"Fossies" - the Fresh Open Source Software Archive

Member "file-5.35/magic/Magdir/msdos" (25 Jul 2018, 56696 Bytes) of package /linux/misc/file-5.35.tar.gz:


As a special service "Fossies" has tried to format the requested text file into HTML format (style: standard) with prefixed line numbers. Alternatively you can here view or download the uninterpreted source code file. See also the latest Fossies "Diffs" side-by-side code changes report for "msdos": 5.34_vs_5.35.

    1 
    2 #------------------------------------------------------------------------------
    3 # $File: msdos,v 1.125 2018/07/25 06:05:34 christos Exp $
    4 # msdos:  file(1) magic for MS-DOS files
    5 #
    6 
    7 # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
    8 # updated by Joerg Jenderek at Oct 2008,Apr 2011
    9 0	string/t	@
   10 >1	string/cW	\ echo\ off	DOS batch file text
   11 !:mime	text/x-msdos-batch
   12 !:ext	bat
   13 >1	string/cW	echo\ off	DOS batch file text
   14 !:mime	text/x-msdos-batch
   15 !:ext	bat
   16 >1	string/cW	rem		DOS batch file text
   17 !:mime	text/x-msdos-batch
   18 !:ext	bat
   19 >1	string/cW	set\ 		DOS batch file text
   20 !:mime	text/x-msdos-batch
   21 !:ext	bat
   22 
   23 
   24 # OS/2 batch files are REXX. the second regex is a bit generic, oh well
   25 # the matched commands seem to be common in REXX and uncommon elsewhere
   26 100	search/0xffff   rxfuncadd
   27 >100	regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc	OS/2 REXX batch file text
   28 100	search/0xffff   say
   29 >100	regex/c =^[\ \t]{0,10}say\ ['"]			OS/2 REXX batch file text
   30 
   31 # updated by Joerg Jenderek at Oct 2015
   32 # https://de.wikipedia.org/wiki/Common_Object_File_Format
   33 # http://www.delorie.com/djgpp/doc/coff/filhdr.html
   34 # ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable"
   35 #0	leshort		0x14c	MS Windows COFF Intel 80386 object file
   36 #>4	ledate		x	stamp %s
   37 0	leshort		0x166	MS Windows COFF MIPS R4000 object file
   38 #>4	ledate		x	stamp %s
   39 0	leshort		0x184	MS Windows COFF Alpha object file
   40 #>4	ledate		x	stamp %s
   41 0	leshort		0x268	MS Windows COFF Motorola 68000 object file
   42 #>4	ledate		x	stamp %s
   43 0	leshort		0x1f0	MS Windows COFF PowerPC object file
   44 #>4	ledate		x	stamp %s
   45 0	leshort		0x290	MS Windows COFF PA-RISC object file
   46 #>4	ledate		x	stamp %s
   47 
   48 # Tests for various EXE types.
   49 #
   50 # Many of the compressed formats were extraced from IDARC 1.23 source code.
   51 #
   52 0	string/b	MZ
   53 # All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
   54 >0x18	leshort <0x40 MS-DOS executable
   55 !:mime	application/x-dosexec
   56 # Windows and later versions of DOS will allow .EXEs to be named with a .COM
   57 # extension, mostly for compatibility's sake.
   58 !:ext	exe/com
   59 # These traditional tests usually work but not always.  When test quality support is
   60 # implemented these can be turned on.
   61 #>>0x18	leshort	0x1c	(Borland compiler)
   62 #>>0x18	leshort	0x1e	(MS compiler)
   63 
   64 # If the relocation table is 0x40 or more bytes into the file, it's definitely
   65 # not a DOS EXE.
   66 >0x18  leshort >0x3f
   67 
   68 # Maybe it's a PE?
   69 >>(0x3c.l) string PE\0\0 PE
   70 !:mime	application/x-dosexec
   71 >>>(0x3c.l+24)	leshort		0x010b	\b32 executable
   72 >>>(0x3c.l+24)	leshort		0x020b	\b32+ executable
   73 >>>(0x3c.l+24)	leshort		0x0107	ROM image
   74 >>>(0x3c.l+24)	default		x	Unknown PE signature
   75 >>>>&0 		leshort		x	0x%x
   76 >>>(0x3c.l+22)	leshort&0x2000	>0	(DLL)
   77 >>>(0x3c.l+92)	leshort		1
   78 # Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the
   79 # drivers in Windows/System32/drivers/*.sys.
   80 >>>>(0x3c.l+22)	leshort&0x2000	>0	(native)
   81 !:ext	dll/sys
   82 >>>>(0x3c.l+22)	leshort&0x2000	0	(native)
   83 !:ext	exe/sys
   84 >>>(0x3c.l+92)	leshort		2
   85 >>>>(0x3c.l+22)	leshort&0x2000	>0	(GUI)
   86 # These could probably be at least partially distinguished from one another by
   87 # looking for specific exported functions.
   88 # CPL: Control Panel item
   89 # TLB: Type library
   90 # OCX: OLE/ActiveX control
   91 # ACM: Audio compression manager codec
   92 # AX: DirectShow source filter
   93 # IME: Input method editor
   94 !:ext	dll/cpl/tlb/ocx/acm/ax/ime
   95 >>>>(0x3c.l+22)	leshort&0x2000	0	(GUI)
   96 # Screen savers typically include code from the scrnsave.lib static library, but
   97 # that's not guaranteed.
   98 !:ext	exe/scr
   99 >>>(0x3c.l+92)	leshort		3
  100 >>>>(0x3c.l+22)	leshort&0x2000	>0	(console)
  101 !:ext	dll/cpl/tlb/ocx/acm/ax/ime
  102 >>>>(0x3c.l+22)	leshort&0x2000	0	(console)
  103 !:ext	exe/com
  104 >>>(0x3c.l+92)	leshort		7	(POSIX)
  105 >>>(0x3c.l+92)	leshort		9	(Windows CE)
  106 >>>(0x3c.l+92)	leshort		10	(EFI application)
  107 >>>(0x3c.l+92)	leshort		11	(EFI boot service driver)
  108 >>>(0x3c.l+92)	leshort		12	(EFI runtime driver)
  109 >>>(0x3c.l+92)	leshort		13	(EFI ROM)
  110 >>>(0x3c.l+92)	leshort		14	(XBOX)
  111 >>>(0x3c.l+92)	leshort		15	(Windows boot application)
  112 >>>(0x3c.l+92)	default		x	(Unknown subsystem
  113 >>>>&0		leshort		x	0x%x)
  114 >>>(0x3c.l+4)	leshort		0x14c	Intel 80386
  115 >>>(0x3c.l+4)	leshort		0x166	MIPS R4000
  116 >>>(0x3c.l+4)	leshort		0x168	MIPS R10000
  117 >>>(0x3c.l+4)	leshort		0x184	Alpha
  118 >>>(0x3c.l+4)	leshort		0x1a2	Hitachi SH3
  119 >>>(0x3c.l+4)	leshort		0x1a6	Hitachi SH4
  120 >>>(0x3c.l+4)	leshort		0x1c0	ARM
  121 >>>(0x3c.l+4)	leshort		0x1c2	ARM Thumb
  122 >>>(0x3c.l+4)	leshort		0x1c4	ARMv7 Thumb
  123 >>>(0x3c.l+4)	leshort		0x1f0	PowerPC
  124 >>>(0x3c.l+4)	leshort		0x200	Intel Itanium
  125 >>>(0x3c.l+4)	leshort		0x266	MIPS16
  126 >>>(0x3c.l+4)	leshort		0x268	Motorola 68000
  127 >>>(0x3c.l+4)	leshort		0x290	PA-RISC
  128 >>>(0x3c.l+4)	leshort		0x366	MIPSIV
  129 >>>(0x3c.l+4)	leshort		0x466	MIPS16 with FPU
  130 >>>(0x3c.l+4)	leshort		0xebc	EFI byte code
  131 >>>(0x3c.l+4)	leshort		0x8664	x86-64
  132 >>>(0x3c.l+4)	leshort		0xc0ee	MSIL
  133 >>>(0x3c.l+4)	default		x	Unknown processor type
  134 >>>>&0		leshort		x	0x%x
  135 >>>(0x3c.l+22)	leshort&0x0200	>0	(stripped to external PDB)
  136 >>>(0x3c.l+22)	leshort&0x1000	>0	system file
  137 >>>(0x3c.l+24)	leshort		0x010b
  138 >>>>(0x3c.l+232) lelong	>0	Mono/.Net assembly
  139 >>>(0x3c.l+24)	leshort		0x020b
  140 >>>>(0x3c.l+248) lelong	>0	Mono/.Net assembly
  141 
  142 # hooray, there's a DOS extender using the PE format, with a valid PE
  143 # executable inside (which just prints a message and exits if run in win)
  144 >>>(8.s*16)		string		32STUB	\b, 32rtm DOS extender
  145 >>>(8.s*16)		string		!32STUB	\b, for MS Windows
  146 >>>(0x3c.l+0xf8)	string		UPX0 \b, UPX compressed
  147 >>>(0x3c.l+0xf8)	search/0x140	PEC2 \b, PECompact2 compressed
  148 >>>(0x3c.l+0xf8)	search/0x140	UPX2
  149 >>>>(&0x10.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
  150 >>>(0x3c.l+0xf8)	search/0x140	.idata
  151 >>>>(&0xe.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
  152 >>>>(&0xe.l+(-4))	string		ZZ0 \b, ZZip self-extracting archive
  153 >>>>(&0xe.l+(-4))	string		ZZ1 \b, ZZip self-extracting archive
  154 >>>(0x3c.l+0xf8)	search/0x140	.rsrc
  155 >>>>(&0x0f.l+(-4))	string		a\\\4\5 \b, WinHKI self-extracting archive
  156 >>>>(&0x0f.l+(-4))	string		Rar! \b, RAR self-extracting archive
  157 >>>>(&0x0f.l+(-4))	search/0x3000	MSCF \b, InstallShield self-extracting archive
  158 >>>>(&0x0f.l+(-4))	search/32	Nullsoft \b, Nullsoft Installer self-extracting archive
  159 >>>(0x3c.l+0xf8)	search/0x140	.data
  160 >>>>(&0x0f.l)		string		WEXTRACT \b, MS CAB-Installer self-extracting archive
  161 >>>(0x3c.l+0xf8)	search/0x140	.petite\0 \b, Petite compressed
  162 >>>>(0x3c.l+0xf7)	byte		x
  163 >>>>>(&0x104.l+(-4))	string		=!sfx! \b, ACE self-extracting archive
  164 >>>(0x3c.l+0xf8)	search/0x140	.WISE \b, WISE installer self-extracting archive
  165 >>>(0x3c.l+0xf8)	search/0x140	.dz\0\0\0 \b, Dzip self-extracting archive
  166 >>>&(0x3c.l+0xf8)	search/0x100	_winzip_ \b, ZIP self-extracting archive (WinZip)
  167 >>>&(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
  168 >>>0x30			string		Inno \b, InnoSetup self-extracting archive
  169 
  170 # Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
  171 # must be one of the unusual subformats.
  172 >>(0x3c.l) string !PE\0\0 MS-DOS executable
  173 !:mime	application/x-dosexec
  174 
  175 >>(0x3c.l)		string		NE \b, NE
  176 !:mime	application/x-dosexec
  177 >>>(0x3c.l+0x36)	byte		1 for OS/2 1.x
  178 >>>(0x3c.l+0x36)	byte		2 for MS Windows 3.x
  179 >>>(0x3c.l+0x36)	byte		3 for MS-DOS
  180 >>>(0x3c.l+0x36)	byte		4 for Windows 386
  181 >>>(0x3c.l+0x36)	byte		5 for Borland Operating System Services
  182 >>>(0x3c.l+0x36)	default		x
  183 >>>>(0x3c.l+0x36)	byte		x (unknown OS %x)
  184 >>>(0x3c.l+0x36)	byte		0x81 for MS-DOS, Phar Lap DOS extender
  185 >>>(0x3c.l+0x0c)	leshort&0x8000	0x8000 (DLL or font)
  186 # DRV: Driver
  187 # 3GR: Grabber device driver
  188 # CPL: Control Panel Item
  189 # VBX: Visual Basic Extension
  190 # FON: Bitmap font
  191 # FOT: Font resource file
  192 !:ext	dll/drv/3gr/cpl/vbx/fon/fot
  193 >>>(0x3c.l+0x0c)	leshort&0x8000	0 (EXE)
  194 !:ext	exe/scr
  195 >>>&(&0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
  196 >>>(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
  197 
  198 >>(0x3c.l)		string		LX\0\0 \b, LX
  199 !:mime	application/x-dosexec
  200 >>>(0x3c.l+0x0a)	leshort		<1 (unknown OS)
  201 >>>(0x3c.l+0x0a)	leshort		1 for OS/2
  202 >>>(0x3c.l+0x0a)	leshort		2 for MS Windows
  203 >>>(0x3c.l+0x0a)	leshort		3 for DOS
  204 >>>(0x3c.l+0x0a)	leshort		>3 (unknown OS)
  205 >>>(0x3c.l+0x10)	lelong&0x28000	=0x8000 (DLL)
  206 >>>(0x3c.l+0x10)	lelong&0x20000	>0 (device driver)
  207 >>>(0x3c.l+0x10)	lelong&0x300	0x300 (GUI)
  208 >>>(0x3c.l+0x10)	lelong&0x28300	<0x300 (console)
  209 >>>(0x3c.l+0x08)	leshort		1 i80286
  210 >>>(0x3c.l+0x08)	leshort		2 i80386
  211 >>>(0x3c.l+0x08)	leshort		3 i80486
  212 >>>(8.s*16)		string		emx \b, emx
  213 >>>>&1			string		x %s
  214 >>>&(&0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive
  215 
  216 # MS Windows system file, supposedly a collection of LE executables
  217 >>(0x3c.l)		string		W3 \b, W3 for MS Windows
  218 !:mime	application/x-dosexec
  219 
  220 >>(0x3c.l)		string		LE\0\0 \b, LE executable
  221 !:mime	application/x-dosexec
  222 >>>(0x3c.l+0x0a)	leshort		1
  223 # some DOS extenders use LE files with OS/2 header
  224 >>>>0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
  225 >>>>0x240		search/0x200	WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
  226 >>>>0x440		search/0x100	CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
  227 >>>>0x40		search/0x40	PMODE/W for MS-DOS, PMODE/W DOS extender
  228 >>>>0x40		search/0x40	STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
  229 >>>>0x40		search/0x80	STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
  230 >>>>0x40		search/0x80	DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
  231 # this is a wild guess; hopefully it is a specific signature
  232 >>>>&0x24		lelong		<0x50
  233 >>>>>(&0x4c.l)		string		\xfc\xb8WATCOM
  234 >>>>>>&0		search/8	3\xdbf\xb9 \b, 32Lite compressed
  235 # another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
  236 #>>>>(0x3c.l+0x1c)	lelong		>0x10000 for OS/2
  237 # fails with DOS-Extenders.
  238 >>>(0x3c.l+0x0a)	leshort		2 for MS Windows
  239 >>>(0x3c.l+0x0a)	leshort		3 for DOS
  240 >>>(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
  241 # VXD: VxD for Windows 95/98/Me
  242 # 386: VxD for Windows 2.10, 3.0, 3.1x
  243 # PDR: Port driver
  244 # MPD: Miniport driver (?)
  245 !:ext	vxd/386/pdr/mpd
  246 >>>(&0x7c.l+0x26)	string		UPX \b, UPX compressed
  247 >>>&(&0x54.l-3)		string		UNACE \b, ACE self-extracting archive
  248 
  249 # looks like ASCII, probably some embedded copyright message.
  250 # and definitely not NE/LE/LX/PE
  251 >>0x3c		lelong	>0x20000000
  252 >>>(4.s*512)	leshort !0x014c \b, MZ for MS-DOS
  253 !:mime	application/x-dosexec
  254 !:ext	exe/com
  255 # header data too small for extended executable
  256 >2		long	!0
  257 >>0x18		leshort <0x40
  258 >>>(4.s*512)	leshort !0x014c
  259 
  260 >>>>&(2.s-514)	string	!LE
  261 >>>>>&-2	string	!BW \b, MZ for MS-DOS
  262 !:mime	application/x-dosexec
  263 >>>>&(2.s-514)	string	LE \b, LE
  264 >>>>>0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
  265 # educated guess since indirection is still not capable enough for complex offset
  266 # calculations (next embedded executable would be at &(&2*512+&0-2)
  267 # I suspect there are only LE executables in these multi-exe files
  268 >>>>&(2.s-514)	string	BW
  269 >>>>>0x240	search/0x100	DOS/4G	\b, LE for MS-DOS, DOS4GW DOS extender (embedded)
  270 >>>>>0x240	search/0x100	!DOS/4G	\b, BW collection for MS-DOS
  271 
  272 # This sequence skips to the first COFF segment, usually .text
  273 >(4.s*512)	leshort		0x014c \b, COFF
  274 !:mime	application/x-dosexec
  275 >>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
  276 >>(8.s*16)	string		emx
  277 >>>&1		string		x for DOS, Win or OS/2, emx %s
  278 >>&(&0x42.l-3)	byte		x
  279 >>>&0x26	string		UPX \b, UPX compressed
  280 # and yet another guess: small .text, and after large .data is unusal, could be 32lite
  281 >>&0x2c		search/0xa0	.text
  282 >>>&0x0b	lelong		<0x2000
  283 >>>>&0		lelong		>0x6000 \b, 32lite compressed
  284 
  285 >(8.s*16) string $WdX \b, WDos/X DOS extender
  286 
  287 # By now an executable type should have been printed out.  The executable
  288 # may be a self-uncompressing archive, so look for evidence of that and
  289 # print it out.
  290 #
  291 # Some signatures below from Greg Roelofs, newt@uchicago.edu.
  292 #
  293 >0x35	string	\x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
  294 >0xe7	string	LH/2\ 	Self-Extract \b, %s
  295 >0x1c	string	UC2X	\b, UCEXE compressed
  296 >0x1c	string	WWP\ 	\b, WWPACK compressed
  297 >0x1c	string	RJSX 	\b, ARJ self-extracting archive
  298 >0x1c	string	diet 	\b, diet compressed
  299 >0x1c	string	LZ09 	\b, LZEXE v0.90 compressed
  300 >0x1c	string	LZ91 	\b, LZEXE v0.91 compressed
  301 >0x1c	string	tz 	\b, TinyProg compressed
  302 >0x1e	string	Copyright\ 1989-1990\ PKWARE\ Inc.	Self-extracting PKZIP archive
  303 !:mime	application/zip
  304 # Yes, this really is "Copr", not "Corp."
  305 >0x1e	string	PKLITE\ Copr.	Self-extracting PKZIP archive
  306 !:mime	application/zip
  307 # winarj stores a message in the stub instead of the sig in the MZ header
  308 >0x20	search/0xe0	aRJsfX \b, ARJ self-extracting archive
  309 >0x20	string AIN
  310 >>0x23	string 2	\b, AIN 2.x compressed
  311 >>0x23	string <2	\b, AIN 1.x compressed
  312 >>0x23	string >2	\b, AIN 1.x compressed
  313 >0x24	string	LHa's\ SFX \b, LHa self-extracting archive
  314 !:mime	application/x-lha
  315 >0x24	string	LHA's\ SFX \b, LHa self-extracting archive
  316 !:mime	application/x-lha
  317 >0x24	string	\ $ARX \b, ARX self-extracting archive
  318 >0x24	string	\ $LHarc \b, LHarc self-extracting archive
  319 >0x20	string	SFX\ by\ LARC \b, LARC self-extracting archive
  320 >0x40	string aPKG \b, aPackage self-extracting archive
  321 >0x64	string	W\ Collis\0\0 \b, Compack compressed
  322 >0x7a	string		Windows\ self-extracting\ ZIP	\b, ZIP self-extracting archive
  323 >>&0xf4 search/0x140 \x0\x40\x1\x0
  324 >>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
  325 >1638	string	-lh5- \b, LHa self-extracting archive v2.13S
  326 >0x17888 string Rar! \b, RAR self-extracting archive
  327 
  328 # Skip to the end of the EXE.  This will usually work fine in the PE case
  329 # because the MZ image is hardcoded into the toolchain and almost certainly
  330 # won't match any of these signatures.
  331 >(4.s*512)	long	x
  332 >>&(2.s-517)	byte	x
  333 >>>&0	string		PK\3\4 \b, ZIP self-extracting archive
  334 >>>&0	string		Rar! \b, RAR self-extracting archive
  335 >>>&0	string		=!\x11 \b, AIN 2.x self-extracting archive
  336 >>>&0	string		=!\x12 \b, AIN 2.x self-extracting archive
  337 >>>&0	string		=!\x17 \b, AIN 1.x self-extracting archive
  338 >>>&0	string		=!\x18 \b, AIN 1.x self-extracting archive
  339 >>>&7	search/400	**ACE** \b, ACE self-extracting archive
  340 >>>&0	search/0x480	UC2SFX\ Header \b, UC2 self-extracting archive
  341 
  342 # a few unknown ZIP sfxes, no idea if they are needed or if they are
  343 # already captured by the generic patterns above
  344 >(8.s*16)	search/0x20	PKSFX \b, ZIP self-extracting archive (PKZIP)
  345 # TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
  346 #
  347 
  348 # TELVOX Teleinformatica CODEC self-extractor for OS/2:
  349 >49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
  350 >>49824 leshort		=1			\b, 1 file
  351 >>49824 leshort		>1			\b, %u files
  352 
  353 # added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc
  354 # and http://www.freedos.org/software/?prog=kpdos
  355 # for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
  356 0	string/b	KCF		FreeDOS KEYBoard Layout collection
  357 # only version=0x100 found
  358 >3	uleshort	x		\b, version 0x%x
  359 # length of string containing author,info and special characters
  360 >6	ubyte		>0
  361 #>>6	pstring		x		\b, name=%s
  362 >>7	string		>\0		\b, author=%-.14s
  363 >>7	search/254	\xff		\b, info=
  364 #>>>&0	string		x		\b%-s
  365 >>>&0	string		x		\b%-.15s
  366 # for FreeDOS *.KL files
  367 0	string/b	KLF		FreeDOS KEYBoard Layout file
  368 # only version=0x100 or 0x101 found
  369 >3	uleshort	x		\b, version 0x%x
  370 # stringlength
  371 >5	ubyte		>0
  372 >>8	string		x		\b, name=%-.2s
  373 0	string	\xffKEYB\ \ \ \0\0\0\0
  374 >12	string	\0\0\0\0`\004\360	MS-DOS KEYBoard Layout file
  375 
  376 # DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017
  377 # https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
  378 0	ulequad&0x07a0ffffffff		0xffffffff
  379 >0	use				msdos-driver
  380 0       name    			msdos-driver		DOS executable (
  381 #!:mime	application/octet-stream
  382 !:mime	application/x-dosdriver
  383 # also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
  384 !:ext	sys/dev/bin
  385 >40	search/7			UPX!			\bUPX compressed
  386 # DOS device driver attributes
  387 >4	uleshort&0x8000			0x0000			\bblock device driver
  388 # character device
  389 >4	uleshort&0x8000			0x8000			\b
  390 >>4	uleshort&0x0008			0x0008			\bclock
  391 # fast video output by int 29h
  392 >>4	uleshort&0x0010			0x0010			\bfast
  393 # standard input/output device
  394 >>4	uleshort&0x0003			>0			\bstandard
  395 >>>4	uleshort&0x0001			0x0001			\binput
  396 >>>4	uleshort&0x0003			0x0003			\b/
  397 >>>4	uleshort&0x0002			0x0002			\boutput
  398 >>4	uleshort&0x8000			0x8000			\bcharacter device driver
  399 >0	ubyte				x
  400 # upx compressed device driver has garbage instead of real in name field of header
  401 >>40	search/7			UPX!
  402 >>40	default				x
  403 # leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
  404 >>>12		ubyte			>0x2E			\b
  405 >>>>10		ubyte			>0x20
  406 >>>>>10		ubyte			!0x2E
  407 >>>>>>10	ubyte			!0x2A			\b%c
  408 >>>>11		ubyte			>0x20
  409 >>>>>11		ubyte			!0x2E			\b%c
  410 >>>>12		ubyte			>0x20
  411 >>>>>12		ubyte			!0x39
  412 >>>>>>12	ubyte			!0x2E			\b%c
  413 >>>13		ubyte			>0x20
  414 >>>>13		ubyte			!0x2E			\b%c
  415 >>>>14		ubyte			>0x20
  416 >>>>>14		ubyte			!0x2E			\b%c
  417 >>>>15		ubyte			>0x20
  418 >>>>>15		ubyte			!0x2E			\b%c
  419 >>>>16		ubyte			>0x20
  420 >>>>>16		ubyte			!0x2E
  421 >>>>>>16	ubyte			<0xCB			\b%c
  422 >>>>17		ubyte			>0x20
  423 >>>>>17		ubyte			!0x2E
  424 >>>>>>17	ubyte			<0x90			\b%c
  425 # some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
  426 >>>12		ubyte			<0x2F
  427 # they have their real name at offset 22
  428 # also block device drivers like DUMBDRV.SYS
  429 >>>>22		string			>\056			%-.6s
  430 >4	uleshort&0x8000			0x0000
  431 # 32 bit sector addressing ( > 32 MB) for block devices
  432 >>4	uleshort&0x0002			0x0002			\b,32-bit sector-
  433 # support by driver functions 13h, 17h, 18h
  434 >4	uleshort&0x0040			0x0040			\b,IOCTL-
  435 # open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
  436 >4	uleshort&0x0800			0x0800			\b,close media-
  437 # output until busy support by int 10h for character device driver
  438 >4	uleshort&0x8000			0x8000
  439 >>4	uleshort&0x2000			0x2000			\b,until busy-
  440 # direct read/write support by driver functions 03h,0Ch
  441 >4	uleshort&0x4000			0x4000			\b,control strings-
  442 >4	uleshort&0x8000			0x8000
  443 >>4	uleshort&0x6840			>0			\bsupport
  444 >4	uleshort&0x8000			0x0000
  445 >>4	uleshort&0x4842			>0			\bsupport
  446 >0	ubyte				x			\b)
  447 # DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
  448 0	ulequad				0x0513c00000000012
  449 >0	use				msdos-driver
  450 # DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
  451 0	ulequad				0x32f28000ffff0016
  452 >0	use				msdos-driver
  453 0	ulequad				0x007f00000000ffff
  454 >0	use				msdos-driver
  455 0	ulequad				0x001600000000ffff
  456 >0	use				msdos-driver
  457 # DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
  458 0	ulequad				0x0bf708c2ffffffff
  459 >0	use				msdos-driver
  460 0	ulequad				0x07bd08c2ffffffff
  461 >0	use				msdos-driver
  462 
  463 # updated by Joerg Jenderek
  464 # GRR: line below too general as it catches also
  465 # rt.lib DYADISKS.PIC and many more
  466 # start with assembler instruction MOV
  467 0	ubyte		0x8c
  468 # skip "AppleWorks word processor data" like ARTICLE.1 ./apple
  469 >4	string			!O====
  470 # skip some unknown basic binaries like RocketRnger.SHR
  471 >>5	string			!MAIN
  472 # skip "GPG symmetrically encrypted data" ./gnu
  473 # skip "PGP symmetric key encrypted data" ./pgp
  474 # openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type
  475 >>>4	ubyte			>13	DOS executable (COM, 0x8C-variant)
  476 # the remaining files should be DOS *.COM executables
  477 # dosshell.COM	8cc0 2ea35f07 e85211 e88a11 b80058 cd
  478 # hmload.COM	8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4
  479 # UNDELETE.COM	8cca 2e8916 6503 b430 cd21 8b 2e0200 8b
  480 # BOOTFIX.COM	8cca 2e8916 9603 b430 cd21 8b 2e0200 8b
  481 # RAWRITE3.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
  482 # SHARE.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
  483 # validchr.COM	8cca 2e8916 9603 b430 cd21 8b 2e028b1e
  484 # devload.COM	8cca 8916ad01 b430 cd21 8b2e0200 892e
  485 !:mime	application/x-dosexec
  486 !:ext com
  487 
  488 # updated by Joerg Jenderek at Oct 2008
  489 0	ulelong		0xffff10eb	DR-DOS executable (COM)
  490 # byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
  491 0	ubeshort&0xeb8d	>0xeb00
  492 # DR-DOS STACKER.COM SCREATE.SYS missed
  493 
  494 0       name    msdos-com
  495 >0  byte        x               DOS executable (COM)
  496 !:mime	application/x-dosexec
  497 !:ext	com
  498 >6	string		SFX\ of\ LHarc	\b, %s
  499 >0x1FE leshort	0xAA55		    \b, boot code
  500 >85	string		UPX		        \b, UPX compressed
  501 >4	string		\ $ARX		    \b, ARX self-extracting archive
  502 >4	string		\ $LHarc	    \b, LHarc self-extracting archive
  503 >0x20e string	SFX\ by\ LARC	\b, LARC self-extracting archive
  504 
  505 # JMP 8bit
  506 0	        byte	0xeb
  507 # allow forward jumps only
  508 >1          byte    >-1
  509 # that offset must be accessible
  510 >>(1.b+2)   byte    x
  511 >>>0        use msdos-com
  512 
  513 # JMP 16bit
  514 0           byte    0xe9
  515 # forward jumps
  516 >1          short   >-1
  517 # that offset must be accessible
  518 >>(1.s+3)   byte    x
  519 >>>0        use msdos-com
  520 # negative offset, must not lead into PSP
  521 >1          short   <-259
  522 # that offset must be accessible
  523 >>(1,s+65539)   byte    x
  524 >>>0        use msdos-com
  525 
  526 # updated by Joerg Jenderek at Oct 2008,2015
  527 # following line is too general
  528 0	ubyte		0xb8
  529 # skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux
  530 >0	string		!\xb8\xc0\x07\x8e
  531 # modified by Joerg Jenderek
  532 # syslinux COM32 or COM32R executable
  533 >>1	lelong&0xFFFFFFFe 0x21CD4CFe	COM executable (32-bit COMBOOT
  534 # http://www.syslinux.org/wiki/index.php/Comboot_API
  535 # Since version 5.00 c32 modules switched from the COM32 object format to ELF
  536 !:mime	application/x-c32-comboot-syslinux-exec
  537 !:ext c32
  538 # http://syslinux.zytor.com/comboot.php
  539 # older syslinux version ( <4 )
  540 # (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
  541 # start with assembler instructions mov eax,21cd4cffh
  542 >>>1	lelong		0x21CD4CFf	\b)
  543 # syslinux:doc/comboot.txt
  544 # A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
  545 # eax,21cd4cfeh) as a magic number.
  546 # syslinux version (4.x)
  547 # "COM executable (COM32R)" or "Syslinux COM32 module" by TrID
  548 >>>1	lelong		0x21CD4CFe	\b, relocatable)
  549 # remaining are DOS COM executables starting with assembler instruction MOV
  550 # like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM
  551 # MS-DOS SYS.COM RESTART.COM
  552 # SYSLINUX.COM (version 1.40 - 2.13)
  553 # GFXBOOT.COM (version 3.75)
  554 # COPYBS.COM POWEROFF.COM INT18.COM
  555 >>1	default	x			COM executable for DOS
  556 !:mime	application/x-dosexec
  557 #!:mime	application/x-ms-dos-executable
  558 #!:mime	application/x-msdos-program
  559 !:ext com
  560 
  561 0	string/b	\x81\xfc
  562 >4	string	\x77\x02\xcd\x20\xb9
  563 >>36	string	UPX!			FREE-DOS executable (COM), UPX compressed
  564 !:mime	application/x-dosexec
  565 !:ext	com
  566 252	string Must\ have\ DOS\ version DR-DOS executable (COM)
  567 !:mime	application/x-dosexec
  568 !:ext	com
  569 # added by Joerg Jenderek at Oct 2008
  570 # GRR search is not working
  571 #34	search/2	UPX!		FREE-DOS executable (COM), UPX compressed
  572 34	string	UPX!			FREE-DOS executable (COM), UPX compressed
  573 !:mime	application/x-dosexec
  574 !:ext	com
  575 35	string	UPX!			FREE-DOS executable (COM), UPX compressed
  576 !:mime	application/x-dosexec
  577 !:ext	com
  578 # GRR search is not working
  579 #2	search/28	\xcd\x21	COM executable for MS-DOS
  580 #WHICHFAT.cOM
  581 2	string	\xcd\x21		COM executable for DOS
  582 !:mime	application/x-dosexec
  583 !:ext	com
  584 #DELTREE.cOM DELTREE2.cOM
  585 4	string	\xcd\x21		COM executable for DOS
  586 !:mime	application/x-dosexec
  587 !:ext	com
  588 #IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
  589 5	string	\xcd\x21		COM executable for DOS
  590 !:mime	application/x-dosexec
  591 !:ext	com
  592 #DELTMP.COm HASFAT32.cOM
  593 7	string	\xcd\x21
  594 >0	byte	!0xb8			COM executable for DOS
  595 !:mime	application/x-dosexec
  596 !:ext	com
  597 #COMP.cOM MORE.COm
  598 10	string	\xcd\x21
  599 >5	string	!\xcd\x21		COM executable for DOS
  600 !:mime	application/x-dosexec
  601 !:ext	com
  602 #comecho.com
  603 13	string	\xcd\x21		COM executable for DOS
  604 !:mime	application/x-dosexec
  605 !:ext	com
  606 #HELP.COm EDIT.coM
  607 18	string	\xcd\x21		COM executable for MS-DOS
  608 !:mime	application/x-dosexec
  609 !:ext	com
  610 #NWRPLTRM.COm
  611 23	string	\xcd\x21		COM executable for MS-DOS
  612 !:mime	application/x-dosexec
  613 !:ext	com
  614 #LOADFIX.cOm LOADFIX.cOm
  615 30	string	\xcd\x21		COM executable for MS-DOS
  616 !:mime	application/x-dosexec
  617 !:ext	com
  618 #syslinux.com 3.11
  619 70	string	\xcd\x21		COM executable for DOS
  620 !:mime	application/x-dosexec
  621 !:ext	com
  622 # many compressed/converted COMs start with a copy loop instead of a jump
  623 0x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
  624 !:mime	application/x-dosexec
  625 !:ext	com
  626 0x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
  627 !:mime	application/x-dosexec
  628 !:ext	com
  629 >0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
  630 0x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
  631 !:mime	application/x-dosexec
  632 !:ext	com
  633 # FIXME: missing diet .com compression
  634 
  635 # miscellaneous formats
  636 0	string/b	LZ		MS-DOS executable (built-in)
  637 #0	byte		0xf0		MS-DOS program library data
  638 #
  639 
  640 # AAF files:
  641 # <stuartc@rd.bbc.co.uk> Stuart Cunningham
  642 0	string/b	\320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377			AAF legacy file using MS Structured Storage
  643 >30	byte	9		(512B sectors)
  644 >30	byte	12		(4kB sectors)
  645 0	string/b	\320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001			AAF file using MS Structured Storage
  646 >30	byte	9		(512B sectors)
  647 >30	byte	12		(4kB sectors)
  648 
  649 # Popular applications
  650 2080	string	Microsoft\ Word\ 6.0\ Document	%s
  651 !:mime	application/msword
  652 2080	string	Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
  653 !:mime	application/msword
  654 # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
  655 2112	string	MSWordDoc			Microsoft Word document data
  656 !:mime	application/msword
  657 #
  658 0	belong	0x31be0000			Microsoft Word Document
  659 !:mime	application/msword
  660 #
  661 0	string/b	PO^Q`				Microsoft Word 6.0 Document
  662 !:mime	application/msword
  663 #
  664 4   long        0
  665 >0  belong      0xfe320000      Microsoft Word for Macintosh 1.0
  666 !:mime	application/msword
  667 !:ext   mcw
  668 >0  belong      0xfe340000      Microsoft Word for Macintosh 3.0
  669 !:mime	application/msword
  670 !:ext   mcw
  671 >0  belong      0xfe37001c      Microsoft Word for Macintosh 4.0
  672 !:mime	application/msword
  673 !:ext   mcw
  674 >0  belong      0xfe370023      Microsoft Word for Macintosh 5.0
  675 !:mime	application/msword
  676 !:ext   mcw
  677 
  678 0	string/b	\333\245-\0\0\0			Microsoft Word 2.0 Document
  679 !:mime	application/msword
  680 !:ext   doc
  681 # Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs
  682 #512	string/b	\354\245\301			Microsoft Word Document
  683 #!:mime	application/msword
  684 
  685 #
  686 0	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
  687 !:mime application/msword
  688 #
  689 2080	string	Microsoft\ Excel\ 5.0\ Worksheet	%s
  690 !:mime	application/vnd.ms-excel
  691 #
  692 0	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
  693 !:mime application/msword
  694 
  695 2080	string	Foglio\ di\ lavoro\ Microsoft\ Exce	%s
  696 !:mime	application/vnd.ms-excel
  697 #
  698 # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
  699 2114	string	Biff5		Microsoft Excel 5.0 Worksheet
  700 !:mime	application/vnd.ms-excel
  701 # Italian MS-Excel
  702 2121	string	Biff5		Microsoft Excel 5.0 Worksheet
  703 !:mime	application/vnd.ms-excel
  704 0	string/b	\x09\x04\x06\x00\x00\x00\x10\x00	Microsoft Excel Worksheet
  705 !:mime	application/vnd.ms-excel
  706 #
  707 # Update: Joerg Jenderek
  708 # URL: https://en.wikipedia.org/wiki/Lotus_1-2-3
  709 # Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
  710 # Note: newer Lotus versions >2 use longer BOF record
  711 # record type (BeginningOfFile=0000h) + length (001Ah)
  712 0	belong	0x00001a00
  713 # reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3
  714 #>18	uleshort&0x73E0	0
  715 # Lotus Multi Byte Character Set (LMBCS=1-31)
  716 >20	ubyte		>0
  717 >>20	ubyte		<32	Lotus 1-2-3
  718 #!:mime	application/x-123
  719 !:mime	application/vnd.lotus-1-2-3
  720 !:apple	????L123
  721 # (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data"
  722 >>>4	uleshort	0x1000	WorKsheet, version 3
  723 !:ext	wk3
  724 # (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data"
  725 >>>4	uleshort	0x1002	WorKsheet, version 4
  726 # also worksheet template 4 (.wt4)
  727 !:ext	wk4/wt4
  728 # no example or documentation for wk5
  729 #>>4	uleshort	0x????	WorKsheet, version 4
  730 #!:ext	wk5
  731 # only MacrotoScript.123 example
  732 >>>4	uleshort	0x1003	WorKsheet, version 97
  733 # also worksheet template Smartmaster (.12M)?
  734 !:ext	123
  735 # only Set_Y2K.123 example
  736 >>>4	uleshort	0x1005	WorKsheet, version 9.8 Millennium
  737 !:ext	123
  738 # no example for this version
  739 >>>4	uleshort	0x8001	FoRMatting data
  740 !:ext	frm
  741 # (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data"
  742 # TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet"
  743 >>>4	uleshort	0x8007	ForMatting data, version 3
  744 !:ext	fm3
  745 >>>4	default		x	unknown
  746 # file revision sub code 0004h for worksheets
  747 >>>>6	uleshort	=0x0004	worksheet
  748 !:ext	wXX
  749 >>>>6	uleshort	!0x0004	formatting data
  750 !:ext	fXX
  751 # main revision number
  752 >>>>4	uleshort	x	\b, revision 0x%x
  753 >>>6	uleshort	=0x0004	\b, cell range
  754 # active cellcoord range (start row, page,column ; end row, page, column)
  755 # start values normally 0~1st sheet A1
  756 >>>>8	ulelong		!0
  757 >>>>>10	ubyte		>0	\b%d*
  758 >>>>>8	uleshort	x	\b%d,
  759 >>>>>11	ubyte		x	\b%d-
  760 # end page mostly 0
  761 >>>>14	ubyte		>0	\b%d*
  762 # end raw, column normally not 0
  763 >>>>12	uleshort	x	\b%d,
  764 >>>>15	ubyte		x	\b%d
  765 # Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??)
  766 >>>>20	ubyte		>1	\b, character set 0x%x
  767 # flags
  768 >>>>21	ubyte		x	\b, flags 0x%x
  769 >>>6	uleshort	!0x0004
  770 # record type (FONTNAME=00AEh)
  771 >>>>30	search/29	\0\xAE
  772 # variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
  773 >>>>>&4	string		>\0	\b, 1st font "%s"
  774 #
  775 # Update: Joerg Jenderek
  776 # URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3
  777 # Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
  778 # Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
  779 # record type (BeginningOfFile=0000h) + length (0002h)
  780 0	belong	0x00000200
  781 # GRR: line above is too general as it catches also MS Windows CURsor
  782 # to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
  783 !:strength -1
  784 # skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
  785 >7	ubyte		0
  786 # skip Windows cursors with image width 256 and keep Lotus with positiv opcode
  787 >>6	ubyte		>0	Lotus
  788 # !:mime	application/x-123
  789 !:mime	application/vnd.lotus-1-2-3
  790 !:apple	????L123
  791 # revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...)
  792 # undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3"
  793 >>>4	uleshort	0x0007	1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF)
  794 !:ext	cnf
  795 >>>4	uleshort	0x0C05	1-2-3 CoNFiguration, version 2.4J
  796 !:ext	cnf
  797 >>>4	uleshort	0x0801	1-2-3 CoNFiguration, version 1-2.1
  798 !:ext	cnf
  799 >>>4	uleshort	0x0802	Symphony CoNFiguration
  800 !:ext	cnf
  801 >>>4	uleshort	0x0804	1-2-3 CoNFiguration, version 2.2
  802 !:ext	cnf
  803 >>>4	uleshort	0x080A	1-2-3 CoNFiguration, version 2.3-2.4
  804 !:ext	cnf
  805 >>>4	uleshort	0x1402	1-2-3 CoNFiguration, version 3.x
  806 !:ext	cnf
  807 >>>4	uleshort	0x1450	1-2-3 CoNFiguration, version 4.x
  808 !:ext	cnf
  809 # (version 5.26) labeled the entry as "Lotus 123"
  810 # TrID labeles the entry as "Lotus 123 Worksheet (generic)"
  811 >>>4	uleshort	0x0404	1-2-3 WorKSheet, version 1
  812 # extension "wks" also for Microsoft Works document
  813 !:ext	wks
  814 # (version 5.26) labeled the entry as "Lotus 123"
  815 # TrID labeles the entry as "Lotus 123 Worksheet (generic)"
  816 >>>4	uleshort	0x0405	Symphony WoRksheet, version 1.0
  817 !:ext	wrk/wr1
  818 # (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data"
  819 # TrID labeles the entry as "Lotus 123 Worksheet (V2)"
  820 >>>4	uleshort	0x0406	1-2-3/Symphony worksheet, version 2
  821 # Symphony (.wr1)
  822 !:ext	wk1/wr1
  823 # no example for this japan version
  824 >>>4	uleshort	0x0600	1-2-3 WorKsheet, version 1.xJ
  825 !:ext	wj1
  826 # no example or documentation for wk2
  827 #>>>4	uleshort	0x????	1-2-3 WorKsheet, version 2
  828 #!:ext	wk2
  829 # undocumented japan version
  830 >>>4	uleshort	0x0602	1-2-3 worksheet, version 2.4J
  831 !:ext	wj3
  832 # (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data"
  833 >>>4	uleshort	0x8006	1-2-3 ForMaTting data, version 2.x
  834 # japan version 2.4J (fj3)
  835 !:ext	fmt/fj3
  836 # no example for this version
  837 >>>4	uleshort	0x8007	1-2-3 FoRMatting data, version 2.0
  838 !:ext	frm
  839 # (version 5.26) labeled the entry as "Lotus 1-2-3"
  840 >>>4	default		x	unknown worksheet or configuration
  841 !:ext	cnf
  842 >>>>4	uleshort	x	\b, revision 0x%x
  843 # 2nd record for most worksheets describes cells range
  844 >>>6		use	lotus-cells
  845 # 3nd record for most japan worksheets describes cells range
  846 >>>(8.s+10)	use	lotus-cells
  847 #	check and then display Lotus worksheet cells range
  848 0	name		lotus-cells
  849 # look for type (RANGE=0006h) + length (0008h) at record begin
  850 >0	ubelong	0x06000800	\b, cell range
  851 # cell range (start column, row, end column, row) start values normally 0,0~A1 cell
  852 >>4	ulong		!0
  853 >>>4	uleshort	x	\b%d,
  854 >>>6	uleshort	x	\b%d-
  855 # end of cell range
  856 >>8	uleshort	x	\b%d,
  857 >>10	uleshort	x	\b%d
  858 # EndOfLotus123
  859 0	string/b		WordPro\0	Lotus WordPro
  860 !:mime	application/vnd.lotus-wordpro
  861 0	string/b		WordPro\r\373	Lotus WordPro
  862 !:mime	application/vnd.lotus-wordpro
  863 
  864 
  865 # Summary: Script used by InstallScield to uninstall applications
  866 # Extension: .isu
  867 # Submitted by: unknown
  868 # Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
  869 0		string		\x71\xa8\x00\x00\x01\x02
  870 >12		string		Stirling\ Technologies,		InstallShield Uninstall Script
  871 
  872 # Winamp .avs
  873 #0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
  874 0	string/b	Nullsoft\ AVS\ Preset\ 	Winamp plug in
  875 
  876 # Windows Metafile .WMF
  877 0	string/b	\327\315\306\232	Windows metafile
  878 !:mime	image/wmf
  879 !:ext	wmf
  880 0	string/b	\002\000\011\000	Windows metafile
  881 !:mime	image/wmf
  882 !:ext	wmf
  883 0	string/b	\001\000\011\000	Windows metafile
  884 !:mime	image/wmf
  885 !:ext	wmf
  886 
  887 #tz3 files whatever that is (MS Works files)
  888 0	string/b	\003\001\001\004\070\001\000\000	tz3 ms-works file
  889 0	string/b	\003\002\001\004\070\001\000\000	tz3 ms-works file
  890 0	string/b	\003\003\001\004\070\001\000\000	tz3 ms-works file
  891 
  892 # PGP sig files .sig
  893 #0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
  894 0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
  895 0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
  896 0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
  897 0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
  898 0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
  899 0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
  900 
  901 # windows zips files .dmf
  902 0	string/b	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
  903 
  904 
  905 #ico files
  906 0	string/b	\102\101\050\000\000\000\056\000\000\000\000\000\000\000	Icon for MS Windows
  907 
  908 # Windows icons
  909 # Update: Joerg Jenderek
  910 # URL: https://en.wikipedia.org/wiki/CUR_(file_format)
  911 # Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG
  912 0   belong  0x00000100
  913 >9  byte    0
  914 >>0 byte    x
  915 >>0 use     cur-ico-dir
  916 >9  ubyte   0xff
  917 >>0 byte    x
  918 >>0 use     cur-ico-dir
  919 #	displays number of icons and information for icon or cursor
  920 0	name		cur-ico-dir
  921 # skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
  922 # 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
  923 >18		ulelong		&0x00000006
  924 # skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
  925 >>(18.l)	ulelong		x		MS Windows
  926 >>>0		ubelong		0x00000100	icon resource
  927 #!:mime		image/vnd.microsoft.icon
  928 !:mime		image/x-icon
  929 !:ext		ico
  930 >>>>4 		uleshort	x		- %d icon
  931 # plural s
  932 >>>>4 		uleshort	>1		\bs
  933 # 1st icon
  934 >>>>0x06	use		ico-entry
  935 # 2nd icon
  936 >>>>4 		uleshort	>1
  937 >>>>>0x16	use		ico-entry
  938 >>>0		ubelong		0x00000200	cursor resource
  939 #!:mime		image/x-cur
  940 !:mime		image/x-win-bitmap
  941 !:ext		cur
  942 >>>>4 		uleshort	x		- %d icon
  943 >>>>4 		uleshort	>1		\bs
  944 # 1st cursor
  945 >>>>0x06	use		cur-entry
  946 #>>>>0x16	use		cur-entry
  947 #	display information of one cursor entry
  948 0	name		cur-entry
  949 >0	use		cur-ico-entry
  950 >4	uleshort	x	\b, hotspot @%dx
  951 >6	uleshort	x	\b%d
  952 #	display information of one icon entry
  953 0	name		ico-entry
  954 >0			use	cur-ico-entry
  955 # normally 0 1 but also found 14
  956 >4	uleshort	>1	\b, %d planes
  957 # normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256
  958 >6	uleshort	>1	\b, %d bits/pixel
  959 #	display shared information of cursor or icon entry
  960 0		name		cur-ico-entry
  961 >0		byte		=0		\b, 256x
  962 >0		byte		!0		\b, %dx
  963 >1		byte        	=0		\b256
  964 >1		byte        	!0		\b%d
  965 # number of colors in palette
  966 >2		ubyte		!0		\b, %d colors
  967 # reserved 0 FFh
  968 #>3		ubyte        	x		\b, reserved %x
  969 #>8		ulelong		x		\b, image size %d
  970 # offset of PNG or DIB image
  971 #>12		ulelong		x		\b, offset 0x%x
  972 # PNG header (\x89PNG)
  973 >(12.l)		ubelong		=0x89504e47
  974 >>&-4		indirect	x	\b with
  975 # DIB image
  976 >(12.l)		ubelong		!0x89504e47
  977 #>>&-4		use     	dib-image
  978 
  979 # Windows non-animated cursors
  980 # Update: Joerg Jenderek
  981 # URL: https://en.wikipedia.org/wiki/CUR_(file_format)
  982 # Note: similar to Windows ICOn. container for BMP ( only DIB part)
  983 # GRR: line below is too general as it catches also Lotus 1-2-3 files
  984 0   belong  0x00000200
  985 >9  byte    0
  986 >>0 use     cur-ico-dir
  987 >9  ubyte   0xff
  988 >>0 use     cur-ico-dir
  989 
  990 # .chr files
  991 0	string/b	PK\010\010BGI	Borland font
  992 >4	string	>\0	%s
  993 # then there is a copyright notice
  994 
  995 
  996 # .bgi files
  997 0	string/b	pk\010\010BGI	Borland device
  998 >4	string	>\0	%s
  999 # then there is a copyright notice
 1000 
 1001 
 1002 # Windows Recycle Bin record file (named INFO2)
 1003 # By Abel Cheung (abelcheung AT gmail dot com)
 1004 # Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
 1005 # Since Vista uses another structure, INFO2 structure probably won't change
 1006 # anymore. Detailed analysis in:
 1007 # http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
 1008 0	lelong		0x00000004
 1009 >12	lelong		0x00000118	Windows Recycle Bin INFO2 file (Win98 or below)
 1010 
 1011 0	lelong		0x00000005
 1012 >12	lelong		0x00000320	Windows Recycle Bin INFO2 file (Win2k - WinXP)
 1013 
 1014 # From Doug Lee via a FreeBSD pr
 1015 9	string		GERBILDOC	First Choice document
 1016 9	string		GERBILDB	First Choice database
 1017 9	string		GERBILCLIP	First Choice database
 1018 0	string		GERBIL		First Choice device file
 1019 9	string		RABBITGRAPH	RabbitGraph file
 1020 0	string		DCU1		Borland Delphi .DCU file
 1021 0	string		=!<spell>	MKS Spell hash list (old format)
 1022 0	string		=!<spell2>	MKS Spell hash list
 1023 # Too simple - MPi
 1024 #0	string		AH		Halo(TM) bitmapped font file
 1025 0	lelong		0x08086b70	TurboC BGI file
 1026 0	lelong		0x08084b50	TurboC Font file
 1027 
 1028 # Debian#712046: The magic below identifies "Delphi compiled form data".
 1029 # An additional source of information is available at:
 1030 # http://www.woodmann.com/fravia/dafix_t1.htm
 1031 0	string		TPF0
 1032 >4	pstring		>\0		Delphi compiled form '%s'
 1033 
 1034 # tests for DBase files moved, updated and merged to database
 1035 
 1036 0	string		PMCC		Windows 3.x .GRP file
 1037 1	string		RDC-meg		MegaDots
 1038 >8	byte		>0x2F		version %c
 1039 >9	byte		>0x2F		\b.%c file
 1040 0	lelong		0x4C
 1041 >4	lelong		0x00021401	Windows shortcut file
 1042 
 1043 # .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm
 1044 # only for windows versions equal or greater 3.0
 1045 0x171	string	MICROSOFT\ PIFEX\0	Windows Program Information File
 1046 !:mime	application/x-dosexec
 1047 !:ext	pif
 1048 #>2	string	 	>\0		\b, Title:%.30s
 1049 >0x24	string		>\0		\b for %.63s
 1050 >0x65	string		>\0		\b, directory=%.64s
 1051 >0xA5	string		>\0		\b, parameters=%.64s
 1052 #>0x181	leshort	x	\b, offset %x
 1053 #>0x183	leshort	x	\b, offsetdata %x
 1054 #>0x185	leshort	x	\b, section length %x
 1055 >0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0
 1056 >>&0x5e		ubyte	>0
 1057 >>>&-1		string	<PIFMGR.DLL		\b, icon=%s
 1058 #>>>&-1		string	PIFMGR.DLL		\b, icon=%s
 1059 >>>&-1		string	>PIFMGR.DLL		\b, icon=%s
 1060 >>&0xF0		ubyte	>0
 1061 >>>&-1		string	<Terminal		\b, font=%.32s
 1062 #>>>&-1		string	=Terminal		\b, font=%.32s
 1063 >>>&-1		string	>Terminal		\b, font=%.32s
 1064 >>&0x110	ubyte	>0
 1065 >>>&-1		string	<Lucida\ Console	\b, TrueTypeFont=%.32s
 1066 #>>>&-1		string	=Lucida\ Console	\b, TrueTypeFont=%.32s
 1067 >>>&-1		string	>Lucida\ Console	\b, TrueTypeFont=%.32s
 1068 #>0x187	search/0xB55	WINDOWS\ 286\ 3.0\0	\b, Windows 3.X standard mode-style
 1069 #>0x187	search/0xB55	WINDOWS\ 386\ 3.0\0	\b, Windows 3.X enhanced mode-style
 1070 >0x187	search/0xB55	WINDOWS\ NT\ \ 3.1\0	\b, Windows NT-style
 1071 #>0x187	search/0xB55	WINDOWS\ NT\ \ 4.0\0	\b, Windows NT-style
 1072 >0x187	search/0xB55	CONFIG\ \ SYS\ 4.0\0	\b +CONFIG.SYS
 1073 #>>&06		string	x			\b:%s
 1074 >0x187	search/0xB55	AUTOEXECBAT\ 4.0\0	\b +AUTOEXEC.BAT
 1075 #>>&06		string	x			\b:%s
 1076 
 1077 # DOS EPS Binary File Header
 1078 # From: Ed Sznyter <ews@Black.Market.NET>
 1079 0	belong		0xC5D0D3C6	DOS EPS Binary File
 1080 !:mime	image/x-eps
 1081 >4	long		>0		Postscript starts at byte %d
 1082 >>8	long		>0		length %d
 1083 >>>12	long		>0		Metafile starts at byte %d
 1084 >>>>16	long		>0		length %d
 1085 >>>20	long		>0		TIFF starts at byte %d
 1086 >>>>24	long		>0		length %d
 1087 
 1088 # TNEF magic From "Joomy" <joomy@se-ed.net>
 1089 # Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
 1090 0	lelong		0x223e9f78	TNEF
 1091 !:mime	application/vnd.ms-tnef
 1092 
 1093 # Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
 1094 # of http://www.davep.org/norton-guides/ng2h-105.tgz
 1095 # http://en.wikipedia.org/wiki/Norton_Guides
 1096 0	string		NG\0\001
 1097 # only value 0x100 found at offset 2
 1098 >2	ulelong		0x00000100	Norton Guide
 1099 # Title[40]
 1100 >>8	string		>\0		"%-.40s"
 1101 #>>6	uleshort	x		\b, MenuCount=%u
 1102 # szCredits[5][66]
 1103 >>48	string		>\0		\b, %-.66s
 1104 >>114	string		>\0		%-.66s
 1105 
 1106 # 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
 1107 # of http://www.4dos.info/
 1108 # pointer,HelpID[8]=4DHnnnmm
 1109 0	ulelong	0x48443408		4DOS help file
 1110 >4	string	x			\b, version %-4.4s
 1111 
 1112 # old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
 1113 0	ulequad	0x3a000000024e4c	MS Advisor help file
 1114 
 1115 # HtmlHelp files (.chm)
 1116 0	string/b	ITSF\003\000\000\000\x60\000\000\000	MS Windows HtmlHelp Data
 1117 
 1118 # GFA-BASIC (Wolfram Kleff)
 1119 2	string/b	GFA-BASIC3	GFA-BASIC 3 data
 1120 
 1121 #------------------------------------------------------------------------------
 1122 # From Stuart Caie <kyzer@4u.net> (developer of cabextract)
 1123 # Update: Joerg Jenderek
 1124 # URL: https://en.wikipedia.org/wiki/Cabinet_(file_format)
 1125 # Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx
 1126 # Note: verified by `7z l *.cab`
 1127 # Microsoft Cabinet files
 1128 0	string/b	MSCF\0\0\0\0	Microsoft Cabinet archive data
 1129 #
 1130 # https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool
 1131 # CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE
 1132 # because some archive does not have *.diag* as 1st or 2nd archive member like
 1133 # O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab
 1134 # brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section
 1135 >0x2c	search/980/c	.diag		\b, Diagnostic
 1136 !:mime	application/vnd.ms-cab-compressed
 1137 !:ext	diagcab
 1138 # http://fileformats.archiveteam.org/wiki/PUZ
 1139 # Microsoft Publisher version about 2003 has a "Pack and Go" feature that
 1140 # bundles a Publisher document *PNG.pub with all links into a CAB
 1141 >0x2c	search/300/c	png.pub\0		\b, Publisher Packed and Go
 1142 !:mime	application/vnd.ms-cab-compressed
 1143 !:ext	puz
 1144 # ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation
 1145 >0x2c	search/17/c	ppview32.exe\0		\b, PowerPoint Viewer Packed and Go
 1146 !:mime	application/vnd.ms-powerpoint
 1147 #!:mime	application/mspowerpoint
 1148 !:ext	ppz
 1149 # http://www.incredimail.com/
 1150 # IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims
 1151 >0x2c	search/3369/c	content.ini\0	\b, IncrediMail
 1152 !:mime	application/x-incredimail
 1153 # member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf
 1154 >>0x2c	search/83/c	Flavor.htm\0	ecard
 1155 !:ext	imf
 1156 # member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims
 1157 >>0x2c	search/211/c	.swf\0		skin
 1158 !:ext	ims
 1159 # member anim.im3 implies IncrediMail animation like in letter_fold.ima 
 1160 >>0x2c	search/92/c	anim.im3\0	animation
 1161 !:ext	ima
 1162 # other IncrediMail cab archive
 1163 >>0x2c	default		x
 1164 >>>0x2c	search/116/c	thumb		ecard, image, notifier or skin
 1165 !:ext	imf/imi/imn/ims
 1166 # http://file-extension.net/seeker/file_extension_ime
 1167 >>>0x2c	default		x		emoticons or sound
 1168 !:ext	ime/imw
 1169 # no Diagnostic and IncrediMail
 1170 >0x2c	default		x
 1171 # look for 1st member name
 1172 >>(16.l+16)	ubyte	x
 1173 # https://en.wikipedia.org/wiki/SNP_file_format
 1174 >>>&-1	string/c 	_accrpt_.snp	\b, Access report snapshot
 1175 !:mime	application/msaccess
 1176 !:ext	snp
 1177 # https://www.cabextract.org.uk/wince_cab_format/
 1178 # extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer
 1179 >>>&7	string 		=.000		\b, WinCE install
 1180 !:mime	application/vnd.ms-cab-compressed
 1181 !:ext	cab
 1182 
 1183 # http://support.microsoft.com/kb/934307/en-US
 1184 # All inspected MSU contain a file with name WSUSSCAN.cab
 1185 # that is called "Windows Update meta data" by Microsoft
 1186 >>>&-1	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
 1187 !:mime	application/vnd.ms-cab-compressed
 1188 !:ext	msu
 1189 >>>&-1	default		x
 1190 # look at point charcter of 1st archive member name for file name extension
 1191 >>>>&-1	search/255 	.
 1192 # http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm
 1193 # PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002
 1194 # packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB
 1195 >>>>>&0	string/c	ppt\0		\b, PowerPoint Packed and Go
 1196 !:mime	application/vnd.ms-powerpoint
 1197 #!:mime	application/mspowerpoint
 1198 !:ext	ppz
 1199 # https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx
 1200 # first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack
 1201 # or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack
 1202 >>>>>&0	string/c	theme		\b, Windows
 1203 !:mime	application/x-windows-themepack
 1204 # http://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8
 1205 # 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack
 1206 # with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme
 1207 >>>>>>(16.l+16)	string	=Panoram	8
 1208 !:ext	deskthemepack
 1209 >>>>>>(16.l+16)	string	!Panoram	7 or 8
 1210 !:ext	themepack/deskthemepack
 1211 >>>>>>(16.l+16)	ubyte	x		Theme Pack
 1212 >>>>>&0	default		x
 1213 # look for null terminator of 1st member name
 1214 >>>>>>&0	search/255 	\0
 1215 # 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu
 1216 >>>>>>>&16	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
 1217 !:mime	application/vnd.ms-cab-compressed
 1218 !:ext	msu
 1219 >>>>>>>&16	default	x
 1220 # archive with more then one file need some output in version 5.32 to avoid error message like
 1221 # Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type
 1222 # Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type
 1223 # file: could not find any valid magic files!
 1224 >>>>>>>>28	uleshort	>1	\b, many
 1225 !:mime	application/vnd.ms-cab-compressed
 1226 !:ext	cab
 1227 # remaining archives with just one file
 1228 >>>>>>>>28	uleshort	=1
 1229 # neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386
 1230 >>>>>>>>>30	uleshort	=0x0000	\b, Windows 2000/XP setup
 1231 # cut of last char of source extension and add underscore to generate extension
 1232 # TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_
 1233 !:mime	application/vnd.ms-cab-compressed
 1234 !:ext	_/?_/??_
 1235 # archive need some output like "single" in version 5.32 to avoid error messages
 1236 >>>>>>>>>30	uleshort	!0x0000	\b, single
 1237 !:mime	application/vnd.ms-cab-compressed
 1238 !:ext	cab
 1239 # TODO: additional extensions like
 1240 # .xsn	InfoPath Dynamic Form
 1241 # .xtp	InfoPath Template Part
 1242 # .lvf	Logitech Video Effects Face Accessory
 1243 >8	ulelong		x		\b, %u bytes
 1244 >28	uleshort		1		\b, 1 file
 1245 >28	uleshort		>1		\b, %u files
 1246 # Reserved fields, set to zero
 1247 #>4	belong		!0		\b, reserved1 %x
 1248 #>12	belong		!0		\b, reserved2 %x
 1249 # offset of the first CFFILE entry coffFiles: minimal 2Ch
 1250 >16	ulelong		x		\b, at 0x%x
 1251 >(16.l)	use		cab-file
 1252 # at least also 2nd member
 1253 >28	uleshort		>1
 1254 >>(16.l+16)	ubyte	x
 1255 >>>&0	search/255 	\0
 1256 # second member info
 1257 >>>>&0	use		cab-file
 1258 #>20	belong		!0		\b, reserved %x
 1259 # Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3
 1260 >24	ubeshort	!0x0301		\b version 0x%x
 1261 # number of CFFOLDER entries
 1262 >26	uleshort	>1		\b, %u cffolders
 1263 # cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields
 1264 # only found for flags 0 1 2 3 4 not 7
 1265 >30	uleshort	>0		\b, flags 0x%x
 1266 # Cabinet files have a 16-bit cabinet setID field that is designed for application use.
 1267 # default is zero, however, the -i option of cabarc can be used to set this field
 1268 >32	uleshort	>0		\b, ID %u
 1269 # iCabinet is number of this cabinet file in a set, where 0 for the first cabinet
 1270 #>34	uleshort	x		\b, iCabinet %u
 1271 # add one for display because humans start numbering by 1 and also fit to name of disk szDisk*
 1272 >34	uleshort+1	x		\b, number %u
 1273 >30	uleshort	&0x0004		\b, extra bytes
 1274 # cbCFHeader optional size of per-cabinet reserved area 14h 1800h
 1275 >>36	uleshort	>0		%u in head
 1276 # cbCFFolder is optional size of per-folder reserved area
 1277 >>38	ubyte		>0		%u in folder
 1278 # cbCFData is optional size of per-datablock reserved area
 1279 >>39	ubyte		>0		%u in data block
 1280 # optional per-cabinet reserved area abReserve[cbCFHeader]
 1281 >>36	uleshort	>0
 1282 # 1st CFFOLDER after reserved area in header
 1283 >>>(36.s+40)	use			cab-folder
 1284 # no reserved area in header
 1285 >30	uleshort	^0x0004
 1286 # no previous and next cab archive
 1287 >>30	uleshort		=0x0000
 1288 >>>36	use				cab-folder
 1289 # only previous cab archive
 1290 >>30	uleshort		=0x0001	\b, previous
 1291 >>>36	use				cab-anchor
 1292 # only next cab archive
 1293 >>30	uleshort		=0x0002	\b, next
 1294 >>>36	use				cab-anchor
 1295 # previous+next cab archive
 1296 # can not use sub routine cab-anchor to display previous and next cabinet together
 1297 #>>>36	use				cab-anchor
 1298 #>>>>&0	use				cab-anchor
 1299 >>30	uleshort		=0x0003	\b, previous
 1300 >>>36	string		x		%s
 1301 # optional name of previous disk szDisk*
 1302 >>>>&1	string		x		disk %s
 1303 >>>>>&1	string		x		\b, next %s
 1304 # optional name of previous disk szDisk*
 1305 >>>>>>&1	string		x	disk %s
 1306 >>>>>>>&1	use			cab-folder
 1307 #	display filename and disk name of previous or next cabinet
 1308 0       name    			cab-anchor
 1309 # optional name of previous/next cabinet file szCabinet*[255]
 1310 >&0	string		x		%s
 1311 # optional name of previous/next disk szDisk*[255]
 1312 >>&1	string		x		disk %s
 1313 #	display folder structure CFFOLDER information like compression of cabinet
 1314 0       name    			cab-folder
 1315 # offset of the CFDATA block in this folder
 1316 #>0	ulelong		x		\b, coffCabStart 0x%x
 1317 # number of CFDATA blocks in folder
 1318 >4	uleshort	x		\b, %u datablock
 1319 # plural s
 1320 >4	uleshort	>1		\bs
 1321 # compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15
 1322 >6	uleshort	x		\b, 0x%x compression
 1323 # optional per-folder reserved area
 1324 #>8	ubequad		x		\b, abReserve 0x%llx
 1325 #	display member structure CFFILE information like member name of cabinet
 1326 0       name    			cab-file
 1327 # cbFile is uncompressed size of file in bytes 
 1328 #>0	ulelong		x		\b, cbFile %u
 1329 # uoffFolderStart is uncompressed offset of file in folder
 1330 #>4	ulelong		>0		\b, uoffFolderStart 0x%x
 1331 # iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet
 1332 # define ifoldCONTINUED_FROM_PREV      (0xFFFD)
 1333 # define ifoldCONTINUED_TO_NEXT        (0xFFFE)
 1334 # define ifoldCONTINUED_PREV_AND_NEXT  (0xFFFF)
 1335 >8	uleshort	>0		\b, iFolder 0x%x
 1336 # date stamp for file
 1337 #>10	uleshort	x		\b, date 0x%x
 1338 # time stamp for file
 1339 #>12	uleshort	x		\b, time 0x%x
 1340 # attribs is attribute flags for file
 1341 # define  _A_RDONLY       (0x01)  file is read-only
 1342 # define  _A_HIDDEN       (0x02)  file is hidden
 1343 # define  _A_SYSTEM       (0x04)  file is a system file
 1344 # define  _A_ARCH         (0x20)  file modified since last backup
 1345 # example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab
 1346 # define  _A_EXEC         (0x40)  run after extraction
 1347 # define  _A_NAME_IS_UTF  (0x80)  szName[] contains UTF
 1348 # define  UNKNOWN       (0x0100)  undocumented or accident
 1349 #>14	uleshort	x		\b, attribs 0x%x
 1350 >14	uleshort	>0		+
 1351 >>14	uleshort	&0x0001		\bR
 1352 >>14	uleshort	&0x0002		\bH
 1353 >>14	uleshort	&0x0004		\bS
 1354 >>14	uleshort	&0x0020		\bA
 1355 >>14	uleshort	&0x0040		\bX
 1356 >>14	uleshort	&0x0080		\bUtf
 1357 # unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB
 1358 >>14	uleshort	&0x0100		\b?
 1359 # szName is name of archive member
 1360 >16	string		x		"%s"
 1361 # next archive member name if more files
 1362 #>>&17	string		>\0		\b, NEXT NAME %-.50s
 1363 
 1364 # InstallShield Cabinet files
 1365 0	string/b	ISc(		InstallShield Cabinet archive data
 1366 >5	byte&0xf0	=0x60		version 6,
 1367 >5	byte&0xf0	!0x60		version 4/5,
 1368 >(12.l+40)	lelong	x		%u files
 1369 
 1370 # Windows CE package files
 1371 0	string/b	MSCE\0\0\0\0	Microsoft WinCE install header
 1372 >20	lelong		0		\b, architecture-independent
 1373 >20	lelong		103		\b, Hitachi SH3
 1374 >20	lelong		104		\b, Hitachi SH4
 1375 >20	lelong		0xA11		\b, StrongARM
 1376 >20	lelong		4000		\b, MIPS R4000
 1377 >20	lelong		10003		\b, Hitachi SH3
 1378 >20	lelong		10004		\b, Hitachi SH3E
 1379 >20	lelong		10005		\b, Hitachi SH4
 1380 >20	lelong		70001		\b, ARM 7TDMI
 1381 >52	leshort		1		\b, 1 file
 1382 >52	leshort		>1		\b, %u files
 1383 >56	leshort		1		\b, 1 registry entry
 1384 >56	leshort		>1		\b, %u registry entries
 1385 
 1386 
 1387 # Windows Enhanced Metafile (EMF)
 1388 # See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
 1389 # for further information.
 1390 0	ulelong 1
 1391 >40	string	\ EMF		Windows Enhanced Metafile (EMF) image data
 1392 >>44	ulelong x		version 0x%x
 1393 
 1394 
 1395 0	string/b	\224\246\056		Microsoft Word Document
 1396 !:mime	application/msword
 1397 
 1398 512	string	R\0o\0o\0t\0\ \0E\0n\0t\0r\0y	Microsoft Word Document
 1399 !:mime	application/msword
 1400 
 1401 # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
 1402 # Magic type for Dell's BIOS .hdr files
 1403 # Dell's .hdr
 1404 0	string/b $RBU
 1405 >23	string Dell			%s system BIOS
 1406 >5	byte   2
 1407 >>48	byte   x			version %d.
 1408 >>49	byte   x			\b%d.
 1409 >>50	byte   x			\b%d
 1410 >5	byte   <2
 1411 >>48	string x			version %.3s
 1412 
 1413 # Type: Microsoft Document Imaging Format (.mdi)
 1414 # URL:	http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
 1415 # From: Daniele Sempione <scrows@oziosi.org>
 1416 # Too weak (EP)
 1417 #0	short	0x5045			Microsoft Document Imaging Format
 1418 
 1419 # MS eBook format (.lit)
 1420 0	string/b	ITOLITLS		Microsoft Reader eBook Data
 1421 >8	lelong	x			\b, version %u
 1422 !:mime					application/x-ms-reader
 1423 
 1424 # Windows CE Binary Image Data Format
 1425 # From: Dr. Jesus <j@hug.gs>
 1426 0	string/b	B000FF\n	Windows Embedded CE binary image
 1427 
 1428 # Windows Imaging (WIM) Image
 1429 0	string/b	MSWIM\000\000\000	Windows imaging (WIM) image
 1430 0	string/b	WLPWM\000\000\000	Windows imaging (WIM) image, wimlib pipable format
 1431 
 1432 # The second byte of these signatures is a file version; I don't know what,
 1433 # if anything, produced files with version numbers 0-2.
 1434 # From: John Elliott <johne@seasip.demon.co.uk>
 1435 0	string	\xfc\x03\x00	Mallard BASIC program data (v1.11)
 1436 0	string	\xfc\x04\x00	Mallard BASIC program data (v1.29+)
 1437 0	string	\xfc\x03\x01	Mallard BASIC protected program data (v1.11)
 1438 0	string	\xfc\x04\x01	Mallard BASIC protected program data (v1.29+)
 1439 
 1440 0	string	MIOPEN		Mallard BASIC Jetsam data
 1441 0	string	Jetsam0		Mallard BASIC Jetsam index data
 1442 
 1443 # DOS backup 2.0 to 3.2
 1444 
 1445 # backupid.@@@
 1446 
 1447 # plausibility check for date
 1448 0x3	ushort	>1979
 1449 >0x5	ubyte-1 <31
 1450 >>0x6	ubyte-1 <12
 1451 # actually 121 nul bytes
 1452 >>>0x7	string	\0\0\0\0\0\0\0\0
 1453 >>>>0x1 ubyte	x	DOS 2.0 backup id file, sequence %d
 1454 !:ext @@@
 1455 >>>>0x0 ubyte	0xff	\b, last disk
 1456 
 1457 # backed up file
 1458 
 1459 # skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
 1460 # by looking for trailing nul of maximal file name string
 1461 0x52	ubyte	0	
 1462 # test for flag byte: FFh~complete file, 00h~split file
 1463 # FFh -127 =	-1 -127 =	-128
 1464 # 00h -127 =	 0 -127 =	-127
 1465 >0	byte-127	<-126
 1466 # plausibility check for file name length
 1467 >>0x53	ubyte-1	<78	
 1468 # looking for terminating nul of file name string
 1469 >>>(0x53.b+4)	ubyte	0	
 1470 # looking if last char of string is valid DOS file name
 1471 >>>>(0x53.b+3)	ubyte	>0x1F	
 1472 # actually 44 nul bytes
 1473 # but sometimes garbage according to Ralf Quint. So can not be used as test
 1474 #>0x54	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
 1475 # first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
 1476 # only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 
 1477 >>>>>5	ubyte&0x8C	0x0C	
 1478 # ./msdos (version 5.30) labeled the entry as
 1479 # "DOS 2.0 backed up file %s, split file, sequence %d" or
 1480 # "DOS 2.0 backed up file %s, complete file"
 1481 >>>>>>0	ubyte	x	DOS 2.0-3.2 backed up
 1482 #>>>>>>0	ubyte	0xff	complete
 1483 >>>>>>0	ubyte	0
 1484 >>>>>>>1 uleshort	x	sequence %d of
 1485 # full file name with path but without drive letter and colon stored from 0x05 til 0x52
 1486 >>>>>>0x5	string	x	file %s
 1487 # backup name is original filename
 1488 #!:ext	*
 1489 # magic/Magdir/msdos, 1169: Warning: EXTENSION type `     *' has bad char '*'
 1490 # file: line 1169: Bad magic entry '  *'
 1491 # after header original file content
 1492 >>>>>>128	indirect x	\b; 
 1493 
 1494 
 1495 # DOS backup 3.3 to 5.x
 1496 
 1497 # CONTROL.nnn files
 1498 0	string	\x8bBACKUP\x20
 1499 # actually 128 nul bytes
 1500 >0xa	string	\0\0\0\0\0\0\0\0
 1501 >>0x9	ubyte	x	DOS 3.3 backup control file, sequence %d
 1502 >>0x8a	ubyte	0xff	\b, last disk
 1503 
 1504 # NB: The BACKUP.nnn files consist of the files backed up,
 1505 # concatenated.