#------------------------------------------------------------------------------
# $File: apple,v 1.48 2023/05/01 14:20:21 christos Exp $
# apple:  file(1) magic for Apple file formats
#
0       search/1/t      FiLeStArTfIlEsTaRt      binscii (apple ][) text
0       string          \x0aGL                  Binary II (apple ][) data
0       string          \x76\xff                Squeezed (apple ][) data
0       string          NuFile                  NuFile archive (apple ][) data
0       string          N\xf5F\xe9l\xe5         NuFile archive (apple ][) data
0       belong          0x00051600              AppleSingle encoded Macintosh file
0       belong          0x00051607              AppleDouble encoded Macintosh file

# Type: Apple Emulator A2R format
# From: Greg Wildman <[email protected]>
# Ref: https://applesaucefdc.com/a2r2-reference/
# Ref: https://applesaucefdc.com/a2r/
0       string          A2R
>3      string          \x31\xFF\x0A\x0D\x0A    Applesauce A2R 1.x Disk Image
>3      string          \x32\xFF\x0A\x0D\x0A    Applesauce A2R 2.x Disk Image
>3      string          \x33\xFF\x0A\x0D\x0A    Applesauce A2R 3.x Disk Image
>8      string          INFO
>>49    byte            01                      \b, 5.25″ SS 40trk
>>49    byte            02                      \b, 3.5″ DS 80trk
>>49    byte            03                      \b, 5.25″ DS 80trk
>>49    byte            04                      \b, 5.25″ DS 40trk
>>49    byte            05                      \b, 3.5″ DS 80trk
>>49    byte            06                      \b, 8″ DS
>>50    byte            01                      \b, write protected
>>51    byte            01                      \b, cross track synchronized
>>17    string/T        x                       \b, %.32s

# Type: Apple Emulator WOZ format
# From: Greg Wildman <[email protected]>
# Ref: https://applesaucefdc.com/woz/reference/
# Ref: https://applesaucefdc.com/woz/reference2/
0       string          WOZ
>3      string          \x31\xFF\x0A\x0D\x0A    Apple ][ WOZ 1.0 Disk Image
>3      string          \x32\xFF\x0A\x0D\x0A    Apple ][ WOZ 2.0 Disk Image
>12     string          INFO
>>21    byte            01                      \b, 5.25 inch
>>21    byte            02                      \b, 3.5 inch
>>22    byte            01                      \b, write protected
>>23    byte            01                      \b, cross track synchronized
>>25    string/T        x                       \b, %.32s

# Type: Apple Macintosh Emulator MOOF format
# From: Greg Wildman <[email protected]>
# Ref: https://applesaucefdc.com/moof-reference/
0       string          MOOF
>4      string          \xFF\x0A\x0D\x0A        Apple Macintosh MOOF Disk Image
>12     string          INFO
>>21    byte            01                      \b, SSDD GCR (400K)
>>21    byte            02                      \b, DSDD GCR (800K)
>>21    byte            03                      \b, DSHD MFM (1.44M)
>>22    byte            01                      \b, write protected
>>23    byte            01                      \b, cross track synchronized
>>25    string/T        x                       \b, %.32s

# Type: Apple Emulator disk images
# From: Greg Wildman <[email protected]>
# ProDOS boot loader?
0               string  \x01\x38\xB0\x03\x4C    Apple ProDOS Image
# Detect Volume Directory block ($02)
>0x400          string  \x00\x00\x03\x00
>>0x404         byte    &0xF0
>>>0x405        string  x                       \b, Volume /%s
>>>0x429        uleshort        x               \b, %u Blocks
# ProDOS ordered ?
>0xb00          string  \x00\x00\x03\x00
>>0xb04         byte    &0xF0
>>>0xb05        string  x                       \b, Volume /%s
>>>0xb29        uleshort        x               \b, %u Blocks
#
# Proboot HD
0               string  \x01\x8A\x48\xD8\x2C\x82\xC0\x8D\x0E\xC0\x8D\x0C        Apple ProDOS ProBoot Image
>0x400          string  \x00\x00\x03\x00
>>0x404         byte    &0xF0
>>>0x405        string  x                       \b, Volume /%s
>>>0x429        uleshort        x               \b, %u Blocks
>0xb00          string  \x00\x00\x03\x00
>>0xb04         byte    &0xF0
>>>0xb05        string  x                       \b, Volume /%s
>>>0xb29        uleshort        x               \b, %u Blocks
0               string  \x01\xA8\x8A\x20\x7B\xF8\x29\x07\x09\xC0\x99\x30        Apple ProDOS ProBoot Image
>0x400          string  \x00\x00\x03\x00
>>0x404         byte    &0xF0
>>>0x405        string  x                       \b, Volume /%s
>>>0x429        uleshort        x               \b, %u Blocks
>0xb00          string  \x00\x00\x03\x00
>>0xb04         byte    &0xF0
>>>0xb05        string  x                       \b, Volume /%s
>>>0xb29        uleshort        x               \b, %u Blocks
0               string  \x01\x4A\xD0\x34\xE6\x3D\x8A\x20\x7B\xF8\x09\xC0        Apple ProDOS ProBoot Image
>0x400          string  \x00\x00\x03\x00
>>0x404         byte    &0xF0
>>>0x405        string  x                       \b, Volume /%s
>>>0x429        uleshort        x               \b, %u Blocks
>0xb00          string  \x00\x00\x03\x00
>>0xb04         byte    &0xF0
>>>0xb05        string  x                       \b, Volume /%s
>>>0xb29        uleshort        x               \b, %u Blocks
#
# ProDOS formatted
0               string  \x01\xBD\x88\xC0\x20\x2F\xFB\x20\x58\xFC\x20\x40        Apple ProDOS Unbootable Image
>0x400          string  \x00\x00\x03\x00
>>0x404         byte    &0xF0
>>>0x405        string  x                       \b, Volume /%s
>>>0x429        uleshort        x               \b, %u Blocks
>0xb00          string  \x00\x00\x03\x00
>>0xb04         byte    &0xF0
>>>0xb05        string  x                       \b, Volume /%s
>>>0xb29        uleshort        x               \b, %u Blocks
0               string  \x01\x38\xB0\x03\x4C\x1C\x09\x78\x86\x43\xC9\x03        Apple ProDOS Unbootable Image
>0x400          string  \x00\x00\x03\x00
>>0x404         byte    &0xF0
>>>0x405        string  x                       \b, Volume /%s
>>>0x429        uleshort        x               \b, %u Blocks
>0xb00          string  \x00\x00\x03\x00
>>0xb04         byte    &0xF0
>>>0xb05        string  x                       \b, Volume /%s
>>>0xb29        uleshort        x               \b, %u Blocks
#
# DOS3 boot loader
0               string  \x01\xA5\x27\xC9\x09\xD0
>0x11001        byte    0x11
>>0x11003       ubyte   x               Apple DOS 3.%u Image
>>0x11006       ubyte   x               \b, Volume #%03u
>>0x11034       ubyte   x               \b, %u Tracks
>>0x11035       ubyte   x               \b, %u Sectors
>>0x11036       uleshort        x               \b, %u bytes per sector
#
# DOS3 uninitialized disk
0               string  \x01\xA6\x2B\xBD\x88\xC0\x8A\x4A\x4A
>0x11001        byte    0x11
>>0x11003       ubyte   x       Apple DOS 3.%u Unbootable Image
>>>0x11006      ubyte   x               \b, Volume #%03u
>>>0x11034      ubyte   x               \b, %u Tracks
>>>0x11035      ubyte   x               \b, %u Sectors
>>>0x11036      uleshort        x               \b, %u bytes per sector
#
# Pascal boot loader?
0               string  \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD
>0xd6           pstring SYSTEM.APPLE
>>0xb00         leshort 0x0000
>>>0xb04        leshort 0x0000          Apple Pascal Image
>>>>0xb06       pstring x               \b, Volume %s:
>>>>0xb0e       leshort x               \b, %u Blocks
>>>>0xb10       leshort x               \b, %u Files
#
# Diversi Dos boot loader?
0               string  \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD
>0x11001        string  \x11\x0F\x03    Apple Diversi Dos Image
>>0x11006       byte    x               \b, Volume %u
>>0x11034       byte    x               \b, %u Tracks
>>0x11035       byte    x               \b, %u Sectors
>>0x11036       leshort x               \b, %u bytes per sector

# Type: Apple Emulator 2IMG format
# From: Radek Vokal <[email protected]>
# Update: Greg Wildman <[email protected]>
0               string  2IMG            Apple ][ 2IMG Disk Image
>4              clear   x
>4              string  XGS!            \b, XGS
>4              string  CTKG            \b, Catakig
>4              string  ShIm            \b, Sheppy's ImageMaker
>4              string  SHEP            \b, Sheppy's ImageMaker
>4              string  WOOF            \b, Sweet 16
>4              string  B2TR            \b, Bernie ][ the Rescue
>4              string  \!nfc           \b, ASIMOV2
>4              string  \>BD\<          \b, Brutal Deluxe's Cadius
>4              string  CdrP            \b, CiderPress
>4              string  Vi][            \b, Virtual ][
>4              string  PRFS            \b, ProFUSE
>4              string  FISH            \b, FishWings
>4              string  RVLW            \b, Revival for Windows
>4              default x
>>4             string  x               \b, Creator tag "%-4.4s"
>0xc            byte    00              \b, DOS 3.3 sector order
>>0x10          byte    00              \b, Volume 254
>>0x10          byte&0x7f x             \b, Volume %u
>0xc            byte    01              \b, ProDOS sector order
# Detect Volume Directory block ($02) + 2mg header offset
>>0x440         string  \x00\x00\x03\x00
>>>0x444        byte    &0xF0
>>>>0x445       string  x               \b, Volume /%s
>>>>0x469       uleshort        x               \b, %u Blocks
>0xc            byte    02              \b, NIB data

# Type: Peter Ferrie QBoot
# From: Greg Wildman <[email protected]>
# Ref: https://github.com/peterferrie/qboot
0       string  \x01\x4A\xA8\x69\x0F\x85\x27\xC9
>8      string  \x12\xF0\x10\xE6\x3D\x86\xDA\x8A        Apple ][ QBoot Image

# Type: Peter Ferrie 0Boot
# From: Greg Wildman <[email protected]>
# Ref: https://github.com/peterferrie/0boot
0       string  \x01\x4A\xA8\x69\x0F\x85\x27\xC9
>8      string  \x12\xF0\x10\xE6\x3D\x86\xDA\x8A        Apple ][ 0Boot Image

# Different proprietary boot sectors
0       string  \x01\x0F\x21\x74\x00\x01\x6B\x00\x02\x30\x81\x5D        Apple ][ Disk Image
0       string  \x01\x20\x58\xFC\xA2\x00\x8E\x78\x04\x8E\xF4\x03        Apple ][ Disk Image
0       string  \x01\x20\x58\xFC\xAD\x51\xC0\xAD\x54\xC0\xA6\x2B        Apple ][ Disk Image
0       string  \x01\x20\x89\xFE\x20\x93\xFE\xA6\x2B\xBD\x88\xC0        Apple ][ Disk Image
0       string  \x01\x20\x93\xFE\x20\x89\xFE\x4C\x25\x08\x68\x85        Apple ][ Disk Image
0       string  \x01\x20\x93\xFE\x20\x89\xFE\x4C\x2D\x08\x68\x85        Apple ][ Disk Image
0       string  \x01\x38\x90\x2A\xC9\x01\xF0\x33\xA8\xC8\xC0\x10        Apple ][ Disk Image
0       string  \x01\x38\xB0\x03\x4C\x32\xA1\x87\x43\xC9\x03\x08        Apple ][ Disk Image
0       string  \x01\x4C\x04\x08\xA9\x2A\x8D\x02\x08\x86\x2B\xEE        Apple ][ Disk Image
0       string  \x01\x4C\x60\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A        Apple ][ Disk Image
0       string  \x01\x4C\x92\x08\x01\x08\xA2\x00\xB5\x00\x9D\x00        Apple ][ Disk Image
0       string  \x01\x4C\xB3\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A        Apple ][ Disk Image
0       string  \x01\x8D\xFB\x03\x8E\xFC\x03\x8C\xFD\x03\x8A\x29        Apple ][ Disk Image
0       string  \x01\xA2\xFF\x9A\xD8\x20\x20\x08\x20\x34\x08\xAD        Apple ][ Disk Image
0       string  \x01\xA5\x27\xBD\x88\xC0\x2C\x10\xC0\xA2\x00\xA9        Apple ][ Disk Image
0       string  \x01\xA5\x2B\xAE\x51\xC0\xEA\xAA\xBD\x88\xC0\x20        Apple ][ Disk Image
0       string  \x01\xA6\x27\xBD\x0B\x08\x48\xBD\x0A\x08\x48\x85        Apple ][ Disk Image
0       string  \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x01\x85        Apple ][ Disk Image
0       string  \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x25\x85        Apple ][ Disk Image
0       string  \x01\xA8\xC0\x0F\x90\x16\xF0\x12\xA0\xFF\x18\xAD        Apple ][ Disk Image
0       string  \x01\xA9\x00\x85\xF0\xA9\x04\x85\xF1\xA0\x00\xA9        Apple ][ Disk Image
0       string  \x01\xA9\x5C\x8D\xF2\x03\xA9\xC6\x8D\xF3\x03\x49        Apple ][ Disk Image
0       string  \x01\xA9\x60\x8D\x01\x08\x20\x2F\xFB\x20\x58\xFC        Apple ][ Disk Image
0       string  \x01\xA9\x60\x8D\x01\x08\x20\x49\x08\xA9\x0A\x85        Apple ][ Disk Image
0       string  \x01\xA9\x60\x8D\x01\x08\x2C\x82\xC0\xBD\x88\xC0        Apple ][ Disk Image
0       string  \x01\xA9\x60\x8D\x01\x08\x86\x43\x8A\x4A\x4A\x4A        Apple ][ Disk Image
0       string  \x01\xA9\x60\x8D\x01\x08\xA2\x00\x86\xFF\xB5\x00        Apple ][ Disk Image
0       string  \x01\xA9\x60\x8D\x01\x08\xA2\x00\xB5\x00\x9D\x00        Apple ][ Disk Image
0       string  \x01\xA9\x60\x8D\x01\x08\xA9\xB2\x8D\xF2\x03\xA9        Apple ][ Disk Image
0       string  \x01\xA9\x60\x8D\x01\x08\xA9\xFF\x8D\xF3\x03\x8D        Apple ][ Disk Image
0       string  \x01\xAC\x00\x08\xF0\x19\xB9\x30\x08\x85\x3D\xCE        Apple ][ Disk Image
0       string  \x01\xAC\x23\x08\x30\x2E\xB9\x24\x08\x85\x3D\xCE        Apple ][ Disk Image
0       string  \x01\xAD\x00\x08\xC9\x09\xB0\x20\x69\x02\x8D\x00        Apple ][ Disk Image
0       string  \x01\xB0\x00\xA9\x3C\x8D\x02\x08\x86\x2B\x8A\x4A        Apple ][ Disk Image
0       string  \x01\xB0\x00\xA9\x3C\x8D\x02\x08\xA9\xF5\x8D\xF2        Apple ][ Disk Image
0       string  \x01\xB0\x00\xA9\x3F\x8D\x02\x08\x86\x2B\x8E\xF4        Apple ][ Disk Image
0       string  \x01\xB0\x00\xA9\x48\x8D\x02\x08\x86\x2B\x8E\xF4        Apple ][ Disk Image
0       string  \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x09\xC0\x8D        Apple ][ Disk Image
0       string  \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x8D\x2F\x08        Apple ][ Disk Image
0       string  \x01\xD8\x2C\x81\xC0\xA9\x60\x4D\x58\xFF\xD0\xFE        Apple ][ Disk Image
0       string  \x01\xD8\x78\xBD\x88\xC0\xA9\xFD\x85\x37\x85\x39        Apple ][ Disk Image
0       string  \x01\xE0\x60\xF0\x03\x4C\x16\x09\xAD\x00\x08\xC9        Apple ][ Disk Image
0       string  \x01\xE0\x60\xF0\x03\x4C\xCB\x08\xAD\x00\x08\xC9        Apple ][ Disk Image
0       string  \x01\xE0\x60\xF0\x03\x4C\xEE\x08\xAD\x00\x08\xC9        Apple ][ Disk Image
0       string  \x01\xE0\x60\xF0\x03\x4C\xEF\x08\xAD\x00\x08\xC9        Apple ][ Disk Image
0       string  \x01\xE0\x70\xB0\x04\xE0\x40\xB0\x39\xBD\x88\xC0        Apple ][ Disk Image
0       string  \x01\xEA\x8D\xF4\x03\xA9\x60\x9D\x88\xC0\x8D\x51        Apple ][ Disk Image

# magic for Newton PDA package formats
# from Ruda Moura <[email protected]>
0       string  package0        Newton package, NOS 1.x,
>12     belong  &0x80000000     AutoRemove,
>12     belong  &0x40000000     CopyProtect,
>12     belong  &0x10000000     NoCompression,
>12     belong  &0x04000000     Relocation,
>12     belong  &0x02000000     UseFasterCompression,
>16     belong  x               version %d

0       string  package1        Newton package, NOS 2.x,
>12     belong  &0x80000000     AutoRemove,
>12     belong  &0x40000000     CopyProtect,
>12     belong  &0x10000000     NoCompression,
>12     belong  &0x04000000     Relocation,
>12     belong  &0x02000000     UseFasterCompression,
>16     belong  x               version %d

0       string  package4        Newton package,
>8      byte    8               NOS 1.x,
>8      byte    9               NOS 2.x,
>12     belong  &0x80000000     AutoRemove,
>12     belong  &0x40000000     CopyProtect,
>12     belong  &0x10000000     NoCompression,

# The following entries for the Apple II are for files that have
# been transferred as raw binary data from an Apple, without having
# been encapsulated by any of the above archivers.
#
# In general, Apple II formats are hard to identify because Apple DOS
# and especially Apple ProDOS have strong typing in the file system and
# therefore programmers never felt much need to include type information
# in the files themselves.
#
# Eric Fischer <[email protected]>

# AppleWorks word processor:
# URL: https://en.wikipedia.org/wiki/AppleWorks
# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
# Update: Joerg Jenderek
# NOTE:
# The "O" is really the magic number, but that's so common that it's
# necessary to check the tab stops that follow it to avoid false positives.
# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
# the newer AppleWorks is from claris with extension CWK
4       string          O
# test for unused bits of zoom- , paginated-boolean bytes
>84     ubequad         ^0x00Fe00000000Fe00
# look for tabstop definitions "=" no tab, "|" no tab
# "<" left tab,"^" center tab,">" right tab, "." decimal tab,
# unofficial "!" other , "\x8a" other
# official only if SFMinVers is nonzero
>>5     regex/s [=.<>|!^\x8a]{79}       AppleWorks Word Processor
# AppleWorks Word Processor File (Apple II)
# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data"
# application/x-appleworks is mime type for claris version with cwk extension
!:mime  application/x-appleworks3
# http://home.earthlink.net/~hughhood/appleiiworksenvoy/
# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
# $70 $1A $F8 $FF is this the apple type ?
#:apple pdosp^Z\xf8\xff
!:ext awp
# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
>>>183  ubyte           30      3.0
>>>183  ubyte           !30
>>>>183 ubyte           !0      %#x
# usual tabstop start sequence "=====<"
>>>5    string          x       \b, tabstop ruler "%6.6s"
# tabstop ruler
#>>>5   string          >\0     \b, tabstops "%-79s"
# zoom switch
>>>85     byte&0x01     >0      \b, zoomed
# whether paginated
>>>90     byte&0x01     >0      \b, paginated
# contains any mail-merge commands
>>>92     byte&0x01     >0      \b, with mail merge
# left margin in 1/10 inches ( normally 0 or 10 )
>>>91   ubyte           >0
>>>>91  ubyte           x       \b, %d/10 inch left margin

# AppleWorks database:
#
# This isn't really a magic number, but it's the closest thing to one
# that I could find.  The 1 and 2 really mean "order in which you defined
# categories" and "left to right, top to bottom," respectively; the D and R
# mean that the cursor should move either down or right when you press Return.

#30     string          \x01D   AppleWorks database data
#30     string          \x02D   AppleWorks database data
#30     string          \x01R   AppleWorks database data
#30     string          \x02R   AppleWorks database data

# AppleWorks spreadsheet:
#
# Likewise, this isn't really meant as a magic number.  The R or C means
# row- or column-order recalculation; the A or M means automatic or manual
# recalculation.

#131    string          RA      AppleWorks spreadsheet data
#131    string          RM      AppleWorks spreadsheet data
#131    string          CA      AppleWorks spreadsheet data
#131    string          CM      AppleWorks spreadsheet data

# Applesoft BASIC:
#
# This is incredibly sloppy, but will be true if the program was
# written at its usual memory location of 2048 and its first line
# number is less than 256.  Yuck.
# update by Joerg Jenderek at Feb 2013

# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
#0       belong&0xff00ff 0x80000 Applesoft BASIC program data
0       belong&0x00ff00ff       0x00080000
# assuming that line number must be positive
>2      leshort                 >0              Applesoft BASIC program data, first line number %d
#>2     leshort         x       \b, first line number %d

# ORCA/EZ assembler:
#
# This will not identify ORCA/M source files, since those have
# some sort of date code instead of the two zero bytes at 6 and 7
# XXX Conflicts with ELF
#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
#>5      byte                    x               \b, build number %d

# Broderbund Fantavision
#
# I don't know what these values really mean, but they seem to recur.
# Will they cause too many conflicts?

# Probably :-)
#2      belong&0xFF00FF         0x040008        Fantavision movie data

# Some attempts at images.
#
# These are actually just bit-for-bit dumps of the frame buffer, so
# there's really no reasonably way to distinguish them except for their
# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
# or, occasionally, 8184.
#
# Nevertheless this will manage to catch a lot of images that happen
# to have a solid-colored line at the bottom of the screen.

# GRR: Magic too weak
#8144   string  \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F        Apple II image with white background
#8144   string  \x55\x2A\x55\x2A\x55\x2A\x55\x2A        Apple II image with purple background
#8144   string  \x2A\x55\x2A\x55\x2A\x55\x2A\x55        Apple II image with green background
#8144   string  \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA        Apple II image with blue background
#8144   string  \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5        Apple II image with orange background

# Beagle Bros. Apple Mechanic fonts

0       belong&0xFF00FFFF       0x6400D000      Apple Mechanic font

# Apple Universal Disk Image Format (UDIF) - dmg files.
# From Johan Gade.
# These entries are disabled for now until we fix the following issues.
#
# Note there might be some problems with the "VAX COFF executable"
# entry. Note this entry should be placed before the mac filesystem section,
# particularly the "Apple Partition data" entry.
#
# The intended meaning of these tests is, that the file is only of the
# specified type if both of the lines are correct - i.e. if the first
# line matches and the second doesn't then it is not of that type.
#
#0      long    0x7801730d
#>4     long    0x62626060      UDIF read-only zlib-compressed image (UDZO)
#
# Note that this entry is recognized correctly by the "Apple Partition
# data" entry - however since this entry is more specific - this
# information seems to be more useful.
#0      long    0x45520200
#>0x410 string  disk\ image     UDIF read/write image (UDRW)

# From: Toby Peterson <[email protected]>
# From https://www.nationalarchives.gov.uk/pronom/fmt/866
0       string  bplist00
>8      search/500      WebMainResource Apple Safari Webarchive
!:mime  application/x-webarchive
!:strength +50
0       string  bplist00        Apple binary property list
!:mime  application/x-bplist

# Apple binary property list (bplist)
#  Assumes version bytes are hex.
#  Provides content hints for version 0 files. Assumes that the root
#  object is the first object (true for CoreFoundation implementation).
# From: David Remahl <[email protected]>
0               string  bplist
>6              byte    x       \bCoreFoundation binary property list data, version %#c
>>7             byte    x       \b%c
>6              string          00              \b
>>8             byte&0xF0       0x00    \b
>>>8    byte&0x0F       0x00    \b, root type: null
>>>8    byte&0x0F       0x08    \b, root type: false boolean
>>>8    byte&0x0F       0x09    \b, root type: true boolean
>>8             byte&0xF0       0x10    \b, root type: integer
>>8             byte&0xF0       0x20    \b, root type: real
>>8             byte&0xF0       0x30    \b, root type: date
>>8             byte&0xF0       0x40    \b, root type: data
>>8             byte&0xF0       0x50    \b, root type: ascii string
>>8             byte&0xF0       0x60    \b, root type: unicode string
>>8             byte&0xF0       0x80    \b, root type: uid (CORRUPT)
>>8             byte&0xF0       0xa0    \b, root type: array
>>8             byte&0xF0       0xd0    \b, root type: dictionary

# Apple/NeXT typedstream data
#  Serialization format used by NeXT and Apple for various
#  purposes in YellowStep/Cocoa, including some nib files.
# From: David Remahl <[email protected]>
2               string          typedstream     NeXT/Apple typedstream data, big endian
>0              byte            x               \b, version %d
>0              byte            <5              \b
>>13    byte            0x81    \b
>>>14   ubeshort        x               \b, system %d
2               string          streamtyped NeXT/Apple typedstream data, little endian
>0              byte            x               \b, version %d
>0              byte            <5              \b
>>13    byte            0x81    \b
>>>14   uleshort        x               \b, system %d

#------------------------------------------------------------------------------
# CAF: Apple CoreAudio File Format
#
# Container format for high-end audio purposes.
# From: David Remahl <[email protected]>
#
0       string          caff            CoreAudio Format audio file
>4      beshort         <10             version %d
>6      beshort         x


#------------------------------------------------------------------------------
# Keychain database files
0       string          kych            Mac OS X Keychain File

#------------------------------------------------------------------------------
# Code Signing related file types
0       belong          0xfade0c00      Mac OS X Code Requirement
>8      belong          1                       (opExpr)
>4      belong          x                       - %d bytes

0       belong          0xfade0c01      Mac OS X Code Requirement Set
>8      belong          >1                      containing %d items
>4      belong          x                       - %d bytes

0       belong          0xfade0c02      Mac OS X Code Directory
>8      belong          x                       version %x
>12     belong          >0                      flags %#x
>4      belong          x                       - %d bytes

0       belong          0xfade0cc0      Mac OS X Detached Code Signature (non-executable)
>4      belong          x                       - %d bytes

0       belong          0xfade0cc1      Mac OS X Detached Code Signature
>8      belong          >1                      (%d elements)
>4      belong          x                       - %d bytes

# From: "Nelson A. de Oliveira" <[email protected]>
# .vdi
4       string innotek\ VirtualBox\ Disk\ Image %s

# Apple disk partition stuff
# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
# Update: Joerg Jenderek
# "ER" is APPLE_DRVR_MAP_MAGIC signature
0       beshort 0x4552
# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
#!:strength +0
# strengthen the magic by looking for used blocksizes 512 2048
>2      ubeshort&0xf1FF         0       Apple Driver Map
# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
#>>504  ubequad&0x0000FFffFFff0000      0
!:mime  application/x-apple-diskimage
!:apple ????devr
# https://en.wikipedia.org/wiki/Apple_Disk_Image
!:ext   dmg/iso
# sbBlkSize for driver descriptor map 512 2048
>>2     beshort x                       \b, blocksize %d
# sbBlkCount sometimes garbish like
# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
# 0xf2720100 for bunziped Firefox 48.0-2.dmg
# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
# 0x00009090 by syslinux-6.03/utils/isohybrid.c
>>4     ubelong x                       \b, blockcount %u
# following device/driver information not very useful
# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>8     ubeshort        x               \b, devtype %u
# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>10    ubeshort        x               \b, devid %u
# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>12    ubelong         >0
>>>12   ubelong         x               \b, driver data %u
# number of driver descriptors sbDrvrCount <= 61
# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>16    ubeshort        x               \b, driver count %u
# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
# >>18  use             apple-driver-map
# >>26  use             apple-driver-map
# # ...
# >>500 use             apple-driver-map
# number of partitions is always same in every partition (map block count)
#>>0x0204       ubelong         x       \b, %u partitions
>>0x0204        ubelong         >0      \b, contains[@0x200]:
>>>0x0200       use             apple-apm
>>0x0204        ubelong         >1      \b, contains[@0x400]:
>>>0x0400       use             apple-apm
>>0x0204        ubelong         >2      \b, contains[@0x600]:
>>>0x0600       use             apple-apm
>>0x0204        ubelong         >3      \b, contains[@0x800]:
>>>0x0800       use             apple-apm
>>0x0204        ubelong         >4      \b, contains[@0xA00]:
>>>0x0A00       use             apple-apm
>>0x0204        ubelong         >5      \b, contains[@0xC00]:
>>>0x0C00       use             apple-apm
>>0x0204        ubelong         >6      \b, contains[@0xE00]:
>>>0x0E00       use             apple-apm
>>0x0204        ubelong         >7      \b, contains[@0x1000]:
>>>0x1000       use             apple-apm
#       display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
0       name                            apple-driver-map
>0      ubequad         !0
# descBlock first block of driver
>>0     ubelong x                       \b, driver start block %u
# descSize driver size in blocks
>>4     ubeshort        x               \b, size %u
# descType driver system type 1 701h F8FFh FFFFh
>>6     ubeshort        x               \b, type %#x

# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
# Update: Joerg Jenderek
# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
# magic stronger.
# for apple partition map stored as a single file
0       belong  0x504d0000
# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
#!:strength +0
>0      use             apple-apm
# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
# file: could not find any valid magic files!
#!:ext  bin
#       display apple partition map. Normally called after Apple driver map
0       name                            apple-apm
>0      belong  0x504d0000              Apple Partition Map
# number of partitions
>>4     ubelong x                       \b, map block count %u
# logical block (512 bytes) start of partition
>>8     ubelong x                       \b, start block %u
>>12    ubelong x                       \b, block count %u
>>16    string >0                       \b, name %s
>>48    string >0                       \b, type %s
# processor type dpme_process_id[16] e.g. "68000" "68020"
>>120   string >0                       \b, processor %s
# A/UX boot arguments BootArgs[128]
>>136   string >0                       \b, boot arguments %s
# status of partition dpme_flags
>>88    belong  & 1                     \b, valid
>>88    belong  & 2                     \b, allocated
>>88    belong  & 4                     \b, in use
>>88    belong  & 8                     \b, has boot info
>>88    belong  & 16                    \b, readable
>>88    belong  & 32                    \b, writable
>>88    belong  & 64                    \b, pic boot code
>>88    belong  & 128                   \b, chain compatible driver
>>88    belong  & 256                   \b, real driver
>>88    belong  & 512                   \b, chain driver
# mount automatically at startup APPLE_PS_AUTO_MOUNT
>>88    ubelong &0x40000000             \b, mount at startup
# is the startup partition APPLE_PS_STARTUP
>>88    ubelong &0x80000000             \b, is the startup partition

#https://wiki.mozilla.org/DS_Store_File_Format
#https://en.wikipedia.org/wiki/.DS_Store
0       string  \0\0\0\1Bud1\0          Apple Desktop Services Store

# HFS/HFS+ Resource fork files ([email protected] Apr 13 2015)
# Usually not in separate files, but have either filename rsrc with
# no extension, or a filename corresponding to another file, with
# extensions rsr/rsrc
# URL:          http://fileformats.archiveteam.org/wiki/Macintosh_resource_file
#               https://en.wikipedia.org/wiki/Resource_fork
# Reference:    https://github.com/kreativekorp/ksfl/wiki/Macintosh-Resource-File-Format
#               http://developer.apple.com/legacy/mac/library/documentation/mac/pdf/MoreMacintoshToolbox.pdf
#               https://formats.kaitai.io/resource_fork/
# Update:       Joerg Jenderek
# Note:         verified often by command like `deark -m macrsrc Icon_.rsrc`
# offset of resource data; usually starts at offset 0x0100
0       string  \000\000\001\000
# skip NPETraceSession.etl with invalid "low" map offset 0
>4      ubelong >0xFF
# skip few Atari DEGAS Elite bitmap (eil2.pi1 nastro.pi1) with ivalid "high" 0x6550766 0x7510763 map length
>>12    ubelong <0x8001
# most examples with zeroed system reserved field
>>>16   lelong  =0
>>>>0   use     apple-rsr
# few samples with not zeroed system reserved field like: Empty.rsrc.rsr OpenSans-CondBold.dfont
>>>16   lelong  !0
# resource fork variant with not zeroed system reserved field and copy of header
>>>>(4.L)       ubelong 0x100
# GRR: the line above only works if in ../../src/file.h FILE_BYTES_MAX is raised from 1 MiB above 0x6ab0f4 (HelveticaNeue.dfont)
>>>>>0  use     apple-rsr
# data fork variant with not zeroed system reserved field and no copy of header
>>>>(4.L)       ubelong 0
>>>>>0  use     apple-rsr
# Note: moved and merged from ./macintosh
# From: Adam Buchbinder <[email protected]>
# URL: https://en.wikipedia.org/wiki/Datafork_TrueType
# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
# don't know what they mean.
#       display information about Mac OSX datafork font DFONT
0       name            apple-dfont
>(4.L+30)       ubelong x               Mac OSX datafork font,
# https://en.wikipedia.org/wiki/Datafork_TrueType
!:mime          application/x-dfont
!:ext           dfont
# https://exiftool.org/TagNames/RSRC.html
>(4.L+30)       ubelong 0x73666e74      TrueType
>(4.L+30)       ubelong 0x464f4e54      'FONT'
>(4.L+30)       ubelong 0x4e464e54      'NFNT'
>(4.L+30)       ubelong 0x504f5354      PostScript
>(4.L+30)       ubelong 0x464f4e44      'FOND'
>(4.L+30)       ubelong 0x76657273      'vers'
#       display information about Macintosh resource
0       name            apple-rsr
>(4.L+30)       ubelong 0x73666e74
>>0     use     apple-dfont
>(4.L+30)       ubelong 0x464f4e54
>>0     use     apple-dfont
>(4.L+30)       ubelong 0x4e464e54
>>0     use     apple-dfont
>(4.L+30)       ubelong 0x504f5354
>>0     use     apple-dfont
>(4.L+30)       ubelong 0x464f4e44
>>0     use     apple-dfont
>(4.L+30)       ubelong 0x76657273
>>0     use     apple-dfont
>(4.L+30)       default x               Apple HFS/HFS+ resource fork
#!:mime         application/octet-stream
!:mime          application/x-apple-rsr
!:ext           rsrc/rsr
# offset to resource data; usually starts at offset 0x0100
>0              ubelong         !0x100  \b, data offset %#x
# offset to resource map; positive but not nil like in NPETraceSession.etl
>4              ubelong         x       \b, map offset %#x
# length of resource map; positive with 32K limitation but not
# nil like in NPETraceSession.etl or high like 0x7510763 in nastro.pi1
>12             ubelong         x       \b, map length %#x
# length of resource data; positive but not nil like in NPETraceSession.etl
>8              ubelong         x       \b, data length %#x
# reserved 112 bytes for system use; apparently often nil, but 8fd20000h in Empty.rsrc.rsr and 0x00768c2b in OpenSans-CondBold.dfont
>16             ubelong         !0      \b, at 16 %#8.8x
# https://fontforge.org/docs/techref/macformats.html
# jump to resource map
# a copy of resource header or 16 bytes of zeros for data fork
#>(4.L)         ubelong         x       \b, DATA offset %#x
#>(4.L+4)       ubelong         x       \b, MAP offset %#x
#>(4.L+8)       ubelong         x       \b, DATA length %#x
#>(4.L+12)      ubelong         x       \b, MAP length %#x
# nextResourceMap; handle to next resource map; used by the Resource Manager for internal bookkeeping; should be zero
>(4.L+16)       ubelong         !0      \b, nextResourceMap %#x
# fileRef; file reference number; used by the Resource Manager for internal bookkeeping; should be zero
>(4.L+20)       ubeshort        !0      \b, fileRef %#x
# attributes; Resource fork attributes (80h~read-only 40h~compression needed 20h~changed); other bits are reserved and should be zero
>(4.L+22)       ubeshort        !0      \b, attributes %#x
# typeListOffset; offset from resource map to start of type list like: 1Ch
>(4.L+24)       ubeshort        x       \b, list offset %#x
# nameListOffset; offset from esource map to start of name list like: 32h 46h 56h (XLISP.RSR XLISPTIN.RSR) 13Eh (HelveticaNeue.dfont)
>(4.L+26)       ubeshort        x       \b, name offset %#x
# typeCount; number of types in the map minus 1; If there are no resources, this is 0xFFFF
>(4.L+28)       beshort+1       >0      \b, %u type
# plural s
>>(4.L+28)      beshort+1       >1      \bs
# resource type list array; 1st resource type like: ALRT CODE FOND MPSR icns scsz
>>(4.L+30)      ubelong         x       \b, %#x
>>(4.L+30)      string          x       '%-.4s'
# resourceCount; number of this type resources minus one. If there is one resource of this type, this is 0x0000
>>(4.L+34)      beshort+1       x       * %d
# resourceListOffset; offset from type list to resource list like: Ah 12h DAh
>(4.L+36)       ubeshort        x       resource offset %#x

#https://en.wikipedia.org/wiki/AppleScript
0       string  FasdUAS                 AppleScript compiled

# AppleWorks/ClarisWorks
# https://github.com/joshenders/appleworks_format
# http://fileformats.archiveteam.org/wiki/AppleWorks
0       name                    appleworks
>0      belong&0x00ffffff       0x07e100        AppleWorks CWK Document
>0      belong&0x00ffffff       0x008803        ClarisWorks CWK Document
>0      default                 x
>>0     belong                  x               AppleWorks/ClarisWorks CWK Document
>0      byte                    x               \b, version %d
>30     beshort                 x               \b, %d
>32     beshort                 x               \bx%d
!:ext cwk

4       string  BOBO
>0      byte    >4
>>12    belong  0
>>>26   belong  0
>>>>0   use     appleworks
>0      belong  0x0481ad00
>>0     use     appleworks

# magic for Apple File System (APFS)
# from Alex Myczko <[email protected]>
32              string  NXSB            Apple File System (APFS)
>36             ulelong x               \b, blocksize %u

# iTunes cover art (versions 1 and 2)
4               string  itch
>24             string  artw
>>0x1e8         string  data            iTunes cover art
>>>0x1ed        string  PNG             (PNG)
>>>0x1ec        beshort 0xffd8          (JPEG)

# MacPaint image
65              string  PNTGMPNT        MacPaint image data
#0              belong  2               MacPaint image data