Skip to content
Browse files

Apple on-disk formats.

  • Loading branch information...
1 parent 0de3251 commit 918400eb76b9c3f4a840c689fe21f6990dd8ede8 @zoulasc zoulasc committed Apr 6, 2012
Showing with 43 additions and 1 deletion.
  1. +43 −1 magic/Magdir/apple
View
44 magic/Magdir/apple
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: apple,v 1.23 2009/09/19 16:28:08 christos Exp $
+# $File: apple,v 1.24 2010/11/25 15:00:12 christos Exp $
# apple: file(1) magic for Apple file formats
#
0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
@@ -249,3 +249,45 @@
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
# .vdi
4 string innotek\ VirtualBox\ Disk\ Image %s
+
+# Apple disk partition stuff, strengthen the magic using byte 4
+0 beshort 0x4552
+>4 byte 0 Apple Driver Map
+>>2 beshort x \b, blocksize %d
+>>4 belong x \b, blockcount %d
+>>10 beshort x \b, devtype %d
+>>12 beshort x \b, devid %d
+>>20 beshort x \b, descriptors %d
+# Assume 8 partitions each at a multiple of the sector size.
+# We could glean this from the partition descriptors, but they are empty!?!?
+>>(2.S*1) indirect \b, contains[@0x%x]:
+>>(2.S*2) indirect \b, contains[@0x%x]:
+>>(2.S*3) indirect \b, contains[@0x%x]:
+>>(2.S*4) indirect \b, contains[@0x%x]:
+>>(2.S*5) indirect \b, contains[@0x%x]:
+>>(2.S*6) indirect \b, contains[@0x%x]:
+>>(2.S*7) indirect \b, contains[@0x%x]:
+>>(2.S*8) indirect \b, contains[@0x%x]:
+
+# Yes, the 3rd and 4th bytes are reserved, but we use them to make the
+# magic stronger.
+0 belong 0x504d0000 Apple Partition Map
+>4 belong x \b, map block count %d
+>8 belong x \b, start block %d
+>12 belong x \b, block count %d
+>16 string >0 \b, name %s
+>48 string >0 \b, type %s
+>124 string >0 \b, processor %s
+>140 string >0 \b, boot arguments %s
+>92 belong & 1 \b, valid
+>92 belong & 2 \b, allocated
+>92 belong & 4 \b, in use
+>92 belong & 8 \b, has boot info
+>92 belong & 16 \b, readable
+>92 belong & 32 \b, writable
+>92 belong & 64 \b, pic boot code
+>92 belong & 128 \b, chain compatible driver
+>92 belong & 256 \b, real driver
+>92 belong & 512 \b, chain driver
+>92 belong & 1024 \b, mount at startup
+>92 belong & 2048 \b, is the startup partition

0 comments on commit 918400e

Please sign in to comment.
Something went wrong with that request. Please try again.