Apple on-disk formats.

file · Apr 6, 2012 · 918400e · 918400e
1 parent 0de3251
commit 918400e
Showing 1 changed file with 43 additions and 1 deletion.
diff --git a/magic/Magdir/apple b/magic/Magdir/apple
@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: apple,v 1.23 2009/09/19 16:28:08 christos Exp $
+# $File: apple,v 1.24 2010/11/25 15:00:12 christos Exp $
 # apple:  file(1) magic for Apple file formats
 #
 0	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
@@ -249,3 +249,45 @@
 # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
 # .vdi
 4	string innotek\ VirtualBox\ Disk\ Image %s
+
+# Apple disk partition stuff, strengthen the magic using byte 4
+0	beshort	0x4552
+>4	byte	0			Apple Driver Map
+>>2	beshort	x			\b, blocksize %d
+>>4	belong	x			\b, blockcount %d
+>>10	beshort	x			\b, devtype %d
+>>12	beshort	x			\b, devid %d
+>>20	beshort x			\b, descriptors %d
+# Assume 	8 partitions each at a multiple of the sector size.
+# We could glean this from the partition descriptors, but they are empty!?!?
+>>(2.S*1)	indirect		\b, contains[@0x%x]: 
+>>(2.S*2)	indirect		\b, contains[@0x%x]: 
+>>(2.S*3)	indirect		\b, contains[@0x%x]: 
+>>(2.S*4)	indirect		\b, contains[@0x%x]: 
+>>(2.S*5)	indirect		\b, contains[@0x%x]: 
+>>(2.S*6)	indirect		\b, contains[@0x%x]: 
+>>(2.S*7)	indirect		\b, contains[@0x%x]: 
+>>(2.S*8)	indirect		\b, contains[@0x%x]: 
+
+# Yes, the 3rd and 4th bytes are reserved, but we use them to make the
+# magic stronger.
+0	belong	0x504d0000		Apple Partition Map
+>4	belong	x			\b, map block count %d
+>8	belong	x			\b, start block %d
+>12	belong	x			\b, block count %d
+>16	string >0			\b, name %s
+>48	string >0			\b, type %s
+>124	string >0			\b, processor %s
+>140	string >0			\b, boot arguments %s
+>92	belong	& 1			\b, valid
+>92	belong	& 2			\b, allocated
+>92	belong	& 4			\b, in use
+>92	belong	& 8			\b, has boot info
+>92	belong	& 16			\b, readable
+>92	belong	& 32			\b, writable
+>92	belong	& 64			\b, pic boot code
+>92	belong	& 128			\b, chain compatible driver
+>92	belong	& 256			\b, real driver
+>92	belong	& 512			\b, chain driver
+>92	belong	& 1024			\b, mount at startup
+>92	belong	& 2048			\b, is the startup partition