apple partition improvements, Joerg Jenderek

1 files changed, 108 insertions, 39 deletions

diff --git a/magic/Magdir/apple b/magic/Magdir/apple
index fb4a4afc..ce03298f 100644
--- a/magic/Magdir/apple
+++ b/magic/Magdir/apple
@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: apple,v 1.34 2016/07/18 19:23:38 christos Exp $
+# $File: apple,v 1.35 2016/08/17 09:45:13 christos Exp $
 # apple:  file(1) magic for Apple file formats
 #
 0	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
@@ -285,47 +285,116 @@
 # .vdi
 4	string innotek\ VirtualBox\ Disk\ Image %s
 
-# Apple disk partition stuff, strengthen the magic using byte 4
+# Apple disk partition stuff
+# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
+# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
+# Update: Joerg Jenderek 
+# "ER" is APPLE_DRVR_MAP_MAGIC signature
 0	beshort	0x4552
->4	byte	0			Apple Driver Map
+# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
+#!:strength +0
+# strengthen the magic by looking for used blocksizes 512 2048
+>2	ubeshort&0xf1FF		0	Apple Driver Map
+# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
+#>>504	ubequad&0x0000FFffFFff0000	0
+!:mime	application/x-apple-diskimage
+!:apple	????devr
+# https://en.wikipedia.org/wiki/Apple_Disk_Image
+!:ext	dmg/iso
+# sbBlkSize for driver descriptor map 512 2048
 >>2	beshort	x			\b, blocksize %d
->>4	belong	x			\b, blockcount %d
->>10	beshort	x			\b, devtype %d
->>12	beshort	x			\b, devid %d
->>20	beshort x			\b, descriptors %d
-# Assume 	8 partitions each at a multiple of the sector size.
-# We could glean this from the partition descriptors, but they are empty!?!?
->>(2.S*1)	indirect	x	\b, contains[@0x%x]: 
->>(2.S*2)	indirect	x	\b, contains[@0x%x]: 
->>(2.S*3)	indirect	x	\b, contains[@0x%x]: 
->>(2.S*4)	indirect	x	\b, contains[@0x%x]: 
->>(2.S*5)	indirect	x	\b, contains[@0x%x]: 
->>(2.S*6)	indirect	x	\b, contains[@0x%x]: 
->>(2.S*7)	indirect	x	\b, contains[@0x%x]: 
->>(2.S*8)	indirect	x	\b, contains[@0x%x]: 
-
-# Yes, the 3rd and 4th bytes are reserved, but we use them to make the
+# sbBlkCount sometimes garbish like
+# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
+# 0xf2720100 for bunziped Firefox 48.0-2.dmg
+# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
+# 0x00009090 by syslinux-6.03/utils/isohybrid.c
+>>4	ubelong	x			\b, blockcount %u
+# following device/driver information not very useful
+# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
+>>8	ubeshort	x		\b, devtype %u
+# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
+>>10	ubeshort	x		\b, devid %u
+# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
+>>12	ubelong		>0		
+>>>12	ubelong		x		\b, driver data %u
+# number of driver descriptors sbDrvrCount <= 61
+# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
+>>16	ubeshort	x		\b, driver count %u
+# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
+# >>18	use		apple-driver-map
+# >>26	use		apple-driver-map
+# # ...
+# >>500	use		apple-driver-map
+# number of partitions is always same in every partition (map block count)
+#>>0x0204	ubelong		x	\b, %u partitions
+>>0x0204	ubelong		>0	\b, contains[@0x200]: 
+>>>0x0200	use		apple-apm
+>>0x0204	ubelong		>1	\b, contains[@0x400]: 
+>>>0x0400	use		apple-apm
+>>0x0204	ubelong		>2	\b, contains[@0x600]: 
+>>>0x0600	use		apple-apm
+>>0x0204	ubelong		>3	\b, contains[@0x800]: 
+>>>0x0800	use		apple-apm
+>>0x0204	ubelong		>4	\b, contains[@0xA00]: 
+>>>0x0A00	use		apple-apm
+>>0x0204	ubelong		>5	\b, contains[@0xC00]: 
+>>>0x0C00	use		apple-apm
+>>0x0204	ubelong		>6	\b, contains[@0xE00]: 
+>>>0x0E00	use		apple-apm
+>>0x0204	ubelong		>7	\b, contains[@0x1000]: 
+>>>0x1000	use		apple-apm
+#	display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
+0	name				apple-driver-map
+>0	ubequad		!0		
+# descBlock first block of driver 
+>>0	ubelong	x			\b, driver start block %u
+# descSize driver size in blocks
+>>4	ubeshort	x		\b, size %u
+# descType driver system type 1 701h F8FFh FFFFh
+>>6	ubeshort	x		\b, type 0x%x
+
+# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
+# Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
+# Update: Joerg Jenderek 
+# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
 # magic stronger.
-0	belong	0x504d0000		Apple Partition Map
->4	belong	x			\b, map block count %d
->8	belong	x			\b, start block %d
->12	belong	x			\b, block count %d
->16	string >0			\b, name %s
->48	string >0			\b, type %s
->124	string >0			\b, processor %s
->140	string >0			\b, boot arguments %s
->92	belong	& 1			\b, valid
->92	belong	& 2			\b, allocated
->92	belong	& 4			\b, in use
->92	belong	& 8			\b, has boot info
->92	belong	& 16			\b, readable
->92	belong	& 32			\b, writable
->92	belong	& 64			\b, pic boot code
->92	belong	& 128			\b, chain compatible driver
->92	belong	& 256			\b, real driver
->92	belong	& 512			\b, chain driver
->92	belong	& 1024			\b, mount at startup
->92	belong	& 2048			\b, is the startup partition
+# for apple partition map stored as a single file
+0	belong	0x504d0000		
+# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
+#!:strength +0
+>0	use		apple-apm
+# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
+# file: could not find any valid magic files!
+#!:ext	bin
+#	display apple partition map. Normally called after Apple driver map
+0	name				apple-apm
+>0	belong	0x504d0000		Apple Partition Map
+# number of partitions
+>>4	ubelong	x			\b, map block count %u
+# logical block (512 bytes) start of partition
+>>8	ubelong	x			\b, start block %u
+>>12	ubelong	x			\b, block count %u
+>>16	string >0			\b, name %s
+>>48	string >0			\b, type %s
+# processor type dpme_process_id[16] e.g. "68000" "68020"
+>>120	string >0			\b, processor %s
+# A/UX boot arguments BootArgs[128]
+>>136	string >0			\b, boot arguments %s
+# status of partition dpme_flags
+>>88	belong	& 1			\b, valid
+>>88	belong	& 2			\b, allocated
+>>88	belong	& 4			\b, in use
+>>88	belong	& 8			\b, has boot info
+>>88	belong	& 16			\b, readable
+>>88	belong	& 32			\b, writable
+>>88	belong	& 64			\b, pic boot code
+>>88	belong	& 128			\b, chain compatible driver
+>>88	belong	& 256			\b, real driver
+>>88	belong	& 512			\b, chain driver
+# mount automatically at startup APPLE_PS_AUTO_MOUNT
+>>88	ubelong	&0x40000000		\b, mount at startup
+# is the startup partition APPLE_PS_STARTUP
+>>88	ubelong	&0x80000000		\b, is the startup partition
 
 #http://wiki.mozilla.org/DS_Store_File_Format
 #http://en.wikipedia.org/wiki/.DS_Store