From 3b0247e3c9ae5854cb0effdaebfa366a25491e4c Mon Sep 17 00:00:00 2001 From: Christos Zoulas Date: Tue, 5 Dec 2017 02:17:48 +0000 Subject: [PATCH] Improve Macbinary format (Joerg Jenderek) --- magic/Magdir/macintosh | 410 +++++++++++++++++++++++++---------------- 1 file changed, 250 insertions(+), 160 deletions(-) diff --git a/magic/Magdir/macintosh b/magic/Magdir/macintosh index e7c0e5e8..249a4d80 100644 --- a/magic/Magdir/macintosh +++ b/magic/Magdir/macintosh @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: macintosh,v 1.27 2017/03/17 21:35:28 christos Exp $ +# $File: macintosh,v 1.28 2017/12/05 02:17:48 christos Exp $ # macintosh description # # BinHex is the Macintosh ASCII-encoded file format (see also "apple") @@ -60,182 +60,272 @@ #>2 string x : %s # MacBinary format (Eric Fischer, enf@pobox.com) +# Update: Joerg Jenderek +# URL: https://en.wikipedia.org/wiki/MacBinary +# Reference: http://files.stairways.com/other/macbinaryii-standard-info.txt # # Unfortunately MacBinary doesn't really have a magic number prior -# to the MacBinary III format. The checksum is really the way to -# do it, but the magic file format isn't up to the challenge. +# to the MacBinary III format. # -# 0 byte 0 -# 1 byte # filename length -# 2 string # filename -# 65 string # file type -# 69 string # file creator -# 73 byte # Finder flags -# 74 byte 0 + +# old version number, must be kept at zero for compatibility +0 byte 0 +# length of filename (must be in the range 1-63) +>1 ubyte >0 +# skip T.PIC.LZ INSTRUMENT.7T INVENTORY +>>1 ubyte <64 +# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)" +# by looking for printable characters at beginning of file name +>>>2 ubelong >0x1F000000 +# zero fill, must be zero for compatibility +>>>>74 byte 0 +# zero fill, must be zero for compatibility +>>>>>82 byte 0 +# MacBinary I test for valid version numbers +>>>>>>122 ubeshort 0 +# additional check for creation date after 1 Jan 1970 ~ 7C25B080h +#>>>>>>>91 ubelong >0x7c25b07F +# additional check for undefined header fields in MacBinary I +#>>>>>>>101 ulong 0 +>>>>>>>0 use mac-bin +# MacBinary II the newer versions begins at 129 +>>>>>>122 ubeshort 0x8181 +>>>>>>>0 use mac-bin +# MacBinary III with MacBinary II to read +>>>>>122 ubeshort 0x8281 +>>>>>>0 use mac-bin + +# display information of MacBinary file +0 name mac-bin +>122 ubyte x MacBinary +# versions for MacBinary II/III +>122 ubyte 129 II +>122 ubyte 130 III +# only in MacBinary III +>>102 string !mBIN with surprising version +!:mime application/x-macbinary +!:apple PSPTBINA +!:ext bin/macbin +# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary +#>1 ubyte >63 \b, name length %u too BIG! +#>122 ubeshort x \b, version 0x%x +# Finder flags if not 0 +# >73 byte !0 \b, flags 0x +# >73 byte =0 +# >>101 byte !0 \b, flags 0x +# # original Finder flags (Bits 8-15) +# >73 byte !0 \b%x +# # finder flags, bits 0-7 +# >101 byte !0 \b%x +>73 byte &0x01 \b, inited +>73 byte &0x02 \b, changed +>73 byte &0x04 \b, busy +>73 byte &0x08 \b, bozo +>73 byte &0x10 \b, system +>73 byte &0x20 \b, bundle +>73 byte &0x40 \b, invisible +>73 byte &0x80 \b, locked + # 75 beshort # vertical posn in window +#>75 beshort !0 \b, v.pos %u # 77 beshort # horiz posn in window +#>77 beshort !0 \b, h.pos %u # 79 beshort # window or folder ID -# 81 byte # protected? -# 82 byte 0 -# 83 belong # length of data segment -# 87 belong # length of resource segment -# 91 belong # file creation date -# 95 belong # file modification date -# 99 beshort # length of comment after resource -# 101 byte # new Finder flags -# 102 string mBIN # (only in MacBinary III) -# 106 byte # char. code of file name -# 107 byte # still more Finder flags -# 116 belong # total file length +>79 ubeshort !0 \b, ID 0x%x +# protected flag +>81 byte !0 \b, protected 0x%x +# length of comment after resource +>99 ubeshort !0 \b, comment length %u +# char. code of file name +>106 ubyte !0 \b, char. code 0x%x +# still more Finder flags +>107 ubyte !0 \b, more flags 0x%x +# length of total files when unpacked only used when pack and unpack on the fly +>116 ubelong !0 \b, total length %u # 120 beshort # length of add'l header -# 122 byte 129 # for MacBinary II -# 122 byte 130 # for MacBinary III -# 123 byte 129 # minimum version that can read fmt +>120 ubeshort !0 \b, 2nd header length %u # 124 beshort # checksum -# -# This attempts to use the version numbers as a magic number, requiring -# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second -# be 0x81. This works for the files I have, but maybe not for everyone's. +#>124 ubeshort !0 \b, CRC 0x%x +# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080 +>91 beldate-0x7C25B080 x \b, %s +# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow +>91 ubelong <0x7c25b080 INVALID date +#>91 belong-0x7C25B080 x \b, DEBUG DATE %d +# last modified date +>95 beldate-0x7C25B080 x \b, modified %s +# Apple creator+typ if not null +# file creator (normally expressed as four characters) +>69 ulong !0 \b, creator +# instead 4 character code display full creator name +>>69 use apple-creator +# file type (normally expressed as four characters) +>65 ulong !0 \b, type +>>65 use apple-type +# length of data segment +>83 ubelong !0 \b, %u bytes +# filename (in the range 1-63) +>1 pstring x "%s" +# print 1 space and then at offset 128 inspect data fork content if it has one +>83 ubelong !0 \b +>>128 indirect x +# Afterwards resource fork if length of resource segment not zero +>87 ubelong !0 +# calculate resource fork offset +>>83 ubelong+128 x \b, at 0x%x +# length of resource segment +>>87 ubelong !0 %u bytes +>>(83.S+128) ubequad x resource +# further resource fork content inspection +>>>&-8 indirect x -# Unfortunately, this magic is quite weak - MPi -#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data - -# MacBinary I doesn't have the version number field at all, but MacBinary II -# has been in use since 1987 so I hope there aren't many really old files -# floating around that this will miss. The original spec calls for using -# the nulls in 0, 74, and 82 as the magic number. -# -# Another possibility, that would also work for MacBinary I, is to use -# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will -# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, -# and that 74 will be 0. So something like -# -# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data -# -# >73 byte&0x01 0x01 \b, inited -# >73 byte&0x02 0x02 \b, changed -# >73 byte&0x04 0x04 \b, busy -# >73 byte&0x08 0x08 \b, bozo -# >73 byte&0x10 0x10 \b, system -# >73 byte&0x10 0x20 \b, bundle -# >73 byte&0x10 0x40 \b, invisible -# >73 byte&0x10 0x80 \b, locked +# Apple Type/Creator Database +# URL: https://en.wikipedia.org/wiki/Type_code +# Reference: http://www.lacikam.co.il/tcdb/ +# http://www.macdisk.com/macsigen.php +# Note: classic Mac OS files have two 4 character codes for type and creator. +# Thereby the Finder attach documents types to applications. #>65 string x \b, type "%4.4s" -#>65 string 8BIM (PhotoShop) -#>65 string ALB3 (PageMaker 3) -#>65 string ALB4 (PageMaker 4) -#>65 string ALT3 (PageMaker 3) -#>65 string APPL (application) -#>65 string AWWP (AppleWorks word processor) -#>65 string CIRC (simulated circuit) -#>65 string DRWG (MacDraw) -#>65 string EPSF (Encapsulated PostScript) -#>65 string FFIL (font suitcase) -#>65 string FKEY (function key) -#>65 string FNDR (Macintosh Finder) -#>65 string GIFf (GIF image) -#>65 string Gzip (GNU gzip) -#>65 string INIT (system extension) -#>65 string LIB\ (library) -#>65 string LWFN (PostScript font) -#>65 string MSBC (Microsoft BASIC) -#>65 string PACT (Compact Pro archive) -#>65 string PDF\ (Portable Document Format) -#>65 string PICT (picture) -#>65 string PNTG (MacPaint picture) -#>65 string PREF (preferences) -#>65 string PROJ (Think C project) -#>65 string QPRJ (Think Pascal project) -#>65 string SCFL (Defender scores) -#>65 string SCRN (startup screen) -#>65 string SITD (StuffIt Deluxe) -#>65 string SPn3 (SuperPaint) -#>65 string STAK (HyperCard stack) -#>65 string Seg\ (StuffIt segment) -#>65 string TARF (Unix tar archive) -#>65 string TEXT (ASCII) -#>65 string TIFF (TIFF image) -#>65 string TOVF (Eudora table of contents) -#>65 string WDBN (Microsoft Word word processor) -#>65 string WORD (MacWrite word processor) -#>65 string XLS\ (Microsoft Excel) -#>65 string ZIVM (compress (.Z)) -#>65 string ZSYS (Pre-System 7 system file) -#>65 string acf3 (Aldus FreeHand) -#>65 string cdev (control panel) -#>65 string dfil (Desk Accessory suitcase) -#>65 string libr (library) -#>65 string nX^d (WriteNow word processor) -#>65 string nX^w (WriteNow dictionary) -#>65 string rsrc (resource) -#>65 string scbk (Scrapbook) -#>65 string shlb (shared library) -#>65 string ttro (SimpleText read-only) -#>65 string zsys (system file) +# display information about apple type +0 name apple-type +>0 string 8BIM PhotoShop +>0 string ALB3 PageMaker 3 +>0 string ALB4 PageMaker 4 +>0 string ALT3 PageMaker 3 +>0 string APPL application +>0 string AWWP AppleWorks word processor +>0 string CIRC simulated circuit +>0 string DRWG MacDraw +>0 string EPSF Encapsulated PostScript +>0 string FFIL font suitcase +>0 string FKEY function key +>0 string FNDR Macintosh Finder +>0 string GIFf GIF image +>0 string Gzip GNU gzip +>0 string INIT system extension +>0 string LIB\ library +>0 string LWFN PostScript font +>0 string MSBC Microsoft BASIC +>0 string PACT Compact Pro archive +>0 string PDF\ Portable Document Format +>0 string PICT picture +>0 string PNTG MacPaint picture +>0 string PREF preferences +>0 string PROJ Think C project +>0 string QPRJ Think Pascal project +>0 string SCFL Defender scores +>0 string SCRN startup screen +>0 string SITD StuffIt Deluxe +>0 string SPn3 SuperPaint +>0 string STAK HyperCard stack +>0 string Seg\ StuffIt segment +>0 string TARF Unix tar archive +>0 string TEXT ASCII +>0 string TIFF TIFF image +>0 string TOVF Eudora table of contents +>0 string WDBN Microsoft Word word processor +>0 string WORD MacWrite word processor +>0 string XLS\ Microsoft Excel +>0 string ZIVM compress (.Z) +>0 string ZSYS Pre-System 7 system file +>0 string acf3 Aldus FreeHand +>0 string cdev control panel +>0 string dfil Desk Accessory suitcase +>0 string libr library +>0 string nX^d WriteNow word processor +>0 string nX^w WriteNow dictionary +>0 string rsrc resource +>0 string scbk Scrapbook +>0 string shlb shared library +>0 string ttro SimpleText read-only +>0 string zsys system file + +# additional types added in Dec 2017 +>0 string BINA binary file +>0 string BMPp BMP image +>0 string JPEG JPEG image +#>0 string W4BN Microsoft Word x.y word processor? +# if type name is not known display 4 character identifier +>0 default x +>>0 string x '%4.4s' #>69 string x \b, creator "%4.4s" -# Somewhere, Apple has a repository of registered Creator IDs. These are +# Now Apple has no repository of registered Creator IDs any more. These are # just the ones that I happened to have files from and was able to identify. -#>69 string 8BIM (Adobe Photoshop) -#>69 string ALD3 (PageMaker 3) -#>69 string ALD4 (PageMaker 4) -#>69 string ALFA (Alpha editor) -#>69 string APLS (Apple Scanner) -#>69 string APSC (Apple Scanner) -#>69 string BRKL (Brickles) -#>69 string BTFT (BitFont) -#>69 string CCL2 (Common Lisp 2) -#>69 string CCL\ (Common Lisp) -#>69 string CDmo (The Talking Moose) -#>69 string CPCT (Compact Pro) -#>69 string CSOm (Eudora) -#>69 string DMOV (Font/DA Mover) -#>69 string DSIM (DigSim) -#>69 string EDIT (Macintosh Edit) -#>69 string ERIK (Macintosh Finder) -#>69 string EXTR (self-extracting archive) -#>69 string Gzip (GNU gzip) -#>69 string KAHL (Think C) -#>69 string LWFU (LaserWriter Utility) -#>69 string LZIV (compress) -#>69 string MACA (MacWrite) -#>69 string MACS (Macintosh operating system) -#>69 string MAcK (MacKnowledge terminal emulator) -#>69 string MLND (Defender) -#>69 string MPNT (MacPaint) -#>69 string MSBB (Microsoft BASIC (binary)) -#>69 string MSWD (Microsoft Word) -#>69 string NCSA (NCSA Telnet) -#>69 string PJMM (Think Pascal) -#>69 string PSAL (Hunt the Wumpus) -#>69 string PSI2 (Apple File Exchange) -#>69 string R*ch (BBEdit) -#>69 string RMKR (Resource Maker) -#>69 string RSED (Resource Editor) -#>69 string Rich (BBEdit) -#>69 string SIT! (StuffIt) -#>69 string SPNT (SuperPaint) -#>69 string Unix (NeXT Mac filesystem) -#>69 string VIM! (Vim editor) -#>69 string WILD (HyperCard) -#>69 string XCEL (Microsoft Excel) -#>69 string aCa2 (Fontographer) -#>69 string aca3 (Aldus FreeHand) -#>69 string dosa (Macintosh MS-DOS file system) -#>69 string movr (Font/DA Mover) -#>69 string nX^n (WriteNow) -#>69 string pdos (Apple ProDOS file system) -#>69 string scbk (Scrapbook) -#>69 string ttxt (SimpleText) -#>69 string ufox (Foreign File Access) - -# Just in case... - -102 string mBIN MacBinary III data with surprising version number +# display information about apple creator +0 name apple-creator +>0 string 8BIM Adobe Photoshop +>0 string ALD3 PageMaker 3 +>0 string ALD4 PageMaker 4 +>0 string ALFA Alpha editor +>0 string APLS Apple Scanner +>0 string APSC Apple Scanner +>0 string BRKL Brickles +>0 string BTFT BitFont +>0 string CCL2 Common Lisp 2 +>0 string CCL\ Common Lisp +>0 string CDmo The Talking Moose +>0 string CPCT Compact Pro +>0 string CSOm Eudora +>0 string DMOV Font/DA Mover +>0 string DSIM DigSim +>0 string EDIT Macintosh Edit +>0 string ERIK Macintosh Finder +>0 string EXTR self-extracting archive +>0 string Gzip GNU gzip +>0 string KAHL Think C +>0 string LWFU LaserWriter Utility +>0 string LZIV compress +>0 string MACA MacWrite +>0 string MACS Macintosh operating system +>0 string MAcK MacKnowledge terminal emulator +>0 string MLND Defender +>0 string MPNT MacPaint +>0 string MSBB Microsoft BASIC (binary) +>0 string MSWD Microsoft Word +>0 string NCSA NCSA Telnet +>0 string PJMM Think Pascal +>0 string PSAL Hunt the Wumpus +#>0 string PSI2 Apple File Exchange +>0 string R*ch BBEdit +>0 string RMKR Resource Maker +>0 string RSED Resource Editor +>0 string Rich BBEdit +>0 string SIT! StuffIt +>0 string SPNT SuperPaint +>0 string Unix NeXT Mac filesystem +>0 string VIM! Vim editor +>0 string WILD HyperCard +>0 string XCEL Microsoft Excel +>0 string aCa2 Fontographer +>0 string aca3 Aldus FreeHand +>0 string dosa Macintosh MS-DOS file system +>0 string movr Font/DA Mover +>0 string nX^n WriteNow +>0 string pdos Apple ProDOS file system +>0 string scbk Scrapbook +>0 string ttxt SimpleText +>0 string ufox Foreign File Access +# additional creators added in Dec 2017 +# Claris/Apple Works +>0 string BOBO Apple Works +# CU-SeeMe_0.87b3_(68K).bin +#>0 string CUce bar +>0 string PSPT Apple File Exchange +# Disk_Copy_4.2.sea.bin +#>0 string NCse foo +# probably StuffIt/Aladdin by Smith Micro Software, Inc. +>0 string STi0 stuffit +# MacGzip-1.1.3.sea.bin +#>0 string aust bar +# D-Disk_Copy_6.3.3.smi.bin +>0 string oneb Disk Copy Self Mounting +# if creator name is not known display 4 character identifier +>0 default x +>>0 string x '%4.4s' # sas magic from Bruce Foster (bef@nwu.edu) # -- 2.50.1