3 # AppleSingle/AppleDouble dump
5 # (c) 2009-2010 by HAT <hat@fa2.so-net.ne.jp>
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 2 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
21 # Applesingle and AppleDouble format internals (version 1)
22 # http://users.phg-online.de/tk/netatalk/doc/Apple/v1/
24 # AppleSingle/AppleDouble Formats for Foreign Files Developer's Note (version2)
25 # http://users.phg-online.de/tk/netatalk/doc/Apple/v2/AppleSingle_AppleDouble.pdf
27 # Inside Macintosh: Macintosh Toolbox Essentials /
28 # Chapter 7 - Finder Interface / Finder Interface Reference
29 # http://developer.apple.com/legacy/mac/library/documentation/mac/toolbox/Toolbox-463.html
31 # Finder Interface Reference
32 # http://developer.apple.com/legacy/mac/library/documentation/Carbon/Reference/Finder_Interface/Reference/reference.html
34 # Technical Note TN1150 HFS Plus Volume Format
35 # http://developer.apple.com/mac/library/technotes/tn/tn1150.html#FinderInfo
37 # CarbonHeaders source
38 # http://www.opensource.apple.com/source/CarbonHeaders/CarbonHeaders-8A428/Finder.h
39 # http://www.opensource.apple.com/source/CarbonHeaders/CarbonHeaders-9A581/Finder.h
43 # /usr/bin/GetFileInfo
45 # Mac OS X 10.6.2 kernel source
46 # http://www.opensource.apple.com/source/xnu/xnu-1486.2.11/bsd/vfs/vfs_xattr.c
51 use bigint; # require perl >= 5.8
53 # parse command line -----------------------------------------------
55 $finderinfo = 0; # 0: unknown 1: file 2: directory
56 while ($arg = shift @ARGV)
58 if ($arg =~ /^(-h|-help|--help)$/ ) {
59 printf ("usage: %s [-a] FILE|DIR\n" ,basename($0));
60 printf (" or: %s -f FILE\n" ,basename($0));
61 printf (" or: %s -d FILE\n" ,basename($0));
62 printf (" or: %s -h|-help|--help\n" ,basename($0));
63 printf ("Dump AppleSingle/AppleDouble format file.\n");
65 printf (" -a (default) Dump a AppleSingle/AppleDouble file for FILE or DIR\n");
66 printf (" automatically.\n");
67 printf (" Extrapolate FinderInfo type from absolute path.\n");
68 printf (" If FILE is not AppleSingle/AppleDouble format,\n");
69 printf (" look for '.AppleDouble/FILE' and '._FILE'.\n");
70 printf (" If DIR, look for 'DIR/.AppleDouble/.Parent' and '._DIR'.\n");
71 printf (" -f Dump FILE. Assume FinderInfo to be FileInfo.\n");
72 printf (" -d Dump FILE. Assume FinderInfo to be DirInfo.\n");
73 printf (" -h,-help,--help Display this help and exit\n");
75 printf ("There is no way to detect whether FinderInfo is FileInfo or DirInfo.\n");
76 printf ("By default, %s examins whether file or directory,\n" ,basename($0));
77 printf ("a parent directory is .AppleDouble, filename is ._*, filename is .Parent,\n");
78 printf ("and so on.\n");
79 printf ("If setting option -f or -d, %s assume FinderInfo and doesn't look for\n");
80 printf ("another file.\n");
82 } elsif ($arg eq "-a") {
84 } elsif ($arg eq "-f") {
86 } elsif ($arg eq "-d") {
88 } elsif ($arg =~ /^-/) {
89 printf (STDERR "%s: invalid option %s\n", basename($0), $arg);
90 printf (STDERR "Try \`%s\ -h' for more information.\n", basename($0));
98 printf (STDERR "missing file operand.\n");
102 printf (STDERR "\"%s\" not found.\n", $afile);
106 # detect FinderInfo, and search AppleSingle/AppleDouble file --------------
108 $abspath = File::Spec->rel2abs($afile);
109 ($basename, $path, $ext) = fileparse($abspath);
111 if ( $finderinfo != 0 ) {
113 } elsif ( -f $afile ) {
114 if ( $basename eq ".Parent") {
116 } elsif ( $path =~ /\/.AppleDouble\/$/ ) {
118 } elsif ( $basename =~ /^._/ ) {
119 if ( -f $path.substr($basename, 2) ) {
121 } elsif ( -d $path.substr($basename, 2) ) {
125 if (!open(INFILE, "<$afile")) {
126 printf (STDERR "cannot open %s\n", $afile);
130 $val = unpack("N", $buf );
132 if ($val == 0x00051600 || $val == 0x00051607) {
135 printf ("\"%s\" is not AppleSingle/AppleDouble format.\n", $afile);
137 $netatalkfile = $path.".AppleDouble/".$basename;
138 $osxfile = $path."._".$basename;
140 if (( -e $netatalkfile ) && !( -e $osxfile )) {
141 $afile = $netatalkfile;
142 } elsif (!( -e $netatalkfile ) && ( -e $osxfile )) {
144 } elsif (( -e $netatalkfile ) && ( -e $osxfile )) {
145 printf ("\"%s\" found.\n", $netatalkfile);
146 printf ("\"%s\" found.\n", $osxfile);
147 printf ("Specify which of file.\n");
150 printf ("\"%s\" not found.\n", $netatalkfile);
151 printf ("\"%s\" not found.\n", $osxfile);
155 } elsif ( -d $afile) {
156 printf ("\"%s\" is a directory.\n", $afile);
158 $netatalkfile = $path.$basename."/.AppleDouble/.Parent";
159 $osxfile = $path."._".$basename;
161 if (( -e $netatalkfile ) && !( -e $osxfile )) {
162 $afile = $netatalkfile;
163 } elsif (!( -e $netatalkfile ) && ( -e $osxfile )) {
165 } elsif (( -e $netatalkfile ) && ( -e $osxfile )) {
166 printf ("\"%s\" found.\n", $netatalkfile);
167 printf ("\"%s\" found.\n", $osxfile);
168 printf ("Specify which of file.\n");
171 printf ("\"%s\" not found.\n", $netatalkfile);
172 printf ("\"%s\" not found.\n", $osxfile);
176 printf (STDERR "unknown error: %s\n", $afile);
180 if (!open(INFILE, "<$afile")) {
181 printf (STDERR "cannot open %s\n", $afile);
184 printf ("%s:\n\n", $afile);
186 # Magic Number -----------------------------------------------
188 print "-------------------------------------------------------------------------------\n";
191 $val = unpack("N", $buf );
192 printf("MagicNumber: %08X", $val);
193 if ( $val == 0x00051600 ) {
194 printf(" : AppleSingle");
196 elsif ( $val == 0x00051607 ) {
197 printf(" : AppleDouble");
200 printf(" : Unknown" );
204 # Version Number ---------------------------------------------
207 $version = unpack("N", $buf );
208 printf("Version : %08X", $version);
209 if ( $version == 0x00010000 ) {
210 printf(" : Version 1");
211 } elsif ( $version == 0x00020000 ) {
212 printf(" : Version 2");
214 printf(" : Unknown" );
218 # v1:Home file system / v2:Filler ----------------------------
220 read(INFILE,$buf,16);
221 if ( $version == 0x00010000 ) {
222 print "HomeFileSys:";
226 hexdump($buf, 16, 16, " ");
228 # Number of entities -----------------------------------------
231 $entnum = unpack("n", $buf );
232 printf("Num. of ent: %04X ", $entnum);
233 printf(" : %d", $entnum);
236 # data -------------------------------------------------------
238 for ( $num = 0 ; $num < $entnum ; $num++) {
240 seek(INFILE, ($num * 12 + 26), 0);
242 # Entry ---------------------------------------------------
245 $entid = unpack("N", $buf );
246 print "\n-------------------------------------------------------------------------------\n";
247 printf("Entry ID : %08X", $entid);
248 if ( $entid == 1 ) { printf(" : Data Fork"); }
249 elsif ( $entid == 2 ) { printf(" : Resource Fork"); }
250 elsif ( $entid == 3 ) { printf(" : Real Name"); }
251 elsif ( $entid == 4 ) { printf(" : Comment"); }
252 elsif ( $entid == 5 ) { printf(" : Icon, B&W"); }
253 elsif ( $entid == 6 ) { printf(" : Icon Color"); }
254 elsif ( $entid == 7 ) { printf(" : File Info"); }
255 elsif ( $entid == 8 ) { printf(" : File Dates Info"); }
256 elsif ( $entid == 9 ) { printf(" : Finder Info"); }
257 elsif ( $entid == 10 ) { printf(" : Macintosh File Info"); }
258 elsif ( $entid == 11 ) { printf(" : ProDOS File Info"); }
259 elsif ( $entid == 12 ) { printf(" : MS-DOS File Info"); }
260 elsif ( $entid == 13 ) { printf(" : Short Name"); }
261 elsif ( $entid == 14 ) { printf(" : AFP File Info"); }
262 elsif ( $entid == 15 ) { printf(" : Directory ID"); }
263 elsif ( $entid == 0x8053567E ) { printf(" : CNID (Netatalk Extended)"); }
264 elsif ( $entid == 0x8053594E ) { printf(" : DB stamp (Netatalk Extended)"); }
265 elsif ( $entid == 0x80444556 ) { printf(" : dev (Netatalk Extended)"); }
266 elsif ( $entid == 0x80494E4F ) { printf(" : inode (Netatalk Extended)"); }
267 else { printf(" : Unknown"); }
270 # Offset -------------------------------------------------
273 $ofst = unpack("N", $buf );
274 printf("Offset : %08X", $ofst);
275 printf(" : %d ", $ofst);
277 # Length -------------------------------------------------
280 $len = unpack("N", $buf );
281 printf("\nLength : %08X", $len);
282 printf(" : %d", $len);
287 # Dump for each Entry ID --------------------------------
289 # if ( $entid == 1 ) { ; } # Data Fork
290 # if ( $entid == 2 ) { ; } # Resource Fork
291 # if ( $entid == 3 ) { ; } # Real Name
292 # if ( $entid == 4 ) { ; } # Comment
293 # if ( $entid == 5 ) { ; } # Icon, B&W
294 # if ( $entid == 6 ) { ; } # Icon Color
295 # if ( $entid == 7 ) { ; } # File Info
296 if ( $entid == 8 ) { filedatesdump($ofst,$len); }
297 elsif ( $entid == 9 ) { finderinfodump($ofst,$len); }
298 # if ( $entid == 10 ) { ; } # Macintosh File Info
299 # if ( $entid == 11 ) { ; } # ProDOS File Info
300 # if ( $entid == 12 ) { ; } # MS-DOS File Info
301 # if ( $entid == 13 ) { ; } # Short Name
302 # if ( $entid == 14 ) { ; } # AFP File Info
303 elsif ( $entid == 15 ) { print "\n"; bedump($ofst,$len); } # Directory ID
304 elsif ( $entid == 0x8053567E ) { print "\n"; bedump($ofst,$len); } # CNID (Netatalk Extended)
305 elsif ( $entid == 0x8053594E ) { print "\n"; bedump($ofst,$len); ledump($ofst,$len); } # DB stamp (Netatalk Extended)
306 elsif ( $entid == 0x80444556 ) { print "\n"; bedump($ofst,$len); ledump($ofst,$len); } # dev (Netatalk Extended)
307 elsif ( $entid == 0x80494E4F ) { print "\n"; bedump($ofst,$len); ledump($ofst,$len); } # inode (Netatalk Extended)
309 # RAW Dump ---------------------------------------------------
311 if ( ($quo > 0) || ($rem > 0)) {
313 print "-RAW DUMP--: 0 1 2 3 4 5 6 7 8 9 A B C D E F : (ASCII)\n";
316 seek(INFILE, $ofst, 0);
324 #sub -----------------------------------------------------------
327 my ($ofst, $len) = @_;
332 @datetype =('create ', 'modify ', 'backup ', 'access ');
334 seek(INFILE, $ofst, 0);
337 printf ("-DATE------: : (GMT) : (Local)\n");
339 for ( $i = 0 ; $i < 4 ; $i++) {
341 $datedata = unpack("N", $buf );
342 if ($datedata < 0x80000000) {
343 $datestr = gmtime( $datedata + 946684800)
345 .localtime( $datedata + 946684800);
346 } elsif ($datedata == 0x80000000) {
347 $datestr = "Unknown or Initial";
349 $datestr = gmtime( $datedata - 3348282496)
351 .localtime( $datedata - 3348282496);
353 printf ("%s : %08X : %s\n",$datetype[$i], $datedata, $datestr);
358 my ($ofst, $len) = @_;
360 seek(INFILE, $ofst, 0);
362 if ($finderinfo == 0) {
364 print "-NOTE------: cannot detect whether FInfo or DInfo. assume FInfo.\n";
367 if ($finderinfo == 0 || $finderinfo == 1) {
368 filefinderinfodump();
369 } elsif ($finderinfo == 2) {
372 print STDERR "unknown FinderInfo type\n"
375 if ($len > 32) { eadump(); }
378 sub filefinderinfodump {
381 print "-FInfo-----:\n";
385 hexdump($buf, 4, 4, "");
389 hexdump($buf, 4, 4, "");
394 $val = unpack("n", $buf );
395 printf("Location v : %04X", $val);
396 printf(" : %d\n", $val>0x7FFF?$val-0x10000:$val);
399 $val = unpack("n", $buf );
400 printf("Location h : %04X", $val);
401 printf(" : %d\n", $val>0x7FFF?$val-0x10000:$val);
405 hexdump($buf, 2, 4, "");
408 print "-FXInfo----:\n";
411 $val = unpack("n", $buf );
412 printf("Rsvd|IconID: %04X", $val);
413 printf(" : %d\n", $val>0x7FFF?$val-0x10000:$val);
417 hexdump($buf, 2, 4, "");
420 hexdump($buf, 2, 4, "");
423 hexdump($buf, 2, 4, "");
428 $val = unpack("n", $buf );
429 printf("Rsvd|commnt: %04X", $val);
430 printf(" : %d\n", $val>0x7FFF?$val-0x10000:$val);
433 $val = unpack("N", $buf );
434 printf("PutAway : %08X", $val);
435 printf(" : %d\n", $val>0x7FFFFFFF?$val-0x100000000:$val); # Why SInt32?
439 sub dirfinderinfodump {
442 print "-DInfo-----:\n";
445 $val = unpack("n", $buf );
446 printf("Rect top : %04X", $val);
447 printf(" : %d\n", $val>0x7FFF?$val-0x10000:$val);
450 $val = unpack("n", $buf );
451 printf("Rect left : %04X", $val);
452 printf(" : %d\n", $val>0x7FFF?$val-0x10000:$val);
455 $val = unpack("n", $buf );
456 printf("Rect bottom: %04X", $val);
457 printf(" : %d\n", $val>0x7FFF?$val-0x10000:$val);
460 $val = unpack("n", $buf );
461 printf("Rect right : %04X", $val);
462 printf(" : %d\n", $val>0x7FFF?$val-0x10000:$val);
467 $val = unpack("n", $buf );
468 printf("Location v : %04X", $val);
469 printf(" : %d\n", $val>0x7FFF?$val-0x10000:$val);
472 $val = unpack("n", $buf );
473 printf("Location h : %04X", $val);
474 printf(" : %d\n", $val>0x7FFF?$val-0x10000:$val);
478 hexdump($buf, 2, 4, "");
481 print "-DXInfo----:\n";
484 $val = unpack("n", $buf );
485 printf("Scroll v : %04X", $val);
486 printf(" : %d\n", $val>0x7FFF?$val-0x10000:$val);
489 $val = unpack("n", $buf );
490 printf("Scroll h : %04X", $val);
491 printf(" : %d\n", $val>0x7FFF?$val-0x10000:$val);
494 $val = unpack("N", $buf );
495 printf("Rsvd|OpnChn: %08X", $val);
496 printf(" : %d\n", $val>0x7FFFFFFF?$val-0x100000000:$val); # Why SInt32?
502 hexdump($buf, 2, 4, "");
505 $val = unpack("N", $buf );
506 printf("PutAway : %08X", $val);
507 printf(" : %d\n", $val>0x7FFFFFFF?$val-0x100000000:$val); # Why SInt32?
512 @colortype =('none', 'gray', 'green', 'purple', 'blue', 'yellow', 'red', 'orange');
515 $flags = unpack("n", $buf );
516 printf ("isAlias : %d\n", ($flags >> 15) & 1);
517 printf ("Invisible : %d\n", ($flags >> 14) & 1);
518 printf ("hasBundle : %d\n", ($flags >> 13) & 1);
519 printf ("nameLocked : %d\n", ($flags >> 12) & 1);
520 printf ("Stationery : %d\n", ($flags >> 11) & 1);
521 printf ("CustomIcon : %d\n", ($flags >> 10) & 1);
522 printf ("Reserved : %d\n", ($flags >> 9) & 1);
523 printf ("Inited : %d\n", ($flags >> 8) & 1);
524 printf ("NoINITS : %d\n", ($flags >> 7) & 1);
525 printf ("Shared : %d\n", ($flags >> 6) & 1);
526 printf ("SwitchLaunc: %d\n", ($flags >> 5) & 1);
527 printf ("Hidden Ext : %d\n", ($flags >> 4) & 1);
528 printf ("color : %d%d%d : %s\n", ($flags >> 3) & 1,
531 @colortype[($flags & 0xE)>>1]);
532 printf ("isOnDesk : %d\n", ($flags >> 0) & 1);
539 $flags = unpack("n", $buf );
541 if (($flags >> 15) == 1) {
543 hexdump($buf, 1, 4, "");
545 printf ("AreInvalid : %d\n", ($flags >> 15) & 1);
546 printf ("unknown bit: %d\n", ($flags >> 14) & 1);
547 printf ("unknown bit: %d\n", ($flags >> 13) & 1);
548 printf ("unknown bit: %d\n", ($flags >> 12) & 1);
549 printf ("unknown bit: %d\n", ($flags >> 11) & 1);
550 printf ("unknown bit: %d\n", ($flags >> 10) & 1);
551 printf ("unknown bit: %d\n", ($flags >> 9) & 1);
554 printf ("CustomBadge: %d\n", ($flags >> 8) & 1);
555 printf ("ObjctIsBusy: %d\n", ($flags >> 7) & 1);
556 printf ("unknown bit: %d\n", ($flags >> 6) & 1);
557 printf ("unknown bit: %d\n", ($flags >> 5) & 1);
558 printf ("unknown bit: %d\n", ($flags >> 4) & 1);
559 printf ("unknown bit: %d\n", ($flags >> 3) & 1);
560 printf ("RoutingInfo: %d\n", ($flags >> 2) & 1);
561 printf ("unknown bit: %d\n", ($flags >> 1) & 1);
562 printf ("unknown bit: %d\n", ($flags >> 0) & 1);
569 print "-EA--------:\n";
573 hexdump($buf, 2, 4, "");
577 hexdump($buf, 4, 4, "");
580 $ea_debug_tag = unpack("N", $buf );
581 printf("debug_tag : %08X", $ea_debug_tag);
582 printf(" : %d\n", $ea_debug_tag);
585 $ea_total_size = unpack("N", $buf );
586 printf("total_size : %08X", $ea_total_size);
587 printf(" : %d\n", $ea_total_size);
590 $ea_data_start = unpack("N", $buf );
591 printf("data_start : %08X", $ea_data_start);
592 printf(" : %d\n", $ea_data_start);
595 $ea_data_length = unpack("N", $buf );
596 printf("data_length: %08X", $ea_data_length);
597 printf(" : %d\n", $ea_data_length);
600 print "reserved[0]: ";
601 hexdump($buf, 4, 4, "");
604 print "reserved[1]: ";
605 hexdump($buf, 4, 4, "");
608 print "reserved[2]: ";
609 hexdump($buf, 4, 4, "");
613 hexdump($buf, 2, 4, "");
616 $ea_num_attrs = unpack("n", $buf );
617 printf("num_attrs : %04X", $ea_num_attrs);
618 printf(" : %d\n", $ea_num_attrs);
622 for ($i = 0 ; $i < $ea_num_attrs ; $i++) {
624 $pos = (($pos & 0x3) == 0) ? ($pos) : ((($pos >> 2) + 1) << 2);
625 seek(INFILE, $pos, 0);
627 print "-EA ENTRY--:\n";
630 $ea_offset = unpack("N", $buf );
631 printf("offset : %08X", $ea_offset);
632 printf(" : %d\n", $ea_offset);
635 $ea_length = unpack("N", $buf );
636 printf("length : %08X", $ea_length);
637 printf(" : %d\n", $ea_length);
641 hexdump($buf, 2, 4, "");
644 $ea_namelen = unpack("C", $buf );
645 printf("namelen : %02X", $ea_namelen);
646 printf(" : %d\n", $ea_namelen);
648 $ea_namequo = $ea_namelen >> 4;
649 $ea_namerem = $ea_namelen & 0xF;
650 print "-EA NAME---: 0 1 2 3 4 5 6 7 8 9 A B C D E F : (ASCII)\n";
651 rawdump($ea_namequo, $ea_namerem);
655 seek(INFILE, $ea_offset, 0);
656 $ea_quo = $ea_length >> 4;
657 $ea_rem = $ea_length & 0xF;
658 print "-EA VALUE--: 0 1 2 3 4 5 6 7 8 9 A B C D E F : (ASCII)\n";
659 rawdump($ea_quo, $ea_rem);
664 my ($ofst, $len) = @_;
668 seek(INFILE, $ofst, 0);
670 printf("%2dbit-BE : ", $len * 8 );
673 for ( $i=0 ; $i < $len ; $i++ ) {
675 $bytedata[$i] = unpack("C", $buf );
676 $value += $bytedata[$i] << (($len - $i -1) * 8) ;
679 for ( $i=0 ; $i < $len ; $i++ ) {
680 printf("%02X", $bytedata[$i]);
683 printf(" : %s", $value);
689 my ($ofst, $len) = @_;
693 seek(INFILE, $ofst, 0);
695 printf("%2dbit-LE : ", $len * 8 );
698 for ( $i=0 ; $i < $len ; $i++ ) {
700 $bytedata[$len - $i - 1] = unpack("C", $buf );
701 $value += $bytedata[$len - $i -1] << ($i * 8) ;
704 for ( $i=0 ; $i < $len ; $i++ ) {
705 printf("%02X", $bytedata[$i]);
708 printf(" : %s", $value);
714 my ($quo, $rem) = @_;
715 my ($addrs, $line, $buf);
718 for ( $line = 0 ; $line < $quo ; $line++) {
719 read(INFILE, $buf, 16);
720 printf ( "%08X :", $addrs);
721 hexdump($buf, 16, 16, " ");
722 $addrs = $addrs + 0x10;
725 read(INFILE, $buf, $rem);
726 printf ( "%08X :", $addrs);
727 hexdump($buf, $rem, 16, " ");
733 my ($buf, $len, $col, $delimit) = @_;
739 for ( $i=0 ; $i < $len ; $i++ ) {
740 $val = substr($buf, $i, 1);
742 $hexstr .= sprintf("%s%02X", $delimit, $ascval);
744 if (($ascval < 32) || ( $ascval > 126 )) {
749 for ( ; $i < $col ; $i++) {
750 $hexstr .= " ".$delimit;
754 printf("%s : %s", $hexstr,$ascstr);