Imported Upstream version 0.4.5
[packages/binwalk.git] / src / magic / magic.filesystems
1 #--------------------File Systems---------------------
2
3 # Minix filesystems - Juan Cespedes <cespedes@debian.org>
4 # Disabled for now until better signatures can be created. Too many false positives.
5 #0x410   leshort         0x137f          Minix filesystem
6 #>0x402  beshort         !0              \b, %d zones
7 #>0x1e   string          minix           \b, bootable
8 #0x410   leshort         0x138f          Minix filesystem, 30 char names
9 #0x410   leshort         0x2468          Minix filesystem, version 2
10 #0x410   leshort         0x2478          Minix filesystem, version 2, 30 char names
11
12 #0x410   beshort         0x137f          Minix filesystem (big endian)
13 #>0x402  beshort         !0              \b, %d zones
14 #>0x1e   string          minix           \b, bootable
15 #0x410   beshort         0x138f          Minix filesystem (big endian), 30 char names
16 #0x410   beshort         0x2468          Minix filesystem (big endian), version 2
17 #0x410   beshort         0x2478          Minix filesystem (big endian), version 2, 30 char names
18
19 # YAFFS
20 0       belong  0x03000000
21 >4      belong  0x01000000
22 >>8     beshort 0xFFFF          YAFFS filesystem
23
24 # EFS2 file system - jojo@utulsa.edu
25 8       string EFSSuper         EFS2 Qualcomm filesystem super block,
26 >0      lelong 0x53000000       little endian,
27 >>4     leshort &1              NAND
28 >>4     leshort ^1              NOR
29 >>4     leshort x               version 0x%x,
30 >>24    lelong  x               %d blocks,
31 >>16    lelong  x               0x%x pages per block,
32 >>20    lelong  x               0x%x bytes per page
33
34 8       string SSFErepu         EFS2 Qualcomm filesystem super block,
35 >0      belong 0x53000000       big endian,
36 >>4     beshort &1              NAND
37 >>4     beshort ^1              NOR
38 >>4     beshort x               version 0x%x,
39 >>24    belong  x               %d blocks,
40 >>16    belong  x               0x%x pages per block,
41 >>20    belong  x               0x%x bytes per page
42
43 # TROC file system
44 0       string  TROC            TROC filesystem,
45 >4      lelong  x               %d file entries
46
47 # PFS file system
48 0       string  PFS/            PFS filesystem,
49 >4      string  x               version %s,
50 >14     leshort x               %d files
51
52 # MPFS file system
53 0       string  MPFS            MPFS (Microchip) filesystem,
54 >4      byte    x               version %d.
55 >5      byte    x               \b%d,
56 >6      leshort x               %d file entries
57
58 # cramfs filesystem - russell@coker.com.au
59 0       lelong  0x28cd3d45      CramFS filesystem, little endian
60 >4      lelong  <0              invalid
61 >4      lelong  x               size %lu
62 >8      lelong  &1              version #2
63 >8      lelong  &2              sorted_dirs
64 >8      lelong  &4              hole_support
65 >32     lelong  x               CRC 0x%x,
66 >36     lelong  x               edition %lu,
67 >40     lelong  <0              invalid
68 >40     lelong  x               %lu blocks,
69 >44     lelong  <0              invalid
70 >44     lelong  x               %lu files
71
72 0       belong  0x28cd3d45      CramFS filesystem, big endian
73 >4      belong  <0              invalid
74 >4      belong  x               size %lu
75 >8      belong  &1              version #2
76 >8      belong  &2              sorted_dirs
77 >8      belong  &4              hole_support
78 >32     belong  x               CRC 0x%x,
79 >36     belong  x               edition %lu,
80 >40     belong  <0              invalid
81 >40     belong  x               %lu blocks,
82 >44     belong  <0              invalid
83 >44     belong  x               %lu files
84
85
86
87 # JFFS2 file system
88 0       leshort 0x1984          JFFS2 filesystem (old) data little endian,
89 >4      lelong  >1000000        invalid
90 >4      lelong  <0              invalid
91 >4      lelong  0               invalid
92 >4      lelong  x               JFFS node length: %d
93
94 0       beshort 0x1984          JFFS2 filesystem (old) data big endian,
95 >4      belong  >1000000        invalid
96 >4      belong  <0              invalid
97 >4      belong  0               invalid
98 >4      belong  x               JFFS node length: %d
99
100 0       leshort 0x1985          JFFS2 filesystem data little endian,
101 >4      lelong  >1000000        invalid
102 >4      lelong  <0              invalid
103 >4      lelong  0               invalid
104 >4      lelong  x               JFFS node length: %d
105
106 0       beshort 0x1985          JFFS2 filesystem data big endian,
107 >4      belong  >1000000        invalid
108 >4      belong  <0              invalid
109 >4      belong  0               invalid
110 >4      belong  x               JFFS node length: %d
111
112
113 # Squashfs
114 0       string  sqsh    Squashfs filesystem, big endian,
115 >28     beshort >10     invalid
116 >28     beshort <1      invalid
117 >28     beshort x       version %d.
118 >30     beshort x       \b%d,
119 >28     beshort >3      compression:
120 >>20    beshort 1       \bgzip,
121 >>20    beshort 2       \blzma,
122 >28     beshort <3
123 >>8     belong  x       size: %d bytes,
124 >28     beshort 3
125 >>63    bequad x        size: %lld bytes,
126 >28     beshort >3
127 >>40    bequad  x       size: %lld bytes,
128 >4      belong  x       %d inodes,
129 >28     beshort >3
130 >>12    belong          blocksize: %d bytes,
131 >28     beshort <2
132 >>32    beshort x       blocksize: %d bytes,
133 >28     beshort 2
134 >>51    belong  x       blocksize: %d bytes,
135 >28     beshort 3
136 >>51    belong  x       blocksize: %d bytes,
137 >28     beshort >3
138 >>12    belong  x       blocksize: %d bytes,
139 >28     beshort <4
140 >>39    bedate  x       created: %s
141 >28     beshort >3
142 >>8     bedate x        created: %s
143
144 0       string  hsqs    Squashfs filesystem, little endian,
145 >28     leshort >10     invalid
146 >28     leshort <1      invalid
147 >28     leshort x       version %d.
148 >30     leshort x       \b%d,
149 >28     leshort >3      compression: 
150 >>20    leshort 1       \bgzip,
151 >>20    leshort 2       \blzma,
152 >28     leshort <3
153 >>8     lelong  x       size: %d bytes,
154 >28     leshort 3
155 >>63    lequad x        size: %lld bytes,
156 >28     leshort >3      
157 >>40    lequad  x       size: %lld bytes,
158 >4      lelong  x       %d inodes,
159 >28     leshort >3
160 >>12    lelong          blocksize: %d bytes,
161 >28     leshort <2
162 >>32    leshort x       blocksize: %d bytes,
163 >28     leshort 2
164 >>51    lelong  x       blocksize: %d bytes,
165 >28     leshort 3
166 >>51    lelong  x       blocksize: %d bytes,
167 >28     leshort >3      
168 >>12    lelong  x       blocksize: %d bytes,
169 >28     leshort <4
170 >>39    ledate  x       created: %s
171 >28     leshort >3
172 >>8     ledate x        created: %s
173
174 # Squashfs with LZMA compression
175 0       string  sqlz    Squashfs filesystem, big endian, lzma compression, 
176 >28     beshort >10     invalid
177 >28     beshort <1      invalid
178 >28     beshort x       version %d.
179 >30     beshort x       \b%d,
180 >28     beshort <3
181 >>8     belong  x       size: %d bytes,
182 >28     beshort >2
183 >>63    bequad x        size: %lld bytes,
184 #>>67   belong  x       %d bytes,
185 >4      belong  x       %d inodes,
186 >28     beshort <2
187 >>32    beshort x       blocksize: %d bytes,
188 >28     beshort >1
189 >>51    belong  x       blocksize: %d bytes,
190 >39     bedate  x       created: %s
191
192 # Squashfs 3.3 LZMA signature
193 0       string  qshs    Squashfs filesystem, big endian, lzma signature,
194 >28     beshort >10     invalid
195 >28     beshort <1      invalid
196 >28     beshort x       version %d.
197 >30     beshort x       \b%d,
198 >28     beshort <3
199 >>8     belong  x       size: %d bytes,
200 >28     beshort >2
201 >>63    bequad x        size: %lld bytes,
202 #>>67   belong  x       %d bytes,
203 >4      belong  x       %d inodes,
204 >28     beshort <2
205 >>32    beshort x       blocksize: %d bytes,
206 >28     beshort >1
207 >>51    belong  x       blocksize: %d bytes,
208 >39     bedate  x       created: %s
209
210 # Squashfs for DD-WRT
211 0       string  tqsh    Squashfs filesystem, big endian, DD-WRT signature,
212 >28     beshort >10     invalid
213 >28     beshort <1      invalid
214 >28     beshort x       version %d.
215 >30     beshort x       \b%d,
216 >28     beshort <3
217 >>8     belong  x       size: %d bytes,
218 >28     beshort >2
219 >>63    bequad x        size: %lld bytes,
220 #>>67   belong  x       %d bytes,
221 >4      belong  x       %d inodes,
222 >28     beshort <2
223 >>32    beshort x       blocksize: %d bytes,
224 >28     beshort >1
225 >>51    belong  x       blocksize: %d bytes,
226 >39     bedate  x       created: %s
227
228 # Squashfs for DD-WRT
229 0       string  hsqt    Squashfs filesystem, little endian, DD-WRT signature,
230 >28     leshort >10     invalid
231 >28     leshort <1      invalid
232 >28     leshort x       version %d.
233 >30     leshort x       \b%d,
234 >28     leshort <3
235 >>8     lelong  x       size: %d bytes,
236 >28     leshort >2
237 >>63    lequad x        size: %lld bytes,
238 #>>63   lelong  x       %d bytes,
239 >4      lelong  x       %d inodes,
240 >28     leshort <2
241 >>32    leshort x       blocksize: %d bytes,
242 >28     leshort >1
243 >>51    lelong  x       blocksize: %d bytes,
244 >39     ledate  x       created: %s
245
246 # Non-standard Squashfs signature found on some D-Link routers
247 0       string  shsq    Squashfs filesystem, little endian, non-standard signature, 
248 >28     leshort >10     invalid
249 >28     leshort <1      invalid
250 >28     leshort x       version %d.
251 >30     leshort x       \b%d,
252 >28     leshort <3
253 >>8     lelong  x       size: %d bytes,
254 >28     leshort >2
255 >>63    lequad x        size: %lld bytes,
256 #>>63   lelong  x       %d bytes,
257 >4      lelong  x       %d inodes,
258 >28     leshort <2
259 >>32    leshort x       blocksize: %d bytes,
260 >28     leshort >1
261 >>51    lelong  x       blocksize: %d bytes,
262 >39     ledate  x       created: %s
263
264 # Commented out for now - unlikely to be found in firmware
265 # CDROM Filesystems
266 # Modified for UDF by gerardo.cacciari@gmail.com
267 #32769   string    CD001     #
268 #!:mime  application/x-iso9660-image
269 #>38913  string   !NSR0      ISO 9660 CD-ROM filesystem data
270 #>38913  string    NSR0      UDF filesystem data
271 #>>38917 string    1         (version 1.0)
272 #>>38917 string    2         (version 1.5)
273 #>>38917 string    3         (version 2.0)
274 #>>38917 byte     >0x33      (unknown version, ID 0x%X)
275 #>>38917 byte     <0x31      (unknown version, ID 0x%X)
276 # "application id" which appears to be used as a volume label
277 #>32808  string    >\0       '%s'
278 #>34816  string    \000CD001\001EL\x20TORITO\x20SPECIFICATION    (bootable)
279 #37633   string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
280 #!:mime  application/x-iso9660-image
281 #32776   string    CDROM     High Sierra CD-ROM filesystem data
282
283 # reiserfs - russell@coker.com.au
284 0x10034         string  ReIsErFs        ReiserFS filesystem V3.5
285 0x10034         string  ReIsEr2Fs       ReiserFS filesystem V3.6
286 0x10034         string  ReIsEr3Fs       ReiserFS filesystem V3.6.19
287 >0x1002c        leshort x               block size %d
288 >0x10032        leshort &2              (mounted or unclean)
289 >0x10000        lelong  x               num blocks %d
290 >0x10040        lelong  1               tea hash
291 >0x10040        lelong  2               yura hash
292 >0x10040        lelong  3               r5 hash
293
294
295 # ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
296 # ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
297 # volume label and UUID Russell Coker
298 # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
299 0x438   leshort         0xEF53          Linux EXT filesystem
300 >0x44c  lelong          <0              invalid
301 >0x44c  lelong          >4              invalid
302 >0x44c  lelong          x               rev %d
303 >0x43e  leshort         x               \b.%d
304 # No journal?  ext2
305 >0x45c  lelong          ^0x0000004      ext2 filesystem data
306 >>0x43a leshort         ^0x0000001      (mounted or unclean)
307 # Has a journal?  ext3 or ext4
308 >0x45c  lelong          &0x0000004
309 #  and small INCOMPAT?
310 >>0x460 lelong          <0x0000040
311 #   and small RO_COMPAT?
312 >>>0x464 lelong         <0x0000008      ext3 filesystem data
313 #   else large RO_COMPAT?
314 >>>0x464 lelong         >0x0000007      ext4 filesystem data
315 #  else large INCOMPAT?
316 >>0x460 lelong          >0x000003f      ext4 filesystem data
317 >0x468  belong          x               \b, UUID=%08x
318 >0x46c  beshort         x               \b-%04x
319 >0x46e  beshort         x               \b-%04x
320 >0x470  beshort         x               \b-%04x
321 >0x472  belong          x               \b-%08x
322 >0x476  beshort         x               \b%04x
323 >0x478  string          >0              \b, volume name "%s"
324 # General flags for any ext* fs
325 >0x460  lelong          &0x0000004      (needs journal recovery)
326 >0x43a  leshort         &0x0000002      (errors, invalid)
327 # INCOMPAT flags
328 >0x460  lelong          &0x0000001      (compressed)
329 #>0x460 lelong          &0x0000002      (filetype)
330 #>0x460 lelong          &0x0000010      (meta bg)
331 >0x460  lelong          &0x0000040      (extents)
332 >0x460  lelong          &0x0000080      (64bit)
333 #>0x460 lelong          &0x0000100      (mmp)
334 #>0x460 lelong          &0x0000200      (flex bg)
335 # RO_INCOMPAT flags
336 #>0x464 lelong          &0x0000001      (sparse super)
337 >0x464  lelong          &0x0000002      (large files)
338 >0x464  lelong          &0x0000008      (huge files)
339 #>0x464 lelong          &0x0000010      (gdt checksum)
340
341
342 #romfs filesystems - Juan Cespedes <cespedes@debian.org>
343 0       string          -rom1fs-        romfs filesystem, version 1
344 >8      belong  >10000000               invalid
345 >8      belong  x                       size: %d bytes,
346 >16     string  x                       named %s.
347
348 # JFFS - russell@coker.com.au           
349 0       lelong  0x34383931      Linux Journalled Flash filesystem, little endian
350 0       belong  0x34383931      Linux Journalled Flash filesystem, big endian
351
352 # Wind River MemFS file system, found in some VxWorks devices
353 0       string  owowowowowowowowowowowowowowow          Wind River management filesystem,
354 >32     belong  0                                       uncompressed
355 >32     belong  1                                       compressed,
356 >36     belong  x                                       %d files
357
358
359 # FATX 
360 0               string          FATX            FATX filesystem data
361
362
363
364
365
366 # updated by Joerg Jenderek at Sep 2007
367 # only for sector sizes with 512 or more Bytes
368 0x1FE   leshort 0xAA55                  start boot sector
369 # to do also for sectors < than 512 Bytes and some other files, GRR
370 #30     search/481      \x55\xAA        start boot sector / filesystem
371 # not for BeOS floppy 1440k, MBRs
372 #(11.s-2) uleshort      0xAA55          start boot sector / filesystem
373 >2      string  OSBS                    \b, OS/BS MBR
374 # J\xf6rg Jenderek <joerg dot jenderek at web dot de>
375 >0x8C   string  Invalid\x20partition\x20table   \b, MS-DOS MBR
376 # dr-dos with some upper-, lowercase variants
377 >0x9D   string  Invalid\x20partition\x20table$  
378 >>181   string  No\x20Operating\x20System$              
379 >>>201  string  Operating\x20System\x20load\x20error$   \b, DR-DOS MBR, Version 7.01 to 7.03
380 >0x9D   string  Invalid\x20partition\x20table$  
381 >>181   string  No\x20operating\x20system$              
382 >>>201  string  Operating\x20system\x20load\x20error$   \b, DR-DOS MBR, Version 7.01 to 7.03
383 >342    string  Invalid\x20partition\x20table$  
384 >>366   string  No\x20operating\x20system$              
385 >>>386  string  Operating\x20system\x20load\x20error$   \b, DR-DOS MBR, version 7.01 to 7.03
386 >295    string  NEWLDR\0                                
387 >>302   string  Bad\x20PT\x20$                          
388 >>>310  string  No\x20OS\x20$                           
389 >>>>317 string  OS\x20load\x20err$                              
390 >>>>>329        string  Moved\x20or\x20missing\x20IBMBIO.LDR\n\r        
391 >>>>>>358       string  Press\x20any\x20key\x20to\x20continue.\n\r$     
392 >>>>>>>387      string  Copyright\x20(c)\x201984,1998   
393 >>>>>>>>411     string  Caldera\x20Inc.\0               \b, DR-DOS MBR (IBMBIO.LDR)
394 >0x10F  string  Ung\201ltige\x20Partitionstabelle       \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
395 >>0x1B8 ubelong >0                              \b, Serial 0x%-.4x
396 >0x8B   string  Ung\201ltige\x20Partitionstabelle       \b, MS-DOS MBR, german version 5.00 to 4.00.950
397 >271    string  Invalid\x20partition\x20table\0         
398 >>295   string  Error\x20loading\x20operating\x20system\0       
399 >>>326  string  Missing\x20operating\x20system\0                \b, mbr
400 #
401 >139    string  Invalid\x20partition\x20table\0         
402 >>163   string  Error\x20loading\x20operating\x20system\0       
403 >>>194  string  Missing\x20operating\x20system\0                \b, Microsoft Windows XP mbr
404 # http://www.heise.de/ct/05/09/006/ page 184
405 #HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes
406 >>>>0x1B8       ulelong >0                              \b,Serial 0x%-.4x
407 >300    string  Invalid\x20partition\x20table\0 
408 >>324   string  Error\x20loading\x20operating\x20system\0
409 >>>355  string  Missing\x20operating\x20system\0                \b, Microsoft Windows XP MBR
410 #??>>>389       string  Invalid\x20system\x20disk               
411 >>>>0x1B8       ulelong >0                              \b, Serial 0x%-.4x
412 >300    string  Ung\201ltige\x20Partitionstabelle
413 #split string to avoid error: String too long
414 >>328   string  Fehler\x20beim\x20Laden\x20     
415 >>>346  string  des\x20Betriebssystems  
416 >>>>366 string  Betriebssystem\x20nicht\x20vorhanden    \b, Microsoft Windows XP MBR (german)
417 >>>>>0x1B8      ulelong >0                              \b, Serial 0x%-.4x
418 #>0x145 string  Default:\x20F                           \b, FREE-DOS MBR
419 #>0x14B string  Default:\x20F                           \b, FREE-DOS 1.0 MBR
420 >0x145  search/7        Default:\x20F                   \b, FREE-DOS MBR
421 #>>313          string  F0\x20.\x20.\x20.                       
422 #>>>322         string  disk\x201                               
423 #>>>>382        string  FAT3                            
424 >64     string  no\x20active\x20partition\x20found      
425 >>96    string  read\x20error\x20while\x20reading\x20drive      \b, FREE-DOS Beta 0.9 MBR
426 # Ranish Partition Manager http://www.ranish.com/part/
427 >387    search/4        \0\x20Error!\r                  
428 >>378   search/7        Virus!                          
429 >>>397  search/4        Booting\x20                     
430 >>>>408 search/4        HD1/\0                          \b, Ranish MBR (
431 >>>>>416        string  Writing\x20changes...           \b2.37
432 >>>>>>438       ubyte           x                       \b,0x%x dots
433 >>>>>>440       ubyte           >0                      \b,virus check
434 >>>>>>441       ubyte           >0                      \b,partition %c
435 #2.38,2.42,2.44
436 >>>>>416        string  !Writing\x20changes...          \b
437 >>>>>>418       ubyte   1                               \bvirus check,
438 >>>>>>419       ubyte   x                               \b0x%x seconds
439 >>>>>>420       ubyte&0x0F      >0                      \b,partition
440 >>>>>>>420      ubyte&0x0F      <5                      \b %x
441 >>>>>>>420      ubyte&0x0F      0Xf                     \b ask
442 >>>>>420        ubyte           x                       \b)
443 #
444 >271    string  Operating\x20system\x20loading          
445 >>296   string  error\r                                 \b, SYSLINUX MBR (2.10)
446 # http://www.acronis.de/
447 >362    string  MBR\x20Error\x20\0\r                    
448 >>376   string  ress\x20any\x20key\x20to\x20                    
449 >>>392  string  boot\x20from\x20floppy...\0                     \b, Acronis MBR
450 # added by Joerg Jenderek
451 # http://www.visopsys.org/
452 # http://partitionlogic.org.uk/
453 >309    string  No\x20bootable\x20partition\x20found\r  
454 >>339   string  I/O\x20Error\x20reading\x20boot\x20sector\r     \b, Visopsys MBR
455 >349    string  No\x20bootable\x20partition\x20found\r  
456 >>379   string  I/O\x20Error\x20reading\x20boot\x20sector\r     \b, simple Visopsys MBR
457 # bootloader, bootmanager
458 >0x40   string  SBML                            
459 # label with 11 characters of FAT 12 bit filesystem
460 >>43    string  SMART\x20BTMGR                  
461 >>>430  string  SBMK\x20Bad!\r                  \b, Smart Boot Manager
462 # OEM-ID not always "SBM"
463 #>>>>3  strings SBM                             
464 >>>>6   string  >\0                             \b, version %s
465 >382    string  XOSLLOADXCF                     \b, eXtended Operating System Loader
466 >6      string  LILO                            \b, LInux i386 boot LOader
467 >>120   string  LILO                            \b, version 22.3.4 SuSe
468 >>172   string  LILO                            \b, version 22.5.8 Debian
469 # updated by Joerg Jenderek at Oct 2008
470 # variables according to grub-0.97/stage1/stage1.S or
471 # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
472 # usual values are marked with comments to get only informations of strange GRUB loaders
473 >342            search/60       \0Geom\0        
474 #>0             ulelong         x               %x=0x009048EB , 0x2a9048EB  0
475 >>0x41          ubyte           <2              
476 >>>0x3E         ubyte           >2              \b; GRand Unified Bootloader
477 # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 
478 >>>>0x3E        ubyte           x               \b, stage1 version 0x%x
479 #If it is 0xFF, use a drive passed by BIOS
480 >>>>0x40        ubyte           <0xFF           \b, boot drive 0x%x
481 # in most case 0,1,0x2e for GRUB 0.5.95
482 >>>>0x41        ubyte           >0              \b, LBA flag 0x%x
483 >>>>0x42        uleshort        <0x8000         \b, stage2 address 0x%x
484 #>>>>0x42       uleshort        =0x8000         \b, stage2 address 0x%x (usual)
485 >>>>0x42        uleshort        >0x8000         \b, stage2 address 0x%x
486 #>>>>0x44       ulelong         =1              \b, 1st sector stage2 0x%x (default)
487 >>>>0x44        ulelong         >1              \b, 1st sector stage2 0x%x
488 >>>>0x48        uleshort        <0x800          \b, stage2 segment 0x%x
489 #>>>>0x48       uleshort        =0x800          \b, stage2 segment 0x%x (usual)
490 >>>>0x48        uleshort        >0x800          \b, stage2 segment 0x%x
491 >>>>402         string  Geom\0Hard\x20Disk\0Read\0\x20Error\0
492 >>>>>394        string  stage1                  \b, GRUB version 0.5.95
493 >>>>382         string  Geom\0Hard\x20Disk\0Read\0\x20Error\0
494 >>>>>376        string  GRUB\x20\0              \b, GRUB version 0.93 or 1.94
495 >>>>383         string  Geom\0Hard\x20Disk\0Read\0\x20Error\0
496 >>>>>377        string  GRUB\x20\0              \b, GRUB version 0.94
497 >>>>385         string  Geom\0Hard\x20Disk\0Read\0\x20Error\0
498 >>>>>379        string  GRUB\x20\0              \b, GRUB version 0.95 or 0.96
499 >>>>391         string  Geom\0Hard\x20Disk\0Read\0\x20Error\0
500 >>>>>385        string  GRUB\x20\0              \b, GRUB version 0.97
501 #unkown version
502 >>>343          string  Geom\0Read\0\x20Error\0 
503 >>>>321         string  Loading\x20stage1.5     \b, GRUB version x.y
504 >>>380          string  Geom\0Hard\x20Disk\0Read\0\x20Error\0
505 >>>>374         string  GRUB\x20\0              \b, GRUB version n.m
506 # http://syslinux.zytor.com/
507 >478    string  Boot\x20failed\r                        
508 >>495   string  LDLINUX\x20SYS                  \b, SYSLINUX bootloader (1.62)
509 >480    string  Boot\x20failed\r                        
510 >>495   string  LDLINUX\x20SYS                  \b, SYSLINUX bootloader (2.06 or 2.11)
511 >484    string  Boot\x20error\r                 \b, SYSLINUX bootloader (3.11)
512 >395    string  chksum\0\x20ERROR!\0            \b, Gujin bootloader
513 # http://www.bcdwb.de/bcdw/index_e.htm
514 >3      string  BCDL                            
515 >>498   string  BCDL\x20\x20\x20\x20BIN                 \b, Bootable CD Loader (1.50Z)
516 # mbr partion table entries
517 # OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs
518 >3                      string          !MS
519 >>3                     string          !SYSLINUX
520 >>>3                    string          !MTOOL
521 >>>>3                   string          !NEWLDR
522 >>>>>5                  string          !DOS
523 # not FAT (32 bit)
524 >>>>>>82                string          !FAT32
525 #not Linux kernel
526 >>>>>>>514              string          !HdrS
527 #not BeOS
528 >>>>>>>>422             string          !Be\x20Boot\x20Loader
529 # active flag 0 or 0x80 and type > 0
530 >>>>>>>>>446            ubyte           <0x81   
531 >>>>>>>>>>446           ubyte&0x7F      0       
532 >>>>>>>>>>>450          ubyte           >0      \b; partition 1: ID=0x%x
533 >>>>>>>>>>>>446         ubyte           0x80    \b, active
534 >>>>>>>>>>>>447         ubyte           x       \b, starthead %u
535 #>>>>>>>>>>>>448                ubyte           x       \b, start C_S: 0x%x
536 #>>>>>>>>>>>>448                ubeshort&1023   x       \b, startcylinder? %d
537 >>>>>>>>>>>>454         ulelong         x       \b, startsector %u
538 >>>>>>>>>>>>458         ulelong         x       \b, %u sectors
539 #
540 >>>>>>>>>462            ubyte           <0x81   
541 >>>>>>>>>>462           ubyte&0x7F      0               
542 >>>>>>>>>>>466          ubyte           >0      \b; partition 2: ID=0x%x
543 >>>>>>>>>>>>462         ubyte           0x80    \b, active
544 >>>>>>>>>>>>463         ubyte           x       \b, starthead %u
545 #>>>>>>>>>>>>464                ubyte           x       \b, start C_S: 0x%x
546 #>>>>>>>>>>>>464                ubeshort&1023   x       \b, startcylinder? %d
547 >>>>>>>>>>>>470         ulelong         x       \b, startsector %u
548 >>>>>>>>>>>>474         ulelong         x       \b, %u sectors
549 #
550 >>>>>>>>>478            ubyte           <0x81           
551 >>>>>>>>>>478           ubyte&0x7F      0               
552 >>>>>>>>>>>482          ubyte           >0      \b; partition 3: ID=0x%x
553 >>>>>>>>>>>>478         ubyte           0x80    \b, active
554 >>>>>>>>>>>>479         ubyte           x       \b, starthead %u
555 #>>>>>>>>>>>>480                ubyte           x       \b, start C_S: 0x%x
556 #>>>>>>>>>>>>481                ubyte           x       \b, start C2S: 0x%x
557 #>>>>>>>>>>>>480                ubeshort&1023   x       \b, startcylinder? %d
558 >>>>>>>>>>>>486         ulelong         x       \b, startsector %u
559 >>>>>>>>>>>>490         ulelong         x       \b, %u sectors
560 #
561 >>>>>>>>>494            ubyte           <0x81   
562 >>>>>>>>>>494           ubyte&0x7F      0               
563 >>>>>>>>>>>498          ubyte           >0      \b; partition 4: ID=0x%x
564 >>>>>>>>>>>>494         ubyte           0x80    \b, active
565 >>>>>>>>>>>>495         ubyte           x       \b, starthead %u
566 #>>>>>>>>>>>>496                ubyte           x       \b, start C_S: 0x%x
567 #>>>>>>>>>>>>496                ubeshort&1023   x       \b, startcylinder? %d
568 >>>>>>>>>>>>502         ulelong         x       \b, startsector %u
569 >>>>>>>>>>>>506         ulelong         x       \b, %u sectors
570 # mbr partion table entries end
571 # http://www.acronis.de/
572 #FAT label=ACRONIS\x20SZ
573 #OEM-ID=BOOTWIZ0
574 >442    string  Non-system\x20disk,\x20 
575 >>459   string  press\x20any\x20key...\x7\0             \b, Acronis Startup Recovery Loader
576 # DOS names like F11.SYS are 8 right space padded bytes+3 bytes
577 >>>477          ubyte&0xDF      >0              
578 >>>>477         string          x               \b %-.3s
579 >>>>>480        ubyte&0xDF      >0              
580 >>>>>>480       string          x               \b%-.5s
581 >>>>485         ubyte&0xDF      >0              
582 >>>>>485        string          x               \b.%-.3s
583 #
584 >185    string  FDBOOT\x20Version\x20                   
585 >>204   string  \rNo\x20Systemdisk.\x20                 
586 >>>220  string  Booting\x20from\x20harddisk.\n\r                
587 >>>245  string  Cannot\x20load\x20from\x20harddisk.\n\r 
588 >>>>273 string  Insert\x20Systemdisk\x20                        
589 >>>>>291 string and\x20press\x20any\x20key.\n\r         \b, FDBOOT harddisk Bootloader
590 >>>>>>200 string        >\0                             \b, version %-3s
591 >242    string  Bootsector\x20from\x20C.H.\x20Hochst\204        
592 >>278   string  No\x20Systemdisk.\x20                   
593 >>>293  string  Booting\x20from\x20harddisk.\n\r                
594 >>>441  string  Cannot\x20load\x20from\x20harddisk.\n\r 
595 >>>>469 string  Insert\x20Systemdisk\x20                        
596 >>>>>487 string and\x20press\x20any\x20key.\n\r         \b, WinImage harddisk Bootloader
597 >>>>>>209 string        >\0                             \b, version %-4.4s
598 >(1.b+2)        ubyte           0xe                     
599 >>(1.b+3)       ubyte           0x1f                    
600 >>>(1.b+4)      ubyte           0xbe                    
601 >>>>(1.b+5)     ubyte           0x77                    
602 >>>>(1.b+6)     ubyte           0x7c                    
603 >>>>>(1.b+7)    ubyte           0xac                    
604 >>>>>>(1.b+8)   ubyte           0x22                    
605 >>>>>>>(1.b+9)  ubyte           0xc0                    
606 >>>>>>>>(1.b+10)        ubyte   0x74                    
607 >>>>>>>>>(1.b+11)       ubyte   0xb                     
608 >>>>>>>>>>(1.b+12)      ubyte   0x56                    
609 >>>>>>>>>>(1.b+13)      ubyte   0xb4                    \b, mkdosfs boot message display
610 >214    string  Please\x20try\x20to\x20install\x20FreeDOS\x20   \b, DOS Emulator boot message display
611 #>>244  string  from\x20dosemu-freedos-*-bin.tgz\r      
612 #>>>170 string  Sorry,\x20could\x20not\x20load\x20an\x20                
613 #>>>>195        string  operating\x20system.\r\n                
614 #
615 >103    string  This\x20is\x20not\x20a\x20bootable\x20disk.\x20 
616 >>132   string  Please\x20insert\x20a\x20bootable\x20           
617 >>>157  string  floppy\x20and\r\n                               
618 >>>>169 string  press\x20any\x20key\x20to\x20try\x20again...\r  \b, FREE-DOS message display
619 #
620 >66     string  Solaris\x20Boot\x20Sector               
621 >>99    string  Incomplete\x20MDBoot\x20load.           
622 >>>89   string  Version                                 \b, Sun Solaris Bootloader
623 >>>>97  byte    x                                       version %c
624 #
625 >408    string  OS/2\x20!!\x20SYS01475\r\0                      
626 >>429   string  OS/2\x20!!\x20SYS02025\r\0                      
627 >>>450  string  OS/2\x20!!\x20SYS02027\r\0                      
628 >>>469  string  OS2BOOT\x20\x20\x20\x20                         \b, IBM OS/2 Warp bootloader
629 #
630 >409    string  OS/2\x20!!\x20SYS01475\r\0                      
631 >>430   string  OS/2\x20!!\x20SYS02025\r\0                      
632 >>>451  string  OS/2\x20!!\x20SYS02027\r\0                      
633 >>>470  string  OS2BOOT\x20\x20\x20\x20                         \b, IBM OS/2 Warp Bootloader
634 >112            string  This\x20disk\x20is\x20not\x20bootable\r                 
635 >>142           string  If\x20you\x20wish\x20to\x20make\x20it\x20bootable               
636 >>>176          string  run\x20the\x20DOS\x20program\x20SYS\x20                         
637 >>>200          string  after\x20the\r                                  
638 >>>>216         string  system\x20has\x20been\x20loaded\r\n                     
639 >>>>>242        string  Please\x20insert\x20a\x20DOS\x20diskette\x20            
640 >>>>>271        string  into\r\n\x20the\x20drive\x20and\x20                     
641 >>>>>>292       string  strike\x20any\x20key...\0               \b, IBM OS/2 Warp message display
642 # XP
643 >430    string  NTLDR\x20is\x20missing\xFF\r\n          
644 >>449   string  Disk\x20error\xFF\r\n                   
645 >>>462  string  Press\x20any\x20key\x20to\x20restart\r          \b, Microsoft Windows XP Bootloader
646 # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
647 >>>>417         ubyte&0xDF      >0                      
648 >>>>>417        string          x                       %-.5s
649 >>>>>>422       ubyte&0xDF      >0                      
650 >>>>>>>422      string          x                       \b%-.3s
651 >>>>>425        ubyte&0xDF      >0                      
652 >>>>>>425       string          >\x20                   \b.%-.3s
653 #
654 >>>>371         ubyte           >0x20                   
655 >>>>>368        ubyte&0xDF      >0                      
656 >>>>>>368       string          x                       %-.5s
657 >>>>>>>373      ubyte&0xDF      >0                      
658 >>>>>>>>373     string          x                       \b%-.3s
659 >>>>>>376       ubyte&0xDF      >0                      
660 >>>>>>>376      string          x                       \b.%-.3s
661 #
662 >430    string  NTLDR\x20nicht\x20gefunden\xFF\r\n              
663 >>453   string  Datentr\204gerfehler\xFF\r\n            
664 >>>473  string  Neustart\x20mit\x20beliebiger\x20Taste\r        \b, Microsoft Windows XP Bootloader (german)
665 >>>>417         ubyte&0xDF      >0                      
666 >>>>>417        string          x                       %-.5s
667 >>>>>>422       ubyte&0xDF      >0                      
668 >>>>>>>422      string          x                       \b%-.3s
669 >>>>>425        ubyte&0xDF      >0                      
670 >>>>>>425       string          >\x20                   \b.%-.3s
671 # offset variant
672 >>>>379 string  \0                                      
673 >>>>>368        ubyte&0xDF      >0                      
674 >>>>>>368       string          x                       %-.5s
675 >>>>>>>373      ubyte&0xDF      >0                      
676 >>>>>>>>373     string          x                       \b%-.3s
677 #
678 >430    string  NTLDR\x20fehlt\xFF\r\n                  
679 >>444   string  Datentr\204gerfehler\xFF\r\n            
680 >>>464  string  Neustart\x20mit\x20beliebiger\x20Taste\r        \b, Microsoft Windows XP Bootloader (2.german)
681 >>>>417         ubyte&0xDF      >0                      
682 >>>>>417        string          x                       %-.5s
683 >>>>>>422       ubyte&0xDF      >0                      
684 >>>>>>>422      string          x                       \b%-.3s
685 >>>>>425        ubyte&0xDF      >0                      
686 >>>>>>425       string          >\x20                   \b.%-.3s
687 # variant
688 >>>>371         ubyte           >0x20                   
689 >>>>>368        ubyte&0xDF      >0                      
690 >>>>>>368       string          x                       %-.5s
691 >>>>>>>373      ubyte&0xDF      >0                      
692 >>>>>>>>373     string          x                       \b%-.3s
693 >>>>>>376       ubyte&0xDF      >0                      
694 >>>>>>>376      string          x                       \b.%-.3s
695 #
696 >430    string  NTLDR\x20fehlt\xFF\r\n                  
697 >>444   string  Medienfehler\xFF\r\n                    
698 >>>459  string  Neustart:\x20Taste\x20dr\201cken\r              \b, Microsoft Windows XP Bootloader (3.german)
699 >>>>371         ubyte           >0x20                   
700 >>>>>368        ubyte&0xDF      >0                      
701 >>>>>>368       string          x                       %-.5s
702 >>>>>>>373      ubyte&0xDF      >0                      
703 >>>>>>>>373     string          x                       \b%-.3s
704 >>>>>>376       ubyte&0xDF      >0                      
705 >>>>>>>376      string          x                       \b.%-.3s
706 # variant
707 >>>>417         ubyte&0xDF      >0                      
708 >>>>>417        string          x                       %-.5s
709 >>>>>>422       ubyte&0xDF      >0                      
710 >>>>>>>422      string          x                       \b%-.3s
711 >>>>>425        ubyte&0xDF      >0                      
712 >>>>>>425       string          >\x20                   \b.%-.3s
713 #
714 >430    string  Datentr\204ger\x20entfernen\xFF\r\n     
715 >>454   string  Medienfehler\xFF\r\n                    
716 >>>469  string  Neustart:\x20Taste\x20dr\201cken\r              \b, Microsoft Windows XP Bootloader (4.german)
717 >>>>379         string          \0                      
718 >>>>>368        ubyte&0xDF      >0                      
719 >>>>>>368       string          x                       %-.5s
720 >>>>>>>373      ubyte&0xDF      >0                      
721 >>>>>>>>373     string          x                       \b%-.3s
722 >>>>>>376       ubyte&0xDF      >0                      
723 >>>>>>>376      string          x                       \b.%-.3s
724 # variant
725 >>>>417         ubyte&0xDF      >0                      
726 >>>>>417        string          x                       %-.5s
727 >>>>>>422       ubyte&0xDF      >0                      
728 >>>>>>>422      string          x                       \b%-.3s
729 >>>>>425        ubyte&0xDF      >0                      
730 >>>>>>425       string          >\x20                   \b.%-.3s
731 #
732
733 #>3     string  NTFS\x20\x20\x20\x20                            
734 >389    string  Fehler\x20beim\x20Lesen\x20
735 >>407   string  des\x20Datentr\204gers
736 >>>426  string  NTLDR\x20fehlt                          
737 >>>>440 string  NTLDR\x20ist\x20komprimiert
738 >>>>>464 string Neustart\x20mit\x20Strg+Alt+Entf\r              \b, Microsoft Windows XP Bootloader NTFS (german)
739 #>3     string  NTFS\x20\x20\x20\x20                            
740 >313    string  A\x20disk\x20read\x20error\x20occurred.\r
741 >>345   string  A\x20kernel\x20file\x20is\x20missing\x20        
742 >>>370  string  from\x20the\x20disk.\r          
743 >>>>484 string  NTLDR\x20is\x20compressed               
744 >>>>>429 string Insert\x20a\x20system\x20diskette\x20   
745 >>>>>>454 string and\x20restart\r\nthe\x20system.\r             \b, Microsoft Windows XP Bootloader NTFS
746 # DOS loader variants different languages,offsets
747 >472    ubyte&0xDF      >0
748 >>389   string  Invalid\x20system\x20disk\xFF\r\n               
749 >>>411  string  Disk\x20I/O\x20error                    
750 >>>>428 string  Replace\x20the\x20disk,\x20and\x20              
751 >>>>>455 string press\x20any\x20key                             \b, Microsoft Windows 98 Bootloader
752 #IO.SYS
753 >>>>>>472       ubyte&0xDF      >0                      
754 >>>>>>>472      string          x                       \b %-.2s
755 >>>>>>>>474     ubyte&0xDF      >0                      
756 >>>>>>>>>474    string          x                       \b%-.5s
757 >>>>>>>>>>479   ubyte&0xDF      >0                      
758 >>>>>>>>>>>479 string           x                       \b%-.1s
759 >>>>>>>480      ubyte&0xDF      >0                      
760 >>>>>>>>480     string          x                       \b.%-.3s
761 #MSDOS.SYS
762 >>>>>>>483      ubyte&0xDF      >0                      \b+
763 >>>>>>>>483     string          x                       \b%-.5s
764 >>>>>>>>>488    ubyte&0xDF      >0                      
765 >>>>>>>>>>488   string          x                       \b%-.3s
766 >>>>>>>>491     ubyte&0xDF      >0                      
767 >>>>>>>>>491    string          x                       \b.%-.3s
768 #
769 >>390   string  Invalid\x20system\x20disk\xFF\r\n               
770 >>>412  string  Disk\x20I/O\x20error\xFF\r\n            
771 >>>>429 string  Replace\x20the\x20disk,\x20and\x20              
772 >>>>>451 string then\x20press\x20any\x20key\r                   \b, Microsoft Windows 98 Bootloader
773 >>388   string  Ungueltiges\x20System\x20\xFF\r\n               
774 >>>410  string  E/A-Fehler\x20\x20\x20\x20\xFF\r\n              
775 >>>>427 string  Datentraeger\x20wechseln\x20und\x20             
776 >>>>>453 string Taste\x20druecken\r                     \b, Microsoft Windows 95/98/ME Bootloader (german)
777 #WINBOOT.SYS only not spaces (0xDF)
778 >>>>>>497       ubyte&0xDF      >0                      
779 >>>>>>>497      string          x                       %-.5s
780 >>>>>>>>502     ubyte&0xDF      >0                      
781 >>>>>>>>>502    string          x                       \b%-.1s
782 >>>>>>>>>>503   ubyte&0xDF      >0                      
783 >>>>>>>>>>>503  string          x                       \b%-.1s
784 >>>>>>>>>>>>504 ubyte&0xDF      >0                      
785 >>>>>>>>>>>>>504 string         x                       \b%-.1s
786 >>>>>>505       ubyte&0xDF      >0                      
787 >>>>>>>505      string          x                       \b.%-.3s
788 #IO.SYS
789 >>>>>>472       ubyte&0xDF      >0                      or
790 >>>>>>>472      string          x                       \b %-.2s
791 >>>>>>>>474     ubyte&0xDF      >0                      
792 >>>>>>>>>474    string          x                       \b%-.5s
793 >>>>>>>>>>479   ubyte&0xDF      >0                      
794 >>>>>>>>>>>479 string           x                       \b%-.1s
795 >>>>>>>480      ubyte&0xDF      >0                      
796 >>>>>>>>480     string          x                       \b.%-.3s
797 #MSDOS.SYS
798 >>>>>>>483      ubyte&0xDF      >0                      \b+
799 >>>>>>>>483     string          x                       \b%-.5s
800 >>>>>>>>>488    ubyte&0xDF      >0                      
801 >>>>>>>>>>488   string          x                       \b%-.3s
802 >>>>>>>>491     ubyte&0xDF      >0                      
803 >>>>>>>>>491    string          x                       \b.%-.3s
804 #
805 >>390   string  Ungueltiges\x20System\x20\xFF\r\n               
806 >>>412  string  E/A-Fehler\x20\x20\x20\x20\xFF\r\n              
807 >>>>429 string  Datentraeger\x20wechseln\x20und\x20             
808 >>>>>455 string Taste\x20druecken\r                     \b, Microsoft Windows 95/98/ME Bootloader (German)
809 #WINBOOT.SYS only not spaces (0xDF)
810 >>>>>>497       ubyte&0xDF      >0                      
811 >>>>>>>497      string          x                       %-.7s
812 >>>>>>>>504     ubyte&0xDF      >0                      
813 >>>>>>>>>504    string          x                       \b%-.1s
814 >>>>>>505       ubyte&0xDF      >0                      
815 >>>>>>>505      string          x                       \b.%-.3s
816 #IO.SYS
817 >>>>>>472       ubyte&0xDF      >0                      or
818 >>>>>>>472      string          x                       \b %-.2s
819 >>>>>>>>474     ubyte&0xDF      >0                      
820 >>>>>>>>>474    string          x                       \b%-.6s
821 >>>>>>>480      ubyte&0xDF      >0                      
822 >>>>>>>>480     string          x                       \b.%-.3s
823 #MSDOS.SYS
824 >>>>>>>483      ubyte&0xDF      >0                      \b+
825 >>>>>>>>483     string          x                       \b%-.5s
826 >>>>>>>>>488    ubyte&0xDF      >0                      
827 >>>>>>>>>>488   string          x                       \b%-.3s
828 >>>>>>>>491     ubyte&0xDF      >0                      
829 >>>>>>>>>491    string          x                       \b.%-.3s
830 #
831 >>389   string  Ungueltiges\x20System\x20\xFF\r\n               
832 >>>411  string  E/A-Fehler\x20\x20\x20\x20\xFF\r\n              
833 >>>>428 string  Datentraeger\x20wechseln\x20und\x20             
834 >>>>>454 string Taste\x20druecken\r                     \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
835 # DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
836 >>>>>>472       string          x                       %-.2s
837 >>>>>>>474      ubyte&0xDF      >0                      
838 >>>>>>>>474     string          x                       \b%-.5s
839 >>>>>>>>479     ubyte&0xDF      >0                      
840 >>>>>>>>>479    string          x                       \b%-.1s
841 >>>>>>480       ubyte&0xDF      >0                      
842 >>>>>>>480      string          x                       \b.%-.3s
843 >>>>>>483       ubyte&0xDF      >0                      \b+
844 >>>>>>>483      string          x                       \b%-.5s
845 >>>>>>>488      ubyte&0xDF      >0                      
846 >>>>>>>>488     string          x                       \b%-.2s
847 >>>>>>>>490     ubyte&0xDF      >0                      
848 >>>>>>>>>490    string          x                       \b%-.1s
849 >>>>>>>491      ubyte&0xDF      >0                      
850 >>>>>>>>491     string          x                       \b.%-.3s
851 >479    ubyte&0xDF      >0
852 >>416   string  Kein\x20System\x20oder\x20                      
853 >>>433  string  Laufwerksfehler                         
854 >>>>450 string  Wechseln\x20und\x20Taste\x20dr\201cken  \b, Microsoft DOS Bootloader (german)
855 #IO.SYS
856 >>>>>479        string          x                       \b %-.2s
857 >>>>>>481       ubyte&0xDF      >0                      
858 >>>>>>>481      string          x                       \b%-.6s
859 >>>>>487        ubyte&0xDF      >0                      
860 >>>>>>487       string          x                       \b.%-.3s
861 #MSDOS.SYS
862 >>>>>>490       ubyte&0xDF      >0                      \b+
863 >>>>>>>490      string          x                       \b%-.5s
864 >>>>>>>>495     ubyte&0xDF      >0                      
865 >>>>>>>>>495    string          x                       \b%-.3s
866 >>>>>>>498      ubyte&0xDF      >0                      
867 >>>>>>>>498     string          x                       \b.%-.3s
868 #
869 >376    search/41       Non-System\x20disk\x20or\x20            
870 >>395   search/41       disk\x20error\r                 
871 >>>407  search/41       Replace\x20and\x20                      
872 >>>>419 search/41       press\x20                               \b,
873 >>>>419 search/41       strike\x20                      \b, old
874 >>>>426 search/41       any\x20key\x20when\x20ready\r           MS or PC-DOS bootloader
875 #449                    Disk\x20Boot\x20failure\r               MS 3.21
876 #466                    Boot\x20Failure\r                       MS 3.30
877 >>>>>468 search/18      \0                              
878 #IO.SYS,IBMBIO.COM
879 >>>>>>&0        string          x                       \b %-.2s
880 >>>>>>>&-20     ubyte&0xDF      >0                      
881 >>>>>>>>&-1     string          x                       \b%-.4s
882 >>>>>>>>>&-16   ubyte&0xDF      >0                      
883 >>>>>>>>>>&-1   string          x                       \b%-.2s
884 >>>>>>&8        ubyte&0xDF      >0                      \b.
885 >>>>>>>&-1      string          x                       \b%-.3s
886 #MSDOS.SYS,IBMDOS.COM
887 >>>>>>&11       ubyte&0xDF      >0                      \b+
888 >>>>>>>&-1      string          x                       \b%-.5s
889 >>>>>>>>&-6     ubyte&0xDF      >0                      
890 >>>>>>>>>&-1    string          x                       \b%-.1s
891 >>>>>>>>>>&-5   ubyte&0xDF      >0                      
892 >>>>>>>>>>>&-1  string          x                       \b%-.2s
893 >>>>>>>&7       ubyte&0xDF      >0                      \b.
894 >>>>>>>>&-1     string          x                       \b%-.3s
895 >441    string  Cannot\x20load\x20from\x20harddisk.\n\r
896 >>469   string  Insert\x20Systemdisk\x20                        
897 >>>487  string  and\x20press\x20any\x20key.\n\r         \b, MS (2.11) DOS bootloader
898 #>43    string  \224R-LOADER\x20\x20SYS                 =label                                  
899 >54     string  SYS
900 >>324   string  VASKK
901 >>>495  string  NEWLDR\0                                \b, DR-DOS Bootloader (LOADER.SYS)
902 #
903 >98     string  Press\x20a\x20key\x20to\x20retry\0\r            
904 >>120   string  Cannot\x20find\x20file\x20\0\r          
905 >>>139  string  Disk\x20read\x20error\0\r                       
906 >>>>156 string  Loading\x20...\0                                \b, DR-DOS (3.41) Bootloader
907 #DRBIOS.SYS
908 >>>>>44         ubyte&0xDF      >0                      
909 >>>>>>44        string          x                       \b %-.6s
910 >>>>>>>50       ubyte&0xDF      >0                      
911 >>>>>>>>50      string          x                       \b%-.2s
912 >>>>>>52        ubyte&0xDF      >0                      
913 >>>>>>>52       string          x                       \b.%-.3s
914 #
915 >70     string  IBMBIO\x20\x20COM                               
916 >>472   string  Cannot\x20load\x20DOS!\x20                      
917 >>>489  string  Any\x20key\x20to\x20retry                       \b, DR-DOS Bootloader
918 >>471   string  Cannot\x20load\x20DOS\x20                       
919 >>487   string  press\x20key\x20to\x20retry                     \b, Open-DOS Bootloader
920 #??
921 >444    string  KERNEL\x20\x20SYS                                       
922 >>314   string  BOOT\x20error!                          \b, FREE-DOS Bootloader
923 >499    string  KERNEL\x20\x20SYS                               
924 >>305   string  BOOT\x20err!\0                          \b, Free-DOS Bootloader
925 >449    string  KERNEL\x20\x20SYS                               
926 >>319   string  BOOT\x20error!                          \b, FREE-DOS 0.5 Bootloader
927 #
928 >449    string  Loading\x20FreeDOS                      
929 >>0x1AF         ulelong         >0                      \b, FREE-DOS 0.95,1.0 Bootloader
930 >>>497          ubyte&0xDF      >0                      
931 >>>>497         string          x                       \b %-.6s
932 >>>>>503        ubyte&0xDF      >0                      
933 >>>>>>503       string          x                       \b%-.1s
934 >>>>>>>504      ubyte&0xDF      >0                      
935 >>>>>>>>504     string          x                       \b%-.1s
936 >>>>505         ubyte&0xDF      >0                      
937 >>>>>505        string          x                       \b.%-.3s
938 #
939 >331    string  Error!.0                                \b, FREE-DOS 1.0 bootloader
940 #
941 >125    string  Loading\x20FreeDOS...\r                 
942 >>311   string  BOOT\x20error!\r                                \b, FREE-DOS bootloader
943 >>>441          ubyte&0xDF      >0                      
944 >>>>441         string          x                       \b %-.6s
945 >>>>>447        ubyte&0xDF      >0                      
946 >>>>>>447       string          x                       \b%-.1s
947 >>>>>>>448      ubyte&0xDF      >0                      
948 >>>>>>>>448     string          x                       \b%-.1s
949 >>>>449         ubyte&0xDF      >0                      
950 >>>>>449        string          x                       \b.%-.3s
951 >124    string  FreeDOS\0                               
952 >>331   string  \x20err\0                                       \b, FREE-DOS BETa 0.9 Bootloader
953 # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
954 >>>497          ubyte&0xDF      >0                      
955 >>>>497         string          x                       \b %-.6s
956 >>>>>503        ubyte&0xDF      >0                      
957 >>>>>>503       string          x                       \b%-.1s
958 >>>>>>>504      ubyte&0xDF      >0                      
959 >>>>>>>>504     string          x                       \b%-.1s
960 >>>>505         ubyte&0xDF      >0                      
961 >>>>>505        string          x                       \b.%-.3s
962 >>333   string  \x20err\0                                       \b, FREE-DOS BEta 0.9 Bootloader
963 >>>497          ubyte&0xDF      >0                      
964 >>>>497         string          x                       \b %-.6s
965 >>>>>503        ubyte&0xDF      >0                      
966 >>>>>>503       string          x                       \b%-.1s
967 >>>>>>>504      ubyte&0xDF      >0                      
968 >>>>>>>>504     string          x                       \b%-.1s
969 >>>>505         ubyte&0xDF      >0                      
970 >>>>>505        string          x                       \b.%-.3s
971 >>334   string  \x20err\0                                       \b, FREE-DOS Beta 0.9 Bootloader
972 >>>497          ubyte&0xDF      >0                      
973 >>>>497         string          x                       \b %-.6s
974 >>>>>503        ubyte&0xDF      >0                      
975 >>>>>>503       string          x                       \b%-.1s
976 >>>>>>>504      ubyte&0xDF      >0                      
977 >>>>>>>>504     string          x                       \b%-.1s
978 >>>>505         ubyte&0xDF      >0                      
979 >>>>>505        string          x                       \b.%-.3s
980 >336    string  Error!\x20                              
981 >>343   string  Hit\x20a\x20key\x20to\x20reboot.                \b, FREE-DOS Beta 0.9sr1 Bootloader
982 >>>497          ubyte&0xDF      >0                      
983 >>>>497         string          x                       \b %-.6s
984 >>>>>503        ubyte&0xDF      >0                      
985 >>>>>>503       string          x                       \b%-.1s
986 >>>>>>>504      ubyte&0xDF      >0                      
987 >>>>>>>>504     string          x                       \b%-.1s
988 >>>>505         ubyte&0xDF      >0                      
989 >>>>>505        string          x                       \b.%-.3s
990 # added by Joerg Jenderek
991 # http://www.visopsys.org/
992 # http://partitionlogic.org.uk/
993 # OEM-ID=Visopsys
994 >478            ulelong 0                                       
995 >>(1.b+326)     string  I/O\x20Error\x20reading\x20                     
996 >>>(1.b+344)    string  Visopsys\x20loader\r                    
997 >>>>(1.b+361)   string  Press\x20any\x20key\x20to\x20continue.\r        \b, Visopsys loader
998 # http://alexfru.chat.ru/epm.html#bootprog
999 >494    ubyte   >0x4D                                   
1000 >>495   string  >E                                      
1001 >>>495  string  <S                                      
1002 #OEM-ID is not reliable
1003 >>>>3   string  BootProg                                
1004 # It just looks for a program file name at the root directory
1005 # and loads corresponding file with following execution.
1006 # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
1007 >>>>499                 ubyte&0xDF      >0              \b, COM/EXE Bootloader
1008 >>>>>499                string          x               \b %-.1s
1009 >>>>>>500               ubyte&0xDF      >0              
1010 >>>>>>>500              string          x               \b%-.1s
1011 >>>>>>>>501             ubyte&0xDF      >0              
1012 >>>>>>>>>501            string          x               \b%-.1s
1013 >>>>>>>>>>502           ubyte&0xDF      >0              
1014 >>>>>>>>>>>502          string          x               \b%-.1s
1015 >>>>>>>>>>>>503         ubyte&0xDF      >0              
1016 >>>>>>>>>>>>>503        string          x               \b%-.1s
1017 >>>>>>>>>>>>>>504       ubyte&0xDF      >0              
1018 >>>>>>>>>>>>>>>504      string          x               \b%-.1s
1019 >>>>>>>>>>>>>>>>505     ubyte&0xDF      >0              
1020 >>>>>>>>>>>>>>>>>505    string          x               \b%-.1s
1021 >>>>>>>>>>>>>>>>>>506   ubyte&0xDF      >0              
1022 >>>>>>>>>>>>>>>>>>>506  string          x               \b%-.1s
1023 #name extension
1024 >>>>>507                ubyte&0xDF      >0              \b.
1025 >>>>>>507               string          x               \b%-.1s
1026 >>>>>>>508              ubyte&0xDF      >0              
1027 >>>>>>>>508             string          x               \b%-.1s
1028 >>>>>>>>>509            ubyte&0xDF      >0              
1029 >>>>>>>>>>509           string          x               \b%-.1s
1030 #If the boot sector fails to read any other sector,
1031 #it prints a very short message ("RE") to the screen and hangs the computer.
1032 #If the boot sector fails to find needed program in the root directory,
1033 #it also hangs with another message ("NF").
1034 >>>>>492                string          RENF            \b, FAT (12 bit)
1035 >>>>>495                string          RENF            \b, FAT (16 bit)
1036 # http://alexfru.chat.ru/epm.html#bootprog
1037 >494    ubyte   >0x4D                                   
1038 >>495   string  >E                                      
1039 >>>495  string  <S                                      
1040 #OEM-ID is not reliable
1041 >>>>3   string  BootProg                                
1042 # It just looks for a program file name at the root directory
1043 # and loads corresponding file with following execution.
1044 # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
1045 >>>>499                 ubyte&0xDF      >0              \b, COM/EXE Bootloader
1046 >>>>>499                string          x               \b %-.1s
1047 >>>>>>500               ubyte&0xDF      >0              
1048 >>>>>>>500              string          x               \b%-.1s
1049 >>>>>>>>501             ubyte&0xDF      >0              
1050 >>>>>>>>>501            string          x               \b%-.1s
1051 >>>>>>>>>>502           ubyte&0xDF      >0              
1052 >>>>>>>>>>>502          string          x               \b%-.1s
1053 >>>>>>>>>>>>503         ubyte&0xDF      >0              
1054 >>>>>>>>>>>>>503        string          x               \b%-.1s
1055 >>>>>>>>>>>>>>504       ubyte&0xDF      >0              
1056 >>>>>>>>>>>>>>>504      string          x               \b%-.1s
1057 >>>>>>>>>>>>>>>>505     ubyte&0xDF      >0              
1058 >>>>>>>>>>>>>>>>>505    string          x               \b%-.1s
1059 >>>>>>>>>>>>>>>>>>506   ubyte&0xDF      >0              
1060 >>>>>>>>>>>>>>>>>>>506  string          x               \b%-.1s
1061 #name extension
1062 >>>>>507                ubyte&0xDF      >0              \b.
1063 >>>>>>507               string          x               \b%-.1s
1064 >>>>>>>508              ubyte&0xDF      >0              
1065 >>>>>>>>508             string          x               \b%-.1s
1066 >>>>>>>>>509            ubyte&0xDF      >0              
1067 >>>>>>>>>>509           string          x               \b%-.1s
1068 #If the boot sector fails to read any other sector,
1069 #it prints a very short message ("RE") to the screen and hangs the computer.
1070 #If the boot sector fails to find needed program in the root directory,
1071 #it also hangs with another message ("NF").
1072 >>>>>492                string          RENF            \b, FAT (12 bit)
1073 >>>>>495                string          RENF            \b, FAT (16 bit)
1074 # x86 bootloader end
1075 # updated by Joerg Jenderek at Sep 2007
1076 >3      ubyte   0                       
1077 #no active flag
1078 >>446   ubyte   0                       
1079 # partition 1 not empty
1080 >>>450  ubyte   >0                      
1081 # partitions 3,4 empty
1082 >>>>482         ubyte   0                       
1083 >>>>>498        ubyte   0                       
1084 # partition 2 ID=0,5,15
1085 >>>>>>466       ubyte   <0x10                   
1086 >>>>>>>466      ubyte   0x05                    \b, extended partition table
1087 >>>>>>>466      ubyte   0x0F                    \b, extended partition table (LBA)
1088 >>>>>>>466      ubyte   0x0                     \b, extended partition table (last)     
1089 # JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
1090 # http://mirror.href.com/thestarman/asm/2bytejumps.htmm#FWD
1091 # older drives may use Near JuMP instruction E9 xx xx
1092 >0              lelong&0x009000EB       0x009000EB 
1093 >0              lelong&0x000000E9       0x000000E9 
1094 # minimal short forward jump found 03cx??
1095 # maximal short forward jump is 07fx
1096 >1              ubyte                   <0xff   \b, code offset 0x%x
1097 # mtools-3.9.8/msdos.h
1098 # usual values are marked with comments to get only informations of strange FAT systems
1099 # valid sectorsize must be a power of 2 from 32 to 32768
1100 >>11            uleshort&0x000f x               
1101 >>>11           uleshort        <32769          
1102 >>>>11          uleshort        >31             
1103 >>>>>21         ubyte&0xf0      0xF0            
1104 >>>>>>3         string          >\0             \b, OEM-ID "%8.8s"
1105 #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
1106 >>>>>>>8        string          IHC             \b cached by Windows 9M
1107 >>>>>>11        uleshort        >512            \b, Bytes/sector %u
1108 #>>>>>>11       uleshort        =512            \b, Bytes/sector %u=512 (usual)
1109 >>>>>>11        uleshort        <512            \b, Bytes/sector %u
1110 >>>>>>13        ubyte           >1              \b, sectors/cluster %u
1111 #>>>>>>13       ubyte           =1              \b, sectors/cluster %u (usual on Floppies)
1112 >>>>>>14        uleshort        >32             \b, reserved sectors %u
1113 #>>>>>>14       uleshort        =32             \b, reserved sectors %u (usual Fat32)
1114 #>>>>>>14       uleshort        >1              \b, reserved sectors %u
1115 #>>>>>>14       uleshort        =1              \b, reserved sectors %u (usual FAT12,FAT16)
1116 >>>>>>14        uleshort        <1              \b, reserved sectors %u
1117 >>>>>>16        ubyte           >2              \b, FATs %u
1118 #>>>>>>16       ubyte           =2              \b, FATs %u (usual)
1119 >>>>>>16        ubyte           =1              \b, FAT  %u
1120 >>>>>>16        ubyte           >0
1121 >>>>>>17        uleshort        >0              \b, root entries %u
1122 #>>>>>>17       uleshort        =0              \b, root entries %u=0 (usual Fat32)
1123 >>>>>>19        uleshort        >0              \b, sectors %u (volumes <=32 MB) 
1124 #>>>>>>19       uleshort        =0              \b, sectors %u=0 (usual Fat32)
1125 >>>>>>21        ubyte           >0xF0           \b, Media descriptor 0x%x
1126 #>>>>>>21       ubyte           =0xF0           \b, Media descriptor 0x%x (usual floppy)
1127 >>>>>>21        ubyte           <0xF0           \b, Media descriptor 0x%x
1128 >>>>>>22        uleshort        >0              \b, sectors/FAT %u
1129 #>>>>>>22       uleshort        =0              \b, sectors/FAT %u=0 (usual Fat32)
1130 >>>>>>26        ubyte           >2              \b, heads %u
1131 #>>>>>>26       ubyte           =2              \b, heads %u (usual floppy)
1132 >>>>>>26        ubyte           =1              \b, heads %u
1133 #skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
1134 >>>>>>38        ubyte           !0x70           
1135 >>>>>>>28       ulelong         >0              \b, hidden sectors %u
1136 #>>>>>>>28      ulelong         =0              \b, hidden sectors %u (usual floppy)
1137 >>>>>>>32       ulelong         >0              \b, sectors %u (volumes > 32 MB) 
1138 #>>>>>>>32      ulelong         =0              \b, sectors %u (volumes > 32 MB)
1139 # FAT<32 specific 
1140 >>>>>>82        string          !FAT32
1141 #>>>>>>>36      ubyte           0x80            \b, physical drive 0x%x=0x80 (usual harddisk)
1142 #>>>>>>>36      ubyte           0               \b, physical drive 0x%x=0 (usual floppy)
1143 >>>>>>>36       ubyte           !0x80           
1144 >>>>>>>>36      ubyte           !0              \b, physical drive 0x%x
1145 >>>>>>>37       ubyte           >0              \b, reserved 0x%x
1146 #>>>>>>>37      ubyte           =0              \b, reserved 0x%x
1147 >>>>>>>38       ubyte           >0x29           \b, dos < 4.0 BootSector (0x%x)
1148 >>>>>>>38       ubyte           <0x29           \b, dos < 4.0 BootSector (0x%x)
1149 >>>>>>>38       ubyte           =0x29
1150 >>>>>>>>39      ulelong         x               \b, serial number 0x%x
1151 >>>>>>>>43      string          <NO\x20NAME     \b, label: "%11.11s"
1152 >>>>>>>>43      string          >NO\x20NAME     \b, label: "%11.11s"
1153 >>>>>>>>43      string          =NO\x20NAME     \b, unlabeled
1154 >>>>>>>54       string          FAT             \b, FAT
1155 >>>>>>>>54      string          FAT12           \b (12 bit)
1156 >>>>>>>>54      string          FAT16           \b (16 bit)
1157 # FAT32 specific
1158 >>>>>>82        string          FAT32           \b, FAT (32 bit)
1159 >>>>>>>36       ulelong         x               \b, sectors/FAT %u
1160 >>>>>>>40       uleshort        >0              \b, extension flags %u
1161 #>>>>>>>40      uleshort        =0              \b, extension flags %u
1162 >>>>>>>42       uleshort        >0              \b, fsVersion %u
1163 #>>>>>>>42      uleshort        =0              \b, fsVersion %u (usual)
1164 >>>>>>>44       ulelong         >2              \b, rootdir cluster %u
1165 #>>>>>>>44      ulelong         =2              \b, rootdir cluster %u
1166 #>>>>>>>44      ulelong         =1              \b, rootdir cluster %u
1167 >>>>>>>48       uleshort        >1              \b, infoSector %u
1168 #>>>>>>>48      uleshort        =1              \b, infoSector %u (usual)
1169 >>>>>>>48       uleshort        <1              \b, infoSector %u
1170 >>>>>>>50       uleshort        >6              \b, Backup boot sector %u
1171 #>>>>>>>50      uleshort        =6              \b, Backup boot sector %u (usual) 
1172 >>>>>>>50       uleshort        <6              \b, Backup boot sector %u
1173 >>>>>>>54       ulelong         >0              \b, reserved1 0x%x
1174 >>>>>>>58       ulelong         >0              \b, reserved2 0x%x
1175 >>>>>>>62       ulelong         >0              \b, reserved3 0x%x
1176 # same structure as FAT1X 
1177 >>>>>>>64       ubyte           >0x80           \b, physical drive 0x%x
1178 #>>>>>>>64      ubyte           =0x80           \b, physical drive 0x%x=80 (usual harddisk)
1179 >>>>>>>64       ubyte&0x7F      >0              \b, physical drive 0x%x
1180 #>>>>>>>64      ubyte           =0              \b, physical drive 0x%x=0 (usual floppy)
1181 >>>>>>>65       ubyte           >0              \b, reserved 0x%x
1182 >>>>>>>66       ubyte           >0x29           \b, dos < 4.0 BootSector (0x%x)
1183 >>>>>>>66       ubyte           <0x29           \b, dos < 4.0 BootSector (0x%x)
1184 >>>>>>>66       ubyte           =0x29
1185 >>>>>>>>67      ulelong         x               \b, serial number 0x%x
1186 >>>>>>>>71      string          <NO\x20NAME     \b, label: "%11.11s"
1187 >>>>>>>71       string          >NO\x20NAME     \b, label: "%11.11s"
1188 >>>>>>>71       string          =NO\x20NAME     \b, unlabeled
1189 ### FATs end
1190 >0x200  lelong  0x82564557              \b, BSD disklabel
1191
1192