contrib/file/magic/Magdir/ole2compounddocs

   1
   2 #------------------------------------------------------------------------------
   3 # $File: ole2compounddocs,v 1.19 2022/09/11 20:52:40 christos Exp $
   4 # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
   5 # storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
   6 # Additional tests for OLE 2 Compound Documents should be under this recipe.
   7 # reference:    https://www.openoffice.org/sc/compdocfileformat.pdf
   8
   9 0   string  \320\317\021\340\241\261\032\341
  10 # https://digital-preservation.github.io/droid/
  11 # skip droid skeleton like fmt-39-signature-id-128.doc by valid version
  12 >0x1A   ushort          !0xABAB         OLE 2 Compound Document
  13 #>0x1C  uleshort                x                       \b, endnian %#4.4x
  14 # big endian not tested
  15 >>0x1C  ubeshort                =0xfffe                 \b, big-endian
  16 >>>546  string  jbjb                    : Microsoft Word Document
  17 !:mime  application/msword
  18 !:apple MSWDWDBN
  19 !:ext   doc
  20 # Byte Order 0xFFFE means little-endian found in real world applications
  21 #>>0x1C uleshort                =0xfffe                 \b, little-endian
  22 >>0x1C  uleshort                =0xfffe
  23 # From:         Joerg Jenderek
  24 # Major Version 3 or 4
  25 >>>0x1A uleshort                x                       \b, v%u
  26 # Minor Version 32h=50 3Bh=59 3Eh=62
  27 >>>0x18 uleshort                x                       \b.%u
  28 # SecID of first sector of the directory stream is often 1 but high like 3144h
  29 >>>48   ulelong                 x                       \b, SecID %#x
  30 # Sector Shift Exponent in short-stream container stream: 6~64 bytes
  31 >>>32   uleshort                !6                      \b, exponent of short stream %u
  32 # total number of sectors used for the FAT
  33 >>>44   ulelong                 >1                      \b, %u FAT sectors
  34 # SecID of first sector of the short-sector allocation table (Mini FAT)
  35 # or -2 (End Of ChainSecID) if not extant
  36 >>>60   ulelong                 !0xffFFffFE             \b, Mini FAT start sector %#x
  37 # total number of sectors used for the short-sector allocation table
  38 >>>64   ulelong                 !1                      \b, %u Mini FAT sector
  39 # plural s
  40 >>>>64  ulelong                 >1                      \bs
  41 # SecID of first sector of the master sector allocation table (DIFAT)
  42 # or -2 (End Of Chain SecID) if no additional sectors used
  43 >>>68   ulelong                 !0xffFFffFE             \b, DIFAT start sector %#x
  44 # total number of sectors used for the master sector allocation table (DIFAT)
  45 >>>72   ulelong                 >0                      \b, %u DIFAT sectors
  46 # First part of the master sector allocation table (DIFAT) containing 109 SecIDs
  47 #>>>76  ubequad                 x                       \b, DIFAT=%#16.16llx
  48 #>>>84  ubequad                 x                       \b%16.16llx...
  49 # pointer to root entry only works with standard configuration for SecID ~< 800h
  50 # Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls
  51 # "ORLEN Factbook 2017.xls" XnView_metadata.doc
  52 # "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized
  53 >>>48   ulelong                 >0x800                  too big for FILE_BYTES_MAX = 1 MiB
  54 # Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4
  55 >>>0x1E uleshort                0xc                     \b, blocksize 4096
  56 # jump to one block (4096 bytes per block) before root storage block
  57 >>>>(48.l*4096) ubyte   x
  58 >>>>>&4095      use             ole2-directory
  59 #>>>0x1E        uleshort                9                       \b, blocksize 512
  60 >>>0x1E uleshort                9
  61 # jump to one block (512 bytes per block) before root storage block
  62 # in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h
  63 >>>>(48.l*512)  ubyte           x
  64 >>>>>&511       use             ole2-directory
  65 # check directory entry structure and display types by GUID
  66 0       name                    ole2-directory
  67 # directory entry name like "Root Entry"
  68 #>0     lestring16      x                       \b, 1st %.10s
  69 # type of the entry; 5~Root storage
  70 #>66    ubyte           x                       \b, type %x
  71 # node colour of the entry: 00H ~ Red 01H ~ Black
  72 #>67    ubyte           x                       \b, color %x
  73 # the DirIDs of the child nodes. Should both be -1 in the root storage entry
  74 #>68    bequad          !0xffffffffffffffff     \b, DirIDs %llx
  75 # second directory entry name like VisioDocument Control000
  76 #>128   lestring16      x \b, 2nd %.20s
  77 # third directory entry like WordDocument
  78 #>256   lestring16      x \b, 3rd %.20s
  79 # forth
  80 #>384   lestring16      x \b, 4th %.10s
  81 # 5th
  82 #>512   lestring16      x \b, 5th %.10s
  83 # 6th
  84 #>640   lestring16      x \b, 6th %.10s
  85 # 7th
  86 #>768   lestring16      x \b, 7th %.10s
  87 #       https://wikileaks.org/ciav7p1/cms/page_13762814.html
  88 #       https://m.blog.naver.com/superman4u/40047693679
  89 #       https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt
  90 #       https://toolslick.com/conversion/data/guid
  91 #>80    ubequad         !0                      \b, clsid %#16.16llx
  92 #>>88   ubequad         x                       \b%16.16llx
  93 # test for "Root Entry" inside directory by type 5 value
  94 >66     ubyte           5
  95 # look for CLSID GUID 0
  96 >>88    ubequad         0x0
  97 >>>80   ubequad         0x0
  98 # - Microstation V8 DGN files (www.bentley.com)
  99 # URL:  https://en.wikipedia.org/wiki/MicroStation
 100 #   Last update on 10/23/2006 by Lester Hightower
 101 #   07/24/2019 by Joerg Jenderek
 102 # Second directory entry name like Dgn~H Dgn~S
 103 >>>>128         lestring16      Dgn~                    : Microstation V8 CAD
 104 #!:mime application/x-ole-storage
 105 !:mime  application/x-bentley-dgn
 106 # http://www.q-cad.com/files/samples_cad_files/1344468165.dgn
 107 !:ext   dgn
 108 #
 109 # URL:  http://fileformats.archiveteam.org/wiki/WordPerfect
 110 # Second directory entry name PerfectOffice_
 111 >>>>128         lestring16      PerfectOffice_          : WordPerfect 7-X3 presentations Master, Document or Graphic
 112 !:mime  application/vnd.wordperfect
 113 # https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
 114 !:apple ????WPC7
 115 !:ext   mst/wpd/wpg
 116 #
 117 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
 118 # Second directory entry name MatOST_
 119 >>>>128         lestring16      MatOST                  : Microsoft Works 3.0 document
 120 !:mime  application/vnd.ms-works
 121 !:apple ????AWWP
 122 !:ext   wps
 123 #
 124 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet
 125 # 3rd directory entry name WksSSWorkBook
 126 >>>>256         lestring16      WksSSWorkBook           : Microsoft Works 6-9 spreadsheet
 127 !:mime  application/vnd.ms-works
 128 !:apple ????AWSS
 129 !:ext   xlr
 130 #
 131 # URL:  http://fileformats.archiveteam.org/wiki/XLS
 132 # what is the difference to {00020820-0000-0000-c000-000000000046} ?
 133 # Second directory entry name Workbook
 134 >>>>128         lestring16      Workbook
 135 >>>>>256        lestring16      !WksSSWorkBook          : Microsoft Excel 97-2003 worksheet 0 clsid
 136 !:mime  application/vnd.ms-excel
 137 # https://www.macdisk.com/macsigen.php  XLS5 for Excel 5
 138 !:apple ????XLS9
 139 !:ext   xls
 140 #
 141 # URL:  http://fileformats.archiveteam.org/wiki/PPT
 142 # Second directory entry name Object1 Object12 Object35
 143 >>>>128         lestring16      Object                  : Microsoft PowerPoint 4 presentation
 144 !:mime  application/vnd.ms-powerpoint
 145 # https://www.macdisk.com/macsigen.php
 146 !:apple ????PPT3
 147 !:ext   ppt
 148 #
 149 # URL:  https://www.msoutlook.info/question/164
 150 # Second directory entry name __CollDataStm
 151 >>>>128         lestring16      __CollDataStm           : Microsoft Outlook Send Receive Settings
 152 #!:mime application/vnd.ms-outlook
 153 !:mime  application/x-ms-srs
 154 # %APPDATA%\Microsoft\Outlook\Outlook.srs
 155 !:ext   srs
 156 #
 157 # URL:  https://www.file-extensions.org/cag-file-extension
 158 # Second directory entry name Category
 159 >>>>128         lestring16      Category                : Microsoft Clip Art Gallery
 160 #!:mime application/x-ole-storage
 161 !:mime  application/x-ms-cag
 162 !:apple MScgCGdb
 163 !:ext   cag/
 164 #
 165 # URL:  https://www.filesuffix.com/de/extension/rra
 166 # 3rd directory entry name StrIndex_StringTable
 167 >>>>256         lestring16      StrIndex_StringTable    : Windows temporarily installer
 168 #!:mime application/x-ole-storage
 169 !:mime  application/x-ms-rra
 170 !:ext   rra
 171 #
 172 # URL:  https://www.forensicswiki.org/wiki/Jump_Lists
 173 # 3rd directory entry name DestList
 174 >>>>256         lestring16      DestList                : Windows jump list
 175 #!:mime application/x-ole-storage
 176 !:mime  application/x-ms-jumplist
 177 # %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms
 178 !:ext   automaticDestinations-ms
 179 #
 180 # URL:  https://en.wikipedia.org/wiki/Windows_thumbnail_cache
 181 # Second directory entry name 256_
 182 >>>>128         lestring16      256_                    : Windows thumbnail database 256
 183 #!:mime application/x-ole-storage
 184 !:mime  application/x-ms-thumbnail
 185 # Thumbs.db
 186 !:ext   db
 187 >>>>128         lestring16      96_                     : Windows thumbnail database 96
 188 !:mime  application/x-ms-thumbnail
 189 !:ext   db
 190 # 3rd directory entry name Catalog_
 191 >>>>256         lestring16      Catalog                 : Windows thumbnail database
 192 !:mime  application/x-ms-thumbnail
 193 !:ext   db
 194 #
 195 # URL:  https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches
 196 # Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based
 197 # Second directory entry name Control000
 198 >>>>128         lestring16      Control000              : Microsoft old Systeminfo
 199 #!:mime application/x-ole-storage
 200 !:mime  application/x-ms-info
 201 !:ext   nfo
 202 #
 203 # From:         Joerg Jenderek
 204 # URL:          https://en.wikipedia.org/wiki/Microsoft_Access
 205 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/m/mdz.trid.xml
 206 #               http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
 207 # Note:         only version foo tested and called "Microsoft Access Wizard template" by TrID
 208 # Fourth directory entry name TemplateID
 209 >>>>384         lestring16      TemplateID              : Microsoft Access wizard template
 210 # Second directory entry name like \005SummaryInformation and 3rd name like \005DocumentSummaryInformation
 211 #!:mime application/x-ole-storage
 212 #!:mime application/vnd.ms-office
 213 #!:mime application/vnd.ms-access
 214 #!:mime application/msaccess
 215 !:mime  application/x-ms-mdz
 216 # http://extension.nirsoft.net/mdz
 217 !:ext   mdz
 218 #
 219 # URL:  http://fileformats.archiveteam.org/wiki/Corel_Print_House
 220 # Second directory entry name Thumbnail
 221 >>>>128         lestring16      Thumbnail               : Corel PrintHouse image
 222 #!:mime application/x-ole-storage
 223 !:mime  application/x-corel-cph
 224 !:ext   cph
 225 # 3rd directory entry name Thumbnail
 226 >>>>256         lestring16      Thumbnail               : Corel PrintHouse image
 227 !:mime  application/x-corel-cph
 228 !:ext   cph
 229 # URL:  http://fileformats.archiveteam.org/wiki/Corel_Gallery
 230 # Note: format since Gallery 2; sometimes called Corel Multimedia Manager Album
 231 # third directory entry name _INFO_
 232 >>>>256         lestring16      _INFO_                  : Corel Gallery
 233 # second directory entry name _ITEM_ or _DATA_
 234 # later directory entry names: _ALBUM_ _THUMBNAIL_
 235 #!:mime application/x-ole-storage
 236 !:mime  application/x-corel-gal
 237 !:ext   gal
 238 #
 239 # From:         Joerg Jenderek
 240 # URL:          https://archive.org/details/iPhoto-Plus-4
 241 #               https://filext.com/file-extension/TPL
 242 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/t/tpl-ulead.trid.xml
 243 # Note:         found in Template sub directory in program directory of software iPhoto Plus version 4
 244 # second, third and fourth directory entry name like TplHeader TplMainImage TplPreview
 245 >>>>128         lestring16      TplHeader               : Ulead iPhoto Template
 246 #!:mime application/x-ole-storage
 247 !:mime  image/x-ulead-tpl
 248 # https://www.file-extensions.org/tpl-file-extension-ulead-photo-express-template
 249 !:ext   tpl
 250 #
 251 # URL:  https://en.wikipedia.org/wiki/Hangul_(word_processor)
 252 # Note: "HWP Document File" signature found in FileHeader
 253 # Second directory entry name FileHeader hint for Thinkfree Office document
 254 >>>>128         lestring16      FileHeader              : Hangul (Korean) 5.0 Word Processor File
 255 #!:mime application/haansofthwp
 256 !:mime  application/x-hwp
 257 # https://example-files.online-convert.com/document/hwp/example.hwp
 258 !:ext   hwp
 259 #
 260 # URL:  https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/
 261 # Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083
 262 >>>>128         lestring16      dd2                     : StarOffice Gallery view
 263 #!:mime application/x-ole-storage
 264 !:mime  application/x-star-sdv
 265 !:ext   sdv
 266 # URL:  https://en.wikipedia.org/wiki/SoftMaker_Office
 267 # second directory entry name Current User
 268 >>>>128         lestring16      Current\ User           : SoftMaker
 269 # third directory entry name SMNativeObjData
 270 >>>>>256        lestring16      SMNativeObjData
 271 # 5th directory entry name PowerPoint
 272 >>>>>>512       lestring16      PowerPoint              PowerPoint presentation or template
 273 !:mime  application/vnd.ms-powerpoint
 274 !:ext   ppt/pps/pot
 275 # 4th directory entry name PowerPoint
 276 >>>>>384        lestring16      PowerPoint              Presentations or template
 277 # http://extension.nirsoft.net/prv
 278 !:mime  application/vnd.softmaker.presentations
 279 !:ext   prd/prv
 280 # third directory entry name like Current User
 281 >>>>256         lestring16      Current\ User           : SoftMaker
 282 # 5th directory entry name PowerPoint
 283 >>>>>512        lestring16      PowerPoint              Presentations or template
 284 # http://extension.nirsoft.net/prd
 285 !:mime  application/vnd.softmaker.presentations
 286 !:ext   prd/prv
 287 # 2nd directory entry name Pictures
 288 >>>>>>128       lestring16      Pictures                with pictures
 289 #
 290 # URL:          http://fileformats.archiveteam.org/wiki/PageMaker
 291 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/p
 292 #               pagemaker-generic.trid.xml
 293 #               pagemaker-pm6.trid.xml
 294 #               pagemaker-pm65.trid.xml
 295 #               pmd-pm7.trid.xml
 296 # From:         Joerg Jenderek
 297 # Note:         since version 6 embedd as stream with PageMaker name the "old" format handled by ./wordprocessors
 298 #               verified by Michal Mutl Structured Storage Viewer `SSView.exe brochus.pt6`
 299 # Second directory entry name PageMaker
 300 >>>>128         lestring16      PageMaker               :
 301 # look for magic of "old" PageMaker like in 02TEMPLT.T65
 302 >>>>>0  search/0xa900/s \0\0\0\0\0\0\xff\x99
 303 # GRR: jump to PageMaker stream and inspect it by sub routine PageMaker of ./wordprocessors failed with wrong version!
 304 #>>>>>>&0       use             PageMaker
 305 # THIS WORKS PARTLY!
 306 >>>>>>&0        indirect        x
 307 #       remaining null clsid
 308 >>>>128         default         x                       : UNKNOWN
 309 # second directory entry name like VisioDocument Control000
 310 >>>>>128        lestring16      x with names %.20s
 311 # third directory entry like WordDocument
 312 >>>>>256        lestring16      x %.20s
 313 # forth
 314 >>>>>384        lestring16      x %.20s
 315 !:mime  application/x-ole-storage
 316 # according to file version 5.41 with -e soft option
 317 #!:mime application/CDFV2
 318 #!:ext  ???
 319 #       look for known clsid GUID
 320 # - Visio documents
 321 # URL:  http://fileformats.archiveteam.org/wiki/Visio
 322 #   Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek
 323 >>88    ubequad         0xc000000000000046      : Microsoft
 324 >>>80   ubequad         0x131a020000000000      Visio 2000-2002 Document, stencil or template
 325 !:mime  application/vnd.visio
 326 # VSD~Drawing VSS~Stencil VST~Template
 327 !:ext   vsd/vss/vst
 328 >>>80   ubequad         0x141a020000000000      Visio 2003-2010 Document, stencil or template
 329 !:mime  application/vnd.visio
 330 !:ext   vsd/vss/vst
 331 #
 332 # URL:  http://fileformats.archiveteam.org/wiki/Windows_Installer
 333 >>>80   ubequad         0x84100c0000000000      Windows Installer Package
 334 !:mime  application/x-msi
 335 #!:mime application/x-ms-win-installer
 336 !:ext   msi
 337 >>>80   ubequad         0x86100c0000000000      Windows Installer Patch
 338 # ??
 339 !:mime  application/x-wine-extension-msp
 340 #!:mime application/x-ms-msp
 341 !:ext   msp
 342 #
 343 # URL:  http://fileformats.archiveteam.org/wiki/DOC
 344 >>>80   ubequad         0x0009020000000000      Word 6-95 document or template
 345 !:mime  application/msword
 346 # for template MSWDW8TN
 347 !:apple MSWDWDBN
 348 !:ext   doc/dot
 349 >>>80   ubequad         0x0609020000000000      Word 97-2003 document or template
 350 !:mime  application/msword
 351 !:apple MSWDWDBN
 352 # dot for template; no extension on Macintosh
 353 !:ext   doc/dot/
 354 #
 355 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
 356 >>>80   ubequad         0x0213020000000000      Works 3-4 document or template
 357 !:mime  application/vnd.ms-works
 358 !:apple ????AWWP
 359 # ps for template       https://filext.com/file-extension/PS    bps for backup
 360 !:ext   wps/ps/bps
 361 #
 362 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
 363 >>>80   ubequad         0x0313020000000000      Works 3-4 database or template
 364 !:mime  application/vnd.ms-works-db
 365 # https://www.macdisk.com/macsigen.php
 366 !:apple ????AWDB
 367 # db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup
 368 !:ext   wdb/db/bdb
 369 #
 370 # URL:  https://en.wikipedia.org/wiki/Microsoft_Excel
 371 >>>80   ubequad         0x1008020000000000      Excel 5-95 worksheet, addin or template
 372 !:mime  application/vnd.ms-excel
 373 # https://www.macdisk.com/macsigen.php
 374 !:apple ????XLS5
 375 # worksheet/addin/template/no extension on Macintosh
 376 !:ext   xls/xla/xlt/
 377 #
 378 >>>80   ubequad         0x2008020000000000      Excel 97-2003
 379 !:mime  application/vnd.ms-excel
 380 # https://www.macdisk.com/macsigen.php  XLS5 for Excel 5
 381 !:apple ????XLS9
 382 # 3rd directory entry name
 383 >>>>256         lestring16      _VBA_PROJECT_CUR        addin
 384 !:ext   xla/
 385 # 4th directory entry name
 386 >>>>384         lestring16      _VBA_PROJECT_CUR        addin
 387 !:ext   xla
 388 #!:ext  xla/
 389 >>>>256         default         x                       worksheet or template
 390 !:ext   xls/xlt
 391 #!:ext  xls/xlt/
 392 #
 393 # URL:  http://fileformats.archiveteam.org/wiki/OLE2
 394 >>>80   ubequad         0x0b0d020000000000      Outlook 97-2003 item
 395 #>>>80  ubequad         0x0b0d020000000000      Outlook 97-2003 Message
 396 #!:mime application/vnd.ms-outlook
 397 !:mime  application/x-ms-msg
 398 !:ext   msg
 399 # URL:  https://wiki.fileformat.com/email/oft/
 400 >>>80   ubequad         0x46f0060000000000      Outlook 97-2003 item template
 401 #!:mime application/vnd.ms-outlook
 402 !:mime  application/x-ms-oft
 403 !:ext   oft
 404 #
 405 # URL:  http://fileformats.archiveteam.org/wiki/PPT
 406 >>>80   ubequad         0x5148040000000000      PowerPoint 4.0 presentation
 407 !:mime  application/vnd.ms-powerpoint
 408 # https://www.macdisk.com/macsigen.php
 409 !:apple ????PPT3
 410 !:ext   ppt
 411 #??
 412 # URL:  http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/
 413 >>88    ubequad         0xa29a00aa004a1a72      : Microsoft
 414 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
 415 >>>80   ubequad         0xc2dbcd28e20ace11      Works 4 document
 416 !:mime  application/vnd.ms-works
 417 !:apple ????AWWP
 418 !:ext   wps
 419 #
 420 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
 421 >>>80   ubequad         0xc3dbcd28e20ace11      Works 4 database
 422 !:mime  application/vnd.ms-works-db
 423 !:apple ????AWDB
 424 !:ext   wdb/bdb
 425 #??
 426 >>88    ubequad         0xa40700c04fb932ba      : Microsoft
 427 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
 428 >>>80   ubequad         0xb25aa40e0a9ed111      Works 5-6 document
 429 !:mime  application/vnd.ms-works
 430 !:apple ????AWWP
 431 !:ext   wps
 432 # From:         Joerg Jenderek
 433 # URL:          https://en.wikipedia.org/wiki/Microsoft_Works
 434 # Reference:    http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
 435 # Note:         probably version 6 and 7
 436 # organize pictures like JPFG images in streams __cf1 with names like
 437 # 001.JPG, 002.JPG ... in streams __fname
 438 >>88    ubequad         0xa1c800c04f612452      : Microsoft
 439 >>>80   ubequad         0xc0c7266eb98cd311      Works portfolio
 440 # 2nd directory entry name PfOrder, 3rd __LastID and 4th __SizeUsed
 441 #!:mime application/x-ole-storage
 442 # https://www.iana.org/assignments/media-types/application/vnd.ms-works
 443 !:mime  application/vnd.ms-works
 444 # https://extension.nirsoft.net/wsb
 445 # like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb
 446 !:ext   wsb
 447 #??
 448 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
 449 >>88    ubequad         0x00c0000000000046      : Microsoft
 450 >>>80   ubequad         0x0112020000000000      Publisher
 451 !:mime  application/vnd.ms-publisher
 452 !:ext   pub
 453 #
 454 # URL:  http://fileformats.archiveteam.org/wiki/PPT
 455 #??
 456 >>88    ubequad         0xa90300aa00510ea3      : Microsoft
 457 >>>80   ubequad         0x70ae7bea3bfbcd11      PowerPoint 95 presentation
 458 !:mime  application/vnd.ms-powerpoint
 459 # https://www.macdisk.com/macsigen.php
 460 !:apple ????PPT3
 461 !:ext   ppt/pot
 462 #??
 463 >>88    ubequad         0x86ea00aa00b929e8      : Microsoft
 464 >>>80   ubequad         0x108d81649b4fcf11      PowerPoint 97-2003 presentation or template
 465 !:mime  application/vnd.ms-powerpoint
 466 !:apple ????PPT3
 467 # /autostart/template
 468 !:ext   ppt/pps/pot
 469 # From:         Joerg Jenderek
 470 # URL:          https://www.file-extensions.org/ppa-file-extension
 471 #               https://en.wikipedia.org/wiki/Microsoft_PowerPoint#cite_note-231
 472 # Reference:    http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
 473 >>88    ubequad         0x871800aa0060263b      : Microsoft
 474 # only version 8 (97) tested; PowerPoint 4.0 to 11.0 (2004) (Wikipedia); 97 to 2003 (file-extensions.org)
 475 >>>80   ubequad         0xf04672810a72cf11      PowerPoint Addin or Wizard
 476 # second, third and fourth directory entry name like VBA PROJECT PROJECTwm
 477 # http://extension.nirsoft.net/pwz
 478 !:mime  application/vnd.ms-powerpoint
 479 # like: BSHPPT97.PPA "AutoContent Wizard.pwz"
 480 !:ext   ppa/pwz
 481 #
 482 # From:         Joerg Jenderek
 483 # URL:          http://fileformats.archiveteam.org/wiki/AWD_(At_Work_Document)
 484 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/a/awd-fax.trid.xml
 485 # Note:         called "Microsoft At Work Fax document" by TrID
 486 >>88    ubequad         0xb29400dd010f2bf9      : Microsoft
 487 >>>80   ubequad         0x801cb0023de01a10      At Work fax Document
 488 #!:mime application/x-ole-storage
 489 !:mime  image/x-ms-awd
 490 !:ext   awd
 491 #
 492 # URL:  https://en.wikipedia.org/wiki/Microsoft_Project
 493 #??
 494 >>88    ubequad         0xbe1100c04fb6faf1      : Microsoft
 495 >>>80   ubequad         0x3a8fb774c8c8d111      Project
 496 !:mime  application/vnd.ms-project
 497 !:ext   mpp
 498 # From:         Joerg Jenderek
 499 # URL:          https://en.wikipedia.org/wiki/Microsoft_Office_shared_tools#Binder
 500 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/o/obd.trid.xml
 501 #               http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
 502 # Note:         only version 8 tested and called "Office Binder Document" by TrID and
 503 #               "Microsoft Office Binder File for Windows" version 97-2000 by DROID fmt/240
 504 >>88    ubequad         0xb21c00aa004ba90b      : Microsoft
 505 >>>80   ubequad         0x0004855964661b10      Office Binder Document, Template or wizard
 506 # second directory entry name like Binder
 507 # https://www.file-extensions.org/obd-file-extension
 508 #!:mime application/vnd.ms-binder
 509 !:mime  application/x-msbinder
 510 # obt for template; obz for Microsoft Office Binder wizard
 511 !:ext   obd/obt/obz
 512 #
 513 # URL:          http://fileformats.archiveteam.org/wiki/WordPerfect
 514 # Reference:    http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
 515 #               https://github.com/OneWingedShark/WordPerfect/
 516 #               blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm
 517 # From:         Joerg Jenderek
 518 # Note:         internal version x.2 or 2.2 like in embedded ole6-PerfectOffice_MAIN.wpd
 519 # 3rd directory entry name PerfectOffice_OBJECT and 2nd PerfectOffice_MAIN,
 520 # which contains WordPerfect document \xffWPC signature handled by ./wordprocessors
 521 >>88    ubequad         0x19370000929679cd      : WordPerfect 7
 522 >>>80   ubequad         0xff739851ad2d2002      Document
 523 !:mime  application/vnd.wordperfect
 524 #!:apple        ????WPC?
 525 # https://fossies.org/linux/wp2latex/test/ole6.wpd
 526 !:ext   wpd
 527 #>>>>0  search/0xc01/s  \xffWPC                 \b, WPC SIGNATURE
 528 # inspect embedded WordPerfect document by ./wordprocessors with 1 space at end
 529 #>>>>>&0        indirect        x       \b; contains
 530 # GRR: the above expression does not work correctly
 531 #
 532 # URL:  http://fileformats.archiveteam.org/wiki/SHW_(Corel)
 533 #???
 534 >>88    ubequad         0x99ae04021c007002      : WordPerfect
 535 >>>80   ubequad         0x62fe2e4099191b10      7-X3 presentation
 536 !:mime  application/x-corelpresentations
 537 #!:mime application/x-shw-viewer
 538 #!:mime image/x-presentations
 539 !:ext   shw
 540 #
 541 # URL:  http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/
 542 >>>80   ubequad         0x60fe2e4099191b10      9 Graphic
 543 #!:mime application/x-wpg
 544 #!:mime image/x-wordperfect-graphics
 545 !:mime  image/x-wpg
 546 # https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
 547 !:apple ????WPC9
 548 !:ext   wpg
 549 #
 550 # URL:  http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats
 551 >>88    ubequad         0x996104021c007002      : StarOffice
 552 >>>80   ubequad         0x407e5cdc5cb31b10      StarWriter 3.0 document or template
 553 # https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html
 554 !:mime  application/x-starwriter
 555 !:ext   sdw/vor
 556 #
 557 >>>80   ubequad         0xa03f543fa6b61b10      StarCalc 3.0 spreadsheet or template
 558 !:mime  application/x-starcalc
 559 !:ext   sdc/vor
 560 #
 561 >>>80   ubequad         0xe0aa10af6db31b10      StarDraw 3.0 drawing or template
 562 !:mime  application/x-starimpress
 563 #!:mime application/x-stardraw
 564 # sda ??
 565 !:ext   sdd/sda/vor
 566 #??
 567 >>88    ubequad         0x89cb008029e4b0b1      : StarOffice
 568 >>>80   ubequad         0x41d461633542d011      StarCalc 4.0 spreadsheet or template
 569 !:mime  application/x-starcalc
 570 !:ext   sdc/vor
 571 #
 572 >>>80   ubequad         0x61b8a5c6d685d111      StarCalc 5.0 spreadsheet or template
 573 !:mime  application/vnd.stardivision.cal
 574 !:ext   sdc/vor
 575 #
 576 >>>80   ubequad         0xc03c2d011642d011      StarImpress 4.0 presentation or template
 577 !:mime  application/x-starimpress
 578 !:ext   sdd/vor
 579 #??
 580 >>88    ubequad         0xb12a04021c007002      : StarOffice
 581 >>>80   ubequad         0x600459d4fd351c10      StarMath 3.0
 582 !:mime  application/x-starmath
 583 !:ext   smf
 584 #??
 585 >>88    ubequad         0x8e2c00001b4cc711      : StarOffice
 586 >>>80   ubequad         0xe0999cfb6d2c1c10      StarChart 3.0
 587 !:mime  application/x-starchart
 588 !:ext   sds
 589 #??
 590 >>88    ubequad         0xa45e00a0249d57b1      : StarOffice
 591 >>>80   ubequad         0xb0e9048b0e42d011      StarWriter 4.0 document or template
 592 !:mime  application/x-starwriter
 593 !:ext   sdw/vor
 594 #??
 595 >>88    ubequad         0x89ca008029e4b0b1      : StarOffice
 596 >>>80   ubequad         0xe1b7b3022542d011      StarMath 4.0
 597 !:mime  application/x-starmath
 598 !:ext   smf
 599 #
 600 >>>80   ubequad         0xe0b7b3022542d011      StarChart 4.0
 601 !:mime  application/x-starchart
 602 !:ext   sds
 603 #??
 604 >>88    ubequad         0xa53f00a0249d57b1      : StarOffice
 605 >>>80   ubequad         0x70c90a340de3d011      Master 4.0 document
 606 !:mime  application/x-starwriter-global
 607 !:ext   sgl
 608 #??
 609 >>88    ubequad         0x89d0008029e4b0b1      : StarOffice
 610 >>>80   ubequad         0x40e6b5ffde85d111      StarMath 5.0
 611 !:mime  application/vnd.stardivision.math
 612 !:ext   smf
 613 #
 614 >>>80   ubequad         0xa005892ebd85d111      StarDraw 5.0 drawing or template
 615 !:mime  application/vnd.stardivision.draw
 616 !:ext   sda/vor
 617 #
 618 >>>80   ubequad         0x21725c56bc85d111      StarImpress 5.0 presentation or template
 619 !:mime  application/vnd.stardivision.impress
 620 # sda is used for what?
 621 !:ext   sdd/vor/sda
 622 #
 623 >>>80   ubequad         0x214388bfdd85d111      StarChart 5.0
 624 !:mime  application/vnd.stardivision.chart
 625 !:ext   sds
 626 # ??
 627 >>88    ubequad         0xaab4006097da561a      : StarOffice
 628 >>>80   ubequad         0xd1f90cc2ae85d111      StarWriter 5.0 document or template
 629 !:mime  application/vnd.stardivision.writer
 630 !:ext   sdw/vor
 631 #
 632 >>>80   ubequad         0xd3f90cc2ae85d111      Master 5.0 document
 633 !:mime  application/vnd.stardivision.writer-global
 634 !:ext   sgl
 635 #??
 636 # URL:  http://fileformats.archiveteam.org/wiki/FlashPix
 637 >>88    ubequad         0x855300aa00a1f95b      : Kodak
 638 >>>80   ubequad         0x0067615654c1ce11      FlashPIX Image
 639 !:mime  image/vnd.fpx
 640 !:apple ????FPix
 641 !:ext   fpx
 642 # URL:  https://en.wikipedia.org/wiki/SoftMaker_Office
 643 >>88    ubequad         0x95f600a0cc3cca14      : PlanMaker
 644 >>>80   ubequad         0x9174088a6452d411      document or template
 645 !:mime  application/vnd.softmaker.planmaker
 646 # pmv for template      https://www.file-extensions.org/pmv-file-extension
 647 !:ext   pmd/pmv
 648 # URL:          http://fileformats.archiveteam.org/wiki/MAX_(3ds_Max)
 649 #               https://en.wikipedia.org/wiki/Autodesk_3ds_Max
 650 # Reference:    http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
 651 # Note:         called "3D Studio Max Scene" by TrID and "3DS Max" by DROID and
 652 #               "3DSMax thumbnail" by XnView and verfied by `nconvert -info A380.max`
 653 #               applies only to "newer" versions (about 2008-2020)
 654 >>88    ubequad         0x9fed04143144cc1e      : Autodesk
 655 >>>80   ubequad         0x7b8cdd1cc081a045      3ds Max
 656 #!:mime application/x-ole-storage
 657 !:mime  model/x-autodesk-max
 658 # like: https://static.free3d.com/models/dropbox/dropbox/sq/A380.7z/A380.max
 659 !:ext   max
 660 # also chr for character file according to DROID https://www.nationalarchives.gov.uk/PRONOM/fmt/978
 661 #!:ext  max/chr
 662 # remaining non null clsid
 663 >>88    default         x
 664 # GRR: check again for non null clsid because wrong when called by indirect directive
 665 >>>88   ubequad         !0                      : UNKNOWN
 666 # https://reposcope.com/mimetype/application/x-ole-storage
 667 !:mime  application/x-ole-storage
 668 # according to file version 5.41 with -e soft option
 669 #!:mime application/CDFV2
 670 #!:ext  ???
 671 >>>>80  ubequad         !0                      \b, clsid %#16.16llx
 672 >>>>88  ubequad         x                       \b%16.16llx
 673