### Home Classes Methods

### Files

- Makefile
- AUTHORS
- COPYING
- ChangeLog
- INSTALL
- MAINT
- Makefile
- NEWS
- README
- TODO
- compile
- configure
- depcomp
- Makefile
- install-sh
- libtool
- Header
- Localstuff
- acorn
- adi
- adventure
- allegro
- alliant
- amanda
- amigaos
- animation
- apl
- apple
- applix
- archive
- asterix
- att3b
- audio
- basis
- bflt
- blcr
- blender
- blit
- bout
- bsdi
- bsi
- btsnoop
- c-lang
- c64
- cad
- cafebabe
- cddb
- chord
- cisco
- citrus
- clarion
- claris
- clipper
- commands
- communications
- compress
- console
- convex
- cracklib
- ctags
- dact
- database
- diamond
- diff
- digital
- dolby
- dump
- dyadic
- ebml
- editors
- efi
- elf
- encore
- epoc
- erlang
- esri
- fcs
- filesystems
- flash
- fonts
- fortran
- frame
- freebsd
- fsav
- games
- gcc
- geo
- geos
- gimp
- gnome-keyring
- gnu
- gnumeric
- grace
- graphviz
- gringotts
- hitachi-sh
- hp
- human68k
- ibm370
- ibm6000
- iff
- images
- inform
- intel
- interleaf
- island
- ispell
- isz
- java
- jpeg
- karma
- kde
- kml
- lecter
- lex
- lif
- linux
- lisp
- llvm
- lua
- luks
- mach
- macintosh
- magic
- maple
- mathcad
- mathematica
- matroska
- mcrypt
- mercurial
- metastore
- mime
- mips
- mirage
- misctools
- mkid
- mlssa
- mmdf
- modem
- motorola
- mozilla
- msdos
- msooxml
- msvc
- mup
- natinst
- ncr
- netbsd
- netscape
- netware
- news
- nitpicker
- oasis
- ocaml
- octave
- ole2compounddocs
- olf
- os2
- os400
- os9
- osf1
- palm
- parix
- parrot
- pbm
- pdf
- pdp
- perl
- pgp
- pkgadd
- plan9
- plus5
- printer
- project
- psdbms
- pulsar
- pyramid
- python
- revision
- riff
- rinex
- rpm
- rtf
- ruby
- sc
- sccs
- scientific
- securitycerts
- selinux
- sendmail
- sequent
- sgi
- sgml
- sharc
- sinclair
- sisu
- sketch
- smalltalk
- sniffer
- softquad
- spec
- spectrum
- sql
- ssh
- ssl
- sun
- sysex
- tcl
- teapot
- terminfo
- tex
- tgif
- ti-8x
- timezone
- troff
- tuxedo
- typeset
- unicode
- unknown
- uuencode
- vax
- vicar
- virtual
- virtutech
- visx
- vms
- vmware
- vorbis
- vxl
- warc
- weak
- windows
- wireless
- wordprocessors
- wsdl
- xdelta
- xenix
- xilinx
- xo65
- xwindows
- zilog
- zyxel
- Makefile
- missing
- Makefile
- README
- Makefile
- stamp-h1
- Makefile
- README

### Class Index

Quicksearch

- CharlockHolmes
- CharlockHolmes::Converter
- CharlockHolmes::EncodingDetector
- Object
- String

No matching classes.

#------------------------------------------------------------------------------ # $File: archive,v 1.67 2011/07/12 11:31:09 rrt Exp $ # archive: file(1) magic for archive formats (see also "msdos" for self- # extracting compressed archives) # # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. # pre-POSIX "tar" archives are handled in the C code.

# POSIX tar archives 257 string ustar0 POSIX tar archive !:mime application/x-tar # encoding: posix 257 string ustar0400400 GNU tar archive !:mime application/x-tar # encoding: gnu

# cpio archives # # Yes, the top two "cpio archive" formats are supposed to just be "short". # The idea is to indicate archives produced on machines with the same # byte order as the machine running "file" with "cpio archive", and # to indicate archives produced on machines with the opposite byte order # from the machine running "file" with "byte-swapped cpio archive". # # The SVR4 "cpio(4)" hints that there are additional formats, but they # are defined as "short"s; I think all the new formats are # character-header formats and thus are strings, not numbers. 0 short 070707 cpio archive !:mime application/x-cpio 0 short 0143561 byte-swapped cpio archive !:mime application/x-cpio # encoding: swapped 0 string 070707 ASCII cpio archive (pre-SVR4 or odc) 0 string 070701 ASCII cpio archive (SVR4 with no CRC) 0 string 070702 ASCII cpio archive (SVR4 with CRC)

# Debian package (needs to go before regular portable archives) # 0 string =!<arch>ndebian !:mime application/x-debian-package >8 string debian-split part of multipart Debian package >8 string debian-binary Debian binary package >8 string !debian >68 string >0 (format %s) # These next two lines do not work, because a bzip2 Debian archive # still uses gzip for the control.tar (first in the archive). Only # data.tar varies, and the location of its filename varies too. # file/libmagic does not current have support for ascii-string based # (offsets) as of 2005-09-15. #>81 string bz2 b, uses bzip2 compression #>84 string gz b, uses gzip compression #>136 ledate x created: %s

# other archives 0 long 0177555 very old archive 0 short 0177555 very old PDP-11 archive 0 long 0177545 old archive 0 short 0177545 old PDP-11 archive 0 long 0100554 apl workspace 0 string =<ar> archive !:mime application/x-archive

# MIPS archive (needs to go before regular portable archives) # 0 string =!<arch>n__________E MIPS archive >20 string U with MIPS Ucode members >21 string L with MIPSEL members >21 string B with MIPSEB members >19 string L and an EL hash table >19 string B and an EB hash table >22 string X -- out of date

0 search/1 -h- Software Tools format archive text

# # XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is # "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: # # 0 string =!<arch> current ar archive # 0 long 0x213c6172 archive file # # and for SVR1 archives, we have: # # 0 string <ar> System V Release 1 ar archive # 0 string =<ar> archive # # XXX - did Aegis really store shared libraries, breakpointed modules, # and absolute code program modules in the same format as new-style # "ar" archives? # 0 string =!<arch> current ar archive !:mime application/x-archive >8 string __.SYMDEF random library >0 belong =65538 - pre SR9.5 >0 belong =65539 - post SR9.5 >0 beshort 2 - object archive >0 beshort 3 - shared library module >0 beshort 4 - debug break-pointed module >0 beshort 5 - absolute code program module 0 string <ar> System V Release 1 ar archive 0 string =<ar> archive # # XXX - from "vax", which appears to collect a bunch of byte-swapped # thingies, to help you recognize VAX files on big-endian machines; # with "leshort", "lelong", and "string", that's no longer necessary.... # 0 belong 0x65ff0000 VAX 3.0 archive 0 belong 0x3c61723e VAX 5.0 archive # 0 long 0x213c6172 archive file 0 lelong 0177555 very old VAX archive 0 leshort 0177555 very old PDP-11 archive # # XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus # be a random library (it said 0xff65 rather than 0177545). # 0 lelong 0177545 old VAX archive >8 string __.SYMDEF random library 0 leshort 0177545 old PDP-11 archive >8 string __.SYMDEF random library # # From "pdp" (but why a 4-byte quantity?) # 0 lelong 0x39bed PDP-11 old archive 0 lelong 0x39bee PDP-11 4.0 archive

# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) # # The first byte is the magic (0x1a), byte 2 is the compression type for # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS # filename of the first file (null terminated). Since some types collide # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW !:mime application/x-arc 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed !:mime application/x-arc 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed !:mime application/x-arc 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed !:mime application/x-arc 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed !:mime application/x-arc 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched !:mime application/x-arc # [JW] stuff taken from idarc, obviously ARC successors: 0 lelong&0x8080ffff 0x00000a1a PAK archive data !:mime application/x-arc 0 lelong&0x8080ffff 0x0000141a ARC+ archive data !:mime application/x-arc 0 lelong&0x8080ffff 0x0000481a HYP archive data !:mime application/x-arc

# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) # I can't create either SPARK or ArcFS archives so I have not tested this stuff # [GRR: the original entries collide with ARC, above; replaced with combined # version (not tested)] #0 byte 0x1a RISC OS archive (spark format) 0 string 032archive RISC OS archive (ArcFS format) 0 string Archive000 RISC OS archive (ArcFS format)

# All these were taken from idarc, many could not be verified. Unfortunately, # there were many low-quality sigs, i.e. easy to trigger false positives. # Please notify me of any real-world fishy/ambiguous signatures and I'll try # to get my hands on the actual archiver and see if I find something better. [JW] # probably many can be enhanced by finding some 0-byte or control char near the start

# idarc calls this Crush/Uncompressed... shrug 0 string CRUSH Crush archive data # Squeeze It (.sqz) 0 string HLSQZ Squeeze It archive data # SQWEZ 0 string SQWEZ SQWEZ archive data # HPack (.hpk) 0 string HPAK HPack archive data # HAP 0 string x91x33HF HAP archive data # MD/MDCD 0 string MDmd MDCD archive data # LIM 0 string LIMx1a LIM archive data # SAR 3 string LH5 SAR archive data # BSArc/BS2 0 string 2123SB 0 BSArc/BS2 archive data # MAR 2 string =-ah MAR archive data # ACB 0 belong&0x00f800ff 0x00800000 ACB archive data # CPZ # TODO, this is what idarc says: 0 string 000 CPZ archive data # JRC 0 string JRchive JRC archive data # Quantum 0 string DS0 Quantum archive data # ReSOF 0 string PK36 ReSOF archive data # QuArk 0 string 74 QuArk archive data # YAC 14 string YC YAC archive data # X1 0 string X1 X1 archive data 0 string XhDr X1 archive data # CDC Codec (.dqt) 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data # AMGC 0 string xad6" AMGC archive data # NuLIB 0 string NõFélå NuLIB archive data # PakLeo 0 string LEOLZW PAKLeo archive data # ChArc 0 string SChF ChArc archive data # PSA 0 string PSA PSA archive data # CrossePAC 0 string DSIGDCC CrossePAC archive data # Freeze 0 string x1fx9fx4ax10x0a Freeze archive data # KBoom 0 string ¨MP¨ KBoom archive data # NSQ, must go after CDC Codec 0 string x76xff NSQ archive data # DPA 0 string Dirk\ Paehl DPA archive data # BA # TODO: idarc says "bytes 0-2 == bytes 3-5" # TTComp 0 string 06 TTComp archive data # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 0 string ESP ESP archive data # ZPack 0 string 1ZPK1 ZPack archive data # Sky 0 string xbcx40 Sky archive data # UFA 0 string UFA UFA archive data # Dry 0 string =-H2O DRY archive data # FoxSQZ 0 string FOXSQZ FoxSQZ archive data # AR7 0 string ,AR7 AR7 archive data # PPMZ 0 string PPMZ PPMZ archive data # MS Compress 4 string x88xf0x27 MS Compress archive data # updated by Joerg Jenderek >9 string 0 >>0 string KWAJ >>>7 string 321003 MS Compress archive data >>>>14 ulong >0 b, original size: %ld bytes >>>>18 ubyte >0x65 >>>>>18 string x b, was %.8s >>>>>(10.b-4) string x b.%.3s # MP3 (archiver, not lossy audio compression) 0 string MP3x1a MP3-Archiver archive data # ZET 0 string OZÝ ZET archive data # TSComp 0 string x65x5dx13x8cx08x01x03x00 TSComp archive data # ARQ 0 string gW41 ARQ archive data # Squash 3 string OctSqu Squash archive data # Terse 0 string 5110 Terse archive data # PUCrunch 0 string x01x08x0bx08xefx00x9ex32x30x36x31 PUCrunch archive data # UHarc 0 string UHA UHarc archive data # ABComp 0 string 2AB ABComp archive data 0 string 3AB2 ABComp archive data # CMP 0 string CO0 CMP archive data # Splint 0 string x93xb9x06 Splint archive data # InstallShield 0 string x13x5dx65x8c InstallShield Z archive Data # Gather 1 string GTH Gather archive data # BOA 0 string BOA BOA archive data # RAX 0 string ULEBxa RAX archive data # Xtreme 0 string ULEB0 Xtreme archive data # Pack Magic 0 string @â10 Pack Magic archive data # BTS 0 belong&0xfeffffff 0x1a034465 BTS archive data # ELI 5750 0 string Ora\ ELI 5750 archive data # QFC 0 string x1aFCx1a QFC archive data 0 string x1aQFx1a QFC archive data # PRO-PACK 0 string RNC PRO-PACK archive data # 777 0 string 777 777 archive data # LZS221 0 string sTaC LZS221 archive data # HPA 0 string HPA HPA archive data # Arhangel 0 string LG Arhangel archive data # EXP1, uses bzip2 0 string 0123456789012345BZh EXP1 archive data # IMP 0 string IMPxa IMP archive data # NRV 0 string x00x9Ex6Ex72x76xFF NRV archive data # Squish 0 string x73xb2x90xf4 Squish archive data # Par 0 string PHILIPP Par archive data 0 string PAR Par archive data # HIT 0 string UB HIT archive data # SBX 0 belong&0xfffff000 0x53423000 SBX archive data # NaShrink 0 string NSK NaShrink archive data # SAPCAR 0 string #\ CAR\ archive\ header SAPCAR archive data 0 string CAR\ 2.00RG SAPCAR archive data # Disintegrator 0 string DST Disintegrator archive data # ASD 0 string ASD ASD archive data # InstallShield CAB 0 string ISc( InstallShield CAB # TOP4 0 string T4x1a TOP4 archive data # BatComp left out: sig looks like COM executable # so TODO: get real 4dos batcomp file and find sig # BlakHole 0 string BH57 BlakHole archive data # BIX 0 string BIX0 BIX archive data # ChiefLZA 0 string ChfLZ ChiefLZA archive data # Blink 0 string Blink Blink archive data # Logitech Compress 0 string xdaxfa Logitech Compress archive data # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 1 string (C)\ STEPANYUK ARS-Sfx archive data # AKT/AKT32 0 string AKT32 AKT32 archive data 0 string AKT AKT archive data # NPack 0 string MSTSM NPack archive data # PFT 0 string 0x500x14 PFT archive data # SemOne 0 string SEM SemOne archive data # PPMD 0 string x8fxafxacx84 PPMD archive data # FIZ 0 string FIZ FIZ archive data # MSXiE 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data # DeepFreezer 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data # DC 0 string =<DC- DC archive data # TPac 0 string 4TPAC3 TPac archive data # Ai 0 string Ai110 Ai archive data 0 string Ai100 Ai archive data # Ai32 0 string Ai20 Ai32 archive data 0 string Ai21 Ai32 archive data # SBC 0 string SBC SBC archive data # Ybs 0 string YBS Ybs archive data # DitPack 0 string x9e00 DitPack archive data # DMS 0 string DMS! DMS archive data # EPC 0 string x8fxafxacx8c EPC archive data # VSARC 0 string VSx1a VSARC archive data # PDZ 0 string PDZ PDZ archive data # ReDuq 0 string rdqx ReDuq archive data # GCA 0 string GCAX GCA archive data # PPMN 0 string pN PPMN archive data # WinImage 3 string WINIMAGE WinImage archive data # Compressia 0 string CMP0CMP Compressia archive data # UHBC 0 string UHB UHBC archive data # WinHKI 0 string x61x5Cx04x05 WinHKI archive data # WWPack data file 0 string WWP WWPack archive data # BSN (BSA, PTS-DOS) 0 string xffBSG BSN archive data 1 string xffBSG BSN archive data 3 string xffBSG BSN archive data 1 string 0xae2 BSN archive data 1 string 0xae3 BSN archive data 1 string 0xae7 BSN archive data # AIN 0 string x33x18 AIN archive data 0 string x33x17 AIN archive data # XPA32 0 string xpa01 XPA32 archive data # SZip (TODO: doesn't catch all versions) 0 string SZx0a4 SZip archive data # XPack DiskImage 0 string jm XPack DiskImage archive data # XPack Data 0 string xpa XPack archive data # XPack Single Data 0 string Í\ jm XPack single archive data

# TODO: missing due to unknown magic/magic at end of file: #DWC #ARG #ZAR #PC/3270 #InstallIt #RKive #RK #XPack Diskimage

# These were inspired by idarc, but actually verified # Dzip archiver (.dz) 0 string DZ Dzip archive data >2 byte x b, version %i >3 byte x b.%i # ZZip archiver (.zz) 0 string ZZ\ 00 ZZip archive data 0 string ZZ0 ZZip archive data # PAQ archiver (.paq) 0 string xaax40x5fx77x1fxe5x82x0d PAQ archive data 0 string PAQ PAQ archive data >3 byte&0xf0 0x30 >>3 byte x (v%c) # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 0xe string x1aJarx1b JAR (ARJ Software, Inc.) archive data 0 string JARCS JAR (ARJ Software, Inc.) archive data

# ARJ archiver (jason@jarthur.Claremont.EDU) 0 leshort 0xea60 ARJ archive data !:mime application/x-arj >5 byte x b, v%d, >8 byte &0x04 multi-volume, >8 byte &0x10 slash-switched, >8 byte &0x20 backup, >34 string x original name: %s, >7 byte 0 os: MS-DOS >7 byte 1 os: PRIMOS >7 byte 2 os: Unix >7 byte 3 os: Amiga >7 byte 4 os: Macintosh >7 byte 5 os: OS/2 >7 byte 6 os: Apple ][ GS >7 byte 7 os: Atari ST >7 byte 8 os: NeXT >7 byte 9 os: VAX/VMS >3 byte >0 %d] # [JW] idarc says this is also possible 2 leshort 0xea60 ARJ archive data

# HA archiver (Greg Roelofs, newt@uchicago.edu) # This is a really bad format. A file containing HAWAII will match this... #0 string HA HA archive data, #>2 leshort =1 1 file, #>2 leshort >1 %u files, #>4 byte&0x0f =0 first is type CPY #>4 byte&0x0f =1 first is type ASC #>4 byte&0x0f =2 first is type HSC #>4 byte&0x0f =0x0e first is type DIR #>4 byte&0x0f =0x0f first is type SPECIAL # suggestion: at least identify small archives (<1024 files) 0 belong&0xffff00fc 0x48410000 HA archive data >2 leshort =1 1 file, >2 leshort >1 %u files, >4 byte&0x0f =0 first is type CPY >4 byte&0x0f =1 first is type ASC >4 byte&0x0f =2 first is type HSC >4 byte&0x0f =0x0e first is type DIR >4 byte&0x0f =0x0f first is type SPECIAL

# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 0 string HPAK HPACK archive data

# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 0 string 351,001JAM\ JAM archive, >7 string >0 version %.4s >0x26 byte =0x27 - >>0x2b string >0 label %.11s, >>0x27 lelong x serial %08x, >>0x36 string >0 fstype %.8s

# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 2 string -lh0- LHarc 1.x/ARX archive data [lh0] !:mime application/x-lharc 2 string -lh1- LHarc 1.x/ARX archive data [lh1] !:mime application/x-lharc 2 string -lz4- LHarc 1.x archive data [lz4] !:mime application/x-lharc 2 string -lz5- LHarc 1.x archive data [lz5] !:mime application/x-lharc # [never seen any but the last; -lh4- reported in comp.compression:] 2 string -lzs- LHa/LZS archive data [lzs] !:mime application/x-lha 2 string -lh40- LHa 2.x? archive data [lh ] !:mime application/x-lha 2 string -lhd- LHa 2.x? archive data [lhd] !:mime application/x-lha 2 string -lh2- LHa 2.x? archive data [lh2] !:mime application/x-lha 2 string -lh3- LHa 2.x? archive data [lh3] !:mime application/x-lha 2 string -lh4- LHa (2.x) archive data [lh4] !:mime application/x-lha 2 string -lh5- LHa (2.x) archive data [lh5] !:mime application/x-lha 2 string -lh6- LHa (2.x) archive data [lh6] !:mime application/x-lha 2 string -lh7- LHa (2.x)/LHark archive data [lh7] !:mime application/x-lha >20 byte x - header level %d # taken from idarc [JW] 2 string -lZ PUT archive data 2 string -lz LZS archive data 2 string -sw1- Swag archive data

# RAR archiver (Greg Roelofs, newt@uchicago.edu) 0 string Rar! RAR archive data, !:mime application/x-rar >44 byte x v%0x, >10 byte >0 flags: >>10 byte &0x01 Archive volume, >>10 byte &0x02 Commented, >>10 byte &0x04 Locked, >>10 byte &0x08 Solid, >>10 byte &0x20 Authenticated, >35 byte 0 os: MS-DOS >35 byte 1 os: OS/2 >35 byte 2 os: Win32 >35 byte 3 os: Unix # some old version? idarc says: 0 string REx7ex5e RAR archive data

# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 0 string SQSH squished archive data (Acorn RISCOS)

# UC2 archiver (Greg Roelofs, newt@uchicago.edu) # [JW] see exe section for self-extracting version 0 string UC2x1a UC2 archive data

# PKZIP multi-volume archive 0 string PKx07x08PKx03x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract !:mime application/zip

# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 0 string PK003004

# Specialised zip formats which start with a member named 'mimetype' # (stored uncompressed, with no 'extra field') containing the file's MIME type. # Check for have 8-byte name, 0-byte extra field, name "mimetype", and # contents starting with "application/": >26 string x8000mimetypeapplication/

# KOffice / OpenOffice & StarOffice / OpenDocument formats # From: Abel Cheung <abel@oaka.org>

# KOffice (1.2 or above) formats # (mimetype contains "application/vnd.kde.<SUBTYPE>") >>50 string vnd.kde. KOffice (>=1.2) >>>58 string karbon Karbon document >>>58 string kchart KChart document >>>58 string kformula KFormula document >>>58 string kivio Kivio document >>>58 string kontour Kontour document >>>58 string kpresenter KPresenter document >>>58 string kspread KSpread document >>>58 string kword KWord document

# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) # (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") >>50 string vnd.sun.xml. OpenOffice.org 1.x >>>62 string writer Writer >>>>68 byte !0x2e document >>>>68 string .template template >>>>68 string .global global document >>>62 string calc Calc >>>>66 byte !0x2e spreadsheet >>>>66 string .template template >>>62 string draw Draw >>>>66 byte !0x2e document >>>>66 string .template template >>>62 string impress Impress >>>>69 byte !0x2e presentation >>>>69 string .template template >>>62 string math Math document >>>62 string base Database file

# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) # lists.oasis-open.org/archives/office/200505/msg00006.html # (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") >>50 string vnd.oasis.opendocument. OpenDocument >>>73 string text >>>>77 byte !0x2d Text !:mime application/vnd.oasis.opendocument.text >>>>77 string -template Text Template !:mime application/vnd.oasis.opendocument.text-template >>>>77 string -web HTML Document Template !:mime application/vnd.oasis.opendocument.text-web >>>>77 string -master Master Document !:mime application/vnd.oasis.opendocument.text-master >>>73 string graphics >>>>81 byte !0x2d Drawing !:mime application/vnd.oasis.opendocument.graphics >>>>81 string -template Template !:mime application/vnd.oasis.opendocument.graphics-template >>>73 string presentation >>>>85 byte !0x2d Presentation !:mime application/vnd.oasis.opendocument.presentation >>>>85 string -template Template !:mime application/vnd.oasis.opendocument.presentation-template >>>73 string spreadsheet >>>>84 byte !0x2d Spreadsheet !:mime application/vnd.oasis.opendocument.spreadsheet >>>>84 string -template Template !:mime application/vnd.oasis.opendocument.spreadsheet-template >>>73 string chart >>>>78 byte !0x2d Chart !:mime application/vnd.oasis.opendocument.chart >>>>78 string -template Template !:mime application/vnd.oasis.opendocument.chart-template >>>73 string formula >>>>80 byte !0x2d Formula !:mime application/vnd.oasis.opendocument.formula >>>>80 string -template Template !:mime application/vnd.oasis.opendocument.formula-template >>>73 string database Database !:mime application/vnd.oasis.opendocument.database >>>73 string image >>>>78 byte !0x2d Image !:mime application/vnd.oasis.opendocument.image >>>>78 string -template Template !:mime application/vnd.oasis.opendocument.image-template

# EPUB (OEBPS) books using OCF (OEBPS Container Format) # From: Adam Buchbinder <adam.buchbinder@gmail.com> # www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. # (mimetype contains "application/epub+zip") >>50 string epub+zip EPUB ebook data !:mime application/epub+zip

# Catch other ZIP-with-mimetype formats # In a ZIP file, the bytes immediately after a member's contents are # always "PK". The 2 regex rules here print the "mimetype" member's # contents up to the first 'P'. Luckily, most MIME types don't contain # any capital 'P's. This is a kludge. # (mimetype contains "application/<OTHER>") >>50 string !epub+zip >>>50 string !vnd.oasis.opendocument. >>>>50 string !vnd.sun.xml. >>>>>50 string !vnd.kde. >>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) !:mime application/zip # (mimetype contents other than "application/*") >26 string x8000mimetype >>38 string !application/ >>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) !:mime application/zip

# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) # Next line excludes specialized formats: >26 string !x8000mimetype Zip archive data !:mime application/zip >>4 byte 0x09 b, at least v0.9 to extract >>4 byte 0x0a b, at least v1.0 to extract >>4 byte 0x0b b, at least v1.1 to extract >>4 byte 0x14 b, at least v2.0 to extract >>4 byte 0x2d b, at least v3.0 to extract >>0x161 string WINZIP b, WinZIP self-extracting

# StarView Metafile # From Pierre Ducroquet <pinaraf@pinaraf.info> 0 string VCLMTF StarView MetaFile >6 beshort x b, version %d >8 belong x b, size %d

# Zoo archiver 20 lelong 0xfdc4a7dc Zoo archive data !:mime application/x-zoo >4 byte >48 b, v%c. >>6 byte >47 b%c >>>7 byte >47 b%c >32 byte >0 b, modify: v%d >>33 byte x b.%d+ >42 lelong 0xfdc4a7dc b, >>70 byte >0 extract: v%d >>>71 byte x b.%d+

# Shell archives 10 string #\ This\ is\ a\ shell\ archive shell archive text !:mime application/octet-stream

# # LBR. NB: May conflict with the questionable # "binary Computer Graphics Metafile" format. # 0 string 0\ \ \ \ \ \ \ \ \ \ \ 00 LBR archive data # # PMA (CP/M derivative of LHA) # 2 string -pm0- PMarc archive data [pm0] 2 string -pm1- PMarc archive data [pm1] 2 string -pm2- PMarc archive data [pm2] 2 string -pms- PMarc SFX archive (CP/M, DOS) 5 string -pc1- PopCom compressed executable (CP/M)

# From Rafael Laboissiere <rafael@laboissiere.net> # The Project Revision Control System (see # prcs.sourceforge.net) generates a packaged project # file which is recognized by the following entry: 0 leshort 0xeb81 PRCS packaged project

# Microsoft cabinets # by David Necas (Yeti) <yeti@physics.muni.cz> #0 string MSCF0000 Microsoft cabinet file data, #>25 byte x v%d #>24 byte x b.%d # MPi: All CABs have version 1.3, so this is pointless. # Better magic in debian-additions.

# GTKtalog catalogs # by David Necas (Yeti) <yeti@physics.muni.cz> 4 string gtktalog\ GTKtalog catalog data, >13 string 3 version 3 >>14 beshort 0x677a (gzipped) >>14 beshort !0x677a (not gzipped) >13 string >3 version %s

############################################################################ # Parity archive reconstruction file, the 'par' file format now used on Usenet. 0 string PAR0 PARity archive data >48 leshort =0 - Index file >48 leshort >0 - file number %d

# Felix von Leitner <felix-file@fefe.de> 0 string d8:announce BitTorrent file !:mime application/x-bittorrent

# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 0 beshort 0x0e0f Atari MSA archive data >2 beshort x b, %d sectors per track >4 beshort 0 b, 1 sided >4 beshort 1 b, 2 sided >6 beshort x b, starting track: %d >8 beshort x b, ending track: %d

# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 0 string PK00PK003004 Zip archive data

# ACE archive (from www.wotsit.org/download.asp?f=ace) # by Stefan `Sec` Zehl <sec@42.org> 7 string *ACE* ACE archive data >15 byte >0 version %d >16 byte =0x00 b, from MS-DOS >16 byte =0x01 b, from OS/2 >16 byte =0x02 b, from Win/32 >16 byte =0x03 b, from Unix >16 byte =0x04 b, from MacOS >16 byte =0x05 b, from WinNT >16 byte =0x06 b, from Primos >16 byte =0x07 b, from AppleGS >16 byte =0x08 b, from Atari >16 byte =0x09 b, from Vax/VMS >16 byte =0x0A b, from Amiga >16 byte =0x0B b, from Next >14 byte x b, version %d to extract >5 leshort &0x0080 b, multiple volumes, >>17 byte x b (part %d), >5 leshort &0x0002 b, contains comment >5 leshort &0x0200 b, sfx >5 leshort &0x0400 b, small dictionary >5 leshort &0x0800 b, multi-volume >5 leshort &0x1000 b, contains AV-String >>30 string x16*UNREGISTEREDx20VERSION* (unregistered) >5 leshort &0x2000 b, with recovery record >5 leshort &0x4000 b, locked >5 leshort &0x8000 b, solid # Date in MS-DOS format (whatever that is) #>18 lelong x Created on

# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann # <doj@cubic.org> 0x1A string sfArk sfArk compressed Soundfont >0x15 string 2 >>0x1 string >0 Version %s >>0x2A string >0 : %s

# DR-DOS 7.03 Packed File *.??_ 0 string Packed\ File\ Personal NetWare Packed File >12 string x b, was "%.12s"

# EET archive # From: Tilman Sauerbeck <tilman@code-monkey.de> 0 belong 0x1ee7ff00 EET archive !:mime application/x-eet

# rzip archives 0 string RZIP rzip compressed data >4 byte x - version %d >5 byte x b.%d >6 belong x (%d bytes)

# From: "Robert Dale" <robdale@gmail.com> 0 belong 123 dar archive, >4 belong x label "%.8x >>8 belong x %.8x >>>12 beshort x %.4x" >14 byte 0x54 end slice >14 beshort 0x4e4e multi-part >14 beshort 0x4e53 multi-part, with -S

# Symbian installation files # www.thouky.co.uk/software/psifs/sis.html # developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8 lelong 0x10000419 Symbian installation file !:mime application/vnd.symbian.install >4 lelong 0x1000006D (EPOC release 3/4/5) >4 lelong 0x10003A12 (EPOC release 6) 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) !:mime x-epoc/x-sisx-app

# From "Nelson A. de Oliveira" <naoliv@gmail.com> 0 string MPQ032 MoPaQ (MPQ) archive

# From: Dirk Jagdmann <doj@cubic.org> # xar archive format: code.google.com/p/xar/ 0 string xar! xar archive >6 beshort x - version %ld

# From: "Nelson A. de Oliveira" <naoliv@gmail.com> # .kgb 0 string KGB_arch KGB Archiver file >10 string x with compression level %.1s

# xar (eXtensible ARchiver) archive # From: "David Remahl" <dremahl@apple.com> 0 string xar! xar archive #>4 beshort x header size %d >6 beshort x version %d, #>8 quad x compressed TOC: %d, #>16 quad x uncompressed TOC: %d, >24 belong 0 no checksum >24 belong 1 SHA-1 checksum >24 belong 2 MD5 checksum

# Type: Parity Archive # From: Daniel van Eeden <daniel_e@dds.nl> 0 string PAR2 Parity Archive Volume Set

# Bacula volume format. (Volumes always start with a block header.) # URL: bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html # From: Adam Buchbinder <adam.buchbinder@gmail.com> 12 string BB02 Bacula volume >20 bedate x b, started %s

# ePub is XHTML + XML inside a ZIP archive. The first member of the # archive must be an uncompressed file called 'mimetype' with contents # 'application/epub+zip'

# start by checking that this is a ZIP archive, then check for the # proper mimetype file # From: Ralf Brown <ralf.brown@gmail.com> 0 string PK003004 >0x1E string mimetypeapplication/epub+zip EPUB document !:mime application/epub+zip

# From: "Michał Górny" <mgorny@gentoo.org> # ZPAQ: mattmahoney.net/dc/zpaq.html 0 string zPQ ZPAQ stream >3 byte x b, level %d

[Validate]

Generated with the Darkfish Rdoc Generator 2.