head	1.4;
access;
symbols
	RELENG_8_4:1.4.0.2
	RELENG_9_1_0_RELEASE:1.3.10.1
	RELENG_9_1:1.3.10.1.0.2
	RELENG_9_1_BP:1.3.10.1
	RELENG_8_3_0_RELEASE:1.3
	RELENG_8_3:1.3.0.14
	RELENG_8_3_BP:1.3
	RELENG_9_0_0_RELEASE:1.3
	RELENG_9_0:1.3.0.12
	RELENG_9_0_BP:1.3
	RELENG_9:1.3.0.10
	RELENG_9_BP:1.3
	RELENG_7_4_0_RELEASE:1.1.1.6.2.1
	RELENG_8_2_0_RELEASE:1.3
	RELENG_7_4:1.1.1.6.2.1.0.8
	RELENG_7_4_BP:1.1.1.6.2.1
	RELENG_8_2:1.3.0.8
	RELENG_8_2_BP:1.3
	RELENG_8_1_0_RELEASE:1.3
	RELENG_8_1:1.3.0.6
	RELENG_8_1_BP:1.3
	RELENG_7_3_0_RELEASE:1.1.1.6.2.1
	RELENG_7_3:1.1.1.6.2.1.0.6
	RELENG_7_3_BP:1.1.1.6.2.1
	RELENG_8_0_0_RELEASE:1.3
	RELENG_8_0:1.3.0.4
	RELENG_8_0_BP:1.3
	RELENG_8:1.3.0.2
	RELENG_8_BP:1.3
	RELENG_7_2_0_RELEASE:1.1.1.6.2.1
	RELENG_7_2:1.1.1.6.2.1.0.4
	RELENG_7_2_BP:1.1.1.6.2.1
	RELENG_7_1_0_RELEASE:1.1.1.6.2.1
	RELENG_6_4_0_RELEASE:1.1.1.5.8.2
	RELENG_7_1:1.1.1.6.2.1.0.2
	RELENG_7_1_BP:1.1.1.6.2.1
	RELENG_6_4:1.1.1.5.8.2.0.2
	RELENG_6_4_BP:1.1.1.5.8.2
	RELENG_7_0_0_RELEASE:1.1.1.6.4.1
	file_4_23__r1_46:1.1.1.7
	RELENG_6_3_0_RELEASE:1.1.1.5
	file_4_23:1.1.1.7
	RELENG_7_0:1.1.1.6.0.4
	RELENG_7_0_BP:1.1.1.6
	RELENG_6_3:1.1.1.5.0.18
	RELENG_6_3_BP:1.1.1.5
	RELENG_7:1.1.1.6.0.2
	RELENG_7_BP:1.1.1.6
	file_4_21:1.1.1.6
	file_4_19:1.1.1.6
	RELENG_6_2_0_RELEASE:1.1.1.5
	RELENG_6_2:1.1.1.5.0.16
	RELENG_6_2_BP:1.1.1.5
	file_4_17_A:1.1
	file_4_17:1.1.1.6
	RELENG_5_5_0_RELEASE:1.1.1.5
	RELENG_5_5:1.1.1.5.0.14
	RELENG_5_5_BP:1.1.1.5
	RELENG_6_1_0_RELEASE:1.1.1.5
	RELENG_6_1:1.1.1.5.0.12
	RELENG_6_1_BP:1.1.1.5
	RELENG_6_0_0_RELEASE:1.1.1.5
	RELENG_6_0:1.1.1.5.0.10
	RELENG_6_0_BP:1.1.1.5
	RELENG_6:1.1.1.5.0.8
	RELENG_6_BP:1.1.1.5
	RELENG_5_4_0_RELEASE:1.1.1.5
	RELENG_5_4:1.1.1.5.0.6
	RELENG_5_4_BP:1.1.1.5
	RELENG_4_11_0_RELEASE:1.1.1.2.2.3
	file_4_12:1.1.1.5
	RELENG_4_11:1.1.1.2.2.3.0.8
	RELENG_4_11_BP:1.1.1.2.2.3
	RELENG_5_3_0_RELEASE:1.1.1.5
	RELENG_5_3:1.1.1.5.0.4
	RELENG_5_3_BP:1.1.1.5
	RELENG_5:1.1.1.5.0.2
	RELENG_5_BP:1.1.1.5
	file_4_10:1.1.1.5
	RELENG_4_10_0_RELEASE:1.1.1.2.2.3
	RELENG_4_10:1.1.1.2.2.3.0.6
	RELENG_4_10_BP:1.1.1.2.2.3
	RELENG_5_2_1_RELEASE:1.1.1.4
	RELENG_5_2_0_RELEASE:1.1.1.4
	RELENG_5_2:1.1.1.4.0.4
	RELENG_5_2_BP:1.1.1.4
	RELENG_4_9_0_RELEASE:1.1.1.2.2.3
	RELENG_4_9:1.1.1.2.2.3.0.4
	RELENG_4_9_BP:1.1.1.2.2.3
	RELENG_5_1_0_RELEASE:1.1.1.4
	RELENG_5_1:1.1.1.4.0.2
	RELENG_5_1_BP:1.1.1.4
	RELENG_4_8_0_RELEASE:1.1.1.2.2.3
	RELENG_4_8:1.1.1.2.2.3.0.2
	RELENG_4_8_BP:1.1.1.2.2.3
	file_3_41:1.1.1.4
	file_3_40:1.1.1.3
	RELENG_5_0_0_RELEASE:1.1.1.3
	RELENG_5_0:1.1.1.3.0.2
	RELENG_5_0_BP:1.1.1.3
	RELENG_4_7_0_RELEASE:1.1.1.2.2.2
	RELENG_4_7:1.1.1.2.2.2.0.8
	RELENG_4_7_BP:1.1.1.2.2.2
	file_3_39:1.1.1.3
	RELENG_4_6_2_RELEASE:1.1.1.2.2.2
	RELENG_4_6_1_RELEASE:1.1.1.2.2.2
	RELENG_4_6_0_RELEASE:1.1.1.2.2.2
	RELENG_4_6:1.1.1.2.2.2.0.6
	RELENG_4_6_BP:1.1.1.2.2.2
	RELENG_4_5_0_RELEASE:1.1.1.2.2.2
	RELENG_4_5:1.1.1.2.2.2.0.4
	RELENG_4_5_BP:1.1.1.2.2.2
	file_3_37:1.1.1.3
	RELENG_4_4_0_RELEASE:1.1.1.2.2.2
	RELENG_4_4:1.1.1.2.2.2.0.2
	RELENG_4_4_BP:1.1.1.2.2.2
	file_3_36:1.1.1.3
	file_3_35:1.1.1.2
	RELENG_4_3_0_RELEASE:1.1.1.2.2.1
	RELENG_4_3:1.1.1.2.2.1.0.2
	RELENG_4_3_BP:1.1.1.2.2.1
	file_3_34:1.1.1.2
	RELENG_4:1.1.1.2.0.2
	file_3_33:1.1.1.2
	file_3_32:1.1.1.1
	ZOULAS:1.1.1;
locks; strict;
comment	@# @;


1.4
date	2012.04.19.03.20.13;	author obrien;	state Exp;
branches
	1.4.2.1;
next	1.3;

1.3
date	2009.05.04.00.37.44;	author obrien;	state Exp;
branches
	1.3.10.1;
next	1.2;

1.2
date	2009.01.02.03.10.55;	author obrien;	state Exp;
branches;
next	1.1;

1.1
date	2000.11.05.08.33.54;	author obrien;	state Exp;
branches
	1.1.1.1;
next	;

1.4.2.1
date	2012.04.19.03.20.13;	author svnexp;	state dead;
branches;
next	1.4.2.2;

1.4.2.2
date	2013.03.28.13.00.45;	author svnexp;	state Exp;
branches;
next	;

1.3.10.1
date	2012.07.02.08.48.58;	author obrien;	state Exp;
branches;
next	;

1.1.1.1
date	2000.11.05.08.33.54;	author obrien;	state Exp;
branches;
next	1.1.1.2;

1.1.1.2
date	2000.11.26.21.26.19;	author obrien;	state Exp;
branches
	1.1.1.2.2.1;
next	1.1.1.3;

1.1.1.3
date	2001.07.30.03.09.45;	author obrien;	state Exp;
branches;
next	1.1.1.4;

1.1.1.4
date	2003.02.28.05.19.35;	author obrien;	state Exp;
branches;
next	1.1.1.5;

1.1.1.5
date	2004.08.09.08.45.41;	author obrien;	state Exp;
branches
	1.1.1.5.8.1;
next	1.1.1.6;

1.1.1.6
date	2006.06.19.07.52.15;	author obrien;	state Exp;
branches
	1.1.1.6.2.1
	1.1.1.6.4.1;
next	1.1.1.7;

1.1.1.7
date	2008.01.13.20.35.15;	author obrien;	state Exp;
branches;
next	;

1.1.1.2.2.1
date	2000.11.26.21.37.24;	author obrien;	state Exp;
branches;
next	1.1.1.2.2.2;

1.1.1.2.2.2
date	2001.08.02.22.51.38;	author obrien;	state Exp;
branches;
next	1.1.1.2.2.3;

1.1.1.2.2.3
date	2003.03.16.04.44.56;	author obrien;	state Exp;
branches;
next	;

1.1.1.5.8.1
date	2008.01.24.15.47.31;	author rafan;	state Exp;
branches;
next	1.1.1.5.8.2;

1.1.1.5.8.2
date	2008.01.29.10.36.39;	author rafan;	state Exp;
branches;
next	;

1.1.1.6.2.1
date	2008.01.30.02.53.11;	author obrien;	state Exp;
branches;
next	;

1.1.1.6.4.1
date	2008.02.06.18.26.37;	author obrien;	state Exp;
branches;
next	;


desc
@@


1.4
log
@SVN rev 234449 on 2012-04-19 03:20:13Z by obrien

Update file(1) to version 5.11.
@
text
@
#------------------------------------------------------------------------------
# $File: macintosh,v 1.22 2011/05/17 17:40:31 rrt Exp $
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
# Daniel Quinlan, quinlan@@yggdrasil.com
11	string	must\ be\ converted\ with\ BinHex	BinHex binary text
!:mime	application/mac-binhex40
>41	string	x					\b, version %.3s

# Stuffit archives are the de facto standard of compression for Macintosh
# files obtained from most archives. (franklsm@@tuns.ca)
0	string		SIT!			StuffIt Archive (data)
!:mime	application/x-stuffit
!:apple	SIT!SIT!
>2	string		x			: %s
0	string		SITD			StuffIt Deluxe (data)
>2	string		x			: %s
0	string		Seg			StuffIt Deluxe Segment (data)
>2	string		x			: %s

# Newer StuffIt archives (grant@@netbsd.org)
0	string		StuffIt			StuffIt Archive
!:mime	application/x-stuffit
!:apple	SIT!SIT!
#>162	string		>0			: %s

# Macintosh Applications and Installation binaries (franklsm@@tuns.ca)
# GRR: Too weak
#0	string		APPL			Macintosh Application (data)
#>2	string		x			\b: %s

# Macintosh System files (franklsm@@tuns.ca)
# GRR: Too weak
#0	string		zsys			Macintosh System File (data)
#0	string		FNDR			Macintosh Finder (data)
#0	string		libr			Macintosh Library (data)
#>2	string		x			: %s
#0	string		shlb			Macintosh Shared Library (data)
#>2	string		x			: %s
#0	string		cdev			Macintosh Control Panel (data)
#>2	string		x			: %s
#0	string		INIT			Macintosh Extension (data)
#>2	string		x			: %s
#0	string		FFIL			Macintosh Truetype Font (data)
#>2	string		x			: %s
#0	string		LWFN			Macintosh Postscript Font (data)
#>2	string		x			: %s

# Additional Macintosh Files (franklsm@@tuns.ca)
# GRR: Too weak
#0	string		PACT			Macintosh Compact Pro Archive (data)
#>2	string		x			: %s
#0	string		ttro			Macintosh TeachText File (data)
#>2	string		x			: %s
#0	string		TEXT			Macintosh TeachText File (data)
#>2	string		x			: %s
#0	string		PDF			Macintosh PDF File (data)
#>2	string		x			: %s

# MacBinary format (Eric Fischer, enf@@pobox.com)
#
# Unfortunately MacBinary doesn't really have a magic number prior
# to the MacBinary III format.  The checksum is really the way to
# do it, but the magic file format isn't up to the challenge.
#
# 0	byte		0
# 1	byte				# filename length
# 2	string				# filename
# 65    string				# file type
# 69	string				# file creator
# 73	byte				# Finder flags
# 74	byte		0
# 75	beshort				# vertical posn in window
# 77	beshort				# horiz posn in window
# 79	beshort				# window or folder ID
# 81    byte				# protected?
# 82	byte		0
# 83	belong				# length of data segment
# 87	belong				# length of resource segment
# 91	belong				# file creation date
# 95	belong				# file modification date
# 99	beshort				# length of comment after resource
# 101	byte				# new Finder flags
# 102	string		mBIN		# (only in MacBinary III)
# 106	byte				# char. code of file name
# 107	byte				# still more Finder flags
# 116	belong				# total file length
# 120	beshort				# length of add'l header
# 122	byte		129		# for MacBinary II
# 122	byte		130		# for MacBinary III
# 123	byte		129		# minimum version that can read fmt
# 124	beshort				# checksum
#
# This attempts to use the version numbers as a magic number, requiring
# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
# be 0x81.  This works for the files I have, but maybe not for everyone's.

# Unfortunately, this magic is quite weak - MPi
#122	beshort&0xFCFF	0x8081		Macintosh MacBinary data

# MacBinary I doesn't have the version number field at all, but MacBinary II
# has been in use since 1987 so I hope there aren't many really old files
# floating around that this will miss.  The original spec calls for using
# the nulls in 0, 74, and 82 as the magic number.
#
# Another possibility, that would also work for MacBinary I, is to use
# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
# and that 74 will be 0.  So something like
# 
# 71 	belong&0x80804EFF 0x00000000 	Macintosh MacBinary data
# 
# >73	byte&0x01	0x01		\b, inited
# >73	byte&0x02	0x02		\b, changed
# >73	byte&0x04	0x04		\b, busy
# >73	byte&0x08	0x08		\b, bozo
# >73	byte&0x10	0x10		\b, system
# >73	byte&0x10	0x20		\b, bundle
# >73	byte&0x10	0x40		\b, invisible
# >73	byte&0x10	0x80		\b, locked

#>65	string		x		\b, type "%4.4s"

#>65	string		8BIM		(PhotoShop)
#>65	string		ALB3		(PageMaker 3)
#>65	string		ALB4		(PageMaker 4)
#>65	string		ALT3		(PageMaker 3)
#>65	string		APPL		(application)
#>65	string		AWWP		(AppleWorks word processor)
#>65	string		CIRC		(simulated circuit)
#>65	string		DRWG		(MacDraw)
#>65	string		EPSF		(Encapsulated PostScript)
#>65	string		FFIL		(font suitcase)
#>65	string		FKEY		(function key)
#>65	string		FNDR		(Macintosh Finder)
#>65	string		GIFf		(GIF image)
#>65	string		Gzip		(GNU gzip)
#>65	string		INIT		(system extension)
#>65	string		LIB\ 		(library)
#>65	string		LWFN		(PostScript font)
#>65	string		MSBC		(Microsoft BASIC)
#>65	string		PACT		(Compact Pro archive)
#>65	string		PDF\ 		(Portable Document Format)
#>65	string		PICT		(picture)
#>65	string		PNTG		(MacPaint picture)
#>65	string		PREF		(preferences)
#>65	string		PROJ		(Think C project)
#>65	string		QPRJ		(Think Pascal project)
#>65	string		SCFL		(Defender scores)
#>65	string		SCRN		(startup screen)
#>65	string		SITD		(StuffIt Deluxe)
#>65	string		SPn3		(SuperPaint)
#>65	string		STAK		(HyperCard stack)
#>65	string		Seg\ 		(StuffIt segment)
#>65	string		TARF		(Unix tar archive)
#>65	string		TEXT		(ASCII)
#>65	string		TIFF		(TIFF image)
#>65	string		TOVF		(Eudora table of contents)
#>65	string		WDBN		(Microsoft Word word processor)
#>65	string		WORD		(MacWrite word processor)
#>65	string		XLS\ 		(Microsoft Excel)
#>65	string		ZIVM		(compress (.Z))
#>65	string		ZSYS		(Pre-System 7 system file)
#>65	string		acf3		(Aldus FreeHand)
#>65	string		cdev		(control panel)
#>65	string		dfil		(Desk Acessory suitcase)
#>65	string		libr		(library)
#>65	string		nX^d		(WriteNow word processor)
#>65	string		nX^w		(WriteNow dictionary)
#>65	string		rsrc		(resource)
#>65	string		scbk		(Scrapbook)
#>65	string		shlb		(shared library)
#>65	string		ttro		(SimpleText read-only)
#>65	string		zsys		(system file)

#>69	string		x		\b, creator "%4.4s"

# Somewhere, Apple has a repository of registered Creator IDs.  These are
# just the ones that I happened to have files from and was able to identify.

#>69	string		8BIM		(Adobe Photoshop)
#>69	string		ALD3		(PageMaker 3)
#>69	string		ALD4		(PageMaker 4)
#>69	string		ALFA		(Alpha editor)
#>69	string		APLS		(Apple Scanner)
#>69	string		APSC		(Apple Scanner)
#>69	string		BRKL		(Brickles)
#>69	string		BTFT		(BitFont)
#>69	string		CCL2 		(Common Lisp 2)
#>69	string		CCL\ 		(Common Lisp)
#>69	string		CDmo		(The Talking Moose)
#>69	string		CPCT		(Compact Pro)
#>69	string		CSOm		(Eudora)
#>69	string		DMOV		(Font/DA Mover)
#>69	string		DSIM		(DigSim)
#>69	string		EDIT		(Macintosh Edit)
#>69	string		ERIK		(Macintosh Finder)
#>69	string		EXTR		(self-extracting archive)
#>69	string		Gzip		(GNU gzip)
#>69	string		KAHL		(Think C)
#>69	string		LWFU		(LaserWriter Utility)
#>69	string		LZIV		(compress)
#>69	string		MACA		(MacWrite)
#>69	string		MACS		(Macintosh operating system)
#>69	string		MAcK		(MacKnowledge terminal emulator)
#>69	string		MLND		(Defender)
#>69	string		MPNT		(MacPaint)
#>69	string		MSBB		(Microsoft BASIC (binary))
#>69	string		MSWD		(Microsoft Word)
#>69	string		NCSA		(NCSA Telnet)
#>69	string		PJMM		(Think Pascal)
#>69	string		PSAL		(Hunt the Wumpus)
#>69	string		PSI2		(Apple File Exchange)
#>69	string		R*ch		(BBEdit)
#>69	string		RMKR		(Resource Maker)
#>69	string		RSED		(Resource Editor)
#>69	string		Rich		(BBEdit)
#>69	string		SIT!		(StuffIt)
#>69	string		SPNT		(SuperPaint)
#>69	string		Unix		(NeXT Mac filesystem)
#>69	string		VIM!		(Vim editor)
#>69	string		WILD		(HyperCard)
#>69	string		XCEL		(Microsoft Excel)
#>69	string		aCa2		(Fontographer)
#>69	string		aca3		(Aldus FreeHand)
#>69	string		dosa		(Macintosh MS-DOS file system)
#>69	string		movr		(Font/DA Mover)
#>69	string		nX^n		(WriteNow)
#>69	string		pdos		(Apple ProDOS file system)
#>69	string		scbk		(Scrapbook)
#>69	string		ttxt		(SimpleText)
#>69	string		ufox		(Foreign File Access)

# Just in case...

102	string		mBIN		MacBinary III data with surprising version number

# sas magic from Bruce Foster (bef@@nwu.edu)
#
#0	string		SAS		SAS
#>8	string		x		%s
0	string		SAS		SAS
>24	string		DATA		data file
>24	string		CATALOG		catalog
>24	string		INDEX		data file index
>24	string		VIEW		data view
# sas 7+ magic from Reinhold Koch (reinhold.koch@@roche.com)
#
0x54    string          SAS             SAS 7+
>0x9C   string          DATA            data file
>0x9C   string          CATALOG         catalog
>0x9C   string          INDEX           data file index
>0x9C   string          VIEW            data view

# spss magic for SPSS system and portable files, 
#	 from Bruce Foster (bef@@nwu.edu).

0	long		0xc1e2c3c9	SPSS Portable File
>40	string 		x		%s

0	string		$FL2		SPSS System File
>24	string		x		%s

# Macintosh filesystem data
# From "Tom N Harris" <telliamed@@mac.com>
# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@@alaska.net>
# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
# entries depend on the data arithmetic added after v.35
# There's also some Pascal strings in here, ditto...

# The boot block signature, according to IM:Files, is 
# "for HFS volumes, this field always contains the value 0x4C4B."
# But if this is true for MFS or HFS+ volumes, I don't know.
# Alternatively, the boot block is supposed to be zeroed if it's
# unused, so a simply >0 should suffice.

0x400	beshort			0xD2D7		Macintosh MFS data
>0	beshort			0x4C4B		(bootable)
>0x40a	beshort			&0x8000		(locked)
>0x402	beldate-0x7C25B080	x		created: %s,
>0x406	beldate-0x7C25B080	>0		last backup: %s,
>0x414	belong			x		block size: %d,
>0x412	beshort			x		number of blocks: %d,
>0x424	pstring			x		volume name: %s

# "BD" gives many false positives
#0x400	beshort			0x4244		Macintosh HFS data
#>0	beshort			0x4C4B		(bootable)
#>0x40a	beshort			&0x8000		(locked)
#>0x40a	beshort			^0x0100		(mounted)
#>0x40a	beshort			&0x0200		(spared blocks)
#>0x40a	beshort			&0x0800		(unclean)
#>0x47C	beshort			0x482B		(Embedded HFS+ Volume)
#>0x402	beldate-0x7C25B080	x		created: %s,
#>0x406	beldate-0x7C25B080	x		last modified: %s,
#>0x440	beldate-0x7C25B080	>0		last backup: %s,
#>0x414	belong			x		block size: %d,
#>0x412	beshort			x		number of blocks: %d,
#>0x424	pstring			x		volume name: %s

0x400	beshort			0x482B		Macintosh HFS Extended
>&0	beshort			x		version %d data
>0	beshort			0x4C4B		(bootable)
>0x404	belong			^0x00000100	(mounted)
>&2	belong			&0x00000200	(spared blocks)
>&2	belong			&0x00000800	(unclean)
>&2	belong			&0x00008000	(locked)
>&6	string			x		last mounted by: '%.4s',
# really, that should be treated as a belong and we print a string
# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
>&14	beldate-0x7C25B080	x		created: %s,
# only the creation date is local time, all other timestamps in HFS+ are UTC.
>&18	bedate-0x7C25B080	x		last modified: %s,
>&22	bedate-0x7C25B080	>0		last backup: %s,
>&26	bedate-0x7C25B080	>0		last checked: %s,
>&38	belong			x		block size: %d,
>&42	belong			x		number of blocks: %d,
>&46	belong			x		free blocks: %d

# I don't think this is really necessary since it doesn't do much and 
# anything with a valid driver descriptor will also have a valid
# partition map
#0		beshort		0x4552		Apple Device Driver data
#>&24		beshort		=1		\b, MacOS

# Is that the partition type a cstring or a pstring? Well, IM says "strings 
# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a 
# cstring. Of course, partitions can contain more than four entries, but 
# what're you gonna do?
# GRR: This magic is too weak, it is just "PM"
#0x200		beshort		0x504D		Apple Partition data
#>0x2		beshort		x		(block size: %d):
#>0x230		string		x		first type: %s,
#>0x210		string		x		name: %s,
#>0x254		belong		x		number of blocks: %d,
#>0x400		beshort		0x504D		
#>>0x430		string		x		second type: %s,
#>>0x410		string		x		name: %s,
#>>0x454		belong		x		number of blocks: %d,
#>>0x600		beshort		0x504D
#>>>0x630	string		x		third type: %s,
#>>>0x610	string		x		name: %s,
#>>>0x654	belong		x		number of blocks: %d,
#>>0x800		beshort		0x504D		
#>>>0x830	string		x		fourth type: %s,
#>>>0x810	string		x		name: %s,
#>>>0x854	belong		x		number of blocks: %d,
#>>>0xa00	beshort		0x504D		
#>>>>0xa30	string		x		fifth type: %s,
#>>>>0xa10	string		x		name: %s,
#>>>>0xa54	belong		x		number of blocks: %d
#>>>0xc00	beshort		0x504D
#>>>>0xc30	string		x		sixth type: %s,
#>>>>0xc10	string		x		name: %s,
#>>>>0xc54	belong		x		number of blocks: %d
## AFAIK, only the signature is different
#0x200		beshort		0x5453		Apple Old Partition data
#>0x2		beshort		x		block size: %d,
#>0x230		string		x		first type: %s,
#>0x210		string		x		name: %s,
#>0x254		belong		x		number of blocks: %d,
#>0x400		beshort		0x504D		
#>>0x430		string		x		second type: %s,
#>>0x410		string		x		name: %s,
#>>0x454		belong		x		number of blocks: %d,
#>>0x800		beshort		0x504D		
#>>>0x830	string		x		third type: %s,
#>>>0x810	string		x		name: %s,
#>>>0x854	belong		x		number of blocks: %d,
#>>>0xa00	beshort		0x504D		
#>>>>0xa30	string		x		fourth type: %s,
#>>>>0xa10	string		x		name: %s,
#>>>>0xa54	belong		x		number of blocks: %d

# From: Remi Mommsen <mommsen@@slac.stanford.edu>
0		string		BOMStore	Mac OS X bill of materials (BOM) file

# From: Adam Buchbinder <adam.buchbinder@@gmail.com>
# URL: http://en.wikipedia.org/wiki/Datafork_TrueType
# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
# don't know what they mean.
0	belong	0x100
>(0x4.L+24)	beshort	x
>>&4	belong	0x73666e74	Mac OSX datafork font, TrueType
>>&4	belong	0x464f4e54	Mac OSX datafork font, 'FONT'
>>&4	belong	0x4e464e54	Mac OSX datafork font, 'NFNT'
>>&4	belong	0x504f5354	Mac OSX datafork font, PostScript
@


1.4.2.1
log
@file macintosh was added on branch RELENG_8_4 on 2013-03-28 13:00:45 +0000
@
text
@d1 390
@


1.4.2.2
log
@## SVN ## Exported commit - http://svnweb.freebsd.org/changeset/base/248810
## SVN ## CVS IS DEPRECATED: http://wiki.freebsd.org/CvsIsDeprecated
@
text
@a0 377

#------------------------------------------------------------------------------
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
# Daniel Quinlan, quinlan@@yggdrasil.com
11	string	must\ be\ converted\ with\ BinHex	BinHex binary text
!:mime	application/mac-binhex40
>41	string	x					\b, version %.3s

# Stuffit archives are the de facto standard of compression for Macintosh
# files obtained from most archives. (franklsm@@tuns.ca)
0	string		SIT!			StuffIt Archive (data)
!:mime	application/x-stuffit
!:apple	SIT!SIT!
>2	string		x			: %s
0	string		SITD			StuffIt Deluxe (data)
>2	string		x			: %s
0	string		Seg			StuffIt Deluxe Segment (data)
>2	string		x			: %s

# Newer StuffIt archives (grant@@netbsd.org)
0	string		StuffIt			StuffIt Archive
!:mime	application/x-stuffit
!:apple	SIT!SIT!
#>162	string		>0			: %s

# Macintosh Applications and Installation binaries (franklsm@@tuns.ca)
# GRR: Too weak
#0	string		APPL			Macintosh Application (data)
#>2	string		x			\b: %s

# Macintosh System files (franklsm@@tuns.ca)
# GRR: Too weak
#0	string		zsys			Macintosh System File (data)
#0	string		FNDR			Macintosh Finder (data)
#0	string		libr			Macintosh Library (data)
#>2	string		x			: %s
#0	string		shlb			Macintosh Shared Library (data)
#>2	string		x			: %s
#0	string		cdev			Macintosh Control Panel (data)
#>2	string		x			: %s
#0	string		INIT			Macintosh Extension (data)
#>2	string		x			: %s
#0	string		FFIL			Macintosh Truetype Font (data)
#>2	string		x			: %s
#0	string		LWFN			Macintosh Postscript Font (data)
#>2	string		x			: %s

# Additional Macintosh Files (franklsm@@tuns.ca)
# GRR: Too weak
#0	string		PACT			Macintosh Compact Pro Archive (data)
#>2	string		x			: %s
#0	string		ttro			Macintosh TeachText File (data)
#>2	string		x			: %s
#0	string		TEXT			Macintosh TeachText File (data)
#>2	string		x			: %s
#0	string		PDF			Macintosh PDF File (data)
#>2	string		x			: %s

# MacBinary format (Eric Fischer, enf@@pobox.com)
#
# Unfortunately MacBinary doesn't really have a magic number prior
# to the MacBinary III format.  The checksum is really the way to
# do it, but the magic file format isn't up to the challenge.
#
# 0	byte		0
# 1	byte				# filename length
# 2	string				# filename
# 65    string				# file type
# 69	string				# file creator
# 73	byte				# Finder flags
# 74	byte		0
# 75	beshort				# vertical posn in window
# 77	beshort				# horiz posn in window
# 79	beshort				# window or folder ID
# 81    byte				# protected?
# 82	byte		0
# 83	belong				# length of data segment
# 87	belong				# length of resource segment
# 91	belong				# file creation date
# 95	belong				# file modification date
# 99	beshort				# length of comment after resource
# 101	byte				# new Finder flags
# 102	string		mBIN		# (only in MacBinary III)
# 106	byte				# char. code of file name
# 107	byte				# still more Finder flags
# 116	belong				# total file length
# 120	beshort				# length of add'l header
# 122	byte		129		# for MacBinary II
# 122	byte		130		# for MacBinary III
# 123	byte		129		# minimum version that can read fmt
# 124	beshort				# checksum
#
# This attempts to use the version numbers as a magic number, requiring
# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
# be 0x81.  This works for the files I have, but maybe not for everyone's.

# Unfortunately, this magic is quite weak - MPi
#122	beshort&0xFCFF	0x8081		Macintosh MacBinary data

# MacBinary I doesn't have the version number field at all, but MacBinary II
# has been in use since 1987 so I hope there aren't many really old files
# floating around that this will miss.  The original spec calls for using
# the nulls in 0, 74, and 82 as the magic number.
#
# Another possibility, that would also work for MacBinary I, is to use
# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
# and that 74 will be 0.  So something like
# 
# 71 	belong&0x80804EFF 0x00000000 	Macintosh MacBinary data
# 
# >73	byte&0x01	0x01		\b, inited
# >73	byte&0x02	0x02		\b, changed
# >73	byte&0x04	0x04		\b, busy
# >73	byte&0x08	0x08		\b, bozo
# >73	byte&0x10	0x10		\b, system
# >73	byte&0x10	0x20		\b, bundle
# >73	byte&0x10	0x40		\b, invisible
# >73	byte&0x10	0x80		\b, locked

#>65	string		x		\b, type "%4.4s"

#>65	string		8BIM		(PhotoShop)
#>65	string		ALB3		(PageMaker 3)
#>65	string		ALB4		(PageMaker 4)
#>65	string		ALT3		(PageMaker 3)
#>65	string		APPL		(application)
#>65	string		AWWP		(AppleWorks word processor)
#>65	string		CIRC		(simulated circuit)
#>65	string		DRWG		(MacDraw)
#>65	string		EPSF		(Encapsulated PostScript)
#>65	string		FFIL		(font suitcase)
#>65	string		FKEY		(function key)
#>65	string		FNDR		(Macintosh Finder)
#>65	string		GIFf		(GIF image)
#>65	string		Gzip		(GNU gzip)
#>65	string		INIT		(system extension)
#>65	string		LIB\ 		(library)
#>65	string		LWFN		(PostScript font)
#>65	string		MSBC		(Microsoft BASIC)
#>65	string		PACT		(Compact Pro archive)
#>65	string		PDF\ 		(Portable Document Format)
#>65	string		PICT		(picture)
#>65	string		PNTG		(MacPaint picture)
#>65	string		PREF		(preferences)
#>65	string		PROJ		(Think C project)
#>65	string		QPRJ		(Think Pascal project)
#>65	string		SCFL		(Defender scores)
#>65	string		SCRN		(startup screen)
#>65	string		SITD		(StuffIt Deluxe)
#>65	string		SPn3		(SuperPaint)
#>65	string		STAK		(HyperCard stack)
#>65	string		Seg\ 		(StuffIt segment)
#>65	string		TARF		(Unix tar archive)
#>65	string		TEXT		(ASCII)
#>65	string		TIFF		(TIFF image)
#>65	string		TOVF		(Eudora table of contents)
#>65	string		WDBN		(Microsoft Word word processor)
#>65	string		WORD		(MacWrite word processor)
#>65	string		XLS\ 		(Microsoft Excel)
#>65	string		ZIVM		(compress (.Z))
#>65	string		ZSYS		(Pre-System 7 system file)
#>65	string		acf3		(Aldus FreeHand)
#>65	string		cdev		(control panel)
#>65	string		dfil		(Desk Acessory suitcase)
#>65	string		libr		(library)
#>65	string		nX^d		(WriteNow word processor)
#>65	string		nX^w		(WriteNow dictionary)
#>65	string		rsrc		(resource)
#>65	string		scbk		(Scrapbook)
#>65	string		shlb		(shared library)
#>65	string		ttro		(SimpleText read-only)
#>65	string		zsys		(system file)

#>69	string		x		\b, creator "%4.4s"

# Somewhere, Apple has a repository of registered Creator IDs.  These are
# just the ones that I happened to have files from and was able to identify.

#>69	string		8BIM		(Adobe Photoshop)
#>69	string		ALD3		(PageMaker 3)
#>69	string		ALD4		(PageMaker 4)
#>69	string		ALFA		(Alpha editor)
#>69	string		APLS		(Apple Scanner)
#>69	string		APSC		(Apple Scanner)
#>69	string		BRKL		(Brickles)
#>69	string		BTFT		(BitFont)
#>69	string		CCL2 		(Common Lisp 2)
#>69	string		CCL\ 		(Common Lisp)
#>69	string		CDmo		(The Talking Moose)
#>69	string		CPCT		(Compact Pro)
#>69	string		CSOm		(Eudora)
#>69	string		DMOV		(Font/DA Mover)
#>69	string		DSIM		(DigSim)
#>69	string		EDIT		(Macintosh Edit)
#>69	string		ERIK		(Macintosh Finder)
#>69	string		EXTR		(self-extracting archive)
#>69	string		Gzip		(GNU gzip)
#>69	string		KAHL		(Think C)
#>69	string		LWFU		(LaserWriter Utility)
#>69	string		LZIV		(compress)
#>69	string		MACA		(MacWrite)
#>69	string		MACS		(Macintosh operating system)
#>69	string		MAcK		(MacKnowledge terminal emulator)
#>69	string		MLND		(Defender)
#>69	string		MPNT		(MacPaint)
#>69	string		MSBB		(Microsoft BASIC (binary))
#>69	string		MSWD		(Microsoft Word)
#>69	string		NCSA		(NCSA Telnet)
#>69	string		PJMM		(Think Pascal)
#>69	string		PSAL		(Hunt the Wumpus)
#>69	string		PSI2		(Apple File Exchange)
#>69	string		R*ch		(BBEdit)
#>69	string		RMKR		(Resource Maker)
#>69	string		RSED		(Resource Editor)
#>69	string		Rich		(BBEdit)
#>69	string		SIT!		(StuffIt)
#>69	string		SPNT		(SuperPaint)
#>69	string		Unix		(NeXT Mac filesystem)
#>69	string		VIM!		(Vim editor)
#>69	string		WILD		(HyperCard)
#>69	string		XCEL		(Microsoft Excel)
#>69	string		aCa2		(Fontographer)
#>69	string		aca3		(Aldus FreeHand)
#>69	string		dosa		(Macintosh MS-DOS file system)
#>69	string		movr		(Font/DA Mover)
#>69	string		nX^n		(WriteNow)
#>69	string		pdos		(Apple ProDOS file system)
#>69	string		scbk		(Scrapbook)
#>69	string		ttxt		(SimpleText)
#>69	string		ufox		(Foreign File Access)

# Just in case...

102	string		mBIN		MacBinary III data with surprising version number

# sas magic from Bruce Foster (bef@@nwu.edu)
#
#0	string		SAS		SAS
#>8	string		x		%s
0	string		SAS		SAS
>24	string		DATA		data file
>24	string		CATALOG		catalog
>24	string		INDEX		data file index
>24	string		VIEW		data view
# sas 7+ magic from Reinhold Koch (reinhold.koch@@roche.com)
#
0x54    string          SAS             SAS 7+
>0x9C   string          DATA            data file
>0x9C   string          CATALOG         catalog
>0x9C   string          INDEX           data file index
>0x9C   string          VIEW            data view

# spss magic for SPSS system and portable files, 
#	 from Bruce Foster (bef@@nwu.edu).

0	long		0xc1e2c3c9	SPSS Portable File
>40	string 		x		%s

0	string		$FL2		SPSS System File
>24	string		x		%s

# Macintosh filesystem data
# From "Tom N Harris" <telliamed@@mac.com>
# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@@alaska.net>
# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
# entries depend on the data arithmetic added after v.35
# There's also some Pascal strings in here, ditto...

# The boot block signature, according to IM:Files, is 
# "for HFS volumes, this field always contains the value 0x4C4B."
# But if this is true for MFS or HFS+ volumes, I don't know.
# Alternatively, the boot block is supposed to be zeroed if it's
# unused, so a simply >0 should suffice.

0x400	beshort			0xD2D7		Macintosh MFS data
>0	beshort			0x4C4B		(bootable)
>0x40a	beshort			&0x8000		(locked)
>0x402	beldate-0x7C25B080	x		created: %s,
>0x406	beldate-0x7C25B080	>0		last backup: %s,
>0x414	belong			x		block size: %d,
>0x412	beshort			x		number of blocks: %d,
>0x424	pstring			x		volume name: %s

# "BD" is has many false positives
#0x400	beshort			0x4244		Macintosh HFS data
#>0	beshort			0x4C4B		(bootable)
#>0x40a	beshort			&0x8000		(locked)
#>0x40a	beshort			^0x0100		(mounted)
#>0x40a	beshort			&0x0200		(spared blocks)
#>0x40a	beshort			&0x0800		(unclean)
#>0x47C	beshort			0x482B		(Embedded HFS+ Volume)
#>0x402	beldate-0x7C25B080	x		created: %s,
#>0x406	beldate-0x7C25B080	x		last modified: %s,
#>0x440	beldate-0x7C25B080	>0		last backup: %s,
#>0x414	belong			x		block size: %d,
#>0x412	beshort			x		number of blocks: %d,
#>0x424	pstring			x		volume name: %s

0x400	beshort			0x482B		Macintosh HFS Extended
>&0	beshort			x		version %d data
>0	beshort			0x4C4B		(bootable)
>0x404	belong			^0x00000100	(mounted)
>&2	belong			&0x00000200	(spared blocks)
>&2	belong			&0x00000800	(unclean)
>&2	belong			&0x00008000	(locked)
>&6	string			x		last mounted by: '%.4s',
# really, that should be treated as a belong and we print a string
# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
>&14	beldate-0x7C25B080	x		created: %s,
# only the creation date is local time, all other timestamps in HFS+ are UTC.
>&18	bedate-0x7C25B080	x		last modified: %s,
>&22	bedate-0x7C25B080	>0		last backup: %s,
>&26	bedate-0x7C25B080	>0		last checked: %s,
>&38	belong			x		block size: %d,
>&42	belong			x		number of blocks: %d,
>&46	belong			x		free blocks: %d

# I don't think this is really necessary since it doesn't do much and 
# anything with a valid driver descriptor will also have a valid
# partition map
#0		beshort		0x4552		Apple Device Driver data
#>&24		beshort		=1		\b, MacOS

# Is that the partition type a cstring or a pstring? Well, IM says "strings 
# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a 
# cstring. Of course, partitions can contain more than four entries, but 
# what're you gonna do?
# GRR: This magic is too weak, it is just "PM"
#0x200		beshort		0x504D		Apple Partition data
#>0x2		beshort		x		(block size: %d):
#>0x230		string		x		first type: %s,
#>0x210		string		x		name: %s,
#>0x254		belong		x		number of blocks: %d,
#>0x400		beshort		0x504D		
#>>0x430		string		x		second type: %s,
#>>0x410		string		x		name: %s,
#>>0x454		belong		x		number of blocks: %d,
#>>0x600		beshort		0x504D
#>>>0x630	string		x		third type: %s,
#>>>0x610	string		x		name: %s,
#>>>0x654	belong		x		number of blocks: %d,
#>>0x800		beshort		0x504D		
#>>>0x830	string		x		fourth type: %s,
#>>>0x810	string		x		name: %s,
#>>>0x854	belong		x		number of blocks: %d,
#>>>0xa00	beshort		0x504D		
#>>>>0xa30	string		x		fifth type: %s,
#>>>>0xa10	string		x		name: %s,
#>>>>0xa54	belong		x		number of blocks: %d
#>>>0xc00	beshort		0x504D
#>>>>0xc30	string		x		sixth type: %s,
#>>>>0xc10	string		x		name: %s,
#>>>>0xc54	belong		x		number of blocks: %d
## AFAIK, only the signature is different
#0x200		beshort		0x5453		Apple Old Partition data
#>0x2		beshort		x		block size: %d,
#>0x230		string		x		first type: %s,
#>0x210		string		x		name: %s,
#>0x254		belong		x		number of blocks: %d,
#>0x400		beshort		0x504D		
#>>0x430		string		x		second type: %s,
#>>0x410		string		x		name: %s,
#>>0x454		belong		x		number of blocks: %d,
#>>0x800		beshort		0x504D		
#>>>0x830	string		x		third type: %s,
#>>>0x810	string		x		name: %s,
#>>>0x854	belong		x		number of blocks: %d,
#>>>0xa00	beshort		0x504D		
#>>>>0xa30	string		x		fourth type: %s,
#>>>>0xa10	string		x		name: %s,
#>>>>0xa54	belong		x		number of blocks: %d

# From: Remi Mommsen <mommsen@@slac.stanford.edu>
0		string		BOMStore	Mac OS X bill of materials (BOM) file
@


1.3
log
@SVN rev 191771 on 2009-05-04 00:37:44Z by obrien

Merge vendor/file/dist@@191739, bringing FILE 5.00 to 8-CURRENT.
@
text
@d3 1
d288 1
a288 1
# "BD" is has many false positives
d379 12
@


1.3.10.1
log
@SVN rev 237983 on 2012-07-02 08:48:58Z by obrien

MFC: r234449: update file(1) to version 5.11.
@
text
@a2 1
# $File: macintosh,v 1.22 2011/05/17 17:40:31 rrt Exp $
d287 1
a287 1
# "BD" gives many false positives
a377 12

# From: Adam Buchbinder <adam.buchbinder@@gmail.com>
# URL: http://en.wikipedia.org/wiki/Datafork_TrueType
# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
# don't know what they mean.
0	belong	0x100
>(0x4.L+24)	beshort	x
>>&4	belong	0x73666e74	Mac OSX datafork font, TrueType
>>&4	belong	0x464f4e54	Mac OSX datafork font, 'FONT'
>>&4	belong	0x4e464e54	Mac OSX datafork font, 'NFNT'
>>&4	belong	0x504f5354	Mac OSX datafork font, PostScript
@


1.2
log
@SVN rev 186691 on 2009-01-02 03:10:55Z by obrien

Record that base/vendor/file/dist@@186675 was merged.
Merge base/vendor/file/dist@@186675@@186690, bringing FILE 4.26 to 8-CURRENT.
@
text
@d14 2
d25 1
@


1.1
log
@Initial revision
@
text
@d8 1
d20 5
d26 3
a28 2
0	string		APPL			Macintosh Application (data)
>2	string		x			\b: %s
d31 15
a45 14
0	string		zsys			Macintosh System File (data)
0	string		FNDR			Macintosh Finder (data)
0	string		libr			Macintosh Library (data)
>2	string		x			: %s
0	string		shlb			Macintosh Shared Library (data)
>2	string		x			: %s
0	string		cdev			Macintosh Control Panel (data)
>2	string		x			: %s
0	string		INIT			Macintosh Extension (data)
>2	string		x			: %s
0	string		FFIL			Macintosh Truetype Font (data)
>2	string		x			: %s
0	string		LWFN			Macintosh Postscript Font (data)
>2	string		x			: %s
d48 9
a56 8
0	string		PACT			Macintosh Compact Pro Archive (data)
>2	string		x			: %s
0	string		ttro			Macintosh TeachText File (data)
>2	string		x			: %s
0	string		TEXT			Macintosh TeachText File (data)
>2	string		x			: %s
0	string		PDF			Macintosh PDF File (data)
>2	string		x			: %s
d96 2
a97 1
122	beshort&0xFCFF	0x8081		Macintosh MacBinary data
d120 1
a120 1
>65	string		x		\b, type "%4.4s"
d122 51
a172 51
>65	string		8BIM		(PhotoShop)
>65	string		ALB3		(PageMaker 3)
>65	string		ALB4		(PageMaker 4)
>65	string		ALT3		(PageMaker 3)
>65	string		APPL		(application)
>65	string		AWWP		(AppleWorks word processor)
>65	string		CIRC		(simulated circuit)
>65	string		DRWG		(MacDraw)
>65	string		EPSF		(Encapsulated PostScript)
>65	string		FFIL		(font suitcase)
>65	string		FKEY		(function key)
>65	string		FNDR		(Macintosh Finder)
>65	string		GIFf		(GIF image)
>65	string		Gzip		(GNU gzip)
>65	string		INIT		(system extension)
>65	string		LIB\ 		(library)
>65	string		LWFN		(PostScript font)
>65	string		MSBC		(Microsoft BASIC)
>65	string		PACT		(Compact Pro archive)
>65	string		PDF\ 		(Portable Document Format)
>65	string		PICT		(picture)
>65	string		PNTG		(MacPaint picture)
>65	string		PREF		(preferences)
>65	string		PROJ		(Think C project)
>65	string		QPRJ		(Think Pascal project)
>65	string		SCFL		(Defender scores)
>65	string		SCRN		(startup screen)
>65	string		SITD		(StuffIt Deluxe)
>65	string		SPn3		(SuperPaint)
>65	string		STAK		(HyperCard stack)
>65	string		Seg\ 		(StuffIt segment)
>65	string		TARF		(Unix tar archive)
>65	string		TEXT		(ASCII)
>65	string		TIFF		(TIFF image)
>65	string		TOVF		(Eudora table of contents)
>65	string		WDBN		(Microsoft Word word processor)
>65	string		WORD		(MacWrite word processor)
>65	string		XLS\ 		(Microsoft Excel)
>65	string		ZIVM		(compress (.Z))
>65	string		ZSYS		(Pre-System 7 system file)
>65	string		acf3		(Aldus FreeHand)
>65	string		cdev		(control panel)
>65	string		dfil		(Desk Acessory suitcase)
>65	string		libr		(library)
>65	string		nX^d		(WriteNow word processor)
>65	string		nX^w		(WriteNow dictionary)
>65	string		rsrc		(resource)
>65	string		scbk		(Scrapbook)
>65	string		shlb		(shared library)
>65	string		ttro		(SimpleText read-only)
>65	string		zsys		(system file)
d174 1
a174 1
>69	string		x		\b, creator "%4.4s"
d179 52
a230 52
>69	string		8BIM		(Adobe Photoshop)
>69	string		ALD3		(PageMaker 3)
>69	string		ALD4		(PageMaker 4)
>69	string		ALFA		(Alpha editor)
>69	string		APLS		(Apple Scanner)
>69	string		APSC		(Apple Scanner)
>69	string		BRKL		(Brickles)
>69	string		BTFT		(BitFont)
>69	string		CCL2 		(Common Lisp 2)
>69	string		CCL\ 		(Common Lisp)
>69	string		CDmo		(The Talking Moose)
>69	string		CPCT		(Compact Pro)
>69	string		CSOm		(Eudora)
>69	string		DMOV		(Font/DA Mover)
>69	string		DSIM		(DigSim)
>69	string		EDIT		(Macintosh Edit)
>69	string		ERIK		(Macintosh Finder)
>69	string		EXTR		(self-extracting archive)
>69	string		Gzip		(GNU gzip)
>69	string		KAHL		(Think C)
>69	string		LWFU		(LaserWriter Utility)
>69	string		LZIV		(compress)
>69	string		MACA		(MacWrite)
>69	string		MACS		(Macintosh operating system)
>69	string		MAcK		(MacKnowledge terminal emulator)
>69	string		MLND		(Defender)
>69	string		MPNT		(MacPaint)
>69	string		MSBB		(Microsoft BASIC (binary))
>69	string		MSWD		(Microsoft Word)
>69	string		NCSA		(NCSA Telnet)
>69	string		PJMM		(Think Pascal)
>69	string		PSAL		(Hunt the Wumpus)
>69	string		PSI2		(Apple File Exchange)
>69	string		R*ch		(BBEdit)
>69	string		RMKR		(Resource Maker)
>69	string		RSED		(Resource Editor)
>69	string		Rich		(BBEdit)
>69	string		SIT!		(StuffIt)
>69	string		SPNT		(SuperPaint)
>69	string		Unix		(NeXT Mac filesystem)
>69	string		VIM!		(Vim editor)
>69	string		WILD		(HyperCard)
>69	string		XCEL		(Microsoft Excel)
>69	string		aCa2		(Fontographer)
>69	string		aca3		(Aldus FreeHand)
>69	string		dosa		(Macintosh MS-DOS file system)
>69	string		movr		(Font/DA Mover)
>69	string		nX^n		(WriteNow)
>69	string		pdos		(Apple ProDOS file system)
>69	string		scbk		(Scrapbook)
>69	string		ttxt		(SimpleText)
>69	string		ufox		(Foreign File Access)
d235 140
@


1.1.1.1
log
@Virgin import of FILE 3.32
@
text
@@


1.1.1.2
log
@Virgin import of Christos Zoulas FILE 3.33.
@
text
@a224 18

# sas magic from Bruce Foster (bef@@nwu.edu)
#
#0	string		SAS		SAS
#>8	string		x		%s
0	string		SAS		SAS
>24	string		DATA		data file
>24	string		CATALOG		catalog
>24	string		INDEX		data file index
>24	string		VIEW		data view
# spss magic for SPSS system and portable files, 
#	 from Bruce Foster (bef@@nwu.edu).

0	long		0xc1e2c3c9	SPSS Portable File
>40	string 		x		%s

0	string		$FL2		SPSS System File
>24	string		x		%s
@


1.1.1.3
log
@Virgin import of Christos Zoulas's FILE 3.36.
@
text
@a242 93

# Macintosh filesystem data
# From "Tom N Harris" <telliamed@@mac.com>
# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
# entries depend on the data arithmetic added after v.35
# There's also some Pascal strings in here, ditto...

# The boot block signature, according to IM:Files, is 
# "for HFS volumes, this field always contains the value 0x4C4B."
# But if this is true for MFS or HFS+ volumes, I don't know.
# Alternatively, the boot block is supposed to be zeroed if it's
# unused, so a simply >0 should suffice.

0x400	beshort			0xD2D7		Macintosh MFS data
>0	beshort			0x4C4B		(bootable)
>0x40a	beshort			&0x8000		(locked)
>0x402	beldate-0x7C25B080	x		created: %s,
>0x406	beldate-0x7C25B080	>0		last backup: %s,
>0x414	belong			x		block size: %d,
>0x412	beshort			x		number of blocks: %d,
>0x424	pstring			x		volume name: %s

0x400	beshort			0x4244		Macintosh HFS data
>0	beshort			0x4C4B		(bootable)
>0x40a	beshort			&0x8000		(locked)
>0x40a	beshort			^0x0100		(mounted)
>0x40a	beshort			&0x0800		(unclean)
>0x402	beldate-0x7C25B080	x		created: %s,
>0x406	beldate-0x7C25B080	x		last modified: %s,
>0x440	beldate-0x7C25B080	>0		last backup: %s,
>0x414	belong			x		block size: %d,
>0x412	beshort			x		number of blocks: %d,
>0x424	pstring			x		volume name: %s
#>0x480	beshort			=0x482B		Embedded HFS+ Volume:
#>>((0x482*(0x414))+(0x41c*512))	x	\b
# Well, this is (theoretically) how we could do this. But it occurs to
# me that we likely don't read in a large enough chunk. I don't have any
# HFS+ volumes to see what a typical offset would be.

0x400	beshort			0x482B		Macintosh HFS Extended
>&2	beshort			x		version %d data
>0	beshort			0x4C4B		(bootable)
>&4	belong			^0x00000100	(mounted)
>&4	belong			&0x00000800	(unclean)
>&4	belong			&0x00008000	(locked)
>&8	string			x		last mounted by: '%.4s',
# really, that should be treated as a belong and we print a string
# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
>&16	beldate-0x7C25B080	x		created: %s,
>&20	beldate-0x7C25B080	x		last modified: %s,
>&24	beldate-0x7C25B080	>0		last backup: %s,
>&28	beldate-0x7C25B080	>0		last checked: %s,
>&40	belong			x		block size: %d,
>&44	belong			x		number of blocks: %d,
>&48	belong			x		free blocks: %d

# I don't think this is really necessary since it doesn't do much and 
# anything with a valid driver descriptor will also have a valid
# partition map
#0		beshort		0x4552		Apple Device Driver data
#>&24		beshort		=1		\b, MacOS

# Is that the partition type a cstring or a pstring? Well, IM says "strings 
# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a 
# cstring. Of course, partitions can contain more than four entries, but 
# what're you gonna do?
0x200		beshort		0x504D		Apple Partition data
>&2		beshort		x		block size: %d
>&48		string		x		first type: %s,
>&12		belong		x		number of blocks: %d,
>(&0x2.S)	beshort		0x504D		
>>&48		string		x		second type: %s
>>&12		belong		x		number of blocks: %d,
>>(&0x2.S)	beshort		0x504D		
>>>&48		string		x		third type: %s
>>>&12		belong		x		number of blocks: %d,
>>>(&0x2.S)	beshort		0x504D		
>>>>&48		string		x		fourth type: %s
>>>>&12		belong		x		number of blocks: %d,
# AFAIK, only the signature is different
0x200		beshort		0x5453		Apple Old Partition data
>&2		beshort		x		block size: %d
>&48		string		x		first type: %s,
>&12		belong		x		number of blocks: %d,
>(&0x2.S)	beshort		0x504D		
>>&48		string		x		second type: %s
>>&12		belong		x		number of blocks: %d,
>>(&0x2.S)	beshort		0x504D		
>>>&48		string		x		third type: %s
>>>&12		belong		x		number of blocks: %d,
>>>(&0x2.S)	beshort		0x504D		
>>>>&48		string		x		fourth type: %s
>>>>&12		belong		x		number of blocks: %d,
@


1.1.1.4
log
@Virgin import of Christos Zoulas's FILE 3.41.
	* - fix memory allocation problem (Jeff Johnson)
	* - fix stack overflow corruption (David Endler)
@
text
@a18 4
# Newer StuffIt archives (grant@@netbsd.org)
0	string		StuffIt			StuffIt Archive
>162	string		>0			: %s

@


1.1.1.5
log
@Virgin import of Christos Zoulas's FILE 4.10.
*- file is now broken into a library containing and processing the magic
   and a consumer binary.
@
text
@d91 1
a91 2
# Unfortunately, this magic is quite weak - MPi
#122	beshort&0xFCFF	0x8081		Macintosh MacBinary data
d114 1
a114 1
#>65	string		x		\b, type "%4.4s"
d116 51
a166 51
#>65	string		8BIM		(PhotoShop)
#>65	string		ALB3		(PageMaker 3)
#>65	string		ALB4		(PageMaker 4)
#>65	string		ALT3		(PageMaker 3)
#>65	string		APPL		(application)
#>65	string		AWWP		(AppleWorks word processor)
#>65	string		CIRC		(simulated circuit)
#>65	string		DRWG		(MacDraw)
#>65	string		EPSF		(Encapsulated PostScript)
#>65	string		FFIL		(font suitcase)
#>65	string		FKEY		(function key)
#>65	string		FNDR		(Macintosh Finder)
#>65	string		GIFf		(GIF image)
#>65	string		Gzip		(GNU gzip)
#>65	string		INIT		(system extension)
#>65	string		LIB\ 		(library)
#>65	string		LWFN		(PostScript font)
#>65	string		MSBC		(Microsoft BASIC)
#>65	string		PACT		(Compact Pro archive)
#>65	string		PDF\ 		(Portable Document Format)
#>65	string		PICT		(picture)
#>65	string		PNTG		(MacPaint picture)
#>65	string		PREF		(preferences)
#>65	string		PROJ		(Think C project)
#>65	string		QPRJ		(Think Pascal project)
#>65	string		SCFL		(Defender scores)
#>65	string		SCRN		(startup screen)
#>65	string		SITD		(StuffIt Deluxe)
#>65	string		SPn3		(SuperPaint)
#>65	string		STAK		(HyperCard stack)
#>65	string		Seg\ 		(StuffIt segment)
#>65	string		TARF		(Unix tar archive)
#>65	string		TEXT		(ASCII)
#>65	string		TIFF		(TIFF image)
#>65	string		TOVF		(Eudora table of contents)
#>65	string		WDBN		(Microsoft Word word processor)
#>65	string		WORD		(MacWrite word processor)
#>65	string		XLS\ 		(Microsoft Excel)
#>65	string		ZIVM		(compress (.Z))
#>65	string		ZSYS		(Pre-System 7 system file)
#>65	string		acf3		(Aldus FreeHand)
#>65	string		cdev		(control panel)
#>65	string		dfil		(Desk Acessory suitcase)
#>65	string		libr		(library)
#>65	string		nX^d		(WriteNow word processor)
#>65	string		nX^w		(WriteNow dictionary)
#>65	string		rsrc		(resource)
#>65	string		scbk		(Scrapbook)
#>65	string		shlb		(shared library)
#>65	string		ttro		(SimpleText read-only)
#>65	string		zsys		(system file)
d168 1
a168 1
#>69	string		x		\b, creator "%4.4s"
d173 52
a224 52
#>69	string		8BIM		(Adobe Photoshop)
#>69	string		ALD3		(PageMaker 3)
#>69	string		ALD4		(PageMaker 4)
#>69	string		ALFA		(Alpha editor)
#>69	string		APLS		(Apple Scanner)
#>69	string		APSC		(Apple Scanner)
#>69	string		BRKL		(Brickles)
#>69	string		BTFT		(BitFont)
#>69	string		CCL2 		(Common Lisp 2)
#>69	string		CCL\ 		(Common Lisp)
#>69	string		CDmo		(The Talking Moose)
#>69	string		CPCT		(Compact Pro)
#>69	string		CSOm		(Eudora)
#>69	string		DMOV		(Font/DA Mover)
#>69	string		DSIM		(DigSim)
#>69	string		EDIT		(Macintosh Edit)
#>69	string		ERIK		(Macintosh Finder)
#>69	string		EXTR		(self-extracting archive)
#>69	string		Gzip		(GNU gzip)
#>69	string		KAHL		(Think C)
#>69	string		LWFU		(LaserWriter Utility)
#>69	string		LZIV		(compress)
#>69	string		MACA		(MacWrite)
#>69	string		MACS		(Macintosh operating system)
#>69	string		MAcK		(MacKnowledge terminal emulator)
#>69	string		MLND		(Defender)
#>69	string		MPNT		(MacPaint)
#>69	string		MSBB		(Microsoft BASIC (binary))
#>69	string		MSWD		(Microsoft Word)
#>69	string		NCSA		(NCSA Telnet)
#>69	string		PJMM		(Think Pascal)
#>69	string		PSAL		(Hunt the Wumpus)
#>69	string		PSI2		(Apple File Exchange)
#>69	string		R*ch		(BBEdit)
#>69	string		RMKR		(Resource Maker)
#>69	string		RSED		(Resource Editor)
#>69	string		Rich		(BBEdit)
#>69	string		SIT!		(StuffIt)
#>69	string		SPNT		(SuperPaint)
#>69	string		Unix		(NeXT Mac filesystem)
#>69	string		VIM!		(Vim editor)
#>69	string		WILD		(HyperCard)
#>69	string		XCEL		(Microsoft Excel)
#>69	string		aCa2		(Fontographer)
#>69	string		aca3		(Aldus FreeHand)
#>69	string		dosa		(Macintosh MS-DOS file system)
#>69	string		movr		(Font/DA Mover)
#>69	string		nX^n		(WriteNow)
#>69	string		pdos		(Apple ProDOS file system)
#>69	string		scbk		(Scrapbook)
#>69	string		ttxt		(SimpleText)
#>69	string		ufox		(Foreign File Access)
a238 8
# sas 7+ magic from Reinhold Koch (reinhold.koch@@roche.com)
#
0x54    string          SAS             SAS 7+
>0x9C   string          DATA            data file
>0x9C   string          CATALOG         catalog
>0x9C   string          INDEX           data file index
>0x9C   string          VIEW            data view

a249 1
# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@@alaska.net>
d269 16
a284 14
# "BD" is has many false positives
#0x400	beshort			0x4244		Macintosh HFS data
#>0	beshort			0x4C4B		(bootable)
#>0x40a	beshort			&0x8000		(locked)
#>0x40a	beshort			^0x0100		(mounted)
#>0x40a	beshort			&0x0200		(spared blocks)
#>0x40a	beshort			&0x0800		(unclean)
#>0x47C	beshort			0x482B		(Embedded HFS+ Volume)
#>0x402	beldate-0x7C25B080	x		created: %s,
#>0x406	beldate-0x7C25B080	x		last modified: %s,
#>0x440	beldate-0x7C25B080	>0		last backup: %s,
#>0x414	belong			x		block size: %d,
#>0x412	beshort			x		number of blocks: %d,
#>0x424	pstring			x		volume name: %s
d287 1
a287 1
>&0	beshort			x		version %d data
d289 4
a292 5
>0x404	belong			^0x00000100	(mounted)
>&2	belong			&0x00000200	(spared blocks)
>&2	belong			&0x00000800	(unclean)
>&2	belong			&0x00008000	(locked)
>&6	string			x		last mounted by: '%.4s',
d295 7
a301 8
>&14	beldate-0x7C25B080	x		created: %s,
# only the creation date is local time, all other timestamps in HFS+ are UTC.
>&18	bedate-0x7C25B080	x		last modified: %s,
>&22	bedate-0x7C25B080	>0		last backup: %s,
>&26	bedate-0x7C25B080	>0		last checked: %s,
>&38	belong			x		block size: %d,
>&42	belong			x		number of blocks: %d,
>&46	belong			x		free blocks: %d
d314 12
a325 16
>0x2		beshort		x		block size: %d,
>0x230		string		x		first type: %s,
>0x210		string		x		name: %s,
>0x254		belong		x		number of blocks: %d,
>0x400		beshort		0x504D		
>>0x430		string		x		second type: %s,
>>0x410		string		x		name: %s,
>>0x454		belong		x		number of blocks: %d,
>>0x800		beshort		0x504D		
>>>0x830	string		x		third type: %s,
>>>0x810	string		x		name: %s,
>>>0x854	belong		x		number of blocks: %d,
>>>0xa00	beshort		0x504D		
>>>>0xa30	string		x		fourth type: %s,
>>>>0xa10	string		x		name: %s,
>>>>0xa54	belong		x		number of blocks: %d
d328 12
a339 19
>0x2		beshort		x		block size: %d,
>0x230		string		x		first type: %s,
>0x210		string		x		name: %s,
>0x254		belong		x		number of blocks: %d,
>0x400		beshort		0x504D		
>>0x430		string		x		second type: %s,
>>0x410		string		x		name: %s,
>>0x454		belong		x		number of blocks: %d,
>>0x800		beshort		0x504D		
>>>0x830	string		x		third type: %s,
>>>0x810	string		x		name: %s,
>>>0x854	belong		x		number of blocks: %d,
>>>0xa00	beshort		0x504D		
>>>>0xa30	string		x		fourth type: %s,
>>>>0xa10	string		x		name: %s,
>>>>0xa54	belong		x		number of blocks: %d

# From: Remi Mommsen <mommsen@@slac.stanford.edu>
0		string		BOMStore	Mac OS X bill of materials (BOM) fil
@


1.1.1.5.8.1
log
@MFC file 4.21
@
text
@d21 1
a21 1
#>162	string		>0			: %s
@


1.1.1.5.8.2
log
@- MFC file 4.23

Discussed with:	obrien
@
text
@d360 1
a360 1
0		string		BOMStore	Mac OS X bill of materials (BOM) file
@


1.1.1.6
log
@Virgin import of Christos Zoulas's FILE 4.17.
@
text
@d21 1
a21 1
#>162	string		>0			: %s
@


1.1.1.6.4.1
log
@MFC: file version 4.23.
Approved by:	re(kensmith)
@
text
@d360 1
a360 1
0		string		BOMStore	Mac OS X bill of materials (BOM) file
@


1.1.1.6.2.1
log
@MFC: version 4.23.
@
text
@d360 1
a360 1
0		string		BOMStore	Mac OS X bill of materials (BOM) file
@


1.1.1.7
log
@Import file version 4.23 onto the vendor branch
@
text
@d360 1
a360 1
0		string		BOMStore	Mac OS X bill of materials (BOM) file
@


1.1.1.2.2.1
log
@MFC:  Christos Zoulas's FILE 3.33
@
text
@@


1.1.1.2.2.2
log
@Update to version 3.36.

This includes knowledge of the lh6 & lh7 "LHA" compression archive formats.
There are also many improvements in supporting other formats such as
Microsoft cabinet file (which is another popular archived format on
Windows), some audio/video file formats including WAV, ASF and so on.

Approved by:	jkh
@
text
@a242 93

# Macintosh filesystem data
# From "Tom N Harris" <telliamed@@mac.com>
# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
# entries depend on the data arithmetic added after v.35
# There's also some Pascal strings in here, ditto...

# The boot block signature, according to IM:Files, is 
# "for HFS volumes, this field always contains the value 0x4C4B."
# But if this is true for MFS or HFS+ volumes, I don't know.
# Alternatively, the boot block is supposed to be zeroed if it's
# unused, so a simply >0 should suffice.

0x400	beshort			0xD2D7		Macintosh MFS data
>0	beshort			0x4C4B		(bootable)
>0x40a	beshort			&0x8000		(locked)
>0x402	beldate-0x7C25B080	x		created: %s,
>0x406	beldate-0x7C25B080	>0		last backup: %s,
>0x414	belong			x		block size: %d,
>0x412	beshort			x		number of blocks: %d,
>0x424	pstring			x		volume name: %s

0x400	beshort			0x4244		Macintosh HFS data
>0	beshort			0x4C4B		(bootable)
>0x40a	beshort			&0x8000		(locked)
>0x40a	beshort			^0x0100		(mounted)
>0x40a	beshort			&0x0800		(unclean)
>0x402	beldate-0x7C25B080	x		created: %s,
>0x406	beldate-0x7C25B080	x		last modified: %s,
>0x440	beldate-0x7C25B080	>0		last backup: %s,
>0x414	belong			x		block size: %d,
>0x412	beshort			x		number of blocks: %d,
>0x424	pstring			x		volume name: %s
#>0x480	beshort			=0x482B		Embedded HFS+ Volume:
#>>((0x482*(0x414))+(0x41c*512))	x	\b
# Well, this is (theoretically) how we could do this. But it occurs to
# me that we likely don't read in a large enough chunk. I don't have any
# HFS+ volumes to see what a typical offset would be.

0x400	beshort			0x482B		Macintosh HFS Extended
>&2	beshort			x		version %d data
>0	beshort			0x4C4B		(bootable)
>&4	belong			^0x00000100	(mounted)
>&4	belong			&0x00000800	(unclean)
>&4	belong			&0x00008000	(locked)
>&8	string			x		last mounted by: '%.4s',
# really, that should be treated as a belong and we print a string
# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
>&16	beldate-0x7C25B080	x		created: %s,
>&20	beldate-0x7C25B080	x		last modified: %s,
>&24	beldate-0x7C25B080	>0		last backup: %s,
>&28	beldate-0x7C25B080	>0		last checked: %s,
>&40	belong			x		block size: %d,
>&44	belong			x		number of blocks: %d,
>&48	belong			x		free blocks: %d

# I don't think this is really necessary since it doesn't do much and 
# anything with a valid driver descriptor will also have a valid
# partition map
#0		beshort		0x4552		Apple Device Driver data
#>&24		beshort		=1		\b, MacOS

# Is that the partition type a cstring or a pstring? Well, IM says "strings 
# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a 
# cstring. Of course, partitions can contain more than four entries, but 
# what're you gonna do?
0x200		beshort		0x504D		Apple Partition data
>&2		beshort		x		block size: %d
>&48		string		x		first type: %s,
>&12		belong		x		number of blocks: %d,
>(&0x2.S)	beshort		0x504D		
>>&48		string		x		second type: %s
>>&12		belong		x		number of blocks: %d,
>>(&0x2.S)	beshort		0x504D		
>>>&48		string		x		third type: %s
>>>&12		belong		x		number of blocks: %d,
>>>(&0x2.S)	beshort		0x504D		
>>>>&48		string		x		fourth type: %s
>>>>&12		belong		x		number of blocks: %d,
# AFAIK, only the signature is different
0x200		beshort		0x5453		Apple Old Partition data
>&2		beshort		x		block size: %d
>&48		string		x		first type: %s,
>&12		belong		x		number of blocks: %d,
>(&0x2.S)	beshort		0x504D		
>>&48		string		x		second type: %s
>>&12		belong		x		number of blocks: %d,
>>(&0x2.S)	beshort		0x504D		
>>>&48		string		x		third type: %s
>>>&12		belong		x		number of blocks: %d,
>>>(&0x2.S)	beshort		0x504D		
>>>>&48		string		x		fourth type: %s
>>>>&12		belong		x		number of blocks: %d,
@


1.1.1.2.2.3
log
@MFC: file version 3.41

Approved by:	murray(re)
Desired by:		nectar(so)
@
text
@a18 4
# Newer StuffIt archives (grant@@netbsd.org)
0	string		StuffIt			StuffIt Archive
>162	string		>0			: %s

@


