From: Christos Zoulas Date: Fri, 6 Apr 2012 21:18:09 +0000 (+0000) Subject: Apple on-disk formats. X-Git-Tag: FILE5_12~105 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=918400eb76b9c3f4a840c689fe21f6990dd8ede8;p=file Apple on-disk formats. --- diff --git a/magic/Magdir/apple b/magic/Magdir/apple index bee859e5..847e92ce 100644 --- a/magic/Magdir/apple +++ b/magic/Magdir/apple @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: apple,v 1.23 2009/09/19 16:28:08 christos Exp $ +# $File: apple,v 1.24 2010/11/25 15:00:12 christos Exp $ # apple: file(1) magic for Apple file formats # 0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text @@ -249,3 +249,45 @@ # From: "Nelson A. de Oliveira" # .vdi 4 string innotek\ VirtualBox\ Disk\ Image %s + +# Apple disk partition stuff, strengthen the magic using byte 4 +0 beshort 0x4552 +>4 byte 0 Apple Driver Map +>>2 beshort x \b, blocksize %d +>>4 belong x \b, blockcount %d +>>10 beshort x \b, devtype %d +>>12 beshort x \b, devid %d +>>20 beshort x \b, descriptors %d +# Assume 8 partitions each at a multiple of the sector size. +# We could glean this from the partition descriptors, but they are empty!?!? +>>(2.S*1) indirect \b, contains[@0x%x]: +>>(2.S*2) indirect \b, contains[@0x%x]: +>>(2.S*3) indirect \b, contains[@0x%x]: +>>(2.S*4) indirect \b, contains[@0x%x]: +>>(2.S*5) indirect \b, contains[@0x%x]: +>>(2.S*6) indirect \b, contains[@0x%x]: +>>(2.S*7) indirect \b, contains[@0x%x]: +>>(2.S*8) indirect \b, contains[@0x%x]: + +# Yes, the 3rd and 4th bytes are reserved, but we use them to make the +# magic stronger. +0 belong 0x504d0000 Apple Partition Map +>4 belong x \b, map block count %d +>8 belong x \b, start block %d +>12 belong x \b, block count %d +>16 string >0 \b, name %s +>48 string >0 \b, type %s +>124 string >0 \b, processor %s +>140 string >0 \b, boot arguments %s +>92 belong & 1 \b, valid +>92 belong & 2 \b, allocated +>92 belong & 4 \b, in use +>92 belong & 8 \b, has boot info +>92 belong & 16 \b, readable +>92 belong & 32 \b, writable +>92 belong & 64 \b, pic boot code +>92 belong & 128 \b, chain compatible driver +>92 belong & 256 \b, real driver +>92 belong & 512 \b, chain driver +>92 belong & 1024 \b, mount at startup +>92 belong & 2048 \b, is the startup partition