-
Notifications
You must be signed in to change notification settings - Fork 22
/
archive
2586 lines (2488 loc) · 91.5 KB
/
archive
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#------------------------------------------------------------------------------
# $File: archive,v 1.191 2023/05/08 01:31:46 christos Exp $
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c.
# POSIX tar archives
# URL: https://en.wikipedia.org/wiki/Tar_(computing)
# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current
# header mainly padded with nul bytes
500 quad 0
!:strength /2
# filename or extended attribute printable strings in range space null til umlaut ue
>0 ubeshort >0x1F00
>>0 ubeshort <0xFCFD
# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad
# at https://sourceforge.net/projects/s-tar/files/testscripts/
>>>508 ubelong&0x8B9E8DFF 0
# nul, space or ascii digit 0-7 at start of mode
>>>>100 ubyte&0xC8 =0
>>>>>101 ubyte&0xC8 =0
# nul, space at end of check sum
>>>>>>155 ubyte&0xDF =0
# space or ascii digit 0 at start of check sum
>>>>>>>148 ubyte&0xEF =0x20
# FOR DEBUGGING:
#>>>>>>>>0 regex \^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp) NAME "%s"
# check for 1st image main name with digits used for sorting
# and for name extension case insensitive like: PNG JPG JPEG TIF TIFF GIF BMP
>>>>>>>>0 regex \^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp)
>>>>>>>>>0 use tar-cbt
# check for 1st member name with ovf suffix
>>>>>>>>0 regex \^.{1,96}[.](ovf)
>>>>>>>>>0 use tar-ova
# if 1st member name without digits and without used image suffix and without *.ovf then it is a TAR archive
>>>>>>>>0 default x
>>>>>>>>>0 use tar-file
# minimal check and then display tar archive information which can also be
# embedded inside others like Android Backup, Clam AntiVirus database
0 name tar-file
>257 string !ustar
# header padded with nuls
>>257 ulong =0
# GNU tar version 1.29 with non pax format option without refusing
# creates misleading V7 header for Long path, Multi-volume, Volume type
>>>156 ubyte 0x4c GNU tar archive
!:mime application/x-gtar
!:ext tar/gtar
>>>156 ubyte 0x4d GNU tar archive
!:mime application/x-gtar
!:ext tar/gtar
>>>156 ubyte 0x56 GNU tar archive
!:mime application/x-gtar
!:ext tar/gtar
>>>156 default x tar archive (V7)
!:mime application/x-tar
!:ext tar
# other stuff in padding
# some implementations add new fields to the blank area at the end of the header record
# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option
>>257 ulong !0 tar archive (old)
!:mime application/x-tar
!:ext tar
# magic in newer, GNU, posix variants
>257 string =ustar
# 2 last char of magic and UStar version because string expression does not work
# 2 space characters followed by a null for GNU variant
>>261 ubelong =0x72202000 POSIX tar archive (GNU)
!:mime application/x-gtar
!:ext tar/gtar
# UStar version with ASCII "00"
>>261 ubelong 0x72003030 POSIX
# gLOBAL and ExTENSION type only found in POSIX.1-2001 format
>>>156 ubyte 0x67 \b.1-2001
>>>156 ubyte 0x78 \b.1-2001
>>>156 ubyte x tar archive
!:mime application/x-ustar
!:ext tar/ustar
# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab
>>261 ubelong 0x72000000 tar archive (ustar)
!:mime application/x-ustar
!:ext tar/ustar
# not seen ustar variant with garbish version
>>261 default x tar archive (unknown ustar)
!:mime application/x-ustar
!:ext tar/ustar
# type flag of 1st tar archive member
#>156 ubyte x \b, %c-type
>156 ubyte x
>>156 ubyte 0 \b, file
>>156 ubyte 0x30 \b, file
>>156 ubyte 0x31 \b, hard link
>>156 ubyte 0x32 \b, symlink
>>156 ubyte 0x33 \b, char device
>>156 ubyte 0x34 \b, block device
>>156 ubyte 0x35 \b, directory
>>156 ubyte 0x36 \b, fifo
>>156 ubyte 0x37 \b, reserved
>>156 ubyte 0x4c \b, long path
>>156 ubyte 0x4d \b, multi volume
>>156 ubyte 0x56 \b, volume
>>156 ubyte 0x67 \b, global
>>156 ubyte 0x78 \b, extension
>>156 default x \b, type
>>>156 ubyte x '%c'
# name[100]
>0 string >\0 %-.60s
# mode mainly stored as an octal number in ASCII null or space terminated
>100 string >\0 \b, mode %-.7s
# user id mainly as octal numbers in ASCII null or space terminated
>108 string >\0 \b, uid %-.7s
# group id mainly as octal numbers in ASCII null or space terminated
>116 string >\0 \b, gid %-.7s
# size mainly as octal number in ASCII
>124 ubyte <0x38
>>124 string >\0 \b, size %-.12s
# coding indicated by setting the high-order bit of the leftmost byte
>124 ubyte >0xEF \b, size 0x
>>124 ubyte !0xff \b%2.2x
>>125 ubyte !0xff \b%2.2x
>>126 ubyte !0xff \b%2.2x
>>127 ubyte !0xff \b%2.2x
>>128 ubyte !0xff \b%2.2x
>>129 ubyte !0xff \b%2.2x
>>130 ubyte !0xff \b%2.2x
>>131 ubyte !0xff \b%2.2x
>>132 ubyte !0xff \b%2.2x
>>133 ubyte !0xff \b%2.2x
>>134 ubyte !0xff \b%2.2x
>>135 ubyte !0xff \b%2.2x
# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated
>136 string >\0 \b, seconds %-.11s
# header checksum stored as an octal number in ASCII null or space terminated
#>148 string x \b, cksum %.7s
# linkname[100]
>157 string >\0 \b, linkname %-.40s
# additional fields for ustar
>257 string =ustar
# owner user name null terminated
>>265 string >\0 \b, user %-.32s
# group name null terminated
>>297 string >\0 \b, group %-.32s
# device major minor if not zero
>>329 ubequad&0xCFCFCFCFcFcFcFdf !0
>>>329 string x \b, devmaj %-.7s
>>337 ubequad&0xCFCFCFCFcFcFcFdf !0
>>>337 string x \b, devmin %-.7s
# prefix[155]
>>345 string >\0 \b, prefix %-.155s
# old non ustar/POSIX tar
>257 string !ustar
>>508 string =tar\0
# padding[255] in old star
>>>257 string >\0 \b, padding: %-.40s
>>508 default x
# padding[255] in old tar sometimes comment field
>>>257 string >\0 \b, comment: %-.40s
# Summary: Comic Book Archive *.CBT with TAR format
# URL: https://en.wikipedia.org/wiki/Comic_book_archive
# http://fileformats.archiveteam.org/wiki/Comic_Book_Archive
# Note: there exist also RAR, ZIP, ACE and 7Z packed variants
0 name tar-cbt
>0 string x Comic Book archive, tar archive
#!:mime application/x-tar
!:mime application/vnd.comicbook
#!:mime application/vnd.comicbook+tar
!:ext cbt
# name[100] probably like: 19.jpg 0001.png 0002.png
# or maybe like ComicInfo.xml
>0 string >\0 \b, 1st image %-.60s
# Summary: Open Virtualization Format *.OVF with disk images and more packed as TAR archive *.OVA
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Open_Virtualization_Format
# http://fileformats.archiveteam.org/wiki/OVF_(Open_Virtualization_Format)
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/o/ova.trid.xml
# Note: called "Open Virtualization Format package" by TrID
# assuming *.ovf comes first
0 name tar-ova
>0 string x Open Virtualization Format Archive
#!:mime application/x-ustar
# http://extension.nirsoft.net/ova
!:mime application/x-virtualbox-ova
!:ext ova
# assuming name[100] like: DOS-0.9.ovf FreeDOS_1.ovf Win98SE_DE.ovf
>0 string >\0 \b, with %-.60s
# Incremental snapshot gnu-tar format from:
# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
0 string GNU\ tar- GNU tar incremental snapshot data
>&0 regex [0-9]\\.[0-9]+-[0-9]+ version %s
# cpio archives
#
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats and thus are strings, not numbers.
# URL: http://fileformats.archiveteam.org/wiki/Cpio
# https://en.wikipedia.org/wiki/Cpio
# Reference: https://people.freebsd.org/~kientzle/libarchive/man/cpio.5.txt
# Update: Joerg Jenderek
#
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cpio-bin.trid.xml
# Note: called "CPIO archive (binary)" by TrID, "cpio/Binary LE" by 7-Zip and "CPIO" by DROID via PUID fmt/635
0 short 070707
# skip DROID fmt-635-signature-id-960.cpio by looking for pathname of 1st entry
>26 string >\0 cpio archive
!:mime application/x-cpio
# https://download.opensuse.org/distribution/leap/15.4/iso/openSUSE-Leap-15.4-NET-x86_64-Media.iso
# boot/x86_64/loader/bootlogo
# message.cpi
!:ext /cpio/cpi
>>0 use cpio-bin
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cpio-bin-sw.trid.xml
# Note: called "CPIO archive (byte swapped binary)" by TrID and "Cpio/Binary BE" by 7-Zip
0 short 0143561 byte-swapped cpio archive
!:mime application/x-cpio # encoding: swapped
# https://telparia.com/fileFormatSamples/archive/cpio/skeleton2.cpio
!:ext cpio
>0 use cpio-bin-be
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cpio.trid.xml
# Note: called "CPIO archive (portable)" by TrID, "cpio/Portable ASCII" by 7-Zip and "cpio/odc" by GNU cpio
0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
!:mime application/x-cpio
# https://telparia.com/fileFormatSamples/archive/cpio/ pthreads-1.60B5.osr5src.cpio cinema.cpi VOL.000.008 VOL.000.012
!:ext cpio/cpi/008/012
# Note: called "CPIO archive (portable)" by TrID, "cpio/New ASCII" by 7-Zip and "cpio/newc" by GNU cpio
0 string 070701 ASCII cpio archive (SVR4 with no CRC)
!:mime application/x-cpio
# https://telparia.com/fileFormatSamples/archive/cpio/MainActor-2.06.3.cpio
!:ext cpio
# Note: called "CPIO archive (portable)" by TrID, "cpio/New CRC" by 7-Zip and "cpio/crc" by GNU cpio
0 string 070702 ASCII cpio archive (SVR4 with CRC)
!:mime application/x-cpio
# http://ftp.gnu.org/gnu/tar/tar-1.27.cpio.gz
# https://telparia.com/fileFormatSamples/archive/cpio/pcmcia
!:ext /cpio
# display information of old binary cpio archive
# Note: verfied by 7-Zip `7z l -tcpio -slt *.cpio` and
# `cpio -ivt --numeric-uid-gid --file=clam.bin-le.cpio`
0 name cpio-bin
# c_dev; device number; WHAT IS THAT?
>2 uleshort x \b; device %u
# c_ino; truncated inode number; use `ls --inode`
>4 uleshort x \b, inode %u
# c_mode; mode specifies permissions and file type like: ?622~?rw-r--r-- by `ls -l`
>6 uleshort x \b, mode %o
# c_uid; numeric user id; use `ls --numeric-uid-gid`
>8 uleshort x \b, uid %u
# c_gid; numeric group id
>10 uleshort x \b, gid %u
# c_nlink; links to this file; directories at least 2
>12 uleshort >1 \b, %u links
# c_rdev; device number for block and character entries; zero for all other entries by writers
# like 0x0440 for /dev/ttyS0
>14 uleshort >0 \b, device %#4.4x
# c_mtime[2]; modification time in seconds since 1 January 1970; most-significant 16 bits first
>16 medate x \b, modified %s
# c_filesize[2]; size of pathname; most-significant 16 bits first like: 544
>22 melong x \b, %u bytes
# c_namesize; bytes in the pathname that follows the header like: 9
#>20 uleshort x \b, namesize %u
# pathname of entry like: "clam.exe"
>26 string x "%s"
# display information of old binary byte swapped cpio archive
# Note: verfied by 7-Zip `7z l -tcpio -slt *.cpio` and
# `LANGUAGE=C cpio -ivt --numeric-uid-gid --file=clam.bin-be.cpio`
0 name cpio-bin-be
>2 ubeshort x \b; device %u
>4 ubeshort x \b, inode %u
>6 ubeshort x \b, mode %o
>8 ubeshort x \b, uid %u
>10 ubeshort x \b, gid %u
>12 ubeshort >1 \b, %u links
>14 ubeshort >0 \b, device %#4.4x
>16 bedate x \b, modified %s
>22 ubelong x \b, %u bytes
#>20 ubeshort x \b, namesize %u
>26 string x "%s"
#
# Various archive formats used by various versions of the "ar"
# command.
#
#
# Original UNIX archive formats.
# They were written with binary values in host byte order, and
# the magic number was a host "int", which might have been 16 bits
# or 32 bits. We don't say "PDP-11" or "VAX", as there might have
# been ports to little-endian 16-bit-int or 32-bit-int platforms
# (x86?) using some of those formats; if none existed, feel free
# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
# 32-bit. There might have been big-endian ports of that sort as
# well.
#
0 leshort 0177555 very old 16-bit-int little-endian archive
0 beshort 0177555 very old 16-bit-int big-endian archive
0 lelong 0177555 very old 32-bit-int little-endian archive
0 belong 0177555 very old 32-bit-int big-endian archive
0 leshort 0177545 old 16-bit-int little-endian archive
>2 string __.SYMDEF random library
0 beshort 0177545 old 16-bit-int big-endian archive
>2 string __.SYMDEF random library
0 lelong 0177545 old 32-bit-int little-endian archive
>4 string __.SYMDEF random library
0 belong 0177545 old 32-bit-int big-endian archive
>4 string __.SYMDEF random library
#
# From "pdp" (but why a 4-byte quantity?)
#
0 lelong 0x39bed PDP-11 old archive
0 lelong 0x39bee PDP-11 4.0 archive
#
# XXX - what flavor of APL used this, and was it a variant of
# some ar archive format? It's similar to, but not the same
# as, the APL workspace magic numbers in pdp.
#
0 long 0100554 apl workspace
#
# System V Release 1 portable(?) archive format.
#
0 string =<ar> System V Release 1 ar archive
!:mime application/x-archive
#
# Debian package; it's in the portable archive format, and needs to go
# before the entry for regular portable archives, as it's recognized as
# a portable archive whose first member has a name beginning with
# "debian".
#
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Deb_(file_format)
0 string =!<arch>\ndebian
# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html
>14 string -split part of multipart Debian package
!:mime application/vnd.debian.binary-package
# udeb is used for stripped down deb file
!:ext deb/udeb
>14 string -binary Debian binary package
!:mime application/vnd.debian.binary-package
# For ipk packager see also https://en.wikipedia.org/wiki/Opkg
!:ext deb/udeb/ipk
# This should not happen
>14 default x Unknown Debian package
# NL terminated version; for most Debian cases this is 2.0 or 2.1 for split
>68 string >\0 (format %s)
#>68 string !2.0\n
#>>68 string x (format %.3s)
>68 string =2.0\n
# 2nd archive name=control archive name like control.tar.gz or control.tar.xz
# or control.tar.zst
>>72 string >\0 \b, with %.15s
# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma}
>>0 search/0x93e4f data.tar. \b, data compression
# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised
# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb
>>>&0 string x %.2s
# skip space (0x20 BSD) and slash (0x2f System V) character marking end of name
>>>&2 ubyte !0x20
>>>>&-1 ubyte !0x2f
# display 3rd character of file name extension like 2 of bz2 or m of lzma
>>>>>&-1 ubyte x \b%c
>>>>>>&0 ubyte !0x20
>>>>>>>&-1 ubyte !0x2f
# display 4th character of file name extension like a of lzma
>>>>>>>>&-1 ubyte x \b%c
# split debian package case
>68 string =2.1\n
# dpkg-1.18.25/dpkg-split/info.c
# NL terminated ASCII package name like ckermit
>>&0 string x \b, %s
# NL terminated package version like 302-5.3
>>>&1 string x %s
# NL terminated MD5 checksum
>>>>&1 string x \b, MD5 %s
# NL terminated original package length
>>>>>&1 string x \b, unsplitted size %s
# NL terminated part length
>>>>>>&1 string x \b, part length %s
# NL terminated package part like n/m
>>>>>>>&1 string x \b, part %s
# NL terminated package architecture like armhf since dpkg 1.16.1 or later
>>>>>>>>&1 string x \b, %s
#
# MIPS archive; they're in the portable archive format, and need to go
# before the entry for regular portable archives, as it's recognized as
# a portable archive whose first member has a name beginning with
# "__________E".
#
0 string =!<arch>\n__________E MIPS archive
!:mime application/x-archive
>20 string U with MIPS Ucode members
>21 string L with MIPSEL members
>21 string B with MIPSEB members
>19 string L and an EL hash table
>19 string B and an EB hash table
>22 string X -- out of date
#
# BSD/SVR2-and-later portable archive formats.
#
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/AR
# Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/
# Note: Mach-O universal binary in ./cafebabe is dependent
# TODO: unify current ar archive, MIPS archive, Debian package
# distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR;
# *.ar packages from *.a libraries. handle empty archive
0 string =!<arch>\n current ar archive
# print first and possibly second ar_name[16] for debugging purpose
#>8 string x \b, 1st "%.16s"
#>68 string x \b, 2nd "%.16s"
!:mime application/x-archive
# a in most case for libraries; lib for Microsoft libraries; ar else cases
!:ext a/lib/ar
>8 string __.SYMDEF random library
# first member with long marked name __.SYMDEF SORTED implies BSD library
>68 string __.SYMDEF\ SORTED random library
# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf
# "archive file" entry moved from ./hp
# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture
# LST header a_magic 0619h~relocatable library
>68 belong 0x020b0619 - PA-RISC1.0 relocatable library
>68 belong 0x02100619 - PA-RISC1.1 relocatable library
>68 belong 0x02110619 - PA-RISC1.2 relocatable library
>68 belong 0x02140619 - PA-RISC2.0 relocatable library
#EOF for common ar archives
#
# "Thin" archive, as can be produced by GNU ar.
#
0 string =!<thin>\n thin archive with
>68 belong 0 no symbol entries
>68 belong 1 %d symbol entry
>68 belong >1 %d symbol entries
0 search/1 -h- Software Tools format archive text
# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
# filename of the first file (null terminated). Since some types collide
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
!:mime application/x-arc
0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
!:mime application/x-arc
0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
!:mime application/x-arc
0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
!:mime application/x-arc
0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
!:mime application/x-arc
0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
!:mime application/x-arc
# [JW] stuff taken from idarc, obviously ARC successors:
0 lelong&0x8080ffff 0x00000a1a PAK archive data
!:mime application/x-arc
0 lelong&0x8080ffff 0x0000141a ARC+ archive data
!:mime application/x-arc
0 lelong&0x8080ffff 0x0000481a HYP archive data
!:mime application/x-arc
# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
# [GRR: the original entries collide with ARC, above; replaced with combined
# version (not tested)]
#0 byte 0x1a RISC OS archive (spark format)
0 string \032archive RISC OS archive (ArcFS format)
0 string Archive\000 RISC OS archive (ArcFS format)
# All these were taken from idarc, many could not be verified. Unfortunately,
# there were many low-quality sigs, i.e. easy to trigger false positives.
# Please notify me of any real-world fishy/ambiguous signatures and I'll try
# to get my hands on the actual archiver and see if I find something better. [JW]
# probably many can be enhanced by finding some 0-byte or control char near the start
# idarc calls this Crush/Uncompressed... *shrug*
0 string CRUSH Crush archive data
# Squeeze It (.sqz)
0 string HLSQZ Squeeze It archive data
# SQWEZ
0 string SQWEZ SQWEZ archive data
# HPack (.hpk)
0 string HPAK HPack archive data
# HAP
0 string \x91\x33HF HAP archive data
# MD/MDCD
0 string MDmd MDCD archive data
# LIM
0 string LIM\x1a LIM archive data
# SAR
3 string LH5 SAR archive data
# BSArc/BS2
0 string \212\3SB\020\0 BSArc/BS2 archive data
# Bethesda Softworks Archive (Oblivion)
0 string BSA\0 BSArc archive data
>4 lelong x version %d
# MAR
2 string =-ah MAR archive data
# ACB
#0 belong&0x00f800ff 0x00800000 ACB archive data
# CPZ
# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
# JRC
0 string JRchive JRC archive data
# Quantum
0 string DS\0 Quantum archive data
# ReSOF
0 string PK\3\6 ReSOF archive data
# QuArk
0 string 7\4 QuArk archive data
# YAC
14 string YC YAC archive data
# X1
0 string X1 X1 archive data
0 string XhDr X1 archive data
# CDC Codec (.dqt)
0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
# AMGC
0 string \xad6" AMGC archive data
# NuLIB
0 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
# PakLeo
0 string LEOLZW PAKLeo archive data
# ChArc
0 string SChF ChArc archive data
# PSA
0 string PSA PSA archive data
# CrossePAC
0 string DSIGDCC CrossePAC archive data
# Freeze
0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
# KBoom
0 string \xc2\xa8MP\xc2\xa8 KBoom archive data
# NSQ, must go after CDC Codec
0 string \x76\xff NSQ archive data
# DPA
0 string Dirk\ Paehl DPA archive data
# BA
# TODO: idarc says "bytes 0-2 == bytes 3-5"
# TTComp
# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive
# Update: Joerg Jenderek
# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others
0 string \0\6
# look for first keyword of Panorama database *.pan
>12 search/261 DESIGN
# skip keyword with low entropy
>12 default x
# skip DOS 2.0 backup id file, sequence 6 with many nils like BACKUPID_xx6.@@@ handled by ./msdos
>>8 quad !0
>>>0 use ttcomp
# variant ASCII, 4K dictionary (strength=48=50-2). With strength=49 wrong order! WHY?
0 string \1\6
# TODO:
# skip VAX-order 68k Blit mpx/mux executable (strength=50) handled by ./blit
!:strength -2
>0 use ttcomp
0 string \0\5
# skip some DOS 2.0 backup id file, sequence 5 with many nils like BACKUPID_075.@@@ handled by ./msdos
>8 quad !0
>>0 use ttcomp
0 string \1\5
# TODO:
# variant ASCII, 2K dictionary (strength=48=50-2). With strength=49 wrong order! WHY?
# skip ctab data (strength=50) handled by ./ibm6000
# skip locale data table (strength=50) handled by ./digital
!:strength -2
>0 use ttcomp
0 string \0\4
# skip many Maple help database *.hdb with version tag handled by ./maple
>1028 string !version
# skip veclib maple.hdb by looking for Mable keyword
>>4 search/1091 Maple\040
#>4 search/34090 Maple\040
>>4 default x
# skip DOS 2.0-3.2 backed up sequence 4 with many nils like LOTUS5.RAR handled by ./msdos
# skip xBASE Compound Index file *.CDX with many nils
>>>0x54 quad !0
>>>>0 use ttcomp
0 string \1\4
# TODO:
# skip shared library (strength=50) handled by ./ibm6000
!:strength -2
# skip Commodore PET BASIC programs (Mastermind.prg) with last 3 nil bytes (\0~end of line followed by 0000h line offset)
#>-4 ubelong x LAST_BYTES=%8.8x
>-4 ubelong&0x00FFffFF !0
>>0 use ttcomp
# display information of TTComp archive
0 name ttcomp
# (version 5.25) labeled the entry as "TTComp archive data"
>0 ubyte x TTComp archive data
!:mime application/x-compress-ttcomp
# PBACKSCR.PI1
!:ext $xe/$ts/pi1/__d
# compression type: 0~binary compression 1~ASCII compression
>0 ubyte 0 \b, binary
>0 ubyte 1 \b, ASCII
# size of the dictionary: 4~1024 bytes 5~2048 bytes 6~4096 bytes
>1 ubyte 4 \b, 1K
>1 ubyte 5 \b, 2K
>1 ubyte 6 \b, 4K
>1 ubyte x dictionary
# https://mark0.net/forum/index.php?topic=848
# last 3 bytes probably have only 8 possible bit sequences
# xxxxxxxx 0000000x 11111111 ____FFh
# xxxxxxxx 10000000 01111111 __807Fh
# 0xxxxxxx 11000000 00111111 __C03Fh
# 00xxxxxx 11100000 00011111 __E01Fh
# 000xxxxx 11110000 00001111 __F00Fh
# 0000xxxx 11111000 00000111 __F807h
# 00000xxx 11111100 00000011 __FC03h
# 000000xx 11111110 00000001 __FE01h
# but for quickgif.__d 0A7DD4h
#>-3 ubyte x \b, last 3 bytes 0x%2.2x
#>-2 ubeshort x \b%4.4x
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Disk_Copy
# reference: http://nulib.com/library/FTN.e00005.htm
0x52 ubeshort 0x0100
# test for disk image size equal or above 400k
>0x40 ubelong >409599
# test also for disk image size equal or below 1440k to skip
# windows7en.mbr UNICODE.DAT
#>>0x40 ubelong <1474561
# test now for "low" disk image size equal or below 64 MiB to skip
# windows7en.mbr (B441BBAAh) UNICODE.DAT (0400AF05h)
>>0x40 ubelong <0x04000001
# To skip Flags$StringJoiner.class with size 00106A61h test also for valid disk image sizes
# 00064000 for 400k GCR disks dc42-400k-gcr.trid.xml
# 000c8000 for 800k GCR disks dc42-800k-gcr.trid.xml
# 000b4000 for 720k MFM disks dc42-720k-mfm.trid.xml
# 00168000 for 1440k MFM disks dc42-1440k-mfm.trid.xml
# https://lisaem.sunder.net/LisaProjectDocs.txt
# 00500000 05M available
# 00A00000 10M available
# 01800000 24M possible
# 02000000 32M uncertain
# 04000000 64M uncertain
>>>0x40 ubelong&0xf8003fFF 0
# skip samples with invalid disk name length like:
# 181 (biosmd80.rom) 202 (Flags$StringJoiner.class) 90 (UNICODE.DAT)
>>>>0x0 ubyte <64
>>>>>0 use dc42-floppy
# display information of Apple DiskCopy 4.2 floppy image
0 name dc42-floppy
# disk name length; maximal 63
#>0 ubyte x DISK NAME LENGTH %u
# ASCII image pascal (maximal 63 bytes) name padded with NULs like:
# "Microsoft Mail" "Disquette 2" "IIe Installer Disk"
# "-lisaem.sunder.net hd-" (dc42-lisaem.trid.xml) "-not a Macintosh disk" (dc42-nonmac.trid.xml)
>00 pstring/B x Apple DiskCopy 4.2 image %s
#!:mime application/octet-stream
!:mime application/x-dc42-floppy-image
!:apple dCpydImg
# probably also img like: "Utilitaires 2.img" "Installation 7.img"
!:ext image/dc42/img
# data size in bytes like: 409600 737280 819200 1474560
>0x40 ubelong x \b, %u bytes
# for debugging purpose size in hexadecimal
#>0x40 ubelong x (%#8.8x)
# tag size in bytes like: 0 (often) 2580h (PUID fmt/625) 4B00h (Microsoft Mail.image)
>0x44 ubelong >0 \b, %#x tag size
# data checksum
#>0x48 ubelong x \b, %#x checksum
# tag checksum
#>0x4c ubelong x \b, %#x tag checksum
# disk encoding like: 0 1 2 3 (PUID: fmt/625)
>0x50 ubyte 0 \b, GCR CLV ssdd (400k)
>0x50 ubyte 1 \b, GCR CLV dsdd (800k)
>0x50 ubyte 2 \b, MFM CAV dsdd (720k)
>0x50 ubyte 3 \b, MFM CAV dshd (1440k)
>0x50 ubyte >3 \b, %#x encoding
# format byte like: 12h (Lisa 400K) 24h (400K Macintosh) 96h (800K Apple II disk)
# 2 (Mac 400k "Disquette Installation 13.image")
# 22h (double-sided MFM or Mac 800k "Disco 12.image" "IIe Installer Disk.image")
>0x51 ubyte x \b, %#x format
#>0x54 ubequad x \b, data %#16.16llx
# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
0 string ESP ESP archive data
# ZPack
0 string \1ZPK\1 ZPack archive data
# Sky
0 string \xbc\x40 Sky archive data
# UFA
0 string UFA UFA archive data
# Dry
0 string =-H2O DRY archive data
# FoxSQZ
0 string FOXSQZ FoxSQZ archive data
# AR7
0 string ,AR7 AR7 archive data
# PPMZ
0 string PPMZ PPMZ archive data
# MS Compress
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html
# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z
4 string \x88\xf0\x27
# KWAJ variant
>0 string KWAJ MS Compress archive data, KWAJ variant
!:mime application/x-ms-compress-kwaj
# extension not working in version 5.32
# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?'
# file: line 284: Bad magic entry ' ??_'
!:ext ??_
# compression method (0-4)
>>8 uleshort x \b, %u method
# offset of compressed data
>>10 uleshort x \b, %#x offset
#>>(10.s) uleshort x
#>>>&-6 string x \b, TEST extension %-.3s
# header flags to mark header extensions
>>12 uleshort >0 \b, %#x flags
# 4 bytes: decompressed length of file
>>12 uleshort &0x01
>>>14 ulelong x \b, original size: %u bytes
# 2 bytes: unknown purpose
# 2 bytes: length of unknown data + mentioned bytes
# 1-9 bytes: null-terminated file name
# 1-4 bytes: null-terminated file extension
>>12 uleshort &0x08
>>>12 uleshort ^0x01
>>>>12 uleshort ^0x02
>>>>>12 uleshort ^0x04
>>>>>>12 uleshort ^0x10
>>>>>>>14 string x \b, %-.8s
>>>>>>12 uleshort &0x10
>>>>>>>14 string x \b, %-.8s
>>>>>>>>&1 string x \b.%-.3s
>>>>>12 uleshort &0x04
>>>>>>12 uleshort ^0x10
>>>>>>>(14.s) uleshort x
>>>>>>>>&14 string x \b, %-.8s
>>>>>>12 uleshort &0x10
>>>>>>>(14.s) uleshort x
>>>>>>>>&14 string x \b, %-.8s
>>>>>>>>>&1 string x \b.%-.3s
>>>>12 uleshort &0x02
>>>>>12 uleshort ^0x04
>>>>>>12 uleshort ^0x10
>>>>>>>16 string x \b, %-.8s
>>>>>>12 uleshort &0x10
>>>>>>>16 string x \b, %-.8s
>>>>>>>>&1 string x \b.%-.3s
>>>>>12 uleshort &0x04
>>>>>>12 uleshort ^0x10
>>>>>>>(16.s) uleshort x
>>>>>>>>&16 string x \b, %-.8s
>>>>>>12 uleshort &0x10
>>>>>>>(16.s) uleshort x
>>>>>>>&16 string x %-.8s
>>>>>>>>&1 string x \b.%-.3s
>>>12 uleshort &0x01
>>>>12 uleshort ^0x02
>>>>>12 uleshort ^0x04
>>>>>>12 uleshort ^0x10
>>>>>>>18 string x \b, %-.8s
>>>>>>12 uleshort &0x10
>>>>>>>18 string x \b, %-.8s
>>>>>>>>&1 string x \b.%-.3s
>>>>>12 uleshort &0x04
>>>>>>12 uleshort ^0x10
>>>>>>>(18.s) uleshort x
>>>>>>>>&18 string x \b, %-.8s
>>>>>>12 uleshort &0x10
>>>>>>>(18.s) uleshort x
>>>>>>>>&18 string x \b, %-.8s
>>>>>>>>>&1 string x \b.%-.3s
>>>>12 uleshort &0x02
>>>>>12 uleshort ^0x04
>>>>>>12 uleshort ^0x10
>>>>>>>20 string x \b, %-.8s
>>>>>>12 uleshort &0x10
>>>>>>>20 string x \b, %-.8s
>>>>>>>>&1 string x \b.%-.3s
>>>>>12 uleshort &0x04
>>>>>>12 uleshort ^0x10
>>>>>>>(20.s) uleshort x
>>>>>>>>&20 string x \b, %-.8s
>>>>>>12 uleshort &0x10
>>>>>>>(20.s) uleshort x
>>>>>>>>&20 string x \b, %-.8s
>>>>>>>>>&1 string x \b.%-.3s
# 2 bytes: length of data + mentioned bytes
#
# SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ
# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
# Reference: http://www.cabextract.org.uk/libmspack/doc/szdd_kwaj_format.html
# http://mark0.net/download/triddefs_xml.7z/defs/s/szdd.trid.xml
# Note: called "Microsoft SZDD compressed (Haruhiko Okumura's LZSS)" by TrID
# verfied by 7-Zip `7z l -tMsLZ -slt *.??_` as MsLZ
# `deark -l -m lzss_oku -d2 setup-1-41.bin` as "LZSS.C by Haruhiko Okumura"
>0 string SZDD MS Compress archive data, SZDD variant
# 2nd part of signature
#>>4 ubelong 0x88F02733 \b, SIGNATURE OK
!:mime application/x-ms-compress-szdd
!:ext ??_
# The character missing from the end of the filename (0=unknown)
>>9 string >\0 \b, %-.1s is last character of original name
# https://www.betaarchive.com/forum/viewtopic.php?t=26161
# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e
>>8 string !A \b, %-.1s method
>>10 ulelong >0 \b, original size: %u bytes
# Summary: InstallShield archive with SZDD compressed
# URL: https://community.flexera.com/t5/InstallShield-Knowledge-Base/InstallShield-Redistributable-Files/ta-p/5647
# From: Joerg Jenderek
1 search/48/bs SZDD\x88\xF0\x27\x33 InstallShield archive
#!:mime application/octet-stream
!:mime application/x-installshield-compress-szdd
!:ext ibt
# name of compressed archive member like: setup.dl_ _setup7int.dl_ _setup2k.dl_ _igdi.dl_ cabinet.dl_
>0 string x %s
# name of uncompressed archive member like: setup.dll _Setup.dll IGdi.dll CABINET.DLL
>>&1 string x (%s)
# probably version like: 9.0.0.333 9.1.0.429 11.50.0.42618
>>>&1 string x \b, version %s
# SZDD member length like: 168048 169333 181842
>>>>&1 string x \b, %s bytes
# MS Compress archive data
#>&0 string SZDD \b, SIGNATURE FOUND
>&0 indirect x
# QBasic SZDD variant
3 string \x88\xf0\x27
>0 string SZ\x20 MS Compress archive data, QBasic variant
!:mime application/x-ms-compress-sz
!:ext ??$
>>8 ulelong >0 \b, original size: %u bytes
# Summary: lzss compressed/EDI Pack
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/EDI_Install_packed_file
# Note: called "EDI Install LZS compressed data" by TrID and verified by
# command like `deark -l -m edi_pack -d2 BOOK01A.IC$` as "EDI Pack LZSS1"
0 string EDILZSS
>7 string 1
# look for point character before orginal file name extension
>>8 search/9/b .
# check suffix of possible orginal file anme
#>>>&0 ubelong x SUFFIX=%8.8x
# samples without valid character after point in original file name field like: FENNEL.LZS PLANTAIN.LZS
>>>&0 ubyte <0x20
>>>>0 use edi-lzs
# samples with valid character after point in original file name field
>>>&0 ubyte >0x1F
# check 2nd charcter of suffix
#>>>>&0 ubyte x 2ND_SUFFIX=%x
# sample with one valid character after point followed by \0 in original file name field like: SPELMATE.H$
>>>>&0 ubyte =0
>>>>>0 use edi-pack
>>>>&0 ubyte >0x1F
# check 3rd charcter of suffix
#>>>>>&0 ubyte x 3RD_SUFFIX=%x
# no sample with 2 valid characters after point followed by \0 in original file name field
>>>>>&0 ubyte =0
>>>>>>0 use edi-pack
# samples with valid 3rd character after point in original file name field
>>>>>&0 ubyte >0x1F
# sample with 3 valid character after point followed by \0 in original file name field like: BOOK01A.IC$ CTL3D.DL$
>>>>>>&0 ubyte =0
>>>>>>>0 use edi-pack
# sample with 3 valid character after point followed by no \0 in original file name field like: HERBTEXT.LZS
>>>>>>&0 ubyte !0
>>>>>>>0 use edi-lzs
# no sample with invalid 3rd character after point in original file name field
>>>>>&0 default x
>>>>>>0 use edi-lzs
# sample with invalid 2nd character after point in original file name field like: LACERATE.LZS SPLINTER.LZS
>>>>&0 default x
>>>>>0 use edi-lzs
# sample without point character in original file name field like GUNSHOT.LZS
>>8 default x
>>>0 use edi-lzs
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/e/edi-lzss2.trid.xml
# Note: called "EDI Install Pro LZSS2 compressed data" by TrID and verified by
# command like `deark -l -m edi_pack -d2 4WAY.WA$` as "EDI Pack LZSS2"
>7 string 2 EDI LZSS2 packed
#!:mime application/octet-stream
!:mime application/x-edi-pack-lzss
# the name of a compressed file often ends in character '$' or '_'
!:ext ??$/??_
# original filename, NUL-terminated, padded to 13 bytes like: mci.vbx 4way.wav skymap.exe cmdialog.vbx
>>8 string x "%-0.13s"
# original file size, as a 4-byte integer.
>>21 ulelong x \b, %u bytes
# compressed data like: ff5249464606ec00 ff4d5aa601010000
>>>25 ubequad x \b, data %#16.16llx...
0 name edi-pack
# Note: verified by command like `deark -l -d2 SPELMATE.H$` as "EDI Pack LZSS1"
# original filename, NUL-terminated, padded to 13 bytes like: ctl3d.dll spelmate.h filemenu.rc owl.def index-it.exe
# but not like \377Aloe.lzs\273 (HERBTEXT.LZS)
>8 string x EDI LZSS packed "%-.13s"
#!:mime application/octet-stream
!:mime application/x-edi-pack-lzss
# the name of a compressed file often ends in character '$' or '_'
!:ext ??$/?$
# compressed data like: f7000001eff02020 ff4d5aa900020000 ff2f2a207370656c
>21 ubequad x \b, data %#16.16llx...
# URL: http://fileformats.archiveteam.org/wiki/EDI_LZSSLib
# Note: verified partly by command like `deark -l -m edi_pack -d2 GUNSHOT.LZS` as "EDI LZSSLib"
0 name edi-lzs
# Note: verified by command like `deark -l -d2 GUNSHOT.LZS` as "EDI LZSSLib"
# no original filename looks like: \277BM\226.\0 \277BM.n\001 \277BM\226.\0 \277BM.g\001 \377Aloe.lzs\273
>8 string x EDI LZSSLib packed
#!:mime application/octet-stream
!:mime application/x-edi-pack-lzss
# The name of a compressed file ends with LZS suffix
!:ext lzs
# compressed data like: bf424df6e10100f3 ff416c6f652e6c7a ff416c6f652e6c7a
>8 ubequad x \b, data %#16.16llx...
# Summary: CAZIP compressed file
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/CAZIP
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/caz.trid.xml
# Note: Format is distinct from CAZIPXP compressed
0 string \x0D\x0A\x1ACAZIP CAZIP compressed file
#!:mime application/octet-stream
!:mime application/x-compress-cazip
# like: BLINKER.WR_ CLIPDEFS._ CAOSETUP.EX_ CLIPPER.EX_ FILEIO.C_
!:ext ??_/?_/_
# Summary: FTCOMP compressed archive
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/FTCOMP
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-ftcomp.trid.xml
# Note: called by TrID "FTCOMP compressed archive"
# extracted by `unpack seahelp.hl_`
24 string/b FTCOMP FTCOMP compressed archive
#!:mime application/octet-stream
!:mime application/x-compress-ftcomp
!:ext ??_/??@/dll/drv/pk2/
# probably A596FDFF magic at the beginning
>0 ubelong !0xA596FDFF \b, at beginning %#x
# probably original file name with directory like: \OS2\unpack.exe \SYSTEM\8514.DRV MAHJONGG.EXE
>41 string x "%s"
# MP3 (archiver, not lossy audio compression)
0 string MP3\x1a MP3-Archiver archive data
# ZET
0 string OZ\xc3\x9d ZET archive data
# TSComp
0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
# ARQ
0 string gW\4\1 ARQ archive data
# Squash
3 string OctSqu Squash archive data
# Terse
0 string \5\1\1\0 Terse archive data
# UHarc
0 string UHA UHarc archive data
# ABComp
0 string \2AB ABComp archive data
0 string \3AB2 ABComp archive data
# CMP
0 string CO\0 CMP archive data
# Splint
0 string \x93\xb9\x06 Splint archive data
# InstallShield
0 string \x13\x5d\x65\x8c InstallShield Z archive Data
# Gather
1 string GTH Gather archive data
# BOA
0 string BOA BOA archive data
# RAX
0 string ULEB\xa RAX archive data
# Xtreme
0 string ULEB\0 Xtreme archive data
# Pack Magic
0 string @\xc3\xa2\1\0 Pack Magic archive data
# BTS
0 belong&0xfeffffff 0x1a034465 BTS archive data
# ELI 5750
0 string Ora\ ELI 5750 archive data
# QFC
0 string \x1aFC\x1a QFC archive data
0 string \x1aQF\x1a QFC archive data
# PRO-PACK https://www.segaretro.org/Rob_Northen_compression
0 string RNC
>3 byte 1 PRO-PACK archive data (compression 1)
>3 byte 2 PRO-PACK archive data (compression 2)
# 777
0 string 777 777 archive data