# Type: Microsoft Document Imaging Format (.mdi) 1414# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 1415# From: Daniele Sempione <scrows@oziosi.org> 1416# Too weak (EP) 1417#0 short 0x5045 Microsoft Document Imaging Format 1418 1419# MS eBook format (.lit) 14200 string/b ITOLITLS Microsoft Reader eBook Data 1421>8 lelong x \b, version %u 1422!:mime application/x-ms-reader 1423 1424# Windows CE Binary Image Data Format 1425# From: Dr. Jesus <j@hug.gs> 14260 string/b B000FF\n Windows Embedded CE binary image 1427 1428# Windows Imaging (WIM) Image 14290 string/b MSWIM\000\000\000 Windows imaging (WIM) image 14300 string/b WLPWM\000\000\000 Windows imaging (WIM) image, wimlib pipable format 1431 1432# The second byte of these signatures is a file version; I don't know what, 1433# if anything, produced files with version numbers 0-2. 1434# From: John Elliott <johne@seasip.demon.co.uk> 14350 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 14360 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 14370 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 14380 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 1439 14400 string MIOPEN Mallard BASIC Jetsam data 14410 string Jetsam0 Mallard BASIC Jetsam index data 1442 1443# DOS backup 2.0 to 3.2 1444 1445# backupid.@@@ 1446 1447# plausibility check for date 14480x3 ushort >1979 1449>0x5 ubyte-1 <31 1450>>0x6 ubyte-1 <12 1451# actually 121 nul bytes 1452>>>0x7 string \0\0\0\0\0\0\0\0 1453>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d 1454!:ext @@@ 1455>>>>0x0 ubyte 0xff \b, last disk 1456 1457# backed up file 1458 1459# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd 1460# by looking for trailing nul of maximal file name string 14610x52 ubyte 0 1462# test for flag byte: FFh~complete file, 00h~split file 1463# FFh -127 = -1 -127 = -128 1464# 00h -127 = 0 -127 = -127 1465>0 byte-127 <-126 1466# plausibility check for file name length 1467>>0x53 ubyte-1 <78 1468# looking for terminating nul of file name string 1469>>>(0x53.b+4) ubyte 0 1470# looking if last char of string is valid DOS file name 1471>>>>(0x53.b+3) ubyte >0x1F 1472# actually 44 nul bytes 1473# but sometimes garbage according to Ralf Quint. So can not be used as test 1474#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 1475# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator 1476# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 1477>>>>>5 ubyte&0x8C 0x0C 1478# ./msdos (version 5.30) labeled the entry as 1479# "DOS 2.0 backed up file %s, split file, sequence %d" or 1480# "DOS 2.0 backed up file %s, complete file" 1481>>>>>>0 ubyte x DOS 2.0-3.2 backed up 1482#>>>>>>0 ubyte 0xff complete 1483>>>>>>0 ubyte 0 1484>>>>>>>1 uleshort x sequence %d of 1485# full file name with path but without drive letter and colon stored from 0x05 til 0x52 1486>>>>>>0x5 string x file %s 1487# backup name is original filename 1488#!:ext * 1489# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*' 1490# file: line 1169: Bad magic entry ' *' 1491# after header original file content 1492>>>>>>128 indirect x \b; 1493 1494 1495# DOS backup 3.3 to 5.x 1496 1497# CONTROL.nnn files 14980 string \x8bBACKUP\x20 1499# actually 128 nul bytes 1500>0xa string \0\0\0\0\0\0\0\0 1501>>0x9 ubyte x DOS 3.3 backup control file, sequence %d 1502>>0x8a ubyte 0xff \b, last disk 1503 1504# NB: The BACKUP.nnn files consist of the files backed up, 1505# concatenated. 1506