[apple/file_cmds.git] / file / magdir / archive


#------------------------------------------------------------------------------
# archive:  file(1) magic for archive formats (see also "msdos" for self-
#           extracting compressed archives)
#
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
# pre-POSIX "tar" archives are handled in the C code.

# POSIX tar archives
257	string		ustar\0		POSIX tar archive
257	string		ustar\040\040\0	GNU tar archive

# cpio archives
#
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats and thus are strings, not numbers.
0	short		070707		cpio archive
0	short		0143561		byte-swapped cpio archive
0	string		070707		ASCII cpio archive (pre-SVR4 or odc)
0	string		070701		ASCII cpio archive (SVR4 with no CRC)
0	string		070702		ASCII cpio archive (SVR4 with CRC)

# other archives
0	long		0177555		very old archive
0	short		0177555		very old PDP-11 archive
0	long		0177545		old archive
0	short		0177545		old PDP-11 archive
0	long		0100554		apl workspace
0	string		=<ar>		archive

# MIPS archive (needs to go first)
#
0	string	!<arch>\n__________E	MIPS archive
>20	string	U			with MIPS Ucode members
>21	string	L			with MIPSEL members
>21	string	B			with MIPSEB members
>19	string	L			and an EL hash table
>19	string	B			and an EB hash table
>22	string	X			-- out of date

0	string		-h-		Software Tools format archive text

#
# XXX - why are there multiple <ar> thingies?  Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0	string		!<arch>		current ar archive
# 0	long		0x213c6172	archive file
#
# and for SVR1 archives, we have:
#
# 0	string		\<ar>		System V Release 1 ar archive
# 0	string		=<ar>		archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0	string		!<arch>		current ar archive
>8	string		__.SYMDEF	random library
>8	string		debian-split	part of multipart Debian package
>8	string		debian-binary	Debian binary package
>0	belong		=65538		- pre SR9.5
>0	belong		=65539		- post SR9.5
>0	beshort		2		- object archive
>0	beshort		3		- shared library module
>0	beshort		4		- debug break-pointed module
>0	beshort		5		- absolute code program module
0	string		\<ar>		System V Release 1 ar archive
0	string		=<ar>		archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
0	belong		0x65ff0000	VAX 3.0 archive
0	belong		0x3c61723e	VAX 5.0 archive
#
0	long		0x213c6172	archive file
0	lelong		0177555		very old VAX archive
0	leshort		0177555		very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0	lelong		0177545		old VAX archive
>8	string		__.SYMDEF	random library
0	leshort		0177545		old PDP-11 archive
>8	string		__.SYMDEF	random library
#
# From "pdp" (but why a 4-byte quantity?)
#
0	lelong		0x39bed		PDP-11 old archive
0	lelong		0x39bee		PDP-11 4.0 archive

# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
# filename of the first file (null terminated).  Since some types collide
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
0	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
0	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
0	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
0	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
0	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
0	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched

# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
# [GRR:  the original entries collide with ARC, above; replaced with combined
#  version (not tested)]
#0	byte		0x1a		RISC OS archive
#>1	string		archive		(ArcFS format)
0	string		\032archive	RISC OS archive (ArcFS format)

# ARJ archiver (jason@jarthur.Claremont.EDU)
0	leshort		0xea60		ARJ archive data
>5	byte		x		\b, v%d,
>8	byte		&0x04		multi-volume,
>8	byte		&0x10		slash-switched,
>8	byte		&0x20		backup,
>34	string		x		original name: %s,
>7	byte		0		os: MS-DOS
>7	byte		1		os: PRIMOS
>7	byte		2		os: Unix
>7	byte		3		os: Amiga
>7	byte		4		os: Macintosh
>7	byte		5		os: OS/2
>7	byte		6		os: Apple ][ GS
>7	byte		7		os: Atari ST
>7	byte		8		os: NeXT
>7	byte		9		os: VAX/VMS
>3	byte		>0		%d]

# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
#0	string		HA		HA archive data,
#>2	leshort		=1		1 file,
#>2	leshort		>1		%u files,
#>4	byte&0x0f	=0		first is type CPY
#>4	byte&0x0f	=1		first is type ASC
#>4	byte&0x0f	=2		first is type HSC
#>4	byte&0x0f	=0x0e		first is type DIR
#>4	byte&0x0f	=0x0f		first is type SPECIAL

# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
0	string		HPAK		HPACK archive data

# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
0	string		\351,\001JAM\		JAM archive,
>7	string		>\0			version %.4s
>0x26	byte		=0x27			-
>>0x2b	string          >\0			label %.11s,
>>0x27	lelong		x			serial %08x,
>>0x36	string		>\0			fstype %.8s

# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2	string		-lh0-		LHarc 1.x archive data [lh0]
2	string		-lh1-		LHarc 1.x archive data [lh1]
2	string		-lz4-		LHarc 1.x archive data [lz4]
2	string		-lz5-		LHarc 1.x archive data [lz5]
#	[never seen any but the last; -lh4- reported in comp.compression:]
2	string		-lzs-		LHa 2.x? archive data [lzs]
2	string		-lh -		LHa 2.x? archive data [lh ]
2	string		-lhd-		LHa 2.x? archive data [lhd]
2	string		-lh2-		LHa 2.x? archive data [lh2]
2	string		-lh3-		LHa 2.x? archive data [lh3]
2	string		-lh4-		LHa (2.x) archive data [lh4]
2	string		-lh5-		LHa (2.x) archive data [lh5]
>20	byte		x		- header level %d

# RAR archiver (Greg Roelofs, newt@uchicago.edu)
0	string		Rar!		RAR archive data

# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0	string		SQSH		squished archive data (Acorn RISCOS)

# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
# I can't figure out the self-extracting form of these buggers...
0	string		UC2\x1a		UC2 archive data

# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0	string		PK\003\004	Zip archive data
>4	byte		0x09		\b, at least v0.9 to extract
>4	byte		0x0a		\b, at least v1.0 to extract
>4	byte		0x0b		\b, at least v1.1 to extract
>4	byte		0x14		\b, at least v2.0 to extract

# Zoo archiver
20	lelong		0xfdc4a7dc	Zoo archive data
>4	byte		>48		\b, v%c.
>>6	byte		>47		\b%c
>>>7	byte		>47		\b%c
>32	byte		>0		\b, modify: v%d
>>33	byte		x		\b.%d+
>42	lelong		0xfdc4a7dc	\b,
>>70	byte		>0		extract: v%d
>>>71	byte		x		\b.%d+

# Shell archives
10	string		#\ This\ is\ a\ shell\ archive	shell archive text
Commit	Line	Data
440bd198 A	1
	2	#------------------------------------------------------------------------------
	3	# archive: file(1) magic for archive formats (see also "msdos" for self-
	4	# extracting compressed archives)
	5	#
	6	# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
	7	# pre-POSIX "tar" archives are handled in the C code.
	8
	9	# POSIX tar archives
	10	257 string ustar\0 POSIX tar archive
	11	257 string ustar\040\040\0 GNU tar archive
	12
	13	# cpio archives
	14	#
	15	# Yes, the top two "cpio archive" formats are supposed to just be "short".
	16	# The idea is to indicate archives produced on machines with the same
	17	# byte order as the machine running "file" with "cpio archive", and
	18	# to indicate archives produced on machines with the opposite byte order
	19	# from the machine running "file" with "byte-swapped cpio archive".
	20	#
	21	# The SVR4 "cpio(4)" hints that there are additional formats, but they
	22	# are defined as "short"s; I think all the new formats are
	23	# character-header formats and thus are strings, not numbers.
	24	0 short 070707 cpio archive
	25	0 short 0143561 byte-swapped cpio archive
	26	0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
	27	0 string 070701 ASCII cpio archive (SVR4 with no CRC)
	28	0 string 070702 ASCII cpio archive (SVR4 with CRC)
	29
	30	# other archives
	31	0 long 0177555 very old archive
	32	0 short 0177555 very old PDP-11 archive
	33	0 long 0177545 old archive
	34	0 short 0177545 old PDP-11 archive
	35	0 long 0100554 apl workspace
	36	0 string =<ar> archive
	37
	38	# MIPS archive (needs to go first)
	39	#
	40	0 string !<arch>\n__________E MIPS archive
	41	>20 string U with MIPS Ucode members
	42	>21 string L with MIPSEL members
	43	>21 string B with MIPSEB members
	44	>19 string L and an EL hash table
	45	>19 string B and an EB hash table
	46	>22 string X -- out of date
	47
	48	0 string -h- Software Tools format archive text
	49
	50	#
	51	# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
	52	# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
	53	#
	54	# 0 string !<arch> current ar archive
	55	# 0 long 0x213c6172 archive file
	56	#
	57	# and for SVR1 archives, we have:
	58	#
	59	# 0 string \<ar> System V Release 1 ar archive
	60	# 0 string =<ar> archive
	61	#
	62	# XXX - did Aegis really store shared libraries, breakpointed modules,
	63	# and absolute code program modules in the same format as new-style
	64	# "ar" archives?
65	#
66	0 string !<arch> current ar archive
67	>8 string __.SYMDEF random library
68	>8 string debian-split part of multipart Debian package
69	>8 string debian-binary Debian binary package
70	>0 belong =65538 - pre SR9.5
71	>0 belong =65539 - post SR9.5
72	>0 beshort 2 - object archive
73	>0 beshort 3 - shared library module
74	>0 beshort 4 - debug break-pointed module
75	>0 beshort 5 - absolute code program module
76	0 string \<ar> System V Release 1 ar archive
77	0 string =<ar> archive
78	#
79	# XXX - from "vax", which appears to collect a bunch of byte-swapped
80	# thingies, to help you recognize VAX files on big-endian machines;
81	# with "leshort", "lelong", and "string", that's no longer necessary....
82	#
83	0 belong 0x65ff0000 VAX 3.0 archive
84	0 belong 0x3c61723e VAX 5.0 archive
85	#
86	0 long 0x213c6172 archive file
87	0 lelong 0177555 very old VAX archive
88	0 leshort 0177555 very old PDP-11 archive
89	#
90	# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
91	# be a random library (it said 0xff65 rather than 0177545).
92	#
93	0 lelong 0177545 old VAX archive
94	>8 string __.SYMDEF random library
95	0 leshort 0177545 old PDP-11 archive
96	>8 string __.SYMDEF random library
97	#
98	# From "pdp" (but why a 4-byte quantity?)
99	#
100	0 lelong 0x39bed PDP-11 old archive
101	0 lelong 0x39bee PDP-11 4.0 archive
102
103	# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
104	#
105	# The first byte is the magic (0x1a), byte 2 is the compression type for
106	# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
107	# filename of the first file (null terminated). Since some types collide
108	# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
109	# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
110	0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
111	0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
112	0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
113	0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
114	0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
115	0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
116
117	# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
118	# I can't create either SPARK or ArcFS archives so I have not tested this stuff
119	# [GRR: the original entries collide with ARC, above; replaced with combined
120	# version (not tested)]
121	#0 byte 0x1a RISC OS archive
122	#>1 string archive (ArcFS format)
123	0 string \032archive RISC OS archive (ArcFS format)
124
125	# ARJ archiver (jason@jarthur.Claremont.EDU)
126	0 leshort 0xea60 ARJ archive data
127	>5 byte x \b, v%d,
128	>8 byte &0x04 multi-volume,
129	>8 byte &0x10 slash-switched,
130	>8 byte &0x20 backup,
131	>34 string x original name: %s,
132	>7 byte 0 os: MS-DOS
133	>7 byte 1 os: PRIMOS
134	>7 byte 2 os: Unix
135	>7 byte 3 os: Amiga
136	>7 byte 4 os: Macintosh
137	>7 byte 5 os: OS/2
138	>7 byte 6 os: Apple ][ GS
139	>7 byte 7 os: Atari ST
140	>7 byte 8 os: NeXT
141	>7 byte 9 os: VAX/VMS
142	>3 byte >0 %d]
143
144	# HA archiver (Greg Roelofs, newt@uchicago.edu)
145	# This is a really bad format. A file containing HAWAII will match this...
146	#0 string HA HA archive data,
147	#>2 leshort =1 1 file,
148	#>2 leshort >1 %u files,
149	#>4 byte&0x0f =0 first is type CPY
150	#>4 byte&0x0f =1 first is type ASC
151	#>4 byte&0x0f =2 first is type HSC
152	#>4 byte&0x0f =0x0e first is type DIR
153	#>4 byte&0x0f =0x0f first is type SPECIAL
154
155	# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
156	0 string HPAK HPACK archive data
157
158	# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
159	0 string \351,\001JAM\ JAM archive,
160	>7 string >\0 version %.4s
161	>0x26 byte =0x27 -
162	>>0x2b string >\0 label %.11s,
163	>>0x27 lelong x serial %08x,
164	>>0x36 string >\0 fstype %.8s
165
166	# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
167	2 string -lh0- LHarc 1.x archive data [lh0]
168	2 string -lh1- LHarc 1.x archive data [lh1]
169	2 string -lz4- LHarc 1.x archive data [lz4]
170	2 string -lz5- LHarc 1.x archive data [lz5]
171	# [never seen any but the last; -lh4- reported in comp.compression:]
172	2 string -lzs- LHa 2.x? archive data [lzs]
173	2 string -lh - LHa 2.x? archive data [lh ]
174	2 string -lhd- LHa 2.x? archive data [lhd]
175	2 string -lh2- LHa 2.x? archive data [lh2]
176	2 string -lh3- LHa 2.x? archive data [lh3]
177	2 string -lh4- LHa (2.x) archive data [lh4]
178	2 string -lh5- LHa (2.x) archive data [lh5]
179	>20 byte x - header level %d
180
181	# RAR archiver (Greg Roelofs, newt@uchicago.edu)
182	0 string Rar! RAR archive data
183
184	# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
185	0 string SQSH squished archive data (Acorn RISCOS)
186
187	# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
188	# I can't figure out the self-extracting form of these buggers...
189	0 string UC2\x1a UC2 archive data
190
191	# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
192	0 string PK\003\004 Zip archive data
193	>4 byte 0x09 \b, at least v0.9 to extract
194	>4 byte 0x0a \b, at least v1.0 to extract
195	>4 byte 0x0b \b, at least v1.1 to extract
196	>4 byte 0x14 \b, at least v2.0 to extract
197
198	# Zoo archiver
199	20 lelong 0xfdc4a7dc Zoo archive data
200	>4 byte >48 \b, v%c.
201	>>6 byte >47 \b%c
202	>>>7 byte >47 \b%c
203	>32 byte >0 \b, modify: v%d
204	>>33 byte x \b.%d+
205	>42 lelong 0xfdc4a7dc \b,
206	>>70 byte >0 extract: v%d
207	>>>71 byte x \b.%d+
208
209	# Shell archives
210	10 string #\ This\ is\ a\ shell\ archive shell archive text