diff options
Diffstat (limited to 'doc/magic.man')
| -rw-r--r-- | doc/magic.man | 71 |
1 files changed, 54 insertions, 17 deletions
diff --git a/doc/magic.man b/doc/magic.man index 1d83603..b6523f2 100644 --- a/doc/magic.man +++ b/doc/magic.man @@ -1,5 +1,5 @@ -.\" $File: magic.man,v 1.78 2013/01/09 13:04:30 christos Exp $ -.Dd January 7, 2013 +.\" $File: magic.man,v 1.85 2015/01/01 17:07:34 christos Exp $ +.Dd January 1, 2015 .Dt MAGIC __FSECTION__ .Os .\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems. @@ -200,6 +200,11 @@ interpreted as a UNIX-style date, but interpreted as local time rather than UTC. .It Dv indirect Starting at the given offset, consult the magic database again. +The offset of th +.Dv indirect +magic is by default absolute in the file, but one can specify +.Dv /r +to indicate that the offset is relative from the beginning of the entry. .It Dv name Define a .Dq named @@ -228,19 +233,25 @@ Regular expressions can take exponential time to process, and their performance is hard to predict, so their use is discouraged. When used in production environments, their performance should be carefully checked. -The type specification can be optionally followed by -.Dv /[c][s] . +The size of the string to search should also be limited by specifying +.Dv /<length> , +to avoid performance issues scanning long files. +The type specification can also be optionally followed by +.Dv /[c][s][l] . The .Dq c flag makes the match case insensitive, while the .Dq s flag update the offset to the start offset of the match, rather than the end. -The regular expression is tested against line -.Dv N + 1 -onwards, where -.Dv N -is the given offset. -Line endings are assumed to be in the machine's native format. +The +.Dq l +modifier, changes the limit of length to mean number of lines instead of a +byte count. +Lines are delimited by the platforms native line delimiter. +When a line count is specified, an implicit byte count also computed assuming +each line is 80 characters long. +If neither a byte or line count is specified, the search is limited automatically +to 8KiB. .Dv ^ and .Dv $ @@ -249,20 +260,28 @@ not beginning and end of file. .It Dv search A literal string search starting at the given offset. The same modifier flags can be used as for string patterns. -The modifier flags (if any) must be followed by -.Dv /number -the range, that is, the number of positions at which the match will be +The search expression must contain the range in the form +.Dv /number, +that is the number of positions at which the match will be attempted, starting from the start offset. This is suitable for searching larger binary expressions with variable offsets, using .Dv \e escapes for special characters. -The offset works as for regex. +The order of modifier and number is not relevant. .It Dv default This is intended to be used with the test .Em x -(which is always true) and a message that is to be used if there are -no other matches. +(which is always true) and it has no type. +It matches when no other test at that continuation level has matched before. +Clearing that matched tests for a continuation level, can be done using the +.Dv clear +test. +.It Dv clear +This test is always true and clears the match flag for that continuation level. +It is intended to be used with the +.Dv default +test. .El .Pp For compatibility with the Single @@ -401,6 +420,9 @@ is octal, and .Dv 0x13 is hexadecimal. .Pp +Numeric operations are not performed on date types, instead the numeric +value is interpreted as an offset. +.Pp For string values, the string from the file must match the specified string. The operators @@ -418,6 +440,9 @@ then print the string), with .Em \*[Gt]\e0 (because all non-empty strings are greater than the empty string). .Pp +Dates are treated as numerical values in the respective internal +representation. +.Pp The special test .Em x always evaluates to true. @@ -605,7 +630,7 @@ Or even both! \*[Gt]\*[Gt]\*[Gt]\*[Am](\*[Am]0x54.l-3) string UNACE \eb, ACE self-extracting archive .Ed .Pp -Finally, if you have to deal with offset/length pairs in your file, even the +If you have to deal with offset/length pairs in your file, even the second value in a parenthesized expression can be taken from the file itself, using another set of parentheses. Note that this additional indirect offset is always relative to the @@ -620,6 +645,18 @@ start of the main indirect offset. # these are located 14 and 10 bytes after the section name \*[Gt]\*[Gt]\*[Gt]\*[Gt](\*[Am]0xe.l+(-4)) string PK\e3\e4 \eb, ZIP self-extracting archive .Ed +.Pp +If you have a list of known avalues at a particular continuation level, +and you want to provide a switch-like default case: +.Bd -literal -offset indent +# clear that continuation level match +\*[Gt]18 clear +\*[Gt]18 lelong 1 one +\*[Gt]18 lelong 2 two +\*[Gt]18 default x +# print default match +\*[Gt]\*[Gt]18 lelong x unmatched 0x%x +.Ed .Sh SEE ALSO .Xr file __CSECTION__ \- the command that reads this file. |