| blob | b1c8d0bfb3cc63b3024196b6e001e671a32ee1ff |
1 #------------------------------------------------------------------------------
2 # $File: filesystems,v 1.131 2019/11/15 23:49:38 christos Exp $
3 # filesystems: file(1) magic for different filesystems
4 #
5 0 name partid
6 >0 ubyte 0x00 Unused
7 >0 ubyte 0x01 12-bit FAT
8 >0 ubyte 0x02 XENIX /
9 >0 ubyte 0x03 XENIX /usr
10 >0 ubyte 0x04 16-bit FAT, less than 32M
11 >0 ubyte 0x05 extended partition
12 >0 ubyte 0x06 16-bit FAT, more than 32M
13 >0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX
14 >0 ubyte 0x08 AIX or os, or etc.
15 >0 ubyte 0x09 AIX boot partition or Coherent
16 >0 ubyte 0x0a O/2 boot manager or Coherent swap
17 >0 ubyte 0x0b 32-bit FAT
18 >0 ubyte 0x0c 32-bit FAT, LBA-mapped
19 >0 ubyte 0x0d 7XXX, LBA-mapped
20 >0 ubyte 0x0e 16-bit FAT, LBA-mapped
21 >0 ubyte 0x0f extended partition, LBA-mapped
22 >0 ubyte 0x10 OPUS
23 >0 ubyte 0x11 OS/2 DOS 12-bit FAT
24 >0 ubyte 0x12 Compaq diagnostics
25 >0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M
26 >0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M
27 >0 ubyte 0x17 OS/2 hidden IFS
28 >0 ubyte 0x18 AST Windows swapfile
29 >0 ubyte 0x19 Willowtech Photon coS
30 >0 ubyte 0x1b hidden win95 fat 32
31 >0 ubyte 0x1c hidden win95 fat 32 lba
32 >0 ubyte 0x1d hidden win95 fat 16 lba
33 >0 ubyte 0x20 Willowsoft OFS1
34 >0 ubyte 0x21 reserved
35 >0 ubyte 0x23 reserved
36 >0 ubyte 0x24 NEC DOS
37 >0 ubyte 0x26 reserved
38 >0 ubyte 0x31 reserved
39 >0 ubyte 0x32 Alien Internet Services NOS
40 >0 ubyte 0x33 reserved
41 >0 ubyte 0x34 reserved
42 >0 ubyte 0x35 JFS on OS2
43 >0 ubyte 0x36 reserved
44 >0 ubyte 0x38 Theos
45 >0 ubyte 0x39 Plan 9, or Theos spanned
46 >0 ubyte 0x3a Theos ver 4 4gb partition
47 >0 ubyte 0x3b Theos ve 4 extended partition
48 >0 ubyte 0x3c PartitionMagic recovery
49 >0 ubyte 0x3d Hidden Netware
50 >0 ubyte 0x40 VENIX 286 or LynxOS
51 >0 ubyte 0x41 PReP
52 >0 ubyte 0x42 linux swap sharing DRDOS disk
53 >0 ubyte 0x43 linux sharing DRDOS disk
54 >0 ubyte 0x44 GoBack change utility
55 >0 ubyte 0x45 Boot US Boot manager
56 >0 ubyte 0x46 EUMEL/Elan or Ergos 3
57 >0 ubyte 0x47 EUMEL/Elan or Ergos 3
58 >0 ubyte 0x48 EUMEL/Elan or Ergos 3
59 >0 ubyte 0x4a ALFX/THIN filesystem for DOS
60 >0 ubyte 0x4c Oberon partition
61 >0 ubyte 0x4d QNX4.x
62 >0 ubyte 0x4e QNX4.x 2nd part
63 >0 ubyte 0x4f QNX4.x 3rd part
64 >0 ubyte 0x50 DM (disk manager)
65 >0 ubyte 0x51 DM6 Aux1 (or Novell)
66 >0 ubyte 0x52 CP/M or Microport SysV/AT
67 >0 ubyte 0x53 DM6 Aux3
68 >0 ubyte 0x54 DM6 DDO
69 >0 ubyte 0x55 EZ-Drive (disk manager)
70 >0 ubyte 0x56 Golden Bow (disk manager)
71 >0 ubyte 0x57 Drive PRO
72 >0 ubyte 0x5c Priam Edisk (disk manager)
73 >0 ubyte 0x61 SpeedStor
74 >0 ubyte 0x63 GNU HURD or Mach or Sys V/386
75 >0 ubyte 0x64 Novell Netware 2.xx or Speedstore
76 >0 ubyte 0x65 Novell Netware 3.xx
77 >0 ubyte 0x66 Novell 386 Netware
78 >0 ubyte 0x67 Novell
79 >0 ubyte 0x68 Novell
80 >0 ubyte 0x69 Novell
81 >0 ubyte 0x70 DiskSecure Multi-Boot
82 >0 ubyte 0x71 reserved
83 >0 ubyte 0x73 reserved
84 >0 ubyte 0x74 reserved
85 >0 ubyte 0x75 PC/IX
86 >0 ubyte 0x76 reserved
87 >0 ubyte 0x77 M2FS/M2CS partition
88 >0 ubyte 0x78 XOSL boot loader filesystem
89 >0 ubyte 0x80 MINIX until 1.4a
90 >0 ubyte 0x81 MINIX since 1.4b
91 >0 ubyte 0x82 Linux swap or Solaris
92 >0 ubyte 0x83 Linux native
93 >0 ubyte 0x84 OS/2 hidden C: drive
94 >0 ubyte 0x85 Linux extended partition
95 >0 ubyte 0x86 NT FAT volume set
96 >0 ubyte 0x87 NTFS volume set or HPFS mirrored
97 >0 ubyte 0x8a Linux Kernel AiR-BOOT partition
98 >0 ubyte 0x8b Legacy Fault tolerant FAT32
99 >0 ubyte 0x8c Legacy Fault tolerant FAT32 ext
100 >0 ubyte 0x8d Hidden free FDISK FAT12
101 >0 ubyte 0x8e Linux Logical Volume Manager
102 >0 ubyte 0x90 Hidden free FDISK FAT16
103 >0 ubyte 0x91 Hidden free FDISK DOS EXT
104 >0 ubyte 0x92 Hidden free FDISK FAT16 Big
105 >0 ubyte 0x93 Amoeba filesystem
106 >0 ubyte 0x94 Amoeba bad block table
107 >0 ubyte 0x95 MIT EXOPC native partitions
108 >0 ubyte 0x97 Hidden free FDISK FAT32
109 >0 ubyte 0x98 Datalight ROM-DOS Super-Boot
110 >0 ubyte 0x99 Mylex EISA SCSI
111 >0 ubyte 0x9a Hidden free FDISK FAT16 LBA
112 >0 ubyte 0x9b Hidden free FDISK EXT LBA
113 >0 ubyte 0x9f BSDI?
114 >0 ubyte 0xa0 IBM Thinkpad hibernation
115 >0 ubyte 0xa1 HP Volume expansion (SpeedStor)
116 >0 ubyte 0xa3 HP Volume expansion (SpeedStor)
117 >0 ubyte 0xa4 HP Volume expansion (SpeedStor)
118 >0 ubyte 0xa5 386BSD partition type
119 >0 ubyte 0xa6 OpenBSD partition type
120 >0 ubyte 0xa7 NeXTSTEP 486
121 >0 ubyte 0xa8 Apple UFS
122 >0 ubyte 0xa9 NetBSD partition type
123 >0 ubyte 0xaa Olivetty Fat12 1.44MB Service part
124 >0 ubyte 0xab Apple Boot
125 >0 ubyte 0xae SHAG OS filesystem
126 >0 ubyte 0xaf Apple HFS
127 >0 ubyte 0xb0 BootStar Dummy
128 >0 ubyte 0xb1 reserved
129 >0 ubyte 0xb3 reserved
130 >0 ubyte 0xb4 reserved
131 >0 ubyte 0xb6 reserved
132 >0 ubyte 0xb7 BSDI BSD/386 filesystem
133 >0 ubyte 0xb8 BSDI BSD/386 swap
134 >0 ubyte 0xbb Boot Wizard Hidden
135 >0 ubyte 0xbe Solaris 8 partition type
136 >0 ubyte 0xbf Solaris partition type
137 >0 ubyte 0xc0 CTOS
138 >0 ubyte 0xc1 DRDOS/sec (FAT-12)
139 >0 ubyte 0xc2 Hidden Linux
140 >0 ubyte 0xc3 Hidden Linux swap
141 >0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M)
142 >0 ubyte 0xc5 DRDOS/sec (EXT)
143 >0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M)
144 >0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled
145 >0 ubyte 0xc8 Reserved for DR-DOS 8.0+
146 >0 ubyte 0xc9 Reserved for DR-DOS 8.0+
147 >0 ubyte 0xca Reserved for DR-DOS 8.0+
148 >0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS
149 >0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA
150 >0 ubyte 0xcd CTOS Memdump
151 >0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA
152 >0 ubyte 0xcf DR-DOS 7.04+ EXT LBA
153 >0 ubyte 0xd0 REAL/32 secure big partition
154 >0 ubyte 0xd1 Old Multiuser DOS FAT12
155 >0 ubyte 0xd4 Old Multiuser DOS FAT16 Small
156 >0 ubyte 0xd5 Old Multiuser DOS Extended
157 >0 ubyte 0xd6 Old Multiuser DOS FAT16 Big
158 >0 ubyte 0xd8 CP/M 86
159 >0 ubyte 0xdb CP/M or Concurrent CP/M
160 >0 ubyte 0xdd Hidden CTOS Memdump
161 >0 ubyte 0xde Dell PowerEdge Server utilities
162 >0 ubyte 0xdf DG/UX virtual disk manager
163 >0 ubyte 0xe0 STMicroelectronics ST AVFS
164 >0 ubyte 0xe1 DOS access or SpeedStor 12-bit
165 >0 ubyte 0xe3 DOS R/O or Storage Dimensions
166 >0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl.
167 >0 ubyte 0xe5 reserved
168 >0 ubyte 0xe6 reserved
169 >0 ubyte 0xeb BeOS
170 >0 ubyte 0xee GPT Protective MBR
171 >0 ubyte 0xef EFI system partition
172 >0 ubyte 0xf0 Linux PA-RISC boot loader
173 >0 ubyte 0xf1 SpeedStor or Storage Dimensions
174 >0 ubyte 0xf2 DOS 3.3+ Secondary
175 >0 ubyte 0xf3 reserved
176 >0 ubyte 0xf4 SpeedStor large partition
177 >0 ubyte 0xf5 Prologue multi-volumen partition
178 >0 ubyte 0xf6 reserved
179 >0 ubyte 0xf9 pCache: ext2/ext3 persistent cache
180 >0 ubyte 0xfa Bochs x86 emulator
181 >0 ubyte 0xfb VMware File System
182 >0 ubyte 0xfc VMware Swap
183 >0 ubyte 0xfd Linux RAID partition persistent sb
184 >0 ubyte 0xfe LANstep or IBM PS/2 IML
185 >0 ubyte 0xff Xenix Bad Block Table
187 0 string \366\366\366\366 PC formatted floppy with no filesystem
188 # Sun disk labels
189 # From /usr/include/sun/dklabel.h:
190 0774 beshort 0xdabe
191 # modified by Joerg Jenderek, because original test
192 # succeeds for Cabinet archive dao360.dl_ with negative blocks
193 >0770 long >0 Sun disk label
194 >>0 string x '%s
195 >>>31 string >\0 \b%s
196 >>>>63 string >\0 \b%s
197 >>>>>95 string >\0 \b%s
198 >>0 string x \b'
199 >>0734 short >0 %d rpm,
200 >>0736 short >0 %d phys cys,
201 >>0740 short >0 %d alts/cyl,
202 >>0746 short >0 %d interleave,
203 >>0750 short >0 %d data cyls,
204 >>0752 short >0 %d alt cyls,
205 >>0754 short >0 %d heads/partition,
206 >>0756 short >0 %d sectors/track,
207 >>0764 long >0 start cyl %d,
208 >>0770 long x %d blocks
209 # Is there a boot block written 1 sector in?
210 >512 belong&077777777 0600407 \b, boot block present
212 # Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
213 # (http://btmgr.sourceforge.net/docs/user-guide-3.html)
214 0 string SBMBAKUP_ Smart Boot Manager backup file
215 >9 string x \b, version %-5.5s
216 >>14 string =_
217 >>>15 string x %-.1s
218 >>>>16 string =_ \b.
219 >>>>>17 string x \b%-.1s
220 >>>>>>18 string =_ \b.
221 >>>>>>>19 string x \b%-.1s
222 >>>22 ubyte 0
223 >>>>21 ubyte x \b, from drive 0x%x
224 >>>22 ubyte >0
225 >>>>21 string x \b, from drive %s
226 >>>535 search/17 \x55\xAA
227 >>>>&-512 indirect x \b; contains
229 # updated by Joerg Jenderek at Nov 2012
230 # DOS Emulator image is 128 byte, null right padded header + harddisc image
231 0 string DOSEMU\0
232 >0x27E leshort 0xAA55
233 #offset is 128
234 >>19 ubyte 128
235 >>>(19.b-1) ubyte 0x0 DOS Emulator image
236 >>>>7 ulelong >0 \b, %u heads
237 >>>>11 ulelong >0 \b, %d sectors/track
238 >>>>15 ulelong >0 \b, %d cylinders
239 >>>>128 indirect x \b; contains
241 # added by Joerg Jenderek at Nov 2012
242 # http://www.thenakedpc.com/articles/v04/08/0408-05.html
243 # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
244 0 string PNCIHISK\0 Norton Utilities disc image data
245 # real x86 boot sector with jump instruction
246 >509 search/1026 \x55\xAA\xeb
247 >>&-1 indirect x \b; contains
248 # http://file-extension.net/seeker/file_extension_dat
249 0 string PNCIUNDO Norton Disk Doctor UnDo file
250 #
252 # DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
253 # for any allowed sector sizes
254 30 search/481 \x55\xAA
255 # to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
256 # DOS BPB information (70) and after DOS floppy (120) like in previous file version
257 !:strength +65
258 # for sector sizes < 512 Bytes
259 >11 uleshort <512
260 >>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector
261 # for sector sizes with 512 or more Bytes
262 >0x1FE leshort 0xAA55 DOS/MBR boot sector
264 # keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
265 # only for sector sizes with 512 or more Bytes
266 0x1FE leshort 0xAA55 DOS/MBR boot sector
267 #
268 # to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
269 !:strength +65
270 >2 string OSBS OS/BS MBR
271 # added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/
272 # and https://en.wikipedia.org/wiki/Master_Boot_Record
273 # test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
274 # characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
275 >0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR
276 # Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
277 # assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
278 >>8 ubequad 0x8bf45007501ffbfc
279 # https://thestarman.pcministry.com/asm/mbr/200MBR.htm
280 >>>0x16 ubyte 0xF3 \b,DOS 2
281 >>>>219 regex Author\ -\ Author:
282 # found "David Litton" , "A Pehrsson "
283 >>>>>&0 string x "%s"
284 >>>0x16 ubyte 0xF2
285 # NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
286 # assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
287 >>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3
288 # version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
289 >>>>0x22 default x \b,D0S version 3.3-7.0
290 # error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
291 # where nn is string offset varying for different languages
292 # "Invalid partition table" nn=0x8b for english version
293 >>>>>(0x49.b) string Invalid\ partition\ table english
294 >>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german
295 >>>>>(0x49.b) string Table\ de\ partition\ invalide french
296 >>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese
297 >>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish
298 >>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian
299 >>>>>0x49 ubyte >0 at offset 0x%x
300 >>>>>>(0x49.b) string >\0 "%s"
301 # "Error loading operating system" nn=0xa3 for english version
302 # "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version
303 # "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version
304 # "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version
305 # "Error al cargar sistema operativo" nn=0xa8 for spanish version
306 # "Errore durante il caricamento del sistema operativo" nn=0xae for italian version
307 >>>>>0x74 ubyte >0 at offset 0x%x
308 >>>>>>(0x74.b) string >\0 "%s"
309 # "Missing operating system" nn=0xc2 for english version
310 # "Betriebssystem fehlt" nn=0xcd for german version
311 # "Syst\212me d'exploitation absent" nn=0xd2 for french version
312 # "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version
313 # "Falta sistema operativo" nn=0xca for spanish version
314 # "Sistema operativo mancante" nn=0xe2 for italian version
315 >>>>>0x79 ubyte >0 at offset 0x%x
316 >>>>>>(0x79.b) string >\0 "%s"
317 # Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
318 # assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b
319 >>8 ubequad 0x5007501ffcbe1b7c
320 # assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
321 >>>24 ubequad 0xf3a4cbbebe07b104 9M
322 # "Invalid partition table" nn=0x10F for english version
323 # "Ung\201ltige Partitionstabelle" nn=0x10F for german version
324 # "Table de partition erron\202e" nn=0x10F for french version
325 # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version
326 >>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english
327 >>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german
328 >>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french
329 >>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian
330 >>>>0x3C ubyte x at offset 0x%x+0xFF
331 >>>>(0x3C.b+0x0FF) string >\0 "%s"
332 # "Error loading operating system" nn=0x127 for english version
333 # "Fehler beim Laden des Betriebssystems" nn=0x12b for german version
334 # "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version
335 # "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version
336 >>>>0xBD ubyte x at offset 0x1%x
337 >>>>(0xBD.b+0x100) string >\0 "%s"
338 # "Missing operating system" nn=0x146 for english version
339 # "Betriebssystem fehlt" nn=0x151 for german version
340 # "Syst\212me d'exploitation manquant" nn=0x15e for french version
341 # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version
342 >>>>0xA9 ubyte x at offset 0x1%x
343 >>>>(0xA9.b+0x100) string >\0 "%s"
344 # https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
345 # assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
346 >>>24 ubequad 0xf3a4cbbdbe07b104 XP
347 # where xxyyzz are lower bits from offsets of error messages varying for different languages
348 >>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english
349 >>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german
350 # "Invalid partition table" xx=0x12C for english version
351 # "Ung\201ltige Partitionstabelle" xx=0x12C for german version
352 >>>>0x1b5 ubyte >0 at offset 0x1%x
353 >>>>(0x1b5.b+0x100) string >\0 "%s"
354 # "Error loading operating system" yy=0x144 for english version
355 # "Fehler beim Laden des Betriebssystems" yy=0x148 for german version
356 >>>>0x1b6 ubyte >0 at offset 0x1%x
357 >>>>(0x1b6.b+0x100) string >\0 "%s"
358 # "Missing operating system" zz=0x163 for english version
359 # "Betriebssystem nicht vorhanden" zz=0x16e for german version
360 >>>>0x1b7 ubyte >0 at offset 0x1%x
361 >>>>(0x1b7.b+0x100) string >\0 "%s"
362 # Microsoft Windows Vista or 7
363 # assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
364 >>8 ubequad 0xc08ed8be007cbf00
365 # Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
366 # assembler instructions: jnz 0729;cmp ebx,"TCPA"
367 >>>0xEC ubequad 0x753b6681fb544350 Vista
368 # where xxyyzz are lower bits from offsets of error messages varying for different languages
369 >>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english
370 #>>>>0x1B4 ubelong&0x00FFFFFF ? german
371 # "Invalid partition table" xx=0x162 for english version
372 # "Ung\201ltige Partitionstabelle" xx=0x1?? for german version
373 >>>>0x1b5 ubyte >0 at offset 0x1%x
374 >>>>(0x1b5.b+0x100) string >\0 "%s"
375 # "Error loading operating system" yy=0x17a for english version
376 # "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version
377 >>>>0x1b6 ubyte >0 at offset 0x1%x
378 >>>>(0x1b6.b+0x100) string >\0 "%s"
379 # "Missing operating system" zz=0x199 for english version
380 # "Betriebssystem nicht vorhanden" zz=0x1?? for german version
381 >>>>0x1b7 ubyte >0 at offset 0x1%x
382 >>>>(0x1b7.b+0x100) string >\0 "%s"
383 # Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
384 # assembler instructions: cmp ebx,"TCPA";cmp
385 >>>0xEC ubequad 0x6681fb5443504175 Windows 7
386 # where xxyyzz are lower bits from offsets of error messages varying for different languages
387 >>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english
388 #>>>>0x1B4 ubelong&0x00FFFFFF ? german
389 # "Invalid partition table" xx=0x163 for english version
390 # "Ung\201ltige Partitionstabelle" xx=0x1?? for german version
391 >>>>0x1b5 ubyte >0 at offset 0x1%x
392 >>>>(0x1b5.b+0x100) string >\0 "%s"
393 # "Error loading operating system" yy=0x17b for english version
394 # "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version
395 >>>>0x1b6 ubyte >0 at offset 0x1%x
396 >>>>(0x1b6.b+0x100) string >\0 "%s"
397 # "Missing operating system" zz=0x19a for english version
398 # "Betriebssystem nicht vorhanden" zz=0x1?? for german version
399 >>>>0x1b7 ubyte >0 at offset 0x1%x
400 >>>>(0x1b7.b+0x100) string >\0 "%s"
401 # https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
402 # https://en.wikipedia.org/wiki/MBR_disk_signature#ID
403 >>0x1b8 ulelong >0 \b, disk signature 0x%-.4x
404 # driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm
405 >>0xDA uleshort 0
406 >>>0xDC ulelong >0 \b, created
407 # physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
408 >>>>0xDC ubyte x with driveID 0x%x
409 # hours, minutes and seconds
410 >>>>0xDf ubyte x at %x
411 >>>>0xDe ubyte x \b:%x
412 >>>>0xDd ubyte x \b:%x
413 # special case for Microsoft MS-DOS 3.21 spanish
414 # assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
415 >0 ubequad 0xfab830008ed0bc00
416 # assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
417 >>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish
418 # Microsoft MBR IPL end
420 # dr-dos with some upper-, lowercase variants
421 >0x9D string Invalid\ partition\ table$
422 >>181 string No\ Operating\ System$
423 >>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
424 >0x9D string Invalid\ partition\ table$
425 >>181 string No\ operating\ system$
426 >>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
427 >342 string Invalid\ partition\ table$
428 >>366 string No\ operating\ system$
429 >>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
430 >295 string NEWLDR\0
431 >>302 string Bad\ PT\ $
432 >>>310 string No\ OS\ $
433 >>>>317 string OS\ load\ err$
434 >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
435 >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
436 >>>>>>>387 string Copyright\ (c)\ 1984,1998
437 >>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
438 #
439 # tests for different MS-DOS Master Boot Records (MBR) moved and merged
440 #
441 #>0x145 string Default:\ F \b, FREE-DOS MBR
442 #>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR
443 >0x145 search/7 Default:\ F \b, FREE-DOS MBR
444 #>>313 string F0\ .\ .\ .
445 #>>>322 string disk\ 1
446 #>>>>382 string FAT3
447 >64 string no\ active\ partition\ found
448 >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
449 # Ranish Partition Manager http://www.ranish.com/part/
450 >387 search/4 \0\ Error!\r
451 >>378 search/7 Virus!
452 >>>397 search/4 Booting\040
453 >>>>408 search/4 HD1/\0 \b, Ranish MBR (
454 >>>>>416 string Writing\ changes... \b2.37
455 >>>>>>438 ubyte x \b,0x%x dots
456 >>>>>>440 ubyte >0 \b,virus check
457 >>>>>>441 ubyte >0 \b,partition %c
458 #2.38,2.42,2.44
459 >>>>>416 string !Writing\ changes... \b
460 >>>>>>418 ubyte 1 \bvirus check,
461 >>>>>>419 ubyte x \b0x%x seconds
462 >>>>>>420 ubyte&0x0F >0 \b,partition
463 >>>>>>>420 ubyte&0x0F <5 \b %x
464 >>>>>>>420 ubyte&0x0F 0Xf \b ask
465 >>>>>420 ubyte x \b)
466 #
467 # SYSLINUX MBR moved
468 # https://www.acronis.de/
469 >362 string MBR\ Error\ \0\r
470 >>376 string ress\ any\ key\ to\040
471 >>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
472 # added by Joerg Jenderek
473 # https://www.visopsys.org/
474 # https://partitionlogic.org.uk/
475 >309 string No\ bootable\ partition\ found\r
476 >>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
477 >349 string No\ bootable\ partition\ found\r
478 >>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
479 # bootloader, bootmanager
480 >0x40 string SBML
481 # label with 11 characters of FAT 12 bit filesystem
482 >>43 string SMART\ BTMGR
483 >>>430 string SBMK\ Bad!\r \b, Smart Boot Manager
484 # OEM-ID not always "SBM"
485 #>>>>3 strings SBM
486 >>>>6 string >\0 \b, version %s
487 >382 string XOSLLOADXCF \b, eXtended Operating System Loader
488 >6 string LILO \b, LInux i386 boot LOader
489 >>120 string LILO \b, version 22.3.4 SuSe
490 >>172 string LILO \b, version 22.5.8 Debian
491 # updated by Joerg Jenderek at Oct 2008
492 # variables according to grub-0.97/stage1/stage1.S or
493 # https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
494 # usual values are marked with comments to get only informations of strange GRUB loaders
495 >342 search/60 \0Geom\0
496 #>0 ulelong x %x=0x009048EB , 0x2a9048EB 0
497 >>0x41 ubyte <2
498 >>>0x3E ubyte >2 \b; GRand Unified Bootloader
499 # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
500 >>>>0x3E ubyte x \b, stage1 version 0x%x
501 #If it is 0xFF, use a drive passed by BIOS
502 >>>>0x40 ubyte <0xFF \b, boot drive 0x%x
503 # in most case 0,1,0x2e for GRUB 0.5.95
504 >>>>0x41 ubyte >0 \b, LBA flag 0x%x
505 >>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x
506 #>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual)
507 >>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x
508 #>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default)
509 >>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x
510 >>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x
511 #>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual)
512 >>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x
513 >>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
514 >>>>>394 string stage1 \b, GRUB version 0.5.95
515 >>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
516 >>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94
517 >>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
518 >>>>>377 string GRUB\ \0 \b, GRUB version 0.94
519 >>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0
520 >>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
521 >>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
522 >>>>>385 string GRUB\ \0 \b, GRUB version 0.97
523 # unknown version
524 >>>343 string Geom\0Read\0\ Error\0
525 >>>>321 string Loading\ stage1.5 \b, GRUB version x.y
526 >>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
527 >>>>374 string GRUB\ \0 \b, GRUB version n.m
528 # SYSLINUX bootloader moved
529 >395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
530 # http://www.bcdwb.de/bcdw/index_e.htm
531 >3 string BCDL
532 >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
533 # mbr partition table entries updated by Joerg Jenderek at Sep 2013
534 # skip Norton Utilities disc image data
535 >3 string !IHISK
536 # skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
537 >>0 belong !0xb8c0078e
538 # not Linux kernel
539 >>>514 string !HdrS
540 # not BeOS
541 >>>>422 string !Be\ Boot\ Loader
542 # jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
543 >>>>>0 ubelong&0xFD000000 =0xE9000000
544 # AdvanceMAME mbr
545 >>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e
546 >>>>>>>446 use partition-table
547 # mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
548 >>>>>0 ubelong&0xFD000000 !0xE9000000
549 # skip FSInfosector
550 >>>>>>0 string !RRaA
551 # skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
552 # https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
553 >>>>>>>0 ubequad !0xfa660fb64610668b
554 # skip 13rd sector of MS x86 bootloader
555 >>>>>>>>0 ubequad !0x660fb64610668b4e
556 # skip sector starting with DOS new line
557 >>>>>>>>>0 string !\r\n
558 # allowed active flag 0,80h-FFh
559 >>>>>>>>>>446 ubyte 0
560 >>>>>>>>>>>446 use partition-table
561 >>>>>>>>>>446 ubyte >0x7F
562 >>>>>>>>>>>446 use partition-table
563 # TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
564 # mbr partition table entries end
565 # https://www.acronis.de/
566 #FAT label=ACRONIS\ SZ
567 #OEM-ID=BOOTWIZ0
568 >442 string Non-system\ disk,\040
569 >>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
570 # updated by Joerg Jenderek at Nov 2012, Sep 2013
571 # DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
572 # display 1 space
573 >>>447 ubyte x \b
574 >>>477 use DOS-filename
575 #
576 >185 string FDBOOT\ Version\040
577 >>204 string \rNo\ Systemdisk.\040
578 >>>220 string Booting\ from\ harddisk.\n\r
579 >>>245 string Cannot\ load\ from\ harddisk.\n\r
580 >>>>273 string Insert\ Systemdisk\040
581 >>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
582 >>>>>>200 string >\0 \b, version %-3s
583 >242 string Bootsector\ from\ C.H.\ Hochst\204
584 # http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c
585 # updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
586 # skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
587 >242 search/127 Bootsector\ from\ C.H.\ Hochst
588 >>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk
589 # followed by variants with point,CR-NL or NL-CR
590 >>>208 search/261 Cannot\ load\ from\ harddisk.
591 # followed by variants CR-NL or NL-CR
592 >>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key.
593 # followed by variants with point,CR-NL or NL-CR
594 >>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader
595 # followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
596 >>>>>>&0 string x \b, version %-4.4s
597 >(1.b+2) ubyte 0xe
598 >>(1.b+3) ubyte 0x1f
599 >>>(1.b+4) ubyte 0xbe
600 # message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
601 >>>>(1.b+5) ubyte&0xd3 0x53
602 >>>>>(1.b+6) ubyte 0x7c
603 # assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
604 >>>>>>(1.b+7) ubyte 0xac
605 >>>>>>>(1.b+8) ubyte 0x22
606 >>>>>>>>(1.b+9) ubyte 0xc0
607 >>>>>>>>>(1.b+10) ubyte 0x74
608 >>>>>>>>>>(1.b+11) ubyte 0x0b
609 >>>>>>>>>>>(1.b+12) ubyte 0x56
610 >>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
611 # FAT1X version
612 >>>>>>>>>>>>>(1.b+5) ubyte 0x5b
613 >>>>>>>>>>>>>>0x5b string >\0 "%-s"
614 # FAT32 version
615 >>>>>>>>>>>>>(1.b+5) ubyte 0x77
616 >>>>>>>>>>>>>>0x77 string >\0 "%-s"
617 >214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display
618 #>>244 string from\ dosemu-freedos-*-bin.tgz\r
619 #>>>170 string Sorry,\ could\ not\ load\ an\040
620 #>>>>195 string operating\ system.\r\n
621 #
622 >103 string This\ is\ not\ a\ bootable\ disk.\040
623 >>132 string Please\ insert\ a\ bootable\040
624 >>>157 string floppy\ and\r\n
625 >>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
626 #
627 >66 string Solaris\ Boot\ Sector
628 >>99 string Incomplete\ MDBoot\ load.
629 >>>89 string Version \b, Sun Solaris Bootloader
630 >>>>97 byte x version %c
631 #
632 >408 string OS/2\ !!\ SYS01475\r\0
633 >>429 string OS/2\ !!\ SYS02025\r\0
634 >>>450 string OS/2\ !!\ SYS02027\r\0
635 >>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
636 #
637 >409 string OS/2\ !!\ SYS01475\r\0
638 >>430 string OS/2\ !!\ SYS02025\r\0
639 >>>451 string OS/2\ !!\ SYS02027\r\0
640 >>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
641 >112 string This\ disk\ is\ not\ bootable\r
642 >>142 string If\ you\ wish\ to\ make\ it\ bootable
643 >>>176 string run\ the\ DOS\ program\ SYS\040
644 >>>200 string after\ the\r
645 >>>>216 string system\ has\ been\ loaded\r\n
646 >>>>>242 string Please\ insert\ a\ DOS\ diskette\040
647 >>>>>271 string into\r\n\ the\ drive\ and\040
648 >>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
649 # XP
650 >430 string NTLDR\ is\ missing\xFF\r\n
651 >>449 string Disk\ error\xFF\r\n
652 >>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
653 # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
654 >>>>417 ubyte&0xDF >0
655 >>>>>417 string x %-.5s
656 >>>>>>422 ubyte&0xDF >0
657 >>>>>>>422 string x \b%-.3s
658 >>>>>425 ubyte&0xDF >0
659 >>>>>>425 string >\ \b.%-.3s
660 #
661 >>>>371 ubyte >0x20
662 >>>>>368 ubyte&0xDF >0
663 >>>>>>368 string x %-.5s
664 >>>>>>>373 ubyte&0xDF >0
665 >>>>>>>>373 string x \b%-.3s
666 >>>>>>376 ubyte&0xDF >0
667 >>>>>>>376 string x \b.%-.3s
668 #
669 >430 string NTLDR\ nicht\ gefunden\xFF\r\n
670 >>453 string Datentr\204gerfehler\xFF\r\n
671 >>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
672 >>>>417 ubyte&0xDF >0
673 >>>>>417 string x %-.5s
674 >>>>>>422 ubyte&0xDF >0
675 >>>>>>>422 string x \b%-.3s
676 >>>>>425 ubyte&0xDF >0
677 >>>>>>425 string >\ \b.%-.3s
678 # offset variant
679 >>>>379 string \0
680 >>>>>368 ubyte&0xDF >0
681 >>>>>>368 string x %-.5s
682 >>>>>>>373 ubyte&0xDF >0
683 >>>>>>>>373 string x \b%-.3s
684 #
685 >430 string NTLDR\ fehlt\xFF\r\n
686 >>444 string Datentr\204gerfehler\xFF\r\n
687 >>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
688 >>>>417 ubyte&0xDF >0
689 >>>>>417 string x %-.5s
690 >>>>>>422 ubyte&0xDF >0
691 >>>>>>>422 string x \b%-.3s
692 >>>>>425 ubyte&0xDF >0
693 >>>>>>425 string >\ \b.%-.3s
694 # variant
695 >>>>371 ubyte >0x20
696 >>>>>368 ubyte&0xDF >0
697 >>>>>>368 string x %-.5s
698 >>>>>>>373 ubyte&0xDF >0
699 >>>>>>>>373 string x \b%-.3s
700 >>>>>>376 ubyte&0xDF >0
701 >>>>>>>376 string x \b.%-.3s
702 #
703 >430 string NTLDR\ fehlt\xFF\r\n
704 >>444 string Medienfehler\xFF\r\n
705 >>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
706 >>>>371 ubyte >0x20
707 >>>>>368 ubyte&0xDF >0
708 >>>>>>368 string x %-.5s
709 >>>>>>>373 ubyte&0xDF >0
710 >>>>>>>>373 string x \b%-.3s
711 >>>>>>376 ubyte&0xDF >0
712 >>>>>>>376 string x \b.%-.3s
713 # variant
714 >>>>417 ubyte&0xDF >0
715 >>>>>417 string x %-.5s
716 >>>>>>422 ubyte&0xDF >0
717 >>>>>>>422 string x \b%-.3s
718 >>>>>425 ubyte&0xDF >0
719 >>>>>>425 string >\ \b.%-.3s
720 #
721 >430 string Datentr\204ger\ entfernen\xFF\r\n
722 >>454 string Medienfehler\xFF\r\n
723 >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
724 >>>>379 string \0
725 >>>>>368 ubyte&0xDF >0
726 >>>>>>368 string x %-.5s
727 >>>>>>>373 ubyte&0xDF >0
728 >>>>>>>>373 string x \b%-.3s
729 >>>>>>376 ubyte&0xDF >0
730 >>>>>>>376 string x \b.%-.3s
731 # variant
732 >>>>417 ubyte&0xDF >0
733 >>>>>417 string x %-.5s
734 >>>>>>422 ubyte&0xDF >0
735 >>>>>>>422 string x \b%-.3s
736 >>>>>425 ubyte&0xDF >0
737 >>>>>>425 string >\ \b.%-.3s
738 #
740 #>3 string NTFS\ \ \ \040
741 >389 string Fehler\ beim\ Lesen\040
742 >>407 string des\ Datentr\204gers
743 >>>426 string NTLDR\ fehlt
744 >>>>440 string NTLDR\ ist\ komprimiert
745 >>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
746 #>3 string NTFS\ \ \ \040
747 >313 string A\ disk\ read\ error\ occurred.\r
748 >>345 string A\ kernel\ file\ is\ missing\040
749 >>>370 string from\ the\ disk.\r
750 >>>>484 string NTLDR\ is\ compressed
751 >>>>>429 string Insert\ a\ system\ diskette\040
752 >>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
753 # DOS loader variants different languages,offsets
754 >472 ubyte&0xDF >0
755 >>389 string Invalid\ system\ disk\xFF\r\n
756 >>>411 string Disk\ I/O\ error
757 >>>>428 string Replace\ the\ disk,\ and\040
758 >>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
759 #IO.SYS
760 >>>>>>472 ubyte&0xDF >0
761 >>>>>>>472 string x \b %-.2s
762 >>>>>>>>474 ubyte&0xDF >0
763 >>>>>>>>>474 string x \b%-.5s
764 >>>>>>>>>>479 ubyte&0xDF >0
765 >>>>>>>>>>>479 string x \b%-.1s
766 >>>>>>>480 ubyte&0xDF >0
767 >>>>>>>>480 string x \b.%-.3s
768 #MSDOS.SYS
769 >>>>>>>483 ubyte&0xDF >0 \b+
770 >>>>>>>>483 string x \b%-.5s
771 >>>>>>>>>488 ubyte&0xDF >0
772 >>>>>>>>>>488 string x \b%-.3s
773 >>>>>>>>491 ubyte&0xDF >0
774 >>>>>>>>>491 string x \b.%-.3s
775 #
776 >>390 string Invalid\ system\ disk\xFF\r\n
777 >>>412 string Disk\ I/O\ error\xFF\r\n
778 >>>>429 string Replace\ the\ disk,\ and\040
779 >>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
780 >>388 string Ungueltiges\ System\ \xFF\r\n
781 >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
782 >>>>427 string Datentraeger\ wechseln\ und\040
783 >>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
784 #WINBOOT.SYS only not spaces (0xDF)
785 >>>>>>497 ubyte&0xDF >0
786 >>>>>>>497 string x %-.5s
787 >>>>>>>>502 ubyte&0xDF >0
788 >>>>>>>>>502 string x \b%-.1s
789 >>>>>>>>>>503 ubyte&0xDF >0
790 >>>>>>>>>>>503 string x \b%-.1s
791 >>>>>>>>>>>>504 ubyte&0xDF >0
792 >>>>>>>>>>>>>504 string x \b%-.1s
793 >>>>>>505 ubyte&0xDF >0
794 >>>>>>>505 string x \b.%-.3s
795 #IO.SYS
796 >>>>>>472 ubyte&0xDF >0 or
797 >>>>>>>472 string x \b %-.2s
798 >>>>>>>>474 ubyte&0xDF >0
799 >>>>>>>>>474 string x \b%-.5s
800 >>>>>>>>>>479 ubyte&0xDF >0
801 >>>>>>>>>>>479 string x \b%-.1s
802 >>>>>>>480 ubyte&0xDF >0
803 >>>>>>>>480 string x \b.%-.3s
804 #MSDOS.SYS
805 >>>>>>>483 ubyte&0xDF >0 \b+
806 >>>>>>>>483 string x \b%-.5s
807 >>>>>>>>>488 ubyte&0xDF >0
808 >>>>>>>>>>488 string x \b%-.3s
809 >>>>>>>>491 ubyte&0xDF >0
810 >>>>>>>>>491 string x \b.%-.3s
811 #
812 >>390 string Ungueltiges\ System\ \xFF\r\n
813 >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
814 >>>>429 string Datentraeger\ wechseln\ und\040
815 >>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
816 #WINBOOT.SYS only not spaces (0xDF)
817 >>>>>>497 ubyte&0xDF >0
818 >>>>>>>497 string x %-.7s
819 >>>>>>>>504 ubyte&0xDF >0
820 >>>>>>>>>504 string x \b%-.1s
821 >>>>>>505 ubyte&0xDF >0
822 >>>>>>>505 string x \b.%-.3s
823 #IO.SYS
824 >>>>>>472 ubyte&0xDF >0 or
825 >>>>>>>472 string x \b %-.2s
826 >>>>>>>>474 ubyte&0xDF >0
827 >>>>>>>>>474 string x \b%-.6s
828 >>>>>>>480 ubyte&0xDF >0
829 >>>>>>>>480 string x \b.%-.3s
830 #MSDOS.SYS
831 >>>>>>>483 ubyte&0xDF >0 \b+
832 >>>>>>>>483 string x \b%-.5s
833 >>>>>>>>>488 ubyte&0xDF >0
834 >>>>>>>>>>488 string x \b%-.3s
835 >>>>>>>>491 ubyte&0xDF >0
836 >>>>>>>>>491 string x \b.%-.3s
837 #
838 >>389 string Ungueltiges\ System\ \xFF\r\n
839 >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
840 >>>>428 string Datentraeger\ wechseln\ und\040
841 >>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
842 # DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
843 >>>>>>472 string x %-.2s
844 >>>>>>>474 ubyte&0xDF >0
845 >>>>>>>>474 string x \b%-.5s
846 >>>>>>>>479 ubyte&0xDF >0
847 >>>>>>>>>479 string x \b%-.1s
848 >>>>>>480 ubyte&0xDF >0
849 >>>>>>>480 string x \b.%-.3s
850 >>>>>>483 ubyte&0xDF >0 \b+
851 >>>>>>>483 string x \b%-.5s
852 >>>>>>>488 ubyte&0xDF >0
853 >>>>>>>>488 string x \b%-.2s
854 >>>>>>>>490 ubyte&0xDF >0
855 >>>>>>>>>490 string x \b%-.1s
856 >>>>>>>491 ubyte&0xDF >0
857 >>>>>>>>491 string x \b.%-.3s
858 >479 ubyte&0xDF >0
859 >>416 string Kein\ System\ oder\040
860 >>>433 string Laufwerksfehler
861 >>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
862 #IO.SYS
863 >>>>>479 string x \b %-.2s
864 >>>>>>481 ubyte&0xDF >0
865 >>>>>>>481 string x \b%-.6s
866 >>>>>487 ubyte&0xDF >0
867 >>>>>>487 string x \b.%-.3s
868 #MSDOS.SYS
869 >>>>>>490 ubyte&0xDF >0 \b+
870 >>>>>>>490 string x \b%-.5s
871 >>>>>>>>495 ubyte&0xDF >0
872 >>>>>>>>>495 string x \b%-.3s
873 >>>>>>>498 ubyte&0xDF >0
874 >>>>>>>>498 string x \b.%-.3s
875 #
876 >376 search/41 Non-System\ disk\ or\040
877 >>395 search/41 disk\ error\r
878 >>>407 search/41 Replace\ and\040
879 >>>>419 search/41 press\ \b,
880 >>>>419 search/41 strike\ \b, old
881 >>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader
882 #449 Disk\ Boot\ failure\r MS 3.21
883 #466 Boot\ Failure\r MS 3.30
884 >>>>>468 search/18 \0
885 #IO.SYS,IBMBIO.COM
886 >>>>>>&0 string x \b %-.2s
887 >>>>>>>&-20 ubyte&0xDF >0
888 >>>>>>>>&-1 string x \b%-.4s
889 >>>>>>>>>&-16 ubyte&0xDF >0
890 >>>>>>>>>>&-1 string x \b%-.2s
891 >>>>>>&8 ubyte&0xDF >0 \b.
892 >>>>>>>&-1 string x \b%-.3s
893 #MSDOS.SYS,IBMDOS.COM
894 >>>>>>&11 ubyte&0xDF >0 \b+
895 >>>>>>>&-1 string x \b%-.5s
896 >>>>>>>>&-6 ubyte&0xDF >0
897 >>>>>>>>>&-1 string x \b%-.1s
898 >>>>>>>>>>&-5 ubyte&0xDF >0
899 >>>>>>>>>>>&-1 string x \b%-.2s
900 >>>>>>>&7 ubyte&0xDF >0 \b.
901 >>>>>>>>&-1 string x \b%-.3s
902 >441 string Cannot\ load\ from\ harddisk.\n\r
903 >>469 string Insert\ Systemdisk\040
904 >>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader
905 #>43 string \224R-LOADER\ \ SYS =label
906 >54 string SYS
907 >>324 string VASKK
908 >>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
909 #
910 >98 string Press\ a\ key\ to\ retry\0\r
911 >>120 string Cannot\ find\ file\ \0\r
912 >>>139 string Disk\ read\ error\0\r
913 >>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader
914 #DRBIOS.SYS
915 >>>>>44 ubyte&0xDF >0
916 >>>>>>44 string x \b %-.6s
917 >>>>>>>50 ubyte&0xDF >0
918 >>>>>>>>50 string x \b%-.2s
919 >>>>>>52 ubyte&0xDF >0
920 >>>>>>>52 string x \b.%-.3s
921 #
922 >70 string IBMBIO\ \ COM
923 >>472 string Cannot\ load\ DOS!\040
924 >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
925 >>471 string Cannot\ load\ DOS\040
926 >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
927 #??
928 >444 string KERNEL\ \ SYS
929 >>314 string BOOT\ error! \b, FREE-DOS Bootloader
930 >499 string KERNEL\ \ SYS
931 >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
932 >449 string KERNEL\ \ SYS
933 >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
934 #
935 >449 string Loading\ FreeDOS
936 >>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader
937 >>>497 ubyte&0xDF >0
938 >>>>497 string x \b %-.6s
939 >>>>>503 ubyte&0xDF >0
940 >>>>>>503 string x \b%-.1s
941 >>>>>>>504 ubyte&0xDF >0
942 >>>>>>>>504 string x \b%-.1s
943 >>>>505 ubyte&0xDF >0
944 >>>>>505 string x \b.%-.3s
945 #
946 >331 string Error!.0 \b, FREE-DOS 1.0 bootloader
947 #
948 >125 string Loading\ FreeDOS...\r
949 >>311 string BOOT\ error!\r \b, FREE-DOS bootloader
950 >>>441 ubyte&0xDF >0
951 >>>>441 string x \b %-.6s
952 >>>>>447 ubyte&0xDF >0
953 >>>>>>447 string x \b%-.1s
954 >>>>>>>448 ubyte&0xDF >0
955 >>>>>>>>448 string x \b%-.1s
956 >>>>449 ubyte&0xDF >0
957 >>>>>449 string x \b.%-.3s
958 >124 string FreeDOS\0
959 >>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
960 # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
961 >>>497 ubyte&0xDF >0
962 >>>>497 string x \b %-.6s
963 >>>>>503 ubyte&0xDF >0
964 >>>>>>503 string x \b%-.1s
965 >>>>>>>504 ubyte&0xDF >0
966 >>>>>>>>504 string x \b%-.1s
967 >>>>505 ubyte&0xDF >0
968 >>>>>505 string x \b.%-.3s
969 >>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
970 >>>497 ubyte&0xDF >0
971 >>>>497 string x \b %-.6s
972 >>>>>503 ubyte&0xDF >0
973 >>>>>>503 string x \b%-.1s
974 >>>>>>>504 ubyte&0xDF >0
975 >>>>>>>>504 string x \b%-.1s
976 >>>>505 ubyte&0xDF >0
977 >>>>>505 string x \b.%-.3s
978 >>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
979 >>>497 ubyte&0xDF >0
980 >>>>497 string x \b %-.6s
981 >>>>>503 ubyte&0xDF >0
982 >>>>>>503 string x \b%-.1s
983 >>>>>>>504 ubyte&0xDF >0
984 >>>>>>>>504 string x \b%-.1s
985 >>>>505 ubyte&0xDF >0
986 >>>>>505 string x \b.%-.3s
987 >336 string Error!\040
988 >>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
989 >>>497 ubyte&0xDF >0
990 >>>>497 string x \b %-.6s
991 >>>>>503 ubyte&0xDF >0
992 >>>>>>503 string x \b%-.1s
993 >>>>>>>504 ubyte&0xDF >0
994 >>>>>>>>504 string x \b%-.1s
995 >>>>505 ubyte&0xDF >0
996 >>>>>505 string x \b.%-.3s
997 # added by Joerg Jenderek
998 # https://www.visopsys.org/
999 # https://partitionlogic.org.uk/
1000 # OEM-ID=Visopsys
1001 >478 ulelong 0
1002 >>(1.b+326) string I/O\ Error\ reading\040
1003 >>>(1.b+344) string Visopsys\ loader\r
1004 >>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
1005 # http://alexfru.chat.ru/epm.html#bootprog
1006 >494 ubyte >0x4D
1007 >>495 string >E
1008 >>>495 string <S
1009 #OEM-ID is not reliable
1010 >>>>3 string BootProg
1011 # It just looks for a program file name at the root directory
1012 # and loads corresponding file with following execution.
1013 # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
1014 >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
1015 >>>>>499 use DOS-filename
1016 #If the boot sector fails to read any other sector,
1017 #it prints a very short message ("RE") to the screen and hangs the computer.
1018 #If the boot sector fails to find needed program in the root directory,
1019 #it also hangs with another message ("NF").
1020 >>>>>492 string RENF \b, FAT (12 bit)
1021 >>>>>495 string RENF \b, FAT (16 bit)
1022 #If the boot sector fails to read any other sector,
1023 #it prints a very short message ("RE") to the screen and hangs the computer.
1024 # x86 bootloader end
1026 # added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
1027 # and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
1028 >0 string RRaA
1029 >>0x1E4 string rrAa \b, FSInfosector
1030 #>>0x1FC uleshort =0 SHOULD BE ZERO
1031 >>>0x1E8 ulelong <0xffffffff \b, %u free clusters
1032 >>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u
1034 # updated by Joerg Jenderek at Sep 2007
1035 >3 ubyte 0
1036 #no active flag
1037 >>446 ubyte 0
1038 # partition 1 not empty
1039 >>>450 ubyte >0
1040 # partitions 3,4 empty
1041 >>>>482 ubyte 0
1042 >>>>>498 ubyte 0
1043 # partition 2 ID=0,5,15
1044 >>>>>>466 ubyte <0x10
1045 >>>>>>>466 ubyte 0x05 \b, extended partition table
1046 >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
1047 >>>>>>>466 ubyte 0x0 \b, extended partition table (last)
1049 # DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
1051 >0x200 lelong 0x82564557 \b, BSD disklabel
1053 # by Joerg Jenderek at Apr 2013
1054 # Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
1055 # like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
1056 0 name DOS-filename
1057 # space=0x20 (00100000b) means empty
1058 >0 ubyte&0xDF >0
1059 >>0 ubyte x \b%c
1060 >>>1 ubyte&0xDF >0
1061 >>>>1 ubyte x \b%c
1062 >>>>>2 ubyte&0xDF >0
1063 >>>>>>2 ubyte x \b%c
1064 >>>>>>>3 ubyte&0xDF >0
1065 >>>>>>>>3 ubyte x \b%c
1066 >>>>>>>>>4 ubyte&0xDF >0
1067 >>>>>>>>>>4 ubyte x \b%c
1068 >>>>>>>>>>>5 ubyte&0xDF >0
1069 >>>>>>>>>>>>5 ubyte x \b%c
1070 >>>>>>>>>>>>>6 ubyte&0xDF >0
1071 >>>>>>>>>>>>>>6 ubyte x \b%c
1072 >>>>>>>>>>>>>>>7 ubyte&0xDF >0
1073 >>>>>>>>>>>>>>>>7 ubyte x \b%c
1074 # DOS filename extension
1075 >>8 ubyte&0xDF >0 \b.
1076 >>>8 ubyte x \b%c
1077 >>>>9 ubyte&0xDF >0
1078 >>>>>9 ubyte x \b%c
1079 >>>>>>10 ubyte&0xDF >0
1080 >>>>>>>10 ubyte x \b%c
1081 # Print 2 following DOS filenames from directory entry form
1082 # like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
1083 0 name 2xDOS-filename
1084 # display 1 space
1085 >0 ubyte x \b
1086 >0 use DOS-filename
1087 >11 ubyte x \b+
1088 >11 use DOS-filename
1090 # https://en.wikipedia.org/wiki/Master_boot_record#PTE
1091 # display standard partition table
1092 0 name partition-table
1093 #>0 ubyte x PARTITION-TABLE
1094 # test and display 1st til 4th partition table entry
1095 >0 use partition-entry-test
1096 >16 use partition-entry-test
1097 >32 use partition-entry-test
1098 >48 use partition-entry-test
1099 # test for entry of partition table
1100 0 name partition-entry-test
1101 # partition type ID > 0
1102 >4 ubyte >0
1103 # active flag 0
1104 >>0 ubyte 0
1105 >>>0 use partition-entry
1106 # active flag 0x80, 0x81, ...
1107 >>0 ubyte >0x7F
1108 >>>0 use partition-entry
1109 # Print entry of partition table
1110 0 name partition-entry
1111 # partition type ID > 0
1112 >4 ubyte >0 \b; partition
1113 >>64 leshort 0xAA55 1
1114 >>48 leshort 0xAA55 2
1115 >>32 leshort 0xAA55 3
1116 >>16 leshort 0xAA55 4
1117 >>4 ubyte x : ID=0x%x
1118 >>0 ubyte&0x80 0x80 \b, active
1119 >>0 ubyte >0x80 0x%x
1120 >>1 ubyte x \b, start-CHS (
1121 >>1 use partition-chs
1122 >>5 ubyte x \b), end-CHS (
1123 >>5 use partition-chs
1124 >>8 ulelong x \b), startsector %u
1125 >>12 ulelong x \b, %u sectors
1126 # Print cylinder,head,sector (CHS) of partition entry
1127 0 name partition-chs
1128 # cylinder
1129 >1 ubyte x \b0x
1130 >1 ubyte&0xC0 0x40 \b1
1131 >1 ubyte&0xC0 0x80 \b2
1132 >1 ubyte&0xC0 0xC0 \b3
1133 >2 ubyte x \b%x
1134 # head
1135 >0 ubyte x \b,%u
1136 # sector
1137 >1 ubyte&0x3F x \b,%u
1139 # FATX
1140 0 string FATX FATX filesystem data
1142 # romfs filesystems - Juan Cespedes <cespedes@debian.org>
1143 0 string -rom1fs- romfs filesystem, version 1
1144 >8 belong x %d bytes,
1145 >16 string x named %s.
1147 # netboot image - Juan Cespedes <cespedes@debian.org>
1148 0 lelong 0x1b031336L Netboot image,
1149 >4 lelong&0xFFFFFF00 0
1150 >>4 lelong&0x100 0x000 mode 2
1151 >>4 lelong&0x100 0x100 mode 3
1152 >4 lelong&0xFFFFFF00 !0 unknown mode
1154 0x18b string OS/2 OS/2 Boot Manager
1156 # updated by Joerg Jenderek at Oct 2008 and Sep 2012
1157 # https://syslinux.zytor.com/iso.php
1158 # tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
1159 # assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
1160 0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
1161 >631 search/689 ISOLINUX\ isolinux Loader
1162 >>&0 string x (version %-4.4s)
1163 # https://syslinux.zytor.com/pxe.php
1164 # assembler instructions: jmp 7C05
1165 0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older)
1166 # assembler instructions: pushfd;pushad
1167 0 ulelong 0x60669c66 pxelinux loader
1168 # assembler instructions: jmp 05
1169 0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer)
1170 # https://syslinux.zytor.com/wiki/index.php/SYSLINUX
1171 0 string LDLINUX\ SYS\ SYSLINUX loader
1172 >12 string x (older version %-4.4s)
1173 0 string \r\nSYSLINUX\ SYSLINUX loader
1174 >11 string x (version %-4.4s)
1175 # syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
1176 # assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
1177 0 ulelong&0x80909bEB 0x009018EB
1178 # OEM-ID not always "SYSLINUX"
1179 >434 search/47 Boot\ failed
1180 # followed by \r\n\0 or :\
1181 >>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older)
1182 >>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9)
1183 >459 search/30 Boot\ error\r\n\0
1184 >>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer)
1185 # SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
1186 # assembler instructions: mov di,0600h;mov cx,0100h
1187 16 search/4 \xbf\x00\x06\xb9\x00\x01
1188 # to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
1189 !:strength +36
1190 >94 search/249 Missing\ operating\ system
1191 # followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
1192 # skip Ranish MBR
1193 >>408 search/4 HD1/\0
1194 >>408 default x
1195 >>>250 search/118 \0Operating\ system\ load SYSLINUX MBR
1196 # followed by "ing " or space
1197 >>>>292 search/98 error
1198 >>>>>&0 string \r (version 3.35 or older)
1199 >>>>>&0 string .\r (version 3.52 or newer)
1200 >>>>>&0 default x (version 3.36-3.51 )
1201 >368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR
1202 >>156 search/10 \0Boot\ partition\ not\ found\r\n
1203 >>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older)
1204 >>174 search/10 \0Missing\ OS\r\n
1205 >>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer)
1206 # SYSLINUX END
1208 # NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
1209 # assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax,
1210 0 ubequad 0x31c08ed0bc007c8e
1211 # mbr_bootsel magic before partition table not reliable with small ipl fragments
1212 #>444 uleshort 0xb5e1
1213 >0004 uleshort x
1214 # ERRorTeXT
1215 >>181 search/166 Error\ \0\r\n NetBSD mbr
1216 # NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
1217 >>>0x1B8 ubelong >0 \b,Serial 0x%-.8x
1218 # BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
1219 >>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector
1220 # BOOT_EXTENDED definitions contains assembler instructions:
1221 # xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
1222 >>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended
1223 # COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
1224 >>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO
1225 # not TERSE_ERROR
1226 >>>196 search/106 No\ active\ partition\0
1227 >>>>&0 string Disk\ read\ error\0
1228 >>>>>&0 string No\ operating\ system\0 \b,verbose
1229 # not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
1230 >>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS
1231 # not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13
1232 >>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check
1233 # assembler instructions: movw nametab,bx
1234 >>>0x26 search/21 \xBB\x94\x07
1235 # not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
1236 >>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94
1237 >>>>>181 search/166 Error\ \0
1238 # "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
1239 >>>>>>&3 string x \b,"%s"
1240 >>>446 use partition-table
1241 # Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
1242 # added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
1243 # assembler instructions: jmp short 0x58;nop;ASCII
1244 0 ubequad&0xeb58908000000000 0xeb58900000000000
1245 # assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
1246 >(1.b+2) ubequad 0xfa31c08ed88ec08e
1247 # Error messages at end of code
1248 >>376 string No\ operating\ system\r\n\0
1249 >>>398 string Disk\ error\r\n\0FDD\0HDD\0
1250 >>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr
1252 # Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/
1253 # added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
1254 # for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
1255 # or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
1256 0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC
1257 # pointer to the data starting with Neil Turton signature string
1258 >(0x1BC.s) string NDTmbr
1259 >>&-14 string 1234F\0 Turton mbr (
1260 # parameters also viewed by install-mbr --list
1261 >>>(0x1BC.s+7) ubyte x \b%u<=
1262 >>>(0x1BC.s+9) ubyte x \bVersion<=%u
1263 #>>>(0x1BC.s+8) ubyte x asm_flag_%x
1264 >>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix
1265 # variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode
1266 >>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk
1267 #0x1~1,..,0x8~4,0x10~F,0x80~A enabled
1268 #>>>(0x1BC.s+10) ubyte x \b,flags 0x%x
1269 #0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
1270 #>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x
1271 # for older versions
1272 >>>(0x1BC.s+9) ubyte <2
1273 #>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds
1274 >>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
1275 # floppy A: or B:
1276 >>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x
1277 >>>>(0x1BC.s+13) ubyte >1
1278 # 1st hard disc
1279 #>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x
1280 # not 1st hard disc
1281 >>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x
1282 # for version >= 2 maximal timeout can be 65534
1283 >>>(0x1BC.s+9) ubyte >1
1284 #>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds
1285 >>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds
1286 # floppy A: or B:
1287 >>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x
1288 >>>>(0x1BC.s+14) ubyte >1
1289 # 1st hard disc
1290 #>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x
1291 # not 1st hard disc
1292 >>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x
1293 >>>0 ubyte x \b)
1295 # added by Joerg Jenderek
1296 # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
1297 # grub-1.94/kern/i386/pc/startup.S
1298 # https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
1299 # usual values are marked with comments to get only informations of strange GRUB loaders
1300 0x200 uleshort 0x70EA
1301 # found only version 3.{1,2}
1302 >0x206 ubeshort >0x0300
1303 # GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
1304 >>0x212 ubyte >0x29
1305 >>>0x213 ubyte >0x29
1306 # not iso9660_stage1_5
1307 #>>>0 ulelong&0x00BE5652 0x00BE5652
1308 >>>>0x213 ubyte >0x29 GRand Unified Bootloader
1309 # config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
1310 >>>>0x217 ubyte 0xFF stage1_5
1311 >>>>0x217 ubyte <0xFF stage2
1312 >>>>0x206 ubyte x \b version %u
1313 >>>>0x207 ubyte x \b.%u
1314 # module_size for 1.94
1315 >>>>0x208 ulelong <0xffffff \b, installed partition %u
1316 #>>>>0x208 ulelong =0xffffff \b, %lu (default)
1317 >>>>0x208 ulelong >0xffffff \b, installed partition %u
1318 # GRUB 0.5.95 unofficial
1319 >>>>0x20C ulelong&0x2E300000 0x2E300000
1320 # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
1321 >>>>>0x20C ubyte x \b, identifier 0x%x
1322 #>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
1323 >>>>>0x20D ubyte >0 \b, LBA flag 0x%x
1324 # GRUB version as string
1325 >>>>>0x20E string >\0 \b, GRUB version %-s
1326 # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
1327 >>>>>>0x215 ulong 0xffffffff
1328 >>>>>>>0x219 string >\0 \b, configuration file %-s
1329 >>>>>>0x215 ulong !0xffffffff
1330 >>>>>>>0x215 string >\0 \b, configuration file %-s
1331 # newer GRUB versions
1332 >>>>0x20C ulelong&0x2E300000 !0x2E300000
1333 ##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
1334 >>>>>0x20C ulelong >0 \b, saved entry %d
1335 # for 1.94 contains kernel image size
1336 # for 0.93,0.94,0.96,0.97
1337 # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
1338 >>>>>0x210 ubyte x \b, identifier 0x%x
1339 # The flag for LBA forcing is in most cases 0
1340 #>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
1341 >>>>>0x211 ubyte >0 \b, LBA flag 0x%x
1342 # GRUB version as string
1343 >>>>>0x212 string >\0 \b, GRUB version %-s
1344 # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
1345 >>>>>0x217 ulong 0xffffffff
1346 >>>>>>0x21b string >\0 \b, configuration file %-s
1347 >>>>>0x217 ulong !0xffffffff
1348 >>>>>>0x217 string >\0 \b, configuration file %-s
1350 # DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
1351 # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
1352 # over BIOS parameter block (BPB)
1353 # https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
1354 # older drives may use Near JuMP instruction E9 xx xx
1355 # minimal short forward jump found 0x29 for bootloaders or 0x0
1356 # maximal short forward jump is 0x7f
1357 # OEM-ID is empty or contain readable bytes
1358 0 ulelong&0x804000E9 0x000000E9
1359 !:strength +60
1360 # mtools-3.9.8/msdos.h
1361 # usual values are marked with comments to get only informations of strange FAT systems
1362 # valid sectorsize must be a power of 2 from 32 to 32768
1363 >11 uleshort&0x001f 0
1364 >>11 uleshort <32769
1365 >>>11 uleshort >31
1366 >>>>21 ubyte&0xf0 0xF0
1367 >>>>>0 ubyte 0xEB DOS/MBR boot sector
1368 >>>>>>1 ubyte x \b, code offset 0x%x+2
1369 >>>>>0 ubyte 0xE9
1370 >>>>>>1 uleshort x \b, code offset 0x%x+3
1371 >>>>>3 string >\0 \b, OEM-ID "%-.8s"
1372 #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
1373 >>>>>>8 string IHC \b cached by Windows 9M
1374 >>>>>11 uleshort >512 \b, Bytes/sector %u
1375 #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
1376 >>>>>11 uleshort <512 \b, Bytes/sector %u
1377 >>>>>13 ubyte >1 \b, sectors/cluster %u
1378 #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
1379 # for lazy FAT32 implementation like Transcend digital photo frame PF830
1380 >>>>>82 string/c fat32
1381 >>>>>>14 uleshort !32 \b, reserved sectors %u
1382 #>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
1383 >>>>>82 string/c !fat32
1384 >>>>>>14 uleshort >1 \b, reserved sectors %u
1385 #>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
1386 #>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS)
1387 >>>>>16 ubyte >2 \b, FATs %u
1388 #>>>>>16 ubyte =2 \b, FATs %u (usual)
1389 >>>>>16 ubyte =1 \b, FAT %u
1390 >>>>>16 ubyte >0
1391 >>>>>17 uleshort >0 \b, root entries %u
1392 #>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32)
1393 >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
1394 #>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32)
1395 >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
1396 #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
1397 >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
1398 >>>>>22 uleshort >0 \b, sectors/FAT %u
1399 #>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32)
1400 >>>>>24 uleshort x \b, sectors/track %u
1401 >>>>>26 ubyte >2 \b, heads %u
1402 #>>>>>26 ubyte =2 \b, heads %u (usual floppy)
1403 >>>>>26 ubyte =1 \b, heads %u
1404 # valid only for sector sizes with more then 32 Bytes
1405 >>>>>11 uleshort >32
1406 # https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
1407 # skip for values 2,2Ah,70h,73h,DFh
1408 # and continue for extended boot signature values 0,28h,29h,80h
1409 >>>>>>38 ubyte&0x56 =0
1410 >>>>>>>28 ulelong >0 \b, hidden sectors %u
1411 #>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
1412 >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
1413 #>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
1414 # FAT<32 bit specific
1415 >>>>>>>82 string/c !fat32
1416 #>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
1417 #>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
1418 >>>>>>>>36 ubyte !0x80
1419 >>>>>>>>>36 ubyte !0 \b, physical drive 0x%x
1420 # VGA-copy CRC or
1421 # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
1422 >>>>>>>>37 ubyte >0 \b, reserved 0x%x
1423 #>>>>>>>>37 ubyte =0 \b, reserved 0x%x
1424 # extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others
1425 >>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
1426 >>>>>>>>38 ubyte&0xFE =0x28
1427 >>>>>>>>>39 ulelong x \b, serial number 0x%x
1428 >>>>>>>>38 ubyte =0x29
1429 >>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
1430 >>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
1431 >>>>>>>>>43 string =NO\ NAME \b, unlabeled
1432 # there exist some old floppies without word FAT at offset 54
1433 # a word like "FATnm " is only a hint for a FAT size on nm-bits
1434 # Normally the number of clusters is calculated by the values of BPP.
1435 # if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
1436 # otherwise FAT is 16 bit.
1437 # http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
1438 >>>>>82 string/c !fat32
1439 >>>>>>54 string FAT12 \b, FAT (12 bit)
1440 >>>>>>54 string FAT16 \b, FAT (16 bit)
1441 >>>>>>54 default x
1442 # determinate FAT bit size by media descriptor
1443 # small floppies implies FAT12
1444 >>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor)
1445 # with media descriptor F0h floppy or maybe superfloppy with FAT16
1446 >>>>>>>21 ubyte =0xF0
1447 # superfloppy (many sectors) implies FAT16
1448 >>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors)
1449 # no superfloppy with media descriptor F0h implies FAT12
1450 >>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors)
1451 # with media descriptor F8h floppy or hard disc with FAT12 or FAT16
1452 >>>>>>>21 ubyte =0xF8
1453 # 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
1454 >>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry)
1455 # hard disc with FAT12 or FAT16
1456 >>>>>>>>19 default x \b, FAT (1Y bit by descriptor)
1457 # with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
1458 >>>>>>>21 ubyte =0xFA
1459 # 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
1460 >>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry)
1461 # RAM disc with FAT12 or FAT16 or Tandy hard disc
1462 >>>>>>>>19 default x \b, FAT (1Y bit by descriptor)
1463 # others are floppy
1464 >>>>>>>21 default x \b, FAT (12 bit by descriptor)
1465 # FAT32 bit specific
1466 >>>>>82 string/c fat32 \b, FAT (32 bit)
1467 >>>>>>36 ulelong x \b, sectors/FAT %u
1468 # https://technet.microsoft.com/en-us/library/cc977221.aspx
1469 >>>>>>40 uleshort >0 \b, extension flags 0x%x
1470 #>>>>>>40 uleshort =0 \b, extension flags %hu
1471 >>>>>>42 uleshort >0 \b, fsVersion %u
1472 #>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
1473 >>>>>>44 ulelong >2 \b, rootdir cluster %u
1474 #>>>>>>44 ulelong =2 \b, rootdir cluster %u
1475 #>>>>>>44 ulelong =1 \b, rootdir cluster %u
1476 >>>>>>48 uleshort >1 \b, infoSector %u
1477 #>>>>>>48 uleshort =1 \b, infoSector %u (usual)
1478 >>>>>>48 uleshort <1 \b, infoSector %u
1479 # 0 or 0xFFFF instead of usual 6 means no backup sector
1480 >>>>>>50 uleshort =0xFFFF \b, no Backup boot sector
1481 >>>>>>50 uleshort =0 \b, no Backup boot sector
1482 #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
1483 >>>>>>50 default x
1484 >>>>>>>50 uleshort x \b, Backup boot sector %u
1485 # corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
1486 >>>>>>52 ulelong >0 \b, reserved1 0x%x
1487 >>>>>>56 ulelong >0 \b, reserved2 0x%x
1488 >>>>>>60 ulelong >0 \b, reserved3 0x%x
1489 # same structure as FAT1X
1490 #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
1491 #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
1492 >>>>>>64 ubyte !0x80
1493 >>>>>>>64 ubyte >0 \b, physical drive 0x%x
1494 # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
1495 >>>>>>65 ubyte >0 \b, reserved 0x%x
1496 >>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
1497 >>>>>>66 ubyte =0x29
1498 >>>>>>>67 ulelong x \b, serial number 0x%x
1499 >>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
1500 >>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
1501 >>>>>>>71 string =NO\ NAME \b, unlabeled
1502 # additional tests for floppy image added by Joerg Jenderek
1503 # no fixed disk
1504 >>>>>21 ubyte !0xF8
1505 # floppy media with 12 bit FAT
1506 >>>>>>54 string !FAT16
1507 # test for FAT after bootsector
1508 >>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT
1509 # floppy image
1510 !:mime application/x-ima
1511 # NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
1512 # and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
1513 # 0 FATs
1514 >>>>>16 ubyte =0
1515 # 0 root entries
1516 >>>>>>17 uleshort =0
1517 # 0 DOS sectors
1518 >>>>>>>19 uleshort =0
1519 # 0 sectors/FAT
1520 # dos < 4.0 BootSector value found is 0x80
1521 #38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x)
1522 >>>>>>>>22 uleshort =0 \b; NTFS
1523 >>>>>>>>>24 uleshort >0 \b, sectors/track %u
1524 >>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x
1525 >>>>>>>>>40 ulequad >0 \b, sectors %lld
1526 >>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld
1527 >>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld
1528 # Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
1529 # Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
1530 >>>>>>>>>64 lelong <256
1531 >>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d
1532 >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i)
1533 # Values 0 to 127 represent index block sizes of 0 to 127 clusters.
1534 # Values 128 to 255 represent index block sizes of 2^(256-N) byte
1535 >>>>>>>>>68 ulelong <256
1536 >>>>>>>>>>68 ulelong <128 \b, clusters/index block %d
1537 #>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d)
1538 >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i)
1539 >>>>>>>>>72 ulequad x \b, serial number 0%llx
1540 >>>>>>>>>80 ulelong >0 \b, checksum 0x%x
1541 #>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual)
1542 # unicode loadername size jump
1543 >>>>>>>>>(0x200.s*2) ubyte x
1544 # in next sector loadername terminated by unicode CTRL-D and $
1545 >>>>>>>>>>&0x1FF ulequad&0x0000FFffFFffFF00 0x0000002400040000 \b; contains
1546 # if 2nd NTFS sectors is found then assume whole filesystem
1547 #!:mime application/x-raw-disk-image
1548 !:ext img/bin/ntfs
1549 >>>>>>>>>>>0x200 use ntfs-sector2
1551 # For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019
1552 # https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
1553 # unused assembler instructions short JMP y2;NOP;NOP
1554 0x056 ulelong&0xFFFF0FFF 0x909002EB NTFS
1555 #!:mime application/octet-stream
1556 !:ext bin
1557 >0 use ntfs-sector2
1558 # https://memory.dataram.com/products-and-services/software/ramdisk
1559 # assembler instructions JMP C000;NOP
1560 0x056 ulelong 0x9000c0e9 NTFS
1561 #!:mime application/octet-stream
1562 !:ext bin
1563 >0 use ntfs-sector2
1564 # check for characteristics of second NTFS sector and then display loader name
1565 0 name ntfs-sector2
1566 # number of utf16 characters of loadername
1567 >0 uleshort <8
1568 # unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP
1569 >>0x056 ulelong&0xFF0000FD 0x900000E9
1570 # loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
1571 >>>0x002 lestring16 x bootstrap %-5.5s
1572 # check for 7 character length of loader name like BOOTMGR
1573 >>>0 uleshort 7
1574 >>>>0x0c lestring16 x \b%-2.2s
1575 ### DOS,NTFS boot sectors end
1577 # ntfsclone-image is a special save format for NTFS volumes,
1578 # created and restored by the ntfsclone program
1579 0 string \0ntfsclone-image ntfsclone image,
1580 >0x10 byte x version %d.
1581 >0x11 byte x \b%d,
1582 >0x12 lelong x cluster size %d,
1583 >0x16 lequad x device size %lld,
1584 >0x1e lequad x %lld total clusters,
1585 >0x26 lequad x %lld clusters in use
1587 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
1588 >8404 string x last mounted on %s,
1589 #>9504 ledate x last checked at %s,
1590 >8224 ledate x last written at %s,
1591 >8401 byte x clean flag %d,
1592 >8228 lelong x number of blocks %d,
1593 >8232 lelong x number of data blocks %d,
1594 >8236 lelong x number of cylinder groups %d,
1595 >8240 lelong x block size %d,
1596 >8244 lelong x fragment size %d,
1597 >8252 lelong x minimum percentage of free blocks %d,
1598 >8256 lelong x rotational delay %dms,
1599 >8260 lelong x disk rotational speed %drps,
1600 >8320 lelong 0 TIME optimization
1601 >8320 lelong 1 SPACE optimization
1603 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
1604 >&-1164 string x last mounted on %s,
1605 >&-696 string >\0 volume name %s,
1606 >&-304 leqldate x last written at %s,
1607 >&-1167 byte x clean flag %d,
1608 >&-1168 byte x readonly flag %d,
1609 >&-296 lequad x number of blocks %lld,
1610 >&-288 lequad x number of data blocks %lld,
1611 >&-1332 lelong x number of cylinder groups %d,
1612 >&-1328 lelong x block size %d,
1613 >&-1324 lelong x fragment size %d,
1614 >&-180 lelong x average file size %d,
1615 >&-176 lelong x average number of files in dir %d,
1616 >&-272 lequad x pending blocks to free %lld,
1617 >&-264 lelong x pending inodes to free %d,
1618 >&-664 lequad x system-wide uuid %0llx,
1619 >&-1316 lelong x minimum percentage of free blocks %d,
1620 >&-1248 lelong 0 TIME optimization
1621 >&-1248 lelong 1 SPACE optimization
1623 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
1624 >&-1164 string x last mounted on %s,
1625 >&-696 string >\0 volume name %s,
1626 >&-304 leqldate x last written at %s,
1627 >&-1167 byte x clean flag %d,
1628 >&-1168 byte x readonly flag %d,
1629 >&-296 lequad x number of blocks %lld,
1630 >&-288 lequad x number of data blocks %lld,
1631 >&-1332 lelong x number of cylinder groups %d,
1632 >&-1328 lelong x block size %d,
1633 >&-1324 lelong x fragment size %d,
1634 >&-180 lelong x average file size %d,
1635 >&-176 lelong x average number of files in dir %d,
1636 >&-272 lequad x pending blocks to free %lld,
1637 >&-264 lelong x pending inodes to free %d,
1638 >&-664 lequad x system-wide uuid %0llx,
1639 >&-1316 lelong x minimum percentage of free blocks %d,
1640 >&-1248 lelong 0 TIME optimization
1641 >&-1248 lelong 1 SPACE optimization
1643 9564 belong 0x00011954 Unix Fast File system [v1] (big-endian),
1644 >7168 belong 0x4c41424c Apple UFS Volume
1645 >>7186 string x named %s,
1646 >>7176 belong x volume label version %d,
1647 >>7180 bedate x created on %s,
1648 >8404 string x last mounted on %s,
1649 #>9504 bedate x last checked at %s,
1650 >8224 bedate x last written at %s,
1651 >8401 byte x clean flag %d,
1652 >8228 belong x number of blocks %d,
1653 >8232 belong x number of data blocks %d,
1654 >8236 belong x number of cylinder groups %d,
1655 >8240 belong x block size %d,
1656 >8244 belong x fragment size %d,
1657 >8252 belong x minimum percentage of free blocks %d,
1658 >8256 belong x rotational delay %dms,
1659 >8260 belong x disk rotational speed %drps,
1660 >8320 belong 0 TIME optimization
1661 >8320 belong 1 SPACE optimization
1663 42332 belong 0x19540119 Unix Fast File system [v2] (big-endian)
1664 >&-1164 string x last mounted on %s,
1665 >&-696 string >\0 volume name %s,
1666 >&-304 beqldate x last written at %s,
1667 >&-1167 byte x clean flag %d,
1668 >&-1168 byte x readonly flag %d,
1669 >&-296 bequad x number of blocks %lld,
1670 >&-288 bequad x number of data blocks %lld,
1671 >&-1332 belong x number of cylinder groups %d,
1672 >&-1328 belong x block size %d,
1673 >&-1324 belong x fragment size %d,
1674 >&-180 belong x average file size %d,
1675 >&-176 belong x average number of files in dir %d,
1676 >&-272 bequad x pending blocks to free %lld,
1677 >&-264 belong x pending inodes to free %d,
1678 >&-664 bequad x system-wide uuid %0llx,
1679 >&-1316 belong x minimum percentage of free blocks %d,
1680 >&-1248 belong 0 TIME optimization
1681 >&-1248 belong 1 SPACE optimization
1683 66908 belong 0x19540119 Unix Fast File system [v2] (big-endian)
1684 >&-1164 string x last mounted on %s,
1685 >&-696 string >\0 volume name %s,
1686 >&-304 beqldate x last written at %s,
1687 >&-1167 byte x clean flag %d,
1688 >&-1168 byte x readonly flag %d,
1689 >&-296 bequad x number of blocks %lld,
1690 >&-288 bequad x number of data blocks %lld,
1691 >&-1332 belong x number of cylinder groups %d,
1692 >&-1328 belong x block size %d,
1693 >&-1324 belong x fragment size %d,
1694 >&-180 belong x average file size %d,
1695 >&-176 belong x average number of files in dir %d,
1696 >&-272 bequad x pending blocks to free %lld,
1697 >&-264 belong x pending inodes to free %d,
1698 >&-664 bequad x system-wide uuid %0llx,
1699 >&-1316 belong x minimum percentage of free blocks %d,
1700 >&-1248 belong 0 TIME optimization
1701 >&-1248 belong 1 SPACE optimization
1703 0 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian),
1704 >0x90 lelong+1 x volume %d
1705 >0x94 lelong x (of %d),
1706 >0x50 string x name %s,
1707 >0x98 ulelong x version %u,
1708 >0xa0 ulelong x flags 0x%x
1710 # ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
1711 # ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
1712 # volume label and UUID Russell Coker
1713 # https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
1714 0x438 leshort 0xEF53 Linux
1715 >0x44c lelong x rev %d
1716 >0x43e leshort x \b.%d
1717 # No journal? ext2
1718 >0x45c lelong ^0x0000004 ext2 filesystem data
1719 >>0x43a leshort ^0x0000001 (mounted or unclean)
1720 # Has a journal? ext3 or ext4
1721 >0x45c lelong &0x0000004
1722 # and small INCOMPAT?
1723 >>0x460 lelong <0x0000040
1724 # and small RO_COMPAT?
1725 >>>0x464 lelong <0x0000008 ext3 filesystem data
1726 # else large RO_COMPAT?
1727 >>>0x464 lelong >0x0000007 ext4 filesystem data
1728 # else large INCOMPAT?
1729 >>0x460 lelong >0x000003f ext4 filesystem data
1730 >0x468 belong x \b, UUID=%08x
1731 >0x46c beshort x \b-%04x
1732 >0x46e beshort x \b-%04x
1733 >0x470 beshort x \b-%04x
1734 >0x472 belong x \b-%08x
1735 >0x476 beshort x \b%04x
1736 >0x478 string >0 \b, volume name "%s"
1737 # General flags for any ext* fs
1738 >0x460 lelong &0x0000004 (needs journal recovery)
1739 >0x43a leshort &0x0000002 (errors)
1740 # INCOMPAT flags
1741 >0x460 lelong &0x0000001 (compressed)
1742 #>0x460 lelong &0x0000002 (filetype)
1743 #>0x460 lelong &0x0000010 (meta bg)
1744 >0x460 lelong &0x0000040 (extents)
1745 >0x460 lelong &0x0000080 (64bit)
1746 #>0x460 lelong &0x0000100 (mmp)
1747 #>0x460 lelong &0x0000200 (flex bg)
1748 # RO_INCOMPAT flags
1749 #>0x464 lelong &0x0000001 (sparse super)
1750 >0x464 lelong &0x0000002 (large files)
1751 >0x464 lelong &0x0000008 (huge files)
1752 #>0x464 lelong &0x0000010 (gdt checksum)
1753 #>0x464 lelong &0x0000020 (many subdirs)
1754 #>0x463 lelong &0x0000040 (extra isize)
1756 # f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
1757 0x400 lelong 0xF2F52010 F2FS filesystem
1758 >0x46c belong x \b, UUID=%08x
1759 >0x470 beshort x \b-%04x
1760 >0x472 beshort x \b-%04x
1761 >0x474 beshort x \b-%04x
1762 >0x476 belong x \b-%08x
1763 >0x47a beshort x \b%04x
1764 >0x147c lestring16 x \b, volume name "%s"
1766 # Minix filesystems - Juan Cespedes <cespedes@debian.org>
1767 0x410 leshort 0x137f
1768 !:strength / 2
1769 >0x402 beshort < 100
1770 >0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones
1771 >0x1e string minix \b, bootable
1772 0x410 beshort 0x137f
1773 !:strength / 2
1774 >0x402 beshort < 100
1775 >0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones
1776 >0x1e string minix \b, bootable
1777 0x410 leshort 0x138f
1778 !:strength / 2
1779 >0x402 beshort < 100
1780 >0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones
1781 >0x1e string minix \b, bootable
1782 0x410 beshort 0x138f
1783 !:strength / 2
1784 >0x402 beshort < 100
1785 >0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones
1786 >0x1e string minix \b, bootable
1787 # Weak Magic: this is $x
1788 #0x410 leshort 0x2468
1789 #>0x402 beshort < 100
1790 #>>0x402 beshort > -1 Minix filesystem, V2, 14 char names
1791 #>0x1e string minix \b, bootable
1792 #0x410 beshort 0x2468
1793 #>0x402 beshort < 100
1794 #>0x402 beshort > -1 Minix filesystem, V2 (big endian)
1795 #>0x1e string minix \b, bootable
1796 #0x410 leshort 0x2478
1797 #>0x402 beshort < 100
1798 #>0x402 beshort > -1 Minix filesystem, V2, 30 char names
1799 #>0x1e string minix \b, bootable
1800 #0x410 leshort 0x2478
1801 #>0x402 beshort < 100
1802 #>0x402 beshort > -1 Minix filesystem, V2, 30 char names
1803 #>0x1e string minix \b, bootable
1804 #0x410 beshort 0x2478
1805 #>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian)
1806 #>0x1e string minix \b, bootable
1807 # Weak Magic! this is MD
1808 #0x418 leshort 0x4d5a
1809 #>0x402 beshort <100
1810 #>>0x402 beshort > -1 Minix filesystem, V3, 60 char names
1812 # SGI disk labels - Nathan Scott <nathans@debian.org>
1813 0 belong 0x0BE5A941 SGI disk label (volume header)
1815 # SGI XFS filesystem - Nathan Scott <nathans@debian.org>
1816 0 belong 0x58465342 SGI XFS filesystem data
1817 >0x4 belong x (blksz %d,
1818 >0x68 beshort x inosz %d,
1819 >0x64 beshort ^0x2004 v1 dirs)
1820 >0x64 beshort &0x2004 v2 dirs)
1822 ############################################################################
1823 # Minix-ST kernel floppy
1824 0x800 belong 0x46fc2700 Atari-ST Minix kernel image
1825 # https://en.wikipedia.org/wiki/BIOS_parameter_block
1826 # floppies with valid BPB and any instruction at beginning
1827 >19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy
1828 >19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy
1830 ############################################################################
1831 # Hmmm, is this a better way of detecting _standard_ floppy images ?
1832 19 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k
1833 >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
1834 19 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k
1835 >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
1836 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
1837 >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
1839 19 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM
1840 >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
1841 19 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs
1842 >0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector
1844 19 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k
1845 19 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k
1846 # | | | | |
1847 # | | | | heads
1848 # | | | sectors/track
1849 # | | sectors/FAT
1850 # | media descriptor
1851 # BPB: sectors
1853 # Valid media descriptor bytes for MS-DOS:
1854 #
1855 # Byte Capacity Media Size and Type
1856 # -------------------------------------------------
1857 #
1858 # F0 2.88 MB 3.5-inch, 2-sided, 36-sector
1859 # F0 1.44 MB 3.5-inch, 2-sided, 18-sector
1860 # F9 720K 3.5-inch, 2-sided, 9-sector
1861 # F9 1.2 MB 5.25-inch, 2-sided, 15-sector
1862 # FD 360K 5.25-inch, 2-sided, 9-sector
1863 # FF 320K 5.25-inch, 2-sided, 8-sector
1864 # FC 180K 5.25-inch, 1-sided, 9-sector
1865 # FE 160K 5.25-inch, 1-sided, 8-sector
1866 # FE 250K 8-inch, 1-sided, single-density
1867 # FD 500K 8-inch, 2-sided, single-density
1868 # FE 1.2 MB 8-inch, 2-sided, double-density
1869 # F8 ----- Fixed disk
1870 #
1871 # FC xxxK Apricot 70x1x9 boot disk.
1872 #
1873 # Originally a bitmap:
1874 # xxxxxxx0 Not two sided
1875 # xxxxxxx1 Double sided
1876 # xxxxxx0x Not 8 SPT
1877 # xxxxxx1x 8 SPT
1878 # xxxxx0xx Not Removable drive
1879 # xxxxx1xx Removable drive
1880 # 11111xxx Must be one.
1881 #
1882 # But now it's rather random:
1883 # 111111xx Low density disk
1884 # 00 SS, Not 8 SPT
1885 # 01 DS, Not 8 SPT
1886 # 10 SS, 8 SPT
1887 # 11 DS, 8 SPT
1888 #
1889 # 11111001 Double density 3 1/2 floppy disk, high density 5 1/4
1890 # 11110000 High density 3 1/2 floppy disk
1891 # 11111000 Hard disk any format
1892 #
1894 # all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
1895 # https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
1896 # Too Weak.
1897 #512 ubelong&0xE0ffff00 0xE0ffff00
1898 # without valid Media descriptor in place of BPB, cases with are done at other places
1899 #>21 ubyte <0xE5 floppy with old FAT filesystem
1900 # but valid Media descriptor at begin of FAT
1901 #>>512 ubyte =0xed 720k
1902 #>>512 ubyte =0xf0 1440k
1903 #>>512 ubyte =0xf8 720k
1904 #>>512 ubyte =0xf9 1220k
1905 #>>512 ubyte =0xfa 320k
1906 #>>512 ubyte =0xfb 640k
1907 #>>512 ubyte =0xfc 180k
1908 # look like an old DOS directory entry
1909 #>>>0xA0E ubequad 0
1910 #>>>>0xA00 ubequad !0
1911 #!:mime application/x-ima
1912 #>>512 ubyte =0xfd
1913 # look for 2nd FAT at different location to distinguish between 360k and 500k
1914 #>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k
1915 #>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k
1916 #>>>0xA0E ubequad 0
1917 #!:mime application/x-ima
1918 #>>512 ubyte =0xfe
1919 #>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k
1920 #>>>>0x60E ubequad 0
1921 #>>>>>0x600 ubequad !0
1922 #!:mime application/x-ima
1923 #>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k
1924 #>>512 ubyte =0xff 320k
1925 #>>>0x60E ubequad 0
1926 #>>>>0x600 ubequad !0
1927 #!:mime application/x-ima
1928 #>>512 ubyte x \b, Media descriptor 0x%x
1929 # without x86 jump instruction
1930 #>>0 ulelong&0x804000E9 !0x000000E9
1931 # assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
1932 #>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader
1933 # IOSYS.COM+MSDOS.COM
1934 #>>>>0xc4 use 2xDOS-filename
1935 #>>0 ulelong&0x804000E9 =0x000000E9
1936 # only x86 short jump instruction found
1937 #>>>0 ubyte =0xEB
1938 #>>>>1 ubyte x \b, code offset 0x%x+2
1939 # https://thestarman.pcministry.com/DOS/ibm100/Boot.htm
1940 # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
1941 #>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader
1942 # ibmbio.com+ibmdos.com
1943 #>>>>>0x176 use DOS-filename
1944 #>>>>>0x181 ubyte x \b+
1945 #>>>>>0x182 use DOS-filename
1946 # https://thestarman.pcministry.com/DOS/ibm110/Boot.htm
1947 # assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
1948 #>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader
1949 # ibmbio.com+ibmdos.com
1950 #>>>>>0x18b use DOS-filename
1951 #>>>>>0x196 ubyte x \b+
1952 #>>>>>0x197 use DOS-filename
1953 # https://en.wikipedia.org/wiki/Zenith_Data_Systems
1954 # assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
1955 #>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader
1956 # IO.SYS+MSDOS.SYS
1957 #>>>>>0x20 use 2xDOS-filename
1958 # https://en.wikipedia.org/wiki/Corona_Data_Systems
1959 # assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
1960 #>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader
1961 # IO.SYS+MSDOS.SYS
1962 #>>>>>0x69 use 2xDOS-filename
1963 # assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
1964 #>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader
1965 # defect IO.SYS+MSDOS.SYS ?
1966 #>>>>>0x162 use 2xDOS-filename
1968 0 name cdrom
1969 >38913 string !NSR0 ISO 9660 CD-ROM filesystem data
1970 !:mime application/x-iso9660-image
1971 !:ext iso/iso9660
1972 >38913 string NSR0 UDF filesystem data
1973 !:mime application/x-iso9660-image
1974 !:ext iso/udf
1975 >>38917 string 1 (version 1.0)
1976 >>38917 string 2 (version 1.5)
1977 >>38917 string 3 (version 2.0)
1978 >>38917 byte >0x33 (unknown version, ID 0x%X)
1979 >>38917 byte <0x31 (unknown version, ID 0x%X)
1980 # The next line is not necessary because the MBR staff is done looking for boot signature
1981 >0x1FE leshort 0xAA55 (DOS/MBR boot sector)
1982 # "application id" which appears to be used as a volume label
1983 >32808 string/T >\0 '%s'
1984 >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
1985 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
1986 !:mime application/x-iso9660-image
1987 32777 string CDROM High Sierra CD-ROM filesystem data
1989 # CDROM Filesystems
1990 # https://en.wikipedia.org/wiki/ISO_9660
1991 # Modified for UDF by gerardo.cacciari@gmail.com
1992 32769 string CD001
1993 # mime line at that position does not work
1994 # to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
1995 #!:strength -11
1996 # to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
1997 !:strength +34
1998 >0 use cdrom
2000 # URL: https://en.wikipedia.org/wiki/NRG_(file_format)
2001 # Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/
2002 # 11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh
2003 # From: Joerg Jenderek
2004 # Note: Only for nero disc with once (DAO) type after 300 KB header
2005 339969 string CD001 Nero CD image at 0x4B000
2006 !:mime application/x-nrg
2007 !:ext nrg
2008 >307200 use cdrom
2010 # .cso files
2011 # Reference: https://pismotec.com/ciso/ciso.h
2012 # NOTE: There are two other formats with the same magic but
2013 # completely incompatible specifications:
2014 # - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
2015 # - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
2016 0 string CISO
2017 # Other fields are used to determine what type of CISO this is:
2018 # - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
2019 # - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
2020 # - 0x10 == 0x00004000: For >2GB files using maxcso...
2021 # https://github.com/unknownbrackets/maxcso/issues/26
2022 # - None of the above: Compact ISO.
2023 >4 lelong !0
2024 >>4 lelong !0x200000
2025 >>>16 lelong !0x800
2026 >>>>16 lelong !0x4000 Compressed ISO CD image
2028 # cramfs filesystem - russell@coker.com.au
2029 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
2030 >4 lelong x size %u
2031 >8 lelong &1 version #2
2032 >8 lelong &2 sorted_dirs
2033 >8 lelong &4 hole_support
2034 >32 lelong x CRC 0x%x,
2035 >36 lelong x edition %u,
2036 >40 lelong x %u blocks,
2037 >44 lelong x %u files
2039 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
2040 >4 belong x size %u
2041 >8 belong &1 version #2
2042 >8 belong &2 sorted_dirs
2043 >8 belong &4 hole_support
2044 >32 belong x CRC 0x%x,
2045 >36 belong x edition %u,
2046 >40 belong x %u blocks,
2047 >44 belong x %u files
2049 # reiserfs - russell@coker.com.au
2050 0x10034 string ReIsErFs ReiserFS V3.5
2051 0x10034 string ReIsEr2Fs ReiserFS V3.6
2052 0x10034 string ReIsEr3Fs ReiserFS V3.6.19
2053 >0x1002c leshort x block size %d
2054 >0x10032 leshort &2 (mounted or unclean)
2055 >0x10000 lelong x num blocks %d
2056 >0x10040 lelong 1 tea hash
2057 >0x10040 lelong 2 yura hash
2058 >0x10040 lelong 3 r5 hash
2060 # EST flat binary format (which isn't, but anyway)
2061 # From: Mark Brown <broonie@sirena.org.uk>
2062 0 string ESTFBINR EST flat binary
2064 # Aculab VoIP firmware
2065 # From: Mark Brown <broonie@sirena.org.uk>
2066 0 string VoIP\ Startup\ and Aculab VoIP firmware
2067 >35 string x format %s
2069 # From: Mark Brown <broonie@sirena.org.uk> [old]
2070 # From: Behan Webster <behanw@websterwood.com>
2071 0 belong 0x27051956 u-boot legacy uImage,
2072 >32 string x %s,
2073 >28 byte 0 Invalid os/
2074 >28 byte 1 OpenBSD/
2075 >28 byte 2 NetBSD/
2076 >28 byte 3 FreeBSD/
2077 >28 byte 4 4.4BSD/
2078 >28 byte 5 Linux/
2079 >28 byte 6 SVR4/
2080 >28 byte 7 Esix/
2081 >28 byte 8 Solaris/
2082 >28 byte 9 Irix/
2083 >28 byte 10 SCO/
2084 >28 byte 11 Dell/
2085 >28 byte 12 NCR/
2086 >28 byte 13 LynxOS/
2087 >28 byte 14 VxWorks/
2088 >28 byte 15 pSOS/
2089 >28 byte 16 QNX/
2090 >28 byte 17 Firmware/
2091 >28 byte 18 RTEMS/
2092 >28 byte 19 ARTOS/
2093 >28 byte 20 Unity OS/
2094 >28 byte 21 INTEGRITY/
2095 >29 byte 0 \bInvalid CPU,
2096 >29 byte 1 \bAlpha,
2097 >29 byte 2 \bARM,
2098 >29 byte 3 \bIntel x86,
2099 >29 byte 4 \bIA64,
2100 >29 byte 5 \bMIPS,
2101 >29 byte 6 \bMIPS 64-bit,
2102 >29 byte 7 \bPowerPC,
2103 >29 byte 8 \bIBM S390,
2104 >29 byte 9 \bSuperH,
2105 >29 byte 10 \bSparc,
2106 >29 byte 11 \bSparc 64-bit,
2107 >29 byte 12 \bM68K,
2108 >29 byte 13 \bNios-32,
2109 >29 byte 14 \bMicroBlaze,
2110 >29 byte 15 \bNios-II,
2111 >29 byte 16 \bBlackfin,
2112 >29 byte 17 \bAVR32,
2113 >29 byte 18 \bSTMicroelectronics ST200,
2114 >29 byte 19 \bSandbox architecture,
2115 >29 byte 20 \bANDES Technology NDS32,
2116 >29 byte 21 \bOpenRISC 1000,
2117 >29 byte 22 \bARM 64-bit,
2118 >29 byte 23 \bDesignWare ARC,
2119 >29 byte 24 \bx86_64,
2120 >29 byte 25 \bXtensa,
2121 >29 byte 26 \bRISC-V,
2122 >30 byte 0 Invalid Image
2123 >30 byte 1 Standalone Program
2124 >30 byte 2 OS Kernel Image
2125 >30 byte 3 RAMDisk Image
2126 >30 byte 4 Multi-File Image
2127 >30 byte 5 Firmware Image
2128 >30 byte 6 Script File
2129 >30 byte 7 Filesystem Image (any type)
2130 >30 byte 8 Binary Flat Device Tree BLOB
2131 >31 byte 0 (Not compressed),
2132 >31 byte 1 (gzip),
2133 >31 byte 2 (bzip2),
2134 >31 byte 3 (lzma),
2135 >12 belong x %d bytes,
2136 >8 bedate x %s,
2137 >16 belong x Load Address: 0x%08X,
2138 >20 belong x Entry Point: 0x%08X,
2139 >4 belong x Header CRC: 0x%08X,
2140 >24 belong x Data CRC: 0x%08X
2142 # JFFS2 file system
2143 0 leshort 0x1984 Linux old jffs2 filesystem data little endian
2144 0 beshort 0x1984 Linux old jffs2 filesystem data big endian
2145 0 leshort 0x1985 Linux jffs2 filesystem data little endian
2146 0 beshort 0x1985 Linux jffs2 filesystem data big endian
2148 # Squashfs
2149 0 name squashfs
2150 >28 beshort x version %d.
2151 >30 beshort x \b%d,
2152 >20 beshort 0 uncompressed,
2153 >20 beshort 1 zlib
2154 >20 beshort 2 lzma
2155 >20 beshort 3 lzo
2156 >20 beshort 4 xz
2157 >20 beshort 5 lz4
2158 >20 beshort 6 zstd
2159 >20 beshort >0 compressed,
2160 >28 beshort <3
2161 >>8 belong x %d bytes,
2162 >28 beshort >2
2163 >>28 beshort <4
2164 >>>63 bequad x %lld bytes,
2165 >>28 beshort >3
2166 >>>40 bequad x %lld bytes,
2167 #>>67 belong x %d bytes,
2168 >4 belong x %d inodes,
2169 >28 beshort <2
2170 >>32 beshort x blocksize: %d bytes,
2171 >28 beshort >1
2172 >>28 beshort <4
2173 >>>51 belong x blocksize: %d bytes,
2174 >>28 beshort >3
2175 >>>12 belong x blocksize: %d bytes,
2176 >28 beshort <4
2177 >>39 bedate x created: %s
2178 >28 beshort >3
2179 >>8 bedate x created: %s
2181 0 string sqsh Squashfs filesystem, big endian,
2182 >0 use squashfs
2184 0 string hsqs Squashfs filesystem, little endian,
2185 >0 use ^squashfs
2187 # AFS Dump Magic
2188 # From: Ty Sarna <tsarna@sarna.org>
2189 0 string \x01\xb3\xa1\x13\x22 AFS Dump
2190 >&0 belong x (v%d)
2191 >>&0 byte 0x76
2192 >>>&0 belong x Vol %d,
2193 >>>>&0 byte 0x6e
2194 >>>>>&0 string x %s
2195 >>>>>>&1 byte 0x74
2196 >>>>>>>&0 beshort 2
2197 >>>>>>>>&4 bedate x on: %s
2198 >>>>>>>>&0 bedate =0 full dump
2199 >>>>>>>>&0 bedate !0 incremental since: %s
2201 #----------------------------------------------------------
2202 #delta ISO Daniel Novotny (dnovotny@redhat.com)
2203 0 string DISO Delta ISO data
2204 !:strength +50
2205 >4 belong x version %d
2207 # VMS backup savesets - gerardo.cacciari@gmail.com
2208 #
2209 4 string \x01\x00\x01\x00\x01\x00
2210 >(0.s+16) string \x01\x01
2211 >>&(&0.b+8) byte 0x42 OpenVMS backup saveset data
2212 >>>40 lelong x (block size %d,
2213 >>>49 string >\0 original name '%s',
2214 >>>2 short 1024 VAX generated)
2215 >>>2 short 2048 AXP generated)
2216 >>>2 short 4096 I64 generated)
2218 # Summary: Oracle Clustered Filesystem
2219 # Created by: Aaron Botsis <redhat@digitalmafia.org>
2220 8 string OracleCFS Oracle Clustered Filesystem,
2221 >4 long x rev %d
2222 >0 long x \b.%d,
2223 >560 string x label: %.64s,
2224 >136 string x mountpoint: %.128s
2226 # Summary: Oracle ASM tagged volume
2227 # Created by: Aaron Botsis <redhat@digitalmafia.org>
2228 32 string ORCLDISK Oracle ASM Volume,
2229 >40 string x Disk Name: %0.12s
2230 32 string ORCLCLRD Oracle ASM Volume (cleared),
2231 >40 string x Disk Name: %0.12s
2233 # Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
2234 8 string OracleCFS Oracle Clustered Filesystem,
2235 >4 long x rev %d
2236 >0 long x \b.%d,
2237 >560 string x label: %.64s,
2238 >136 string x mountpoint: %.128s
2240 # Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
2241 32 string ORCLDISK Oracle ASM Volume,
2242 >40 string x Disk Name: %0.12s
2243 32 string ORCLCLRD Oracle ASM Volume (cleared),
2244 >40 string x Disk Name: %0.12s
2246 # Compaq/HP RILOE floppy image
2247 # From: Dirk Jagdmann <doj@cubic.org>
2248 0 string CPQRFBLO Compaq/HP RILOE floppy image
2250 #------------------------------------------------------------------------------
2251 # Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
2252 # These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
2253 # which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
2254 #
2255 1008 string DECFILE11 Files-11 On-Disk Structure
2256 >525 byte x (ODS-%d);
2257 >1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system;
2258 >1017 string B
2259 >>525 byte 2 VAX/VMS or OpenVMS file system;
2260 >>525 byte 5 OpenVMS Alpha or Itanium file system;
2261 >984 string x volume label is '%-12.12s'
2263 # From: Thomas Klausner <wiz@NetBSD.org>
2264 # https://filext.com/file-extension/DAA
2265 # describes the daa file format. The magic would be:
2266 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive
2268 # From Albert Cahalan <acahalan@gmail.com>
2269 # really le32 operation,destination,payloadsize (but quite predictable)
2270 # 01 00 00 00 00 00 00 c0 00 02 00 00
2271 0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware
2273 # From Eric Sandeen
2274 # GFS2
2275 0x10000 belong 0x01161970
2276 >0x10018 belong 0x0000051d GFS1 Filesystem
2277 >>0x10024 belong x (blocksize %d,
2278 >>0x10060 string >\0 lockproto %s)
2279 >0x10018 belong 0x00000709 GFS2 Filesystem
2280 >>0x10024 belong x (blocksize %d,
2281 >>0x10060 string >\0 lockproto %s)
2283 # Russell Coker <russell@coker.com.au>
2284 0x10040 string _BHRfS_M BTRFS Filesystem
2285 >0x1012b string >\0 label "%s",
2286 >0x10090 lelong x sectorsize %d,
2287 >0x10094 lelong x nodesize %d,
2288 >0x10098 lelong x leafsize %d,
2289 >0x10020 belong x UUID=%08x-
2290 >0x10024 beshort x \b%04x-
2291 >0x10026 beshort x \b%04x-
2292 >0x10028 beshort x \b%04x-
2293 >0x1002a beshort x \b%04x
2294 >0x1002c belong x \b%08x,
2295 >0x10078 lequad x %lld/
2296 >0x10070 lequad x \b%lld bytes used,
2297 >0x10088 lequad x %lld devices
2299 # dvdisaster's .ecc
2300 # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
2301 0 string *dvdisaster* dvdisaster error correction file
2303 # xfs metadump image
2304 # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
2305 # but can we do the << ? For now it's always 512 (0x200) anyway.
2306 0 string XFSM
2307 >0x200 string XFSB XFS filesystem metadump image
2309 # Type: CROM filesystem
2310 # From: Werner Fink <werner@suse.de>
2311 0 string CROMFS CROMFS
2312 >6 string >\0 \b version %2.2s,
2313 >8 ulequad >0 \b block data at %lld,
2314 >16 ulequad >0 \b fblock table at %lld,
2315 >24 ulequad >0 \b inode table at %lld,
2316 >32 ulequad >0 \b root at %lld,
2317 >40 ulelong >0 \b fblock size = %d,
2318 >44 ulelong >0 \b block size = %d,
2319 >48 ulequad >0 \b bytes = %lld
2321 # Type: xfs metadump image
2322 # From: Daniel Novotny <dnovotny@redhat.com>
2323 # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
2324 # but can we do the << ? For now it's always 512 (0x200) anyway.
2325 0 string XFSM
2326 >0x200 string XFSB XFS filesystem metadump image
2328 # Type: delta ISO
2329 # From: Daniel Novotny <dnovotny@redhat.com>
2330 0 string DISO Delta ISO data,
2331 >4 belong x version %d
2333 # JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
2334 # See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
2335 # From: Adam Buchbinder <adam.buchbinder@gmail.com>
2336 0x8000 string JFS1
2337 # Because it's text-only magic, check a binary value (version) to be sure.
2338 # Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
2339 # mountable.
2340 >&0 lelong <3 JFS2 filesystem image
2341 # Label is followed by a UUID; we have to limit string length to avoid
2342 # appending the UUID in the case of a 16-byte label.
2343 >>&144 regex [\x20-\x7E]{1,16} (label "%s")
2344 >>&0 lequad x \b, %lld blocks
2345 >>&8 lelong x \b, blocksize %d
2346 >>&32 lelong&0x00000006 >0 (dirty)
2347 >>&36 lelong >0 (compressed)
2349 # LFS
2350 0 lelong 0x070162 LFS filesystem image
2351 >4 lelong 1 version 1,
2352 >>8 lelong x \b blocks %u,
2353 >>12 lelong x \b blocks per segment %u,
2354 >4 lelong 2 version 2,
2355 >>8 lelong x \b fragments %u,
2356 >>12 lelong x \b bytes per segment %u,
2357 >16 lelong x \b disk blocks %u,
2358 >20 lelong x \b block size %u,
2359 >24 lelong x \b fragment size %u,
2360 >28 lelong x \b fragments per block %u,
2361 >32 lelong x \b start for free list %u,
2362 >36 lelong x \b number of free blocks %d,
2363 >40 lelong x \b number of files %u,
2364 >44 lelong x \b blocks available for writing %d,
2365 >48 lelong x \b inodes in cache %d,
2366 >52 lelong x \b inode file disk address 0x%x,
2367 >56 lelong x \b inode file inode number %u,
2368 >60 lelong x \b address of last segment written 0x%x,
2369 >64 lelong x \b address of next segment to write 0x%x,
2370 >68 lelong x \b address of current segment written 0x%x
2372 0 string td\000 floppy image data (TeleDisk, compressed)
2373 0 string TD\000 floppy image data (TeleDisk)
2375 0 string CQ\024 floppy image data (CopyQM,
2376 >16 leshort x %d sectors,
2377 >18 leshort x %d heads.)
2379 0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk)
2381 0 beshort 0xAA58 floppy image data (IBM SaveDskF, old)
2382 0 beshort 0xAA59 floppy image data (IBM SaveDskF)
2383 0 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed)
2385 0 string \074CPM_Disk\076 disk image data (YAZE)
2387 # ReFS
2388 # Richard W.M. Jones <rjones@redhat.com>
2389 0 string \0\0\0ReFS\0 ReFS filesystem image
2391 # EFW encase image file format:
2392 # Gregoire Passault
2393 # http://www.forensicswiki.org/wiki/Encase_image_file_format
2394 0 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format
2396 # UBIfs
2397 # Linux kernel sources: fs/ubifs/ubifs-media.h
2398 0 lelong 0x06101831
2399 >0x16 leshort 0 UBIfs image
2400 >0x08 lequad x \b, sequence number %llu
2401 >0x10 leshort x \b, length %u
2402 >0x04 lelong x \b, CRC 0x%08x
2404 0 lelong 0x23494255
2405 >0x04 leshort <2
2406 >0x05 string \0\0\0
2407 >0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
2408 >0x04 leshort x UBI image, version %u
2410 # NEC PC-88 2D disk image
2411 # From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
2412 0x20 ulelong&0xFFFFFEFF 0x2A0
2413 >0x10 string \0\0\0\0\0\0\0\0\0\0
2414 >>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
2415 >>>0x1A ubyte&0xEF 0
2416 >>>>0x1B ubyte&0x8F 0
2417 >>>>>0x1B ubyte&70 <0x40
2418 >>>>>>0x1C ulelong >0x21
2419 >>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s
2420 >>>>>>>>0x1B ubyte 0 \b, media=2D
2421 >>>>>>>>0x1B ubyte 0x10 \b, media=2DD
2422 >>>>>>>>0x1B ubyte 0x20 \b, media=2HD
2423 >>>>>>>>0x1B ubyte 0x30 \b, media=1D
2424 >>>>>>>>0x1B ubyte 0x40 \b, media=1DD
2425 >>>>>>>>0x1A ubyte 0x10 \b, write-protected
2427 # HDD Raw Copy Tool disk image, file extension: .imgc
2428 # From Benjamin Vanheuverzwijn <bvanheu@gmail.com>
2429 0 pstring HDD\ Raw\ Copy\ Tool %s
2430 >0x100 pstring x %s
2431 >0x200 pstring x - HD model: %s
2432 #>0x300 pstring x unknown %s
2433 >0x400 pstring x serial: %s
2434 #>0x500 pstring x unknown: %s
2435 !:ext imgc