506 lines
17 KiB
Plaintext
506 lines
17 KiB
Plaintext
|
|
#------------------------------------------------------------------------------
|
|
# $File: macintosh,v 1.36 2022/12/06 18:45:20 christos Exp $
|
|
# macintosh description
|
|
#
|
|
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
|
|
# Daniel Quinlan, quinlan@yggdrasil.com
|
|
# Update: Joerg Jenderek
|
|
# URL: https://en.wikipedia.org/wiki/BinHex
|
|
# Reference: http://fileformats.archiveteam.org/wiki/BinHex
|
|
# Note: only tested with version 4.0 and hqx extension
|
|
# Any text/binary before the characteristic comment sentence is to be ignored like in
|
|
# http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx
|
|
0 search/1602 (This\ file\
|
|
>&0 use binhex
|
|
# http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx
|
|
0 search/2652/b (This\ file\
|
|
>&0 use binhex
|
|
0 name binhex
|
|
# keep split search string format similar like in version 5.37
|
|
>0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version
|
|
# http://www.macdisk.com/binhexen.php3
|
|
!:apple BNHQTEXT
|
|
# http://www.faqs.org/faqs/macintosh/comm-faq/part1/
|
|
>>&0 string 1.0 1.0
|
|
!:mime application/mac-binhex
|
|
!:ext hex
|
|
>>&0 string 2.0 2.0
|
|
!:mime application/mac-binhex
|
|
!:ext hcx
|
|
# BinHex 3.0 never existed
|
|
>>&0 string 4.0 4.0
|
|
!:mime application/mac-binhex40
|
|
!:ext hqx
|
|
# BinHex 5.0 also MacBinary I
|
|
>>&0 string 5.0 5.0
|
|
!:mime application/mac-binhex40
|
|
!:ext hqx
|
|
# this should never happen
|
|
>>&0 default x
|
|
>>>&0 string x %.3s
|
|
!:mime application/mac-binhex
|
|
!:ext hqx
|
|
|
|
# Stuffit archives are the de facto standard of compression for Macintosh
|
|
# files obtained from most archives. (franklsm@tuns.ca)
|
|
0 string SIT! StuffIt Archive (data)
|
|
!:mime application/x-stuffit
|
|
!:apple SIT!SIT!
|
|
>2 string x : %s
|
|
0 string SITD StuffIt Deluxe (data)
|
|
>2 string x : %s
|
|
0 string Seg StuffIt Deluxe Segment (data)
|
|
>2 string x : %s
|
|
|
|
# Newer StuffIt archives (grant@netbsd.org)
|
|
0 string StuffIt StuffIt Archive
|
|
!:mime application/x-stuffit
|
|
!:apple SIT!SIT!
|
|
#>162 string >0 : %s
|
|
|
|
# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
|
|
# GRR: Too weak
|
|
#0 string APPL Macintosh Application (data)
|
|
#>2 string x \b: %s
|
|
|
|
# Macintosh System files (franklsm@tuns.ca)
|
|
# GRR: Too weak
|
|
#0 string zsys Macintosh System File (data)
|
|
#0 string FNDR Macintosh Finder (data)
|
|
#0 string libr Macintosh Library (data)
|
|
#>2 string x : %s
|
|
#0 string shlb Macintosh Shared Library (data)
|
|
#>2 string x : %s
|
|
#0 string cdev Macintosh Control Panel (data)
|
|
#>2 string x : %s
|
|
#0 string INIT Macintosh Extension (data)
|
|
#>2 string x : %s
|
|
#0 string FFIL Macintosh Truetype Font (data)
|
|
#>2 string x : %s
|
|
#0 string LWFN Macintosh Postscript Font (data)
|
|
#>2 string x : %s
|
|
|
|
# Additional Macintosh Files (franklsm@tuns.ca)
|
|
# GRR: Too weak
|
|
#0 string PACT Macintosh Compact Pro Archive (data)
|
|
#>2 string x : %s
|
|
#0 string ttro Macintosh TeachText File (data)
|
|
#>2 string x : %s
|
|
#0 string TEXT Macintosh TeachText File (data)
|
|
#>2 string x : %s
|
|
#0 string PDF Macintosh PDF File (data)
|
|
#>2 string x : %s
|
|
|
|
# MacBinary format (Eric Fischer, enf@pobox.com)
|
|
# Update: Joerg Jenderek
|
|
# URL: https://en.wikipedia.org/wiki/MacBinary
|
|
# http://fileformats.archiveteam.org/wiki/MacBinary
|
|
# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt
|
|
# Note: verified by macutils `macunpack -i -v BBEdit4.0.sit.bin` and
|
|
# `deark -l -d -m macbinary G3FirmwareUpdate1.1.smi.bin`
|
|
#
|
|
# Unfortunately MacBinary doesn't really have a magic number prior
|
|
# to the MacBinary III format.
|
|
#
|
|
|
|
# old version number, must be kept at zero for compatibility
|
|
0 byte 0
|
|
# length of filename (must be in the range 1-63)
|
|
>1 ubyte >0
|
|
# skip T.PIC.LZ INSTRUMENT.7T INVENTORY
|
|
>>1 ubyte <64
|
|
# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)"
|
|
# by looking for printable characters at beginning of file name
|
|
>>>2 ubelong >0x1F000000
|
|
# zero fill, must be zero for compatibility
|
|
>>>>74 byte 0
|
|
# zero fill, must be zero for compatibility
|
|
>>>>>82 byte 0
|
|
# skip few DEGAS mid-res uncompressed bitmap (GEMINI03.PI2 CODE_RAM.PI2) with "too high" file names ffffff88 ffff4f00
|
|
>>>>>>2 ubelong <0xffff0000
|
|
# MacBinary I test for valid version numbers
|
|
>>>>>>>122 ubeshort 0
|
|
# additional check for undefined header fields in MacBinary I
|
|
#>>>>>>>>101 ulong 0
|
|
>>>>>>>>0 use mac-bin
|
|
# MacBinary II the newer versions begins at 129
|
|
>>>>>>>122 ubeshort 0x8181
|
|
>>>>>>>>0 use mac-bin
|
|
# MacBinary III with MacBinary II to read
|
|
>>>>>>122 ubeshort 0x8281
|
|
>>>>>>>0 use mac-bin
|
|
|
|
# display information of MacBinary file
|
|
0 name mac-bin
|
|
>122 ubyte x MacBinary
|
|
# versions for MacBinary II/III
|
|
>122 ubyte 129 II
|
|
>122 ubyte 130 III
|
|
# only in MacBinary III
|
|
>>102 string !mBIN with surprising version
|
|
!:mime application/x-macbinary
|
|
!:apple PSPTBINA
|
|
!:ext bin/macbin
|
|
# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidentified as MacBinary
|
|
#>1 ubyte >63 \b, name length %u too BIG!
|
|
#>122 ubeshort x \b, version %#x
|
|
# Finder flags if not 0
|
|
# >73 byte !0 \b, flags 0x
|
|
# >73 byte =0
|
|
# >>101 byte !0 \b, flags 0x
|
|
# # original Finder flags (Bits 8-15)
|
|
# >73 byte !0 \b%x
|
|
# # finder flags, bits 0-7
|
|
# >101 byte !0 \b%x
|
|
>73 byte &0x01 \b, inited
|
|
>73 byte &0x02 \b, changed
|
|
>73 byte &0x04 \b, busy
|
|
>73 byte &0x08 \b, bozo
|
|
>73 byte &0x10 \b, system
|
|
>73 byte &0x20 \b, bundle
|
|
>73 byte &0x40 \b, invisible
|
|
>73 byte &0x80 \b, locked
|
|
|
|
# 75 beshort # vertical posn in window
|
|
#>75 beshort !0 \b, v.pos %u
|
|
# 77 beshort # horiz posn in window
|
|
#>77 beshort !0 \b, h.pos %u
|
|
# 79 beshort # window or folder ID
|
|
>79 ubeshort !0 \b, ID %#x
|
|
# protected flag
|
|
>81 byte !0 \b, protected %#x
|
|
# length of comment after resource
|
|
>99 ubeshort !0 \b, comment length %u
|
|
# char. code of file name
|
|
>106 ubyte !0 \b, char. code %#x
|
|
# still more Finder flags
|
|
>107 ubyte !0 \b, more flags %#x
|
|
# length of total files when unpacked only used when pack and unpack on the fly
|
|
>116 ubelong !0 \b, total length %u
|
|
# 120 beshort # length of add'l header
|
|
>120 ubeshort !0 \b, 2nd header length %u
|
|
# 124 beshort # checksum
|
|
#>124 ubeshort !0 \b, CRC %#x
|
|
# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080
|
|
# few (31/1247) examples (hinkC4.0.sitx.bin InternetExplorer5.1.smi.bin G3FirmwareUpdate1.1.smi.bin Firewire2.3.3.smi.bin LR2image.bin) contain zeroed date fields
|
|
>91 long !0
|
|
>>91 beldate-0x7C25B080 x \b, %s
|
|
# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidentified or time overflow
|
|
>91 ubelong <0x7c25b080 INVALID date
|
|
# reported date seconds by deark
|
|
#>91 ubelong x deark-DATE=%u
|
|
# last modified date
|
|
>95 long !0
|
|
>>95 beldate-0x7C25B080 x \b, modified %s
|
|
# Apple creator+typ if not null
|
|
# file creator (normally expressed as four characters)
|
|
>69 ulong !0 \b, creator
|
|
# instead 4 character code display full creator name
|
|
>>69 use apple-creator
|
|
# file type (normally expressed as four characters)
|
|
>65 ulong !0 \b, type
|
|
>>65 use apple-type
|
|
# length of data segment
|
|
>83 ubelong !0 \b, %u bytes
|
|
# filename (in the range 1-63)
|
|
# like "BBEdit4.0.sit" "Archive.sitx" "MacPGP 2.2 (.sea)"
|
|
>1 pstring x "%s"
|
|
# print 1 space and then at offset 128 inspect data fork content if it has one
|
|
>83 ubelong !0 \b
|
|
>>128 indirect x
|
|
# Afterwards resource fork if length of resource segment not zero
|
|
>87 ubelong !0
|
|
# calculate resource fork offset
|
|
>>83 ubelong+128 x \b, at %#x
|
|
# length of resource segment
|
|
>>87 ubelong !0 %u bytes
|
|
>>(83.S+128) ubequad x resource
|
|
# further resource fork content inspection
|
|
>>>&-8 indirect x
|
|
|
|
# Apple Type/Creator Database
|
|
# URL: https://en.wikipedia.org/wiki/Type_code
|
|
# Reference: https://www.lacikam.co.il/tcdb/
|
|
# https://www.macdisk.com/macsigen.php
|
|
# Note: classic Mac OS files have two 4 character codes for type and creator.
|
|
# Thereby the Finder attach documents types to applications.
|
|
|
|
#>65 string x \b, type "%4.4s"
|
|
|
|
# display information about apple type
|
|
0 name apple-type
|
|
>0 string 8BIM PhotoShop
|
|
>0 string ALB3 PageMaker 3
|
|
>0 string ALB4 PageMaker 4
|
|
>0 string ALT3 PageMaker 3
|
|
>0 string APPL application
|
|
>0 string AWWP AppleWorks word processor
|
|
>0 string CIRC simulated circuit
|
|
>0 string DRWG MacDraw
|
|
>0 string EPSF Encapsulated PostScript
|
|
>0 string FFIL font suitcase
|
|
>0 string FKEY function key
|
|
>0 string FNDR Macintosh Finder
|
|
>0 string GIFf GIF image
|
|
>0 string Gzip GNU gzip
|
|
>0 string INIT system extension
|
|
>0 string LIB\ library
|
|
>0 string LWFN PostScript font
|
|
>0 string MSBC Microsoft BASIC
|
|
>0 string PACT Compact Pro archive
|
|
>0 string PDF\ Portable Document Format
|
|
>0 string PICT picture
|
|
>0 string PNTG MacPaint picture
|
|
>0 string PREF preferences
|
|
>0 string PROJ Think C project
|
|
>0 string QPRJ Think Pascal project
|
|
>0 string SCFL Defender scores
|
|
>0 string SCRN startup screen
|
|
>0 string SITD StuffIt Deluxe
|
|
>0 string SPn3 SuperPaint
|
|
>0 string STAK HyperCard stack
|
|
>0 string Seg\ StuffIt segment
|
|
>0 string TARF Unix tar archive
|
|
>0 string TEXT ASCII
|
|
>0 string TIFF TIFF image
|
|
>0 string TOVF Eudora table of contents
|
|
>0 string WDBN Microsoft Word word processor
|
|
>0 string WORD MacWrite word processor
|
|
>0 string XLS\ Microsoft Excel
|
|
>0 string ZIVM compress (.Z)
|
|
>0 string ZSYS Pre-System 7 system file
|
|
>0 string acf3 Aldus FreeHand
|
|
>0 string cdev control panel
|
|
>0 string dfil Desk Accessory suitcase
|
|
>0 string libr library
|
|
>0 string nX^d WriteNow word processor
|
|
>0 string nX^w WriteNow dictionary
|
|
>0 string rsrc resource
|
|
>0 string scbk Scrapbook
|
|
>0 string shlb shared library
|
|
>0 string ttro SimpleText read-only
|
|
>0 string zsys system file
|
|
|
|
# additional types added in Dec 2017
|
|
>0 string BINA binary file
|
|
>0 string BMPp BMP image
|
|
>0 string JPEG JPEG image
|
|
#>0 string W4BN Microsoft Word x.y word processor?
|
|
# if type name is not known display 4 character identifier
|
|
>0 default x
|
|
>>0 string x '%4.4s'
|
|
|
|
#>69 string x \b, creator "%4.4s"
|
|
|
|
# Now Apple has no repository of registered Creator IDs any more. These are
|
|
# just the ones that I happened to have files from and was able to identify.
|
|
|
|
# display information about apple creator
|
|
0 name apple-creator
|
|
>0 string 8BIM Adobe Photoshop
|
|
>0 string ALD3 PageMaker 3
|
|
>0 string ALD4 PageMaker 4
|
|
>0 string ALFA Alpha editor
|
|
>0 string APLS Apple Scanner
|
|
>0 string APSC Apple Scanner
|
|
>0 string BRKL Brickles
|
|
>0 string BTFT BitFont
|
|
>0 string CCL2 Common Lisp 2
|
|
>0 string CCL\ Common Lisp
|
|
>0 string CDmo The Talking Moose
|
|
>0 string CPCT Compact Pro
|
|
>0 string CSOm Eudora
|
|
>0 string DMOV Font/DA Mover
|
|
>0 string DSIM DigSim
|
|
>0 string EDIT Macintosh Edit
|
|
>0 string ERIK Macintosh Finder
|
|
>0 string EXTR self-extracting archive
|
|
>0 string Gzip GNU gzip
|
|
>0 string KAHL Think C
|
|
>0 string LWFU LaserWriter Utility
|
|
>0 string LZIV compress
|
|
>0 string MACA MacWrite
|
|
>0 string MACS Macintosh operating system
|
|
>0 string MAcK MacKnowledge terminal emulator
|
|
>0 string MLND Defender
|
|
>0 string MPNT MacPaint
|
|
>0 string MSBB Microsoft BASIC (binary)
|
|
>0 string MSWD Microsoft Word
|
|
>0 string NCSA NCSA Telnet
|
|
>0 string PJMM Think Pascal
|
|
>0 string PSAL Hunt the Wumpus
|
|
#>0 string PSI2 Apple File Exchange
|
|
>0 string R*ch BBEdit
|
|
>0 string RMKR Resource Maker
|
|
>0 string RSED Resource Editor
|
|
>0 string Rich BBEdit
|
|
>0 string SIT! StuffIt
|
|
>0 string SPNT SuperPaint
|
|
>0 string Unix NeXT Mac filesystem
|
|
>0 string VIM! Vim editor
|
|
>0 string WILD HyperCard
|
|
>0 string XCEL Microsoft Excel
|
|
>0 string aCa2 Fontographer
|
|
>0 string aca3 Aldus FreeHand
|
|
>0 string dosa Macintosh MS-DOS file system
|
|
>0 string movr Font/DA Mover
|
|
>0 string nX^n WriteNow
|
|
>0 string pdos Apple ProDOS file system
|
|
>0 string scbk Scrapbook
|
|
>0 string ttxt SimpleText
|
|
>0 string ufox Foreign File Access
|
|
# additional creators added in Dec 2017
|
|
# Claris/Apple Works
|
|
>0 string BOBO Apple Works
|
|
# CU-SeeMe_0.87b3_(68K).bin
|
|
#>0 string CUce bar
|
|
>0 string PSPT Apple File Exchange
|
|
# Disk_Copy_4.2.sea.bin
|
|
#>0 string NCse foo
|
|
# probably StuffIt/Aladdin by Smith Micro Software, Inc.
|
|
>0 string STi0 stuffit
|
|
# MacGzip-1.1.3.sea.bin
|
|
#>0 string aust bar
|
|
# D-Disk_Copy_6.3.3.smi.bin
|
|
>0 string oneb Disk Copy Self Mounting
|
|
# if creator name is not known display 4 character identifier
|
|
>0 default x
|
|
>>0 string x '%4.4s'
|
|
|
|
# sas magic from Bruce Foster (bef@nwu.edu)
|
|
#
|
|
#0 string SAS SAS
|
|
#>8 string x %s
|
|
0 string SAS SAS
|
|
>24 string DATA data file
|
|
>24 string CATALOG catalog
|
|
>24 string INDEX data file index
|
|
>24 string VIEW data view
|
|
# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
|
|
#
|
|
0x54 string SAS SAS 7+
|
|
>0x9C string DATA data file
|
|
>0x9C string CATALOG catalog
|
|
>0x9C string INDEX data file index
|
|
>0x9C string VIEW data view
|
|
|
|
# spss magic for SPSS system and portable files,
|
|
# from Bruce Foster (bef@nwu.edu).
|
|
|
|
0 long 0xc1e2c3c9 SPSS Portable File
|
|
>40 string x %s
|
|
|
|
0 string $FL2 SPSS System File
|
|
>24 string x %s
|
|
|
|
0 string $FL3 SPSS System File
|
|
>24 string x %s
|
|
|
|
# Macintosh filesystem data
|
|
# From "Tom N Harris" <telliamed@mac.com>
|
|
# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
|
|
# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
|
|
# entries depend on the data arithmetic added after v.35
|
|
# There's also some Pascal strings in here, ditto...
|
|
|
|
# The boot block signature, according to IM:Files, is
|
|
# "for HFS volumes, this field always contains the value 0x4C4B."
|
|
# But if this is true for MFS or HFS+ volumes, I don't know.
|
|
# Alternatively, the boot block is supposed to be zeroed if it's
|
|
# unused, so a simply >0 should suffice.
|
|
|
|
0x400 beshort 0xD2D7 Macintosh MFS data
|
|
>0 beshort 0x4C4B (bootable)
|
|
>0x40a beshort &0x8000 (locked)
|
|
>0x402 beldate-0x7C25B080 x created: %s,
|
|
>0x406 beldate-0x7C25B080 >0 last backup: %s,
|
|
>0x414 belong x block size: %d,
|
|
>0x412 beshort x number of blocks: %d,
|
|
>0x424 pstring x volume name: %s
|
|
|
|
# *.hfs updated by Joerg Jenderek
|
|
# https://en.wikipedia.org/wiki/Hierarchical_File_System
|
|
# "BD" gives many false positives
|
|
0x400 beshort 0x4244
|
|
# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
|
|
# first block of volume bit map (always 3)
|
|
>0x40e ubeshort 0x0003
|
|
# maximal length of volume name is 27
|
|
>>0x424 ubyte <28 Macintosh HFS data
|
|
!:mime application/x-apple-diskimage
|
|
#!:apple hfsdINIT
|
|
#!:apple MACSdisk
|
|
# https://www.macdisk.com/macsigen.php
|
|
#!:apple ddskdevi
|
|
!:apple ????devi
|
|
# https://en.wikipedia.org/wiki/Apple_Disk_Image
|
|
!:ext hfs/dmg
|
|
>>>0 beshort 0x4C4B (bootable)
|
|
#>>>0 beshort 0x0000 (not bootable)
|
|
>>>0x40a beshort &0x8000 (locked)
|
|
>>>0x40a beshort ^0x0100 (mounted)
|
|
>>>0x40a beshort &0x0200 (spared blocks)
|
|
>>>0x40a beshort &0x0800 (unclean)
|
|
>>>0x47C beshort 0x482B (Embedded HFS+ Volume)
|
|
# https://www.epochconverter.com/
|
|
# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970
|
|
# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00
|
|
# construct not working
|
|
#>>>0x402 beldate-0x7C25B080 x created: %s,
|
|
#>>>0x406 beldate-0x7C25B080 x last modified: %s,
|
|
#>>>0x440 beldate-0x7C25B080 >0 last backup: %s,
|
|
# found block sizes 200h,1200h,2800h
|
|
>>>0x414 belong x block size: %d,
|
|
>>>0x412 beshort x number of blocks: %d,
|
|
>>>0x424 pstring x volume name: %s
|
|
|
|
0 name hfsplus
|
|
>&0 beshort x version %d data
|
|
>0 beshort 0x4C4B (bootable)
|
|
>0x404 belong ^0x00000100 (mounted)
|
|
>&2 belong &0x00000200 (spared blocks)
|
|
>&2 belong &0x00000800 (unclean)
|
|
>&2 belong &0x00008000 (locked)
|
|
>&6 string x last mounted by: '%.4s',
|
|
# really, that should be treated as a belong and we print a string
|
|
# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
|
|
>&14 beldate-0x7C25B080 x created: %s,
|
|
# only the creation date is local time, all other timestamps in HFS+ are UTC.
|
|
>&18 bedate-0x7C25B080 x last modified: %s,
|
|
>&22 bedate-0x7C25B080 >0 last backup: %s,
|
|
>&26 bedate-0x7C25B080 >0 last checked: %s,
|
|
>&38 belong x block size: %d,
|
|
>&42 belong x number of blocks: %d,
|
|
>&46 belong x free blocks: %d
|
|
|
|
0x400 beshort 0x482B Apple HFS Plus
|
|
>&0 use hfsplus
|
|
0x400 beshort 0x4858 Apple HFS Plus Extended
|
|
>&0 use hfsplus
|
|
|
|
## AFAIK, only the signature is different
|
|
# same as Apple Partition Map
|
|
# GRR: This magic is too weak, it is just "TS"
|
|
#0x200 beshort 0x5453 Apple Old Partition data
|
|
#>0x2 beshort x block size: %d,
|
|
#>0x230 string x first type: %s,
|
|
#>0x210 string x name: %s,
|
|
#>0x254 belong x number of blocks: %d,
|
|
#>0x400 beshort 0x504D
|
|
#>>0x430 string x second type: %s,
|
|
#>>0x410 string x name: %s,
|
|
#>>0x454 belong x number of blocks: %d,
|
|
#>>0x800 beshort 0x504D
|
|
#>>>0x830 string x third type: %s,
|
|
#>>>0x810 string x name: %s,
|
|
#>>>0x854 belong x number of blocks: %d,
|
|
#>>>0xa00 beshort 0x504D
|
|
#>>>>0xa30 string x fourth type: %s,
|
|
#>>>>0xa10 string x name: %s,
|
|
#>>>>0xa54 belong x number of blocks: %d
|
|
|
|
# From: Remi Mommsen <mommsen@slac.stanford.edu>
|
|
0 string BOMStore Mac OS X bill of materials (BOM) file
|
|
|