die-python 0.4.0__cp313-abi3-win_amd64.whl

die/db/db/Binary/bin.IDA.1.sg

@@ -0,0 +1,78 @@
+// Detect It Easy: detection rule file
+// Author: LinXP
+// Status: WIP
+
+init("format", "");
+includeScript("zlib");
+
+function detect() {
+    if (Binary.getSize() >= 0x20) {
+        if (Binary.compare("'IDA'..0000") && Binary.compare("DDCCBBAA", 0x1A)) {
+            var nVer = Binary.read_uint16(0x1E);
+            sVersion = nVer + ".0";
+            switch (Binary.getString(0, 4)) {
+                case "IDA0":
+                    bDetected = true;
+                    sName = "IDA Database (.IDB)"
+                    break;
+                case "IDA1":
+                    bDetected = true;
+                    sName = "IDA Database for 32-bit binary (.IDB)"
+                    break;
+                case "IDA2":
+                    bDetected = true;
+                    sName = "IDA Database for 64-bit binary (.I64)"
+                    break;
+            }
+            if (bDetected) {
+                switch (nVer) {
+                    case 2:
+                        detect_zlib(Binary, Binary.read_uint32(0x06) + 0x05);
+                        break;
+                    case 3:
+                        detect_zlib(Binary, Binary.read_uint32(0x06) + 0x05);
+                        break;
+                    case 4:
+                        detect_zlib(Binary, Binary.read_uint32(0x06) + 0x05);
+                        break;
+                    case 5:
+                        detect_zlib(Binary, Binary.read_uint32(0x06) + 0x09);
+                        break;
+                    case 6:
+                        detect_zlib(Binary, Binary.read_uint32(0x06) + 0x09);
+                        break;
+                }
+            }
+        } else if (Binary.compare("'IDASGN'")) {
+            bDetected = true;
+            sName = "IDA FLIRT Signature Database (.SIG)"
+            var nVer = Binary.read_uint8(0x06);
+            var nModules = Binary.read_uint16(0x12);
+            var nFlags = Binary.read_uint8(0x10);
+            var nLibNameSz = Binary.read_uint8(0x22);
+            var nLibNameOf = 0x25;
+            sVersion = "v" + nVer;
+            if (!nModules) {
+                nModules = Binary.read_uint32(0x25);
+                nLibNameOf += 4;
+                if (nVer >= 10) { nLibNameOf += 4; }
+            }
+            sOptions = "\"" + Binary.getString(nLibNameOf, nLibNameSz) + "\"";
+
+            if (Binary.isVerbose()) {
+                detect_zlib(Binary, nLibNameOf + nLibNameSz);
+                sOption("modules:" + nModules) // count modules
+                sOption("p:" + Binary.read_uint8(0x7)) // processor id
+                sOption("a:" + Binary.read_uint16(0xE)) // application type
+                sOption("o:" + Binary.read_uint16(0xC)) // os type
+                sOption("f:" + Binary.read_uint32(0x8)) // file format type
+            }
+        } else if (Binary.compare("'IDATIL'")) {
+            bDetected = true;
+            sName = "IDA Type Information List (.TIL)";
+            sOptions = "\"" + Binary.getString(0xF, Binary.read_uint8(0xE)) + "\"";
+        }
+    }
+
+    return result();
+}

die/db/db/Binary/bin.ISO_9660.1.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+
+init("format", "ISO 9660");
+
+function detect() {
+    if (Binary.getSize() > 0x8010) {
+        if (Binary.compare("01'CD001'01", 0x8000)) {
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

die/db/db/Binary/bin.JMDL.1.sg

@@ -0,0 +1,34 @@
+// Detect It Easy: detection rule file
+
+init("format", "Microstation Java (JMDL) Compiled Class");
+
+function detect() {
+    if (Binary.getSize() >= 8 && Binary.compare("CAFEBEEF")) {
+        // var nMinor = Binary.readBEWord(4);
+        var nMajor = Binary.readBEWord(6);
+        if (nMajor) {
+            sVersion = "JDK ";
+            switch (nMajor) {
+                case 0x2D:
+                    sVersion += "1.1";
+                    break;
+                case 0x2E:
+                    sVersion += "1.2";
+                    break;
+                case 0x2F:
+                    sVersion += "1.3";
+                    break;
+                case 0x30:
+                    sVersion += "1.4";
+                    break;
+            }
+
+            bDetected = nMajor >= 0x2D && nMajor <= 0x42;
+        }
+    }
+
+
+    _setLang("Java", bDetected);
+
+    return result();
+}

die/db/db/Binary/bin.JSC.1.sg

@@ -0,0 +1,88 @@
+// Detect It Easy: detection rule file
+// Author: LinXP
+
+init("format", "JavaScript Compiled/Bytenode (.JSC)");
+
+var VersionHash = [
+    ["11.8.172.17", "4aaade2a", "6e55fcb4"],
+    ["11.3.244.8", "88b331c0", "bc2e4000"],
+    ["10.8.168.25", "22162e5c", "866ceba8"],
+    ["10.2.154.26", "353c3291", "82a06935"],
+    ["9.6.180.15", "96a2e9d1", "77a0eea2"],
+    ["9.6.180.14", "efecf234", "15e726e8"],
+    ["9.5.172.25", "87f3c490", "7845cebc"],
+    ["9.5.172.21", "22b0877a", "d54c6bc9"],
+    ["9.4.146.26", "4f3466a4", "ee64ddac"],
+    ["9.4.146.24", "34bdcb66", "251899cd"],
+    ["9.4.146.19", "1c8f8b6a", "15375929"],
+    ["8.6.395.17", "4e4909d8", "a8d671f0"],
+    ["8.6.395.16", "2e933797", "42ff7bd2"],
+    ["8.4.371.23", "422a9510", "305d5cb4"],
+    ["8.4.371.19", "9ee57fe0", "8b279ced"],
+    ["8.3.110.9", "98545131", "878c72a5"],
+    ["8.1.307.31", "2cb9ba58", "8912ed09"],
+    ["8.1.307.30", "22d2f67c", "f8e02587"],
+    ["7.9.317.25", "e46e0ba2", "affe52ff"],
+    ["7.9.317.23", "327e22f1", "a5ef90cb"],
+    ["7.8.279.23", "f4ca7648", "2453843a"],
+    ["7.8.279.17", "533dd511", "2e4f9afd"],
+    ["7.7.299.13", "7ee98716", "8f1d647f"],
+    ["7.7.299.11", "f4bd9236", "defcacc7"],
+    ["7.6.303.29", "62a5311c", "905e664f"],
+    ["7.4.288.27", "8d2f9651", "84fec91f"],
+    ["7.5.288.22", "8176065f", "8b9ea960"],
+    ["7.4.288.21", "4e79ebb1", "27f6dd21"],
+    ["7.0.276.38", "5aa2a8c8", "261396d3"],
+    ["7.0.276.32", "302bcaf2", "1c3c201f"],
+    ["6.8.275.32", "4914c00b", "8af4d4f4"],
+    ["6.8.275.30", "34fd59c5", "91d1cc59"],
+    ["6.8.275.24", "70ff0c52", "74a2eeac"],
+    ["6.7.288.49", "f5e4a619", "aa47d109"],
+    ["6.7.288.46", "555f09bb", "6070752b"],
+    ["6.7.288.45", "3f06ef23", "ca0b678f"],
+    ["6.7.288.43", "bc67142f", "884dad18"],
+    ["6.6.346.32", "9ac1441d", "600024b1"],
+    ["6.6.346.27", "741c5f3b", "91b8852b"],
+    ["6.6.346.24", "cbb74c67", "3e6b9b38"],
+    ["6.2.414.78", "4d9d4c8d", "c2f91993"],
+    ["6.2.414.77", "2e12ba35", "818125c8"],
+    ["6.2.414.72", "90a269a0", "96890b15"],
+    ["6.2.414.66", "a8f60b85", "36eba645"],
+    ["6.2.414.54", "6ed53280", "82f11b7d"],
+    ["6.2.414.50", "ae6544a8", "bd692ce0"],
+    ["6.2.414.46", "4e617339", "81adf054"],
+    ["6.2.414.44", "c60a7c87", "7e207921"],
+    ["6.2.414.32", "42110b24", "84d039aa"],
+    ["6.1.534.50", "a0f6f0f4", "9e10b69f"],
+    ["6.1.534.48", "f14f22a0", "82467775"],
+    ["6.1.534.47", "79276eb0", "221a8fc5"],
+    ["6.1.534.46", "babe69a4", "64318412"],
+    ["6.1.534.42", "166f25d9", "9892d1c2"],
+    ["6.0.287.53", "a1bc32d4", "6fcdcd18"],
+    ["6.0.286.52", "2cf4293d", "a030b731"],
+    ["5.5.372.43", "b96063d0", "c10a0c40"],
+    ["5.1.281.111", "bb23baab", "78f44bee"],
+    ["4.6.85.32", "35a37732", "ca4b83fd"],
+    ["4.5.103.53", "15953e0e", "b217e70b"],
+    ["3.28.71.20", "26145e77", "fec9a40d"],
+];
+
+function detect() {
+    if (Binary.getSize() >= 0x20) {
+        if (Binary.compare("DEC0", 0x02)) {
+            bDetected = true;
+            for (i = 0; i < VersionHash.length; i++) {
+                if (Binary.compare(VersionHash[i][1], 0x04)) {
+                    sVersion = "v" + VersionHash[i][0] + " x86"
+                } else if (Binary.compare(VersionHash[i][2], 0x04)) {
+                    sVersion = "v" + VersionHash[i][0] + " x64"
+                };
+            }
+        }
+    }
+
+
+    _setLang("JavaScript", bDetected);
+
+    return result();
+}

die/db/db/Binary/bin.Java.1.sg

@@ -0,0 +1,152 @@
+// Detect It Easy: detection rule file
+// Author: Levis <levintaeyeon@live.com>, LinXP
+// doc-ref: https://docs.oracle.com/javase/specs/jvms/se18/html/jvms-4.html
+
+init("format", "Java Class File (.CLASS)");
+
+function detect() {
+    if (Binary.getSize() >= 8) {
+        if (Binary.compare("CAFEBABE")) {
+            var nMinor = Binary.read_uint16(0x04, _BE);
+            var nMajor = Binary.read_uint16(0x06, _BE);
+            bDetected = true;
+            switch (nMajor) {
+                case 45:
+                    sVersion = "JDK 1.1";
+                    break; // February 1997
+                case 46:
+                    sVersion = "JDK 1.2";
+                    break; // December 1998
+                case 47:
+                    sVersion = "JDK 1.3";
+                    break; // May 2000
+                case 48:
+                    sVersion = "JDK 1.4";
+                    break; // February 2002
+                case 49:
+                    sVersion = "Java SE 5.0";
+                    break; // September 2004
+                case 50:
+                    sVersion = "Java SE 6";
+                    break; // December 2006
+                case 51:
+                    sVersion = "Java SE 7";
+                    break; // July 2011
+                case 52:
+                    sVersion = "Java SE 8";
+                    break; // March 2014
+                case 53:
+                    sVersion = "Java SE 9";
+                    break; // September 2017
+                case 54:
+                    sVersion = "Java SE 10";
+                    break; // March 2018
+                case 55:
+                    sVersion = "Java SE 11";
+                    break; // September 2018
+                case 56:
+                    sVersion = "Java SE 12";
+                    break; // March 2019
+                case 57:
+                    sVersion = "Java SE 13";
+                    break; // September 2019
+                case 58:
+                    sVersion = "Java SE 14";
+                    break; // March 2020
+                case 59:
+                    sVersion = "Java SE 15";
+                    break; // September 2020
+                case 60:
+                    sVersion = "Java SE 16";
+                    break; // March 2021
+                case 61:
+                    sVersion = "Java SE 17";
+                    break; // September 2021
+                case 62:
+                    sVersion = "Java SE 18";
+                    break; // March 2022
+                case 63:
+                    sVersion = "Java SE 19";
+                    break; // September 2022
+                case 64:
+                    sVersion = "Java SE 20";
+                    break; // March 2023
+                case 65:
+                    sVersion = "Java SE 21";
+                    break; // September 2023
+                case 66:
+                    sVersion = "Java SE 22";
+                    break; // March 2024
+                case 67:
+                    sVersion = "Java SE 23";
+                    break;
+                case 68:
+                    sVersion = "Java SE 24";
+                    break;
+                default:
+                    bDetected = false;
+            }
+
+            if ((sVersion != "") && (nMinor)) {
+                sVersion += "." + nMinor;
+            }
+
+            if (bDetected && Binary.isVerbose()) {
+                var nOffset = 0x08;
+                var constant_pool_count = Binary.read_uint16(nOffset, _BE);
+                nOffset += 2;
+                for (pool = 1; pool < constant_pool_count; pool++) {
+                    switch (Binary.read_uint8(nOffset)) // Tag
+                    {
+                        case 1: // CONSTANT_Utf8
+                            nOffset += 1 + 2 + Binary.read_uint16(nOffset + 1, _BE);
+                            break;
+                        case 3: // CONSTANT_Integer
+                        case 4: // CONSTANT_Float
+                            nOffset += 1 + 4;
+                            break;
+                        case 5: // CONSTANT_Long
+                        case 6: // CONSTANT_Double
+                            nOffset += 1 + 4 + 4;
+                            break;
+                        case 7: // CONSTANT_Class
+                        case 8: // CONSTANT_String
+                        case 16: // CONSTANT_MethodType
+                            nOffset += 1 + 2;
+                            break;
+                        case 9: // CONSTANT_Fieldref
+                        case 10: // CONSTANT_Methodref
+                        case 11: // CONSTANT_InterfaceMethodref
+                        case 12: // CONSTANT_NameAndType
+                        case 18: // CONSTANT_InvokeDynamic
+                            nOffset += 1 + 2 + 2;
+                            break;
+                        case 15: // CONSTANT_MethodHandle_info
+                            nOffset += 1 + 1 + 2;
+                            break;
+                        default:
+                            sOption("err unk tag:" + nOffset);
+                    }
+                }
+                var nAccessFlagss = Binary.read_uint16(nOffset, _BE);
+                if (nAccessFlagss & 0x0001) { sOption("ACC_PUBLIC"); }
+                if (nAccessFlagss & 0x0002) { sOption("ACC_PRIVATE"); }
+                if (nAccessFlagss & 0x0004) { sOption("ACC_PROTECTED"); }
+                if (nAccessFlagss & 0x0008) { sOption("ACC_STATIC"); }
+                if (nAccessFlagss & 0x0010) { sOption("ACC_FINAL"); }
+                if (nAccessFlagss & 0x0020) { sOption("ACC_SUPER"); }
+                if (nAccessFlagss & 0x0040) { sOption("ACC_VOLATILE"); }
+                if (nAccessFlagss & 0x0080) { sOption("ACC_TRANSIENT"); }
+                if (nAccessFlagss & 0x0100) { sOption("ACC_NATIVE"); }
+                if (nAccessFlagss & 0x0200) { sOption("ACC_INTERFACE"); }
+                if (nAccessFlagss & 0x0400) { sOption("ACC_ABSTRACT"); }
+                if (nAccessFlagss & 0x0800) { sOption("ACC_STRICT"); }
+            }
+        }
+    }
+
+
+    _setLang("Java", bDetected);
+
+    return result();
+}

die/db/db/Binary/bin.KeePass.1.sg

@@ -0,0 +1,22 @@
+// Detect It Easy: detection rule file
+// Author: Arjan Onwezen
+// Info: https://gist.github.com/lgg/e6ccc6e212d18dd2ecd8a8c116fb1e45
+
+init("format", "KeePass");
+
+function detect() {
+    if (Binary.compare("03 D9 A2 9A")) {
+        bDetected = true;
+        if (Binary.compare("65 FB 4B B5", 4)) {
+            sName = "KeePass 1.x (.KBD)"
+        }
+        if (Binary.compare("66 FB 4B B5", 4)) {
+            sName = "KeePass 2.x pre-release (alpha & beta) (.KBDX)"
+        }
+        if (Binary.compare("67 FB 4B B5", 4)) {
+            sName = "KeePass 2.x (.KBDX)"
+        }
+    }
+
+    return result();
+}

die/db/db/Binary/bin.LUA.1.sg

@@ -0,0 +1,48 @@
+// Detect It Easy: detection rule file
+// Author: LinXP
+
+init("format", "Lua Bytecode (.LUAC)");
+
+function detect() {
+    if (Binary.getSize() >= 8) {
+        if (Binary.compare("1B'Lua'..00")) {
+            bDetected = true;
+            switch (Binary.read_uint8(0x04)) {
+                case 0x50:
+                    sVersion = "v5.0";
+                    break;
+                case 0x51:
+                    sVersion = "v5.1";
+                    break;
+                case 0x52:
+                    sVersion = "v5.2";
+                    break;
+                case 0x53:
+                    sVersion = "v5.3";
+                    break;
+                case 0x54:
+                    sVersion = "v5.4";
+                    break;
+                default:
+                    bDetected = false;
+            }
+            if (Binary.isVerbose()) {
+                switch (Binary.read_uint8(0x06)) {
+                    case 0:
+                        sOption("BigEndian");
+                        break;
+                    case 1:
+                        sOption("LittleEndian");
+                        break;
+                    default:
+                        bDetected = false;
+                }
+            }
+        }
+    }
+
+
+    _setLang("Lua", bDetected);
+
+    return result();
+}

die/db/db/Binary/bin.NVA.1.sg

@@ -0,0 +1,15 @@
+// Detect It Easy: detection rule file
+// Author: Tembo (http://tembolab.pl/products/executable-image-viewer.html)
+
+init("format", "NVA");
+
+function detect() {
+    if (Binary.getSize() >= 8) {
+        if (Binary.compare("'%NVA'")) {
+            sVersion = Binary.getString(5, 3);
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

die/db/db/Binary/bin.PDB.1.sg

@@ -0,0 +1,16 @@
+// Detect It Easy: detection rule file
+// doc-ref: https://en.wikipedia.org/wiki/Program_database
+
+init("format", "Microsoft Program Database (.PDB)");
+
+function detect() {
+    if (Binary.compare("'Microsoft C/C++ program database 2.00\r\n\'1A4A470000")) {
+        sVersion = "v2.00";
+        bDetected = true;
+    } else if (Binary.compare("'Microsoft C/C++ MSF 7.00\r\n'1A4453000000")) {
+        sVersion = "v7.00";
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/Binary/bin.PEFF.1.sg

@@ -0,0 +1,11 @@
+// Detect It Easy: detection rule file
+
+init("format", "Preferred Executable Format");
+
+function detect() {
+    if (Binary.compare("'Joy!peff'")) {
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/Binary/bin.PalmFile.1.sg

@@ -0,0 +1,104 @@
+// https://github.com/horsicq/Detect-It-Easy signature file
+// Author: Kaens (TG @kaens)
+// TODO parse PQA too, why not
+/* beautify ignore:start */
+
+init("format", "Palm OS file ");
+includeScript("read");
+
+function detect() {
+	//ref https://jichu4n.github.io/palm-pdb/assets/Palm%20File%20Format%20Specification.pdf
+	// & https://github.com/jichu4n/palm-os-sdk/blob/master/sdk-3.1/include/Core/System/DataPrv.h
+	var bad = '', sus = 0;
+
+	function palmDateToStr(dt,desc) {
+		// Palm OS date starts from Jan 1, 1904......
+		if(typeof desc != 'string') desc = '';
+		var msecs = new Date(1904, 0, 1).getTime() + dt * 1000;
+		var date = new Date(msecs);
+		if(!isWithin(date.getFullYear(), 1996, 2040) //...but not many file makers seem to have actually known that lol
+		 && date.getFullYear() != 1907) { // 1907 is courtesy Graffiti Sniper - Golgo 13 xmas cards. The game's from 2001
+			msecs = new Date(0).getTime() + (dt * 1000); date = new Date(msecs) }
+		if(!isWithin(date.getFullYear(), 1996, 2040) && date.getFullYear() != 1907)
+			if(isWithin(dt, 1996, 2040))
+				return 'y'+dt // some don't even realise it has a format and think it's just the year. (ZioGolf's zgrsc.pdb :D)
+			else return ''; //thankfully even with the special snowflakes it's' tight enough for detection
+		var r = date.toISOString().slice(0, 19);
+		return r.slice(0, 4) == '1907'? '2001'+r.slice(4, 19): r
+	}
+
+	const dmHdrAttrBackup = 1, dmHdrAttrLaunchableData = 2;
+	var name = X.SA(0,0x20), nc = charStat(name,true);
+	if(nc.indexOf('asc') < 0) return;
+	var attr = X.U16(0x20,_BE), v = X.U16(0x22,_BE), dtCre = X.U32(0x24,_BE), dtMod = X.U32(0x28,_BE),
+		dtBak = X.U32(0x2C,_BE), modnum = X.U32(0x30,_BE), appinfo = X.U32(0x34,_BE),
+		sortinfo = X.U32(0x38,_BE), tp = 'PDB', tp_ = X.SA(0x3C,4), by = X.SA(0x40,4);
+	var idseed = X.U32(0x44,_BE), nextrec = X.U16(0x48,_BE), numrec = X.U16(0x4C,_BE),
+		p = numrec? 0x4E: 0x50;
+	if(nextrec) bad = bad.addIfNone('!baddbdir'); //Palm specs say reject this db (artefacts of pre-v4 OSes)
+	if(!/\w{3,}/.test(by)) return;
+	switch(tp_) { case 'appl': tp = 'PRC'; break;
+		case 'pqa ': if(by == 'clpr') tp = 'PQA'; else return;
+		default:
+			if(charStat(X.readBytes(p,4),true).indexOf('allasc') >= 0) {
+				tp = 'PRC'; bad = bad.addIfNone('!badtype')} }
+	var dt = palmDateToStr(dtMod,'mod'),endp,reclen=8,m=i=0,mhk='',uniq=[];
+	if(dtMod && dt === '') sus += 2;
+	if(dtCre && palmDateToStr(dtCre,'cre') === '') sus++;
+	if(dtBak && palmDateToStr(dtBak,'bak') === '') sus++;
+
+	if(tp === 'PRC') for(reclen=10, endp = p+reclen*numrec; p < endp; p += reclen) { // PRC RsrcEntryType
+		if(p+10 > X.Sz()) { /*debug('lookahead shorted out');*/ return }
+		var hkhd = X.SA(p,4), hkid = X.U16(p+4,_BE), hkofs = X.U32(p+6,_BE);
+		if(!isWithin(hkofs,p,X.Sz()) || !/\w{3,}/.test(hkhd) || uniq.indexOf(hkofs) >= 0) return;
+		uniq.push(hkofs); if(m < hkofs) { m = hkofs; mhk = hkhd }
+		if(hkhd === 'tver') sVersion = 'v'+X.SA(m,0x100).trim()
+		}
+	else if(tp === 'PDB') for(reclen=8, endp = p+reclen*numrec; p < endp; p += reclen) { // PDB RecordEntryType
+		if(p+8 > X.Sz()) return;
+		var hkofs = X.U32(p,_BE), hkattr = X.U8(p+4), hkid = X.U24(p+5,_BE); //the ID is unique. Not in reality though
+		if(!isWithin(hkofs,p,X.Sz()) || uniq.indexOf(hkofs) >= 0) return;
+		uniq.push(hkofs); if(m < hkofs) m = hkofs
+	}
+	//else TODO parse PQA reclist
+	if(appinfo && !isWithin(appinfo,0x4E+reclen*numrec,X.Sz())
+	  || sortinfo && !isWithin(sortinfo, 0x4C+reclen*numrec, X.Sz())
+	  || appinfo && sortinfo && sortinfo < appinfo) {
+		/*debug('appinfo/sortinfo bad address');*/ return }
+
+	if(sVersion != '') sVersion = tp_.appendS(sVersion,' '); else sVersion = tp_;
+	if(appinfo && Math.abs(appinfo-p) > 0x10) {
+		//_l2r('Palm OS file',p,'appinfo should be '+Hex(appinfo));
+		return }
+	if(sus > 3) return;
+	if(tp == 'PRC')
+		if(['taic','tAIN','tver','tSTR'].indexOf(mhk) >= 0)
+			sz = outSz(X.fSig(m,-1,'00')+1); //text fields, most end with 0. Some do have 0 padding...
+		else if(mhk == 'tSTL') {
+			var ll = X.U8(m+2,_BE), z; m += 4;
+			for(i=0; i < ll && m <= X.Sz(); i++) {
+				z = X.fSig(m,TOEOF,"00");
+				if(z < 0) { bad = bad.addIfNone('!short'); break }
+				m = z+1
+			}
+			sz = outSz(m)
+		}
+		else if(['pref'].indexOf(mhk) >= 0) sz = outSz(m+10);
+		else if(X.c("'RIFF'........'WAVE'",m)) sz = outSz(m+X.U32(m+4)+8);
+		else {
+			sz = Hex(Math.max(m,p,appinfo,sortinfo))+'+'+mhk;
+			if(mhk === 'code' && !X.c("4E75",X.Sz()-2)) bad = bad.addIfNone("!noRTSatEoF")
+		}
+	else // PDB? PQA?
+		sz = Math.max(m,p)+'+'+mhk;
+
+	sName = "Palm OS file (."+tp+")"; bDetected = true;
+	if(bad != '') sVersion = sVersion.appendS('malformed'+bad,'/');
+	if(X.isVerbose()) {
+		sOption(name); sOption(by,'by:'); sOption(dt,'lastmod'+(modnum > 1? ' (×'+modnum+')':'')+':');
+		if(appinfo) sOption('appinfo');  if(sortinfo) sOption('sortinfo');  sOption(numrec,'res:'); sOption(sz,'sz:')
+	}
+
+	return result()
+}
+/* beautify ignore:end */