folkslinux
/
rpm
mirror of https://github.com/rpm-software-management/rpm.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Rip out internal libmagic, require external. 

This is going to need more sorting out...
This commit is contained in:
Panu Matilainen 2007-07-24 09:59:33 +03:00
parent 4cc65f782d
commit 68fc61fe08
237 changed files with 9 additions and 23608 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Makefile.am
View File

@ -110,9 +110,7 @@ lint:
`make -s sources -C build` \
`make -s sources -C lib` \
`make -s sources -C rpmdb` \
`make -s sources -C rpmio` \
`make -s sources -C beecrypt` \
`make -s sources -C file/src`
`make -s sources -C rpmio`
CVSTAG = r$(subst .,-,$(VERSION))

6
autogen.sh
View File

@ -38,14 +38,10 @@ fi
# XXX add missing config.rpath, kludgery around what's apparently
# gettext related stuff...
for d in . file; do
for d in . ; do
touch $d/config.rpath
done
if [ -d file ]; then
(echo "--- file"; cd file; ./autogen.sh --noconfigure "$@")
fi
echo "--- rpm"
$libtoolize --copy --force
aclocal

17
configure.ac
View File

@ -523,25 +523,20 @@ AC_SUBST(WITH_NEON_INCLUDE)
AC_SUBST(WITH_NEON_LIB)
#=================
# Check for magic library. Prefer internal, otherwise external.
# Check for magic library.
WITH_MAGIC_SUBDIR=
WITH_MAGIC_INCLUDE=
WITH_MAGIC_LIB=
if test -d file ; then
WITH_RPMFILE=rpmfile
WITH_MAGIC_SUBDIR=file
WITH_MAGIC_INCLUDE="-I\${top_srcdir}/${WITH_MAGIC_SUBDIR}/src"
WITH_MAGIC_LIB="\${top_builddir}/${WITH_MAGIC_SUBDIR}/src/libmagic.la"
else
WITH_RPMFILE=
AC_CHECK_HEADER([magic.h], [
AC_CHECK_HEADER([magic.h], [
AC_CHECK_LIB(magic, magic_open, [
WITH_MAGIC_SUBDIR=
WITH_MAGIC_INCLUDE=
WITH_MAGIC_LIB="-lmagic"
])
])
])
if test -z "${WITH_MAGIC_LIB}" ; then
AC_MSG_ERROR([rpm requires libmagic])
fi
AC_SUBST(WITH_RPMFILE)
@ -1291,7 +1286,7 @@ AC_SUBST(RPM)
AC_SUBST(OBJDUMP)
AC_CONFIG_SUBDIRS(file db3)
AC_CONFIG_SUBDIRS(db3)
AC_CONFIG_FILES([ Doxyfile Makefile rpmrc macros platform rpmpopt
rpmio/Makefile rpmdb/Makefile lib/Makefile build/Makefile

20
file/.cvsignore
View File

@ -1,20 +0,0 @@
Makefile
Makefile.in
aclocal.m4
autom4te*
config.cache
config.guess
config.h
config.h.in
config.log
config.status
config.sub
configure
depcomp
install-sh
libtool
ltconfig
ltmain.sh
missing
stamp-h*
file-*.tar.gz

231
file/ChangeLog
View File

@ -1,231 +0,0 @@
2005-06-25 11:48 Christos Zoulas <christos@zoulas.com>
* Dynamically allocate the string buffers and make the
default read size 256K.
2005-06-01 00:00 Joerg Sonnenberger <joerg@britannica.bec.de>
* Dragonfly ELF note support
2005-03-14 00:00 Giuliano Bertoletti <gb@symbolic.it>
* Avoid NULL pointer dereference in time conversion.
2005-03-06 00:00 Joerg Walter <jwalt@mail.garni.ch>
* Add indirect magic offset support, and search mode.
2005-01-12 00:00 Stepan Kasal <kasal@ucw.cz>
* src/ascmagic.c (file_ascmagic): Fix three bugs about text files:
If a CRLF text file happens to have CR at offset HOWMANY - 1
(currently 0xffff), it should not be counted as CR line
terminator.
If a line has length exactly MAXLINELEN, it should not yet be
treated as a ``very long line'', as MAXLINELEN is ``longest sane
line length''.
With CRLF, the line length was not computed correctly, and even
lines of length MAXLINELEN - 1 were treated as ``very long''.
2004-12-07 14:15 Christos Zoulas <christos@zoulas.com>
* bzip2 needs a lot of input buffer space on some files
before it can begin uncompressing. This makes file -z
fail on some bz2 files. Fix it by giving it a copy of
the file descriptor to read as much as it wants if we
have access to it. <christos@zoulas.com>
2004-11-24 12:39 Christos Zoulas <christos@zoulas.com>
* Stack smash fix, and ELF more conservative reading.
Jakub Bogusz <qboosh@pld-linux.org>
2004-11-20 18:50 Christos Zoulas <christos@zoulas.com>
* New FreeBSD version parsing code:
Jon Noack <noackjr@alumni.rice.edu>
* Hackish support for ucs16 strings <christos@zoulas.com>
2004-11-13 03:07 Christos Zoulas <christos@zoulas.com>
* print the file name and line number in syntax errors.
2004 10-12 10:50 Christos Zoulas <christos@zoulas.com>
* Fix stack overwriting on 0 length strings: Tim Waugh
<twaugh@redhat.com> Ned Ludd <solar@gentoo.org>
2004-09-27 11:30 Christos Zoulas <christos@zoulas.com>
* Remove 3rd and 4th copyright clause; approved by Ian Darwin.
* Fix small memory leaks; caught by: Tamas Sarlos
<stamas@csillag.ilab.sztaki.hu>
2004-07-24 16:33 Christos Zoulas <christos@zoulas.com>
* magic.mime update Danny Milosavljevic <danny.milo@gmx.net>
* FreeBSD version update Oliver Eikemeier <eikemeier@fillmore-labs.com>
* utime/utimes detection Ian Lance Taylor <ian@wasabisystems.com>
* errors reading elf magic Jakub Bogusz <qboosh@pld-linux.org>
2004-04-12 10:55 Christos Zoulas <christos@zoulas.com>
* make sure that magic formats match magic types during compilation
* fix broken sgi magic file
2004-04-06 20:36 Christos Zoulas <christos@zoulas.com>
* detect present of mbstate_t Petter Reinholdtsen <pere@hungry.com>
* magic fixes
2004-03-22 15:25 Christos Zoulas <christos@zoulas.com>
* Lots of mime fixes
(Joerg Ostertag) <ostertag@rechengilde.de>
* FreeBSD ELF version handling
(Edwin Groothuis) <edwin@mavetju.org>
* correct cleanup in all cases; don't just close the file.
(Christos Zoulas) <christos@zoulas.com>
* add gettext message catalogue support
(Michael Piefel) <piefel@debian.org>
* better printout for unreadable files
(Michael Piefel) <piefel@debian.org>
* compensate for missing MAXPATHLEN
(Michael Piefel) <piefel@debian.org>
* add wide character string length computation
(Michael Piefel) <piefel@debian.org>
* Avoid infinite loops caused by bad elf alignments
or name and description note sizes. Reported by
(Mikael Magnusson) <mmikael@comhem.se>
2004-03-09 13:55 Christos Zoulas <christos@zoulas.com>
* Fix possible memory leak on error and add missing regfree
(Dmitry V. Levin) <ldv@altlinux.org>
2003-12-23 12:12 Christos Zoulas <christos@zoulas.com>
* fix -k flag (Maciej W. Rozycki)
2003-11-18 14:10 Christos Zoulas <christos@zoulas.com>
* Try to give us much info as possible on corrupt elf files.
(Willy Tarreau) <willy@w.ods.org>
* Updated python bindings (Brett Funderburg)
<brettf@deepfile.com>
2003-11-11 15:03 Christos Zoulas <christos@zoulas.com>
* Include file.h first, because it includes config.h
breaks largefile test macros otherwise.
(Paul Eggert <eggert@CS.UCLA.EDU> via
Lars Hecking <lhecking@nmrc.ie>)
2003-10-14 21:39 Christos Zoulas <christos@zoulas.com>
* Python bindings (Brett Funderburg) <brettf@deepfile.com>
* Don't lookup past the end of the buffer
(Chad Hanson) <chanson@tcs-sec.com>
* Add MAGIC_ERROR and api on magic_errno()
2003-10-08 12:40 Christos Zoulas <christos@zoulas.com>
* handle error conditions from compile as fatal
(Antti Kantee) <pooka@netbsd.org>
* handle magic filename parsing sanely
* more magic fixes.
* fix a memory leak (Illes Marton) <illes.marton@balabit.hu>
* describe magic file handling
(Bryan Henderson) <bryanh@giraffe-data.com>
2003-09-12 15:09 Christos Zoulas <christos@zoulas.com>
* update magic files.
* remove largefile support from file.h; it breaks things on most OS's
2003-08-10 10:25 Christos Zoulas <christos@zoulas.com>
* fix unmapping'ing of mmaped files.
2003-07-10 12:03 Christos Zoulas <christos@zoulas.com>
* don't exit with -1 on error; always exit 1 (Marty Leisner)
* restore utimes code.
2003-06-10 17:03 Christos Zoulas <christos@zoulas.com>
* make sure we don't access uninitialized memory.
* pass lint
* #ifdef __cplusplus in magic.h
2003-05-25 19:23 Christos Zoulas <christos@zoulas.com>
* rename cvs magic file to revision to deal with
case insensitive filesystems.
2003-05-23 17:03 Christos Zoulas <christos@zoulas.com>
* documentation fixes from Michael Piefel <piefel@debian.org>
* magic fixes (various)
* revert basename magic in .mgc name determination
* buffer protection in uncompress,
signness issues,
close files
Maciej W. Rozycki <macro@ds2.pg.gda.pl
2003-04-21 20:12 Christos Zoulas <christos@zoulas.com>
* fix zsh magic
2003-04-04 16:59 Christos Zoulas <christos@zoulas.com>
* fix operand sort order in string.
2003-04-02 17:30 Christos Zoulas <christos@zoulas.com>
* cleanup namespace in magic.h
2003-04-02 13:50 Christos Zoulas <christos@zoulas.com>
* Magic additions (Alex Ott)
* Fix bug that broke VPATH compilation (Peter Breitenlohner)
2003-03-28 16:03 Christos Zoulas <christos@zoulas.com>
* remove packed attribute from magic struct.
* make the magic struct properly aligned.
* bump version number of compiled files to 2.
2003-03-27 13:10 Christos Zoulas <christos@zoulas.com>
* separate tar detection and run it before softmagic.
* fix reversed symlink test.
* fix version printing.
* make separator a string instead of a char.
* update manual page and sort options.
2003-03-26 11:00 Christos Zoulas <christos@zoulas.com>
* Pass lint
* make NULL in magic_file mean stdin
* Fix "-" argument to file to pass NULL to magic_file
* avoid pointer casts by using memcpy
* rename magic_buf -> magic_buffer
* keep only the first error
* manual page: new sentence, new line
* fix typo in api function (magic_buf -> magic_buffer)

29
file/LEGAL.NOTICE
View File

@ -1,29 +0,0 @@
$Id: LEGAL.NOTICE,v 1.14 2004/09/11 19:15:56 christos Exp $
Copyright (c) Ian F. Darwin 1986, 1987, 1989, 1990, 1991, 1992, 1994, 1995.
Software written by Ian F. Darwin and others;
maintained 1994-2004 Christos Zoulas.
This software is not subject to any export provision of the United States
Department of Commerce, and may be exported to any country or planet.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice immediately at the beginning of the file, without modification,
this list of conditions, and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.

33
file/MAINT
View File

@ -1,33 +0,0 @@
$Id: MAINT,v 1.5 2003/03/23 04:36:37 christos Exp $
Maintenance notes:
I am continuing to maintain the file command. I welcome your help,
but to make my life easier I'd like to request the following:
- Don't change the version numbers!
If your changes are extensive, I will have to work hard to
integrate them into my version. If you check it into SCCS locally,
the version numbers will likely be kept. IF you check it into RCS
or CVS locally, please use -k to keep the version numbers, and
please use branch deltas (1.21.1, 1.21.2, ...). If you don't do
this, I will likely be unable to use your changes; life's just too
short.
- Do not distribute changed versions.
People trying to be helpful occasionally put up their hacked versions
of the file command for FTP, then the "archie" server finds and publishes
the hacked version, and people all over the world get copies of it.
Within a day or two I am getting email from around the world
asking me why "my" file command won't compile!!! Needless to say this
detracts from the limited time I have available to work on the actual
software. Therefore I ask you again to please NOT distribute
your changed version.
Thank you for your assistance and cooperation.
Christos Zoulas
christos@astron.com

6
file/Makefile.am
View File

@ -1,6 +0,0 @@
# don't enforce GNU packaging standards
AUTOMAKE_OPTIONS = foreign no-dependencies
EXTRA_DIST = ChangeLog LEGAL.NOTICE MAINT PORTING README
SUBDIRS = src magic doc python

0
file/PORTING
View File

102
file/README
View File

@ -1,102 +0,0 @@
** README for file(1) Command **
@(#) $Id: README,v 1.33 2003/05/23 21:31:56 christos Exp $
This is Release 4.x of Ian Darwin's (copyright but distributable)
file(1) command. This version is the standard "file" command for Linux,
*BSD, and other systems. (See "patchlevel.h" for the exact release number).
The major feature of 4.x is the refactoring of the code into a library,
and the re-write of the file command in terms of that library. The library
itself, libmagic can be used by 3rd party programs that wish to identify
file types without having to fork() and exec() file. The prime contributor
for 4.0 was M\xe5ns Rullg\xe5rd.
UNIX is a trademark of UNIX System Laboratories.
The prime contributor to Release 3.8 was Guy Harris, who put in megachanges
including byte-order independence.
The prime contributor to Release 3.0 was Christos Zoulas, who put
in hundreds of lines of source code changes, including his own
ANSIfication of the code (I liked my own ANSIfication better, but
his (__P()) is the "Berkeley standard" way of doing it, and I wanted UCB
to include the code...), his HP-like "indirection" (a feature of
the HP file command, I think), and his mods that finally got the
uncompress (-z) mode finished and working.
This release has compiled in numerous environments; see PORTING
for a list and problems.
This fine freeware file(1) follows the USG (System V) model of the file
command, rather than the Research (V7) version or the V7-derived 4.[23]
Berkeley one. That is, the file /etc/magic contains much of the ritual
information that is the source of this program's power. My version
knows a little more magic (including tar archives) than System V; the
/etc/magic parsing seems to be compatible with the (poorly documented)
System V /etc/magic format (with one exception; see the man page).
In addition, the /etc/magic file is built from a subdirectory
for easier(?) maintenance. I will act as a clearinghouse for
magic numbers assigned to all sorts of data files that
are in reasonable circulation. Send your magic numbers,
in magic(5) format please, to the maintainer, Christos Zoulas.
LEGAL.NOTICE - read this first.
README - read this second (you are currently reading this file).
PORTING - read this only if the program won't compile.
Makefile - read this next, adapt it as needed (particularly
the location of the old existing file command and
the man page layouts), type "make" to compile,
"make try" to try it out against your old version.
Expect some diffs, particularly since your original
file(1) may not grok the embedded-space ("\ ") in
the current magic file, or may even not use the
magic file.
apprentice.c - parses /etc/magic to learn magic
ascmagic.c - third & last set of tests, based on hardwired assumptions.
core - not included in distribution due to mailer limitations.
debug.c - includes -c printout routine
file.1 - man page for the command
magic.4 - man page for the magic file, courtesy Guy Harris.
Install as magic.4 on USG and magic.5 on V7 or Berkeley; cf Makefile.
file.c - main program
file.h - header file
fsmagic.c - first set of tests the program runs, based on filesystem info
is_tar.c, tar.h - knows about tarchives (courtesy John Gilmore).
magdir - directory of /etc/magic pieces
magdir/Makefile - ADJUST THIS FOR YOUR CONFIGURATION
names.h - header file for ascmagic.c
softmagic.c - 2nd set of tests, based on /etc/magic
readelf.[ch] - Stand-alone elf parsing code.
compress.c - on-the-fly decompression.
print.c - print results, errors, warnings.
If your gzip sometimes fails to decompress things complaining about a short
file, apply this patch [which is going to be in the next version of gzip]:
*** - Tue Oct 29 02:06:35 1996
--- util.c Sun Jul 21 21:51:38 1996
*** 106,111 ****
--- 108,114 ----
if (insize == 0) {
if (eof_ok) return EOF;
+ flush_window();
read_error();
}
bytes_in += (ulg)insize;
E-mail: christos@astron.com
Phone: Do not even think of telephoning me about this program. Send cash first!
Parts of this software were developed at SoftQuad Inc., developers
of SGML/HTML/XML publishing software, in Toronto, Canada.
SoftQuad was swallowed up by Corel in 2002
and does not exist any longer.
From: Kees Zeelenberg
An MS-Windows (Win32) port of File-3.36 is available from
http://gnuwin32.sourceforge.net/
File is an implementation of the Unix File(1) command.
It knows the 'magic number' of several thousands of file types.

284
file/acinclude.m4
View File

@ -1,284 +0,0 @@
dnl cloned from autoconf 2.13 acspecific.m4
AC_DEFUN([AC_C_LONG_LONG],
[AC_CACHE_CHECK(for long long, ac_cv_c_long_long,
[if test "$GCC" = yes; then
ac_cv_c_long_long=yes
else
AC_TRY_RUN([int main() {
long long foo = 0;
exit(sizeof(long long) < sizeof(long)); }],
ac_cv_c_long_long=yes, ac_cv_c_long_long=no)
fi])
if test $ac_cv_c_long_long = yes; then
AC_DEFINE(HAVE_LONG_LONG)
fi
])
dnl from autoconf 2.13 acspecific.m4, with changes to check for daylight
AC_DEFUN([AC_STRUCT_TIMEZONE_DAYLIGHT],
[AC_REQUIRE([AC_STRUCT_TM])dnl
AC_CACHE_CHECK([for tm_zone in struct tm], ac_cv_struct_tm_zone,
[AC_TRY_COMPILE([#include <sys/types.h>
#include <$ac_cv_struct_tm>], [struct tm tm; tm.tm_zone;],
ac_cv_struct_tm_zone=yes, ac_cv_struct_tm_zone=no)])
if test "$ac_cv_struct_tm_zone" = yes; then
AC_DEFINE(HAVE_TM_ZONE,1,[HAVE_TM_ZONE])
fi
AC_CACHE_CHECK(for tzname, ac_cv_var_tzname,
[AC_TRY_LINK(
changequote(<<, >>)dnl
<<#include <time.h>
#ifndef tzname /* For SGI. */
extern char *tzname[]; /* RS6000 and others reject char **tzname. */
#endif>>,
changequote([, ])dnl
[atoi(*tzname);], ac_cv_var_tzname=yes, ac_cv_var_tzname=no)])
if test $ac_cv_var_tzname = yes; then
AC_DEFINE(HAVE_TZNAME,1,[HAVE_TZNAME])
fi
AC_CACHE_CHECK([for tm_isdst in struct tm], ac_cv_struct_tm_isdst,
[AC_TRY_COMPILE([#include <sys/types.h>
#include <$ac_cv_struct_tm>], [struct tm tm; tm.tm_isdst;],
ac_cv_struct_tm_isdst=yes, ac_cv_struct_tm_isdst=no)])
if test "$ac_cv_struct_tm_isdst" = yes; then
AC_DEFINE(HAVE_TM_ISDST)
fi
AC_CACHE_CHECK(for daylight, ac_cv_var_daylight,
[AC_TRY_LINK(
changequote(<<, >>)dnl
<<#include <time.h>
#ifndef daylight /* In case IRIX #defines this, too */
extern int daylight;
#endif>>,
changequote([, ])dnl
[atoi(daylight);], ac_cv_var_daylight=yes, ac_cv_var_daylight=no)])
if test $ac_cv_var_daylight = yes; then
AC_DEFINE(HAVE_DAYLIGHT)
fi
])
dnl from autoconf 2.13 acgeneral.m4, with patch:
dnl Date: Fri, 15 Jan 1999 05:52:41 -0800
dnl Message-ID: <199901151352.FAA18237@shade.twinsun.com>
dnl From: eggert@twinsun.com (Paul Eggert)
dnl Subject: autoconf 2.13 AC_CHECK_TYPE doesn't allow shell vars
dnl Newsgroups: gnu.utils.bug
dnl
dnl now include <stdint.h> if available
dnl AC_CHECK_TYPE2_STDC(TYPE, DEFAULT)
AC_DEFUN([AC_CHECK_TYPE2_STDC],
[AC_REQUIRE([AC_HEADER_STDC])dnl
AC_REQUIRE([AC_HEADER_STDINT])dnl
AC_MSG_CHECKING(for $1)
AC_CACHE_VAL(ac_cv_type_$1,
[AC_EGREP_CPP(dnl
[(^|[^a-zA-Z_0-9])$1[^a-zA-Z_0-9]],
[#if HAVE_STDINT_H
#include <stdint.h>
#endif
#include <sys/types.h>
#if STDC_HEADERS
#include <stdlib.h>
#include <stddef.h>
#endif], eval "ac_cv_type_$1=yes", eval "ac_cv_type_$1=no")])dnl
if eval "test \"`echo '$ac_cv_type_'$1`\" = yes"; then
AC_MSG_RESULT(yes)
else
AC_MSG_RESULT(no)
AC_DEFINE_UNQUOTED($1, $2)
fi
])
dnl from autoconf 2.13 acgeneral.m4, with additional third argument
dnl AC_CHECK_SIZEOF_INCLUDES(TYPE [, CROSS-SIZE [, INCLUDES]])
AC_DEFUN([AC_CHECK_SIZEOF_INCLUDES],
[dnl The name to #define.
define([AC_TYPE_NAME], translit(sizeof_$1, [[[a-z *]]], [[[A-Z_P]]]))dnl
dnl The cache variable name.
define([AC_CV_NAME], translit(ac_cv_sizeof_$1, [[[ *]]], [[[_p]]]))dnl
AC_MSG_CHECKING(size of $1)
AC_CACHE_VAL(AC_CV_NAME,
[AC_TRY_RUN([$3
#include <stdio.h>
main()
{
FILE *f=fopen("conftestval", "w");
if (!f) exit(1);
fprintf(f, "%d\n", sizeof($1));
exit(0);
}], AC_CV_NAME=`cat conftestval`, AC_CV_NAME=0, ifelse([$2], , , AC_CV_NAME=$2))])dnl
AC_MSG_RESULT($AC_CV_NAME)
AC_DEFINE_UNQUOTED(AC_TYPE_NAME, $AC_CV_NAME)
undefine([AC_TYPE_NAME])dnl
undefine([AC_CV_NAME])dnl
])
dnl AC_CHECK_SIZEOF_STDC_HEADERS(TYPE [, CROSS_SIZE])
AC_DEFUN([AC_CHECK_SIZEOF_STDC_HEADERS],
[AC_REQUIRE([AC_HEADER_STDC])dnl
AC_REQUIRE([AC_HEADER_STDINT])dnl
AC_CHECK_SIZEOF_INCLUDES($1, $2,
[#if HAVE_STDINT_H
#include <stdint.h>
#endif
#include <sys/types.h>
#ifdef STDC_HEADERS
#include <stdlib.h>
#endif
])
])
dnl AC_CHECK_TYPE_STDC(TYPE, DEFAULT)
AC_DEFUN([AC_CHECK_TYPE_STDC],
[AC_REQUIRE([AC_HEADER_STDC])dnl
AC_REQUIRE([AC_HEADER_STDINT])dnl
AC_MSG_CHECKING(for $1)
AC_CACHE_VAL(ac_cv_type_$1,
[AC_EGREP_CPP(dnl
[(^|[^a-zA-Z_0-9])$1[^a-zA-Z_0-9]],
[#if HAVE_STDINT_H
#include <stdint.h>
#endif
#include <sys/types.h>
#if STDC_HEADERS
#include <stdlib.h>
#include <stddef.h>
#endif], ac_cv_type_$1=yes, ac_cv_type_$1=no)])dnl
AC_MSG_RESULT($ac_cv_type_$1)
if test $ac_cv_type_$1 = no; then
AC_DEFINE($1, $2)
fi
])
dnl AC_HEADER_STDINT
AC_DEFUN([AC_HEADER_STDINT], [AC_CHECK_HEADERS(stdint.h)])
#serial 19
dnl By default, many hosts won't let programs access large files;
dnl one must use special compiler options to get large-file access to work.
dnl For more details about this brain damage please see:
dnl http://www.sas.com/standards/large.file/x_open.20Mar96.html
dnl Written by Paul Eggert <eggert@twinsun.com>.
dnl Internal subroutine of AC_SYS_LARGEFILE.
dnl AC_SYS_LARGEFILE_TEST_INCLUDES
AC_DEFUN([AC_SYS_LARGEFILE_TEST_INCLUDES],
[[#include <sys/types.h>
/* Check that off_t can represent 2**63 - 1 correctly.
We can't simply "#define LARGE_OFF_T 9223372036854775807",
since some C++ compilers masquerading as C compilers
incorrectly reject 9223372036854775807. */
# define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
&& LARGE_OFF_T % 2147483647 == 1)
? 1 : -1];
]])
dnl Internal subroutine of AC_SYS_LARGEFILE.
dnl AC_SYS_LARGEFILE_MACRO_VALUE(C-MACRO, VALUE, CACHE-VAR, COMMENT, INCLU=
DES, FUNCTION-BODY)
AC_DEFUN([AC_SYS_LARGEFILE_MACRO_VALUE],
[AC_CACHE_CHECK([for $1 value needed for large files], $3,
[$3=no
AC_TRY_COMPILE([$5],
[$6],
,
[AC_TRY_COMPILE([#define $1 $2]
[$5]
,
[$6],
[$3=$2])])])
if test "[$]$3" != no; then
AC_DEFINE_UNQUOTED([$1], [$]$3, [$4])
fi])
AC_DEFUN([AC_SYS_LARGEFILE],
[AC_REQUIRE([AC_PROG_CC])
AC_ARG_ENABLE(largefile,
[ --disable-largefile omit support for large files])
if test "$enable_largefile" != no; then
AC_CACHE_CHECK([for special C compiler options needed for large files=
],
ac_cv_sys_largefile_CC,
[ac_cv_sys_largefile_CC=no
if test "$GCC" != yes; then
# IRIX 6.2 and later do not support large files by default,
# so use the C compiler's -n32 option if that helps.
AC_TRY_COMPILE(AC_SYS_LARGEFILE_TEST_INCLUDES, , ,
[ac_save_CC="$CC"
CC="$CC -n32"
AC_TRY_COMPILE(AC_SYS_LARGEFILE_TEST_INCLUDES, ,
ac_cv_sys_largefile_CC=' -n32')
CC="$ac_save_CC"])
fi])
if test "$ac_cv_sys_largefile_CC" != no; then
CC="$CC$ac_cv_sys_largefile_CC"
fi
AC_SYS_LARGEFILE_MACRO_VALUE(_FILE_OFFSET_BITS, 64,
ac_cv_sys_file_offset_bits,
[Number of bits in a file offset, on hosts where this is settable.],
AC_SYS_LARGEFILE_TEST_INCLUDES)
AC_SYS_LARGEFILE_MACRO_VALUE(_LARGE_FILES, 1,
ac_cv_sys_large_files,
[Define for large files, on AIX-style hosts.],
AC_SYS_LARGEFILE_TEST_INCLUDES)
fi
])
AC_DEFUN([AC_FUNC_FSEEKO],
[AC_SYS_LARGEFILE_MACRO_VALUE(_LARGEFILE_SOURCE, 1,
ac_cv_sys_largefile_source,
[Define to make fseeko visible on some hosts (e.g. glibc 2.2).],
[#include <stdio.h>], [return !fseeko;])
# We used to try defining _XOPEN_SOURCE=500 too, to work around a bug
# in glibc 2.1.3, but that breaks too many other things.
# If you want fseeko and ftello with glibc, upgrade to a fixed glibc.
AC_CACHE_CHECK([for fseeko], ac_cv_func_fseeko,
[ac_cv_func_fseeko=no
AC_TRY_LINK([#include <stdio.h>],
[return fseeko && fseeko (stdin, 0, 0);],
[ac_cv_func_fseeko=yes])])
if test $ac_cv_func_fseeko != no; then
AC_DEFINE(HAVE_FSEEKO, 1,
[Define if fseeko (and presumably ftello) exists and is declared.])
fi])
# serial 9
# From Paul Eggert.
# BeOS 5 has <wchar.h> but does not define mbstate_t,
# so you can't declare an object of that type.
# Check for this incompatibility with Standard C.
# Include stdlib.h first, because otherwise this test would fail on Linux
# (at least glibc-2.1.3) because the "_XOPEN_SOURCE 500" definition elicits
# a syntax error in wchar.h due to the use of undefined __int32_t.
AC_DEFUN([AC_MBSTATE_T],
[
AC_CHECK_HEADERS(stdlib.h)
AC_CACHE_CHECK([for mbstate_t], ac_cv_type_mbstate_t,
[AC_TRY_COMPILE([
#if HAVE_STDLIB_H
# include <stdlib.h>
#endif
#include <wchar.h>],
[mbstate_t x; return sizeof x;],
ac_cv_type_mbstate_t=yes,
ac_cv_type_mbstate_t=no)])
if test $ac_cv_type_mbstate_t = no; then
AC_DEFINE(mbstate_t, int,
[Define to a type if <wchar.h> does not define.])
fi])

37
file/autogen.sh
View File

@ -1,37 +0,0 @@
#!/bin/sh
export CFLAGS
export LDFLAGS
libtoolize=`which glibtoolize 2>/dev/null`
case $libtoolize in
/*) ;;
*) libtoolize=`which libtoolize 2>/dev/null`
case $libtoolize in
/*) ;;
*) libtoolize=libtoolize
esac
esac
$libtoolize --copy --force
aclocal
autoheader
automake -a -c
autoconf
if [ "$1" = "--noconfigure" ]; then
exit 0;
fi
if [ X"$@" = X -a "X`uname -s`" = "XLinux" ]; then
if [ -d /usr/share/man ]; then
mandir=/usr/share/man
infodir=/usr/share/info
else
mandir=/usr/man
infodir=/usr/info
fi
./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --infodir=${infodir} --mandir=${mandir} --enable-static "$@"
else
./configure "$@"
fi

141
file/configure.ac
View File

@ -1,141 +0,0 @@
dnl Process this file with autoconf to produce a configure script.
AC_INIT
AC_CONFIG_SRCDIR([src/file.c])
AM_INIT_AUTOMAKE(file, 4.14)
AM_CONFIG_HEADER([config.h])
dnl AM_MAINTAINER_MODE
AC_MSG_CHECKING(for builtin ELF support)
AC_ARG_ENABLE(elf,
[ --disable-elf disable builtin ELF support],
[if test "${enableval}" = yes; then
AC_MSG_RESULT(yes)
AC_DEFINE(BUILTIN_ELF)
else
AC_MSG_RESULT(no)
fi], [
# enable by default
AC_MSG_RESULT(yes)
AC_DEFINE(BUILTIN_ELF)
])
AC_MSG_CHECKING(for ELF core file support)
AC_ARG_ENABLE(elf-core,
[ --disable-elf-core disable ELF core file support],
[if test "${enableval}" = yes; then
AC_MSG_RESULT(yes)
AC_DEFINE(ELFCORE)
else
AC_MSG_RESULT(no)
fi], [
# enable by default
AC_MSG_RESULT(yes)
AC_DEFINE(ELFCORE)
])
AC_MSG_CHECKING(for file formats in man section 5)
AC_ARG_ENABLE(fsect-man5,
[ --enable-fsect-man5 enable file formats in man section 5],
[if test "${enableval}" = yes; then
AC_MSG_RESULT(yes)
fsect=5
else
AC_MSG_RESULT(no)
fsect=4
fi], [
# disable by default
AC_MSG_RESULT(no)
fsect=4
])
AC_SUBST(fsect)
AM_CONDITIONAL(FSECT5, test x$fsect = x5)
dnl Checks for programs.
AC_PROG_CC
AC_PROG_INSTALL
AC_PROG_LN_S
AC_PROG_LIBTOOL
dnl Templates for autoheader
AH_TEMPLATE([BUILTIN_ELF],
[Use the builtin ELF recognition code])
AH_TEMPLATE([ELFCORE],
[Recognize ELF core files])
AH_TEMPLATE([HAVE_DAYLIGHT], [])
AH_TEMPLATE([HAVE_LONG_LONG], [])
AH_TEMPLATE([HAVE_TM_ISDST], [])
AH_TEMPLATE([SIZEOF_UINT16_T], [])
AH_TEMPLATE([SIZEOF_UINT32_T], [])
AH_TEMPLATE([SIZEOF_UINT64_T], [])
AH_TEMPLATE([SIZEOF_UINT8_T], [])
AH_TEMPLATE([int32_t], [])
AH_TEMPLATE([uint16_t], [])
AH_TEMPLATE([uint32_t], [])
AH_TEMPLATE([uint64_t], [])
AH_TEMPLATE([uint8_t], [])
dnl Checks for headers
AC_HEADER_STDC
AC_HEADER_MAJOR
AC_HEADER_SYS_WAIT
AC_HEADER_STDINT
AC_CHECK_HEADERS(fcntl.h locale.h)
AC_CHECK_HEADERS(sys/mman.h sys/stat.h sys/types.h)
AC_CHECK_HEADERS(stdint.h inttypes.h)
AC_CHECK_HEADERS(unistd.h)
AC_CHECK_HEADERS(getopt.h)
AC_CHECK_HEADERS(locale.h)
AC_CHECK_HEADERS(utime.h)
AC_CHECK_HEADERS(sys/utime.h)
AC_CHECK_HEADERS(wchar.h)
dnl Checks for typedefs, structures, and compiler characteristics.
AC_C_CONST
AC_TYPE_OFF_T
AC_TYPE_SIZE_T
AC_DIAGNOSE([obsolete],[AC_STRUCT_ST_RDEV:
your code should no longer depend upon `HAVE_ST_RDEV', but
`HAVE_STRUCT_STAT_ST_RDEV'. Remove this warning and
the `AC_DEFINE' when you adjust the code.])
AC_CHECK_MEMBERS([struct stat.st_rdev],[AC_DEFINE(HAVE_ST_RDEV, 1,
[Define to 1 if your `struct stat' has `st_rdev'.
Deprecated, use `HAVE_STRUCT_STAT_ST_RDEV'
instead.])])
AC_STRUCT_TIMEZONE_DAYLIGHT
AC_SYS_LARGEFILE
AC_MBSTATE_T
AC_CHECK_TYPE_STDC(uint8_t, unsigned char)
AC_CHECK_TYPE_STDC(uint16_t, unsigned short)
AC_CHECK_TYPE_STDC(uint32_t, unsigned int)
AC_CHECK_TYPE_STDC(int32_t, int)
AC_C_LONG_LONG
if test $ac_cv_c_long_long = yes; then
long64='unsigned long long';
else
long64='unsigned long';
fi
dnl This needs a patch to autoconf 2.13 acgeneral.m4
AC_CHECK_TYPE2_STDC(uint64_t, $long64)
AC_CHECK_SIZEOF_STDC_HEADERS(uint8_t, 0)
AC_CHECK_SIZEOF_STDC_HEADERS(uint16_t, 0)
AC_CHECK_SIZEOF_STDC_HEADERS(uint32_t, 0)
AC_CHECK_SIZEOF_STDC_HEADERS(uint64_t, 0)
dnl Checks for functions
AC_CHECK_FUNCS(mmap strerror strtoul mbrtowc mkstemp getopt_long utimes utime wcwidth)
dnl Checks for libraries
AC_CHECK_LIB(z,gzopen)
# XXX Choose /usr/lib or /usr/lib64 for library installs.
MARK64=
case "${target_cpu}" in
x86_64*|powerpc64*|ppc64*|sparc64*|s390x*) MARK64=64 ;;
esac
AC_SUBST(MARK64)
AC_CONFIG_FILES([Makefile src/Makefile magic/Makefile doc/Makefile python/Makefile])
AC_OUTPUT

5
file/doc/.cvsignore
View File

@ -1,5 +0,0 @@
Makefile
Makefile.in
file.1
libmagic.3
magic.4

33
file/doc/Makefile.am
View File

@ -1,33 +0,0 @@
MAGIC = $(pkgdatadir)/magic
if FSECT5
man_MAGIC = magic.5
else
man_MAGIC = magic.4
endif
fsect = @fsect@
#man_MANS = file.1 $(man_MAGIC) libmagic.3
noinst_MANS = file.1 $(man_MAGIC) libmagic.3
EXTRA_DIST = file.man magic.man libmagic.man
CLEANFILES = $(man_MANS)
file.1: Makefile file.man
@rm -f $@
sed -e s@__CSECTION__@1@g \
-e s@__FSECTION__@${fsect}@g \
-e s@__VERSION__@${VERSION}@g \
-e s@__MAGIC__@${MAGIC}@g $(srcdir)/file.man > $@
magic.${fsect}: Makefile magic.man
@rm -f $@
sed -e s@__CSECTION__@1@g \
-e s@__FSECTION__@${fsect}@g \
-e s@__VERSION__@${VERSION}@g \
-e s@__MAGIC__@${MAGIC}@g $(srcdir)/magic.man > $@
libmagic.3: Makefile libmagic.man
@rm -f $@
sed -e s@__CSECTION__@1@g \
-e s@__FSECTION__@${fsect}@g \
-e s@__VERSION__@${VERSION}@g \
-e s@__MAGIC__@${MAGIC}@g $(srcdir)/libmagic.man > $@

510
file/doc/file.man
View File

@ -1,510 +0,0 @@
.TH FILE __CSECTION__ "Copyright but distributable"
.\" $Id: file.man,v 1.55 2005/02/09 19:07:30 christos Exp $
.SH NAME
file
\- determine file type
.SH SYNOPSIS
.B file
[
.B \-bcikLnNprsvz
]
[
.B \-f
.I namefile
]
[
.B \-F
.I separator
]
[
.B \-m
.I magicfiles
]
.I file
\&...
.br
.B file
.B -C
[
.B \-m
magicfile ]
.SH DESCRIPTION
This manual page documents version __VERSION__ of the
.B file
command.
.PP
.B File
tests each argument in an attempt to classify it.
There are three sets of tests, performed in this order:
filesystem tests, magic number tests, and language tests.
The
.I first
test that succeeds causes the file type to be printed.
.PP
The type printed will usually contain one of the words
.B text
(the file contains only
printing characters and a few common control
characters and is probably safe to read on an
.SM ASCII
terminal),
.B executable
(the file contains the result of compiling a program
in a form understandable to some \s-1UNIX\s0 kernel or another),
or
.B data
meaning anything else (data is usually `binary' or non-printable).
Exceptions are well-known file formats (core files, tar archives)
that are known to contain binary data.
When modifying the file
.I __MAGIC__
or the program itself,
.B "preserve these keywords" .
People depend on knowing that all the readable files in a directory
have the word ``text'' printed.
Don't do as Berkeley did and change ``shell commands text''
to ``shell script''.
Note that the file
.I __MAGIC__
is built mechanically from a large number of small files in
the subdirectory
.I Magdir
in the source distribution of this program.
.PP
The filesystem tests are based on examining the return from a
.BR stat (2)
system call.
The program checks to see if the file is empty,
or if it's some sort of special file.
Any known file types appropriate to the system you are running on
(sockets, symbolic links, or named pipes (FIFOs) on those systems that
implement them)
are intuited if they are defined in
the system header file
.IR <sys/stat.h> .
.PP
The magic number tests are used to check for files with data in
particular fixed formats.
The canonical example of this is a binary executable (compiled program)
.I a.out
file, whose format is defined in
.I a.out.h
and possibly
.I exec.h
in the standard include directory.
These files have a `magic number' stored in a particular place
near the beginning of the file that tells the \s-1UNIX\s0 operating system
that the file is a binary executable, and which of several types thereof.
The concept of `magic number' has been applied by extension to data files.
Any file with some invariant identifier at a small fixed
offset into the file can usually be described in this way.
The information identifying these files is read from the compiled
magic file
.I __MAGIC__.mgc ,
or
.I __MAGIC__
if the compile file does not exist. In addition
.B file
will look in
.I $HOME/.magic.mgc ,
or
.I $HOME/.magic
for magic entries.
.PP
If a file does not match any of the entries in the magic file,
it is examined to see if it seems to be a text file.
ASCII, ISO-8859-x, non-ISO 8-bit extended-ASCII character sets
(such as those used on Macintosh and IBM PC systems),
UTF-8-encoded Unicode, UTF-16-encoded Unicode, and EBCDIC
character sets can be distinguished by the different
ranges and sequences of bytes that constitute printable text
in each set.
If a file passes any of these tests, its character set is reported.
ASCII, ISO-8859-x, UTF-8, and extended-ASCII files are identified
as ``text'' because they will be mostly readable on nearly any terminal;
UTF-16 and EBCDIC are only ``character data'' because, while
they contain text, it is text that will require translation
before it can be read.
In addition,
.B file
will attempt to determine other characteristics of text-type files.
If the lines of a file are terminated by CR, CRLF, or NEL, instead
of the Unix-standard LF, this will be reported.
Files that contain embedded escape sequences or overstriking
will also be identified.
.PP
Once
.B file
has determined the character set used in a text-type file,
it will
attempt to determine in what language the file is written.
The language tests look for particular strings (cf
.IR names.h )
that can appear anywhere in the first few blocks of a file.
For example, the keyword
.B .br
indicates that the file is most likely a
.BR troff (1)
input file, just as the keyword
.B struct
indicates a C program.
These tests are less reliable than the previous
two groups, so they are performed last.
The language test routines also test for some miscellany
(such as
.BR tar (1)
archives).
.PP
Any file that cannot be identified as having been written
in any of the character sets listed above is simply said to be ``data''.
.SH OPTIONS
.TP 8
.B "\-b, \-\-brief"
Do not prepend filenames to output lines (brief mode).
.TP 8
.B "\-c, \-\-checking\-printout"
Cause a checking printout of the parsed form of the magic file.
This is usually used in conjunction with
.B \-m
to debug a new magic file before installing it.
.TP 8
.B "\-C, \-\-compile"
Write a magic.mgc output file that contains a pre-parsed version of
file.
.TP 8
.BI "\-f, \-\-files\-from" " namefile"
Read the names of the files to be examined from
.I namefile
(one per line)
before the argument list.
Either
.I namefile
or at least one filename argument must be present;
to test the standard input, use ``\-'' as a filename argument.
.TP 8
.BI "\-F, \-\-separator" " separator"
Use the specified string as the separator between the filename and the
file result returned. Defaults to ``:''.
.TP 8
.B "\-i, \-\-mime"
Causes the file command to output mime type strings rather than the more
traditional human readable ones. Thus it may say
``text/plain; charset=us-ascii''
rather
than ``ASCII text''.
In order for this option to work, file changes the way
it handles files recognised by the command itself (such as many of the
text file types, directories etc), and makes use of an alternative
``magic'' file.
(See ``FILES'' section, below).
.TP 8
.B "\-k, \-\-keep\-going"
Don't stop at the first match, keep going.
.TP 8
.B "\-L, \-\-dereference"
option causes symlinks to be followed, as the like-named option in
.BR ls (1).
(on systems that support symbolic links).
.TP 8
.BI "\-m, \-\-magic\-file" " list"
Specify an alternate list of files containing magic numbers.
This can be a single file, or a colon-separated list of files.
If a compiled magic file is found alongside, it will be used instead.
With the \-i or \-\-mime option, the program adds ".mime" to each file name.
.TP 8
.B "\-n, \-\-no\-buffer"
Force stdout to be flushed after checking each file.
This is only useful if checking a list of files.
It is intended to be used by programs that want filetype output from a pipe.
.TP 8
.B "\-N, \-\-no\-pad"
Don't pad filenames so that they align in the output.
.TP 8
.B "\-p, \-\-preserve\-date"
On systems that support
.BR utime (2)
or
.BR utimes(2),
attempt to preserve the access time of files analyzed, to pretend that
.BR file (2)
never read them.
.TP 8
.B "\-r, \-\-raw"
Don't translate unprintable characters to \eooo.
Normally
.B file
translates unprintable characters to their octal representation.
.TP 8
.B "\-s, \-\-special\-files"
Normally,
.B file
only attempts to read and determine the type of argument files which
.BR stat (2)
reports are ordinary files.
This prevents problems, because reading special files may have peculiar
consequences.
Specifying the
.BR \-s
option causes
.B file
to also read argument files which are block or character special files.
This is useful for determining the filesystem types of the data in raw
disk partitions, which are block special files.
This option also causes
.B file
to disregard the file size as reported by
.BR stat (2)
since on some systems it reports a zero size for raw disk partitions.
.TP 8
.B "\-v, \-\-version"
Print the version of the program and exit.
.TP 8
.B "\-z, \-\-uncompress"
Try to look inside compressed files.
.TP 8
.B "\-\-help"
Print a help message and exit.
.SH FILES
.TP
.I __MAGIC__.mgc
Default compiled list of magic numbers
.TP
.I __MAGIC__
Default list of magic numbers
.TP
.I __MAGIC__.mime.mgc
Default compiled list of magic numbers, used to output mime types when
the -i option is specified.
.TP
.I __MAGIC__.mime
Default list of magic numbers, used to output mime types when the -i option
is specified.
.TP
.I /etc/magic
Local additions to magic wisdom.
.SH ENVIRONMENT
The environment variable
.B MAGIC
can be used to set the default magic number file name.
If that variable is set, then
.B file
will not attempt to open
.B $HOME/.magic .
.B file
adds ".mime" and/or ".mgc" to the value of this variable as appropriate.
.SH SEE ALSO
.BR magic (__FSECTION__)
\- description of magic file format.
.br
.BR strings (1), " od" (1), " hexdump(1)"
\- tools for examining non-textfiles.
.SH STANDARDS CONFORMANCE
This program is believed to exceed the System V Interface Definition
of FILE(CMD), as near as one can determine from the vague language
contained therein.
Its behaviour is mostly compatible with the System V program of the same name.
This version knows more magic, however, so it will produce
different (albeit more accurate) output in many cases.
.PP
The one significant difference
between this version and System V
is that this version treats any white space
as a delimiter, so that spaces in pattern strings must be escaped.
For example,
.br
>10 string language impress\ (imPRESS data)
.br
in an existing magic file would have to be changed to
.br
>10 string language\e impress (imPRESS data)
.br
In addition, in this version, if a pattern string contains a backslash,
it must be escaped.
For example
.br
0 string \ebegindata Andrew Toolkit document
.br
in an existing magic file would have to be changed to
.br
0 string \e\ebegindata Andrew Toolkit document
.br
.PP
SunOS releases 3.2 and later from Sun Microsystems include a
.BR file (1)
command derived from the System V one, but with some extensions.
My version differs from Sun's only in minor ways.
It includes the extension of the `&' operator, used as,
for example,
.br
>16 long&0x7fffffff >0 not stripped
.SH MAGIC DIRECTORY
The magic file entries have been collected from various sources,
mainly USENET, and contributed by various authors.
Christos Zoulas (address below) will collect additional
or corrected magic file entries.
A consolidation of magic file entries
will be distributed periodically.
.PP
The order of entries in the magic file is significant.
Depending on what system you are using, the order that
they are put together may be incorrect.
If your old
.B file
command uses a magic file,
keep the old magic file around for comparison purposes
(rename it to
.IR __MAGIC__.orig ).
.SH EXAMPLES
.nf
$ file file.c file /dev/{wd0a,hda}
file.c: C program text
file: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV),
dynamically linked (uses shared libs), stripped
/dev/wd0a: block special (0/0)
/dev/hda: block special (3/0)
$ file -s /dev/wd0{b,d}
/dev/wd0b: data
/dev/wd0d: x86 boot sector
$ file -s /dev/hda{,1,2,3,4,5,6,7,8,9,10}
/dev/hda: x86 boot sector
/dev/hda1: Linux/i386 ext2 filesystem
/dev/hda2: x86 boot sector
/dev/hda3: x86 boot sector, extended partition table
/dev/hda4: Linux/i386 ext2 filesystem
/dev/hda5: Linux/i386 swap file
/dev/hda6: Linux/i386 swap file
/dev/hda7: Linux/i386 swap file
/dev/hda8: Linux/i386 swap file
/dev/hda9: empty
/dev/hda10: empty
$ file -i file.c file /dev/{wd0a,hda}
file.c: text/x-c
file: application/x-executable, dynamically linked (uses shared libs),
not stripped
/dev/hda: application/x-not-regular-file
/dev/wd0a: application/x-not-regular-file
.fi
.SH HISTORY
There has been a
.B file
command in every \s-1UNIX\s0 since at least Research Version 4
(man page dated November, 1973).
The System V version introduced one significant major change:
the external list of magic number types.
This slowed the program down slightly but made it a lot more flexible.
.PP
This program, based on the System V version,
was written by Ian Darwin <ian@darwinsys.com>
without looking at anybody else's source code.
.PP
John Gilmore revised the code extensively, making it better than
the first version.
Geoff Collyer found several inadequacies
and provided some magic file entries.
Contributions by the `&' operator by Rob McMahon, cudcv@warwick.ac.uk, 1989.
.PP
Guy Harris, guy@netapp.com, made many changes from 1993 to the present.
.PP
Primary development and maintenance from 1990 to the present by
Christos Zoulas (christos@astron.com).
.PP
Altered by Chris Lowth, chris@lowth.com, 2000:
Handle the ``-i'' option to output mime type strings and using an alternative
magic file and internal logic.
.PP
Altered by Eric Fischer (enf@pobox.com), July, 2000,
to identify character codes and attempt to identify the languages
of non-ASCII files.
.PP
The list of contributors to the "Magdir" directory (source for the
/etc/magic
file) is too long to include here.
You know who you are; thank you.
.SH LEGAL NOTICE
Copyright (c) Ian F. Darwin, Toronto, Canada, 1986-1999.
Covered by the standard Berkeley Software Distribution copyright; see the file
LEGAL.NOTICE in the source distribution.
.PP
The files
.I tar.h
and
.I is_tar.c
were written by John Gilmore from his public-domain
.B tar
program, and are not covered by the above license.
.SH BUGS
There must be a better way to automate the construction of the Magic
file from all the glop in magdir.
What is it?
Better yet, the magic file should be compiled into binary (say,
.BR ndbm (3)
or, better yet, fixed-length
.SM ASCII
strings for use in heterogenous network environments) for faster startup.
Then the program would run as fast as the Version 7 program of the same name,
with the flexibility of the System V version.
.PP
.B File
uses several algorithms that favor speed over accuracy,
thus it can be misled about the contents of
text
files.
.PP
The support for
text
files (primarily for programming languages)
is simplistic, inefficient and requires recompilation to update.
.PP
There should be an ``else'' clause to follow a series of continuation lines.
.PP
The magic file and keywords should have regular expression support.
Their use of
.SM "ASCII TAB"
as a field delimiter is ugly and makes
it hard to edit the files, but is entrenched.
.PP
It might be advisable to allow upper-case letters in keywords
for e.g.,
.BR troff (1)
commands vs man page macros.
Regular expression support would make this easy.
.PP
The program doesn't grok \s-2FORTRAN\s0.
It should be able to figure \s-2FORTRAN\s0 by seeing some keywords which
appear indented at the start of line.
Regular expression support would make this easy.
.PP
The list of keywords in
.I ascmagic
probably belongs in the Magic file.
This could be done by using some keyword like `*' for the offset value.
.PP
Another optimisation would be to sort
the magic file so that we can just run down all the
tests for the first byte, first word, first long, etc, once we
have fetched it.
Complain about conflicts in the magic file entries.
Make a rule that the magic entries sort based on file offset rather
than position within the magic file?
.PP
The program should provide a way to give an estimate
of ``how good'' a guess is.
We end up removing guesses (e.g. ``From '' as first 5 chars of file) because
they are not as good as other guesses (e.g. ``Newsgroups:'' versus
``Return-Path:'').
Still, if the others don't pan out, it should be possible to use the
first guess.
.PP
This program is slower than some vendors' file commands.
The new support for multiple character codes makes it even slower.
.PP
This manual page, and particularly this section, is too long.
.SH AVAILABILITY
You can obtain the original author's latest version by anonymous FTP
on
.B ftp.astron.com
in the directory
.I /pub/file/file-X.YZ.tar.gz

226
file/doc/libmagic.man
View File

@ -1,226 +0,0 @@
.\"
.\" Copyright (c) Christos Zoulas 2003.
.\" All Rights Reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice immediately at the beginning of the file, without modification,
.\" this list of conditions, and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
.\" ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.Dd March 22, 2003
.Dt MAGIC 3
.Os
.Sh NAME
.Nm magic_open ,
.Nm magic_close ,
.Nm magic_error ,
.Nm magic_file ,
.Nm magic_buffer ,
.Nm magic_setflags ,
.Nm magic_check ,
.Nm magic_compile ,
.Nm magic_load
.Nd Magic number recognition library.
.Sh LIBRARY
.Lb libmagic
.Sh SYNOPSIS
.In magic.h
.Ft magic_t
.Fn magic_open "int flags"
.Ft void
.Fn magic_close "magic_t cookie"
.Ft const char *
.Fn magic_error "magic_t cookie"
.Ft int
.Fn magic_errno "magic_t cookie"
.Ft const char *
.Fn magic_file "magic_t cookie, const char *filename"
.Ft const char *
.Fn magic_buffer "magic_t cookie, const void *buffer, size_t length"
.Ft int
.Fn magic_setflags "magic_t cookie, int flags"
.Ft int
.Fn magic_check "magic_t cookie, const char *filename"
.Ft int
.Fn magic_compile "magic_t cookie, const char *filename"
.Ft int
.Fn magic_load "magic_t cookie, const char *filename"
.Sh DESCRIPTION
These functions
operate on the magic database file
which is described
in
.Xr magic __FSECTION__ .
.Pp
The function
.Fn magic_open
creates a magic cookie pointer and returns it. It returns NULL if
there was an error allocating the magic cookie. The
.Ar flags
argument specifies how the other magic functions should behave:
.Bl -tag -width MAGIC_COMPRESS
.It Dv MAGIC_NONE
No special handling.
.It Dv MAGIC_DEBUG
Print debugging messages to stderr.
.It Dv MAGIC_SYMLINK
If the file queried is a symlink, follow it.
.It Dv MAGIC_COMPRESS
If the file is compressed, unpack it and look at the contents.
.It Dv MAGIC_DEVICES
If the file is a block or character special device, then open the device
and try to look in its contents.
.It Dv MAGIC_MIME
Return a mime string, instead of a textual description.
.It Dv MAGIC_CONTINUE
Return all matches, not just the first.
.It Dv MAGIC_CHECK
Check the magic database for consistency and print warnings to stderr.
.It Dv MAGIC_PRESERVE_ATIME
On systems that support
.Xr utime 2
or
.Xr utimes 2 ,
attempt to preserve the access time of files analyzed.
.It Dv MAGIC_RAW
Don't translate unprintable characters to a \eooo octal representation.
.It Dv MAGIC_ERROR
Treat operating system errors while trying to open files and follow symlinks
as real errors, instead of printing them in the magic buffer.
.El
.Pp
The
.Fn magic_close
function closes the
.Xr magic __FSECTION__
database and deallocates any resources used.
.Pp
The
.Fn magic_error
function returns a textual explanation of the last error, or NULL if there was
no error.
.Pp
The
.Fn magic_errno
function returns the last operating system error number (
.Xr errno 3 )
that was encountered by a system call.
.Pp
The
.Fn magic_file
function returns a textual description of the contents of the
.Ar filename
argument, or NULL if an error occurred.
If the
.Ar filename
is NULL, then stdin is used.
.Pp
The
.Fn magic_buffer
function returns a textual description of the contents of the
.Ar buffer
argument with
.Ar length
bytes size.
.Pp
The
.Fn magic_setflags
function, sets the
.Ar flags
described above.
.Pp
The
.Fn magic_check
function can be used to check the validity of entries in the colon
separated database files passed in as
.Ar filename ,
or NULL for the default database. It returns 0 on success and -1 on
failure.
.Pp
The
.Fn magic_compile
function can be used to compile the the colon
separated list of database files passed in as
.Ar filename ,
or NULL for the default database. It returns 0 on success and -1 on
failure. The compiled files created are named from the
.Xr basename 1
of each file argument with ".mgc" appended to it.
.Pp
The
.Fn magic_load
function must be used to load the the colon
separated list of database files passed in as
.Ar filename ,
or NULL for the default database file
before any magic queries can performed.
.Pp
The default database file is named by the MAGIC environment variable. If
that variable is not set, the default database file name is __MAGIC__.
.Pp
.Fn magic_load
adds ".mime" and/or ".mgc" to the database filename as appropriate.
.Sh RETURN VALUES
The function
.Fn magic_open
returns a magic cookie on success and NULL on failure setting errno to
an appropriate value. It will set errno to EINVAL if an unsupported
value for flags was given.
The
.Fn magic_load ,
.Fn magic_compile ,
and
.Fn magic_check
functions return 0 on success and -1 on failure.
The
.Fn magic_file ,
and
.Fn magic_buffer
functions return a string on success and NULL on failure. The
.Fn magic_error
function returns a textual description of the errors of the above
functions, or NULL if there was no error.
Finally,
.Fn magic_setflags
returns -1 on systems that don't support
.Xr utime 2 ,
or
.Xr utimes 2
when
.Dv MAGIC_PRESERVE_ATIME
is set.
.Sh FILES
.Bl -tag -width __MAGIC__.mime.mgc -compact
.It Pa __MAGIC__.mime
The non-compiled default magic mime database.
.It Pa __MAGIC__.mime.mgc
The compiled default magic mime database.
.It Pa __MAGIC__
The non-compiled default magic database.
.It Pa __MAGIC__.mgc
The compiled default magic database.
.El
.Sh SEE ALSO
.Xr file __CSECTION__ ,
.Xr magic __FSECTION__
.Sh AUTHORS
Måns Rullgård Initial libmagic implementation,
and configuration.
Christos Zoulas API cleanup, error code and allocation handling.

373
file/doc/magic.man
View File

@ -1,373 +0,0 @@
.TH MAGIC __FSECTION__ "Public Domain"
.\" install as magic.4 on USG, magic.5 on V7 or Berkeley systems.
.SH NAME
magic \- file command's magic number file
.SH DESCRIPTION
This manual page documents the format of the magic file as
used by the
.BR file (__CSECTION__)
command, version __VERSION__.
The
.BR file
command identifies the type of a file using,
among other tests,
a test for whether the file begins with a certain
.IR "magic number" .
The file
.I __MAGIC__
specifies what magic numbers are to be tested for,
what message to print if a particular magic number is found,
and additional information to extract from the file.
.PP
Each line of the file specifies a test to be performed.
A test compares the data starting at a particular offset
in the file with a 1-byte, 2-byte, or 4-byte numeric value or
a string.
If the test succeeds, a message is printed.
The line consists of the following fields:
.IP offset \w'message'u+2n
A number specifying the offset, in bytes, into the file of the data
which is to be tested.
.IP type
The type of the data to be tested.
The possible values are:
.RS
.IP byte \w'message'u+2n
A one-byte value.
.IP short
A two-byte value (on most systems) in this machine's native byte order.
.IP long
A four-byte value (on most systems) in this machine's native byte order.
.IP string
A string of bytes.
The string type specification can be optionally followed
by /[Bbc]*.
The ``B'' flag compacts whitespace in the target, which must
contain at least one whitespace character.
If the magic has
.I n
consecutive blanks, the target needs at least
.I n
consecutive blanks to match.
The ``b'' flag treats every blank in the target as an optional blank.
Finally the ``c'' flag, specifies case insensitive matching: lowercase
characters in the magic match both lower and upper case characters in the
targer, whereas upper case characters in the magic, only much uppercase
characters in the target.
.IP date
A four-byte value interpreted as a UNIX date.
.IP ldate
A four-byte value interpreted as a UNIX-style date, but interpreted as
local time rather than UTC.
.IP beshort
A two-byte value (on most systems) in big-endian byte order.
.IP belong
A four-byte value (on most systems) in big-endian byte order.
.IP bedate
A four-byte value (on most systems) in big-endian byte order,
interpreted as a Unix date.
.IP leshort
A two-byte value (on most systems) in little-endian byte order.
.IP lelong
A four-byte value (on most systems) in little-endian byte order.
.IP ledate
A four-byte value (on most systems) in little-endian byte order,
interpreted as a UNIX date.
.IP leldate
A four-byte value (on most systems) in little-endian byte order,
interpreted as a UNIX-style date, but interpreted as local time rather
than UTC.
.IP regex
A regular expression match in extended POSIX regular expression syntax
(much like egrep).
The type specification can be optionally followed by
.B /c
for case-insensitive matches.
The regular expression is always
tested against the first
.B N
lines, where
.B N
is the given offset, thus it
is only useful for (single-byte encoded) text.
.B ^
and
.B $
will match the beginning and end of individual lines, respectively,
not beginning and end of file.
.IP search
A literal string search starting at the given offset. It must be followed by
.B /<number>
which specifies how many matches shall be attempted (the range).
This is suitable for searching larger binary expressions with variable
offsets, using
.B \e
escapes for special characters.
.RE
.PP
The numeric types may optionally be followed by
.B &
and a numeric value,
to specify that the value is to be AND'ed with the
numeric value before any comparisons are done.
Prepending a
.B u
to the type indicates that ordered comparisons should be unsigned.
.IP test
The value to be compared with the value from the file.
If the type is
numeric, this value
is specified in C form; if it is a string, it is specified as a C string
with the usual escapes permitted (e.g. \en for new-line).
.IP
Numeric values
may be preceded by a character indicating the operation to be performed.
It may be
.BR = ,
to specify that the value from the file must equal the specified value,
.BR < ,
to specify that the value from the file must be less than the specified
value,
.BR > ,
to specify that the value from the file must be greater than the specified
value,
.BR & ,
to specify that the value from the file must have set all of the bits
that are set in the specified value,
.BR ^ ,
to specify that the value from the file must have clear any of the bits
that are set in the specified value, or
.BR x ,
to specify that any value will match.
If the character is omitted, it is assumed to be
.BR = .
For all tests except
.B string
and
.B regex,
operation
.BR !
specifies that the line matches if the test does
.B not
succeed.
.IP
Numeric values are specified in C form; e.g.
.B 13
is decimal,
.B 013
is octal, and
.B 0x13
is hexadecimal.
.IP
For string values, the byte string from the
file must match the specified byte string.
The operators
.BR = ,
.B <
and
.B >
(but not
.BR & )
can be applied to strings.
The length used for matching is that of the string argument
in the magic file.
This means that a line can match any string, and
then presumably print that string, by doing
.B >\e0
(because all strings are greater than the null string).
.IP message
The message to be printed if the comparison succeeds. If the string
contains a
.BR printf (3)
format specification, the value from the file (with any specified masking
performed) is printed using the message as the format string.
.PP
Some file formats contain additional information which is to be printed
along with the file type or need additional tests to determine the true
file type.
These additional tests are introduced by one or more
.B >
characters preceding the offset.
The number of
.B >
on the line indicates the level of the test; a line with no
.B >
at the beginning is considered to be at level 0.
Tests are arranged in a tree-like hierarchy:
If a the test on a line at level
.IB n
succeeds, all following tests at level
.IB n+1
are performed, and the messages printed if the tests succeed, untile a line
with level
.IB n
(or less) appears.
For more complex files, one can use empty messages to get just the
"if/then" effect, in the following way:
.sp
.nf
0 string MZ
>0x18 leshort <0x40 MS-DOS executable
>0x18 leshort >0x3f extended PC executable (e.g., MS Windows)
.fi
.PP
Offsets do not need to be constant, but can also be read from the file
being examined.
If the first character following the last
.B >
is a
.B (
then the string after the parenthesis is interpreted as an indirect offset.
That means that the number after the parenthesis is used as an offset in
the file.
The value at that offset is read, and is used again as an offset
in the file.
Indirect offsets are of the form:
.BI (( x [.[bslBSL]][+\-][ y ]).
The value of
.I x
is used as an offset in the file. A byte, short or long is read at that offset
depending on the
.B [bslBSL]
type specifier.
The capitalized types interpret the number as a big endian
value, whereas the small letter versions interpret the number as a little
endian value.
To that number the value of
.I y
is added and the result is used as an offset in the file.
The default type if one is not specified is long.
.PP
That way variable length structures can be examined:
.sp
.nf
# MS Windows executables are also valid MS-DOS executables
0 string MZ
>0x18 leshort <0x40 MZ executable (MS-DOS)
# skip the whole block below if it is not an extended executable
>0x18 leshort >0x3f
>>(0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
>>(0x3c.l) string LX\e0\e0 LX executable (OS/2)
.fi
.PP
This strategy of examining has one drawback: You must make sure that
you eventually print something, or users may get empty output (like, when
there is neither PE\e0\e0 nor LE\e0\e0 in the above example)
.PP
If this indirect offset cannot be used as-is, there are simple calculations
possible: appending
.BI [+-*/%&|^]<number>
inside parentheses allows one to modify
the value read from the file before it is used as an offset:
.sp
.nf
# MS Windows executables are also valid MS-DOS executables
0 string MZ
# sometimes, the value at 0x18 is less that 0x40 but there's still an
# extended executable, simply appended to the file
>0x18 leshort <0x40
>>(4.s*512) leshort 0x014c COFF executable (MS-DOS, DJGPP)
>>(4.s*512) leshort !0x014c MZ executable (MS-DOS)
.fi
.PP
Sometimes you do not know the exact offset as this depends on the length or
position (when indirection was used before) of preceding fields. You can
specify an offset relative to the end of the last uplevel field using
.BI &
as a prefix to the offset:
.sp
.nf
0 string MZ
>0x18 leshort >0x3f
>>(0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
# immediately following the PE signature is the CPU type
>>>&0 leshort 0x14c for Intel 80386
>>>&0 leshort 0x184 for DEC Alpha
.fi
.PP
Indirect and relative offsets can be combined:
.sp
.nf
0 string MZ
>0x18 leshort <0x40
>>(4.s*512) leshort !0x014c MZ executable (MS-DOS)
# if it's not COFF, go back 512 bytes and add the offset taken
# from byte 2/3, which is yet another way of finding the start
# of the extended executable
>>>&(2.s-514) string LE LE executable (MS Windows VxD driver)
.fi
.PP
Or the other way around:
.sp
.nf
0 string MZ
>0x18 leshort >0x3f
>>(0x3c.l) string LE\e0\e0 LE executable (MS-Windows)
# at offset 0x80 (-4, since relative offsets start at the end
# of the uplevel match) inside the LE header, we find the absolute
# offset to the code area, where we look for a specific signature
>>>(&0x7c.l+0x26) string UPX \eb, UPX compressed
.fi
.PP
Or even both!
.sp
.nf
0 string MZ
>0x18 leshort >0x3f
>>(0x3c.l) string LE\e0\e0 LE executable (MS-Windows)
# at offset 0x58 inside the LE header, we find the relative offset
# to a data area where we look for a specific signature
>>>&(&0x54.l-3) string UNACE \eb, ACE self-extracting archive
.fi
.PP
Finally, if you have to deal with offset/length pairs in your file, even the
second value in a parenthesed expression can be taken from the file itself,
using another set of parentheses. Note that this additional indirect offset
is always relative to the start of the main indirect offset.
.sp
.nf
0 string MZ
>0x18 leshort >0x3f
>>(0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
# search for the PE section called ".idata"...
>>>&0xf4 search/0x140 .idata
# ...and go to the end of it, calculated from start+length;
# these are located 14 and 10 bytes after the section name
>>>>(&0xe.l+(-4)) string PK\e3\e4 \eb, ZIP self-extracting archive
.fi
.SH BUGS
The formats
.IR long ,
.IR belong ,
.IR lelong ,
.IR short ,
.IR beshort ,
.IR leshort ,
.IR date ,
.IR bedate ,
and
.I ledate
are system-dependent; perhaps they should be specified as a number
of bytes (2B, 4B, etc),
since the files being recognized typically come from
a system on which the lengths are invariant.
.PP
There is (currently) no support for specified-endian data to be used in
indirect offsets.
.SH SEE ALSO
.BR file (__CSECTION__)
\- the command that reads this file.
.\"
.\" From: guy@sun.uucp (Guy Harris)
.\" Newsgroups: net.bugs.usg
.\" Subject: /etc/magic's format isn't well documented
.\" Message-ID: <2752@sun.uucp>
.\" Date: 3 Sep 85 08:19:07 GMT
.\" Organization: Sun Microsystems, Inc.
.\" Lines: 136
.\"
.\" Here's a manual page for the format accepted by the "file" made by adding
.\" the changes I posted to the S5R2 version.
.\"
.\" Modified for Ian Darwin's version of the file command.
.\" @(#)$Id: magic.man,v 1.28 2005/03/17 17:34:15 christos Exp $

4
file/magic/.cvsignore
View File

@ -1,4 +0,0 @@
Makefile
Makefile.in
magic
*.mgc

5
file/magic/Header
View File

@ -1,5 +0,0 @@
# Magic
# Magic data for file(1) command.
# Machine-generated from src/cmd/file/magdir/*; edit there only!
# Format is described in magic(files), where:
# files is 5 on V7 and BSD, 4 on SV, and ?? in the SVID.

16
file/magic/Localstuff
View File

@ -1,16 +0,0 @@
#------------------------------------------------------------------------------
# Localstuff: file(1) magic for locally observed files
#
# $Id: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $
# Add any locally observed files here. Remember:
# text if readable, executable if runnable binary, data if unreadable.
# XXX promoted from tex so that *.tfm is not mis-identified as mc68k file.
# There is no way to detect TeX Font Metric (*.tfm) files without
# breaking them apart and reading the data. The following patterns
# match most *.tfm files generated by METAFONT or afm2tfm.
2 string \000\021 TeX font metric data
>33 string >\0 (%s)
2 string \000\022 TeX font metric data
>33 string >\0 (%s)

32
file/magic/Magdir/acorn
View File

@ -1,32 +0,0 @@
#------------------------------------------------------------------------------
# acorn: file(1) magic for files found on Acorn systems
#
# RISC OS Chunk File Format
# From RISC OS Programmer's Reference Manual, Appendix D
# We guess the file type from the type of the first chunk.
0 lelong 0xc3cbc6c5 RISC OS Chunk data
>12 string OBJ_ \b, AOF object
>12 string LIB_ \b, ALF library
# RISC OS AIF, contains "SWI OS_Exit" at offset 16.
16 lelong 0xef000011 RISC OS AIF executable
# RISC OS Draw files
# From RISC OS Programmer's Reference Manual, Appendix E
0 string Draw RISC OS Draw file data
# RISC OS new format font files
# From RISC OS Programmer's Reference Manual, Appendix E
0 string FONT\0 RISC OS outline font data,
>5 byte x version %d
0 string FONT\1 RISC OS 1bpp font data,
>5 byte x version %d
0 string FONT\4 RISC OS 4bpp font data
>5 byte x version %d
# RISC OS Music files
# From RISC OS Programmer's Reference Manual, Appendix E
0 string Maestro\r RISC OS music file
>8 byte x version %d

12
file/magic/Magdir/adi
View File

@ -1,12 +0,0 @@
#------------------------------------------------------------------------------
# adi: file(1) magic for ADi's objects
# From Gregory McGarry <g.mcgarry@ieee.org>
#
0 leshort 0x521c COFF DSP21k
>18 lelong &02 executable,
>18 lelong ^02
>>18 lelong &01 static object,
>>18 lelong ^01 relocatable object,
>18 lelong &010 stripped
>18 lelong ^010 not stripped

75
file/magic/Magdir/adventure
View File

@ -1,75 +0,0 @@
#------------------------------------------------------------------------------
# adventure: file(1) magic for Adventure game files
#
# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
#
# ALAN
# I assume there are other, lower versions, but these are the only ones I
# saw in the archive.
0 beshort 0x0206 ALAN game data
>2 byte <10 version 2.6%d
# Infocom (see z-machine)
#------------------------------------------------------------------------------
# Z-machine: file(1) magic for Z-machine binaries.
#
# This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which
# appears to be a version-0 Z-machine binary.
#
# The (false match) message is to correct that behavior. Perhaps it is
# not needed.
#
16 belong&0xfe00f0f0 0x3030 Infocom game data
>0 ubyte 0 (false match)
>0 ubyte >0 (Z-machine %d,
>>2 ubeshort x Release %d /
>>18 string >\0 Serial %.6s)
#------------------------------------------------------------------------------
# Glulx: file(1) magic for Glulx binaries.
#
# I haven't checked for false matches yet.
#
0 string Glul Glulx game data
>4 beshort x (Version %d
>>6 byte x \b.%d
>>8 byte x \b.%d)
>36 string Info Compiled by Inform
# For Quetzal and blorb magic see iff
# TADS (Text Adventure Development System)
# All files are machine-independent (games compile to byte-code) and are tagged
# with a version string of the form "V2.<digit>.<digit>\0" (but TADS 3 is
# on the way).
# Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
0 string TADS2\ bin TADS
>9 belong !0x0A0D1A00 game data, CORRUPTED
>9 belong 0x0A0D1A00
>>13 string >\0 %s game data
# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
0 string TADS2\ rsc TADS
>9 belong !0x0A0D1A00 resource data, CORRUPTED
>9 belong 0x0A0D1A00
>>13 string >\0 %s resource data
# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
# 2-byte length N, the N-char name of the game file *without* a NUL (darn!),
# "TADS2 save\n\r\032\0" and the interpreter version.
0 string TADS2\ save/g TADS
>12 belong !0x0A0D1A00 saved game data, CORRUPTED
>12 belong 0x0A0D1A00
>>(16.s+32) string >\0 %s saved game data
# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
# version.
0 string TADS2\ save TADS
>10 belong !0x0A0D1A00 saved game data, CORRUPTED
>10 belong 0x0A0D1A00
>>14 string >\0 %s saved game data

7
file/magic/Magdir/allegro
View File

@ -1,7 +0,0 @@
#------------------------------------------------------------------------------
# allegro: file(1) magic for Allegro datafiles
# Toby Deshane <hac@shoelace.digivill.net>
#
0 belong 0x736C6821 Allegro datafile (packed)
0 belong 0x736C682E Allegro datafile (not packed/autodetect)
0 belong 0x736C682B Allegro datafile (appended exe data)

17
file/magic/Magdir/alliant
View File

@ -1,17 +0,0 @@
#------------------------------------------------------------------------------
# alliant: file(1) magic for Alliant FX series a.out files
#
# If the FX series is the one that had a processor with a 68K-derived
# instruction set, the "short" should probably become "beshort" and the
# "long" should probably become "belong".
# If it's the i860-based one, they should probably become either the
# big-endian or little-endian versions, depending on the mode they ran
# the 860 in....
#
0 short 0420 0420 Alliant virtual executable
>2 short &0x0020 common library
>16 long >0 not stripped
0 short 0421 0421 Alliant compact executable
>2 short &0x0020 common library
>16 long >0 not stripped

30
file/magic/Magdir/alpha
View File

@ -1,30 +0,0 @@
#------------------------------------------------------------------------------
# alpha architecture description
#
0 leshort 0603 COFF format alpha
>22 leshort&030000 !020000 executable
>24 leshort 0410 pure
>24 leshort 0413 paged
>22 leshort&020000 !0 dynamically linked
>16 lelong !0 not stripped
>16 lelong 0 stripped
>22 leshort&030000 020000 shared library
>24 leshort 0407 object
>27 byte x - version %d
>26 byte x .%d
>28 byte x -%d
# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
#
# The actual magic number is just "Core", followed by a 2-byte version
# number; however, treating any file that begins with "Core" as a Digital
# UNIX core dump file may produce too many false hits, so we include one
# byte of the version number as well; DU 5.0 appears only to be up to
# version 2.
#
0 string Core\001 Alpha COFF format core dump (Digital UNIX)
>24 string >\0 \b, from '%s'
0 string Core\002 Alpha COFF format core dump (Digital UNIX)
>24 string >\0 \b, from '%s'

10
file/magic/Magdir/amanda
View File

@ -1,10 +0,0 @@
#------------------------------------------------------------------------------
# amanda: file(1) magic for amanda file format
#
0 string AMANDA:\ AMANDA
>8 string TAPESTART\ DATE tape header file,
>>23 string X
>>>25 string >\ Unused %s
>>23 string >\ DATE %s
>8 string FILE\ dump file,
>>13 string >\ DATE %s

56
file/magic/Magdir/amigaos
View File

@ -1,56 +0,0 @@
#------------------------------------------------------------------------------
# amigaos: file(1) magic for AmigaOS binary formats:
#
# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
#
0 belong 0x000003fa AmigaOS shared library
0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary
0 belong 0x000003e7 AmigaOS object/library data
#
0 beshort 0xe310 Amiga Workbench
>2 beshort 1
>>48 byte 1 disk icon
>>48 byte 2 drawer icon
>>48 byte 3 tool icon
>>48 byte 4 project icon
>>48 byte 5 garbage icon
>>48 byte 6 device icon
>>48 byte 7 kickstart icon
>>48 byte 8 workbench application icon
>2 beshort >1 icon, vers. %d
#
# various sound formats from the Amiga
# G=F6tz Waschk <waschk@informatik.uni-rostock.de>
#
0 string FC14 Future Composer 1.4 Module sound file
0 string SMOD Future Composer 1.3 Module sound file
0 string AON4artofnoise Art Of Noise Module sound file
1 string MUGICIAN/SOFTEYES Mugician Module sound file
58 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file
0 string Synth4.0 Synthesis Module sound file
0 string ARP. The Holy Noise Module sound file
0 string BeEp\0 JamCracker Module sound file
0 string COSO\0 Hippel-COSO Module sound file
# Too simple (short, pure ASCII, deep), MPi
#26 string V.3 Brian Postma's Soundmon Module sound file v3
#26 string BPSM Brian Postma's Soundmon Module sound file v3
#26 string V.2 Brian Postma's Soundmon Module sound file v2
# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
0 beshort 0x0f00 AmigaOS bitmap font
0 beshort 0x0f03 AmigaOS outline font
0 belong 0x80001001 AmigaOS outline tag
0 string ##\ version catalog translation
# Amiga disk types
#
0 string RDSK Rigid Disk Block
>160 string x on %.24s
0 string DOS\0 Amiga DOS disk
0 string DOS\1 Amiga FFS disk
0 string DOS\2 Amiga Inter DOS disk
0 string DOS\3 Amiga Inter FFS disk
0 string DOS\4 Amiga Fastdir DOS disk
0 string DOS\5 Amiga Fastdir FFS disk
0 string KICK Kickstart disk

676
file/magic/Magdir/animation
View File

@ -1,676 +0,0 @@
#------------------------------------------------------------------------------
# animation: file(1) magic for animation/movie formats
#
# animation formats
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
# SGI and Apple formats
0 string MOVI Silicon Graphics movie file
4 string moov Apple QuickTime
>12 string mvhd \b movie (fast start)
>12 string mdra \b URL
>12 string cmov \b movie (fast start, compressed header)
>12 string rmra \b multiple URLs
4 string mdat Apple QuickTime movie (unoptimized)
4 string wide Apple QuickTime movie (unoptimized)
4 string skip Apple QuickTime movie (modified)
4 string free Apple QuickTime movie (modified)
4 string idsc Apple QuickTime image (fast start)
4 string idat Apple QuickTime image (unoptimized)
4 string pckg Apple QuickTime compressed archive
4 string/B jP JPEG 2000 image
4 string ftyp ISO Media
>8 string isom \b, MPEG v4 system, version 1
>8 string iso2 \b, MPEG v4 system, part 12 revision
>8 string mp41 \b, MPEG v4 system, version 1
>8 string mp42 \b, MPEG v4 system, version 2
>8 string mp7t \b, MPEG v4 system, MPEG v7 XML
>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML
>8 string/B jp2 \b, JPEG 2000
>8 string 3gp \b, MPEG v4 system, 3GPP
>>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
>>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile
>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC
>8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC
>8 string/B M4P \b, MPEG v4 system, iTunes AES encrypted
>8 string/B M4B \b, MPEG v4 system, iTunes bookmarked
>8 string/B qt \b, Apple QuickTime movie
# MPEG sequences
# Scans for all common MPEG header start codes
0 belong 0x00000001 JVT NAL sequence
>4 byte&0x1F 0x07 \b, H.264 video
>>5 byte 66 \b, baseline
>>5 byte 77 \b, main
>>5 byte 88 \b, extended
>>7 byte x \b @ L %u
0 belong&0xFFFFFF00 0x00000100 MPEG sequence
>3 byte 0xBA
>>4 byte &0x40 \b, v2, program multiplex
>>4 byte ^0x40 \b, v1, system multiplex
>3 byte 0xBB \b, v1/2, multiplex (missing pack header)
>3 byte&0x1F 0x07 \b, H.264 video
>>4 byte 66 \b, baseline
>>4 byte 77 \b, main
>>4 byte 88 \b, extended
>>6 byte x \b @ L %u
>3 byte 0xB0 \b, v4
>>5 belong 0x000001B5
>>>9 byte &0x80
>>>>10 byte&0xF0 16 \b, video
>>>>10 byte&0xF0 32 \b, still texture
>>>>10 byte&0xF0 48 \b, mesh
>>>>10 byte&0xF0 64 \b, face
>>>9 byte&0xF8 8 \b, video
>>>9 byte&0xF8 16 \b, still texture
>>>9 byte&0xF8 24 \b, mesh
>>>9 byte&0xF8 32 \b, face
>>4 byte 1 \b, simple @ L1
>>4 byte 2 \b, simple @ L2
>>4 byte 3 \b, simple @ L3
>>4 byte 4 \b, simple @ L0
>>4 byte 17 \b, simple scalable @ L1
>>4 byte 18 \b, simple scalable @ L2
>>4 byte 33 \b, core @ L1
>>4 byte 34 \b, core @ L2
>>4 byte 50 \b, main @ L2
>>4 byte 51 \b, main @ L3
>>4 byte 53 \b, main @ L4
>>4 byte 66 \b, n-bit @ L2
>>4 byte 81 \b, scalable texture @ L1
>>4 byte 97 \b, simple face animation @ L1
>>4 byte 98 \b, simple face animation @ L2
>>4 byte 99 \b, simple face basic animation @ L1
>>4 byte 100 \b, simple face basic animation @ L2
>>4 byte 113 \b, basic animation text @ L1
>>4 byte 114 \b, basic animation text @ L2
>>4 byte 129 \b, hybrid @ L1
>>4 byte 130 \b, hybrid @ L2
>>4 byte 145 \b, advanced RT simple @ L!
>>4 byte 146 \b, advanced RT simple @ L2
>>4 byte 147 \b, advanced RT simple @ L3
>>4 byte 148 \b, advanced RT simple @ L4
>>4 byte 161 \b, core scalable @ L1
>>4 byte 162 \b, core scalable @ L2
>>4 byte 163 \b, core scalable @ L3
>>4 byte 177 \b, advanced coding efficiency @ L1
>>4 byte 178 \b, advanced coding efficiency @ L2
>>4 byte 179 \b, advanced coding efficiency @ L3
>>4 byte 180 \b, advanced coding efficiency @ L4
>>4 byte 193 \b, advanced core @ L1
>>4 byte 194 \b, advanced core @ L2
>>4 byte 209 \b, advanced scalable texture @ L1
>>4 byte 210 \b, advanced scalable texture @ L2
>>4 byte 211 \b, advanced scalable texture @ L3
>>4 byte 225 \b, simple studio @ L1
>>4 byte 226 \b, simple studio @ L2
>>4 byte 227 \b, simple studio @ L3
>>4 byte 228 \b, simple studio @ L4
>>4 byte 229 \b, core studio @ L1
>>4 byte 230 \b, core studio @ L2
>>4 byte 231 \b, core studio @ L3
>>4 byte 232 \b, core studio @ L4
>>4 byte 240 \b, advanced simple @ L0
>>4 byte 241 \b, advanced simple @ L1
>>4 byte 242 \b, advanced simple @ L2
>>4 byte 243 \b, advanced simple @ L3
>>4 byte 244 \b, advanced simple @ L4
>>4 byte 245 \b, advanced simple @ L5
>>4 byte 247 \b, advanced simple @ L3b
>>4 byte 248 \b, FGS @ L0
>>4 byte 249 \b, FGS @ L1
>>4 byte 250 \b, FGS @ L2
>>4 byte 251 \b, FGS @ L3
>>4 byte 252 \b, FGS @ L4
>>4 byte 253 \b, FGS @ L5
>3 byte 0xB5 \b, v4
>>4 byte &0x80
>>>5 byte&0xF0 16 \b, video (missing profile header)
>>>5 byte&0xF0 32 \b, still texture (missing profile header)
>>>5 byte&0xF0 48 \b, mesh (missing profile header)
>>>5 byte&0xF0 64 \b, face (missing profile header)
>>4 byte&0xF8 8 \b, video (missing profile header)
>>4 byte&0xF8 16 \b, still texture (missing profile header)
>>4 byte&0xF8 24 \b, mesh (missing profile header)
>>4 byte&0xF8 32 \b, face (missing profile header)
>3 byte 0xB3
>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
>>12 belong 0x000001B5 \b, v2,
>>>16 byte&0x0F 1 \b HP
>>>16 byte&0x0F 2 \b Spt
>>>16 byte&0x0F 3 \b SNR
>>>16 byte&0x0F 4 \b MP
>>>16 byte&0x0F 5 \b SP
>>>17 byte&0xF0 64 \b@HL
>>>17 byte&0xF0 96 \b@H-14
>>>17 byte&0xF0 128 \b@ML
>>>17 byte&0xF0 160 \b@LL
>>>17 byte &0x08 \b progressive
>>>17 byte ^0x08 \b interlaced
>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video
>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video
>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video
>>11 byte &0x02
>>>75 byte &0x01
>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
>>>>140 belong 0x000001B5 \b, v2,
>>>>>144 byte&0x0F 1 \b HP
>>>>>144 byte&0x0F 2 \b Spt
>>>>>144 byte&0x0F 3 \b SNR
>>>>>144 byte&0x0F 4 \b MP
>>>>>144 byte&0x0F 5 \b SP
>>>>>145 byte&0xF0 64 \b@HL
>>>>>145 byte&0xF0 96 \b@H-14
>>>>>145 byte&0xF0 128 \b@ML
>>>>>145 byte&0xF0 160 \b@LL
>>>>>145 byte &0x08 \b progressive
>>>>>145 byte ^0x08 \b interlaced
>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video
>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video
>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video
>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
>>76 belong 0x000001B5 \b, v2,
>>>80 byte&0x0F 1 \b HP
>>>80 byte&0x0F 2 \b Spt
>>>80 byte&0x0F 3 \b SNR
>>>80 byte&0x0F 4 \b MP
>>>80 byte&0x0F 5 \b SP
>>>81 byte&0xF0 64 \b@HL
>>>81 byte&0xF0 96 \b@H-14
>>>81 byte&0xF0 128 \b@ML
>>>81 byte&0xF0 160 \b@LL
>>>81 byte &0x08 \b progressive
>>>81 byte ^0x08 \b interlaced
>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video
>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video
>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video
>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P
>>>7 byte&0xF0 0x10 \b, 16:9
>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I
>>>7 byte&0xF0 0x10 \b, 16:9
>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture
>>>7 byte&0xF0 0x10 \b, 4:3
>>4 beshort&0xFFF0 0x2C00 \b, 4CIF
>>>5 beshort&0x0FFF 0x01E0 \b NTSC
>>>5 beshort&0x0FFF 0x0240 \b PAL
>>>7 byte&0xF0 0x20 \b, 4:3
>>>7 byte&0xF0 0x30 \b, 16:9
>>>7 byte&0xF0 0x40 \b, 11:5
>>>7 byte&0xF0 0x80 \b, PAL 4:3
>>>7 byte&0xF0 0xC0 \b, NTSC 4:3
>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P
>>>7 byte&0xF0 0x10 \b, 4:3
>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240
>>>7 byte&0xF0 0x10 \b, 4:3
>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160
>>>7 byte&0xF0 0x10 \b, 4:3
>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120
>>>7 byte&0xF0 0x10 \b, 4:3
>>4 beshort&0xFFF0 0x1600 \b, CIF
>>>5 beshort&0x0FFF 0x00F0 \b NTSC
>>>5 beshort&0x0FFF 0x0120 \b PAL
>>>7 byte&0xF0 0x20 \b, 4:3
>>>7 byte&0xF0 0x30 \b, 16:9
>>>7 byte&0xF0 0x40 \b, 11:5
>>>7 byte&0xF0 0x80 \b, PAL 4:3
>>>7 byte&0xF0 0xC0 \b, NTSC 4:3
>>>5 beshort&0x0FFF 0x0240 \b PAL 625
>>>>7 byte&0xF0 0x20 \b, 4:3
>>>>7 byte&0xF0 0x30 \b, 16:9
>>>>7 byte&0xF0 0x40 \b, 11:5
>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU
>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
>>>5 beshort&0x0FFF 0x0240 \b PAL 625
>>>7 byte&0xF0 0x20 \b, 4:3
>>>7 byte&0xF0 0x30 \b, 16:9
>>>7 byte&0xF0 0x40 \b, 11:5
>>4 beshort&0xFFF0 0x1E00 \b, SVCD
>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
>>>5 beshort&0x0FFF 0x0240 \b PAL 625
>>>7 byte&0xF0 0x20 \b, 4:3
>>>7 byte&0xF0 0x30 \b, 16:9
>>>7 byte&0xF0 0x40 \b, 11:5
>>7 byte&0x0F 1 \b, 23.976 fps
>>7 byte&0x0F 2 \b, 24 fps
>>7 byte&0x0F 3 \b, 25 fps
>>7 byte&0x0F 4 \b, 29.97 fps
>>7 byte&0x0F 5 \b, 30 fps
>>7 byte&0x0F 6 \b, 50 fps
>>7 byte&0x0F 7 \b, 59.94 fps
>>7 byte&0x0F 8 \b, 60 fps
>>11 byte &0x04 \b, Constrained
# MPEG ADTS Audio (*.mpx/mxa/aac)
# from dreesen@math.fu-berlin.de
# modified to fully support MPEG ADTS
# MP3, M1A
0 beshort&0xFFFE 0xFFFA MPEG ADTS, layer III, v1
# rates
>2 byte&0xF0 0x10 \b, 32 kBits
>2 byte&0xF0 0x20 \b, 40 kBits
>2 byte&0xF0 0x30 \b, 48 kBits
>2 byte&0xF0 0x40 \b, 56 kBits
>2 byte&0xF0 0x50 \b, 64 kBits
>2 byte&0xF0 0x60 \b, 80 kBits
>2 byte&0xF0 0x70 \b, 96 kBits
>2 byte&0xF0 0x80 \b, 112 kBits
>2 byte&0xF0 0x90 \b, 128 kBits
>2 byte&0xF0 0xA0 \b, 160 kBits
>2 byte&0xF0 0xB0 \b, 192 kBits
>2 byte&0xF0 0xC0 \b, 224 kBits
>2 byte&0xF0 0xD0 \b, 256 kBits
>2 byte&0xF0 0xE0 \b, 320 kBits
# timing
>2 byte&0x0C 0x00 \b, 44.1 kHz
>2 byte&0x0C 0x04 \b, 48 kHz
>2 byte&0x0C 0x08 \b, 32 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# MP2, M1A
0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1
# rates
>2 byte&0xF0 0x10 \b, 32 kBits
>2 byte&0xF0 0x20 \b, 48 kBits
>2 byte&0xF0 0x30 \b, 56 kBits
>2 byte&0xF0 0x40 \b, 64 kBits
>2 byte&0xF0 0x50 \b, 80 kBits
>2 byte&0xF0 0x60 \b, 96 kBits
>2 byte&0xF0 0x70 \b, 112 kBits
>2 byte&0xF0 0x80 \b, 128 kBits
>2 byte&0xF0 0x90 \b, 160 kBits
>2 byte&0xF0 0xA0 \b, 192 kBits
>2 byte&0xF0 0xB0 \b, 224 kBits
>2 byte&0xF0 0xC0 \b, 256 kBits
>2 byte&0xF0 0xD0 \b, 320 kBits
>2 byte&0xF0 0xE0 \b, 384 kBits
# timing
>2 byte&0x0C 0x00 \b, 44.1 kHz
>2 byte&0x0C 0x04 \b, 48 kHz
>2 byte&0x0C 0x08 \b, 32 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# MPA, M1A
0 beshort&0xFFFE 0xFFFE MPEG ADTS, layer I, v1
# rate
>2 byte&0xF0 0x10 \b, 32 kBits
>2 byte&0xF0 0x20 \b, 64 kBits
>2 byte&0xF0 0x30 \b, 96 kBits
>2 byte&0xF0 0x40 \b, 128 kBits
>2 byte&0xF0 0x50 \b, 160 kBits
>2 byte&0xF0 0x60 \b, 192 kBits
>2 byte&0xF0 0x70 \b, 224 kBits
>2 byte&0xF0 0x80 \b, 256 kBits
>2 byte&0xF0 0x90 \b, 288 kBits
>2 byte&0xF0 0xA0 \b, 320 kBits
>2 byte&0xF0 0xB0 \b, 352 kBits
>2 byte&0xF0 0xC0 \b, 384 kBits
>2 byte&0xF0 0xD0 \b, 416 kBits
>2 byte&0xF0 0xE0 \b, 448 kBits
# timing
>2 byte&0x0C 0x00 \b, 44.1 kHz
>2 byte&0x0C 0x04 \b, 48 kHz
>2 byte&0x0C 0x08 \b, 32 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# MP3, M2A
0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2
# rate
>2 byte&0xF0 0x10 \b, 8 kBits
>2 byte&0xF0 0x20 \b, 16 kBits
>2 byte&0xF0 0x30 \b, 24 kBits
>2 byte&0xF0 0x40 \b, 32 kBits
>2 byte&0xF0 0x50 \b, 40 kBits
>2 byte&0xF0 0x60 \b, 48 kBits
>2 byte&0xF0 0x70 \b, 56 kBits
>2 byte&0xF0 0x80 \b, 64 kBits
>2 byte&0xF0 0x90 \b, 80 kBits
>2 byte&0xF0 0xA0 \b, 96 kBits
>2 byte&0xF0 0xB0 \b, 112 kBits
>2 byte&0xF0 0xC0 \b, 128 kBits
>2 byte&0xF0 0xD0 \b, 144 kBits
>2 byte&0xF0 0xE0 \b, 160 kBits
# timing
>2 byte&0x0C 0x00 \b, 22.05 kHz
>2 byte&0x0C 0x04 \b, 24 kHz
>2 byte&0x0C 0x08 \b, 16 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# MP2, M2A
0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
# rate
>2 byte&0xF0 0x10 \b, 8 kBits
>2 byte&0xF0 0x20 \b, 16 kBits
>2 byte&0xF0 0x30 \b, 24 kBits
>2 byte&0xF0 0x40 \b, 32 kBits
>2 byte&0xF0 0x50 \b, 40 kBits
>2 byte&0xF0 0x60 \b, 48 kBits
>2 byte&0xF0 0x70 \b, 56 kBits
>2 byte&0xF0 0x80 \b, 64 kBits
>2 byte&0xF0 0x90 \b, 80 kBits
>2 byte&0xF0 0xA0 \b, 96 kBits
>2 byte&0xF0 0xB0 \b, 112 kBits
>2 byte&0xF0 0xC0 \b, 128 kBits
>2 byte&0xF0 0xD0 \b, 144 kBits
>2 byte&0xF0 0xE0 \b, 160 kBits
# timing
>2 byte&0x0C 0x00 \b, 22.05 kHz
>2 byte&0x0C 0x04 \b, 24 kHz
>2 byte&0x0C 0x08 \b, 16 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# MPA, M2A
0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2
# rate
>2 byte&0xF0 0x10 \b, 32 kBits
>2 byte&0xF0 0x20 \b, 48 kBits
>2 byte&0xF0 0x30 \b, 56 kBits
>2 byte&0xF0 0x40 \b, 64 kBits
>2 byte&0xF0 0x50 \b, 80 kBits
>2 byte&0xF0 0x60 \b, 96 kBits
>2 byte&0xF0 0x70 \b, 112 kBits
>2 byte&0xF0 0x80 \b, 128 kBits
>2 byte&0xF0 0x90 \b, 144 kBits
>2 byte&0xF0 0xA0 \b, 160 kBits
>2 byte&0xF0 0xB0 \b, 176 kBits
>2 byte&0xF0 0xC0 \b, 192 kBits
>2 byte&0xF0 0xD0 \b, 224 kBits
>2 byte&0xF0 0xE0 \b, 256 kBits
# timing
>2 byte&0x0C 0x00 \b, 22.05 kHz
>2 byte&0x0C 0x04 \b, 24 kHz
>2 byte&0x0C 0x08 \b, 16 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# MP3, M25A
0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5
# rate
>2 byte&0xF0 0x10 \b, 8 kBits
>2 byte&0xF0 0x20 \b, 16 kBits
>2 byte&0xF0 0x30 \b, 24 kBits
>2 byte&0xF0 0x40 \b, 32 kBits
>2 byte&0xF0 0x50 \b, 40 kBits
>2 byte&0xF0 0x60 \b, 48 kBits
>2 byte&0xF0 0x70 \b, 56 kBits
>2 byte&0xF0 0x80 \b, 64 kBits
>2 byte&0xF0 0x90 \b, 80 kBits
>2 byte&0xF0 0xA0 \b, 96 kBits
>2 byte&0xF0 0xB0 \b, 112 kBits
>2 byte&0xF0 0xC0 \b, 128 kBits
>2 byte&0xF0 0xD0 \b, 144 kBits
>2 byte&0xF0 0xE0 \b, 160 kBits
# timing
>2 byte&0x0C 0x00 \b, 11.025 kHz
>2 byte&0x0C 0x04 \b, 12 kHz
>2 byte&0x0C 0x08 \b, 8 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
# Stored AAC streams (instead of the MP4 format)
0 string ADIF MPEG ADIF, AAC
>4 byte &0x80
>>13 byte &0x10 \b, VBR
>>13 byte ^0x10 \b, CBR
>>16 byte&0x1E 0x02 \b, single stream
>>16 byte&0x1E 0x04 \b, 2 streams
>>16 byte&0x1E 0x06 \b, 3 streams
>>16 byte &0x08 \b, 4 or more streams
>>16 byte &0x10 \b, 8 or more streams
>>4 byte &0x80 \b, Copyrighted
>>13 byte &0x40 \b, Original Source
>>13 byte &0x20 \b, Home Flag
>4 byte ^0x80
>>4 byte &0x10 \b, VBR
>>4 byte ^0x10 \b, CBR
>>7 byte&0x1E 0x02 \b, single stream
>>7 byte&0x1E 0x04 \b, 2 streams
>>7 byte&0x1E 0x06 \b, 3 streams
>>7 byte &0x08 \b, 4 or more streams
>>7 byte &0x10 \b, 8 or more streams
>>4 byte &0x40 \b, Original Stream(s)
>>4 byte &0x20 \b, Home Source
# Live or stored single AAC stream (used with MPEG-2 systems)
0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC
>1 byte &0x08 \b, v2
>1 byte ^0x08 \b, v4
# profile
>>2 byte &0xC0 \b LTP
>2 byte&0xc0 0x00 \b Main
>2 byte&0xc0 0x40 \b LC
>2 byte&0xc0 0x80 \b SSR
# timing
>2 byte&0x3c 0x00 \b, 96 kHz
>2 byte&0x3c 0x04 \b, 88.2 kHz
>2 byte&0x3c 0x08 \b, 64 kHz
>2 byte&0x3c 0x0c \b, 48 kHz
>2 byte&0x3c 0x10 \b, 44.1 kHz
>2 byte&0x3c 0x14 \b, 32 kHz
>2 byte&0x3c 0x18 \b, 24 kHz
>2 byte&0x3c 0x1c \b, 22.05 kHz
>2 byte&0x3c 0x20 \b, 16 kHz
>2 byte&0x3c 0x24 \b, 12 kHz
>2 byte&0x3c 0x28 \b, 11.025 kHz
>2 byte&0x3c 0x2c \b, 8 kHz
# channels
>2 beshort&0x01c0 0x0040 \b, monaural
>2 beshort&0x01c0 0x0080 \b, stereo
>2 beshort&0x01c0 0x00c0 \b, stereo + center
>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE
>2 beshort&0x01c0 0x0140 \b, surround
>2 beshort&0x01c0 0x0180 \b, surround + LFE
>2 beshort &0x01C0 \b, surround + side
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Custom Flag
#>3 byte &0x20 \b, Original Stream
#>3 byte &0x10 \b, Home Source
#>3 byte &0x08 \b, Copyrighted
# Live MPEG-4 audio streams (instead of RTP FlexMux)
0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS
#>1 beshort&0x1FFF x \b, %u byte packet
>3 byte&0xE0 0x40
>>4 byte&0x3C 0x04 \b, single stream
>>4 byte&0x3C 0x08 \b, 2 streams
>>4 byte&0x3C 0x0C \b, 3 streams
>>4 byte &0x08 \b, 4 or more streams
>>4 byte &0x20 \b, 8 or more streams
>3 byte&0xC0 0
>>4 byte&0x78 0x08 \b, single stream
>>4 byte&0x78 0x10 \b, 2 streams
>>4 byte&0x78 0x18 \b, 3 streams
>>4 byte &0x20 \b, 4 or more streams
>>4 byte &0x40 \b, 8 or more streams
0 beshort 0x4DE1 MPEG-4 LO-EP audio stream
# FLI animation format
4 leshort 0xAF11 FLI file
>6 leshort x - %d frames,
>8 leshort x width=%d pixels,
>10 leshort x height=%d pixels,
>12 leshort x depth=%d,
>16 leshort x ticks/frame=%d
# FLC animation format
4 leshort 0xAF12 FLC file
>6 leshort x - %d frames
>8 leshort x width=%d pixels,
>10 leshort x height=%d pixels,
>12 leshort x depth=%d,
>16 leshort x ticks/frame=%d
# DL animation format
# XXX - collision with most `mips' magic
#
# I couldn't find a real magic number for these, however, this
# -appears- to work. Note that it might catch other files, too, so be
# careful!
#
# Note that title and author appear in the two 20-byte chunks
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
# 255 (hex FF)! The DL format is really bad.
#
#0 byte 1 DL version 1, medium format (160x100, 4 images/screen)
#>42 byte x - %d screens,
#>43 byte x %d commands
#0 byte 2 DL version 2
#>1 byte 1 - large format (320x200,1 image/screen),
#>1 byte 2 - medium format (160x100,4 images/screen),
#>1 byte >2 - unknown format,
#>42 byte x %d screens,
#>43 byte x %d commands
# Based on empirical evidence, DL version 3 have several nulls following the
# \003. Most of them start with non-null values at hex offset 0x34 or so.
#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3
# iso 13818 transport stream
#
# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
# (the following is a little bit restrictive and works fine for a stream
# that starts with PAT properly. it won't work for stream data, that is
# cut from an input device data right in the middle, but this shouldn't
# disturb)
# syncbyte 8 bit 0x47
# error_ind 1 bit -
# payload_start 1 bit 1
# priority 1 bit -
# PID 13 bit 0x0000
# scrambling 2 bit -
# adaptfld_ctrl 2 bit 1 or 3
# conti_count 4 bit 0
0 belong&0xFF5FFF1F 0x47400010 MPEG transport stream data
>188 byte !0x47 CORRUPTED
# DIF digital video file format <mpruett@sgi.com>
0 belong&0xffffff00 0x1f070000 DIF
>4 byte &0x01 (DVCPRO) movie file
>4 byte ^0x01 (DV) movie file
>3 byte &0x80 (PAL)
>3 byte ^0x80 (NTSC)
# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
0 belong 0x3026b275 Microsoft ASF
# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
0 string \x8aMNG MNG video data,
>4 belong !0x0d0a1a0a CORRUPTED,
>4 belong 0x0d0a1a0a
>>16 belong x %ld x
>>20 belong x %ld
# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
0 string \x8bJNG JNG video data,
>4 belong !0x0d0a1a0a CORRUPTED,
>4 belong 0x0d0a1a0a
>>16 belong x %ld x
>>20 belong x %ld
# Vivo video (Wolfram Kleff)
3 string \x0D\x0AVersion:Vivo Vivo video data
# VRML (Virtual Reality Modelling Language)
0 string/b #VRML\ V1.0\ ascii VRML 1 file
0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
#---------------------------------------------------------------------------
# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
#
0 string HVQM4 %s
>6 string >\0 v%s
>0 byte x GameCube movie,
>0x34 ubeshort x %d x
>0x36 ubeshort x %d,
>0x26 ubeshort x %dµs,
>0x42 ubeshort 0 no audio
>0x42 ubeshort >0 %dHz audio
# From: "Stefan A. Haubenthal" <polluks@web.de>
0 string DVDVIDEO-VTS Video title set,
>0x21 byte x v%x
0 string DVDVIDEO-VMG Video manager,
>0x21 byte x v%x

6
file/magic/Magdir/apl
View File

@ -1,6 +0,0 @@
#------------------------------------------------------------------------------
# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL
# workspaces)
#
0 long 0100554 APL workspace (Ken's original?)

170
file/magic/Magdir/apple
View File

@ -1,170 +0,0 @@
#------------------------------------------------------------------------------
# apple: file(1) magic for Apple file formats
#
0 string FiLeStArTfIlEsTaRt binscii (apple ][) text
0 string \x0aGL Binary II (apple ][) data
0 string \x76\xff Squeezed (apple ][) data
0 string NuFile NuFile archive (apple ][) data
0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
0 belong 0x00051600 AppleSingle encoded Macintosh file
0 belong 0x00051607 AppleDouble encoded Macintosh file
# Apple Emulator 2IMG format
#
0 string 2IMG Apple ][ 2IMG Disk Image
>4 string XGS! \b, XGS
>4 string CTKG \b, Catakig
>4 string ShIm \b, Sheppy's ImageMaker
>4 string WOOF \b, Sweet 16
>4 string B2TR \b, Bernie ][ the Rescue
>4 string !nfc \b, ASIMOV2
>4 string x \b, Unknown Format
>0xc byte 00 \b, DOS 3.3 sector order
>>0x10 byte 00 \b, Volume 254
>>0x10 byte&0x7f x \b, Volume %u
>0xc byte 01 \b, ProDOS sector order
>>0x14 short x \b, %u Blocks
>0xc byte 02 \b, NIB data
# magic for Newton PDA package formats
# from Ruda Moura <ruda@helllabs.org>
0 string package0 Newton package, NOS 1.x,
>12 belong &0x80000000 AutoRemove,
>12 belong &0x40000000 CopyProtect,
>12 belong &0x10000000 NoCompression,
>12 belong &0x04000000 Relocation,
>12 belong &0x02000000 UseFasterCompression,
>16 belong x version %d
0 string package1 Newton package, NOS 2.x,
>12 belong &0x80000000 AutoRemove,
>12 belong &0x40000000 CopyProtect,
>12 belong &0x10000000 NoCompression,
>12 belong &0x04000000 Relocation,
>12 belong &0x02000000 UseFasterCompression,
>16 belong x version %d
0 string package4 Newton package,
>8 byte 8 NOS 1.x,
>8 byte 9 NOS 2.x,
>12 belong &0x80000000 AutoRemove,
>12 belong &0x40000000 CopyProtect,
>12 belong &0x10000000 NoCompression,
# The following entries for the Apple II are for files that have
# been transferred as raw binary data from an Apple, without having
# been encapsulated by any of the above archivers.
#
# In general, Apple II formats are hard to identify because Apple DOS
# and especially Apple ProDOS have strong typing in the file system and
# therefore programmers never felt much need to include type information
# in the files themselves.
#
# Eric Fischer <enf@pobox.com>
# AppleWorks word processor:
#
# This matches the standard tab stops for an AppleWorks file, but if
# a file has a tab stop set in the first four columns this will fail.
#
# The "O" is really the magic number, but that's so common that it's
# necessary to check the tab stops that follow it to avoid false positives.
4 string O==== AppleWorks word processor data
>85 byte&0x01 >0 \b, zoomed
>90 byte&0x01 >0 \b, paginated
>92 byte&0x01 >0 \b, with mail merge
#>91 byte x \b, left margin %d
# AppleWorks database:
#
# This isn't really a magic number, but it's the closest thing to one
# that I could find. The 1 and 2 really mean "order in which you defined
# categories" and "left to right, top to bottom," respectively; the D and R
# mean that the cursor should move either down or right when you press Return.
#30 string \x01D AppleWorks database data
#30 string \x02D AppleWorks database data
#30 string \x01R AppleWorks database data
#30 string \x02R AppleWorks database data
# AppleWorks spreadsheet:
#
# Likewise, this isn't really meant as a magic number. The R or C means
# row- or column-order recalculation; the A or M means automatic or manual
# recalculation.
#131 string RA AppleWorks spreadsheet data
#131 string RM AppleWorks spreadsheet data
#131 string CA AppleWorks spreadsheet data
#131 string CM AppleWorks spreadsheet data
# Applesoft BASIC:
#
# This is incredibly sloppy, but will be true if the program was
# written at its usual memory location of 2048 and its first line
# number is less than 256. Yuck.
0 belong&0xff00ff 0x80000 Applesoft BASIC program data
#>2 leshort x \b, first line number %d
# ORCA/EZ assembler:
#
# This will not identify ORCA/M source files, since those have
# some sort of date code instead of the two zero bytes at 6 and 7
# XXX Conflicts with ELF
#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
#>5 byte x \b, build number %d
# Broderbund Fantavision
#
# I don't know what these values really mean, but they seem to recur.
# Will they cause too many conflicts?
# Probably :-)
#2 belong&0xFF00FF 0x040008 Fantavision movie data
# Some attempts at images.
#
# These are actually just bit-for-bit dumps of the frame buffer, so
# there's really no reasonably way to distinguish them except for their
# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
# or, occasionally, 8184.
#
# Nevertheless this will manage to catch a lot of images that happen
# to have a solid-colored line at the bottom of the screen.
8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
# Beagle Bros. Apple Mechanic fonts
0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
# Apple Universal Disk Image Format (UDIF) - dmg files.
# From Johan Gade.
# These entries are disabled for now until we fix the following issues.
#
# Note there might be some problems with the "VAX COFF executable"
# entry. Note this entry should be placed before the mac filesystem section,
# particularly the "Apple Partition data" entry.
#
# The intended meaning of these tests is, that the file is only of the
# specified type if both of the lines are correct - i.e. if the first
# line matches and the second doesn't then it is not of that type.
#
#0 long 0x7801730d
#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
#
# Note that this entry is recognized correctly by the "Apple Partition
# data" entry - however since this entry is more specific - this
# information seems to be more useful.
#0 long 0x45520200
#>0x410 string disk\ image UDIF read/write image (UDRW)
# From: Toby Peterson <toby@apple.com>
0 string bplist00 Apple binary property list

12
file/magic/Magdir/applix
View File

@ -1,12 +0,0 @@
#------------------------------------------------------------------------------
# applix: file(1) magic for Applixware
# From: Peter Soos <sp@osb.hu>
#
0 string *BEGIN Applixware
>7 string WORDS Words Document
>7 string GRAPHICS Graphic
>7 string RASTER Bitmap
>7 string SPREADSHEETS Spreadsheet
>7 string MACRO Macro
>7 string BUILDER Builder Object

636
file/magic/Magdir/archive
View File

@ -1,636 +0,0 @@
#------------------------------------------------------------------------------
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
# pre-POSIX "tar" archives are handled in the C code.
# POSIX tar archives
257 string ustar\0 POSIX tar archive
257 string ustar\040\040\0 GNU tar archive
# cpio archives
#
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats and thus are strings, not numbers.
0 short 070707 cpio archive
0 short 0143561 byte-swapped cpio archive
0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
0 string 070701 ASCII cpio archive (SVR4 with no CRC)
0 string 070702 ASCII cpio archive (SVR4 with CRC)
# Debian package (needs to go before regular portable archives)
#
0 string =!<arch>\ndebian
>8 string debian-split part of multipart Debian package
>8 string debian-binary Debian binary package
>68 string >\0 (format %s)
>81 string bz2 \b, uses bzip2 compression
>84 string gz \b, uses gzip compression
#>136 ledate x created: %s
# other archives
0 long 0177555 very old archive
0 short 0177555 very old PDP-11 archive
0 long 0177545 old archive
0 short 0177545 old PDP-11 archive
0 long 0100554 apl workspace
0 string =<ar> archive
# MIPS archive (needs to go before regular portable archives)
#
0 string =!<arch>\n__________E MIPS archive
>20 string U with MIPS Ucode members
>21 string L with MIPSEL members
>21 string B with MIPSEB members
>19 string L and an EL hash table
>19 string B and an EB hash table
>22 string X -- out of date
0 string -h- Software Tools format archive text
#
# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0 string =!<arch> current ar archive
# 0 long 0x213c6172 archive file
#
# and for SVR1 archives, we have:
#
# 0 string \<ar> System V Release 1 ar archive
# 0 string =<ar> archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0 string =!<arch> current ar archive
>8 string __.SYMDEF random library
>0 belong =65538 - pre SR9.5
>0 belong =65539 - post SR9.5
>0 beshort 2 - object archive
>0 beshort 3 - shared library module
>0 beshort 4 - debug break-pointed module
>0 beshort 5 - absolute code program module
0 string \<ar> System V Release 1 ar archive
0 string =<ar> archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
0 belong 0x65ff0000 VAX 3.0 archive
0 belong 0x3c61723e VAX 5.0 archive
#
0 long 0x213c6172 archive file
0 lelong 0177555 very old VAX archive
0 leshort 0177555 very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0 lelong 0177545 old VAX archive
>8 string __.SYMDEF random library
0 leshort 0177545 old PDP-11 archive
>8 string __.SYMDEF random library
#
# From "pdp" (but why a 4-byte quantity?)
#
0 lelong 0x39bed PDP-11 old archive
0 lelong 0x39bee PDP-11 4.0 archive
# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
# filename of the first file (null terminated). Since some types collide
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
# [JW] stuff taken from idarc, obviously ARC successors:
0 lelong&0x8080ffff 0x00000a1a PAK archive data
0 lelong&0x8080ffff 0x0000141a ARC+ archive data
0 lelong&0x8080ffff 0x0000481a HYP archive data
# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
# [GRR: the original entries collide with ARC, above; replaced with combined
# version (not tested)]
#0 byte 0x1a RISC OS archive
#>1 string archive (ArcFS format)
#0 string \032archive RISC OS archive (ArcFS format)
0 string \032 RISC OS archive (spark format)
0 string Archive\000 RISC OS archive (ArcFS format)
# All these were taken from idarc, many could not be verified. Unfortunately,
# there were many low-quality sigs, i.e. easy to trigger false positives.
# Please notify me of any real-world fishy/ambiguous signatures and I'll try
# to get my hands on the actual archiver and see if I find something better. [JW]
# probably many can be enhanced by finding some 0-byte or control char near the start
# idarc calls this Crush/Uncompressed... *shrug*
0 string CRUSH Crush archive data
# Squeeze It (.sqz)
0 string HLSQZ Squeeze It archive data
# SQWEZ
0 string SQWEZ SQWEZ archive data
# HPack (.hpk)
0 string HPAK HPack archive data
# HAP
0 string \x91\x33HF HAP archive data
# MD/MDCD
0 string MDmd MDCD archive data
# LIM
0 string LIM\x1a LIM archive data
# SAR
3 string LH5 SAR archive data
# BSArc/BS2
0 string \212\3SB \0 BSArc/BS2 archive data
# MAR
2 string =-ah MAR archive data
# ACB
0 belong&0x00f800ff 0x00800000 ACB archive data
# CPZ
# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
# JRC
0 string JRchive JRC archive data
# Quantum
0 string DS\0 Quantum archive data
# ReSOF
0 string PK\3\6 ReSOF archive data
# QuArk
0 string 7\4 QuArk archive data
# YAC
14 string YC YAC archive data
# X1
0 string X1 X1 archive data
0 string XhDr X1 archive data
# CDC Codec (.dqt)
0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
# AMGC
0 string \xad6" AMGC archive data
# NuLIB
0 string NõFélå NuLIB archive data
# PakLeo
0 string LEOLZW PAKLeo archive data
# ChArc
0 string SChF ChArc archive data
# PSA
0 string PSA PSA archive data
# CrossePAC
0 string DSIGDCC CrossePAC archive data
# Freeze
0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
# KBoom
0 string ¨MP¨ KBoom archive data
# NSQ, must go after CDC Codec
0 string \x76\xff NSQ archive data
# DPA
0 string Dirk\ Paehl DPA archive data
# BA
# TODO: idarc says "bytes 0-2 == bytes 3-5"
# TTComp
0 string \0\6 TTComp archive data
# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
0 string ESP ESP archive data
# ZPack
0 string \1ZPK\1 ZPack archive data
# Sky
0 string \xbc\x40 Sky archive data
# UFA
0 string UFA UFA archive data
# Dry
0 string =-H2O DRY archive data
# FoxSQZ
0 string FOXSQZ FoxSQZ archive data
# AR7
0 string ,AR7 AR7 archive data
# PPMZ
0 string PPMZ PPMZ archive data
# MS Compress
4 string \x88\xf0\x27 MS Compress archive data
# MP3 (archiver, not lossy audio compression)
0 string MP3\x1a MP3-Archiver archive data
# ZET
0 string OZÝ ZET archive data
# TSComp
0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
# ARQ
0 string gW\4\1 ARQ archive data
# Squash
3 string OctSqu Squash archive data
# Terse
0 string \5\1\1\0 Terse archive data
# PUCrunch
0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
# UHarc
0 string UHA UHarc archive data
# ABComp
0 string \2AB ABComp archive data
0 string \3AB2 ABComp archive data
# CMP
0 string CO\0 CMP archive data
# Splint
0 string \x93\xb9\x06 Splint archive data
# InstallShield
0 string \x13\x5d\x65\x8c InstallShield Z archive Data
# Gather
1 string GTH Gather archive data
# BOA
0 string BOA BOA archive data
# RAX
0 string ULEB\xa RAX archive data
# Xtreme
0 string ULEB\0 Xtreme archive data
# Pack Magic
0 string @â\1\0 Pack Magic archive data
# BTS
0 belong&0xfeffffff 0x1a034465 BTS archive data
# ELI 5750
0 string Ora\ ELI 5750 archive data
# QFC
0 string \x1aFC\x1a QFC archive data
0 string \x1aQF\x1a QFC archive data
# PRO-PACK
0 string RNC PRO-PACK archive data
# 777
0 string 777 777 archive data
# LZS221
0 string sTaC LZS221 archive data
# HPA
0 string HPA HPA archive data
# Arhangel
0 string LG Arhangel archive data
# EXP1, uses bzip2
0 string 0123456789012345BZh EXP1 archive data
# IMP
0 string IMP\xa IMP archive data
# NRV
0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data
# Squish
0 string \x73\xb2\x90\xf4 Squish archive data
# Par
0 string PHILIPP Par archive data
0 string PAR Par archive data
# HIT
0 string UB HIT archive data
# SBX
0 belong&0xfffff000 0x53423000 SBX archive data
# NaShrink
0 string NSK NaShrink archive data
# SAPCAR
0 string #\ CAR\ archive\ header SAPCAR archive data
0 string CAR\ 2.00RG SAPCAR archive data
# Disintegrator
0 string DST Disintegrator archive data
# ASD
0 string ASD ASD archive data
# InstallShield CAB
0 string ISc( InstallShield CAB
# TOP4
0 string T4\x1a TOP4 archive data
# BatComp left out: sig looks like COM executable
# so TODO: get real 4dos batcomp file and find sig
# BlakHole
0 string BH\5\7 BlakHole archive data
# BIX
0 string BIX0 BIX archive data
# ChiefLZA
0 string ChfLZ ChiefLZA archive data
# Blink
0 string Blink Blink archive data
# Logitech Compress
0 string \xda\xfa Logitech Compress archive data
# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
1 string (C)\ STEPANYUK ARS-Sfx archive data
# AKT/AKT32
0 string AKT32 AKT32 archive data
0 string AKT AKT archive data
# NPack
0 string MSTSM NPack archive data
# PFT
0 string \0\x50\0\x14 PFT archive data
# SemOne
0 string SEM SemOne archive data
# PPMD
0 string \x8f\xaf\xac\x84 PPMD archive data
# FIZ
0 string FIZ FIZ archive data
# MSXiE
0 belong&0xfffff0f0 0x4d530000 MSXiE archive data
# DeepFreezer
0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data
# DC
0 string =<DC- DC archive data
# TPac
0 string \4TPAC\3 TPac archive data
# Ai
0 string Ai\1\1\0 Ai archive data
0 string Ai\1\0\0 Ai archive data
# Ai32
0 string Ai\2\0 Ai32 archive data
0 string Ai\2\1 Ai32 archive data
# SBC
0 string SBC SBC archive data
# Ybs
0 string YBS Ybs archive data
# DitPack
0 string \x9e\0\0 DitPack archive data
# DMS
0 string DMS! DMS archive data
# EPC
0 string \x8f\xaf\xac\x8c EPC archive data
# VSARC
0 string VS\x1a VSARC archive data
# PDZ
0 string PDZ PDZ archive data
# ReDuq
0 string rdqx ReDuq archive data
# GCA
0 string GCAX GCA archive data
# PPMN
0 string pN PPMN archive data
# WinImage
3 string WINIMAGE WinImage archive data
# Compressia
0 string CMP0CMP Compressia archive data
# UHBC
0 string UHB UHBC archive data
# WinHKI
0 string \x61\x5C\x04\x05 WinHKI archive data
# WWPack data file
0 string WWP WWPack archive data
# BSN (BSA, PTS-DOS)
0 string \xffBSG BSN archive data
1 string \xffBSG BSN archive data
3 string \xffBSG BSN archive data
1 string \0\xae\2 BSN archive data
1 string \0\xae\3 BSN archive data
1 string \0\xae\7 BSN archive data
# AIN
0 string \x33\x18 AIN archive data
0 string \x33\x17 AIN archive data
# XPA32
0 string xpa\0\1 XPA32 archive data
# SZip (TODO: doesn't catch all versions)
0 string SZ\x0a\4 SZip archive data
# XPack DiskImage
0 string jm XPack DiskImage archive data
# XPack Data
0 string xpa XPack archive data
# XPack Single Data
0 string Í\ jm XPack single archive data
# TODO: missing due to unknown magic/magic at end of file:
#DWC
#ARG
#ZAR
#PC/3270
#InstallIt
#RKive
#RK
#XPack Diskimage
# These were inspired by idarc, but actually verified
# Dzip archiver (.dz)
0 string DZ Dzip archive data
>2 byte x \b, version %i
>3 byte x \b.%i
# ZZip archiver (.zz)
0 string ZZ\ \0\0 ZZip archive data
0 string ZZ0 ZZip archive data
# PAQ archiver (.paq)
0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
0 string PAQ PAQ archive data
>3 byte&0xf0 0x30
>>3 byte x (v%c)
# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
0 string JARCS JAR (ARJ Software, Inc.) archive data
# ARJ archiver (jason@jarthur.Claremont.EDU)
0 leshort 0xea60 ARJ archive data
>5 byte x \b, v%d,
>8 byte &0x04 multi-volume,
>8 byte &0x10 slash-switched,
>8 byte &0x20 backup,
>34 string x original name: %s,
>7 byte 0 os: MS-DOS
>7 byte 1 os: PRIMOS
>7 byte 2 os: Unix
>7 byte 3 os: Amiga
>7 byte 4 os: Macintosh
>7 byte 5 os: OS/2
>7 byte 6 os: Apple ][ GS
>7 byte 7 os: Atari ST
>7 byte 8 os: NeXT
>7 byte 9 os: VAX/VMS
>3 byte >0 %d]
# [JW] idarc says this is also possible
2 leshort 0xea60 ARJ archive data
# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
#0 string HA HA archive data,
#>2 leshort =1 1 file,
#>2 leshort >1 %u files,
#>4 byte&0x0f =0 first is type CPY
#>4 byte&0x0f =1 first is type ASC
#>4 byte&0x0f =2 first is type HSC
#>4 byte&0x0f =0x0e first is type DIR
#>4 byte&0x0f =0x0f first is type SPECIAL
# suggestion: at least identify small archives (<1024 files)
0 belong&0xffff00fc 0x48410000 HA archive data
>2 leshort =1 1 file,
>2 leshort >1 %u files,
>4 byte&0x0f =0 first is type CPY
>4 byte&0x0f =1 first is type ASC
>4 byte&0x0f =2 first is type HSC
>4 byte&0x0f =0x0e first is type DIR
>4 byte&0x0f =0x0f first is type SPECIAL
# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
0 string HPAK HPACK archive data
# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
0 string \351,\001JAM\ JAM archive,
>7 string >\0 version %.4s
>0x26 byte =0x27 -
>>0x2b string >\0 label %.11s,
>>0x27 lelong x serial %08x,
>>0x36 string >\0 fstype %.8s
# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2 string -lh0- LHarc 1.x/ARX archive data [lh0]
2 string -lh1- LHarc 1.x/ARX archive data [lh1]
2 string -lz4- LHarc 1.x archive data [lz4]
2 string -lz5- LHarc 1.x archive data [lz5]
# [never seen any but the last; -lh4- reported in comp.compression:]
2 string -lzs- LHa/LZS archive data [lzs]
2 string -lh\40- LHa 2.x? archive data [lh ]
2 string -lhd- LHa 2.x? archive data [lhd]
2 string -lh2- LHa 2.x? archive data [lh2]
2 string -lh3- LHa 2.x? archive data [lh3]
2 string -lh4- LHa (2.x) archive data [lh4]
2 string -lh5- LHa (2.x) archive data [lh5]
2 string -lh6- LHa (2.x) archive data [lh6]
2 string -lh7- LHa (2.x)/LHark archive data [lh7]
>20 byte x - header level %d
# taken from idarc [JW]
2 string -lZ PUT archive data
2 string -lz LZS archive data
2 string -sw1- Swag archive data
# RAR archiver (Greg Roelofs, newt@uchicago.edu)
0 string Rar! RAR archive data,
>44 byte x v%0x,
>35 byte 0 os: MS-DOS
>35 byte 1 os: OS/2
>35 byte 2 os: Win32
>35 byte 3 os: Unix
# some old version? idarc says:
0 string RE\x7e\x5e RAR archive data
# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0 string SQSH squished archive data (Acorn RISCOS)
# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
# [JW] see exe section for self-extracting version
0 string UC2\x1a UC2 archive data
# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0 string PK\003\004 Zip archive data
>4 byte 0x09 \b, at least v0.9 to extract
>4 byte 0x0a \b, at least v1.0 to extract
>4 byte 0x0b \b, at least v1.1 to extract
>4 byte 0x14 \b, at least v2.0 to extract
# Zoo archiver
20 lelong 0xfdc4a7dc Zoo archive data
>4 byte >48 \b, v%c.
>>6 byte >47 \b%c
>>>7 byte >47 \b%c
>32 byte >0 \b, modify: v%d
>>33 byte x \b.%d+
>42 lelong 0xfdc4a7dc \b,
>>70 byte >0 extract: v%d
>>>71 byte x \b.%d+
# Shell archives
10 string #\ This\ is\ a\ shell\ archive shell archive text
#
# LBR. NB: May conflict with the questionable
# "binary Computer Graphics Metafile" format.
#
0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
#
# PMA (CP/M derivative of LHA)
#
2 string -pm0- PMarc archive data [pm0]
2 string -pm1- PMarc archive data [pm1]
2 string -pm2- PMarc archive data [pm2]
2 string -pms- PMarc SFX archive (CP/M, DOS)
5 string -pc1- PopCom compressed executable (CP/M)
# From Rafael Laboissiere <rafael@laboissiere.net>
# The Project Revision Control System (see
# http://prcs.sourceforge.net) generates a packaged project
# file which is recognized by the following entry:
0 leshort 0xeb81 PRCS packaged project
# Microsoft cabinets
# by David Necas (Yeti) <yeti@physics.muni.cz>
#0 string MSCF\0\0\0\0 Microsoft cabinet file data,
#>25 byte x v%d
#>24 byte x \b.%d
# MPi: All CABs have version 1.3, so this is pointless.
# Better magic in debian-additions.
# GTKtalog catalogs
# by David Necas (Yeti) <yeti@physics.muni.cz>
4 string gtktalog\ GTKtalog catalog data,
>13 string 3 version 3
>>14 beshort 0x677a (gzipped)
>>14 beshort !0x677a (not gzipped)
>13 string >3 version %s
############################################################################
# Parity archive reconstruction file, the 'par' file format now used on Usenet.
0 string PAR\0 PARity archive data
>48 leshort =0 - Index file
>48 leshort >0 - file number %d
# Felix von Leitner <felix-file@fefe.de>
0 string d8:announce BitTorrent file
# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
0 beshort 0x0e0f Atari MSA archive data
>2 beshort x \b, %d sectors per track
>4 beshort 0 \b, 1 sided
>4 beshort 1 \b, 2 sided
>6 beshort x \b, starting track: %d
>8 beshort x \b, ending track: %d
# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
0 string PK00PK\003\004 Zip archive data
# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
# by Stefan `Sec` Zehl <sec@42.org>
7 string **ACE** ACE archive data
>15 byte >0 version %d
>16 byte =0x00 \b, from MS-DOS
>16 byte =0x01 \b, from OS/2
>16 byte =0x02 \b, from Win/32
>16 byte =0x03 \b, from Unix
>16 byte =0x04 \b, from MacOS
>16 byte =0x05 \b, from WinNT
>16 byte =0x06 \b, from Primos
>16 byte =0x07 \b, from AppleGS
>16 byte =0x08 \b, from Atari
>16 byte =0x09 \b, from Vax/VMS
>16 byte =0x0A \b, from Amiga
>16 byte =0x0B \b, from Next
>14 byte x \b, version %d to extract
>5 leshort &0x0080 \b, multiple volumes,
>>17 byte x \b (part %d),
>5 leshort &0x0002 \b, contains comment
>5 leshort &0x0200 \b, sfx
>5 leshort &0x0400 \b, small dictionary
>5 leshort &0x0800 \b, multi-volume
>5 leshort &0x1000 \b, contains AV-String
>>30 string\x16*UNREGISTERED\x20VERSION* (unregistered)
>5 leshort &0x2000 \b, with recovery record
>5 leshort &0x4000 \b, locked
>5 leshort &0x8000 \b, solid
# Date in MS-DOS format (whatever that is)
#>18 lelong x Created on
# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
# <doj@cubic.org>
0x1A string sfArk sfArk compressed Soundfont
>0x15 string 2
>>0x1 string >\0 Version %s
>>0x2A string >\0 : %s
# DR-DOS 7.03 Packed File *.??_
0 string Packed\ File\ Personal NetWare Packed File
>12 string x \b, was "%.12s"
# EET archive
# From: Tilman Sauerbeck <tilman@code-monkey.de>
0 belong 0x1ee7ff00 EET archive

17
file/magic/Magdir/asterix
View File

@ -1,17 +0,0 @@
#------------------------------------------------------------------------------
# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
# strings as "long" - we assume they're just strings:
# From: guy@netapp.com (Guy Harris)
#
0 string *STA Aster*x
>7 string WORD Words Document
>7 string GRAP Graphic
>7 string SPRE Spreadsheet
>7 string MACR Macro
0 string 2278 Aster*x Version 2
>29 byte 0x36 Words Document
>29 byte 0x35 Graphic
>29 byte 0x32 Spreadsheet
>29 byte 0x38 Macro

40
file/magic/Magdir/att3b
View File

@ -1,40 +0,0 @@
#------------------------------------------------------------------------------
# att3b: file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
# 3B20
#
# The 3B20 conflicts with SCCS.
#0 beshort 0550 3b20 COFF executable
#>12 belong >0 not stripped
#>22 beshort >0 - version %ld
#0 beshort 0551 3b20 COFF executable (TV)
#>12 belong >0 not stripped
#>22 beshort >0 - version %ld
#
# WE32K
#
0 beshort 0560 WE32000 COFF
>18 beshort ^00000020 object
>18 beshort &00000020 executable
>12 belong >0 not stripped
>18 beshort ^00010000 N/A on 3b2/300 w/paging
>18 beshort &00020000 32100 required
>18 beshort &00040000 and MAU hardware required
>20 beshort 0407 (impure)
>20 beshort 0410 (pure)
>20 beshort 0413 (demand paged)
>20 beshort 0443 (target shared library)
>22 beshort >0 - version %ld
0 beshort 0561 WE32000 COFF executable (TV)
>12 belong >0 not stripped
#>18 beshort &00020000 - 32100 required
#>18 beshort &00040000 and MAU hardware required
#>22 beshort >0 - version %ld
#
# core file for 3b2
0 string \000\004\036\212\200 3b2 core file
>364 string >\0 of '%s'

427
file/magic/Magdir/audio
View File

@ -1,427 +0,0 @@
#------------------------------------------------------------------------------
# audio: file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
# and others
#
# Sun/NeXT audio data
0 string .snd Sun/NeXT audio data:
>12 belong 1 8-bit ISDN mu-law,
>12 belong 2 8-bit linear PCM [REF-PCM],
>12 belong 3 16-bit linear PCM,
>12 belong 4 24-bit linear PCM,
>12 belong 5 32-bit linear PCM,
>12 belong 6 32-bit IEEE floating point,
>12 belong 7 64-bit IEEE floating point,
>12 belong 8 Fragmented sample data,
>12 belong 10 DSP program,
>12 belong 11 8-bit fixed point,
>12 belong 12 16-bit fixed point,
>12 belong 13 24-bit fixed point,
>12 belong 14 32-bit fixed point,
>12 belong 18 16-bit linear with emphasis,
>12 belong 19 16-bit linear compressed,
>12 belong 20 16-bit linear with emphasis and compression,
>12 belong 21 Music kit DSP commands,
>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice data encoding),
>12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
>12 belong 27 8-bit A-law (CCITT G.711),
>20 belong 1 mono,
>20 belong 2 stereo,
>20 belong 4 quad,
>16 belong >0 %d Hz
# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
0 lelong 0x0064732E DEC audio data:
>12 lelong 1 8-bit ISDN mu-law,
>12 lelong 2 8-bit linear PCM [REF-PCM],
>12 lelong 3 16-bit linear PCM,
>12 lelong 4 24-bit linear PCM,
>12 lelong 5 32-bit linear PCM,
>12 lelong 6 32-bit IEEE floating point,
>12 lelong 7 64-bit IEEE floating point,
>12 belong 8 Fragmented sample data,
>12 belong 10 DSP program,
>12 belong 11 8-bit fixed point,
>12 belong 12 16-bit fixed point,
>12 belong 13 24-bit fixed point,
>12 belong 14 32-bit fixed point,
>12 belong 18 16-bit linear with emphasis,
>12 belong 19 16-bit linear compressed,
>12 belong 20 16-bit linear with emphasis and compression,
>12 belong 21 Music kit DSP commands,
>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice data encoding),
>12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
>12 belong 27 8-bit A-law (CCITT G.711),
>20 lelong 1 mono,
>20 lelong 2 stereo,
>20 lelong 4 quad,
>16 lelong >0 %d Hz
# Creative Labs AUDIO stuff
0 string MThd Standard MIDI data
>8 beshort x (format %d)
>10 beshort x using %d track
>10 beshort >1 \bs
>12 beshort&0x7fff x at 1/%d
>12 beshort&0x8000 >0 SMPTE
0 string CTMF Creative Music (CMF) data
0 string SBI SoundBlaster instrument data
0 string Creative\ Voice\ File Creative Labs voice data
# is this next line right? it came this way...
>19 byte 0x1A
>23 byte >0 - version %d
>22 byte >0 \b.%d
# first entry is also the string "NTRK"
0 belong 0x4e54524b MultiTrack sound data
>4 belong x - version %ld
# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
0 string EMOD Extended MOD sound data,
>4 byte&0xf0 x version %d
>4 byte&0x0f x \b.%d,
>45 byte x %d instruments
>83 byte 0 (module)
>83 byte 1 (song)
# Real Audio (Magic .ra\0375)
0 belong 0x2e7261fd RealAudio sound file
0 string .RMF RealMedia file
# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
# Oct 31, 1995
# fixed by <doj@cubic.org> 2003-06-24
# Too short...
#0 string MTM MultiTracker Module sound file
#0 string if Composer 669 Module sound data
#0 string JN Composer 669 Module sound data (extended format)
0 string MAS_U ULT(imate) Module sound data
#0 string FAR Module sound data
#>4 string >\15 Title: "%s"
0x2c string SCRM ScreamTracker III Module sound data
>0 string >\0 Title: "%s"
# Gravis UltraSound patches
# From <ache@nagual.ru>
0 string GF1PATCH110\0ID#000002\0 GUS patch
0 string GF1PATCH100\0ID#000002\0 Old GUS patch
#
# Taken from loader code from mikmod version 2.14
# by Steve McIntyre (stevem@chiark.greenend.org.uk)
# <doj@cubic.org> added title printing on 2003-06-24
0 string MAS_UTrack_V00
>14 string >/0 ultratracker V1.%.1s module sound data
0 string UN05 MikMod UNI format module sound data
0 string Extended\ Module: Fasttracker II module sound data
>17 string >\0 Title: "%s"
21 string/c =!SCREAM! Screamtracker 2 module sound data
21 string BMOD2STM Screamtracker 2 module sound data
1080 string M.K. 4-channel Protracker module sound data
>0 string >\0 Title: "%s"
1080 string M!K! 4-channel Protracker module sound data
>0 string >\0 Title: "%s"
1080 string FLT4 4-channel Startracker module sound data
>0 string >\0 Title: "%s"
1080 string FLT8 8-channel Startracker module sound data
>0 string >\0 Title: "%s"
1080 string 4CHN 4-channel Fasttracker module sound data
>0 string >\0 Title: "%s"
1080 string 6CHN 6-channel Fasttracker module sound data
>0 string >\0 Title: "%s"
1080 string 8CHN 8-channel Fasttracker module sound data
>0 string >\0 Title: "%s"
1080 string CD81 8-channel Octalyser module sound data
>0 string >\0 Title: "%s"
1080 string OKTA 8-channel Oktalyzer module sound data
>0 string >\0 Title: "%s"
# Not good enough.
#1082 string CH
#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data
1080 string 16CN 16-channel Taketracker module sound data
>0 string >\0 Title: "%s"
1080 string 32CN 32-channel Taketracker module sound data
>0 string >\0 Title: "%s"
# TOC sound files -Trevor Johnson <trevor@jpj.net>
#
0 string TOC TOC sound file
# sidfiles <pooka@iki.fi>
# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
0 string SIDPLAY\ INFOFILE Sidplay info file
0 string PSID PlaySID v2.2+ (AMIGA) sidtune
>4 beshort >0 w/ header v%d,
>14 beshort =1 single song,
>14 beshort >1 %d songs,
>16 beshort >0 default song: %d
>0x16 string >\0 name: "%s"
>0x36 string >\0 author: "%s"
>0x56 string >\0 copyright: "%s"
0 string RSID RSID sidtune PlaySID compatible
>4 beshort >0 w/ header v%d,
>14 beshort =1 single song,
>14 beshort >1 %d songs,
>16 beshort >0 default song: %d
>0x16 string >\0 name: "%s"
>0x36 string >\0 author: "%s"
>0x56 string >\0 copyright: "%s"
# IRCAM <mpruett@sgi.com>
# VAX and MIPS files are little-endian; Sun and NeXT are big-endian
0 belong 0x64a30100 IRCAM file (VAX)
0 belong 0x64a30200 IRCAM file (Sun)
0 belong 0x64a30300 IRCAM file (MIPS little-endian)
0 belong 0x64a30400 IRCAM file (NeXT)
# NIST SPHERE <mpruett@sgi.com>
0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file
# Sample Vision <mpruett@sgi.com>
0 string SOUND\ SAMPLE\ DATA\ Sample Vision file
# Audio Visual Research <tonigonenstein@users.sourceforge.net>
0 string 2BIT Audio Visual Research file,
>12 beshort =0 mono,
>12 beshort =-1 stereo,
>14 beshort x %d bits
>16 beshort =0 unsigned,
>16 beshort =-1 signed,
>22 belong&0x00ffffff x %d Hz,
>18 beshort =0 no loop,
>18 beshort =-1 loop,
>21 ubyte <=127 note %d,
>22 byte =0 replay 5.485 KHz
>22 byte =1 replay 8.084 KHz
>22 byte =2 replay 10.971 Khz
>22 byte =3 replay 16.168 Khz
>22 byte =4 replay 21.942 KHz
>22 byte =5 replay 32.336 KHz
>22 byte =6 replay 43.885 KHz
>22 byte =7 replay 47.261 KHz
# SGI SoundTrack <mpruett@sgi.com>
0 string _SGI_SoundTrack SGI SoundTrack project file
# ID3 version 2 tags <waschk@informatik.uni-rostock.de>
0 string ID3 MP3 file with ID3 version 2.
>3 ubyte <0xff \b%d.
>4 ubyte <0xff \b%d tag
# NSF (NES sound file) magic
0 string NESM\x1a NES Sound File
>14 string >\0 ("%s" by
>46 string >\0 %s, copyright
>78 string >\0 %s),
>5 byte x version %d,
>6 byte x %d tracks,
>122 byte&0x2 =1 dual PAL/NTSC
>122 byte&0x1 =1 PAL
>122 byte&0x1 =0 NTSC
# Impuse tracker module (audio/x-it)
0 string IMPM Impulse Tracker module sound data -
>4 string >\0 "%s"
>40 leshort !0 compatible w/ITv%x
>42 leshort !0 created w/ITv%x
# Imago Orpheus module (audio/x-imf)
60 string IM10 Imago Orpheus module sound data -
>0 string >\0 "%s"
# From <collver1@attbi.com>
# These are the /etc/magic entries to decode modules, instruments, and
# samples in Impulse Tracker's native format.
0 string IMPS Impulse Tracker Sample
>18 byte &2 16 bit
>18 byte ^2 8 bit
>18 byte &4 stereo
>18 byte ^4 mono
0 string IMPI Impulse Tracker Instrument
>28 leshort !0 ITv%x
>30 byte !0 %d samples
# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files
# From <collver1@attbi.com>
0 string LM8953 Yamaha TX Wave
>22 byte 0x49 looped
>22 byte 0xC9 non-looped
>23 byte 1 33kHz
>23 byte 2 50kHz
>23 byte 3 16kHz
# scream tracker: file(1) magic for Scream Tracker sample files
#
# From <collver1@attbi.com>
76 string SCRS Scream Tracker Sample
>0 byte 1 sample
>0 byte 2 adlib melody
>0 byte >2 adlib drum
>31 byte &2 stereo
>31 byte ^2 mono
>31 byte &4 16bit little endian
>31 byte ^4 8bit
>30 byte 0 unpacked
>30 byte 1 packed
# audio
# From: Cory Dikkers <cdikkers@swbell.net>
0 string MMD0 MED music file, version 0
0 string MMD1 OctaMED Pro music file, version 1
0 string MMD3 OctaMED Soundstudio music file, version 3
0 string OctaMEDCmpr OctaMED Soundstudio compressed file
0 string MED MED_Song
0 string SymM Symphonie SymMOD music file
#
0 string THX AHX version
>3 byte =0 1 module data
>3 byte =1 2 module data
#
0 string OKTASONG Oktalyzer module data
#
0 string DIGI\ Booster\ module\0 %s
>20 byte >0 %c
>>21 byte >0 \b%c
>>>22 byte >0 \b%c
>>>>23 byte >0 \b%c
>610 string >\0 \b, "%s"
#
0 string DBM0 DIGI Booster Pro Module
>4 byte >0 V%X.
>>5 byte x \b%02X
>16 string >\0 \b, "%s"
#
0 string FTMN FaceTheMusic module
>16 string >\0d \b, "%s"
# From: <doj@cubic.org> 2003-06-24
0 string AMShdr\32 Velvet Studio AMS Module v2.2
0 string Extreme Extreme Tracker AMS Module v1.3
0 string DDMF Xtracker DMF Module
>4 byte x v%i
>0xD string >\0 Title: "%s"
>0x2B string >\0 Composer: "%s"
0 string DSM\32 Dynamic Studio Module DSM
0 string SONG DigiTrekker DTM Module
0 string DMDL DigiTrakker MDL Module
0 string PSM\32 Protracker Studio PSM Module
44 string PTMF Poly Tracker PTM Module
>0 string >\32 Title: "%s"
0 string MT20 MadTracker 2.0 Module MT2
0 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
0 string RTMM RTM Module
0x426 string MaDoKaN96 XMS Adlib Module
>0 string >\0 Composer: "%s"
0 string AMF AMF Module
>4 string >\0 Title: "%s"
0 string MODINFO1 Open Cubic Player Module Inforation MDZ
0 string Extended\40Instrument: Fast Tracker II Instrument
# From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
# NOA Nancy Codec file
0 string \210NOA\015\012\032 NOA Nancy Codec Movie file
# Yamaha SMAF format
0 string MMMD Yamaha SMAF file
# Sharp Jisaku Melody format for PDC
0 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody
>20 string Ver01.00 Ver. 1.00
>>32 byte x , %d tracks
# Free lossless audio codec <http://flac.sourceforge.net>
# From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
0 string fLaC FLAC audio bitstream data
>4 byte&0x7f >0 \b, unknown version
>4 byte&0x7f 0 \b
# some common bits/sample values
>>20 beshort&0x1f0 0x030 \b, 4 bit
>>20 beshort&0x1f0 0x050 \b, 6 bit
>>20 beshort&0x1f0 0x070 \b, 8 bit
>>20 beshort&0x1f0 0x0b0 \b, 12 bit
>>20 beshort&0x1f0 0x0f0 \b, 16 bit
>>20 beshort&0x1f0 0x170 \b, 24 bit
>>20 byte&0xe 0x0 \b, mono
>>20 byte&0xe 0x2 \b, stereo
>>20 byte&0xe 0x4 \b, 3 channels
>>20 byte&0xe 0x6 \b, 4 channels
>>20 byte&0xe 0x8 \b, 5 channels
>>20 byte&0xe 0xa \b, 6 channels
>>20 byte&0xe 0xc \b, 7 channels
>>20 byte&0xe 0xe \b, 8 channels
# some common sample rates
>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz
>>17 belong&0xfffff0 0x07d000 \b, 32 kHz
>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz
>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz
>>17 belong&0xfffff0 0x03e800 \b, 16 kHz
>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz
>>17 belong&0xfffff0 0x02ee00 \b, 12 kHz
>>17 belong&0xfffff0 0x01f400 \b, 8 kHz
>>17 belong&0xfffff0 0x177000 \b, 96 kHz
>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz
>>21 byte&0xf >0 \b, >4G samples
>>21 byte&0xf 0 \b
>>>22 belong >0 \b, %u samples
>>>22 belong 0 \b, length unknown
# (ISDN) VBOX voice message file (Wolfram Kleff)
0 string VBOX VBOX voice message data
# ReBorn Song Files (.rbs)
# David J. Singer <doc@deadvirgins.org.uk>
8 string RB40 RBS Song file
>29 string ReBorn created by ReBorn
>37 string Propellerhead created by ReBirth
# Synthesizer Generator and Kimwitu share their file format
0 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data
# Kimwitu++ uses a slightly different magic
0 string A#S#C#S#S#L#HUB Kimwitu++ data
# From "Simon Hosie
0 string TFMX-SONG TFMX module sound data
# From danny.milo@gmx.net (Danny Milosavljevic)
# monkeysaudio for magic.mime
0 string MAC\ X/Monkey audio,
>4 leshort >0 version %d,
>6 leshort >0 compression level %d,
>8 leshort >0 flags %x,
>10 leshort >0 channels %d,
>12 lelong >0 samplerate %d,
>24 lelong >0 frames %d
# adlib sound files
# From Gürkan Sengün <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
0 string RAWADATA RdosPlay RAW
1068 string RoR AMUSIC Adlib Tracker
0 string JCH EdLib
0 string mpu401tr MPU-401 Trakker
0 string SAdT Surprise! Adlib Tracker
>4 byte x Version %d
0 string XAD! eXotic ADlib
0 string ofTAZ! eXtra Simple Music

12
file/magic/Magdir/bFLT
View File

@ -1,12 +0,0 @@
#------------------------------------------------------------------------------
# bFLT: file(1) magic for BFLT uclinux binary files
#
# From Philippe De Muyter <phdm@macqel.be>
#
0 string bFLT BFLT executable
>4 belong x - version %ld
>4 belong 4
>>36 belong&0x1 0x1 ram
>>36 belong&0x2 0x2 gotpic
>>36 belong&0x4 0x4 gzip
>>36 belong&0x8 0x8 gzdata

17
file/magic/Magdir/blender
View File

@ -1,17 +0,0 @@
#------------------------------------------------------------------------------
# blender: file(1) magic for Blender 3D data files
#
# Coded by Guillermo S. Romero <gsromero@alumnos.euitt.upm.es> using the
# data from Ton Roosendaal <ton@blender.nl>. Ton or his company do not
# support the rule, so mail GSR if problems with it. Rule version: 1.1.
# You can get latest version with comments and details about the format
# at http://acd.asoc.euitt.upm.es/~gsromero/3d/blender/magic.blender
0 string =BLENDER Blender3D,
>7 string =_ saved as 32-bits
>7 string =- saved as 64-bits
>8 string =v little endian
>8 string =V big endian
>9 byte x with version %c.
>10 byte x \b%c
>11 byte x \b%c

19
file/magic/Magdir/blit
View File

@ -1,19 +0,0 @@
#------------------------------------------------------------------------------
# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine
#
# Note that this 0407 conflicts with several other a.out formats...
#
# XXX - should this be redone with "be" and "le", so that it works on
# little-endian machines as well? If so, what's the deal with
# "VAX-order" and "VAX-order2"?
#
#0 long 0407 68K Blit (standalone) executable
#0 short 0407 VAX-order2 68K Blit (standalone) executable
0 short 03401 VAX-order 68K Blit (standalone) executable
0 long 0406 68k Blit mpx/mux executable
0 short 0406 VAX-order2 68k Blit mpx/mux executable
0 short 03001 VAX-order 68k Blit mpx/mux executable
# Need more values for WE32 DMD executables.
# Note that 0520 is the same as COFF
#0 short 0520 tty630 layers executable

9
file/magic/Magdir/bout
View File

@ -1,9 +0,0 @@
#
# i80960 b.out objects and archives
#
0 long 0x10d i960 b.out relocatable object
>16 long >0 not stripped
#
# b.out archive (hp-rt on i960)
0 string =!<bout> b.out archive
>8 string __.SYMDEF random library

41
file/magic/Magdir/bsdi
View File

@ -1,41 +0,0 @@
#------------------------------------------------------------------------------
# bsdi: file(1) magic for BSD/OS (from BSDI) objects
#
0 lelong 0314 386 compact demand paged pure executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses shared libs)
0 lelong 0407 386 executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses shared libs)
0 lelong 0410 386 pure executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses shared libs)
0 lelong 0413 386 demand paged pure executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses shared libs)
# same as in SunOS 4.x, except for static shared libraries
0 belong&077777777 0600413 sparc demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>36 belong 0xb4100001 (uses shared libs)
0 belong&077777777 0600410 sparc pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>36 belong 0xb4100001 (uses shared libs)
0 belong&077777777 0600407 sparc
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>36 belong 0xb4100001 (uses shared libs)

24
file/magic/Magdir/c-lang
View File

@ -1,24 +0,0 @@
#------------------------------------------------------------------------------
# c-lang: file(1) magic for C programs (or REXX)
#
# XPM icons (Greg Roelofs, newt@uchicago.edu)
# if you uncomment "/*" for C/REXX below, also uncomment this entry
#0 string /*\ XPM\ */ X pixmap image data
# this first will upset you if you're a PL/1 shop...
# in which case rm it; ascmagic will catch real C programs
#0 string /* C or REXX program text
#0 string // C++ program text
# From: Mikhail Teterin <mi@aldan.algebra.com>
0 string cscope cscope reference data
>7 string x version %.2s
# We skip the path here, because it is often long (so file will
# truncate it) and mostly redundant.
# The inverted index functionality was added some time betwen
# versions 11 and 15, so look for -q if version is above 14:
>7 string >14
>>10 regex .+\ -q\ with inverted index
>10 regex .+\ -c\ text (non-compressed)

27
file/magic/Magdir/c64
View File

@ -1,27 +0,0 @@
#------------------------------------------------------------------------------
# c64: file(1) magic for various commodore 64 related files
#
# From <doj@cubic.org>
0x16500 belong 0x12014100 D64 Image
0x16500 belong 0x12014180 D71 Image
0x61800 belong 0x28034400 D81 Image
0 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image
0 belong 0x43154164 X64 Image
0 string GCR-1541 GCR Image
>8 byte x version: $i
>9 byte x tracks: %i
9 string PSUR ARC archive (c64)
2 string -LH1- LHA archive (c64)
0 string C64File PC64 Emulator file
>8 string >\0 "%s"
0 string C64Image PC64 Freezer Image
0 beshort 0x38CD C64 PCLink Image
0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot
0 belong 0xFF424CFF WRAptor packer (c64)

36
file/magic/Magdir/cad
View File

@ -1,36 +0,0 @@
#------------------------------------------------------------------------------
# autocad: file(1) magic for cad files
#
# AutoCAD DWG versions R13/R14 (www.autodesk.com)
# Written December 01, 2003 by Lester Hightower
# Based on the DWG File Format Specifications at http://www.opendwg.org/
0 string \101\103\061\060\061 AutoCAD
>5 string \062\000\000\000\000 DWG ver. R13
>5 string \064\000\000\000\000 DWG ver. R14
# Microstation DGN/CIT Files (www.bentley.com)
# Written October 30, 2003 by Lester Hightower
# DGN is the default file extension of Microstation/Intergraph CAD files.
# CIT is the proprietary raster format (similar to TIFF) used to attach
# raster underlays to Microstation DGN (vector) drawings.
#
# http://www.wotsit.org/search.asp
# http://filext.com/detaillist.php?extdetail=DGN
# http://filext.com/detaillist.php?extdetail=CIT
#
# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
0 string \010\011\376 Microstation
>3 string \002
>>30 string \372\104 DGN File
>>30 string \172\104 DGN File
>>30 string \026\105 DGN File
>4 string \030\000\000 CIT File
# AutoCad, from Nahuel Greco
0 string AC1012 AutoCad (release 12)
0 string AC1014 AutoCad (release 14)

11
file/magic/Magdir/cddb
View File

@ -1,11 +0,0 @@
#------------------------------------------------------------------------------
# CDDB: file(1) magic for CDDB(tm) format CD text data files
#
# From <steve@gracenote.com>
#
# This is the /etc/magic entry to decode datafiles as used by
# CDDB-enabled CD player applications.
#
0 string/b #\040xmcd CDDB(tm) format CD text data

7
file/magic/Magdir/chi
View File

@ -1,7 +0,0 @@
#------------------------------------------------------------------------------
# chi: file(1) magic for ChiWriter files
#
0 string \\1cw\ ChiWriter file
>5 string >\0 version %s
0 string \\1cw ChiWriter file

9
file/magic/Magdir/chord
View File

@ -1,9 +0,0 @@
#------------------------------------------------------------------------------
# chord: file(1) magic for Chord music sheet typesetting utility input files
#
# From Philippe De Muyter <phdm@macqel.be>
# File format is actually free, but many distributed files begin with `{title'
#
0 string {title Chord text file

10
file/magic/Magdir/cisco
View File

@ -1,10 +0,0 @@
#------------------------------------------------------------------------------
# cisco: file(1) magic for cisco Systems routers
#
# Most cisco file-formats are covered by the generic elf code
#
# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
0 belong&0xffffff00 0x85011400 cisco IOS microcode
>7 string >\0 for '%s'
0 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode
>7 string >\0 for '%s'

6
file/magic/Magdir/citrus
View File

@ -1,6 +0,0 @@
#------------------------------------------------------------------------------
# citrus locale declaration
#
0 string RuneCT Citrus locale declaration for LC_CTYPE

46
file/magic/Magdir/claris
View File

@ -1,46 +0,0 @@
#------------------------------------------------------------------------------
# claris: file(1) magic for claris
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Claris Works a word processor, etc.
# Version 3.0
# .pct claris works clip art files
#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
#*
#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
#null to byte 1000 octal
514 string \377\377\377\377\000 Claris clip art?
>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
514 string \377\377\377\377\001 Claris clip art?
>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
# Claris works files
# .cwk
0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
# .plt
0 string \020\341\000\000\010\010 Claris Works pallete files .plt
# .msp a dictionary file I am not sure about this I have only one .msp file
0 string \002\271\262\000\040\002\000\164 Claris works dictionary
# .usp are user dictionary bits
# I am not sure about a magic header:
#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
# soh S p f 8 U D sp ^ S cr nl p o d i
#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
# a t r i s t sp ^ S cr nl d i v sp #
# .mth Thesaurus
# starts with \0 but no magic header
# .chy Hyphenation file
# I am not sure: 000 210 034 000 000
# other claris files
#./windows/claris/useng.ndx: data
#./windows/claris/xtndtran.l32: data
#./windows/claris/xtndtran.lst: data
#./windows/claris/clworks.lbl: data
#./windows/claris/clworks.prf: data
#./windows/claris/userd.spl: data

64
file/magic/Magdir/clipper
View File

@ -1,64 +0,0 @@
#------------------------------------------------------------------------------
# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what's the "!" stuff:
#
# >18 short !074000,000000 C1 R1
# >18 short !074000,004000 C2 R1
# >18 short !074000,010000 C3 R1
# >18 short !074000,074000 TEST
#
# I shall assume it's ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
# >18 short&074000 000000 C1 R1
# >18 short&074000 004000 C2 R1
# >18 short&074000 010000 C3 R1
# >18 short&074000 074000 TEST
#
# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
# sort, nor does SunOS 4.x, so either it's something Intergraph added
# in CLIX, or something AT&T added in SVR3.2 or later, or something
# somebody else thought was a good idea; it's not documented in the
# man page for this version of "magic", nor does it appear to be
# implemented (at least not after I blew off the bogus code to turn
# old-style "&"s into new-style "&"s, which just didn't work at all).
#
0 short 0575 CLIPPER COFF executable (VAX #)
>20 short 0407 (impure)
>20 short 0410 (5.2 compatible)
>20 short 0411 (pure)
>20 short 0413 (demand paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
>22 short >0 - version %ld
0 short 0577 CLIPPER COFF executable
>18 short&074000 000000 C1 R1
>18 short&074000 004000 C2 R1
>18 short&074000 010000 C3 R1
>18 short&074000 074000 TEST
>20 short 0407 (impure)
>20 short 0410 (pure)
>20 short 0411 (separate I&D)
>20 short 0413 (paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
>22 short >0 - version %ld
>48 long&01 01 alignment trap enabled
>52 byte 1 -Ctnc
>52 byte 2 -Ctsw
>52 byte 3 -Ctpw
>52 byte 4 -Ctcb
>53 byte 1 -Cdnc
>53 byte 2 -Cdsw
>53 byte 3 -Cdpw
>53 byte 4 -Cdcb
>54 byte 1 -Csnc
>54 byte 2 -Cssw
>54 byte 3 -Cspw
>54 byte 4 -Cscb
4 string pipe CLIPPER instruction trace
4 string prof CLIPPER instruction profile

53
file/magic/Magdir/commands
View File

@ -1,53 +0,0 @@
#------------------------------------------------------------------------------
# commands: file(1) magic for various shells and interpreters
#
0 string : shell archive or script for antique kernel text
0 string/b #!\ /bin/sh Bourne shell script text executable
0 string/b #!\ /bin/csh C shell script text executable
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0 string/b #!\ /bin/ksh Korn shell script text executable
0 string/b #!\ /bin/tcsh Tenex C shell script text executable
0 string/b #!\ /usr/local/tcsh Tenex C shell script text executable
0 string/b #!\ /usr/local/bin/tcsh Tenex C shell script text executable
#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0 string/b #!\ /bin/zsh Paul Falstad's zsh script text executable
0 string/b #!\ /usr/bin/zsh Paul Falstad's zsh script text executable
0 string/b #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable
0 string/b #!\ /usr/local/bin/ash Neil Brown's ash script text executable
0 string/b #!\ /usr/local/bin/ae Neil Brown's ae script text executable
0 string/b #!\ /bin/nawk new awk script text executable
0 string/b #!\ /usr/bin/nawk new awk script text executable
0 string/b #!\ /usr/local/bin/nawk new awk script text executable
0 string/b #!\ /bin/gawk GNU awk script text executable
0 string/b #!\ /usr/bin/gawk GNU awk script text executable
0 string/b #!\ /usr/local/bin/gawk GNU awk script text executable
#
0 string/b #!\ /bin/awk awk script text executable
0 string/b #!\ /usr/bin/awk awk script text executable
0 string BEGIN awk script text
# AT&T Bell Labs' Plan 9 shell
0 string/b #!\ /bin/rc Plan 9 rc shell script text executable
# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0 string/b #!\ /bin/bash Bourne-Again shell script text executable
0 string/b #!\ /usr/local/bin/bash Bourne-Again shell script text executable
# using env
0 string #!/usr/bin/env a
>15 string >\0 %s script text executable
0 string #!\ /usr/bin/env a
>16 string >\0 %s script text executable
# PHP scripts
# Ulf Harnhammar <ulfh@update.uu.se>
0 string/c =<?php PHP script text
0 string =<?\n PHP script text
0 string =<?\r PHP script text
0 string/b #!\ /usr/local/bin/php PHP script text executable
0 string/b #!\ /usr/bin/php PHP script text executable
0 string Zend\x00 PHP script Zend Optimizer data

21
file/magic/Magdir/communications
View File

@ -1,21 +0,0 @@
#----------------------------------------------------------------------------
# communication
# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
# It is used for conformance testing of communication protocols.
# Added by W. Borgert <debacle@debian.org>.
0 string $Suite TTCN Abstract Test Suite
>&1 string $SuiteId
>>&1 string >\n %s
>&2 string $SuiteId
>>&1 string >\n %s
>&3 string $SuiteId
>>&1 string >\n %s
# MSC (message sequence charts) are a formal description technique,
# described in ITU-T Z.120, mainly used for communication protocols.
# Added by W. Borgert <debacle@debian.org>.
0 string mscdocument Message Sequence Chart (document)
0 string msc Message Sequence Chart (chart)
0 string submsc Message Sequence Chart (subchart)

172
file/magic/Magdir/compress
View File

@ -1,172 +0,0 @@
#------------------------------------------------------------------------------
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.
# standard unix compress
0 string \037\235 compress'd data
>2 byte&0x80 >0 block compressed
>2 byte&0x1f x %d bits
# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
# * Original filename is only at offset 10 if "extra field" absent
# * Produce shorter output - notably, only report compression methods
# other than 8 ("deflate", the only method defined in RFC 1952).
0 string \037\213 gzip compressed data
>2 byte <8 \b, reserved method
>2 byte >8 \b, unknown method
>3 byte &0x01 \b, ASCII
>3 byte &0x02 \b, continuation
>3 byte &0x04 \b, extra field
>3 byte&0xC =0x08
>>10 string x \b, was "%s"
>9 byte =0x00 \b, from MS-DOS
>9 byte =0x01 \b, from Amiga
>9 byte =0x02 \b, from VMS
>9 byte =0x03 \b, from Unix
>9 byte =0x05 \b, from Atari
>9 byte =0x06 \b, from OS/2
>9 byte =0x07 \b, from MacOS
>9 byte =0x0A \b, from Tops/20
>9 byte =0x0B \b, from Win/32
>3 byte &0x10 \b, comment
>3 byte &0x20 \b, encrypted
### >4 ledate x last modified: %s,
>8 byte 2 \b, max compression
>8 byte 4 \b, max speed
# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
0 string \037\036 packed data
>2 belong >1 \b, %d characters originally
>2 belong =1 \b, %d character originally
#
# This magic number is byte-order-independent.
0 short 0x1f1f old packed data
# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0 short 0x1fff compacted data
# This string is valid for SunOS (BE) and a matching "short" is listed
# in the Ultrix (LE) magic file.
0 string \377\037 compacted data
0 short 0145405 huf output
# bzip2
0 string BZh bzip2 compressed data
>3 byte >47 \b, block size = %c00k
# squeeze and crunch
# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
0 beshort 0x76FF squeezed data,
>4 string x original name %s
0 beshort 0x76FE crunched data,
>2 string x original name %s
0 beshort 0x76FD LZH compressed data,
>2 string x original name %s
# Freeze
0 string \037\237 frozen file 2.1
0 string \037\236 frozen file 1.0 (or gzip 0.5)
# SCO compress -H (LZH)
0 string \037\240 SCO compress -H (LZH) data
# European GSM 06.10 is a provisional standard for full-rate speech
# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
# excitation/long term prediction) coding at 13 kbit/s.
#
# There's only a magic nibble (4 bits); that nibble repeats every 33
# bytes. This isn't suited for use, but maybe we can use it someday.
#
# This will cause very short GSM files to be declared as data and
# mismatches to be declared as data too!
#0 byte&0xF0 0xd0 data
#>33 byte&0xF0 0xd0
#>66 byte&0xF0 0xd0
#>99 byte&0xF0 0xd0
#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
# bzip a block-sorting file compressor
# by Julian Seward <sewardj@cs.man.ac.uk> and others
#
0 string BZ bzip compressed data
>2 byte x \b, version: %c
>3 string =1 \b, compression block size 100k
>3 string =2 \b, compression block size 200k
>3 string =3 \b, compression block size 300k
>3 string =4 \b, compression block size 400k
>3 string =5 \b, compression block size 500k
>3 string =6 \b, compression block size 600k
>3 string =7 \b, compression block size 700k
>3 string =8 \b, compression block size 800k
>3 string =9 \b, compression block size 900k
# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data
>9 beshort <0x0940
>>9 byte&0xf0 =0x00 - version 0.
>>9 beshort&0x0fff x \b%03x,
>>13 byte 1 LZO1X-1,
>>13 byte 2 LZO1X-1(15),
>>13 byte 3 LZO1X-999,
## >>22 bedate >0 last modified: %s,
>>14 byte =0x00 os: MS-DOS
>>14 byte =0x01 os: Amiga
>>14 byte =0x02 os: VMS
>>14 byte =0x03 os: Unix
>>14 byte =0x05 os: Atari
>>14 byte =0x06 os: OS/2
>>14 byte =0x07 os: MacOS
>>14 byte =0x0A os: Tops/20
>>14 byte =0x0B os: WinNT
>>14 byte =0x0E os: Win32
>9 beshort >0x0939
>>9 byte&0xf0 =0x00 - version 0.
>>9 byte&0xf0 =0x10 - version 1.
>>9 byte&0xf0 =0x20 - version 2.
>>9 beshort&0x0fff x \b%03x,
>>15 byte 1 LZO1X-1,
>>15 byte 2 LZO1X-1(15),
>>15 byte 3 LZO1X-999,
## >>25 bedate >0 last modified: %s,
>>17 byte =0x00 os: MS-DOS
>>17 byte =0x01 os: Amiga
>>17 byte =0x02 os: VMS
>>17 byte =0x03 os: Unix
>>17 byte =0x05 os: Atari
>>17 byte =0x06 os: OS/2
>>17 byte =0x07 os: MacOS
>>17 byte =0x0A os: Tops/20
>>17 byte =0x0B os: WinNT
>>17 byte =0x0E os: Win32
# 4.3BSD-Quasijarus Strong Compression
# http://minnie.tuhs.org/Quasijarus/compress.html
0 string \037\241 Quasijarus strong compressed data
# From: Cory Dikkers <cdikkers@swbell.net>
0 string XPKF Amiga xpkf.library compressed data
0 string PP11 Power Packer 1.1 compressed data
0 string PP20 Power Packer 2.0 compressed data,
>4 belong 0x09090909 fast compression
>4 belong 0x090A0A0A mediocre compression
>4 belong 0x090A0B0B good compression
>4 belong 0x090A0C0C very good compression
>4 belong 0x090A0C0D best compression
# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
# http://www.7-zip.org or DOC/7zFormat.txt
#
0 string 7z\274\257\047\034 7-zip archive data,
>6 byte x version %d
>7 byte x \b.%d
# AFX compressed files (Wolfram Kleff)
2 string -afx- AFX compressed file data

166
file/magic/Magdir/console
View File

@ -1,166 +0,0 @@
#------------------------------------------------------------------------------
# Console game magic
# Toby Deshane <hac@shoelace.digivill.net>
# ines: file(1) magic for Marat's iNES Nintendo Entertainment System
# ROM dump format
0 string NES\032 iNES ROM dump,
>4 byte x %dx16k PRG
>5 byte x \b, %dx8k CHR
>6 byte&0x01 =0x1 \b, [Vert.]
>6 byte&0x01 =0x0 \b, [Horiz.]
>6 byte&0x02 =0x2 \b, [SRAM]
>6 byte&0x04 =0x4 \b, [Trainer]
>6 byte&0x04 =0x8 \b, [4-Scr]
#------------------------------------------------------------------------------
# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
#
0x104 belong 0xCEED6666 Gameboy ROM:
>0x134 string >\0 "%.16s"
>0x146 byte 0x03 \b,[SGB]
>0x147 byte 0x00 \b, [ROM ONLY]
>0x147 byte 0x01 \b, [ROM+MBC1]
>0x147 byte 0x02 \b, [ROM+MBC1+RAM]
>0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT]
>0x147 byte 0x05 \b, [ROM+MBC2]
>0x147 byte 0x06 \b, [ROM+MBC2+BATTERY]
>0x147 byte 0x08 \b, [ROM+RAM]
>0x147 byte 0x09 \b, [ROM+RAM+BATTERY]
>0x147 byte 0x0B \b, [ROM+MMM01]
>0x147 byte 0x0C \b, [ROM+MMM01+SRAM]
>0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT]
>0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT]
>0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT]
>0x147 byte 0x11 \b, [ROM+MBC3]
>0x147 byte 0x12 \b, [ROM+MBC3+RAM]
>0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT]
>0x147 byte 0x19 \b, [ROM+MBC5]
>0x147 byte 0x1A \b, [ROM+MBC5+RAM]
>0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT]
>0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE]
>0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM]
>0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
>0x147 byte 0x1F \b, [Pocket Camera]
>0x147 byte 0xFD \b, [Bandai TAMA5]
>0x147 byte 0xFE \b, [Hudson HuC-3]
>0x147 byte 0xFF \b, [Hudson HuC-1]
>0x148 byte 0 \b, ROM: 256Kbit
>0x148 byte 1 \b, ROM: 512Kbit
>0x148 byte 2 \b, ROM: 1Mbit
>0x148 byte 3 \b, ROM: 2Mbit
>0x148 byte 4 \b, ROM: 4Mbit
>0x148 byte 5 \b, ROM: 8Mbit
>0x148 byte 6 \b, ROM: 16Mbit
>0x148 byte 0x52 \b, ROM: 9Mbit
>0x148 byte 0x53 \b, ROM: 10Mbit
>0x148 byte 0x54 \b, ROM: 12Mbit
>0x149 byte 1 \b, RAM: 16Kbit
>0x149 byte 2 \b, RAM: 64Kbit
>0x149 byte 3 \b, RAM: 128Kbit
>0x149 byte 4 \b, RAM: 1Mbit
#>0x14e long x \b, CRC: %x
#------------------------------------------------------------------------------
# genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format
#
0x100 string SEGA Sega MegaDrive/Genesis raw ROM dump
>0x120 string >\0 Name: "%.16s"
>0x110 string >\0 %.16s
>0x1B0 string RA with SRAM
#------------------------------------------------------------------------------
# genesis: file(1) magic for the Super MegaDrive ROM dump format
#
0x280 string EAGN Super MagicDrive ROM dump
>0 byte x %dx16k blocks
>2 byte 0 \b, last in series or standalone
>2 byte >0 \b, split ROM
>8 byte 0xAA
>9 byte 0xBB
#------------------------------------------------------------------------------
# genesis: file(1) alternate magic for the Super MegaDrive ROM dump format
#
0x280 string EAMG Super MagicDrive ROM dump
>0 byte x %dx16k blocks
>2 byte x \b, last in series or standalone
>8 byte 0xAA
>9 byte 0xBB
#------------------------------------------------------------------------------
# smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps
#
# Does not detect all images. Very preliminary guesswork. Need more data
# on format.
#
# FIXME: need a little more info...;P
#
#0 byte 0xF3
#>1 byte 0xED Sega Master System/Game Gear ROM dump
#>1 byte 0x31 Sega Master System/Game Gear ROM dump
#>1 byte 0xDB Sega Master System/Game Gear ROM dump
#>1 byte 0xAF Sega Master System/Game Gear ROM dump
#>1 byte 0xC3 Sega Master System/Game Gear ROM dump
#------------------------------------------------------------------------------
# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format
#
0 belong 0x21068028 Sega Dreamcast VMU game image
0 string LCDi Dream Animator file
#------------------------------------------------------------------------------
# v64: file(1) uncertain magic for the V64 format N64 ROM dumps
#
0 belong 0x37804012 V64 Nintendo 64 ROM dump
#------------------------------------------------------------------------------
# msx: file(1) magic for MSX game cartridge dumps
# Too simple - MPi
#0 beshort 0x4142 MSX game cartridge dump
#------------------------------------------------------------------------------
# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
0 string PS-X\ EXE Sony Playstation executable
# Area:
>113 string x (%s)
#------------------------------------------------------------------------------
# Microsoft Xbox executables .xbe (Esa Hyytiä <ehyytia@cc.hut.fi>)
0 string XBEH XBE, Microsoft Xbox executable
# probabilistic checks whether signed or not
>0x0004 ulelong =0x0
>>&2 ulelong =0x0
>>>&2 ulelong =0x0 \b, not signed
>0x0004 ulelong >0
>>&2 ulelong >0
>>>&2 ulelong >0 \b, signed
# expect base address of 0x10000
>0x0104 ulelong =0x10000
>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions
>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007
>>>(0x0118-0x0FF60) ulelong >0 (regions:
>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA
>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan
>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World
>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer
>>>(0x0118-0x0FF60) ulelong >0 \b)
# --------------------------------
# Microsoft Xbox data file formats
0 string XIP0 XIP, Microsoft Xbox data
0 string XTF0 XTF, Microsoft Xbox data
# Atari Lynx cartridge dump (EXE/BLL header)
# From: "Stefan A. Haubenthal" <polluks@web.de>
0 beshort 0x8008 Lynx cartridge,
>2 beshort x RAM start $%04x
>6 string BS93

69
file/magic/Magdir/convex
View File

@ -1,69 +0,0 @@
#------------------------------------------------------------------------------
# convex: file(1) magic for Convex boxes
#
# Convexes are big-endian.
#
# /*\
# * Below are the magic numbers and tests added for Convex.
# * Added at beginning, because they are expected to be used most.
# \*/
0 belong 0507 Convex old-style object
>16 belong >0 not stripped
0 belong 0513 Convex old-style demand paged executable
>16 belong >0 not stripped
0 belong 0515 Convex old-style pre-paged executable
>16 belong >0 not stripped
0 belong 0517 Convex old-style pre-paged, non-swapped executable
>16 belong >0 not stripped
0 belong 0x011257 Core file
#
# The following are a series of dump format magic numbers. Each one
# corresponds to a drastically different dump format. The first on is
# the original dump format on a 4.1 BSD or earlier file system. The
# second marks the change between the 4.1 file system and the 4.2 file
# system. The Third marks the changing of the block size from 1K
# to 2K to be compatible with an IDC file system. The fourth indicates
# a dump that is dependent on Convex Storage Manager, because data in
# secondary storage is not physically contained within the dump.
# The restore program uses these number to determine how the data is
# to be extracted.
#
24 belong =60011 dump format, 4.1 BSD or earlier
24 belong =60012 dump format, 4.2 or 4.3 BSD without IDC
24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible)
24 belong =60014 dump format, Convex Storage Manager by-reference dump
#
# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
# If there is no `=' sign, assume just checking for whether the bit is set?
#
0 belong 0601 Convex SOFF
>88 belong&0x000f0000 =0x00000000 c1
>88 belong &0x00010000 c2
>88 belong &0x00020000 c2mp
>88 belong &0x00040000 parallel
>88 belong &0x00080000 intrinsic
>88 belong &0x00000001 demand paged
>88 belong &0x00000002 pre-paged
>88 belong &0x00000004 non-swapped
>88 belong &0x00000008 POSIX
#
>84 belong &0x80000000 executable
>84 belong &0x40000000 object
>84 belong&0x20000000 =0 not stripped
>84 belong&0x18000000 =0x00000000 native fpmode
>84 belong&0x18000000 =0x10000000 ieee fpmode
>84 belong&0x18000000 =0x18000000 undefined fpmode
#
0 belong 0605 Convex SOFF core
#
0 belong 0607 Convex SOFF checkpoint
>88 belong&0x000f0000 =0x00000000 c1
>88 belong &0x00010000 c2
>88 belong &0x00020000 c2mp
>88 belong &0x00040000 parallel
>88 belong &0x00080000 intrinsic
>88 belong &0x00000008 POSIX
#
>84 belong&0x18000000 =0x00000000 native fpmode
>84 belong&0x18000000 =0x10000000 ieee fpmode
>84 belong&0x18000000 =0x18000000 undefined fpmode

5
file/magic/Magdir/ctags
View File

@ -1,5 +0,0 @@
# ----------------------------------------------------------------------------
# ctags: file (1) magic for Exuberant Ctags files
# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
0 string =!_TAG Exuberant Ctags tag file text

10
file/magic/Magdir/dact
View File

@ -1,10 +0,0 @@
#------------------------------------------------------------------------------
# dact: file(1) magic for DACT compressed files
#
0 long 0x444354C3 DACT compressed data
>4 byte >-1 (version %i.
>5 byte >-1 $BS%i.
>6 byte >-1 $BS%i)
>7 long >0 $BS, original size: %i bytes
>15 long >30 $BS, block size: %i bytes

212
file/magic/Magdir/database
View File

@ -1,212 +0,0 @@
#------------------------------------------------------------------------------
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
#
#
# GDBM magic numbers
# Will be maintained as part of the GDBM distribution in the future.
# <downsj@teeny.org>
0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian
0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian
0 string GDBM GNU dbm 2.x database
#
# Berkeley DB
#
# Ian Darwin's file /etc/magic files: big/little-endian version.
#
# Hash 1.85/1.86 databases store metadata in network byte order.
# Btree 1.85/1.86 databases store the metadata in host byte order.
# Hash and Btree 2.X and later databases store the metadata in host byte order.
0 long 0x00061561 Berkeley DB
>8 belong 4321
>>4 belong >2 1.86
>>4 belong <3 1.85
>>4 belong >0 (Hash, version %d, native byte-order)
>8 belong 1234
>>4 belong >2 1.86
>>4 belong <3 1.85
>>4 belong >0 (Hash, version %d, little-endian)
0 belong 0x00061561 Berkeley DB
>8 belong 4321
>>4 belong >2 1.86
>>4 belong <3 1.85
>>4 belong >0 (Hash, version %d, big-endian)
>8 belong 1234
>>4 belong >2 1.86
>>4 belong <3 1.85
>>4 belong >0 (Hash, version %d, native byte-order)
0 long 0x00053162 Berkeley DB 1.85/1.86
>4 long >0 (Btree, version %d, native byte-order)
0 belong 0x00053162 Berkeley DB 1.85/1.86
>4 belong >0 (Btree, version %d, big-endian)
0 lelong 0x00053162 Berkeley DB 1.85/1.86
>4 lelong >0 (Btree, version %d, little-endian)
12 long 0x00061561 Berkeley DB
>16 long >0 (Hash, version %d, native byte-order)
12 belong 0x00061561 Berkeley DB
>16 belong >0 (Hash, version %d, big-endian)
12 lelong 0x00061561 Berkeley DB
>16 lelong >0 (Hash, version %d, little-endian)
12 long 0x00053162 Berkeley DB
>16 long >0 (Btree, version %d, native byte-order)
12 belong 0x00053162 Berkeley DB
>16 belong >0 (Btree, version %d, big-endian)
12 lelong 0x00053162 Berkeley DB
>16 lelong >0 (Btree, version %d, little-endian)
12 long 0x00042253 Berkeley DB
>16 long >0 (Queue, version %d, native byte-order)
12 belong 0x00042253 Berkeley DB
>16 belong >0 (Queue, version %d, big-endian)
12 lelong 0x00042253 Berkeley DB
>16 lelong >0 (Queue, version %d, little-endian)
# From Max Bowsher.
12 long 0x00040988 Berkeley DB
>16 long >0 (Log, version %d, native byte-order)
12 belong 0x00040988 Berkeley DB
>16 belong >0 (Log, version %d, big-endian)
12 lelong 0x00040988 Berkeley DB
>16 lelong >0 (Log, version %d, little-endian)
#
#
# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
0 string RRD RRDTool DB
>4 string x version %s
#----------------------------------------------------------------------
# ROOT: file(1) magic for ROOT databases
#
0 string root\0 ROOT file
>4 belong x Version %d
>33 belong x (Compression: %d)
# XXX: Weak magic.
# Alex Ott <ott@jet.msk.su>
## Paradox file formats
#2 leshort 0x0800 Paradox
#>0x39 byte 3 v. 3.0
#>0x39 byte 4 v. 3.5
#>0x39 byte 9 v. 4.x
#>0x39 byte 10 v. 5.x
#>0x39 byte 11 v. 5.x
#>0x39 byte 12 v. 7.x
#>>0x04 byte 0 indexed .DB data file
#>>0x04 byte 1 primary index .PX file
#>>0x04 byte 2 non-indexed .DB data file
#>>0x04 byte 3 non-incrementing secondary index .Xnn file
#>>0x04 byte 4 secondary index .Ynn file
#>>0x04 byte 5 incrementing secondary index .Xnn file
#>>0x04 byte 6 non-incrementing secondary index .XGn file
#>>0x04 byte 7 secondary index .YGn file
#>>>0x04 byte 8 incrementing secondary index .XGn file
## XBase database files
#0 byte 0x02
#>8 leshort >0
#>>12 leshort 0 FoxBase
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x03
#>8 leshort >0
#>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x04
#>8 leshort >0
#>>12 leshort 0 dBASE IV no memo file
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x05
#>8 leshort >0
#>>12 leshort 0 dBASE V no memo file
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x30
#>8 leshort >0
#>>12 leshort 0 Visual FoxPro
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x43
#>8 leshort >0
#>>12 leshort 0 FlagShip with memo var size
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x7b
#>8 leshort >0
#>>12 leshort 0 dBASEIV with memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x83
#>8 leshort >0
#>>12 leshort 0 FoxBase+, dBaseIII+ with memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x8b
#>8 leshort >0
#>>12 leshort 0 dBaseIV with memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x8e
#>8 leshort >0
#>>12 leshort 0 dBaseIV with SQL Table
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0xb3
#>8 leshort >0
#>>12 leshort 0 FlagShip with .dbt memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0xf5
#>8 leshort >0
#>>12 leshort 0 FoxPro with memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 leshort 0x0006 DBase 3 index file
# MS Access database
4 string Standard\ Jet\ DB Microsoft Access Database
# TDB database from Samba et al - Martin Pool <mbp@samba.org>
0 string TDB\ file TDB database
>32 lelong 0x2601196D version 6, little-endian
>>36 lelong x hash size %d bytes
# SE Linux policy database
0 lelong 0xf97cff8c SE Linux policy
>16 lelong x v%d
>20 lelong 1 MLS
>24 lelong x %d symbols
>28 lelong x %d ocons
# ICE authority file data (Wolfram Kleff)
2 string ICE ICE authority data
# X11 Xauthority file (Wolfram Kleff)
10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data

11
file/magic/Magdir/diamond
View File

@ -1,11 +0,0 @@
#------------------------------------------------------------------------------
# diamond: file(1) magic for Diamond system
#
# ... diamond is a multi-media mail and electronic conferencing system....
#
# XXX - I think it was either renamed Slate, or replaced by Slate....
#
# The full deal is too long...
#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document
0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document

8
file/magic/Magdir/diff
View File

@ -1,8 +0,0 @@
#------------------------------------------------------------------------------
# diff: file(1) magic for diff(1) output
#
0 string diff\ 'diff' output text
0 string ***\ 'diff' output text
0 string Only\ in\ 'diff' output text
0 string Common\ subdirectories:\ 'diff' output text

41
file/magic/Magdir/digital
View File

@ -1,41 +0,0 @@
# Digital UNIX - Info
#
0 string =!<arch>\n________64E Alpha archive
>22 string X -- out of date
#
# Alpha COFF Based Executables
# The stripped stuff really needs to be an 8 byte (64 bit) compare,
# but this works
0 leshort 0x183 COFF format alpha
>22 leshort&020000 &010000 sharable library,
>22 leshort&020000 ^010000 dynamically linked,
>24 leshort 0410 pure
>24 leshort 0413 demand paged
>8 lelong >0 executable or object module, not stripped
>8 lelong 0
>>12 lelong 0 executable or object module, stripped
>>12 lelong >0 executable or object module, not stripped
>27 byte >0 - version %d.
>26 byte >0 %d-
>28 leshort >0 %d
#
# The next is incomplete, we could tell more about this format,
# but its not worth it.
0 leshort 0x188 Alpha compressed COFF
0 leshort 0x18f Alpha u-code object
#
#
# Some other interesting Digital formats,
0 string \377\377\177 ddis/ddif
0 string \377\377\174 ddis/dots archive
0 string \377\377\176 ddis/dtif table data
0 string \033c\033 LN03 output
0 long 04553207 X image
#
0 string =!<PDF>!\n profiling data file
#
# Locale data tables (MIPS and Alpha).
#
0 short 0x0501 locale data table
>6 short 0x24 for MIPS
>6 short 0x40 for Alpha

57
file/magic/Magdir/dolby
View File

@ -1,57 +0,0 @@
# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
# from http://www.atsc.org/standards/a_52a.pdf
# corrections, additions, etc. are always welcome!
#
# syncword
0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream,
# fscod
>4 byte&0xc0 0x00 48 kHz,
>4 byte&0xc0 0x40 44.1 kHz,
>4 byte&0xc0 0x80 32 kHz,
# is this one used for 96 kHz?
>4 byte&0xc0 0xc0 reserved frequency,
#
>5 byte&7 = 0 \b, complete main (CM)
>5 byte&7 = 1 \b, music and effects (ME)
>5 byte&7 = 2 \b, visually impaired (VI)
>5 byte&7 = 3 \b, hearing impaired (HI)
>5 byte&7 = 4 \b, dialogue (D)
>5 byte&7 = 5 \b, commentary (C)
>5 byte&7 = 6 \b, emergency (E)
# acmod
>6 byte&0xe0 0x00 1+1 front,
>6 byte&0xe0 0x20 1 front/0 rear,
>6 byte&0xe0 0x40 2 front/0 rear,
>6 byte&0xe0 0x60 3 front/0 rear,
>6 byte&0xe0 0x80 2 front/1 rear,
>6 byte&0xe0 0xa0 3 front/1 rear,
>6 byte&0xe0 0xc0 2 front/2 rear,
>6 byte&0xe0 0xe0 3 front/2 rear,
# lfeon (these may be incorrect)
>7 byte&0x40 0x00 LFE off,
>7 byte&0x40 0x40 LFE on,
#
>4 byte&0x3e = 0x00 \b, 32 kbit/s
>4 byte&0x3e = 0x02 \b, 40 kbit/s
>4 byte&0x3e = 0x04 \b, 48 kbit/s
>4 byte&0x3e = 0x06 \b, 56 kbit/s
>4 byte&0x3e = 0x08 \b, 64 kbit/s
>4 byte&0x3e = 0x0a \b, 80 kbit/s
>4 byte&0x3e = 0x0c \b, 96 kbit/s
>4 byte&0x3e = 0x0e \b, 112 kbit/s
>4 byte&0x3e = 0x10 \b, 128 kbit/s
>4 byte&0x3e = 0x12 \b, 160 kbit/s
>4 byte&0x3e = 0x14 \b, 192 kbit/s
>4 byte&0x3e = 0x16 \b, 224 kbit/s
>4 byte&0x3e = 0x18 \b, 256 kbit/s
>4 byte&0x3e = 0x1a \b, 320 kbit/s
>4 byte&0x3e = 0x1c \b, 384 kbit/s
>4 byte&0x3e = 0x1e \b, 448 kbit/s
>4 byte&0x3e = 0x20 \b, 512 kbit/s
>4 byte&0x3e = 0x22 \b, 576 kbit/s
>4 byte&0x3e = 0x24 \b, 640 kbit/s
# dsurmod (these may be incorrect)
>6 beshort&0x0180 0x0000 Dolby Surround not indicated
>6 beshort&0x0180 0x0080 not Dolby Surround encoded
>6 beshort&0x0180 0x0100 Dolby Surround encoded
>6 beshort&0x0180 0x0180 reserved Dolby Surround mode

81
file/magic/Magdir/dump
View File

@ -1,81 +0,0 @@
#------------------------------------------------------------------------------
# dump: file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#
24 belong 60012 new-fs dump file (big endian),
>4 bedate x Previous dump %s,
>8 bedate x This dump %s,
>12 belong >0 Volume %ld,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
>0 belong 2 beginning of file record,
>0 belong 3 map of inodes on tape,
>0 belong 4 continuation of file record,
>0 belong 5 end of volume,
>0 belong 6 map of inodes deleted,
>0 belong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 belong >0 Flags %x
24 belong 60011 old-fs dump file (big endian),
#>4 bedate x Previous dump %s,
#>8 bedate x This dump %s,
>12 belong >0 Volume %ld,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
>0 belong 2 beginning of file record,
>0 belong 3 map of inodes on tape,
>0 belong 4 continuation of file record,
>0 belong 5 end of volume,
>0 belong 6 map of inodes deleted,
>0 belong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 belong >0 Flags %x
24 lelong 60012 new-fs dump file (little endian),
>4 ledate x This dump %s,
>8 ledate x Previous dump %s,
>12 lelong >0 Volume %ld,
>692 lelong 0 Level zero, type:
>692 lelong >0 Level %d, type:
>0 lelong 1 tape header,
>0 lelong 2 beginning of file record,
>0 lelong 3 map of inodes on tape,
>0 lelong 4 continuation of file record,
>0 lelong 5 end of volume,
>0 lelong 6 map of inodes deleted,
>0 lelong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 lelong >0 Flags %x
24 lelong 60011 old-fs dump file (little endian),
#>4 ledate x Previous dump %s,
#>8 ledate x This dump %s,
>12 lelong >0 Volume %ld,
>692 lelong 0 Level zero, type:
>692 lelong >0 Level %d, type:
>0 lelong 1 tape header,
>0 lelong 2 beginning of file record,
>0 lelong 3 map of inodes on tape,
>0 lelong 4 continuation of file record,
>0 lelong 5 end of volume,
>0 lelong 6 map of inodes deleted,
>0 lelong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 lelong >0 Flags %x

12
file/magic/Magdir/dyadic
View File

@ -1,12 +0,0 @@
#------------------------------------------------------------------------------
# Dyadic: file(1) magic for Dyalog APL.
#
0 byte 0xaa
>1 byte <4 Dyalog APL
>>1 byte 0x00 incomplete workspace
>>1 byte 0x01 component file
>>1 byte 0x02 external variable
>>1 byte 0x03 workspace
>>2 byte x version %d
>>3 byte x .%d

13
file/magic/Magdir/editors
View File

@ -1,13 +0,0 @@
#------------------------------------------------------------------------------
# T602 editor documents
# by David Necas <yeti@physics.muni.cz>
0 string @CT\ T602 document data,
>4 string 0 Kamenicky
>4 string 1 CP 852
>4 string 2 KOI8-CS
>4 string >2 unknown encoding
# Vi IMproved Encrypted file
# by David Necas <yeti@physics.muni.cz>
0 string VimCrypt~ Vim encrypted file data

222
file/magic/Magdir/elf
View File

@ -1,222 +0,0 @@
#------------------------------------------------------------------------------
# elf: file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
0 string \177ELF ELF
>4 byte 0 invalid class
>4 byte 1 32-bit
# only for MIPS - in the future, the ABI field of e_flags should be used.
>>18 leshort 8
>>>36 lelong &0x20 N32
>>18 leshort 10
>>>36 lelong &0x20 N32
>>18 beshort 8
>>>36 belong &0x20 N32
>>18 beshort 10
>>>36 belong &0x20 N32
>4 byte 2 64-bit
>5 byte 0 invalid byte order
>5 byte 1 LSB
# The official e_machine number for MIPS is now #8, regardless of endianness.
# The second number (#10) will be deprecated later. For now, we still
# say something if #10 is encountered, but only gory details for #8.
>>18 leshort 8
# only for 32-bit
>>>4 byte 1
>>>>36 lelong&0xf0000000 0x00000000 MIPS-I
>>>>36 lelong&0xf0000000 0x10000000 MIPS-II
>>>>36 lelong&0xf0000000 0x20000000 MIPS-III
>>>>36 lelong&0xf0000000 0x30000000 MIPS-IV
>>>>36 lelong&0xf0000000 0x40000000 MIPS-V
>>>>36 lelong&0xf0000000 0x60000000 MIPS32
>>>>36 lelong&0xf0000000 0x70000000 MIPS64
>>>>36 lelong&0xf0000000 0x80000000 MIPS32 rel2
>>>>36 lelong&0xf0000000 0x90000000 MIPS64 rel2
# only for 64-bit
>>>4 byte 2
>>>>48 lelong&0xf0000000 0x00000000 MIPS-I
>>>>48 lelong&0xf0000000 0x10000000 MIPS-II
>>>>48 lelong&0xf0000000 0x20000000 MIPS-III
>>>>48 lelong&0xf0000000 0x30000000 MIPS-IV
>>>>48 lelong&0xf0000000 0x40000000 MIPS-V
>>>>48 lelong&0xf0000000 0x60000000 MIPS32
>>>>48 lelong&0xf0000000 0x70000000 MIPS64
>>>>48 lelong&0xf0000000 0x80000000 MIPS32 rel2
>>>>48 lelong&0xf0000000 0x90000000 MIPS64 rel2
>>16 leshort 0 no file type,
>>16 leshort 1 relocatable,
>>16 leshort 2 executable,
>>16 leshort 3 shared object,
# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
>>16 leshort 4 core file
# Core file detection is not reliable.
#>>>(0x38+0xcc) string >\0 of '%s'
#>>>(0x38+0x10) lelong >0 (signal %d),
>>16 leshort &0xff00 processor-specific,
>>18 leshort 0 no machine,
>>18 leshort 1 AT&T WE32100 - invalid byte order,
>>18 leshort 2 SPARC - invalid byte order,
>>18 leshort 3 Intel 80386,
>>18 leshort 4 Motorola
>>>36 lelong &0x01000000 68000 - invalid byte order,
>>>36 lelong &0x00810000 CPU32 - invalid byte order,
>>>36 lelong 0 68020 - invalid byte order,
>>18 leshort 5 Motorola 88000 - invalid byte order,
>>18 leshort 6 Intel 80486,
>>18 leshort 7 Intel 80860,
>>18 leshort 8 MIPS,
>>18 leshort 9 Amdahl - invalid byte order,
>>18 leshort 10 MIPS (deprecated),
>>18 leshort 11 RS6000 - invalid byte order,
>>18 leshort 15 PA-RISC - invalid byte order,
>>>50 leshort 0x0214 2.0
>>>48 leshort &0x0008 (LP64),
>>18 leshort 16 nCUBE,
>>18 leshort 17 Fujitsu VPP500,
>>18 leshort 18 SPARC32PLUS,
>>18 leshort 20 PowerPC,
>>18 leshort 22 IBM S/390,
>>18 leshort 36 NEC V800,
>>18 leshort 37 Fujitsu FR20,
>>18 leshort 38 TRW RH-32,
>>18 leshort 39 Motorola RCE,
>>18 leshort 40 ARM,
>>18 leshort 41 Alpha,
>>18 leshort 0xa390 IBM S/390 (obsolete),
>>18 leshort 42 Hitachi SH,
>>18 leshort 43 SPARC V9 - invalid byte order,
>>18 leshort 44 Siemens Tricore Embedded Processor,
>>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
>>18 leshort 46 Hitachi H8/300,
>>18 leshort 47 Hitachi H8/300H,
>>18 leshort 48 Hitachi H8S,
>>18 leshort 49 Hitachi H8/500,
>>18 leshort 50 IA-64,
>>18 leshort 51 Stanford MIPS-X,
>>18 leshort 52 Motorola Coldfire,
>>18 leshort 53 Motorola M68HC12,
>>18 leshort 62 AMD x86-64,
>>18 leshort 75 Digital VAX,
>>18 leshort 88 Renesas M32R,
>>18 leshort 97 NatSemi 32k,
>>18 leshort 0x9026 Alpha (unofficial),
>>20 lelong 0 invalid version
>>20 lelong 1 version 1
>>36 lelong 1 MathCoPro/FPU/MAU Required
>5 byte 2 MSB
# only for MIPS - see comment in little-endian section above.
>>18 beshort 8
# only for 32-bit
>>>4 byte 1
>>>>36 belong&0xf0000000 0x00000000 MIPS-I
>>>>36 belong&0xf0000000 0x10000000 MIPS-II
>>>>36 belong&0xf0000000 0x20000000 MIPS-III
>>>>36 belong&0xf0000000 0x30000000 MIPS-IV
>>>>36 belong&0xf0000000 0x40000000 MIPS-V
>>>>36 belong&0xf0000000 0x60000000 MIPS32
>>>>36 belong&0xf0000000 0x70000000 MIPS64
>>>>36 belong&0xf0000000 0x80000000 MIPS32 rel2
>>>>36 belong&0xf0000000 0x90000000 MIPS64 rel2
# only for 64-bit
>>>4 byte 2
>>>>48 belong&0xf0000000 0x00000000 MIPS-I
>>>>48 belong&0xf0000000 0x10000000 MIPS-II
>>>>48 belong&0xf0000000 0x20000000 MIPS-III
>>>>48 belong&0xf0000000 0x30000000 MIPS-IV
>>>>48 belong&0xf0000000 0x40000000 MIPS-V
>>>>48 belong&0xf0000000 0x60000000 MIPS32
>>>>48 belong&0xf0000000 0x70000000 MIPS64
>>>>48 belong&0xf0000000 0x80000000 MIPS32 rel2
>>>>48 belong&0xf0000000 0x90000000 MIPS64 rel2
>>16 beshort 0 no file type,
>>16 beshort 1 relocatable,
>>16 beshort 2 executable,
>>16 beshort 3 shared object,
>>16 beshort 4 core file,
#>>>(0x38+0xcc) string >\0 of '%s'
#>>>(0x38+0x10) belong >0 (signal %d),
>>16 beshort &0xff00 processor-specific,
>>18 beshort 0 no machine,
>>18 beshort 1 AT&T WE32100,
>>18 beshort 2 SPARC,
>>18 beshort 3 Intel 80386 - invalid byte order,
>>18 beshort 4 Motorola
>>>36 belong &0x01000000 68000,
>>>36 belong &0x00810000 CPU32,
>>>36 belong 0 68020,
>>18 beshort 5 Motorola 88000,
>>18 beshort 6 Intel 80486 - invalid byte order,
>>18 beshort 7 Intel 80860,
>>18 beshort 8 MIPS,
>>18 beshort 9 Amdahl,
>>18 beshort 10 MIPS (deprecated),
>>18 beshort 11 RS6000,
>>18 beshort 15 PA-RISC
>>>50 beshort 0x0214 2.0
>>>48 beshort &0x0008 (LP64)
>>18 beshort 16 nCUBE,
>>18 beshort 17 Fujitsu VPP500,
>>18 beshort 18 SPARC32PLUS,
>>>36 belong&0xffff00 &0x000100 V8+ Required,
>>>36 belong&0xffff00 &0x000200 Sun UltraSPARC1 Extensions Required,
>>>36 belong&0xffff00 &0x000400 HaL R1 Extensions Required,
>>>36 belong&0xffff00 &0x000800 Sun UltraSPARC3 Extensions Required,
>>18 beshort 20 PowerPC or cisco 4500,
>>18 beshort 21 cisco 7500,
>>18 beshort 22 IBM S/390,
>>18 beshort 24 cisco SVIP,
>>18 beshort 25 cisco 7200,
>>18 beshort 36 NEC V800 or cisco 12000,
>>18 beshort 37 Fujitsu FR20,
>>18 beshort 38 TRW RH-32,
>>18 beshort 39 Motorola RCE,
>>18 beshort 40 ARM,
>>18 beshort 41 Alpha,
>>18 beshort 42 Hitachi SH,
>>18 beshort 43 SPARC V9,
>>18 beshort 44 Siemens Tricore Embedded Processor,
>>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
>>18 beshort 46 Hitachi H8/300,
>>18 beshort 47 Hitachi H8/300H,
>>18 beshort 48 Hitachi H8S,
>>18 beshort 49 Hitachi H8/500,
>>18 beshort 50 IA-64,
>>18 beshort 51 Stanford MIPS-X,
>>18 beshort 52 Motorola Coldfire,
>>18 beshort 53 Motorola M68HC12,
>>18 beshort 73 Cray NV1,
>>18 beshort 75 Digital VAX,
>>18 beshort 88 Renesas M32R,
>>18 beshort 97 NatSemi 32k,
>>18 beshort 0x9026 Alpha (unofficial),
>>18 beshort 0xa390 IBM S/390 (obsolete),
>>20 belong 0 invalid version
>>20 belong 1 version 1
>>36 belong 1 MathCoPro/FPU/MAU Required
# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
# like proper ELF, but extracting the string had bad results.
>4 byte <0x80
>>8 string >\0 (%s)
>8 string \0
>>7 byte 0 (SYSV)
>>7 byte 1 (HP-UX)
>>7 byte 2 (NetBSD)
>>7 byte 3 (GNU/Linux)
>>7 byte 4 (GNU/Hurd)
>>7 byte 5 (86Open)
>>7 byte 6 (Solaris)
>>7 byte 7 (Monterey)
>>7 byte 8 (IRIX)
>>7 byte 9 (FreeBSD)
>>7 byte 10 (Tru64)
>>7 byte 11 (Novell Modesto)
>>7 byte 12 (OpenBSD)
>>7 byte 97 (ARM)
>>7 byte 255 (embedded)

21
file/magic/Magdir/encore
View File

@ -1,21 +0,0 @@
#------------------------------------------------------------------------------
# encore: file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
# dunno whether they run the 88K in little-endian mode or not).
#
0 short 0x154 Encore
>20 short 0x107 executable
>20 short 0x108 pure executable
>20 short 0x10b demand-paged executable
>20 short 0x10f unsupported executable
>12 long >0 not stripped
>22 short >0 - version %ld
>22 short 0 -
#>4 date x stamp %s
0 short 0x155 Encore unsupported executable
>12 long >0 not stripped
>22 short >0 - version %ld
>22 short 0 -
#>4 date x stamp %s

10
file/magic/Magdir/epoc
View File

@ -1,10 +0,0 @@
#------------------------------------------------------------------------------
# Epoc 32 : file(1) magic for Epoc Documents [psion/osaris
# Stefan Praszalowicz (hpicollo@worldnet.fr)
#0 lelong 0x10000037 Epoc32
>4 lelong 0x1000006D
>>8 lelong 0x1000007F Word
>>8 lelong 0x10000088 Sheet
>>8 lelong 0x1000007D Sketch
>>8 lelong 0x10000085 TextEd

27
file/magic/Magdir/esri
View File

@ -1,27 +0,0 @@
#------------------------------------------------------------------------------
# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
# Based on info from
# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
0 belong 9994 ESRI Shapefile
>4 belong =0
>8 belong =0
>12 belong =0
>16 belong =0
>20 belong =0
>28 lelong x version %d
>24 belong x length %d
>32 lelong =0 type Null Shape
>32 lelong =1 type Point
>32 lelong =3 type PolyLine
>32 lelong =5 type Polygon
>32 lelong =8 type MultiPoint
>32 lelong =11 type PointZ
>32 lelong =13 type PolyLineZ
>32 lelong =15 type PolygonZ
>32 lelong =18 type MultiPointZ
>32 lelong =21 type PointM
>32 lelong =23 type PolyLineM
>32 lelong =25 type PolygonM
>32 lelong =28 type MultiPointM
>32 lelong =31 type MultiPatch

8
file/magic/Magdir/fcs
View File

@ -1,8 +0,0 @@
#------------------------------------------------------------------------------
# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
# From Roger Leigh <roger@whinlatter.uklinux.net>
0 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0
0 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0
0 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0

589
file/magic/Magdir/filesystems
View File

@ -1,589 +0,0 @@
#------------------------------------------------------------------------------
# filesystems: file(1) magic for different filesystems
#
0 string \366\366\366\366 PC formatted floppy with no filesystem
# Sun disk labels
# From /usr/include/sun/dklabel.h:
0774 beshort 0xdabe Sun disk label
>0 string x '%s
>>31 string >\0 \b%s
>>>63 string >\0 \b%s
>>>>95 string >\0 \b%s
>0 string x \b'
>0734 short >0 %d rpm,
>0736 short >0 %d phys cys,
>0740 short >0 %d alts/cyl,
>0746 short >0 %d interleave,
>0750 short >0 %d data cyls,
>0752 short >0 %d alt cyls,
>0754 short >0 %d heads/partition,
>0756 short >0 %d sectors/track,
>0764 long >0 start cyl %ld,
>0770 long x %ld blocks
# Is there a boot block written 1 sector in?
>512 belong&077777777 0600407 \b, boot block present
# DOS Emulator image is 128 byte header + harddisc image
0 string DOSEMU\0
>0x27E leshort 0xAA55 DOS Emulator image
0x1FE leshort 0xAA55 x86 boot sector
>2 string OSBS \b, OS/BS MBR
# J\xf6rg Jenderek <joerg.jenderek@gmx.net>
>0x8C string Invalid\ partition\ table \b, MS-DOS MBR
# dr-dos with some upper-, lowercase variants
>0x9D string Invalid\ partition\ table$
>>181 string No\ Operating\ System$
>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
>0x9D string Invalid\ partition\ table$
>>181 string No\ operating\ system$
>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
>342 string Invalid\ partition\ table$
>>366 string No\ operating\ system$
>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
>295 string NEWLDR\0
>>302 string Bad\ PT\ $
>>>310 string No\ OS\ $
>>>>317 string OS\ load\ err$
>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
>>>>>>>387 string Copyright\ (c)\ 1984,1998
>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
>0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
>0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950
>300 string Invalid\ partition\ table\0
>>324 string Error\ loading\ operating\ system\0
>>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR
#??>>>389 string Invalid\ system\ disk
>300 string Ung\201ltige\ Partitionstabelle
#split string to avoid error: String too long
>>328 string Fehler\ beim\ Laden\
>>>346 string des\ Betriebssystems
>>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german)
>0x145 string Default:\ F \b, FREE-DOS MBR
>64 string no\ active\ partition\ found
>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta9 MBR
# bootloader, bootmanager
>43 string SMART\ BTMGRFAT12\ \ \
>>430 string SBMK\ Bad!\r
>>>3 string SBM \b, Smart Boot Manager
>>>>6 string >\0 \b, version %s
>382 string XOSLLOADXCF \b, EXtended Operating System Loader
>6 string LILO \b, LInux i386 boot LOader
>>120 string LILO \b, version 22.3.4 SuSe
>>172 string LILO \b, version 22.5.8 Debian
>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
>>394 string stage1 \b, GRand Unified Bootloader (0.5.95)
>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
>>374 string GRUB\ \0 \b, GRand Unified Bootloader
>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
>>376 string GRUB\ \0 \b, GRand Unified Bootloader (0.93)
>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
>>377 string GRUB\ \0 \b, GRand Unified Bootloader (0.94)
>480 string Boot\ failed\r
>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06)
>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
>185 string FDBOOT\ Version\
>>204 string \rNo\ Systemdisk.\
>>>220 string Booting\ from\ harddisk.\n\r
>>>245 string Cannot\ load\ from\ harddisk.\n\r
>>>>273 string Insert\ Systemdisk\
>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
>>>>>>200 string >\0 \b, version %-3s
>242 string Bootsector\ from\ C.H.\ Hochst\204
>>278 string No\ Systemdisk.\
>>>293 string Booting\ from\ harddisk.\n\r
>>>441 string Cannot\ load\ from\ harddisk.\n\r
>>>>469 string Insert\ Systemdisk\
>>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader
>>>>>>209 string >\0 \b, version %-4.4s
>(1.b+2) ubyte 0xe
>>(1.b+3) ubyte 0x1f
>>>(1.b+4) ubyte 0xbe
>>>>(1.b+5) ubyte 0x77
>>>>(1.b+6) ubyte 0x7c
>>>>>(1.b+7) ubyte 0xac
>>>>>>(1.b+8) ubyte 0x22
>>>>>>>(1.b+9) ubyte 0xc0
>>>>>>>>(1.b+10) ubyte 0x74
>>>>>>>>>(1.b+11) ubyte 0xb
>>>>>>>>>>(1.b+12) ubyte 0x56
>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
# XP
>430 string NTLDR\ is\ missing\xFF\r\n
>>449 string Disk\ error\xFF\r\n
>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
>>>>417 ubyte <0x7E
>>>>>417 string >\ %-.5s
>>>>>>422 ubyte <0x7E
>>>>>>>422 string >\ \b%-.3s
>>>>>>425 string >\ \b.%-.3s
#
>>>>368 ubyte <0x7E
>>>>>368 string >\ %-.5s
>>>>>>373 ubyte <0x7E
>>>>>>>373 string >\ \b%-.3s
>>>>>>376 string >\ \b.%-.3s
#
>430 string NTLDR\ nicht\ gefunden\xFF\r\n
>>453 string Datentr\204gerfehler\xFF\r\n
>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
>>>>417 ubyte <0x7E
>>>>>417 string >\ %-.5s
>>>>>>422 ubyte <0x7E
>>>>>>>422 string >\ \b%-.3s
>>>>>>425 string >\ \b.%-.3s
#
>>>>368 ubyte <0x7E
>>>>>368 string >\ %-.5s
>>>>>>373 ubyte <0x7E
>>>>>>>373 string >\ \b%-.3s
>>>>>>376 string >\ \b.%-.3s
#
>430 string NTLDR\ fehlt\xFF\r\n
>>444 string Datentr\204gerfehler\xFF\r\n
>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
>>>>417 ubyte <0x7E
>>>>>417 string >\ %-.5s
>>>>>>422 ubyte <0x7E
>>>>>>>422 string >\ \b%-.3s
>>>>>>425 string >\ \b.%-.3s
#
>430 string NTLDR\ fehlt\xFF\r\n
>>444 string Medienfehler\xFF\r\n
>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
>>>>368 ubyte <0x7E
>>>>>368 string >\ %-.5s
>>>>>>373 ubyte <0x7E
>>>>>>>373 string >\ \b%-.3s
>>>>>>376 string >\ \b.%-.3s
>>>>417 ubyte <0x7E
>>>>>417 string >\ %-.5s
>>>>>>422 ubyte <0x7E
>>>>>>>422 string >\ \b%-.3s
>>>>>>425 string >\ \b.%-.3s
#
>430 string Datentr\204ger\ entfernen\xFF\r\n
>>454 string Medienfehler\xFF\r\n
>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
>>>>368 ubyte <0x7E
>>>>>368 string >\ %-.5s
>>>>>>373 ubyte <0x7E
>>>>>>>373 string >\ \b%-.3s
>>>>>>376 string >\ \b.%-.3s
#>3 string NTFS\ \ \ \
>389 string Fehler\ beim\ Lesen\
>>407 string des\ Datentr\204gers
>>>426 string NTLDR\ fehlt
>>>>440 string NTLDR\ ist\ komprimiert
>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
#>3 string NTFS\ \ \ \
>313 string A\ disk\ read\ error\ occurred.\r
>>345 string A\ kernel\ file\ is\ missing\
>>>370 string from\ the\ disk.\r
>>>>484 string NTLDR\ is\ compressed
>>>>>429 string Insert\ a\ system\ diskette\
>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
# DOS loader variants different languages,offsets
>472 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS
>>497 string WINBOOT\ SYS
>>389 string Invalid\ system\ disk\xFF\r\n
>>>411 string Disk\ I/O\ error
>>>>428 string Replace\ the\ disk,\ and\
>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
#
>>390 string Invalid\ system\ disk\xFF\r\n
>>>412 string Disk\ I/O\ error\xFF\r\n
>>>>429 string Replace\ the\ disk,\ and\
>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
>>388 string Ungueltiges\ System\ \xFF\r\n
>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
>>>>427 string Datentraeger\ wechseln\ und\
>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
#
>>390 string Ungueltiges\ System\ \xFF\r\n
>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
>>>>429 string Datentraeger\ wechseln\ und\
>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
#
>>389 string Ungueltiges\ System\ \xFF\r\n
>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
>>>>428 string Datentraeger\ wechseln\ und\
>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
>479 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS
>>416 string Kein\ System\ oder\
>>>433 string Laufwerksfehler
>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
>486 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS
>>416 string Non-System\ disk\ or\
>>>435 string disk\ error\r
>>>>447 string Replace\ and\ press\ any\ key\
>>>>>473 string when\ ready\r \b, Microsoft DOS Bootloader
>480 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS
>>393 string Non-System\ disk\ or\
>>>412 string disk\ error\r
>>>>424 string Replace\ and\ press\ any\ key\
>>>>>450 string when\ ready\r \b, Microsoft DOS bootloader
#>43 string \224R-LOADER\ \ SYS =label
>54 string SYS
>>324 string VASKK
>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
#
>70 string IBMBIO\ \ COM
>>472 string Cannot\ load\ DOS!\
>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
>>471 string Cannot\ load\ DOS\
>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
>444 string KERNEL\ \ SYS
>>314 string BOOT\ error! \b, FREE-DOS Bootloader
>499 string KERNEL\ \ SYS
>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
>449 string KERNEL\ \ SYS
>>319 string BOOT\ error! \b, FREE-DOS 5.0 Bootloader
>124 string FreeDOS\0
>>331 string \ err\0 \b, FREE-DOS BETa 9 Bootloader
# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
>>>497 string >\ %-.6s
>>>>503 string >\ \b%-.1s
>>>>504 string >\ \b%-.1s
>>>505 string >\ \b.%-.3s
>>333 string \ err\0 \b, FREE-DOS BEta 9 Bootloader
>>>497 string >\ %-.6s
>>>>503 string >\ \b%-.1s
>>>>504 string >\ \b%-.1s
>>>505 string >\ \b.%-.3s
>>334 string \ err\0 \b, FREE-DOS Beta 9 Bootloader
>>>497 string >\ %-.6s
>>>>503 string >\ \b%-.1s
>>>>504 string >\ \b%-.1s
>>>505 string >\ \b.%-.3s
# loader end
>0 string \0\0\0\0 \b, extended partition table
# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
# older drives may use E9 xx xx
>0 lelong&0x009000EB 0x009000EB
>0 lelong&0x000000E9 0x000000E9
>>1 ubyte >37 \b, code offset 0x%x
# mtools-3.9.8/msdos.h
# usual values are marked with comments to get only informations of strange FAT systems
# valid sectorsize are from 32 to 2048
>>>11 uleshort <2049
>>>>11 uleshort >31
>>>>>3 string >\0 \b, OEM-ID "%8.8s"
>>>>>11 uleshort >512 \b, Bytes/sector %u
#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
>>>>>11 uleshort <512 \b, Bytes/sector %u
>>>>>13 ubyte >1 \b, sectors/cluster %u
#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
>>>>>14 uleshort >32 \b, reserved sectors %u
#>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
#>>>>>14 uleshort >1 \b, reserved sectors %u
#>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
>>>>>14 uleshort <1 \b, reserved sectors %u
>>>>>16 ubyte >2 \b, FATs %u
#>>>>>16 ubyte =2 \b, FATs %u (usual)
>>>>>16 ubyte =1 \b, FAT %u
>>>>>16 ubyte >0
>>>>>17 uleshort >0 \b, root entries %u
#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
>>>>>22 uleshort >0 \b, sectors/FAT %u
#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
>>>>>26 ubyte >2 \b, heads %u
#>>>>>26 ubyte =2 \b, heads %u (usual floppy)
>>>>>26 ubyte =1 \b, heads %u
>>>>>28 ulelong >0 \b, hidden sectors %u
#>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
#>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
# FAT<32 specific
# NOT le FAT3=NOT 3TAF=0xCCABBEB9
>>>>>82 ulelong&0xCCABBEB9 >0
>>>>>>36 ubyte >0x80 \b, physical drive 0x%x
#>>>>>>36 ubyte =0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
>>>>>>36 ubyte&0x7F >0 \b, physical drive 0x%x
#>>>>>>36 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
>>>>>>37 ubyte >0 \b, reserved 0x%x
#>>>>>>37 ubyte =0 \b, reserved 0x%x
>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
>>>>>>38 ubyte =0x29
>>>>>>>39 ulelong x \b, serial number 0x%x
>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
>>>>>>>43 string =NO\ NAME \b, unlabeled
>>>>>>54 string FAT1 \b, FAT
>>>>>>>54 string FAT12 \b (12 bit)
>>>>>>>54 string FAT16 \b (16 bit)
# FAT32 specific
>>>>>82 string FAT32 \b, FAT (32 bit)
>>>>>>36 ulelong x \b, sectors/FAT %u
>>>>>>40 uleshort >0 \b, extension flags %u
#>>>>>>40 uleshort =0 \b, extension flags %u
>>>>>>42 uleshort >0 \b, fsVersion %u
#>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
>>>>>>44 ulelong >2 \b, rootdir cluster %u
#>>>>>>44 ulelong =2 \b, rootdir cluster %u
#>>>>>>44 ulelong =1 \b, rootdir cluster %u
>>>>>>48 uleshort >1 \b, infoSector %u
#>>>>>>48 uleshort =1 \b, infoSector %u (usual)
>>>>>>48 uleshort <1 \b, infoSector %u
>>>>>>50 uleshort >6 \b, Backup boot sector %u
#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
>>>>>>50 uleshort <6 \b, Backup boot sector %u
>>>>>>54 ulelong >0 \b, reserved1 0x%x
>>>>>>58 ulelong >0 \b, reserved2 0x%x
>>>>>>62 ulelong >0 \b, reserved3 0x%x
# same structure as FAT1X
>>>>>>64 ubyte >0x80 \b, physical drive 0x%x
#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x
#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
>>>>>>65 ubyte >0 \b, reserved 0x%x
>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
>>>>>>66 ubyte =0x29
>>>>>>>67 ulelong x \b, serial number 0x%x
>>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
>>>>>>71 string =NO\ NAME \b, unlabeled
### FATs end
>0x200 lelong 0x82564557 \b, BSD disklabel
# FATX
0 string FATX FATX filesystem data
# Minix filesystems - Juan Cespedes <cespedes@debian.org>
0x410 leshort 0x137f Minix filesystem
0x410 beshort 0x137f Minix filesystem (big endian),
>0x402 beshort !0 \b, %d zones
>0x1e string minix \b, bootable
0x410 leshort 0x138f Minix filesystem, 30 char names
0x410 leshort 0x2468 Minix filesystem, version 2
0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names
# romfs filesystems - Juan Cespedes <cespedes@debian.org>
0 string -rom1fs-\0 romfs filesystem, version 1
>8 belong x %d bytes,
>16 string x named %s.
# netboot image - Juan Cespedes <cespedes@debian.org>
0 lelong 0x1b031336L Netboot image,
>4 lelong&0xFFFFFF00 0
>>4 lelong&0x100 0x000 mode 2
>>4 lelong&0x100 0x100 mode 3
>4 lelong&0xFFFFFF00 !0 unknown mode
0x18b string OS/2 OS/2 Boot Manager
9564 lelong 0x00011954 Unix Fast File system (little-endian),
>8404 string x last mounted on %s,
#>9504 ledate x last checked at %s,
>8224 ledate x last written at %s,
>8401 byte x clean flag %d,
>8228 lelong x number of blocks %d,
>8232 lelong x number of data blocks %d,
>8236 lelong x number of cylinder groups %d,
>8240 lelong x block size %d,
>8244 lelong x fragment size %d,
>8252 lelong x minimum percentage of free blocks %d,
>8256 lelong x rotational delay %dms,
>8260 lelong x disk rotational speed %drps,
>8320 lelong 0 TIME optimization
>8320 lelong 1 SPACE optimization
9564 belong 0x00011954 Unix Fast File system (big-endian),
>7168 long 0x4c41424c Apple UFS Volume
>>7186 string x named %s,
>>7176 belong x volume label version %d,
>>7180 bedate x created on %s,
>8404 string x last mounted on %s,
#>9504 bedate x last checked at %s,
>8224 bedate x last written at %s,
>8401 byte x clean flag %d,
>8228 belong x number of blocks %d,
>8232 belong x number of data blocks %d,
>8236 belong x number of cylinder groups %d,
>8240 belong x block size %d,
>8244 belong x fragment size %d,
>8252 belong x minimum percentage of free blocks %d,
>8256 belong x rotational delay %dms,
>8260 belong x disk rotational speed %drps,
>8320 belong 0 TIME optimization
>8320 belong 1 SPACE optimization
# ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com>
0x438 leshort 0xEF53 Linux
>0x44c lelong x rev %d
>0x43e leshort x \b.%d
>0x45c lelong ^0x0000004 ext2 filesystem data
>>0x43a leshort ^0x0000001 (mounted or unclean)
>0x45c lelong &0x0000004 ext3 filesystem data
>>0x460 lelong &0x0000004 (needs journal recovery)
>0x43a leshort &0x0000002 (errors)
>0x460 lelong &0x0000001 (compressed)
#>0x460 lelong &0x0000002 (filetype)
#>0x464 lelong &0x0000001 (sparse_super)
>0x464 lelong &0x0000002 (large files)
# SGI disk labels - Nathan Scott <nathans@debian.org>
0 belong 0x0BE5A941 SGI disk label (volume header)
# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
0 belong 0x58465342 SGI XFS filesystem data
>0x4 belong x (blksz %d,
>0x68 beshort x inosz %d,
>0x64 beshort ^0x2004 v1 dirs)
>0x64 beshort &0x2004 v2 dirs)
############################################################################
# Minix-ST kernel floppy
0x800 belong 0x46fc2700 Atari-ST Minix kernel image
>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
############################################################################
# Hmmm, is this a better way of detecting _standard_ floppy images ?
19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
# Valid media descriptor bytes for MS-DOS:
#
# Byte Capacity Media Size and Type
# -------------------------------------------------
#
# F0 2.88 MB 3.5-inch, 2-sided, 36-sector
# F0 1.44 MB 3.5-inch, 2-sided, 18-sector
# F9 720K 3.5-inch, 2-sided, 9-sector
# F9 1.2 MB 5.25-inch, 2-sided, 15-sector
# FD 360K 5.25-inch, 2-sided, 9-sector
# FF 320K 5.25-inch, 2-sided, 8-sector
# FC 180K 5.25-inch, 1-sided, 9-sector
# FE 160K 5.25-inch, 1-sided, 8-sector
# FE 250K 8-inch, 1-sided, single-density
# FD 500K 8-inch, 2-sided, single-density
# FE 1.2 MB 8-inch, 2-sided, double-density
# F8 ----- Fixed disk
#
# FC xxxK Apricot 70x1x9 boot disk.
#
# Originally a bitmap:
# xxxxxxx0 Not two sided
# xxxxxxx1 Double sided
# xxxxxx0x Not 8 SPT
# xxxxxx1x 8 SPT
# xxxxx0xx Not Removable drive
# xxxxx1xx Removable drive
# 11111xxx Must be one.
#
# But now it's rather random:
# 111111xx Low density disk
# 00 SS, Not 8 SPT
# 01 DS, Not 8 SPT
# 10 SS, 8 SPT
# 11 DS, 8 SPT
#
# 11111001 Double density 3½ floppy disk, high density 5¼
# 11110000 High density 3½ floppy disk
# 11111000 Hard disk any format
#
# CDROM Filesystems
32769 string CD001 ISO 9660 CD-ROM filesystem data
# "application id" which appears to be used as a volume label
>32808 string >\0 '%s'
>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
32776 string CDROM High Sierra CD-ROM filesystem data
# cramfs filesystem - russell@coker.com.au
0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
>4 lelong x size %d
>8 lelong &1 version #2
>8 lelong &2 sorted_dirs
>8 lelong &4 hole_support
>32 lelong x CRC 0x%x,
>36 lelong x edition %d,
>40 lelong x %d blocks,
>44 lelong x %d files
0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
>4 belong x size %d
>8 belong &1 version #2
>8 belong &2 sorted_dirs
>8 belong &4 hole_support
>32 belong x CRC 0x%x,
>36 belong x edition %d,
>40 belong x %d blocks,
>44 belong x %d files
# reiserfs - russell@coker.com.au
0x10034 string ReIsErFs ReiserFS V3.5
0x10034 string ReIsEr2Fs ReiserFS V3.6
>0x1002c leshort x block size %d
>0x10032 leshort &2 (mounted or unclean)
>0x10000 lelong x num blocks %d
>0x10040 lelong 1 tea hash
>0x10040 lelong 2 yura hash
>0x10040 lelong 3 r5 hash
# JFFS - russell@coker.com.au
0 lelong 0x34383931 Linux Journalled Flash File system, little endian
0 belong 0x34383931 Linux Journalled Flash File system, big endian
# EST flat binary format (which isn't, but anyway)
# From: Mark Brown <broonie@sirena.org.uk>
0 string ESTFBINR EST flat binary
# Aculab VoIP firmware
# From: Mark Brown <broonie@sirena.org.uk>
0 string VoIP\ Startup\ and Aculab VoIP firmware
>35 string x format %s
# PPCBoot image file
# From: Mark Brown <broonie@sirena.org.uk>
0 belong 0x27051956 PPCBoot image
>4 string PPCBoot
>>12 string x version %s
# JFFS2 file system
0 leshort 0x1984 Linux old jffs2 filesystem data little endian
0 lelong 0xe0011985 Linux jffs2 filesystem data little endian
# Squashfs
0 string sqsh Squashfs filesystem, big endian,
>28 beshort x version %d.
>30 beshort x \b%d,
>8 belong x %d bytes,
>4 belong x %d inodes,
>28 beshort <2
>>32 beshort x blocksize: %d bytes,
>28 beshort >1
>>51 belong x blocksize: %d bytes,
>39 bedate x created: %s
0 string hsqs Squashfs filesystem, little endian,
>28 leshort x version %d.
>30 leshort x \b%d,
>8 lelong x %d bytes,
>4 lelong x %d inodes,
>28 leshort <2
>>32 leshort x blocksize: %d bytes,
>28 leshort >1
>>51 lelong x blocksize: %d bytes,
>39 ledate x created: %s

15
file/magic/Magdir/flash
View File

@ -1,15 +0,0 @@
#------------------------------------------------------------------------------
# flash: file(1) magic for Macromedia Flash file format
#
# See
#
# http://www.macromedia.com/software/flash/open/
#
0 string FWS Macromedia Flash data,
>3 byte x version %d
0 string CWS Macromedia Flash data (compressed),
>3 byte x version %d
#
# From Dave Wilson
0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document

61
file/magic/Magdir/fonts
View File

@ -1,61 +0,0 @@
#------------------------------------------------------------------------------
# fonts: file(1) magic for font data
#
0 string FONT ASCII vfont text
0 short 0436 Berkeley vfont data
0 short 017001 byte-swapped Berkeley vfont data
# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
0 string %!PS-AdobeFont-1. PostScript Type 1 font text
>20 string >\0 (%s)
6 string %!PS-AdobeFont-1. PostScript Type 1 font program data
# X11 font files in SNF (Server Natural Format) format
0 belong 00000004 X11 SNF font data, MSB first
0 lelong 00000004 X11 SNF font data, LSB first
# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string STARTFONT\040 X11 BDF font text
# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
0 string \001fcp X11 Portable Compiled Font data
>12 byte 0x02 \b, LSB first
>12 byte 0x0a \b, MSB first
0 string D1.0\015 X11 Speedo font data
#------------------------------------------------------------------------------
# FIGlet fonts and controlfiles
# From figmagic supplied with Figlet version 2.2
# "David E. O'Brien" <obrien@FreeBSD.ORG>
0 string flf FIGlet font
>3 string >2a version %-2.2s
0 string flc FIGlet controlfile
>3 string >2a version %-2.2s
# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
0 belong 0x14025919 libGrx font data,
>8 leshort x %dx
>10 leshort x \b%d
>40 string x %s
# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
0 belong 0xff464f4e DOS code page font data collection
7 belong 0x00454741 DOS code page font data
7 belong 0x00564944 DOS code page font data (from Linux?)
4098 string DOSFONT DOSFONT2 encrypted font data
# downloadable fonts for browser (prints type) anthon@mnt.org
0 string PFR1 PFR1 font
>102 string >0 \b: %s
# True Type fonts
0 string \000\001\000\000\000 TrueType font data
0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
# Opentype font data from Avi Bercovich
0 string OTTO OpenType font data

38
file/magic/Magdir/frame
View File

@ -1,38 +0,0 @@
#------------------------------------------------------------------------------
# frame: file(1) magic for FrameMaker files
#
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is "published" as witness the following:
#
0 string \<MakerFile FrameMaker document
>11 string 5.5 (5.5
>11 string 5.0 (5.0
>11 string 4.0 (4.0
>11 string 3.0 (3.0
>11 string 2.0 (2.0
>11 string 1.0 (1.0
>14 byte x %c)
0 string \<MIFFile FrameMaker MIF (ASCII) file
>9 string 4.0 (4.0)
>9 string 3.0 (3.0)
>9 string 2.0 (2.0)
>9 string 1.0 (1.x)
0 string \<MakerDictionary FrameMaker Dictionary text
>17 string 3.0 (3.0)
>17 string 2.0 (2.0)
>17 string 1.0 (1.x)
0 string \<MakerScreenFont FrameMaker Font file
>17 string 1.01 (%s)
0 string \<MML FrameMaker MML file
0 string \<BookFile FrameMaker Book file
>10 string 3.0 (3.0
>10 string 2.0 (2.0
>10 string 1.0 (1.0
>13 byte x %c)
# XXX - this book entry should be verified, if you find one, uncomment this
#0 string \<Book\ FrameMaker Book (ASCII) file
#>6 string 3.0 (3.0)
#>6 string 2.0 (2.0)
#>6 string 1.0 (1.0)
0 string \<Maker Intermediate Print File FrameMaker IPL file

143
file/magic/Magdir/freebsd
View File

@ -1,143 +0,0 @@
#------------------------------------------------------------------------------
# freebsd: file(1) magic for FreeBSD objects
#
# All new-style FreeBSD magic numbers are in host byte order (i.e.,
# little-endian on x86).
#
# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
# schemes for distinguishing between executable images, shared libraries,
# and object files.
#
# FreeBSD says:
#
# Regardless of whether it's pure, demand-paged, or none of the
# above:
#
# if the entry point is < 4096, then it's a shared library if
# the "has run-time loader information" bit is set, and is
# position-independent if the "is position-independent" bit
# is set;
#
# if the entry point is >= 4096 (or >4095, same thing), then it's
# an executable, and is dynamically-linked if the "has run-time
# loader information" bit is set.
#
# On x86, NetBSD says:
#
# If it's neither pure nor demand-paged:
#
# if it has the "has run-time loader information" bit set, it's
# a dynamically-linked executable;
#
# if it doesn't have that bit set, then:
#
# if it has the "is position-independent" bit set, it's
# position-independent;
#
# if the entry point is non-zero, it's an executable, otherwise
# it's an object file.
#
# If it's pure:
#
# if it has the "has run-time loader information" bit set, it's
# a dynamically-linked executable, otherwise it's just an
# executable.
#
# If it's demand-paged:
#
# if it has the "has run-time loader information" bit set,
# then:
#
# if the entry point is < 4096, it's a shared library;
#
# if the entry point is = 4096 or > 4096 (i.e., >= 4096),
# it's a dynamically-linked executable);
#
# if it doesn't have the "has run-time loader information" bit
# set, then it's just an executable.
#
# (On non-x86, NetBSD does much the same thing, except that it uses
# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
# had 8K pages; dunno about MIPS.)
#
# I suspect the two will differ only in perverse and uninteresting cases
# ("shared" libraries that aren't demand-paged and whose pages probably
# won't actually be shared, executables with entry points <4096).
#
# I leave it to those more familiar with FreeBSD and NetBSD to figure out
# what the right answer is (although using ">4095", FreeBSD-style, is
# probably better than separately checking for "=4096" and ">4096",
# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged
# executables using the NetBSD technique.)
#
0 lelong&0377777777 041400407 FreeBSD/i386
>20 lelong <4096
>>3 byte&0xC0 &0x80 shared library
>>3 byte&0xC0 0x40 PIC object
>>3 byte&0xC0 0x00 object
>20 lelong >4095
>>3 byte&0x80 0x80 dynamically linked executable
>>3 byte&0x80 0x00 executable
>16 lelong >0 not stripped
0 lelong&0377777777 041400410 FreeBSD/i386 pure
>20 lelong <4096
>>3 byte&0xC0 &0x80 shared library
>>3 byte&0xC0 0x40 PIC object
>>3 byte&0xC0 0x00 object
>20 lelong >4095
>>3 byte&0x80 0x80 dynamically linked executable
>>3 byte&0x80 0x00 executable
>16 lelong >0 not stripped
0 lelong&0377777777 041400413 FreeBSD/i386 demand paged
>20 lelong <4096
>>3 byte&0xC0 &0x80 shared library
>>3 byte&0xC0 0x40 PIC object
>>3 byte&0xC0 0x00 object
>20 lelong >4095
>>3 byte&0x80 0x80 dynamically linked executable
>>3 byte&0x80 0x00 executable
>16 lelong >0 not stripped
0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged
>20 lelong <4096
>>3 byte&0xC0 &0x80 shared library
>>3 byte&0xC0 0x40 PIC object
>>3 byte&0xC0 0x00 object
>20 lelong >4095
>>3 byte&0x80 0x80 dynamically linked executable
>>3 byte&0x80 0x00 executable
>16 lelong >0 not stripped
# XXX gross hack to identify core files
# cores start with a struct tss; we take advantage of the following:
# byte 7: highest byte of the kernel stack pointer, always 0xfe
# 8/9: kernel (ring 0) ss value, always 0x0010
# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
# 28: low order byte of the current PTD entry, always 0 since the
# PTD is page-aligned
#
7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file
>1039 string >\0 from '%s'
# /var/run/ld.so.hints
# What are you laughing about?
0 lelong 011421044151 ld.so hints file (Little Endian
>4 lelong >0 \b, version %d)
>4 belong <=0 \b)
0 belong 011421044151 ld.so hints file (Big Endian
>4 belong >0 \b, version %d)
>4 belong <=0 \b)
#
# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
#
0 string SCRSHOT_ scrshot(1) screenshot,
>8 byte x version %d,
>9 byte 2 %d bytes in header,
>>10 byte x %d chars wide by
>>11 byte x %d chars high

27
file/magic/Magdir/fsav
View File

@ -1,27 +0,0 @@
#------------------------------------------------------------------------------
# fsav: file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon@mnt.org)
0 beshort 0x1575 fsav (linux) macro virus
>8 leshort >0 (%d-
>11 byte >0 \b%02d-
>10 byte >0 \b%02d)
# comment this out for now because it regognizes every file where
# the eighth character is \n
#8 byte 0x0a
#>12 byte 0x07
#>11 leshort >0 fsav (linux) virus (%d-
#>10 byte 0 \b01-
#>10 byte 1 \b02-
#>10 byte 2 \b03-
#>10 byte 3 \b04-
#>10 byte 4 \b05-
#>10 byte 5 \b06-
#>10 byte 6 \b07-
#>10 byte 7 \b08-
#>10 byte 8 \b08-
#>10 byte 9 \b10-
#>10 byte 10 \b11-
#>10 byte 11 \b12-
#>9 byte >0 \b%02d)

157
file/magic/Magdir/games
View File

@ -1,157 +0,0 @@
#------------------------------------------------------------------------------
# games: file(1) for games
# Thomas M. Ott (ThMO)
1 string =WAD DOOM data,
>0 string =I main wad
>0 string =P patch wad
>0 byte x unknown junk
# Fabio Bonelli <fabiobonelli@libero.it>
# Quake II - III data files
0 string IDP2 Quake II 3D Model file,
>20 long x %lu skin(s),
>8 long x (%lu x
>12 long x %lu),
>40 long x %lu frame(s),
>16 long x Frame size %lu bytes,
>24 long x %lu vertices/frame,
>28 long x %lu texture coordinates,
>32 long x %lu triangles/frame
0 string IBSP Quake
>4 long 0x26 II Map file (BSP)
>4 long 0x2E III Map file (BSP)
0 string IDS2 Quake II SP2 sprite file
#---------------------------------------------------------------------------
# Doom and Quake
# submitted by Nicolas Patrois
# DOOM
0 string IWAD DOOM or DOOM ][ world
0 string PWAD DOOM or DOOM ][ extension world
0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo
# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
24 string LxD\ 203 Linuxdoom save
>0 string x , name=%s
>44 string x , world=%s
# Quake
0 string PACK Quake I or II world or extension
#0 string -1\x0a Quake I demo
#>30 string x version %.4s
#>61 string x level %s
#0 string 5\x0a Quake I save
# The levels
# Quake 1
0 string 5\x0aIntroduction Quake I save: start Introduction
0 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex
0 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned
0 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis
0 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto
0 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret)
0 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep
0 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon
0 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon
0 string 5\x0athe_Installation Quake I save: e2m1 The installation
0 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel
0 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!)
0 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret)
0 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress
0 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse
0 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette
0 string 5\x0aTermination_Central Quake I save: e3m1 Termination central
0 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin
0 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror
0 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight
0 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret)
0 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels
0 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment
0 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system
0 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair
0 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine
0 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate
0 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium
0 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret)
0 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze
0 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony
0 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit
# Quake DeathMatch levels
0 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths
0 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis
0 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base
0 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place
0 string 5\x0aThe_Cistern Quake I save: dm5 The cistern
0 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone
# Scourge of Armagon
0 string 5\x0aCommand_HQ Quake I save: start Command HQ
0 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station
0 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility
0 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret)
0 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine
0 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility
0 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms
0 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret)
0 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral
0 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs
0 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt
0 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep
0 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment
0 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium
0 string 5\x0aLimbo Quake I save: hip3m3 Limbo
0 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret)
0 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet
0 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair
# Malice
0 string 5\x0aThe_Academy Quake I save: start The academy
0 string 5\x0aThe_Lab Quake I save: d1 The lab
0 string 5\x0aArea_33 Quake I save: d1b Area 33
0 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions
0 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret)
0 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
0 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice
0 string 5\x0aArea44 Quake I save: d1c Area 44
0 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers
0 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life
0 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood
0 string 5\x0aThe_Flood Quake I save: d5 The flood
0 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant
0 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant
0 string 5\x0aThe_Foundry Quake I save: d7b The foundry
0 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base
0 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base
0 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories
0 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive
0 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ
0 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown!
# Malice DeathMatch levels
0 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct
0 string 5\x0aSub_Station Quake I save: ddm2 Sub station
0 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights!
0 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa
0 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse
0 string 5\x0aDOMINO Quake I save: ddm6 Domino
0 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder
0 string MComprHD MAME CHD compressed hard disk image,
>12 belong x version %lu

16
file/magic/Magdir/gcc
View File

@ -1,16 +0,0 @@
#------------------------------------------------------------------------------
# gcc: file(1) magic for GCC special files
#
0 string gpch GCC precompiled header
# The version field is annoying. It's 3 characters, not zero-terminated.
>5 byte x (version %c
>6 byte x \b%c
>7 byte x \b%c)
# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
>4 byte 67 for C
>4 byte 111 for Objective C
>4 byte 43 for C++
>4 byte 79 for Objective C++

19
file/magic/Magdir/geos
View File

@ -1,19 +0,0 @@
#------------------------------------------------------------------------------
# GEOS files (Vidar Madsen, vidar@gimp.org)
# semi-commonly used in embedded and handheld systems.
0 belong 0xc745c153 GEOS
>40 byte 1 executable
>40 byte 2 VMFile
>40 byte 3 binary
>40 byte 4 directory label
>40 byte <1 unknown
>40 byte >4 unknown
>4 string >\0 \b, name "%s"
#>44 short x \b, version %d
#>46 short x \b.%d
#>48 short x \b, rev %d
#>50 short x \b.%d
#>52 short x \b, proto %d
#>54 short x \br%d
#>168 string >\0 \b, copyright "%s"

36
file/magic/Magdir/gimp
View File

@ -1,36 +0,0 @@
#------------------------------------------------------------------------------
# GIMP Gradient: file(1) magic for the GIMP's gradient data files
# by Federico Mena <federico@nuclecu.unam.mx>
0 string GIMP\ Gradient GIMP gradient data
#------------------------------------------------------------------------------
# XCF: file(1) magic for the XCF image format used in the GIMP developed
# by Spencer Kimball and Peter Mattis
# ('Bucky' LaDieu, nega@vt.edu)
0 string gimp\ xcf GIMP XCF image data,
>9 string file version 0,
>9 string v version
>>10 string >\0 %s,
>14 belong x %lu x
>18 belong x %lu,
>22 belong 0 RGB Color
>22 belong 1 Greyscale
>22 belong 2 Indexed Color
>22 belong >2 Unknown Image Type.
#------------------------------------------------------------------------------
# XCF: file(1) magic for the patterns used in the GIMP, developed
# by Spencer Kimball and Peter Mattis
# ('Bucky' LaDieu, nega@vt.edu)
20 string GPAT GIMP pattern data,
>24 string x %s
#------------------------------------------------------------------------------
# XCF: file(1) magic for the brushes used in the GIMP, developed
# by Spencer Kimball and Peter Mattis
# ('Bucky' LaDieu, nega@vt.edu)
20 string GIMP GIMP brush data

34
file/magic/Magdir/gnu
View File

@ -1,34 +0,0 @@
#------------------------------------------------------------------------------
# gnu: file(1) magic for various GNU tools
#
# GNU nlsutils message catalog file format
#
0 string \336\22\4\225 GNU message catalog (little endian),
>4 lelong x revision %d,
>8 lelong x %d messages
0 string \225\4\22\336 GNU message catalog (big endian),
>4 belong x revision %d,
>8 belong x %d messages
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
0 string *nazgul* Nazgul style compiled message catalog
>8 lelong >0 \b, version %ld
# GnuPG
# The format is very similar to pgp
0 string \001gpg GPG key trust database
>4 byte x version %d
0 beshort 0x8502 GPG encrypted data
# This magic is not particularly good, as the keyrings don't have true
# magic. Nevertheless, it covers many keyrings.
0 beshort 0x9901 GPG key public ring
# Gnumeric spreadsheet
# This entry is only semi-helpful, as Gnumeric compresses its files, so
# they will ordinarily reported as "compressed", but at least -z helps
39 string =<gmr:Workbook Gnumeric spreadsheet
# From: James Youngman <jay@gnu.org>
# gnu find magic
0 string \0LOCATE GNU findutils locate database data
>7 string >\0 \b, format %s
>7 string 02 \b (frcode)

20
file/magic/Magdir/grace
View File

@ -1,20 +0,0 @@
#------------------------------------------------------------------------------
# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
#
# ACE/gr binary
0 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file
>39 byte >0 - version %c
# ACE/gr ascii
0 string #\ xvgr\ parameter\ file ACE/gr ascii file
0 string #\ xmgr\ parameter\ file ACE/gr ascii file
0 string #\ ACE/gr\ parameter\ file ACE/gr ascii file
# Grace projects
0 string #\ Grace\ project\ file Grace project file
>23 string @version\ (version
>>32 byte >0 %c
>>33 string >\0 \b.%.2s
>>35 string >\0 \b.%.2s)
# ACE/gr fit description files
0 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file
# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE

47
file/magic/Magdir/gringotts
View File

@ -1,47 +0,0 @@
#------------------------------------------------------------------------------
# gringotts: file(1) magic for Gringotts
# http://devel.pluto.linux.it/projects/Gringotts/
# author: Germano Rizzo <mano@pluto.linux.it>
#GRG3????Y
0 string GRG Gringotts data file
#file format 1
>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
#file format 2
>3 string 2 v.2, MCRYPT S2K,
>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
>>8 byte&0x70 0x10 SERPENT crypt,
>>8 byte&0x70 0x20 TWOFISH crypt,
>>8 byte&0x70 0x30 CAST-256 crypt,
>>8 byte&0x70 0x40 SAFER+ crypt,
>>8 byte&0x70 0x50 LOKI97 crypt,
>>8 byte&0x70 0x60 3DES crypt,
>>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
>>8 byte&0x08 0x00 SHA1 hash,
>>8 byte&0x08 0x08 RIPEMD-160 hash,
>>8 byte&0x04 0x00 ZLib
>>8 byte&0x04 0x04 BZip2
>>8 byte&0x03 0x00 lvl.0
>>8 byte&0x03 0x01 lvl.3
>>8 byte&0x03 0x02 lvl.6
>>8 byte&0x03 0x03 lvl.9
#file format 3
>3 string 3 v.3, OpenPGP S2K,
>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
>>8 byte&0x70 0x10 SERPENT crypt,
>>8 byte&0x70 0x20 TWOFISH crypt,
>>8 byte&0x70 0x30 CAST-256 crypt,
>>8 byte&0x70 0x40 SAFER+ crypt,
>>8 byte&0x70 0x50 LOKI97 crypt,
>>8 byte&0x70 0x60 3DES crypt,
>>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
>>8 byte&0x08 0x00 SHA1 hash,
>>8 byte&0x08 0x08 RIPEMD-160 hash,
>>8 byte&0x04 0x00 ZLib
>>8 byte&0x04 0x04 BZip2
>>8 byte&0x03 0x00 lvl.0
>>8 byte&0x03 0x01 lvl.3
>>8 byte&0x03 0x02 lvl.6
>>8 byte&0x03 0x03 lvl.9
#file format >3
>3 string >3 v.%.1s (unknown details)

7
file/magic/Magdir/hdf
View File

@ -1,7 +0,0 @@
#------------------------------------------------------------------------------
# Hierarchical Data Format, used to facilitate scientific data exchange
# specifications at http://hdf.ncsa.uiuc.edu/
0 belong 0x0e031301 Hierarchical Data Format (version 4) data
0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data

18
file/magic/Magdir/hitachi-sh
View File

@ -1,18 +0,0 @@
#------------------------------------------------------------------------------
# hitach-sh: file(1) magic for Hitachi Super-H
#
# Super-H COFF
#
0 beshort 0x0500 Hitachi SH big-endian COFF
>18 beshort&0x0002 =0x0000 object
>18 beshort&0x0002 =0x0002 executable
>18 beshort&0x0008 =0x0008 \b, stripped
>18 beshort&0x0008 =0x0000 \b, not stripped
#
0 leshort 0x0550 Hitachi SH little-endian COFF
>18 leshort&0x0002 =0x0000 object
>18 leshort&0x0002 =0x0002 executable
>18 leshort&0x0008 =0x0008 \b, stripped
>18 leshort&0x0008 =0x0000 \b, not stripped

395
file/magic/Magdir/hp
View File

@ -1,395 +0,0 @@
#------------------------------------------------------------------------------
# hp: file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
# applied to the "TML" stuff; I'm assuming the Apollo stuff is
# big-endian as it was mostly 68K-based.
#
# I think the 500 series was the old stack-based machines, running a
# UNIX environment atop the "SUN kernel"; dunno whether it was
# big-endian or little-endian.
#
# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
# hp300 are 68020+68881 based; hp400 are also 68k. The following basic
# HP magic is useful for reference, but using "long" magic is a better
# practice in order to avoid collisions.
#
# Guy Harris (guy@netapp.com): some additions to this list came from
# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
# "/etc/magic", though, except for the "archive file relocatable library"
# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
# used in executables, or have they just not yet updated "/etc/magic"
# completely?
#
# 0 beshort 200 hp200 (68010) BSD binary
# 0 beshort 300 hp300 (68020+68881) BSD binary
# 0 beshort 0x20c hp200/300 HP-UX binary
# 0 beshort 0x20d hp400 (68030) HP-UX binary
# 0 beshort 0x20e hp400 (68040?) HP-UX binary
# 0 beshort 0x20b PA-RISC1.0 HP-UX binary
# 0 beshort 0x210 PA-RISC1.1 HP-UX binary
# 0 beshort 0x211 PA-RISC1.2 HP-UX binary
# 0 beshort 0x214 PA-RISC2.0 HP-UX binary
#
# The "misc" stuff needs a byte order; the archives look suspiciously
# like the old 177545 archives (0xff65 = 0177545).
#
#### Old Apollo stuff
0 beshort 0627 Apollo m68k COFF executable
>18 beshort ^040000 not stripped
>22 beshort >0 - version %ld
0 beshort 0624 apollo a88k COFF executable
>18 beshort ^040000 not stripped
>22 beshort >0 - version %ld
0 long 01203604016 TML 0123 byte-order format
0 long 01702407010 TML 1032 byte-order format
0 long 01003405017 TML 2301 byte-order format
0 long 01602007412 TML 3210 byte-order format
#### PA-RISC 1.1
0 belong 0x02100106 PA-RISC1.1 relocatable object
0 belong 0x02100107 PA-RISC1.1 executable
>168 belong &0x00000004 dynamically linked
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x02100108 PA-RISC1.1 shared executable
>168 belong&0x4 0x4 dynamically linked
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x0210010b PA-RISC1.1 demand-load executable
>168 belong&0x4 0x4 dynamically linked
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x0210010e PA-RISC1.1 shared library
>96 belong >0 - not stripped
0 belong 0x0210010d PA-RISC1.1 dynamic load library
>96 belong >0 - not stripped
#### PA-RISC 2.0
0 belong 0x02140106 PA-RISC2.0 relocatable object
0 belong 0x02140107 PA-RISC2.0 executable
>168 belong &0x00000004 dynamically linked
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x02140108 PA-RISC2.0 shared executable
>168 belong &0x00000004 dynamically linked
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x0214010b PA-RISC2.0 demand-load executable
>168 belong &0x00000004 dynamically linked
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x0214010e PA-RISC2.0 shared library
>96 belong >0 - not stripped
0 belong 0x0214010d PA-RISC2.0 dynamic load library
>96 belong >0 - not stripped
#### 800
0 belong 0x020b0106 PA-RISC1.0 relocatable object
0 belong 0x020b0107 PA-RISC1.0 executable
>168 belong&0x4 0x4 dynamically linked
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x020b0108 PA-RISC1.0 shared executable
>168 belong&0x4 0x4 dynamically linked
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x020b010b PA-RISC1.0 demand-load executable
>168 belong&0x4 0x4 dynamically linked
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x020b010e PA-RISC1.0 shared library
>96 belong >0 - not stripped
0 belong 0x020b010d PA-RISC1.0 dynamic load library
>96 belong >0 - not stripped
0 belong 0x213c6172 archive file
>68 belong 0x020b0619 - PA-RISC1.0 relocatable library
>68 belong 0x02100619 - PA-RISC1.1 relocatable library
>68 belong 0x02110619 - PA-RISC1.2 relocatable library
>68 belong 0x02140619 - PA-RISC2.0 relocatable library
#### 500
0 long 0x02080106 HP s500 relocatable executable
>16 long >0 - version %ld
0 long 0x02080107 HP s500 executable
>16 long >0 - version %ld
0 long 0x02080108 HP s500 pure executable
>16 long >0 - version %ld
#### 200
0 belong 0x020c0108 HP s200 pure executable
>4 beshort >0 - version %ld
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c0107 HP s200 executable
>4 beshort >0 - version %ld
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c010b HP s200 demand-load executable
>4 beshort >0 - version %ld
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c0106 HP s200 relocatable executable
>4 beshort >0 - version %ld
>6 beshort >0 - highwater %d
>8 belong &0x80000000 save fp regs
>8 belong &0x20000000 debuggable
>8 belong &0x10000000 PIC
0 belong 0x020a0108 HP s200 (2.x release) pure executable
>4 beshort >0 - version %ld
>36 belong >0 not stripped
0 belong 0x020a0107 HP s200 (2.x release) executable
>4 beshort >0 - version %ld
>36 belong >0 not stripped
0 belong 0x020c010e HP s200 shared library
>4 beshort >0 - version %ld
>6 beshort >0 - highwater %d
>36 belong >0 not stripped
0 belong 0x020c010d HP s200 dynamic load library
>4 beshort >0 - version %ld
>6 beshort >0 - highwater %d
>36 belong >0 not stripped
#### MISC
0 long 0x0000ff65 HP old archive
0 long 0x020aff65 HP s200 old archive
0 long 0x020cff65 HP s200 old archive
0 long 0x0208ff65 HP s500 old archive
0 long 0x015821a6 HP core file
0 long 0x4da7eee8 HP-WINDOWS font
>8 byte >0 - version %ld
0 string Bitmapfile HP Bitmapfile
0 string IMGfile CIS compimg HP Bitmapfile
# XXX - see "lif"
#0 short 0x8000 lif file
0 long 0x020c010c compiled Lisp
0 string msgcat01 HP NLS message catalog,
>8 long >0 %d messages
# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
0 string HPHP48- HP48 binary
>7 byte >0 - Rev %c
>8 beshort 0x1129 (ADR)
>8 beshort 0x3329 (REAL)
>8 beshort 0x5529 (LREAL)
>8 beshort 0x7729 (COMPLX)
>8 beshort 0x9d29 (LCOMPLX)
>8 beshort 0xbf29 (CHAR)
>8 beshort 0xe829 (ARRAY)
>8 beshort 0x0a2a (LNKARRAY)
>8 beshort 0x2c2a (STRING)
>8 beshort 0x4e2a (HXS)
>8 beshort 0x742a (LIST)
>8 beshort 0x962a (DIR)
>8 beshort 0xb82a (ALG)
>8 beshort 0xda2a (UNIT)
>8 beshort 0xfc2a (TAGGED)
>8 beshort 0x1e2b (GROB)
>8 beshort 0x402b (LIB)
>8 beshort 0x622b (BACKUP)
>8 beshort 0x882b (LIBDATA)
>8 beshort 0x9d2d (PROG)
>8 beshort 0xcc2d (CODE)
>8 beshort 0x482e (GNAME)
>8 beshort 0x6d2e (LNAME)
>8 beshort 0x922e (XLIB)
0 string %%HP: HP48 text
>6 string T(0) - T(0)
>6 string T(1) - T(1)
>6 string T(2) - T(2)
>6 string T(3) - T(3)
>10 string A(D) A(D)
>10 string A(R) A(R)
>10 string A(G) A(G)
>14 string F(.) F(.);
>14 string F(,) F(,);
# hpBSD magic numbers
0 beshort 200 hp200 (68010) BSD
>2 beshort 0407 impure binary
>2 beshort 0410 read-only binary
>2 beshort 0413 demand paged binary
0 beshort 300 hp300 (68020+68881) BSD
>2 beshort 0407 impure binary
>2 beshort 0410 read-only binary
>2 beshort 0413 demand paged binary
#
# From David Gero <dgero@nortelnetworks.com>
# HP-UX 10.20 core file format from /usr/include/sys/core.h
# Unfortunately, HP-UX uses corehead blocks without specifying the order
# There are four we care about:
# CORE_KERNEL, which starts with the string "HP-UX"
# CORE_EXEC, which contains the name of the command
# CORE_PROC, which contains the signal number that caused the core dump
# CORE_FORMAT, which contains the version of the core file format (== 1)
# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
# but we include all 6 variations of the order of the first 3, and
# assume that PROC will always be last
# Order 1: KERNEL, EXEC, FORMAT, PROC
0x10 string HP-UX
>0 belong 2
>>0xC belong 0x3C
>>>0x4C belong 0x100
>>>>0x58 belong 0x44
>>>>>0xA0 belong 1
>>>>>>0xAC belong 4
>>>>>>>0xB0 belong 1
>>>>>>>>0xB4 belong 4 core file
>>>>>>>>>0x90 string >\0 from '%s'
>>>>>>>>>0xC4 belong 3 - received SIGQUIT
>>>>>>>>>0xC4 belong 4 - received SIGILL
>>>>>>>>>0xC4 belong 5 - received SIGTRAP
>>>>>>>>>0xC4 belong 6 - received SIGABRT
>>>>>>>>>0xC4 belong 7 - received SIGEMT
>>>>>>>>>0xC4 belong 8 - received SIGFPE
>>>>>>>>>0xC4 belong 10 - received SIGBUS
>>>>>>>>>0xC4 belong 11 - received SIGSEGV
>>>>>>>>>0xC4 belong 12 - received SIGSYS
>>>>>>>>>0xC4 belong 33 - received SIGXCPU
>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
# Order 2: KERNEL, FORMAT, EXEC, PROC
>>>0x4C belong 1
>>>>0x58 belong 4
>>>>>0x5C belong 1
>>>>>>0x60 belong 0x100
>>>>>>>0x6C belong 0x44
>>>>>>>>0xB4 belong 4 core file
>>>>>>>>>0xA4 string >\0 from '%s'
>>>>>>>>>0xC4 belong 3 - received SIGQUIT
>>>>>>>>>0xC4 belong 4 - received SIGILL
>>>>>>>>>0xC4 belong 5 - received SIGTRAP
>>>>>>>>>0xC4 belong 6 - received SIGABRT
>>>>>>>>>0xC4 belong 7 - received SIGEMT
>>>>>>>>>0xC4 belong 8 - received SIGFPE
>>>>>>>>>0xC4 belong 10 - received SIGBUS
>>>>>>>>>0xC4 belong 11 - received SIGSEGV
>>>>>>>>>0xC4 belong 12 - received SIGSYS
>>>>>>>>>0xC4 belong 33 - received SIGXCPU
>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
# Order 3: FORMAT, KERNEL, EXEC, PROC
0x24 string HP-UX
>0 belong 1
>>0xC belong 4
>>>0x10 belong 1
>>>>0x14 belong 2
>>>>>0x20 belong 0x3C
>>>>>>0x60 belong 0x100
>>>>>>>0x6C belong 0x44
>>>>>>>>0xB4 belong 4 core file
>>>>>>>>>0xA4 string >\0 from '%s'
>>>>>>>>>0xC4 belong 3 - received SIGQUIT
>>>>>>>>>0xC4 belong 4 - received SIGILL
>>>>>>>>>0xC4 belong 5 - received SIGTRAP
>>>>>>>>>0xC4 belong 6 - received SIGABRT
>>>>>>>>>0xC4 belong 7 - received SIGEMT
>>>>>>>>>0xC4 belong 8 - received SIGFPE
>>>>>>>>>0xC4 belong 10 - received SIGBUS
>>>>>>>>>0xC4 belong 11 - received SIGSEGV
>>>>>>>>>0xC4 belong 12 - received SIGSYS
>>>>>>>>>0xC4 belong 33 - received SIGXCPU
>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
# Order 4: EXEC, KERNEL, FORMAT, PROC
0x64 string HP-UX
>0 belong 0x100
>>0xC belong 0x44
>>>0x54 belong 2
>>>>0x60 belong 0x3C
>>>>>0xA0 belong 1
>>>>>>0xAC belong 4
>>>>>>>0xB0 belong 1
>>>>>>>>0xB4 belong 4 core file
>>>>>>>>>0x44 string >\0 from '%s'
>>>>>>>>>0xC4 belong 3 - received SIGQUIT
>>>>>>>>>0xC4 belong 4 - received SIGILL
>>>>>>>>>0xC4 belong 5 - received SIGTRAP
>>>>>>>>>0xC4 belong 6 - received SIGABRT
>>>>>>>>>0xC4 belong 7 - received SIGEMT
>>>>>>>>>0xC4 belong 8 - received SIGFPE
>>>>>>>>>0xC4 belong 10 - received SIGBUS
>>>>>>>>>0xC4 belong 11 - received SIGSEGV
>>>>>>>>>0xC4 belong 12 - received SIGSYS
>>>>>>>>>0xC4 belong 33 - received SIGXCPU
>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
# Order 5: FORMAT, EXEC, KERNEL, PROC
0x78 string HP-UX
>0 belong 1
>>0xC belong 4
>>>0x10 belong 1
>>>>0x14 belong 0x100
>>>>>0x20 belong 0x44
>>>>>>0x68 belong 2
>>>>>>>0x74 belong 0x3C
>>>>>>>>0xB4 belong 4 core file
>>>>>>>>>0x58 string >\0 from '%s'
>>>>>>>>>0xC4 belong 3 - received SIGQUIT
>>>>>>>>>0xC4 belong 4 - received SIGILL
>>>>>>>>>0xC4 belong 5 - received SIGTRAP
>>>>>>>>>0xC4 belong 6 - received SIGABRT
>>>>>>>>>0xC4 belong 7 - received SIGEMT
>>>>>>>>>0xC4 belong 8 - received SIGFPE
>>>>>>>>>0xC4 belong 10 - received SIGBUS
>>>>>>>>>0xC4 belong 11 - received SIGSEGV
>>>>>>>>>0xC4 belong 12 - received SIGSYS
>>>>>>>>>0xC4 belong 33 - received SIGXCPU
>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
# Order 6: EXEC, FORMAT, KERNEL, PROC
>0 belong 0x100
>>0xC belong 0x44
>>>0x54 belong 1
>>>>0x60 belong 4
>>>>>0x64 belong 1
>>>>>>0x68 belong 2
>>>>>>>0x74 belong 0x2C
>>>>>>>>0xB4 belong 4 core file
>>>>>>>>>0x44 string >\0 from '%s'
>>>>>>>>>0xC4 belong 3 - received SIGQUIT
>>>>>>>>>0xC4 belong 4 - received SIGILL
>>>>>>>>>0xC4 belong 5 - received SIGTRAP
>>>>>>>>>0xC4 belong 6 - received SIGABRT
>>>>>>>>>0xC4 belong 7 - received SIGEMT
>>>>>>>>>0xC4 belong 8 - received SIGFPE
>>>>>>>>>0xC4 belong 10 - received SIGBUS
>>>>>>>>>0xC4 belong 11 - received SIGSEGV
>>>>>>>>>0xC4 belong 12 - received SIGSYS
>>>>>>>>>0xC4 belong 33 - received SIGXCPU
>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
# From: AMAKAWA Shuhei <sa264@cam.ac.uk>
0 string HPHP49- HP49 binary

25
file/magic/Magdir/human68k
View File

@ -1,25 +0,0 @@
#------------------------------------------------------------------------------
# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats
# Magic too short!
#0 string HU Human68k
#>68 string LZX LZX compressed
#>>72 string >\0 (version %s)
#>(8.L+74) string LZX LZX compressed
#>>(8.L+78) string >\0 (version %s)
#>60 belong >0 binded
#>(8.L+66) string #HUPAIR hupair
#>0 string HU X executable
#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1
#>4 belong >0 - base address 0x%x
#>28 belong >0 not stripped
#>32 belong >0 with debug information
#0 beshort 0x601a Human68k Z executable
#0 beshort 0x6000 Human68k object file
#0 belong 0xd1000000 Human68k ar binary archive
#0 belong 0xd1010000 Human68k ar ascii archive
#0 beshort 0x0068 Human68k lib archive
#4 string LZX Human68k LZX compressed
#>8 string >\0 (version %s)
#>4 string LZX R executable
#2 string #HUPAIR Human68k hupair R executable

47
file/magic/Magdir/ibm370
View File

@ -1,47 +0,0 @@
#------------------------------------------------------------------------------
# ibm370: file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
# AIX 4.1's "/etc/magic" has
#
# 0 short 0535 370 sysV executable
# >12 long >0 not stripped
# >22 short >0 - version %d
# >30 long >0 - 5.2 format
# 0 short 0530 370 sysV pure executable
# >12 long >0 not stripped
# >22 short >0 - version %d
# >30 long >0 - 5.2 format
#
# instead of the "USS/370" versions of the same magic numbers.
#
0 beshort 0537 370 XA sysV executable
>12 belong >0 not stripped
>22 beshort >0 - version %d
>30 belong >0 - 5.2 format
0 beshort 0532 370 XA sysV pure executable
>12 belong >0 not stripped
>22 beshort >0 - version %d
>30 belong >0 - 5.2 format
0 beshort 054001 370 sysV pure executable
>12 belong >0 not stripped
0 beshort 055001 370 XA sysV pure executable
>12 belong >0 not stripped
0 beshort 056401 370 sysV executable
>12 belong >0 not stripped
0 beshort 057401 370 XA sysV executable
>12 belong >0 not stripped
0 beshort 0531 SVR2 executable (Amdahl-UTS)
>12 belong >0 not stripped
>24 belong >0 - version %ld
0 beshort 0534 SVR2 pure executable (Amdahl-UTS)
>12 belong >0 not stripped
>24 belong >0 - version %ld
0 beshort 0530 SVR2 pure executable (USS/370)
>12 belong >0 not stripped
>24 belong >0 - version %ld
0 beshort 0535 SVR2 executable (USS/370)
>12 belong >0 not stripped
>24 belong >0 - version %ld

19
file/magic/Magdir/ibm6000
View File

@ -1,19 +0,0 @@
#------------------------------------------------------------------------------
# ibm6000: file(1) magic for RS/6000 and the RT PC.
#
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
>12 belong >0 not stripped
# Breaks sun4 statically linked execs.
#0 beshort 0x0103 executable (RT Version 2) or obj module
#>2 byte 0x50 pure
#>28 belong >0 not stripped
#>6 beshort >0 - version %ld
0 beshort 0x0104 shared library
0 beshort 0x0105 ctab data
0 beshort 0xfe04 structured file
0 string 0xabcdef AIX message catalog
0 belong 0x000001f9 AIX compiled message catalog
0 string \<aiaff> archive
0 string \<bigaf> archive (big format)

42
file/magic/Magdir/iff
View File

@ -1,42 +0,0 @@
#------------------------------------------------------------------------------
# iff: file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
# Arts for file interchange. It has also been used by Apple, SGI, and
# especially Commodore-Amiga.
#
# IFF files begin with an 8 byte FORM header, followed by a 4 character
# FORM type, which is followed by the first chunk in the FORM.
0 string FORM IFF data
#>4 belong x \b, FORM is %d bytes long
# audio formats
>8 string AIFF \b, AIFF audio
>8 string AIFC \b, AIFF-C compressed audio
>8 string 8SVX \b, 8SVX 8-bit sampled sound voice
>8 string SAMP \b, SAMP sampled audio
>8 string DTYP \b, DTYP datatype description
>8 string PTCH \b, PTCH binary patch
# image formats
>8 string ILBMBMHD \b, ILBM interleaved image
>>20 beshort x \b, %d x
>>22 beshort x %d
>8 string RGBN \b, RGBN 12-bit RGB image
>8 string RGB8 \b, RGB8 24-bit RGB image
>8 string DR2D \b, DR2D 2-D object
>8 string TDDD \b, TDDD 3-D rendering
# other formats
>8 string FTXT \b, FTXT formatted text
>8 string CTLG \b, CTLG message catalog
>8 string PREF \b, PREF preferences
# These go at the end of the iff rules
#
# I don't see why these might collide with anything else.
#
# Interactive Fiction related formats
#
>8 string IFRS \b, Blorb Interactive Fiction
>>24 string Exec with executable chunk
>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal)

534
file/magic/Magdir/images
View File

@ -1,534 +0,0 @@
#------------------------------------------------------------------------------
# images: file(1) magic for image formats (see also "iff")
#
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
# little magic: PCX (first byte is 0x0a)
# Targa - matches `povray', `ppmtotga' and `xv' outputs
# by Philippe De Muyter <phdm@macqel.be>
# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
# `tgatoppm' recognizes a superset (Index may be anything)
1 belong&0xfff7ffff 0x01010000 Targa image data - Map
>2 byte&8 8 - RLE
>12 leshort >0 %hd x
>14 leshort >0 %hd
1 belong&0xfff7ffff 0x00020000 Targa image data - RGB
>2 byte&8 8 - RLE
>12 leshort >0 %hd x
>14 leshort >0 %hd
1 belong&0xfff7ffff 0x00030000 Targa image data - Mono
>2 byte&8 8 - RLE
>12 leshort >0 %hd x
>14 leshort >0 %hd
# PBMPLUS images
# The next byte following the magic is always whitespace.
0 string P1 Netpbm PBM image text
0 string P2 Netpbm PGM image text
0 string P3 Netpbm PPM image text
0 string P4 Netpbm PBM "rawbits" image data
0 string P5 Netpbm PGM "rawbits" image data
0 string P6 Netpbm PPM "rawbits" image data
0 string P7 Netpbm PAM image file
# From: bryanh@giraffe-data.com (Bryan Henderson)
0 string \117\072 Solitaire Image Recorder format
>4 string \013 MGI Type 11
>4 string \021 MGI Type 17
0 string .MDA MicroDesign data
>21 byte 48 version 2
>21 byte 51 version 3
0 string .MDP MicroDesign page data
>21 byte 48 version 2
>21 byte 51 version 3
# NIFF (Navy Interchange File Format, a modification of TIFF) images
0 string IIN1 NIFF image data
# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
# The second word of TIFF files is the TIFF version number, 42, which has
# never changed. The TIFF specification recommends testing for it.
0 string MM\x00\x2a TIFF image data, big-endian
0 string II\x2a\x00 TIFF image data, little-endian
# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
# (Greg Roelofs, newt@uchicago.edu)
# (Albert Cahalan, acahalan@cs.uml.edu)
#
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
#
0 string \x89PNG PNG image data,
>4 belong !0x0d0a1a0a CORRUPTED,
>4 belong 0x0d0a1a0a
>>16 belong x %ld x
>>20 belong x %ld,
>>24 byte x %d-bit
>>25 byte 0 grayscale,
>>25 byte 2 \b/color RGB,
>>25 byte 3 colormap,
>>25 byte 4 gray+alpha,
>>25 byte 6 \b/color RGBA,
#>>26 byte 0 deflate/32K,
>>28 byte 0 non-interlaced
>>28 byte 1 interlaced
1 string PNG PNG image data, CORRUPTED
# GIF
0 string GIF8 GIF image data
>4 string 7a \b, version 8%s,
>4 string 9a \b, version 8%s,
>6 leshort >0 %hd x
>8 leshort >0 %hd
#>10 byte &0x80 color mapped,
#>10 byte&0x07 =0x00 2 colors
#>10 byte&0x07 =0x01 4 colors
#>10 byte&0x07 =0x02 8 colors
#>10 byte&0x07 =0x03 16 colors
#>10 byte&0x07 =0x04 32 colors
#>10 byte&0x07 =0x05 64 colors
#>10 byte&0x07 =0x06 128 colors
#>10 byte&0x07 =0x07 256 colors
# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster,
# 1 plane, no encoding.
0 string \361\0\100\273 CMU window manager raster image data
>4 lelong >0 %d x
>8 lelong >0 %d,
>12 lelong >0 %d-bit
# Magick Image File Format
0 string id=ImageMagick MIFF image data
# Artisan
0 long 1123028772 Artisan image data
>4 long 1 \b, rectangular 24-bit
>4 long 2 \b, rectangular 8-bit with colormap
>4 long 3 \b, rectangular 32-bit (24-bit with matte)
# FIG (Facility for Interactive Generation of figures), an object-based format
0 string #FIG FIG image text
>5 string x \b, version %.3s
# PHIGS
0 string ARF_BEGARF PHIGS clear text archive
0 string @(#)SunPHIGS SunPHIGS
# version number follows, in the form m.n
>40 string SunBin binary
>32 string archive archive
# GKS (Graphics Kernel System)
0 string GKSM GKS Metafile
>24 string SunGKS \b, SunGKS
# CGM image files
0 string BEGMF clear text Computer Graphics Metafile
# XXX - questionable magic
0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile
0 beshort 0x3020 character Computer Graphics Metafile
# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
0 string yz MGR bitmap, modern format, 8-bit aligned
0 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned
0 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned
0 string yx MGR bitmap, modern format, squeezed
# Fuzzy Bitmap (FBM) images
0 string %bitmap\0 FBM image data
>30 long 0x31 \b, mono
>30 long 0x33 \b, color
# facsimile data
1 string PC\ Research,\ Inc group 3 fax data
>29 byte 0 \b, normal resolution (204x98 DPI)
>29 byte 1 \b, fine resolution (204x196 DPI)
# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
0 string Sfff structured fax file
# PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu)
0 string BM PC bitmap data
>14 leshort 12 \b, OS/2 1.x format
>>18 leshort x \b, %d x
>>20 leshort x %d
>14 leshort 64 \b, OS/2 2.x format
>>18 leshort x \b, %d x
>>20 leshort x %d
>14 leshort 40 \b, Windows 3.x format
>>18 lelong x \b, %d x
>>22 lelong x %d x
>>28 leshort x %d
# Too simple - MPi
#0 string IC PC icon data
#0 string PI PC pointer image data
#0 string CI PC color icon data
#0 string CP PC color pointer image data
# Conflicts with other entries [BABYL]
#0 string BA PC bitmap array data
# XPM icons (Greg Roelofs, newt@uchicago.edu)
# note possible collision with C/REXX entry in c-lang; currently commented out
0 string /*\ XPM\ */ X pixmap image text
# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
0 leshort 0xcc52 RLE image data,
>6 leshort x %d x
>8 leshort x %d
>2 leshort >0 \b, lower left corner: %d
>4 leshort >0 \b, lower right corner: %d
>10 byte&0x1 =0x1 \b, clear first
>10 byte&0x2 =0x2 \b, no background
>10 byte&0x4 =0x4 \b, alpha channel
>10 byte&0x8 =0x8 \b, comment
>11 byte >0 \b, %d color channels
>12 byte >0 \b, %d bits per pixel
>13 byte >0 \b, %d color map channels
# image file format (Robert Potter, potter@cs.rochester.edu)
0 string Imagefile\ version- iff image data
# this adds the whole header (inc. version number), informative but longish
>10 string >\0 %s
# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
0 belong 0x59a66a95 Sun raster image data
>4 belong >0 \b, %d x
>8 belong >0 %d,
>12 belong >0 %d-bit,
#>16 belong >0 %d bytes long,
>20 belong 0 old format,
#>20 belong 1 standard,
>20 belong 2 compressed,
>20 belong 3 RGB,
>20 belong 4 TIFF,
>20 belong 5 IFF,
>20 belong 0xffff reserved for testing,
>24 belong 0 no colormap
>24 belong 1 RGB colormap
>24 belong 2 raw colormap
#>28 belong >0 colormap is %d bytes long
# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# See
# http://reality.sgi.com/grafica/sgiimage.html
#
0 beshort 474 SGI image data
#>2 byte 0 \b, verbatim
>2 byte 1 \b, RLE
#>3 byte 1 \b, normal precision
>3 byte 2 \b, high precision
>4 beshort x \b, %d-D
>6 beshort x \b, %d x
>8 beshort x %d
>10 beshort x \b, %d channel
>10 beshort !1 \bs
>80 string >0 \b, "%s"
0 string IT01 FIT image data
>4 belong x \b, %d x
>8 belong x %d x
>12 belong x %d
#
0 string IT02 FIT image data
>4 belong x \b, %d x
>8 belong x %d x
>12 belong x %d
#
2048 string PCD_IPI Kodak Photo CD image pack file
>0xe02 byte&0x03 0x00 , landscape mode
>0xe02 byte&0x03 0x01 , portrait mode
>0xe02 byte&0x03 0x02 , landscape mode
>0xe02 byte&0x03 0x03 , portrait mode
0 string PCD_OPA Kodak Photo CD overview pack file
# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
# FITS is the Flexible Image Transport System, the de facto standard for
# data and image transfer, storage, etc., for the astronomical community.
# (FITS floating point formats are big-endian.)
0 string SIMPLE\ \ = FITS image data
>109 string 8 \b, 8-bit, character or unsigned binary integer
>108 string 16 \b, 16-bit, two's complement binary integer
>107 string \ 32 \b, 32-bit, two's complement binary integer
>107 string -32 \b, 32-bit, floating point, single precision
>107 string -64 \b, 64-bit, floating point, double precision
# other images
0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file
0 string =!! Bennet Yee's "face" format
# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
# stuff.
#
0 beshort 0x1010 PEX Binary Archive
# Visio drawings
03000 string Visio\ (TM)\ Drawing %s
# Tgif files
0 string \%TGIF\ x Tgif file version %s
# DICOM medical imaging data
128 string DICM DICOM medical imaging data
# XWD - X Window Dump file.
# As described in /usr/X11R6/include/X11/XWDFile.h
# used by the xwd program.
# Bradford Castalia, idaeim, 1/01
4 belong 7 XWD X Window Dump image data
>100 string >\0 \b, "%s"
>16 belong x \b, %dx
>20 belong x \b%dx
>12 belong x \b%d
# PDS - Planetary Data System
# These files use Parameter Value Language in the header section.
# Unfortunately, there is no certain magic, but the following
# strings have been found to be most likely.
0 string NJPL1I00 PDS (JPL) image data
2 string NJPL1I PDS (JPL) image data
0 string CCSD3ZF PDS (CCSD) image data
2 string CCSD3Z PDS (CCSD) image data
0 string PDS_ PDS image data
0 string LBLSIZE= PDS (VICAR) image data
# pM8x: ATARI STAD compressed bitmap format
#
# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
# p M 8 5/6 xx yy zz data...
# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
# bytes either run horizontally (pM85) or vertically (pM86). yy is the
# most frequent byte, xx and zz are runlength escape codes, where xx is
# used for runs of yy.
#
0 string pM85 Atari ST STAD bitmap image data (hor)
>5 byte 0x00 (white background)
>5 byte 0xFF (black background)
0 string pM86 Atari ST STAD bitmap image data (vert)
>5 byte 0x00 (white background)
>5 byte 0xFF (black background)
# XXX:
# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
# magic.
# SGI RICE image file <mpruett@sgi.com>
#0 beshort 0x5249 RICE image
#>2 beshort x v%d
#>4 beshort x (%d x
#>6 beshort x %d)
#>8 beshort 0 8 bit
#>8 beshort 1 10 bit
#>8 beshort 2 12 bit
#>8 beshort 3 13 bit
#>10 beshort 0 4:2:2
#>10 beshort 1 4:2:2:4
#>10 beshort 2 4:4:4
#>10 beshort 3 4:4:4:4
#>12 beshort 1 RGB
#>12 beshort 2 CCIR601
#>12 beshort 3 RP175
#>12 beshort 4 YUV
#------------------------------------------------------------------------------
#
# Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image file format
# for the EPOC operating system, which is used with PDAs like those from Psion
#
# see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description
# of various EPOC file formats
0 string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file
# PCX image files
# From: Dan Fandrich <dan@coneharvesters.com>
0 beshort 0x0a00 PCX ver. 2.5 image data
0 beshort 0x0a02 PCX ver. 2.8 image data, with palette
0 beshort 0x0a03 PCX ver. 2.8 image data, without palette
0 beshort 0x0a04 PCX for Windows image data
0 beshort 0x0a05 PCX ver. 3.0 image data
>4 leshort x bounding box [%hd,
>6 leshort x %hd] -
>8 leshort x [%hd,
>10 leshort x %hd],
>65 byte >1 %d planes each of
>3 byte x %hhd-bit
>68 byte 0 image,
>68 byte 1 colour,
>68 byte 2 grayscale,
>68 byte >2 image,
>68 byte <0 image,
>12 leshort >0 %hd x
>>14 leshort x %hd dpi,
>2 byte 0 uncompressed
>2 byte 1 RLE compressed
# Adobe Photoshop
0 string 8BPS Adobe Photoshop Image
# XV thumbnail indicator (ThMO)
0 string P7\ 332 XV thumbnail image data
# NITF is defined by United States MIL-STD-2500A
0 string NITF National Imagery Transmission Format
>25 string >\0 dated %.14s
# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
0 belong 0x00010008 GEM Image data
>12 beshort x %d x
>14 beshort x %d,
>4 beshort x %d planes,
>8 beshort x %d x
>10 beshort x %d pixelsize
# GEM Metafile (Wolfram Kleff)
0 lelong 0x0018FFFF GEM Metafile data
>4 leshort x version %d
#
# SMJPEG. A custom Motion JPEG format used by Loki Entertainment
# Software Torbjorn Andersson <d91tan@Update.UU.SE>.
#
0 string \0\nSMJPEG SMJPEG
>8 belong x %d.x data
# According to the specification you could find any number of _TXT
# headers here, but I can't think of any way of handling that. None of
# the SMJPEG files I tried it on used this feature. Even if such a
# file is encountered the output should still be reasonable.
>16 string _SND \b,
>>24 beshort >0 %d Hz
>>26 byte 8 8-bit
>>26 byte 16 16-bit
>>28 string NONE uncompressed
# >>28 string APCM ADPCM compressed
>>27 byte 1 mono
>>28 byte 2 stereo
# Help! Isn't there any way to avoid writing this part twice?
>>32 string _VID \b,
# >>>48 string JFIF JPEG
>>>40 belong >0 %d frames
>>>44 beshort >0 (%d x
>>>46 beshort >0 %d)
>16 string _VID \b,
# >>32 string JFIF JPEG
>>24 belong >0 %d frames
>>28 beshort >0 (%d x
>>30 beshort >0 %d)
0 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File
# "thumbnail file" (icon)
# descended from "xv", but in use by other applications as well (Wolfram Kleff)
0 string P7\ 332 XV "thumbnail file" (icon) data
# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
0 string KiSS KISS/GS
>4 byte 16 color
>>5 byte x %d bit
>>8 leshort x %d colors
>>10 leshort x %d groups
>4 byte 32 cell
>>5 byte x %d bit
>>8 leshort x %d x
>>10 leshort x %d
>>12 leshort x +%d
>>14 leshort x +%d
# Webshots (www.webshots.com), by John Harrison
0 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file
# Hercules DASD image files
# From Jan Jaeger <jj@septa.nl>
0 string CKD_P370 Hercules CKD DASD image file
>8 long x \b, %d heads per cylinder
>12 long x \b, track size %d bytes
>16 byte x \b, device type 33%2.2X
0 string CKD_C370 Hercules compressed CKD DASD image file
>8 long x \b, %d heads per cylinder
>12 long x \b, track size %d bytes
>16 byte x \b, device type 33%2.2X
0 string CKD_S370 Hercules CKD DASD shadow file
>8 long x \b, %d heads per cylinder
>12 long x \b, track size %d bytes
>16 byte x \b, device type 33%2.2X
# Squeak images and - etoffi@softhome.net
0 string \146\031\0\0 Squeak image data
0 string 'From\040Squeak Squeak program text
# partimage: file(1) magic for PartImage files (experimental, incomplete)
# Author: Hans-Joachim Baader <hjb@pro-linux.de>
0 string PaRtImAgE-VoLuMe PartImage
>0x0020 string 0.6.1 file version %s
>>0x0060 lelong >-1 volume %ld
#>>0x0064 8 byte identifier
#>>0x007c reserved
>>0x0200 string >\0 type %s
>>0x1400 string >\0 device %s,
>>0x1600 string >\0 original filename %s,
# Some fields omitted
>>0x2744 lelong 0 not compressed
>>0x2744 lelong 1 gzip compressed
>>0x2744 lelong 2 bzip2 compressed
>>0x2744 lelong >2 compressed with unknown algorithm
>0x0020 string >0.6.1 file version %s
>0x0020 string <0.6.1 file version %s
# DCX is multi-page PCX, using a simple header of up to 1024
# offsets for the respective PCX components.
# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
0 lelong 987654321 DCX multi-page PCX image data
# Simon Walton <simonw@matteworld.com>
# Kodak Cineon format for scanned negatives
# http://www.kodak.com/US/en/motion/support/dlad/
0 lelong 0xd75f2a80 Cineon image data
>200 belong >0 \b, %ld x
>204 belong >0 %ld
# Bio-Rad .PIC is an image format used by microscope control systems
# and related image processing software used by biologists.
# From: Vebjorn Ljosa <vebjorn@ljosa.com>
54 leshort 12345 Bio-Rad .PIC Image File
>0 leshort >0 %hd x
>2 leshort >0 %hd,
>4 leshort =1 1 image in file
>4 leshort >1 %hd images in file
# From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
# The description of *.mrw format can be found at
# http://www.dalibor.cz/minolta/raw_file_format.htm
0 string \000MRM Minolta Dimage camera raw image data
# From: stephane.loeuillet@tiscali.f
# http://www.djvuzone.org/
0 string AT&TFORM DjVu Image file
# From: Jason Bacon <bacon@smithers.neuro.mcw.edu>
0 beshort 0x3020 character Computer Graphics Metafile
# From Marc Espie
0 lelong 20000630 OpenEXR image data
# From: Tom Hilinski <tom.hilinski@comcast.net>
# http://www.unidata.ucar.edu/packages/netcdf/
0 string CDF\001 NetCDF Data Format data
#-----------------------------------------------------------------------
# Hierarchical Data Format, used to facilitate scientific data exchange
# specifications at http://hdf.ncsa.uiuc.edu/
0 belong 0x0e031301 Hierarchical Data Format (version 4) data
0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data
# The boot loaders syslinux and isolinux use a RLE based image format
# called SLL16 to store splash screens.
0 lelong 0x1413f33d Syslinux SLL16 image data,
>4 leshort >0 %hd x
>6 leshort >0 %hd

47
file/magic/Magdir/intel
View File

@ -1,47 +0,0 @@
#------------------------------------------------------------------------------
# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do
# Windows as well.
#
# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere
# as well, if, as, and when IBM makes it portable.
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0 leshort 0502 basic-16 executable
>12 lelong >0 not stripped
#>22 leshort >0 - version %ld
0 leshort 0503 basic-16 executable (TV)
>12 lelong >0 not stripped
#>22 leshort >0 - version %ld
0 leshort 0510 x86 executable
>12 lelong >0 not stripped
0 leshort 0511 x86 executable (TV)
>12 lelong >0 not stripped
0 leshort =0512 iAPX 286 executable small model (COFF)
>12 lelong >0 not stripped
#>22 leshort >0 - version %ld
0 leshort =0522 iAPX 286 executable large model (COFF)
>12 lelong >0 not stripped
#>22 leshort >0 - version %ld
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
0 leshort =0514 80386 COFF executable
>12 lelong >0 not stripped
>22 leshort >0 - version %ld
# rom: file(1) magic for BIOS ROM Extensions found in intel machines
# mapped into memory between 0xC0000 and 0xFFFFF
# From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
0 beshort 0x55AA BIOS (ia32) ROM Ext.
>5 string USB USB
>7 string LDR UNDI image
>30 string IBM IBM comp. Video
>26 string Adaptec Adaptec
>28 string Adaptec Adaptec
>42 string PROMISE Promise
>2 byte x (%d*512)

8
file/magic/Magdir/interleaf
View File

@ -1,8 +0,0 @@
#------------------------------------------------------------------------------
# interleaf: file(1) magic for InterLeaf TPS:
#
0 string =\210OPS Interleaf saved data
0 string =<!OPS Interleaf document text
>5 string ,\ Version\ = \b, version
>>17 string >\0 %.3s

9
file/magic/Magdir/island
View File

@ -1,9 +0,0 @@
#------------------------------------------------------------------------------
# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
# "/etc/magic":
# From: guy@netapp.com (Guy Harris)
#
4 string pgscriptver IslandWrite document
13 string DrawFile IslandDraw document

62
file/magic/Magdir/ispell
View File

@ -1,62 +0,0 @@
#------------------------------------------------------------------------------
# ispell: file(1) magic for ispell
#
# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic
# will match 0x9600 through 0x9603 in *both* little endian and big endian.
# (No other current magic entries collide.)
#
# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
#
0 leshort&0xFFFC 0x9600 little endian ispell
>0 byte 0 hash file (?),
>0 byte 1 3.0 hash file,
>0 byte 2 3.1 hash file,
>0 byte 3 hash file (?),
>2 leshort 0x00 8-bit, no capitalization, 26 flags
>2 leshort 0x01 7-bit, no capitalization, 26 flags
>2 leshort 0x02 8-bit, capitalization, 26 flags
>2 leshort 0x03 7-bit, capitalization, 26 flags
>2 leshort 0x04 8-bit, no capitalization, 52 flags
>2 leshort 0x05 7-bit, no capitalization, 52 flags
>2 leshort 0x06 8-bit, capitalization, 52 flags
>2 leshort 0x07 7-bit, capitalization, 52 flags
>2 leshort 0x08 8-bit, no capitalization, 128 flags
>2 leshort 0x09 7-bit, no capitalization, 128 flags
>2 leshort 0x0A 8-bit, capitalization, 128 flags
>2 leshort 0x0B 7-bit, capitalization, 128 flags
>2 leshort 0x0C 8-bit, no capitalization, 256 flags
>2 leshort 0x0D 7-bit, no capitalization, 256 flags
>2 leshort 0x0E 8-bit, capitalization, 256 flags
>2 leshort 0x0F 7-bit, capitalization, 256 flags
>4 leshort >0 and %d string characters
0 beshort&0xFFFC 0x9600 big endian ispell
>1 byte 0 hash file (?),
>1 byte 1 3.0 hash file,
>1 byte 2 3.1 hash file,
>1 byte 3 hash file (?),
>2 beshort 0x00 8-bit, no capitalization, 26 flags
>2 beshort 0x01 7-bit, no capitalization, 26 flags
>2 beshort 0x02 8-bit, capitalization, 26 flags
>2 beshort 0x03 7-bit, capitalization, 26 flags
>2 beshort 0x04 8-bit, no capitalization, 52 flags
>2 beshort 0x05 7-bit, no capitalization, 52 flags
>2 beshort 0x06 8-bit, capitalization, 52 flags
>2 beshort 0x07 7-bit, capitalization, 52 flags
>2 beshort 0x08 8-bit, no capitalization, 128 flags
>2 beshort 0x09 7-bit, no capitalization, 128 flags
>2 beshort 0x0A 8-bit, capitalization, 128 flags
>2 beshort 0x0B 7-bit, capitalization, 128 flags
>2 beshort 0x0C 8-bit, no capitalization, 256 flags
>2 beshort 0x0D 7-bit, no capitalization, 256 flags
>2 beshort 0x0E 8-bit, capitalization, 256 flags
>2 beshort 0x0F 7-bit, capitalization, 256 flags
>4 beshort >0 and %d string characters
# ispell 4.0 hash files kromJx <kromJx@crosswinds.net>
# Ispell 4.0
0 string ISPL ispell
>4 long x hash file version %d,
>8 long x lexletters %d,
>12 long x lexsize %d,
>16 long x hashsize %d,
>20 long x stblsize %d

12
file/magic/Magdir/java
View File

@ -1,12 +0,0 @@
#------------------------------------------------------------
# Java ByteCode
# From Larry Schwimmer (schwim@cs.stanford.edu)
# Handled in Mach now
#0 belong 0xcafebabe compiled Java class data,
#>6 beshort x version %d.
#>4 beshort x \b%d
#------------------------------------------------------------
# Java serialization
# From Martin Pool (m.pool@pharos.com.au)
0 beshort 0xaced Java serialization data
>2 beshort >0x0004 \b, version %d

155
file/magic/Magdir/jpeg
View File

@ -1,155 +0,0 @@
#------------------------------------------------------------------------------
# JPEG images
# SunOS 5.5.1 had
#
# 0 string \377\330\377\340 JPEG file
# 0 string \377\330\377\356 JPG file
#
# both of which turn into "JPEG image data" here.
#
0 beshort 0xffd8 JPEG image data
>6 string JFIF \b, JFIF standard
# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
# in a vain attempt to add image size reporting for JFIF. Note that these
# tests are not fool-proof since some perfectly valid JPEGs are currently
# impossible to specify in magic(4) format.
# First, a little JFIF version info:
>>11 byte x \b %d.
>>12 byte x \b%02d
# Next, the resolution or aspect ratio of the image:
#>>13 byte 0 \b, aspect ratio
#>>13 byte 1 \b, resolution (DPI)
#>>13 byte 2 \b, resolution (DPCM)
#>>4 beshort x \b, segment length %d
# Next, show thumbnail info, if it exists:
>>18 byte !0 \b, thumbnail %dx
>>>19 byte x \b%d
# EXIF moved down here to avoid reporting a bogus version number,
# and EXIF version number printing added.
# - Patrik R=E5dman <patrik+file-magic@iki.fi>
>6 string Exif \b, EXIF standard
# Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD.
# All possible combinations of entries have to be enumerated, since no looping
# is possible. And both endians are possible...
# The combinations included below are from real-world JPEGs.
# Little-endian
>>12 string II
# IFD 0 Entry #5:
>>>70 leshort 0x8769
# EXIF IFD Entry #1:
>>>>(78.l+14) leshort 0x9000
>>>>>(78.l+23) byte x %c
>>>>>(78.l+24) byte x \b.%c
>>>>>(78.l+25) byte !0x30 \b%c
# IFD 0 Entry #9:
>>>118 leshort 0x8769
# EXIF IFD Entry #3:
>>>>(126.l+38) leshort 0x9000
>>>>>(126.l+47) byte x %c
>>>>>(126.l+48) byte x \b.%c
>>>>>(126.l+49) byte !0x30 \b%c
# IFD 0 Entry #10
>>>130 leshort 0x8769
# EXIF IFD Entry #3:
>>>>(138.l+38) leshort 0x9000
>>>>>(138.l+47) byte x %c
>>>>>(138.l+48) byte x \b.%c
>>>>>(138.l+49) byte !0x30 \b%c
# EXIF IFD Entry #4:
>>>>(138.l+50) leshort 0x9000
>>>>>(138.l+59) byte x %c
>>>>>(138.l+60) byte x \b.%c
>>>>>(138.l+61) byte !0x30 \b%c
# EXIF IFD Entry #5:
>>>>(138.l+62) leshort 0x9000
>>>>>(138.l+71) byte x %c
>>>>>(138.l+72) byte x \b.%c
>>>>>(138.l+73) byte !0x30 \b%c
# IFD 0 Entry #11
>>>142 leshort 0x8769
# EXIF IFD Entry #3:
>>>>(150.l+38) leshort 0x9000
>>>>>(150.l+47) byte x %c
>>>>>(150.l+48) byte x \b.%c
>>>>>(150.l+49) byte !0x30 \b%c
# EXIF IFD Entry #4:
>>>>(150.l+50) leshort 0x9000
>>>>>(150.l+59) byte x %c
>>>>>(150.l+60) byte x \b.%c
>>>>>(150.l+61) byte !0x30 \b%c
# EXIF IFD Entry #5:
>>>>(150.l+62) leshort 0x9000
>>>>>(150.l+71) byte x %c
>>>>>(150.l+72) byte x \b.%c
>>>>>(150.l+73) byte !0x30 \b%c
# Big-endian
>>12 string MM
# IFD 0 Entry #9:
>>>118 beshort 0x8769
# EXIF IFD Entry #1:
>>>>(126.L+14) beshort 0x9000
>>>>>(126.L+23) byte x %c
>>>>>(126.L+24) byte x \b.%c
>>>>>(126.L+25) byte !0x30 \b%c
# EXIF IFD Entry #3:
>>>>(126.L+38) beshort 0x9000
>>>>>(126.L+47) byte x %c
>>>>>(126.L+48) byte x \b.%c
>>>>>(126.L+49) byte !0x30 \b%c
# IFD 0 Entry #10
>>>130 beshort 0x8769
# EXIF IFD Entry #3:
>>>>(138.L+38) beshort 0x9000
>>>>>(138.L+47) byte x %c
>>>>>(138.L+48) byte x \b.%c
>>>>>(138.L+49) byte !0x30 \b%c
# EXIF IFD Entry #5:
>>>>(138.L+62) beshort 0x9000
>>>>>(138.L+71) byte x %c
>>>>>(138.L+72) byte x \b.%c
>>>>>(138.L+73) byte !0x30 \b%c
# IFD 0 Entry #11
>>>142 beshort 0x8769
# EXIF IFD Entry #4:
>>>>(150.L+50) beshort 0x9000
>>>>>(150.L+59) byte x %c
>>>>>(150.L+60) byte x \b.%c
>>>>>(150.L+61) byte !0x30 \b%c
# Here things get sticky. We can do ONE MORE marker segment with
# indirect addressing, and that's all. It would be great if we could
# do pointer arithemetic like in an assembler language. Christos?
# And if there was some sort of looping construct to do searches, plus a few
# named accumulators, it would be even more effective...
# At least we can show a comment if no other segments got inserted before:
>(4.S+5) byte 0xFE
>>(4.S+8) string >\0 \b, comment: "%s"
#>(4.S+5) byte 0xFE \b, comment
#>>(4.S+6) beshort x \b length=%d
#>>(4.S+8) string >\0 \b, "%s"
# Or, we can show the encoding type (I've included only the three most common)
# and image dimensions if we are lucky and the SOFn (image segment) is here:
>(4.S+5) byte 0xC0 \b, baseline
>>(4.S+6) byte x \b, precision %d
>>(4.S+7) beshort x \b, %dx
>>(4.S+9) beshort x \b%d
>(4.S+5) byte 0xC1 \b, extended sequential
>>(4.S+6) byte x \b, precision %d
>>(4.S+7) beshort x \b, %dx
>>(4.S+9) beshort x \b%d
>(4.S+5) byte 0xC2 \b, progressive
>>(4.S+6) byte x \b, precision %d
>>(4.S+7) beshort x \b, %dx
>>(4.S+9) beshort x \b%d
# I've commented-out quantisation table reporting. I doubt anyone cares yet.
#>(4.S+5) byte 0xDB \b, quantisation table
#>>(4.S+6) beshort x \b length=%d
#>14 beshort x \b, %d x
#>16 beshort x \b %d
# HSI is Handmade Software's proprietary JPEG encoding scheme
0 string hsi1 JPEG image data, HSI proprietary
# From: David Santinoli <david@santinoli.com>
0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data

8
file/magic/Magdir/karma
View File

@ -1,8 +0,0 @@
#------------------------------------------------------------------------------
# karma: file(1) magic for Karma data files
#
# From <rgooch@atnf.csiro.au>
0 string KarmaRHD Version Karma Data Structure Version
>16 belong x %lu

Some files were not shown because too many files have changed in this diff Show More