diff options
Diffstat (limited to 'magic')
251 files changed, 19616 insertions, 0 deletions
diff --git a/magic/Header b/magic/Header new file mode 100644 index 0000000..831122e --- /dev/null +++ b/magic/Header @@ -0,0 +1,5 @@ +# Magic data for file(1) command. +# Format is described in magic(files), where: +# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID. +# Don't edit this file, edit /etc/magic or send your magic improvements +# to the maintainers, at file@mx.gw.com diff --git a/magic/Localstuff b/magic/Localstuff new file mode 100644 index 0000000..419855f --- /dev/null +++ b/magic/Localstuff @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# Localstuff: file(1) magic for locally observed files +# +# $File: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $ +# Add any locally observed files here. Remember: +# text if readable, executable if runnable binary, data if unreadable. diff --git a/magic/Magdir/acorn b/magic/Magdir/acorn new file mode 100644 index 0000000..4202be9 --- /dev/null +++ b/magic/Magdir/acorn @@ -0,0 +1,69 @@ + +#------------------------------------------------------------------------------ +# $File: acorn,v 1.5 2009/09/19 16:28:07 christos Exp $ +# acorn: file(1) magic for files found on Acorn systems +# + +# RISC OS Chunk File Format +# From RISC OS Programmer's Reference Manual, Appendix D +# We guess the file type from the type of the first chunk. +0 lelong 0xc3cbc6c5 RISC OS Chunk data +>12 string OBJ_ \b, AOF object +>12 string LIB_ \b, ALF library + +# RISC OS AIF, contains "SWI OS_Exit" at offset 16. +16 lelong 0xef000011 RISC OS AIF executable + +# RISC OS Draw files +# From RISC OS Programmer's Reference Manual, Appendix E +0 string Draw RISC OS Draw file data + +# RISC OS new format font files +# From RISC OS Programmer's Reference Manual, Appendix E +0 string FONT\0 RISC OS outline font data, +>5 byte x version %d +0 string FONT\1 RISC OS 1bpp font data, +>5 byte x version %d +0 string FONT\4 RISC OS 4bpp font data +>5 byte x version %d + +# RISC OS Music files +# From RISC OS Programmer's Reference Manual, Appendix E +0 string Maestro\r RISC OS music file +>8 byte x version %d + +>8 byte x type %d + +# Digital Symphony data files +# From: Bernard Jungen (bern8817@euphonynet.be) +0 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS), +>8 byte x version %d, +>9 pstring x named "%s", +>(9.b+19) byte =0 8-bit logarithmic +>(9.b+19) byte =1 LZW-compressed linear +>(9.b+19) byte =2 8-bit linear signed +>(9.b+19) byte =3 16-bit linear signed +>(9.b+19) byte =4 SigmaDelta-compressed linear +>(9.b+19) byte =5 SigmaDelta-compressed logarithmic +>(9.b+19) byte >5 unknown format + +0 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS), +>8 byte x version %d, +>9 byte =1 1 voice, +>9 byte !1 %d voices, +>10 leshort =1 1 track, +>10 leshort !1 %d tracks, +>12 leshort =1 1 pattern +>12 leshort !1 %d patterns + +0 string \x02\x01\x13\x13\x10\x14\x12\x0e +>9 byte =0 Digital Symphony sequence (RISC OS), +>>8 byte x version %d, +>>10 byte =1 1 line, +>>10 byte !1 %d lines, +>>11 leshort =1 1 position +>>11 leshort !1 %d positions +>9 byte =1 Digital Symphony pattern data (RISC OS), +>>8 byte x version %d, +>>10 leshort =1 1 pattern +>>10 leshort !1 %d patterns diff --git a/magic/Magdir/adi b/magic/Magdir/adi new file mode 100644 index 0000000..2fe79d4 --- /dev/null +++ b/magic/Magdir/adi @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $ +# adi: file(1) magic for ADi's objects +# From Gregory McGarry <g.mcgarry@ieee.org> +# +0 leshort 0x521c COFF DSP21k +>18 lelong &02 executable, +>18 lelong ^02 +>>18 lelong &01 static object, +>>18 lelong ^01 relocatable object, +>18 lelong &010 stripped +>18 lelong ^010 not stripped diff --git a/magic/Magdir/adventure b/magic/Magdir/adventure new file mode 100644 index 0000000..37b4cb3 --- /dev/null +++ b/magic/Magdir/adventure @@ -0,0 +1,110 @@ + +#------------------------------------------------------------------------------ +# $File: adventure,v 1.14 2012/06/21 01:32:26 christos Exp $ +# adventure: file(1) magic for Adventure game files +# +# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> +# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 +# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 +# +# ALAN +# I assume there are other, lower versions, but these are the only ones I +# saw in the archive. +0 beshort 0x0206 ALAN game data +>2 byte <10 version 2.6%d + + +# Infocom (see z-machine) +#------------------------------------------------------------------------------ +# Z-machine: file(1) magic for Z-machine binaries. +# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> +# +#http://www.gnelson.demon.co.uk/zspec/sect11.html +#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt +#http://en.wikipedia.org/wiki/Z-machine +# The first byte is the Z-machine revision; it is always between 1 and 8. We +# had false matches (for instance, inbig5.ocp from the Omega TeX extension as +# well as an occasional MP3 file), so we sanity-check the version number. +# +# It might be possible to sanity-check the release number as well, as it seems +# (at least in classic Infocom games) to always be a relatively small number, +# always under 150 or so, but as this isn't rigorous, we'll wait on that until +# it becomes clear that it's needed. +# +0 ubyte >0 +>0 ubyte <9 +>>16 belong&0xfe00f0f0 0x3030 +>>>0 ubyte < 10 +>>>>2 ubeshort < 10 +>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9] +>>>>>>0 ubyte < 10 Infocom (Z-machine %d, +>>>>>>>2 ubeshort < 10 Release %d / +>>>>>>>>18 string >\0 Serial %.6s) +!:strength + 40 + +#------------------------------------------------------------------------------ +# Glulx: file(1) magic for Glulx binaries. +# +# I haven't checked for false matches yet. +# +0 string Glul Glulx game data +>4 beshort x (Version %d +>>6 byte x \b.%d +>>8 byte x \b.%d) +>36 string Info Compiled by Inform + + + +# For Quetzal and blorb magic see iff + + +# TADS (Text Adventure Development System) version 2 +# All files are machine-independent (games compile to byte-code) and are tagged +# with a version string of the form "V2.<digit>.<digit>\0". +# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. +0 string TADS2\ bin TADS +>9 belong !0x0A0D1A00 game data, CORRUPTED +>9 belong 0x0A0D1A00 +>>13 string >\0 %s game data +# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. +0 string TADS2\ rsc TADS +>9 belong !0x0A0D1A00 resource data, CORRUPTED +>9 belong 0x0A0D1A00 +>>13 string >\0 %s resource data +# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian +# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), +# "TADS2 save\n\r\032\0" and the interpreter version. +0 string TADS2\ save/g TADS +>12 belong !0x0A0D1A00 saved game data, CORRUPTED +>12 belong 0x0A0D1A00 +>>(16.s+32) string >\0 %s saved game data +# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter +# version. +0 string TADS2\ save TADS +>10 belong !0x0A0D1A00 saved game data, CORRUPTED +>10 belong 0x0A0D1A00 +>>14 string >\0 %s saved game data + +# TADS (Text Adventure Development System) version 3 +# Game files start with "T3-image\015\012\032" +0 string T3-image\015\012\032 +>11 leshort x TADS 3 game data (format version %d) +# Saved game files start with "T3-state-v####\015\012\032" +# where #### is a format version number +0 string T3-state-v +>14 string \015\012\032 TADS 3 saved game data (format version +>>10 byte x %c +>>11 byte x \b%c +>>12 byte x \b%c +>>13 byte x \b%c) + +# Danny Milosavljevic <danny.milo@gmx.net> +# this are adrift (adventure game standard) game files, extension .taf +# depending on version magic continues with 0x93453E6139FA (V 4.0) +# 0x9445376139FA (V 3.90) +# 0x9445366139FA (V 3.80) +# this is from source (http://www.adrift.org.uk/) and I have some taf +# files, and checked them. +#0 belong 0x3C423FC9 +#>4 belong 0x6A87C2CF Adrift game file +#!:mime application/x-adrift diff --git a/magic/Magdir/allegro b/magic/Magdir/allegro new file mode 100644 index 0000000..b937c9c --- /dev/null +++ b/magic/Magdir/allegro @@ -0,0 +1,9 @@ + +#------------------------------------------------------------------------------ +# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $ +# allegro: file(1) magic for Allegro datafiles +# Toby Deshane <hac@shoelace.digivill.net> +# +0 belong 0x736C6821 Allegro datafile (packed) +0 belong 0x736C682E Allegro datafile (not packed/autodetect) +0 belong 0x736C682B Allegro datafile (appended exe data) diff --git a/magic/Magdir/alliant b/magic/Magdir/alliant new file mode 100644 index 0000000..9620202 --- /dev/null +++ b/magic/Magdir/alliant @@ -0,0 +1,18 @@ + +#------------------------------------------------------------------------------ +# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $ +# alliant: file(1) magic for Alliant FX series a.out files +# +# If the FX series is the one that had a processor with a 68K-derived +# instruction set, the "short" should probably become "beshort" and the +# "long" should probably become "belong". +# If it's the i860-based one, they should probably become either the +# big-endian or little-endian versions, depending on the mode they ran +# the 860 in.... +# +0 short 0420 0420 Alliant virtual executable +>2 short &0x0020 common library +>16 long >0 not stripped +0 short 0421 0421 Alliant compact executable +>2 short &0x0020 common library +>16 long >0 not stripped diff --git a/magic/Magdir/amanda b/magic/Magdir/amanda new file mode 100644 index 0000000..395ef54 --- /dev/null +++ b/magic/Magdir/amanda @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $ +# amanda: file(1) magic for amanda file format +# +0 string AMANDA:\ AMANDA +>8 string TAPESTART\ DATE tape header file, +>>23 string X +>>>25 string >\ Unused %s +>>23 string >\ DATE %s +>8 string FILE\ dump file, +>>13 string >\ DATE %s diff --git a/magic/Magdir/amigaos b/magic/Magdir/amigaos new file mode 100644 index 0000000..8fdf376 --- /dev/null +++ b/magic/Magdir/amigaos @@ -0,0 +1,68 @@ + +#------------------------------------------------------------------------------ +# $File: amigaos,v 1.15 2012/06/21 01:13:59 christos Exp $ +# amigaos: file(1) magic for AmigaOS binary formats: + +# +# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) +# +0 belong 0x000003fa AmigaOS shared library +0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary +0 belong 0x000003e7 AmigaOS object/library data +# +0 beshort 0xe310 Amiga Workbench +>2 beshort 1 +>>48 byte 1 disk icon +>>48 byte 2 drawer icon +>>48 byte 3 tool icon +>>48 byte 4 project icon +>>48 byte 5 garbage icon +>>48 byte 6 device icon +>>48 byte 7 kickstart icon +>>48 byte 8 workbench application icon +>2 beshort >1 icon, vers. %d +# +# various sound formats from the Amiga +# G=F6tz Waschk <waschk@informatik.uni-rostock.de> +# +0 string FC14 Future Composer 1.4 Module sound file +0 string SMOD Future Composer 1.3 Module sound file +0 string AON4artofnoise Art Of Noise Module sound file +1 string MUGICIAN/SOFTEYES Mugician Module sound file +58 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file +0 string Synth4.0 Synthesis Module sound file +0 string ARP. The Holy Noise Module sound file +0 string BeEp\0 JamCracker Module sound file +0 string COSO\0 Hippel-COSO Module sound file +# Too simple (short, pure ASCII, deep), MPi +#26 string V.3 Brian Postma's Soundmon Module sound file v3 +#26 string BPSM Brian Postma's Soundmon Module sound file v3 +#26 string V.2 Brian Postma's Soundmon Module sound file v2 + +# The following are from: "Stefan A. Haubenthal" <polluks@web.de> +0 beshort 0x0f00 AmigaOS bitmap font +0 beshort 0x0f03 AmigaOS outline font +0 belong 0x80001001 AmigaOS outline tag +0 string ##\ version catalog translation +0 string EMOD\0 Amiga E module +8 string ECXM\0 ECX module +0 string/c @database AmigaGuide file + +# Amiga disk types +# +0 string RDSK Rigid Disk Block +>160 string x on %.24s +0 string DOS\0 Amiga DOS disk +0 string DOS\1 Amiga FFS disk +0 string DOS\2 Amiga Inter DOS disk +0 string DOS\3 Amiga Inter FFS disk +0 string DOS\4 Amiga Fastdir DOS disk +0 string DOS\5 Amiga Fastdir FFS disk +0 string KICK Kickstart disk + +# From: Alex Beregszaszi <alex@fsn.hu> +0 string LZX LZX compressed archive (Amiga) + +# From: Przemek Kramarczyk <pkramarczyk@gmail.com> +0 string .KEY AmigaDOS script +0 string .key AmigaDOS script diff --git a/magic/Magdir/animation b/magic/Magdir/animation new file mode 100644 index 0000000..fa5e6f1 --- /dev/null +++ b/magic/Magdir/animation @@ -0,0 +1,891 @@ + +#------------------------------------------------------------------------------ +# $File: animation,v 1.47 2013/02/06 14:18:52 christos Exp $ +# animation: file(1) magic for animation/movie formats +# +# animation formats +# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) +# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) + +# SGI and Apple formats +0 string MOVI Silicon Graphics movie file +!:mime video/x-sgi-movie +4 string moov Apple QuickTime +!:mime video/quicktime +>12 string mvhd \b movie (fast start) +>12 string mdra \b URL +>12 string cmov \b movie (fast start, compressed header) +>12 string rmra \b multiple URLs +4 string mdat Apple QuickTime movie (unoptimized) +!:mime video/quicktime +#4 string wide Apple QuickTime movie (unoptimized) +#!:mime video/quicktime +#4 string skip Apple QuickTime movie (modified) +#!:mime video/quicktime +#4 string free Apple QuickTime movie (modified) +#!:mime video/quicktime +4 string idsc Apple QuickTime image (fast start) +!:mime image/x-quicktime +#4 string idat Apple QuickTime image (unoptimized) +#!:mime image/x-quicktime +4 string pckg Apple QuickTime compressed archive +!:mime application/x-quicktime-player +4 string/W jP JPEG 2000 image +!:mime image/jp2 +4 string ftyp ISO Media +>8 string isom \b, MPEG v4 system, version 1 +!:mime video/mp4 +>8 string iso2 \b, MPEG v4 system, part 12 revision +>8 string mp41 \b, MPEG v4 system, version 1 +!:mime video/mp4 +>8 string mp42 \b, MPEG v4 system, version 2 +!:mime video/mp4 +>8 string mp7t \b, MPEG v4 system, MPEG v7 XML +>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML +>8 string/W jp2 \b, JPEG 2000 +!:mime image/jp2 +>8 string 3ge \b, MPEG v4 system, 3GPP +!:mime video/3gpp +>8 string 3gg \b, MPEG v4 system, 3GPP +!:mime video/3gpp +>8 string 3gp \b, MPEG v4 system, 3GPP +!:mime video/3gpp +>8 string 3gs \b, MPEG v4 system, 3GPP +!:mime video/3gpp +>8 string 3g2 \b, MPEG v4 system, 3GPP2 +!:mime video/3gpp2 +>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) +>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) +>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) +>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile +!:mime video/mp4 +>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC +!:mime video/3gpp +>8 string/W M4A \b, MPEG v4 system, iTunes AAC-LC +!:mime audio/mp4 +>8 string/W M4V \b, MPEG v4 system, iTunes AVC-LC +!:mime video/mp4 +>8 string/W M4P \b, MPEG v4 system, iTunes AES encrypted +>8 string/W M4B \b, MPEG v4 system, iTunes bookmarked +>8 string/W qt \b, Apple QuickTime movie +!:mime video/quicktime + +# MPEG sequences +# Scans for all common MPEG header start codes +0 belong 0x00000001 +>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video +>>5 byte 66 \b, baseline +>>5 byte 77 \b, main +>>5 byte 88 \b, extended +>>7 byte x \b @ L %u +0 belong&0xFFFFFF00 0x00000100 +>3 byte 0xBA MPEG sequence +!:mime video/mpeg +>>4 byte &0x40 \b, v2, program multiplex +>>4 byte ^0x40 \b, v1, system multiplex +>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) +>3 byte&0x1F 0x07 MPEG sequence, H.264 video +>>4 byte 66 \b, baseline +>>4 byte 77 \b, main +>>4 byte 88 \b, extended +>>6 byte x \b @ L %u +>3 byte 0xB0 MPEG sequence, v4 +!:mime video/mpeg4-generic +>>5 belong 0x000001B5 +>>>9 byte &0x80 +>>>>10 byte&0xF0 16 \b, video +>>>>10 byte&0xF0 32 \b, still texture +>>>>10 byte&0xF0 48 \b, mesh +>>>>10 byte&0xF0 64 \b, face +>>>9 byte&0xF8 8 \b, video +>>>9 byte&0xF8 16 \b, still texture +>>>9 byte&0xF8 24 \b, mesh +>>>9 byte&0xF8 32 \b, face +>>4 byte 1 \b, simple @ L1 +>>4 byte 2 \b, simple @ L2 +>>4 byte 3 \b, simple @ L3 +>>4 byte 4 \b, simple @ L0 +>>4 byte 17 \b, simple scalable @ L1 +>>4 byte 18 \b, simple scalable @ L2 +>>4 byte 33 \b, core @ L1 +>>4 byte 34 \b, core @ L2 +>>4 byte 50 \b, main @ L2 +>>4 byte 51 \b, main @ L3 +>>4 byte 53 \b, main @ L4 +>>4 byte 66 \b, n-bit @ L2 +>>4 byte 81 \b, scalable texture @ L1 +>>4 byte 97 \b, simple face animation @ L1 +>>4 byte 98 \b, simple face animation @ L2 +>>4 byte 99 \b, simple face basic animation @ L1 +>>4 byte 100 \b, simple face basic animation @ L2 +>>4 byte 113 \b, basic animation text @ L1 +>>4 byte 114 \b, basic animation text @ L2 +>>4 byte 129 \b, hybrid @ L1 +>>4 byte 130 \b, hybrid @ L2 +>>4 byte 145 \b, advanced RT simple @ L! +>>4 byte 146 \b, advanced RT simple @ L2 +>>4 byte 147 \b, advanced RT simple @ L3 +>>4 byte 148 \b, advanced RT simple @ L4 +>>4 byte 161 \b, core scalable @ L1 +>>4 byte 162 \b, core scalable @ L2 +>>4 byte 163 \b, core scalable @ L3 +>>4 byte 177 \b, advanced coding efficiency @ L1 +>>4 byte 178 \b, advanced coding efficiency @ L2 +>>4 byte 179 \b, advanced coding efficiency @ L3 +>>4 byte 180 \b, advanced coding efficiency @ L4 +>>4 byte 193 \b, advanced core @ L1 +>>4 byte 194 \b, advanced core @ L2 +>>4 byte 209 \b, advanced scalable texture @ L1 +>>4 byte 210 \b, advanced scalable texture @ L2 +>>4 byte 211 \b, advanced scalable texture @ L3 +>>4 byte 225 \b, simple studio @ L1 +>>4 byte 226 \b, simple studio @ L2 +>>4 byte 227 \b, simple studio @ L3 +>>4 byte 228 \b, simple studio @ L4 +>>4 byte 229 \b, core studio @ L1 +>>4 byte 230 \b, core studio @ L2 +>>4 byte 231 \b, core studio @ L3 +>>4 byte 232 \b, core studio @ L4 +>>4 byte 240 \b, advanced simple @ L0 +>>4 byte 241 \b, advanced simple @ L1 +>>4 byte 242 \b, advanced simple @ L2 +>>4 byte 243 \b, advanced simple @ L3 +>>4 byte 244 \b, advanced simple @ L4 +>>4 byte 245 \b, advanced simple @ L5 +>>4 byte 247 \b, advanced simple @ L3b +>>4 byte 248 \b, FGS @ L0 +>>4 byte 249 \b, FGS @ L1 +>>4 byte 250 \b, FGS @ L2 +>>4 byte 251 \b, FGS @ L3 +>>4 byte 252 \b, FGS @ L4 +>>4 byte 253 \b, FGS @ L5 +>3 byte 0xB5 MPEG sequence, v4 +!:mime video/mpeg4-generic +>>4 byte &0x80 +>>>5 byte&0xF0 16 \b, video (missing profile header) +>>>5 byte&0xF0 32 \b, still texture (missing profile header) +>>>5 byte&0xF0 48 \b, mesh (missing profile header) +>>>5 byte&0xF0 64 \b, face (missing profile header) +>>4 byte&0xF8 8 \b, video (missing profile header) +>>4 byte&0xF8 16 \b, still texture (missing profile header) +>>4 byte&0xF8 24 \b, mesh (missing profile header) +>>4 byte&0xF8 32 \b, face (missing profile header) +>3 byte 0xB3 MPEG sequence +!:mime video/mpeg +>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video +>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video +>>12 belong 0x000001B5 \b, v2, +>>>16 byte&0x0F 1 \b HP +>>>16 byte&0x0F 2 \b Spt +>>>16 byte&0x0F 3 \b SNR +>>>16 byte&0x0F 4 \b MP +>>>16 byte&0x0F 5 \b SP +>>>17 byte&0xF0 64 \b@HL +>>>17 byte&0xF0 96 \b@H-14 +>>>17 byte&0xF0 128 \b@ML +>>>17 byte&0xF0 160 \b@LL +>>>17 byte &0x08 \b progressive +>>>17 byte ^0x08 \b interlaced +>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video +>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video +>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video +>>11 byte &0x02 +>>>75 byte &0x01 +>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video +>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video +>>>>140 belong 0x000001B5 \b, v2, +>>>>>144 byte&0x0F 1 \b HP +>>>>>144 byte&0x0F 2 \b Spt +>>>>>144 byte&0x0F 3 \b SNR +>>>>>144 byte&0x0F 4 \b MP +>>>>>144 byte&0x0F 5 \b SP +>>>>>145 byte&0xF0 64 \b@HL +>>>>>145 byte&0xF0 96 \b@H-14 +>>>>>145 byte&0xF0 128 \b@ML +>>>>>145 byte&0xF0 160 \b@LL +>>>>>145 byte &0x08 \b progressive +>>>>>145 byte ^0x08 \b interlaced +>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video +>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video +>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video +>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video +>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video +>>76 belong 0x000001B5 \b, v2, +>>>80 byte&0x0F 1 \b HP +>>>80 byte&0x0F 2 \b Spt +>>>80 byte&0x0F 3 \b SNR +>>>80 byte&0x0F 4 \b MP +>>>80 byte&0x0F 5 \b SP +>>>81 byte&0xF0 64 \b@HL +>>>81 byte&0xF0 96 \b@H-14 +>>>81 byte&0xF0 128 \b@ML +>>>81 byte&0xF0 160 \b@LL +>>>81 byte &0x08 \b progressive +>>>81 byte ^0x08 \b interlaced +>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video +>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video +>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video +>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P +>>>7 byte&0xF0 0x10 \b, 16:9 +>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I +>>>7 byte&0xF0 0x10 \b, 16:9 +>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 beshort&0xFFF0 0x2C00 \b, 4CIF +>>>5 beshort&0x0FFF 0x01E0 \b NTSC +>>>5 beshort&0x0FFF 0x0240 \b PAL +>>>7 byte&0xF0 0x20 \b, 4:3 +>>>7 byte&0xF0 0x30 \b, 16:9 +>>>7 byte&0xF0 0x40 \b, 11:5 +>>>7 byte&0xF0 0x80 \b, PAL 4:3 +>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 +>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 beshort&0xFFF0 0x1600 \b, CIF +>>>5 beshort&0x0FFF 0x00F0 \b NTSC +>>>5 beshort&0x0FFF 0x0120 \b PAL +>>>7 byte&0xF0 0x20 \b, 4:3 +>>>7 byte&0xF0 0x30 \b, 16:9 +>>>7 byte&0xF0 0x40 \b, 11:5 +>>>7 byte&0xF0 0x80 \b, PAL 4:3 +>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 +>>>5 beshort&0x0FFF 0x0240 \b PAL 625 +>>>>7 byte&0xF0 0x20 \b, 4:3 +>>>>7 byte&0xF0 0x30 \b, 16:9 +>>>>7 byte&0xF0 0x40 \b, 11:5 +>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU +>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 +>>>5 beshort&0x0FFF 0x0240 \b PAL 625 +>>>7 byte&0xF0 0x20 \b, 4:3 +>>>7 byte&0xF0 0x30 \b, 16:9 +>>>7 byte&0xF0 0x40 \b, 11:5 +>>4 beshort&0xFFF0 0x1E00 \b, SVCD +>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 +>>>5 beshort&0x0FFF 0x0240 \b PAL 625 +>>>7 byte&0xF0 0x20 \b, 4:3 +>>>7 byte&0xF0 0x30 \b, 16:9 +>>>7 byte&0xF0 0x40 \b, 11:5 +>>7 byte&0x0F 1 \b, 23.976 fps +>>7 byte&0x0F 2 \b, 24 fps +>>7 byte&0x0F 3 \b, 25 fps +>>7 byte&0x0F 4 \b, 29.97 fps +>>7 byte&0x0F 5 \b, 30 fps +>>7 byte&0x0F 6 \b, 50 fps +>>7 byte&0x0F 7 \b, 59.94 fps +>>7 byte&0x0F 8 \b, 60 fps +>>11 byte &0x04 \b, Constrained + +# MPEG ADTS Audio (*.mpx/mxa/aac) +# from dreesen@math.fu-berlin.de +# modified to fully support MPEG ADTS + +# MP3, M1A +# modified by Joerg Jenderek +# GRR the original test are too common for many DOS files +# so don't accept as MP3 until we've tested the rate +0 beshort&0xFFFE 0xFFFA +# rates +>2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps +!:mime audio/mpeg +# timing +>2 byte&0x0C 0x00 \b, 44.1 kHz +>2 byte&0x0C 0x04 \b, 48 kHz +>2 byte&0x0C 0x08 \b, 32 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MP2, M1A +0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 +!:mime audio/mpeg +# rates +>2 byte&0xF0 0x10 \b, 32 kbps +>2 byte&0xF0 0x20 \b, 48 kbps +>2 byte&0xF0 0x30 \b, 56 kbps +>2 byte&0xF0 0x40 \b, 64 kbps +>2 byte&0xF0 0x50 \b, 80 kbps +>2 byte&0xF0 0x60 \b, 96 kbps +>2 byte&0xF0 0x70 \b, 112 kbps +>2 byte&0xF0 0x80 \b, 128 kbps +>2 byte&0xF0 0x90 \b, 160 kbps +>2 byte&0xF0 0xA0 \b, 192 kbps +>2 byte&0xF0 0xB0 \b, 224 kbps +>2 byte&0xF0 0xC0 \b, 256 kbps +>2 byte&0xF0 0xD0 \b, 320 kbps +>2 byte&0xF0 0xE0 \b, 384 kbps +# timing +>2 byte&0x0C 0x00 \b, 44.1 kHz +>2 byte&0x0C 0x04 \b, 48 kHz +>2 byte&0x0C 0x08 \b, 32 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MPA, M1A +# updated by Joerg Jenderek +# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 +# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) +# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries +#0 beshort&0xFFFE 0xFFFE +#>2 ubyte&0xF0 >0x0F +#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 +## rate +#>>>2 byte&0xF0 0x10 \b, 32 kbps +#>>>2 byte&0xF0 0x20 \b, 64 kbps +#>>>2 byte&0xF0 0x30 \b, 96 kbps +#>>>2 byte&0xF0 0x40 \b, 128 kbps +#>>>2 byte&0xF0 0x50 \b, 160 kbps +#>>>2 byte&0xF0 0x60 \b, 192 kbps +#>>>2 byte&0xF0 0x70 \b, 224 kbps +#>>>2 byte&0xF0 0x80 \b, 256 kbps +#>>>2 byte&0xF0 0x90 \b, 288 kbps +#>>>2 byte&0xF0 0xA0 \b, 320 kbps +#>>>2 byte&0xF0 0xB0 \b, 352 kbps +#>>>2 byte&0xF0 0xC0 \b, 384 kbps +#>>>2 byte&0xF0 0xD0 \b, 416 kbps +#>>>2 byte&0xF0 0xE0 \b, 448 kbps +## timing +#>>>2 byte&0x0C 0x00 \b, 44.1 kHz +#>>>2 byte&0x0C 0x04 \b, 48 kHz +#>>>2 byte&0x0C 0x08 \b, 32 kHz +## channels/options +#>>>3 byte&0xC0 0x00 \b, Stereo +#>>>3 byte&0xC0 0x40 \b, JntStereo +#>>>3 byte&0xC0 0x80 \b, 2x Monaural +#>>>3 byte&0xC0 0xC0 \b, Monaural +##>1 byte ^0x01 \b, Data Verify +##>2 byte &0x02 \b, Packet Pad +##>2 byte &0x01 \b, Custom Flag +##>3 byte &0x08 \b, Copyrighted +##>3 byte &0x04 \b, Original Source +##>3 byte&0x03 1 \b, NR: 50/15 ms +##>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MP3, M2A +0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 +!:mime audio/mpeg +# rate +>2 byte&0xF0 0x10 \b, 8 kbps +>2 byte&0xF0 0x20 \b, 16 kbps +>2 byte&0xF0 0x30 \b, 24 kbps +>2 byte&0xF0 0x40 \b, 32 kbps +>2 byte&0xF0 0x50 \b, 40 kbps +>2 byte&0xF0 0x60 \b, 48 kbps +>2 byte&0xF0 0x70 \b, 56 kbps +>2 byte&0xF0 0x80 \b, 64 kbps +>2 byte&0xF0 0x90 \b, 80 kbps +>2 byte&0xF0 0xA0 \b, 96 kbps +>2 byte&0xF0 0xB0 \b, 112 kbps +>2 byte&0xF0 0xC0 \b, 128 kbps +>2 byte&0xF0 0xD0 \b, 144 kbps +>2 byte&0xF0 0xE0 \b, 160 kbps +# timing +>2 byte&0x0C 0x00 \b, 22.05 kHz +>2 byte&0x0C 0x04 \b, 24 kHz +>2 byte&0x0C 0x08 \b, 16 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MP2, M2A +0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 +# rate +>2 byte&0xF0 0x10 \b, 8 kbps +>2 byte&0xF0 0x20 \b, 16 kbps +>2 byte&0xF0 0x30 \b, 24 kbps +>2 byte&0xF0 0x40 \b, 32 kbps +>2 byte&0xF0 0x50 \b, 40 kbps +>2 byte&0xF0 0x60 \b, 48 kbps +>2 byte&0xF0 0x70 \b, 56 kbps +>2 byte&0xF0 0x80 \b, 64 kbps +>2 byte&0xF0 0x90 \b, 80 kbps +>2 byte&0xF0 0xA0 \b, 96 kbps +>2 byte&0xF0 0xB0 \b, 112 kbps +>2 byte&0xF0 0xC0 \b, 128 kbps +>2 byte&0xF0 0xD0 \b, 144 kbps +>2 byte&0xF0 0xE0 \b, 160 kbps +# timing +>2 byte&0x0C 0x00 \b, 22.05 kHz +>2 byte&0x0C 0x04 \b, 24 kHz +>2 byte&0x0C 0x08 \b, 16 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MPA, M2A +0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 +!:mime audio/mpeg +# rate +>2 byte&0xF0 0x10 \b, 32 kbps +>2 byte&0xF0 0x20 \b, 48 kbps +>2 byte&0xF0 0x30 \b, 56 kbps +>2 byte&0xF0 0x40 \b, 64 kbps +>2 byte&0xF0 0x50 \b, 80 kbps +>2 byte&0xF0 0x60 \b, 96 kbps +>2 byte&0xF0 0x70 \b, 112 kbps +>2 byte&0xF0 0x80 \b, 128 kbps +>2 byte&0xF0 0x90 \b, 144 kbps +>2 byte&0xF0 0xA0 \b, 160 kbps +>2 byte&0xF0 0xB0 \b, 176 kbps +>2 byte&0xF0 0xC0 \b, 192 kbps +>2 byte&0xF0 0xD0 \b, 224 kbps +>2 byte&0xF0 0xE0 \b, 256 kbps +# timing +>2 byte&0x0C 0x00 \b, 22.05 kHz +>2 byte&0x0C 0x04 \b, 24 kHz +>2 byte&0x0C 0x08 \b, 16 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MP3, M25A +0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 +!:mime audio/mpeg +# rate +>2 byte&0xF0 0x10 \b, 8 kbps +>2 byte&0xF0 0x20 \b, 16 kbps +>2 byte&0xF0 0x30 \b, 24 kbps +>2 byte&0xF0 0x40 \b, 32 kbps +>2 byte&0xF0 0x50 \b, 40 kbps +>2 byte&0xF0 0x60 \b, 48 kbps +>2 byte&0xF0 0x70 \b, 56 kbps +>2 byte&0xF0 0x80 \b, 64 kbps +>2 byte&0xF0 0x90 \b, 80 kbps +>2 byte&0xF0 0xA0 \b, 96 kbps +>2 byte&0xF0 0xB0 \b, 112 kbps +>2 byte&0xF0 0xC0 \b, 128 kbps +>2 byte&0xF0 0xD0 \b, 144 kbps +>2 byte&0xF0 0xE0 \b, 160 kbps +# timing +>2 byte&0x0C 0x00 \b, 11.025 kHz +>2 byte&0x0C 0x04 \b, 12 kHz +>2 byte&0x0C 0x08 \b, 8 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio + +# Stored AAC streams (instead of the MP4 format) +0 string ADIF MPEG ADIF, AAC +!:mime audio/x-hx-aac-adif +>4 byte &0x80 +>>13 byte &0x10 \b, VBR +>>13 byte ^0x10 \b, CBR +>>16 byte&0x1E 0x02 \b, single stream +>>16 byte&0x1E 0x04 \b, 2 streams +>>16 byte&0x1E 0x06 \b, 3 streams +>>16 byte &0x08 \b, 4 or more streams +>>16 byte &0x10 \b, 8 or more streams +>>4 byte &0x80 \b, Copyrighted +>>13 byte &0x40 \b, Original Source +>>13 byte &0x20 \b, Home Flag +>4 byte ^0x80 +>>4 byte &0x10 \b, VBR +>>4 byte ^0x10 \b, CBR +>>7 byte&0x1E 0x02 \b, single stream +>>7 byte&0x1E 0x04 \b, 2 streams +>>7 byte&0x1E 0x06 \b, 3 streams +>>7 byte &0x08 \b, 4 or more streams +>>7 byte &0x10 \b, 8 or more streams +>>4 byte &0x40 \b, Original Stream(s) +>>4 byte &0x20 \b, Home Source + +# Live or stored single AAC stream (used with MPEG-2 systems) +0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC +!:mime audio/x-hx-aac-adts +>1 byte &0x08 \b, v2 +>1 byte ^0x08 \b, v4 +# profile +>>2 byte &0xC0 \b LTP +>2 byte&0xc0 0x00 \b Main +>2 byte&0xc0 0x40 \b LC +>2 byte&0xc0 0x80 \b SSR +# timing +>2 byte&0x3c 0x00 \b, 96 kHz +>2 byte&0x3c 0x04 \b, 88.2 kHz +>2 byte&0x3c 0x08 \b, 64 kHz +>2 byte&0x3c 0x0c \b, 48 kHz +>2 byte&0x3c 0x10 \b, 44.1 kHz +>2 byte&0x3c 0x14 \b, 32 kHz +>2 byte&0x3c 0x18 \b, 24 kHz +>2 byte&0x3c 0x1c \b, 22.05 kHz +>2 byte&0x3c 0x20 \b, 16 kHz +>2 byte&0x3c 0x24 \b, 12 kHz +>2 byte&0x3c 0x28 \b, 11.025 kHz +>2 byte&0x3c 0x2c \b, 8 kHz +# channels +>2 beshort&0x01c0 0x0040 \b, monaural +>2 beshort&0x01c0 0x0080 \b, stereo +>2 beshort&0x01c0 0x00c0 \b, stereo + center +>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE +>2 beshort&0x01c0 0x0140 \b, surround +>2 beshort&0x01c0 0x0180 \b, surround + LFE +>2 beshort &0x01C0 \b, surround + side +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Custom Flag +#>3 byte &0x20 \b, Original Stream +#>3 byte &0x10 \b, Home Source +#>3 byte &0x08 \b, Copyrighted + +# Live MPEG-4 audio streams (instead of RTP FlexMux) +0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS +!:mime audio/x-mp4a-latm +#>1 beshort&0x1FFF x \b, %u byte packet +>3 byte&0xE0 0x40 +>>4 byte&0x3C 0x04 \b, single stream +>>4 byte&0x3C 0x08 \b, 2 streams +>>4 byte&0x3C 0x0C \b, 3 streams +>>4 byte &0x08 \b, 4 or more streams +>>4 byte &0x20 \b, 8 or more streams +>3 byte&0xC0 0 +>>4 byte&0x78 0x08 \b, single stream +>>4 byte&0x78 0x10 \b, 2 streams +>>4 byte&0x78 0x18 \b, 3 streams +>>4 byte &0x20 \b, 4 or more streams +>>4 byte &0x40 \b, 8 or more streams +# This magic isn't strong enough (matches plausible ISO-8859-1 text) +#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream +#!:mime audio/x-mp4a-latm + +# Summary: FLI animation format +# Created by: Daniel Quinlan <quinlan@yggdrasil.com> +# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) +4 leshort 0xAF11 +# standard FLI always has 320x200 resolution and 8 bit color +>8 leshort 320 +>>10 leshort 200 +>>>12 leshort 8 FLI animation, 320x200x8 +!:mime video/x-fli +>>>>6 leshort x \b, %d frames +# frame speed is multiple of 1/70s +>>>>16 leshort x \b, %d/70s per frame + +# Summary: FLC animation format +# Created by: Daniel Quinlan <quinlan@yggdrasil.com> +# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) +4 leshort 0xAF12 +# standard FLC always use 8 bit color +>12 leshort 8 FLC animation +!:mime video/x-flc +>>8 leshort x \b, %d +>>10 leshort x \bx%dx8 +>>6 uleshort x \b, %d frames +>>16 uleshort x \b, %dms per frame + +# DL animation format +# XXX - collision with most `mips' magic +# +# I couldn't find a real magic number for these, however, this +# -appears- to work. Note that it might catch other files, too, so be +# careful! +# +# Note that title and author appear in the two 20-byte chunks +# at decimal offsets 2 and 22, respectively, but they are XOR'ed with +# 255 (hex FF)! The DL format is really bad. +# +#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) +#!:mime video/x-unknown +#>42 byte x - %d screens, +#>43 byte x %d commands +#0 byte 2 DL version 2 +#!:mime video/x-unknown +#>1 byte 1 - large format (320x200,1 image/screen), +#>1 byte 2 - medium format (160x100,4 images/screen), +#>1 byte >2 - unknown format, +#>42 byte x %d screens, +#>43 byte x %d commands +# Based on empirical evidence, DL version 3 have several nulls following the +# \003. Most of them start with non-null values at hex offset 0x34 or so. +#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 + +# iso 13818 transport stream +# +# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) +# syncbyte 8 bit 0x47 +# error_ind 1 bit - +# payload_start 1 bit 1 +# priority 1 bit - +# PID 13 bit 0x0000 +# scrambling 2 bit - +# adaptfld_ctrl 2 bit 1 or 3 +# conti_count 4 bit - +0 belong&0xFF5FFF10 0x47400010 +>188 byte 0x47 MPEG transport stream data + +# DIF digital video file format <mpruett@sgi.com> +0 belong&0xffffff00 0x1f070000 DIF +>4 byte &0x01 (DVCPRO) movie file +>4 byte ^0x01 (DV) movie file +>3 byte &0x80 (PAL) +>3 byte ^0x80 (NTSC) + +# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> +0 belong 0x3026b275 Microsoft ASF +!:mime video/x-ms-asf + +# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> +0 string \x8aMNG MNG video data, +!:mime video/x-mng +>4 belong !0x0d0a1a0a CORRUPTED, +>4 belong 0x0d0a1a0a +>>16 belong x %ld x +>>20 belong x %ld + +# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> +0 string \x8bJNG JNG video data, +!:mime video/x-jng +>4 belong !0x0d0a1a0a CORRUPTED, +>4 belong 0x0d0a1a0a +>>16 belong x %ld x +>>20 belong x %ld + +# Vivo video (Wolfram Kleff) +3 string \x0D\x0AVersion:Vivo Vivo video data + +# VRML (Virtual Reality Modelling Language) +0 string/w #VRML\ V1.0\ ascii VRML 1 file +!:mime model/vrml +0 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file +!:mime model/vrml + +# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd] +# From Michel Briand <michelbriand@free.fr> +0 string/t \<?xml\ version=" +!:strength +1 +>20 search/1000/cw \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text +!:mime model/x3d + +#--------------------------------------------------------------------------- +# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube +# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 +# +0 string HVQM4 %s +>6 string >\0 v%s +>0 byte x GameCube movie, +>0x34 ubeshort x %d x +>0x36 ubeshort x %d, +>0x26 ubeshort x %dus, +>0x42 ubeshort 0 no audio +>0x42 ubeshort >0 %dHz audio + +# From: "Stefan A. Haubenthal" <polluks@web.de> +0 string DVDVIDEO-VTS Video title set, +>0x21 byte x v%x +0 string DVDVIDEO-VMG Video manager, +>0x21 byte x v%x + +# From: Behan Webster <behanw@websterwood.com> +# NuppelVideo used by Mythtv (*.nuv) +# Note: there are two identical stanzas here differing only in the +# initial string matched. It used to be done with a regex, but we're +# trying to get rid of those. +0 string NuppelVideo MythTV NuppelVideo +>12 string x v%s +>20 lelong x (%d +>24 lelong x \bx%d), +>36 string P \bprogressive, +>36 string I \binterlaced, +>40 ledouble x \baspect:%.2f, +>48 ledouble x \bfps:%.2f +0 string MythTV MythTV NuppelVideo +>12 string x v%s +>20 lelong x (%d +>24 lelong x \bx%d), +>36 string P \bprogressive, +>36 string I \binterlaced, +>40 ledouble x \baspect:%.2f, +>48 ledouble x \bfps:%.2f + +# MPEG file +# MPEG sequences +# FIXME: This section is from the old magic.mime file and needs integrating with the rest +0 belong 0x000001BA +>4 byte &0x40 +!:mime video/mp2p +>4 byte ^0x40 +!:mime video/mpeg +0 belong 0x000001BB +!:mime video/mpeg +0 belong 0x000001B0 +!:mime video/mp4v-es +0 belong 0x000001B5 +!:mime video/mp4v-es +0 belong 0x000001B3 +!:mime video/mpv +0 belong&0xFF5FFF1F 0x47400010 +!:mime video/mp2t +0 belong 0x00000001 +>4 byte&0x1F 0x07 +!:mime video/h264 + +# Type: Bink Video +# Extension: .bik +# URL: http://wiki.multimedia.cx/index.php?title=Bink_Container +# From: <hoehle@users.sourceforge.net> 2008-07-18 +0 string BIK Bink Video +>3 regex =[a-z] rev.%s +#>4 ulelong x size %d +>20 ulelong x \b, %d +>24 ulelong x \bx%d +>8 ulelong x \b, %d frames +>32 ulelong x at rate %d/ +>28 ulelong >1 \b%d +>40 ulelong =0 \b, no audio +>40 ulelong !0 \b, %d audio track +>>40 ulelong !1 \bs +# follow properties of the first audio track only +>>48 uleshort x %dHz +>>51 byte&0x20 0 mono +>>51 byte&0x20 !0 stereo +#>>51 byte&0x10 0 FFT +#>>51 byte&0x10 !0 DCT + +# Type: NUT Container +# URL: http://wiki.multimedia.cx/index.php?title=NUT +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +0 string nut/multimedia\ container\0 NUT multimedia container + +# Type: Nullsoft Video (NSV) +# URL: http://wiki.multimedia.cx/index.php?title=Nullsoft_Video +# From: Mike Melanson <mike@multimedia.cx> +0 string NSVf Nullsoft Video + +# Type: REDCode Video +# URL: http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode +# From: Mike Melanson <mike@multimedia.cx> +4 string RED1 REDCode Video + +# Type: MTV Multimedia File +# URL: http://wiki.multimedia.cx/index.php?title=MTV +# From: Mike Melanson <mike@multimedia.cx> +0 string AMVS MTV Multimedia File + +# Type: ARMovie +# URL: http://wiki.multimedia.cx/index.php?title=ARMovie +# From: Mike Melanson <mike@multimedia.cx> +0 string ARMovie\012 ARMovie + +# Type: Interplay MVE Movie +# URL: http://wiki.multimedia.cx/index.php?title=Interplay_MVE +# From: Mike Melanson <mike@multimedia.cx> +0 string Interplay\040MVE\040File\032 Interplay MVE Movie + +# Type: Windows Television DVR File +# URL: http://wiki.multimedia.cx/index.php?title=WTV +# From: Mike Melanson <mike@mutlimedia.cx> +# This takes the form of a Windows-style GUID +0 bequad 0xB7D800203749DA11 +>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media + +# Type: Sega FILM/CPK Multimedia +# URL: http://wiki.multimedia.cx/index.php?title=Sega_FILM +# From: Mike Melanson <mike@multimedia.cx> +0 string FILM Sega FILM/CPK Multimedia, +>32 belong x %d x +>28 belong x %d + +# Type: Nintendo THP Multimedia +# URL: http://wiki.multimedia.cx/index.php?title=THP +# From: Mike Melanson <mike@multimedia.cx> +0 string THP\0 Nintendo THP Multimedia + +# Type: BBC Dirac Video +# URL: http://wiki.multimedia.cx/index.php?title=Dirac +# From: Mike Melanson <mike@multimedia.cx> +0 string BBCD BBC Dirac Video + +# Type: RAD Game Tools Smacker Multimedia +# URL: http://wiki.multimedia.cx/index.php?title=Smacker +# From: Mike Melanson <mike@multimedia.cx> +0 string SMK RAD Game Tools Smacker Multimedia +>3 byte x version %c, +>4 lelong x %d x +>8 lelong x %d, +>12 lelong x %d frames diff --git a/magic/Magdir/aout b/magic/Magdir/aout new file mode 100644 index 0000000..69b6ec6 --- /dev/null +++ b/magic/Magdir/aout @@ -0,0 +1,46 @@ + +#------------------------------------------------------------------------------ +# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $ +# aout: file(1) magic for a.out executable/object/etc entries that +# handle executables on multiple platforms. +# + +# +# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from +# BSDI), netbsd, and vax (for UNIX/32V and BSD) +# +# XXX - is there anything we can look at to distinguish BSD/OS 386 from +# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag +# works only for binaries using shared libraries. Grabbing the entry +# point from the a.out header, using it to find the first code executed +# in the program, and looking at that might help. +# +0 lelong 0407 a.out little-endian 32-bit executable +>16 lelong >0 not stripped +>32 byte 0x6a (uses BSD/OS shared libs) + +0 lelong 0410 a.out little-endian 32-bit pure executable +>16 lelong >0 not stripped +>32 byte 0x6a (uses BSD/OS shared libs) + +0 lelong 0413 a.out little-endian 32-bit demand paged pure executable +>16 lelong >0 not stripped +>32 byte 0x6a (uses BSD/OS shared libs) + +# +# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out), +# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out). +# +# XXX - is there anything we can look at to distinguish old SunOS 68010 +# from old 68020 IRIX from old NetBSD? Again, I guess we could look at +# the first instruction or instructions in the program. +# +0 belong 0407 a.out big-endian 32-bit executable +>16 belong >0 not stripped + +0 belong 0410 a.out big-endian 32-bit pure executable +>16 belong >0 not stripped + +0 belong 0413 a.out big-endian 32-bit demand paged executable +>16 belong >0 not stripped + diff --git a/magic/Magdir/apl b/magic/Magdir/apl new file mode 100644 index 0000000..d717e37 --- /dev/null +++ b/magic/Magdir/apl @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $ +# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL +# workspaces) +# +0 long 0100554 APL workspace (Ken's original?) diff --git a/magic/Magdir/apple b/magic/Magdir/apple new file mode 100644 index 0000000..419b090 --- /dev/null +++ b/magic/Magdir/apple @@ -0,0 +1,297 @@ + +#------------------------------------------------------------------------------ +# $File: apple,v 1.26 2012/12/27 15:43:23 christos Exp $ +# apple: file(1) magic for Apple file formats +# +0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text +0 string \x0aGL Binary II (apple ][) data +0 string \x76\xff Squeezed (apple ][) data +0 string NuFile NuFile archive (apple ][) data +0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data +0 belong 0x00051600 AppleSingle encoded Macintosh file +0 belong 0x00051607 AppleDouble encoded Macintosh file + +# Type: Apple Emulator 2IMG format +# From: Radek Vokal <rvokal@redhat.com> +0 string 2IMG Apple ][ 2IMG Disk Image +>4 string XGS! \b, XGS +>4 string CTKG \b, Catakig +>4 string ShIm \b, Sheppy's ImageMaker +>4 string WOOF \b, Sweet 16 +>4 string B2TR \b, Bernie ][ the Rescue +>4 string !nfc \b, ASIMOV2 +>4 string x \b, Unknown Format +>0xc byte 00 \b, DOS 3.3 sector order +>>0x10 byte 00 \b, Volume 254 +>>0x10 byte&0x7f x \b, Volume %u +>0xc byte 01 \b, ProDOS sector order +>>0x14 short x \b, %u Blocks +>0xc byte 02 \b, NIB data + +# magic for Newton PDA package formats +# from Ruda Moura <ruda@helllabs.org> +0 string package0 Newton package, NOS 1.x, +>12 belong &0x80000000 AutoRemove, +>12 belong &0x40000000 CopyProtect, +>12 belong &0x10000000 NoCompression, +>12 belong &0x04000000 Relocation, +>12 belong &0x02000000 UseFasterCompression, +>16 belong x version %d + +0 string package1 Newton package, NOS 2.x, +>12 belong &0x80000000 AutoRemove, +>12 belong &0x40000000 CopyProtect, +>12 belong &0x10000000 NoCompression, +>12 belong &0x04000000 Relocation, +>12 belong &0x02000000 UseFasterCompression, +>16 belong x version %d + +0 string package4 Newton package, +>8 byte 8 NOS 1.x, +>8 byte 9 NOS 2.x, +>12 belong &0x80000000 AutoRemove, +>12 belong &0x40000000 CopyProtect, +>12 belong &0x10000000 NoCompression, + +# The following entries for the Apple II are for files that have +# been transferred as raw binary data from an Apple, without having +# been encapsulated by any of the above archivers. +# +# In general, Apple II formats are hard to identify because Apple DOS +# and especially Apple ProDOS have strong typing in the file system and +# therefore programmers never felt much need to include type information +# in the files themselves. +# +# Eric Fischer <enf@pobox.com> + +# AppleWorks word processor: +# +# This matches the standard tab stops for an AppleWorks file, but if +# a file has a tab stop set in the first four columns this will fail. +# +# The "O" is really the magic number, but that's so common that it's +# necessary to check the tab stops that follow it to avoid false positives. + +4 string O==== AppleWorks word processor data +>85 byte&0x01 >0 \b, zoomed +>90 byte&0x01 >0 \b, paginated +>92 byte&0x01 >0 \b, with mail merge +#>91 byte x \b, left margin %d + +# AppleWorks database: +# +# This isn't really a magic number, but it's the closest thing to one +# that I could find. The 1 and 2 really mean "order in which you defined +# categories" and "left to right, top to bottom," respectively; the D and R +# mean that the cursor should move either down or right when you press Return. + +#30 string \x01D AppleWorks database data +#30 string \x02D AppleWorks database data +#30 string \x01R AppleWorks database data +#30 string \x02R AppleWorks database data + +# AppleWorks spreadsheet: +# +# Likewise, this isn't really meant as a magic number. The R or C means +# row- or column-order recalculation; the A or M means automatic or manual +# recalculation. + +#131 string RA AppleWorks spreadsheet data +#131 string RM AppleWorks spreadsheet data +#131 string CA AppleWorks spreadsheet data +#131 string CM AppleWorks spreadsheet data + +# Applesoft BASIC: +# +# This is incredibly sloppy, but will be true if the program was +# written at its usual memory location of 2048 and its first line +# number is less than 256. Yuck. + +0 belong&0xff00ff 0x80000 Applesoft BASIC program data +#>2 leshort x \b, first line number %d + +# ORCA/EZ assembler: +# +# This will not identify ORCA/M source files, since those have +# some sort of date code instead of the two zero bytes at 6 and 7 +# XXX Conflicts with ELF +#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data +#>5 byte x \b, build number %d + +# Broderbund Fantavision +# +# I don't know what these values really mean, but they seem to recur. +# Will they cause too many conflicts? + +# Probably :-) +#2 belong&0xFF00FF 0x040008 Fantavision movie data + +# Some attempts at images. +# +# These are actually just bit-for-bit dumps of the frame buffer, so +# there's really no reasonably way to distinguish them except for their +# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 +# or, occasionally, 8184. +# +# Nevertheless this will manage to catch a lot of images that happen +# to have a solid-colored line at the bottom of the screen. + +# GRR: Magic too weak +#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background +#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background +#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background +#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background +#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background + +# Beagle Bros. Apple Mechanic fonts + +0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font + +# Apple Universal Disk Image Format (UDIF) - dmg files. +# From Johan Gade. +# These entries are disabled for now until we fix the following issues. +# +# Note there might be some problems with the "VAX COFF executable" +# entry. Note this entry should be placed before the mac filesystem section, +# particularly the "Apple Partition data" entry. +# +# The intended meaning of these tests is, that the file is only of the +# specified type if both of the lines are correct - i.e. if the first +# line matches and the second doesn't then it is not of that type. +# +#0 long 0x7801730d +#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) +# +# Note that this entry is recognized correctly by the "Apple Partition +# data" entry - however since this entry is more specific - this +# information seems to be more useful. +#0 long 0x45520200 +#>0x410 string disk\ image UDIF read/write image (UDRW) + +# From: Toby Peterson <toby@apple.com> +0 string bplist00 Apple binary property list + +# Apple binary property list (bplist) +# Assumes version bytes are hex. +# Provides content hints for version 0 files. Assumes that the root +# object is the first object (true for CoreFoundation implementation). +# From: David Remahl <dremahl@apple.com> +0 string bplist +>6 byte x \bCoreFoundation binary property list data, version 0x%c +>>7 byte x \b%c +>6 string 00 \b +>>8 byte&0xF0 0x00 \b +>>>8 byte&0x0F 0x00 \b, root type: null +>>>8 byte&0x0F 0x08 \b, root type: false boolean +>>>8 byte&0x0F 0x09 \b, root type: true boolean +>>8 byte&0xF0 0x10 \b, root type: integer +>>8 byte&0xF0 0x20 \b, root type: real +>>8 byte&0xF0 0x30 \b, root type: date +>>8 byte&0xF0 0x40 \b, root type: data +>>8 byte&0xF0 0x50 \b, root type: ascii string +>>8 byte&0xF0 0x60 \b, root type: unicode string +>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) +>>8 byte&0xF0 0xa0 \b, root type: array +>>8 byte&0xF0 0xd0 \b, root type: dictionary + +# Apple/NeXT typedstream data +# Serialization format used by NeXT and Apple for various +# purposes in YellowStep/Cocoa, including some nib files. +# From: David Remahl <dremahl@apple.com> +2 string typedstream NeXT/Apple typedstream data, big endian +>0 byte x \b, version %hhd +>0 byte <5 \b +>>13 byte 0x81 \b +>>>14 ubeshort x \b, system %hd +2 string streamtyped NeXT/Apple typedstream data, little endian +>0 byte x \b, version %hhd +>0 byte <5 \b +>>13 byte 0x81 \b +>>>14 uleshort x \b, system %hd + +#------------------------------------------------------------------------------ +# CAF: Apple CoreAudio File Format +# +# Container format for high-end audio purposes. +# From: David Remahl <dremahl@apple.com> +# +0 string caff CoreAudio Format audio file +>4 beshort <10 version %d +>6 beshort x + + +#------------------------------------------------------------------------------ +# Keychain database files +0 string kych Mac OS X Keychain File + +#------------------------------------------------------------------------------ +# Code Signing related file types +0 belong 0xfade0c00 Mac OS X Code Requirement +>8 belong 1 (opExpr) +>4 belong x - %d bytes + +0 belong 0xfade0c01 Mac OS X Code Requirement Set +>8 belong >1 containing %d items +>4 belong x - %d bytes + +0 belong 0xfade0c02 Mac OS X Code Directory +>8 belong x version %x +>12 belong >0 flags 0x%x +>4 belong x - %d bytes + +0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) +>4 belong x - %d bytes + +0 belong 0xfade0cc1 Mac OS X Detached Code Signature +>8 belong >1 (%d elements) +>4 belong x - %d bytes + +# From: "Nelson A. de Oliveira" <naoliv@gmail.com> +# .vdi +4 string innotek\ VirtualBox\ Disk\ Image %s + +# Apple disk partition stuff, strengthen the magic using byte 4 +0 beshort 0x4552 +>4 byte 0 Apple Driver Map +>>2 beshort x \b, blocksize %d +>>4 belong x \b, blockcount %d +>>10 beshort x \b, devtype %d +>>12 beshort x \b, devid %d +>>20 beshort x \b, descriptors %d +# Assume 8 partitions each at a multiple of the sector size. +# We could glean this from the partition descriptors, but they are empty!?!? +>>(2.S*1) indirect \b, contains[@0x%x]: +>>(2.S*2) indirect \b, contains[@0x%x]: +>>(2.S*3) indirect \b, contains[@0x%x]: +>>(2.S*4) indirect \b, contains[@0x%x]: +>>(2.S*5) indirect \b, contains[@0x%x]: +>>(2.S*6) indirect \b, contains[@0x%x]: +>>(2.S*7) indirect \b, contains[@0x%x]: +>>(2.S*8) indirect \b, contains[@0x%x]: + +# Yes, the 3rd and 4th bytes are reserved, but we use them to make the +# magic stronger. +0 belong 0x504d0000 Apple Partition Map +>4 belong x \b, map block count %d +>8 belong x \b, start block %d +>12 belong x \b, block count %d +>16 string >0 \b, name %s +>48 string >0 \b, type %s +>124 string >0 \b, processor %s +>140 string >0 \b, boot arguments %s +>92 belong & 1 \b, valid +>92 belong & 2 \b, allocated +>92 belong & 4 \b, in use +>92 belong & 8 \b, has boot info +>92 belong & 16 \b, readable +>92 belong & 32 \b, writable +>92 belong & 64 \b, pic boot code +>92 belong & 128 \b, chain compatible driver +>92 belong & 256 \b, real driver +>92 belong & 512 \b, chain driver +>92 belong & 1024 \b, mount at startup +>92 belong & 2048 \b, is the startup partition + +#http://wiki.mozilla.org/DS_Store_File_Format` +#http://en.wikipedia.org/wiki/.DS_Store +0 string \0\0\0\1Bud1\0 Apple Desktop Services Store diff --git a/magic/Magdir/applix b/magic/Magdir/applix new file mode 100644 index 0000000..f3f362e --- /dev/null +++ b/magic/Magdir/applix @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $ +# applix: file(1) magic for Applixware +# From: Peter Soos <sp@osb.hu> +# +0 string *BEGIN Applixware +>7 string WORDS Words Document +>7 string GRAPHICS Graphic +>7 string RASTER Bitmap +>7 string SPREADSHEETS Spreadsheet +>7 string MACRO Macro +>7 string BUILDER Builder Object diff --git a/magic/Magdir/archive b/magic/Magdir/archive new file mode 100644 index 0000000..b8fbd28 --- /dev/null +++ b/magic/Magdir/archive @@ -0,0 +1,922 @@ +#------------------------------------------------------------------------------ +# $File: archive,v 1.79 2013/02/08 17:24:06 christos Exp $ +# archive: file(1) magic for archive formats (see also "msdos" for self- +# extracting compressed archives) +# +# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. +# pre-POSIX "tar" archives are handled in the C code. + +# POSIX tar archives +257 string ustar\0 POSIX tar archive +!:mime application/x-tar # encoding: posix +257 string ustar\040\040\0 GNU tar archive +!:mime application/x-tar # encoding: gnu + +# Incremental snapshot gnu-tar format from: +# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html +0 string GNU\ tar- GNU tar incremental snapshot data +>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s + +# cpio archives +# +# Yes, the top two "cpio archive" formats *are* supposed to just be "short". +# The idea is to indicate archives produced on machines with the same +# byte order as the machine running "file" with "cpio archive", and +# to indicate archives produced on machines with the opposite byte order +# from the machine running "file" with "byte-swapped cpio archive". +# +# The SVR4 "cpio(4)" hints that there are additional formats, but they +# are defined as "short"s; I think all the new formats are +# character-header formats and thus are strings, not numbers. +0 short 070707 cpio archive +!:mime application/x-cpio +0 short 0143561 byte-swapped cpio archive +!:mime application/x-cpio # encoding: swapped +0 string 070707 ASCII cpio archive (pre-SVR4 or odc) +0 string 070701 ASCII cpio archive (SVR4 with no CRC) +0 string 070702 ASCII cpio archive (SVR4 with CRC) + +# +# Various archive formats used by various versions of the "ar" +# command. +# + +# +# Original UNIX archive formats. +# They were written with binary values in host byte order, and +# the magic number was a host "int", which might have been 16 bits +# or 32 bits. We don't say "PDP-11" or "VAX", as there might have +# been ports to little-endian 16-bit-int or 32-bit-int platforms +# (x86?) using some of those formats; if none existed, feel free +# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian +# 32-bit. There might have been big-endian ports of that sort as +# well. +# +0 leshort 0177555 very old 16-bit-int little-endian archive +0 beshort 0177555 very old 16-bit-int big-endian archive +0 lelong 0177555 very old 32-bit-int little-endian archive +0 belong 0177555 very old 32-bit-int big-endian archive + +0 leshort 0177545 old 16-bit-int little-endian archive +>2 string __.SYMDEF random library +0 beshort 0177545 old 16-bit-int big-endian archive +>2 string __.SYMDEF random library +0 lelong 0177545 old 32-bit-int little-endian archive +>4 string __.SYMDEF random library +0 belong 0177545 old 32-bit-int big-endian archive +>4 string __.SYMDEF random library + +# +# From "pdp" (but why a 4-byte quantity?) +# +0 lelong 0x39bed PDP-11 old archive +0 lelong 0x39bee PDP-11 4.0 archive + +# +# XXX - what flavor of APL used this, and was it a variant of +# some ar archive format? It's similar to, but not the same +# as, the APL workspace magic numbers in pdp. +# +0 long 0100554 apl workspace + +# +# System V Release 1 portable(?) archive format. +# +0 string =<ar> System V Release 1 ar archive +!:mime application/x-archive + +# +# Debian package; it's in the portable archive format, and needs to go +# before the entry for regular portable archives, as it's recognized as +# a portable archive whose first member has a name beginning with +# "debian". +# +0 string =!<arch>\ndebian +!:mime application/x-debian-package +>8 string debian-split part of multipart Debian package +>8 string debian-binary Debian binary package +>8 string !debian +>68 string >\0 (format %s) +# These next two lines do not work, because a bzip2 Debian archive +# still uses gzip for the control.tar (first in the archive). Only +# data.tar varies, and the location of its filename varies too. +# file/libmagic does not current have support for ascii-string based +# (offsets) as of 2005-09-15. +#>81 string bz2 \b, uses bzip2 compression +#>84 string gz \b, uses gzip compression +#>136 ledate x created: %s + +# +# MIPS archive; they're in the portable archive format, and need to go +# before the entry for regular portable archives, as it's recognized as +# a portable archive whose first member has a name beginning with +# "__________E". +# +0 string =!<arch>\n__________E MIPS archive +!:mime application/x-archive +>20 string U with MIPS Ucode members +>21 string L with MIPSEL members +>21 string B with MIPSEB members +>19 string L and an EL hash table +>19 string B and an EB hash table +>22 string X -- out of date + +0 search/1 -h- Software Tools format archive text + +# +# BSD/SVR2-and-later portable archive formats. +# +0 string =!<arch> current ar archive +!:mime application/x-archive +>8 string __.SYMDEF random library +>68 string __.SYMDEF\ SORTED random library + +# +# "Thin" archive, as can be produced by GNU ar. +# +0 string =!<thin>\n thin archive with +>68 belong 0 no symbol entries +>68 belong 1 %d symbol entry +>68 belong >1 %d symbol entries + +# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) +# +# The first byte is the magic (0x1a), byte 2 is the compression type for +# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS +# filename of the first file (null terminated). Since some types collide +# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), +# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. +0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW +!:mime application/x-arc +0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed +!:mime application/x-arc +0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed +!:mime application/x-arc +0 lelong&0x8080ffff 0x0000031a ARC archive data, packed +!:mime application/x-arc +0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed +!:mime application/x-arc +0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched +!:mime application/x-arc +# [JW] stuff taken from idarc, obviously ARC successors: +0 lelong&0x8080ffff 0x00000a1a PAK archive data +!:mime application/x-arc +0 lelong&0x8080ffff 0x0000141a ARC+ archive data +!:mime application/x-arc +0 lelong&0x8080ffff 0x0000481a HYP archive data +!:mime application/x-arc + +# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) +# I can't create either SPARK or ArcFS archives so I have not tested this stuff +# [GRR: the original entries collide with ARC, above; replaced with combined +# version (not tested)] +#0 byte 0x1a RISC OS archive (spark format) +0 string \032archive RISC OS archive (ArcFS format) +0 string Archive\000 RISC OS archive (ArcFS format) + +# All these were taken from idarc, many could not be verified. Unfortunately, +# there were many low-quality sigs, i.e. easy to trigger false positives. +# Please notify me of any real-world fishy/ambiguous signatures and I'll try +# to get my hands on the actual archiver and see if I find something better. [JW] +# probably many can be enhanced by finding some 0-byte or control char near the start + +# idarc calls this Crush/Uncompressed... *shrug* +0 string CRUSH Crush archive data +# Squeeze It (.sqz) +0 string HLSQZ Squeeze It archive data +# SQWEZ +0 string SQWEZ SQWEZ archive data +# HPack (.hpk) +0 string HPAK HPack archive data +# HAP +0 string \x91\x33HF HAP archive data +# MD/MDCD +0 string MDmd MDCD archive data +# LIM +0 string LIM\x1a LIM archive data +# SAR +3 string LH5 SAR archive data +# BSArc/BS2 +0 string \212\3SB\020\0 BSArc/BS2 archive data +# Bethesda Softworks Archive (Oblivion) +0 string BSA\0 BSArc archive data +>4 lelong x version %d +# MAR +2 string =-ah MAR archive data +# ACB +#0 belong&0x00f800ff 0x00800000 ACB archive data +# CPZ +# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data +# JRC +0 string JRchive JRC archive data +# Quantum +0 string DS\0 Quantum archive data +# ReSOF +0 string PK\3\6 ReSOF archive data +# QuArk +0 string 7\4 QuArk archive data +# YAC +14 string YC YAC archive data +# X1 +0 string X1 X1 archive data +0 string XhDr X1 archive data +# CDC Codec (.dqt) +0 belong&0xffffe000 0x76ff2000 CDC Codec archive data +# AMGC +0 string \xad6" AMGC archive data +# NuLIB +0 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data +# PakLeo +0 string LEOLZW PAKLeo archive data +# ChArc +0 string SChF ChArc archive data +# PSA +0 string PSA PSA archive data +# CrossePAC +0 string DSIGDCC CrossePAC archive data +# Freeze +0 string \x1f\x9f\x4a\x10\x0a Freeze archive data +# KBoom +0 string \xc2\xa8MP\xc2\xa8 KBoom archive data +# NSQ, must go after CDC Codec +0 string \x76\xff NSQ archive data +# DPA +0 string Dirk\ Paehl DPA archive data +# BA +# TODO: idarc says "bytes 0-2 == bytes 3-5" +# TTComp +0 string \0\6 TTComp archive data +# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? +0 string ESP ESP archive data +# ZPack +0 string \1ZPK\1 ZPack archive data +# Sky +0 string \xbc\x40 Sky archive data +# UFA +0 string UFA UFA archive data +# Dry +0 string =-H2O DRY archive data +# FoxSQZ +0 string FOXSQZ FoxSQZ archive data +# AR7 +0 string ,AR7 AR7 archive data +# PPMZ +0 string PPMZ PPMZ archive data +# MS Compress +4 string \x88\xf0\x27 MS Compress archive data +# updated by Joerg Jenderek +>9 string \0 +>>0 string KWAJ +>>>7 string \321\003 MS Compress archive data +>>>>14 ulong >0 \b, original size: %ld bytes +>>>>18 ubyte >0x65 +>>>>>18 string x \b, was %.8s +>>>>>(10.b-4) string x \b.%.3s +# MP3 (archiver, not lossy audio compression) +0 string MP3\x1a MP3-Archiver archive data +# ZET +0 string OZ\xc3\x9d ZET archive data +# TSComp +0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data +# ARQ +0 string gW\4\1 ARQ archive data +# Squash +3 string OctSqu Squash archive data +# Terse +0 string \5\1\1\0 Terse archive data +# PUCrunch +0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data +# UHarc +0 string UHA UHarc archive data +# ABComp +0 string \2AB ABComp archive data +0 string \3AB2 ABComp archive data +# CMP +0 string CO\0 CMP archive data +# Splint +0 string \x93\xb9\x06 Splint archive data +# InstallShield +0 string \x13\x5d\x65\x8c InstallShield Z archive Data +# Gather +1 string GTH Gather archive data +# BOA +0 string BOA BOA archive data +# RAX +0 string ULEB\xa RAX archive data +# Xtreme +0 string ULEB\0 Xtreme archive data +# Pack Magic +0 string @\xc3\xa2\1\0 Pack Magic archive data +# BTS +0 belong&0xfeffffff 0x1a034465 BTS archive data +# ELI 5750 +0 string Ora\ ELI 5750 archive data +# QFC +0 string \x1aFC\x1a QFC archive data +0 string \x1aQF\x1a QFC archive data +# PRO-PACK +0 string RNC PRO-PACK archive data +# 777 +0 string 777 777 archive data +# LZS221 +0 string sTaC LZS221 archive data +# HPA +0 string HPA HPA archive data +# Arhangel +0 string LG Arhangel archive data +# EXP1, uses bzip2 +0 string 0123456789012345BZh EXP1 archive data +# IMP +0 string IMP\xa IMP archive data +# NRV +0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data +# Squish +0 string \x73\xb2\x90\xf4 Squish archive data +# Par +0 string PHILIPP Par archive data +0 string PAR Par archive data +# HIT +0 string UB HIT archive data +# SBX +0 belong&0xfffff000 0x53423000 SBX archive data +# NaShrink +0 string NSK NaShrink archive data +# SAPCAR +0 string #\ CAR\ archive\ header SAPCAR archive data +0 string CAR\ 2.00RG SAPCAR archive data +# Disintegrator +0 string DST Disintegrator archive data +# ASD +0 string ASD ASD archive data +# InstallShield CAB +0 string ISc( InstallShield CAB +# TOP4 +0 string T4\x1a TOP4 archive data +# BatComp left out: sig looks like COM executable +# so TODO: get real 4dos batcomp file and find sig +# BlakHole +0 string BH\5\7 BlakHole archive data +# BIX +0 string BIX0 BIX archive data +# ChiefLZA +0 string ChfLZ ChiefLZA archive data +# Blink +0 string Blink Blink archive data +# Logitech Compress +0 string \xda\xfa Logitech Compress archive data +# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) +1 string (C)\ STEPANYUK ARS-Sfx archive data +# AKT/AKT32 +0 string AKT32 AKT32 archive data +0 string AKT AKT archive data +# NPack +0 string MSTSM NPack archive data +# PFT +0 string \0\x50\0\x14 PFT archive data +# SemOne +0 string SEM SemOne archive data +# PPMD +0 string \x8f\xaf\xac\x84 PPMD archive data +# FIZ +0 string FIZ FIZ archive data +# MSXiE +0 belong&0xfffff0f0 0x4d530000 MSXiE archive data +# DeepFreezer +0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data +# DC +0 string =<DC- DC archive data +# TPac +0 string \4TPAC\3 TPac archive data +# Ai +0 string Ai\1\1\0 Ai archive data +0 string Ai\1\0\0 Ai archive data +# Ai32 +0 string Ai\2\0 Ai32 archive data +0 string Ai\2\1 Ai32 archive data +# SBC +0 string SBC SBC archive data +# Ybs +0 string YBS Ybs archive data +# DitPack +0 string \x9e\0\0 DitPack archive data +# DMS +0 string DMS! DMS archive data +# EPC +0 string \x8f\xaf\xac\x8c EPC archive data +# VSARC +0 string VS\x1a VSARC archive data +# PDZ +0 string PDZ PDZ archive data +# ReDuq +0 string rdqx ReDuq archive data +# GCA +0 string GCAX GCA archive data +# PPMN +0 string pN PPMN archive data +# WinImage +3 string WINIMAGE WinImage archive data +# Compressia +0 string CMP0CMP Compressia archive data +# UHBC +0 string UHB UHBC archive data +# WinHKI +0 string \x61\x5C\x04\x05 WinHKI archive data +# WWPack data file +0 string WWP WWPack archive data +# BSN (BSA, PTS-DOS) +0 string \xffBSG BSN archive data +1 string \xffBSG BSN archive data +3 string \xffBSG BSN archive data +1 string \0\xae\2 BSN archive data +1 string \0\xae\3 BSN archive data +1 string \0\xae\7 BSN archive data +# AIN +0 string \x33\x18 AIN archive data +0 string \x33\x17 AIN archive data +# XPA32 +0 string xpa\0\1 XPA32 archive data +# SZip (TODO: doesn't catch all versions) +0 string SZ\x0a\4 SZip archive data +# XPack DiskImage +0 string jm XPack DiskImage archive data +# XPack Data +0 string xpa XPack archive data +# XPack Single Data +0 string \xc3\x8d\ jm XPack single archive data + +# TODO: missing due to unknown magic/magic at end of file: +#DWC +#ARG +#ZAR +#PC/3270 +#InstallIt +#RKive +#RK +#XPack Diskimage + +# These were inspired by idarc, but actually verified +# Dzip archiver (.dz) +0 string DZ Dzip archive data +>2 byte x \b, version %i +>3 byte x \b.%i +# ZZip archiver (.zz) +0 string ZZ\ \0\0 ZZip archive data +0 string ZZ0 ZZip archive data +# PAQ archiver (.paq) +0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data +0 string PAQ PAQ archive data +>3 byte&0xf0 0x30 +>>3 byte x (v%c) +# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) +0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data +0 string JARCS JAR (ARJ Software, Inc.) archive data + +# ARJ archiver (jason@jarthur.Claremont.EDU) +0 leshort 0xea60 ARJ archive data +!:mime application/x-arj +>5 byte x \b, v%d, +>8 byte &0x04 multi-volume, +>8 byte &0x10 slash-switched, +>8 byte &0x20 backup, +>34 string x original name: %s, +>7 byte 0 os: MS-DOS +>7 byte 1 os: PRIMOS +>7 byte 2 os: Unix +>7 byte 3 os: Amiga +>7 byte 4 os: Macintosh +>7 byte 5 os: OS/2 +>7 byte 6 os: Apple ][ GS +>7 byte 7 os: Atari ST +>7 byte 8 os: NeXT +>7 byte 9 os: VAX/VMS +>3 byte >0 %d] +# [JW] idarc says this is also possible +2 leshort 0xea60 ARJ archive data + +# HA archiver (Greg Roelofs, newt@uchicago.edu) +# This is a really bad format. A file containing HAWAII will match this... +#0 string HA HA archive data, +#>2 leshort =1 1 file, +#>2 leshort >1 %u files, +#>4 byte&0x0f =0 first is type CPY +#>4 byte&0x0f =1 first is type ASC +#>4 byte&0x0f =2 first is type HSC +#>4 byte&0x0f =0x0e first is type DIR +#>4 byte&0x0f =0x0f first is type SPECIAL +# suggestion: at least identify small archives (<1024 files) +0 belong&0xffff00fc 0x48410000 HA archive data +>2 leshort =1 1 file, +>2 leshort >1 %u files, +>4 byte&0x0f =0 first is type CPY +>4 byte&0x0f =1 first is type ASC +>4 byte&0x0f =2 first is type HSC +>4 byte&0x0f =0x0e first is type DIR +>4 byte&0x0f =0x0f first is type SPECIAL + +# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) +0 string HPAK HPACK archive data + +# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net +0 string \351,\001JAM\ JAM archive, +>7 string >\0 version %.4s +>0x26 byte =0x27 - +>>0x2b string >\0 label %.11s, +>>0x27 lelong x serial %08x, +>>0x36 string >\0 fstype %.8s + +# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) +2 string -lh0- LHarc 1.x/ARX archive data [lh0] +!:mime application/x-lharc +2 string -lh1- LHarc 1.x/ARX archive data [lh1] +!:mime application/x-lharc +2 string -lz4- LHarc 1.x archive data [lz4] +!:mime application/x-lharc +2 string -lz5- LHarc 1.x archive data [lz5] +!:mime application/x-lharc +# [never seen any but the last; -lh4- reported in comp.compression:] +2 string -lzs- LHa/LZS archive data [lzs] +!:mime application/x-lha +2 string -lh\40- LHa 2.x? archive data [lh ] +!:mime application/x-lha +2 string -lhd- LHa 2.x? archive data [lhd] +!:mime application/x-lha +2 string -lh2- LHa 2.x? archive data [lh2] +!:mime application/x-lha +2 string -lh3- LHa 2.x? archive data [lh3] +!:mime application/x-lha +2 string -lh4- LHa (2.x) archive data [lh4] +!:mime application/x-lha +2 string -lh5- LHa (2.x) archive data [lh5] +!:mime application/x-lha +2 string -lh6- LHa (2.x) archive data [lh6] +!:mime application/x-lha +2 string -lh7- LHa (2.x)/LHark archive data [lh7] +!:mime application/x-lha +>20 byte x - header level %d +# taken from idarc [JW] +2 string -lZ PUT archive data +2 string -lz LZS archive data +2 string -sw1- Swag archive data + +# RAR archiver (Greg Roelofs, newt@uchicago.edu) +0 string Rar! RAR archive data, +!:mime application/x-rar +>44 byte x v%0x, +>10 byte >0 flags: +>>10 byte &0x01 Archive volume, +>>10 byte &0x02 Commented, +>>10 byte &0x04 Locked, +>>10 byte &0x08 Solid, +>>10 byte &0x20 Authenticated, +>35 byte 0 os: MS-DOS +>35 byte 1 os: OS/2 +>35 byte 2 os: Win32 +>35 byte 3 os: Unix +# some old version? idarc says: +0 string RE\x7e\x5e RAR archive data + +# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) +0 string SQSH squished archive data (Acorn RISCOS) + +# UC2 archiver (Greg Roelofs, newt@uchicago.edu) +# [JW] see exe section for self-extracting version +0 string UC2\x1a UC2 archive data + +# PKZIP multi-volume archive +0 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract +!:mime application/zip + +# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) +0 string PK\005\006 Zip archive data (empty) +0 string PK\003\004 + +# Specialised zip formats which start with a member named 'mimetype' +# (stored uncompressed, with no 'extra field') containing the file's MIME type. +# Check for have 8-byte name, 0-byte extra field, name "mimetype", and +# contents starting with "application/": +>26 string \x8\0\0\0mimetypeapplication/ + +# KOffice / OpenOffice & StarOffice / OpenDocument formats +# From: Abel Cheung <abel@oaka.org> + +# KOffice (1.2 or above) formats +# (mimetype contains "application/vnd.kde.<SUBTYPE>") +>>50 string vnd.kde. KOffice (>=1.2) +>>>58 string karbon Karbon document +>>>58 string kchart KChart document +>>>58 string kformula KFormula document +>>>58 string kivio Kivio document +>>>58 string kontour Kontour document +>>>58 string kpresenter KPresenter document +>>>58 string kspread KSpread document +>>>58 string kword KWord document + +# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) +# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") +>>50 string vnd.sun.xml. OpenOffice.org 1.x +>>>62 string writer Writer +>>>>68 byte !0x2e document +>>>>68 string .template template +>>>>68 string .global global document +>>>62 string calc Calc +>>>>66 byte !0x2e spreadsheet +>>>>66 string .template template +>>>62 string draw Draw +>>>>66 byte !0x2e document +>>>>66 string .template template +>>>62 string impress Impress +>>>>69 byte !0x2e presentation +>>>>69 string .template template +>>>62 string math Math document +>>>62 string base Database file + +# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) +# http://lists.oasis-open.org/archives/office/200505/msg00006.html +# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") +>>50 string vnd.oasis.opendocument. OpenDocument +>>>73 string text +>>>>77 byte !0x2d Text +!:mime application/vnd.oasis.opendocument.text +>>>>77 string -template Text Template +!:mime application/vnd.oasis.opendocument.text-template +>>>>77 string -web HTML Document Template +!:mime application/vnd.oasis.opendocument.text-web +>>>>77 string -master Master Document +!:mime application/vnd.oasis.opendocument.text-master +>>>73 string graphics +>>>>81 byte !0x2d Drawing +!:mime application/vnd.oasis.opendocument.graphics +>>>>81 string -template Template +!:mime application/vnd.oasis.opendocument.graphics-template +>>>73 string presentation +>>>>85 byte !0x2d Presentation +!:mime application/vnd.oasis.opendocument.presentation +>>>>85 string -template Template +!:mime application/vnd.oasis.opendocument.presentation-template +>>>73 string spreadsheet +>>>>84 byte !0x2d Spreadsheet +!:mime application/vnd.oasis.opendocument.spreadsheet +>>>>84 string -template Template +!:mime application/vnd.oasis.opendocument.spreadsheet-template +>>>73 string chart +>>>>78 byte !0x2d Chart +!:mime application/vnd.oasis.opendocument.chart +>>>>78 string -template Template +!:mime application/vnd.oasis.opendocument.chart-template +>>>73 string formula +>>>>80 byte !0x2d Formula +!:mime application/vnd.oasis.opendocument.formula +>>>>80 string -template Template +!:mime application/vnd.oasis.opendocument.formula-template +>>>73 string database Database +!:mime application/vnd.oasis.opendocument.database +>>>73 string image +>>>>78 byte !0x2d Image +!:mime application/vnd.oasis.opendocument.image +>>>>78 string -template Template +!:mime application/vnd.oasis.opendocument.image-template + +# EPUB (OEBPS) books using OCF (OEBPS Container Format) +# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. +# From: Ralf Brown <ralf.brown@gmail.com> +>0x1E string mimetypeapplication/epub+zip EPUB document +!:mime application/epub+zip + +# Catch other ZIP-with-mimetype formats +# In a ZIP file, the bytes immediately after a member's contents are +# always "PK". The 2 regex rules here print the "mimetype" member's +# contents up to the first 'P'. Luckily, most MIME types don't contain +# any capital 'P's. This is a kludge. +# (mimetype contains "application/<OTHER>") +>>50 string !epub+zip +>>>50 string !vnd.oasis.opendocument. +>>>>50 string !vnd.sun.xml. +>>>>>50 string !vnd.kde. +>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) +!:mime application/zip +# (mimetype contents other than "application/*") +>26 string \x8\0\0\0mimetype +>>38 string !application/ +>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) +!:mime application/zip + +# Java Jar files +>(26.s+30) leshort 0xcafe Java Jar file data (zip) +!:mime application/jar + +# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) +# Next line excludes specialized formats: +>(26.s+30) leshort !0xcafe +>>26 string !\x8\0\0\0mimetype Zip archive data +!:mime application/zip +>>>4 byte 0x09 \b, at least v0.9 to extract +>>>4 byte 0x0a \b, at least v1.0 to extract +>>>4 byte 0x0b \b, at least v1.1 to extract +>>>4 byte 0x14 \b, at least v2.0 to extract +>>>4 byte 0x2d \b, at least v3.0 to extract +>>>0x161 string WINZIP \b, WinZIP self-extracting + +# StarView Metafile +# From Pierre Ducroquet <pinaraf@pinaraf.info> +0 string VCLMTF StarView MetaFile +>6 beshort x \b, version %d +>8 belong x \b, size %d + +# Zoo archiver +20 lelong 0xfdc4a7dc Zoo archive data +!:mime application/x-zoo +>4 byte >48 \b, v%c. +>>6 byte >47 \b%c +>>>7 byte >47 \b%c +>32 byte >0 \b, modify: v%d +>>33 byte x \b.%d+ +>42 lelong 0xfdc4a7dc \b, +>>70 byte >0 extract: v%d +>>>71 byte x \b.%d+ + +# Shell archives +10 string #\ This\ is\ a\ shell\ archive shell archive text +!:mime application/octet-stream + +# +# LBR. NB: May conflict with the questionable +# "binary Computer Graphics Metafile" format. +# +0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data +# +# PMA (CP/M derivative of LHA) +# +2 string -pm0- PMarc archive data [pm0] +2 string -pm1- PMarc archive data [pm1] +2 string -pm2- PMarc archive data [pm2] +2 string -pms- PMarc SFX archive (CP/M, DOS) +5 string -pc1- PopCom compressed executable (CP/M) + +# From Rafael Laboissiere <rafael@laboissiere.net> +# The Project Revision Control System (see +# http://prcs.sourceforge.net) generates a packaged project +# file which is recognized by the following entry: +0 leshort 0xeb81 PRCS packaged project + +# Microsoft cabinets +# by David Necas (Yeti) <yeti@physics.muni.cz> +#0 string MSCF\0\0\0\0 Microsoft cabinet file data, +#>25 byte x v%d +#>24 byte x \b.%d +# MPi: All CABs have version 1.3, so this is pointless. +# Better magic in debian-additions. + +# GTKtalog catalogs +# by David Necas (Yeti) <yeti@physics.muni.cz> +4 string gtktalog\ GTKtalog catalog data, +>13 string 3 version 3 +>>14 beshort 0x677a (gzipped) +>>14 beshort !0x677a (not gzipped) +>13 string >3 version %s + +############################################################################ +# Parity archive reconstruction file, the 'par' file format now used on Usenet. +0 string PAR\0 PARity archive data +>48 leshort =0 - Index file +>48 leshort >0 - file number %d + +# Felix von Leitner <felix-file@fefe.de> +0 string d8:announce BitTorrent file +!:mime application/x-bittorrent + +# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> +0 beshort 0x0e0f Atari MSA archive data +>2 beshort x \b, %d sectors per track +>4 beshort 0 \b, 1 sided +>4 beshort 1 \b, 2 sided +>6 beshort x \b, starting track: %d +>8 beshort x \b, ending track: %d + +# Alternate ZIP string (amc@arwen.cs.berkeley.edu) +0 string PK00PK\003\004 Zip archive data + +# ACE archive (from http://www.wotsit.org/download.asp?f=ace) +# by Stefan `Sec` Zehl <sec@42.org> +7 string **ACE** ACE archive data +>15 byte >0 version %d +>16 byte =0x00 \b, from MS-DOS +>16 byte =0x01 \b, from OS/2 +>16 byte =0x02 \b, from Win/32 +>16 byte =0x03 \b, from Unix +>16 byte =0x04 \b, from MacOS +>16 byte =0x05 \b, from WinNT +>16 byte =0x06 \b, from Primos +>16 byte =0x07 \b, from AppleGS +>16 byte =0x08 \b, from Atari +>16 byte =0x09 \b, from Vax/VMS +>16 byte =0x0A \b, from Amiga +>16 byte =0x0B \b, from Next +>14 byte x \b, version %d to extract +>5 leshort &0x0080 \b, multiple volumes, +>>17 byte x \b (part %d), +>5 leshort &0x0002 \b, contains comment +>5 leshort &0x0200 \b, sfx +>5 leshort &0x0400 \b, small dictionary +>5 leshort &0x0800 \b, multi-volume +>5 leshort &0x1000 \b, contains AV-String +>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) +>5 leshort &0x2000 \b, with recovery record +>5 leshort &0x4000 \b, locked +>5 leshort &0x8000 \b, solid +# Date in MS-DOS format (whatever that is) +#>18 lelong x Created on + +# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann +# <doj@cubic.org> +0x1A string sfArk sfArk compressed Soundfont +>0x15 string 2 +>>0x1 string >\0 Version %s +>>0x2A string >\0 : %s + +# DR-DOS 7.03 Packed File *.??_ +0 string Packed\ File\ Personal NetWare Packed File +>12 string x \b, was "%.12s" + +# EET archive +# From: Tilman Sauerbeck <tilman@code-monkey.de> +0 belong 0x1ee7ff00 EET archive +!:mime application/x-eet + +# rzip archives +0 string RZIP rzip compressed data +>4 byte x - version %d +>5 byte x \b.%d +>6 belong x (%d bytes) + +# From: "Robert Dale" <robdale@gmail.com> +0 belong 123 dar archive, +>4 belong x label "%.8x +>>8 belong x %.8x +>>>12 beshort x %.4x" +>14 byte 0x54 end slice +>14 beshort 0x4e4e multi-part +>14 beshort 0x4e53 multi-part, with -S + +# Symbian installation files +# http://www.thouky.co.uk/software/psifs/sis.html +# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf +8 lelong 0x10000419 Symbian installation file +!:mime application/vnd.symbian.install +>4 lelong 0x1000006D (EPOC release 3/4/5) +>4 lelong 0x10003A12 (EPOC release 6) +0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) +!:mime x-epoc/x-sisx-app + +# From "Nelson A. de Oliveira" <naoliv@gmail.com> +0 string MPQ\032 MoPaQ (MPQ) archive + +# From: Dirk Jagdmann <doj@cubic.org> +# xar archive format: http://code.google.com/p/xar/ +0 string xar! xar archive +>6 beshort x - version %ld + +# From: "Nelson A. de Oliveira" <naoliv@gmail.com> +# .kgb +0 string KGB_arch KGB Archiver file +>10 string x with compression level %.1s + +# xar (eXtensible ARchiver) archive +# From: "David Remahl" <dremahl@apple.com> +0 string xar! xar archive +#>4 beshort x header size %d +>6 beshort x version %d, +#>8 quad x compressed TOC: %d, +#>16 quad x uncompressed TOC: %d, +>24 belong 0 no checksum +>24 belong 1 SHA-1 checksum +>24 belong 2 MD5 checksum + +# Type: Parity Archive +# From: Daniel van Eeden <daniel_e@dds.nl> +0 string PAR2 Parity Archive Volume Set + +# Bacula volume format. (Volumes always start with a block header.) +# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +12 string BB02 Bacula volume +>20 bedate x \b, started %s + +# ePub is XHTML + XML inside a ZIP archive. The first member of the +# archive must be an uncompressed file called 'mimetype' with contents +# 'application/epub+zip' + + +# From: "Michael Gorny" <mgorny@gentoo.org> +# ZPAQ: http://mattmahoney.net/dc/zpaq.html +0 string zPQ ZPAQ stream +>3 byte x \b, level %d + +# BBeB ebook, unencrypted (LRF format) +# URL: http://www.sven.de/librie/Librie/LrfFormat +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +0 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted +>8 beshort x \b, version %d +>36 byte 1 \b, front-to-back +>36 byte 16 \b, back-to-front +>42 beshort x \b, (%dx, +>44 beshort x %d) diff --git a/magic/Magdir/assembler b/magic/Magdir/assembler new file mode 100644 index 0000000..f311ae9 --- /dev/null +++ b/magic/Magdir/assembler @@ -0,0 +1,18 @@ +#------------------------------------------------------------------------------ +# $File: assembler,v 1.4 2013/01/04 23:31:11 christos Exp $ +# make: file(1) magic for assembler source +# +0 regex \^[\020\t]*\\.asciiz assembler source text +!:mime text/x-asm +0 regex \^[\020\t]*\\.byte assembler source text +!:mime text/x-asm +0 regex \^[\020\t]*\\.even assembler source text +!:mime text/x-asm +0 regex \^[\020\t]*\\.globl assembler source text +!:mime text/x-asm +0 regex \^[\020\t]*\\.text assembler source text +!:mime text/x-asm +0 regex \^[\020\t]*\\.file assembler source text +!:mime text/x-asm +0 regex \^[\020\t]*\\.type assembler source text +!:mime text/x-asm diff --git a/magic/Magdir/asterix b/magic/Magdir/asterix new file mode 100644 index 0000000..a9ea885 --- /dev/null +++ b/magic/Magdir/asterix @@ -0,0 +1,18 @@ + +#------------------------------------------------------------------------------ +# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $ +# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character +# strings as "long" - we assume they're just strings: +# From: guy@netapp.com (Guy Harris) +# +0 string *STA Aster*x +>7 string WORD Words Document +>7 string GRAP Graphic +>7 string SPRE Spreadsheet +>7 string MACR Macro +0 string 2278 Aster*x Version 2 +>29 byte 0x36 Words Document +>29 byte 0x35 Graphic +>29 byte 0x32 Spreadsheet +>29 byte 0x38 Macro + diff --git a/magic/Magdir/att3b b/magic/Magdir/att3b new file mode 100644 index 0000000..9688011 --- /dev/null +++ b/magic/Magdir/att3b @@ -0,0 +1,41 @@ + +#------------------------------------------------------------------------------ +# $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $ +# att3b: file(1) magic for AT&T 3B machines +# +# The `versions' should be un-commented if they work for you. +# (Was the problem just one of endianness?) +# +# 3B20 +# +# The 3B20 conflicts with SCCS. +#0 beshort 0550 3b20 COFF executable +#>12 belong >0 not stripped +#>22 beshort >0 - version %ld +#0 beshort 0551 3b20 COFF executable (TV) +#>12 belong >0 not stripped +#>22 beshort >0 - version %ld +# +# WE32K +# +0 beshort 0560 WE32000 COFF +>18 beshort ^00000020 object +>18 beshort &00000020 executable +>12 belong >0 not stripped +>18 beshort ^00010000 N/A on 3b2/300 w/paging +>18 beshort &00020000 32100 required +>18 beshort &00040000 and MAU hardware required +>20 beshort 0407 (impure) +>20 beshort 0410 (pure) +>20 beshort 0413 (demand paged) +>20 beshort 0443 (target shared library) +>22 beshort >0 - version %ld +0 beshort 0561 WE32000 COFF executable (TV) +>12 belong >0 not stripped +#>18 beshort &00020000 - 32100 required +#>18 beshort &00040000 and MAU hardware required +#>22 beshort >0 - version %ld +# +# core file for 3b2 +0 string \000\004\036\212\200 3b2 core file +>364 string >\0 of '%s' diff --git a/magic/Magdir/audio b/magic/Magdir/audio new file mode 100644 index 0000000..ebe6f09 --- /dev/null +++ b/magic/Magdir/audio @@ -0,0 +1,639 @@ + +#------------------------------------------------------------------------------ +# $File: audio,v 1.66 2013/02/06 14:18:52 christos Exp $ +# audio: file(1) magic for sound formats (see also "iff") +# +# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), +# and others +# + +# Sun/NeXT audio data +0 string .snd Sun/NeXT audio data: +>12 belong 1 8-bit ISDN mu-law, +!:mime audio/basic +>12 belong 2 8-bit linear PCM [REF-PCM], +!:mime audio/basic +>12 belong 3 16-bit linear PCM, +!:mime audio/basic +>12 belong 4 24-bit linear PCM, +!:mime audio/basic +>12 belong 5 32-bit linear PCM, +!:mime audio/basic +>12 belong 6 32-bit IEEE floating point, +!:mime audio/basic +>12 belong 7 64-bit IEEE floating point, +!:mime audio/basic +>12 belong 8 Fragmented sample data, +>12 belong 10 DSP program, +>12 belong 11 8-bit fixed point, +>12 belong 12 16-bit fixed point, +>12 belong 13 24-bit fixed point, +>12 belong 14 32-bit fixed point, +>12 belong 18 16-bit linear with emphasis, +>12 belong 19 16-bit linear compressed, +>12 belong 20 16-bit linear with emphasis and compression, +>12 belong 21 Music kit DSP commands, +>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), +!:mime audio/x-adpcm +>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) +>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), +>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), +>12 belong 27 8-bit A-law (CCITT G.711), +>20 belong 1 mono, +>20 belong 2 stereo, +>20 belong 4 quad, +>16 belong >0 %d Hz + +# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format +# that uses little-endian encoding and has a different magic number +0 lelong 0x0064732E DEC audio data: +>12 lelong 1 8-bit ISDN mu-law, +!:mime audio/x-dec-basic +>12 lelong 2 8-bit linear PCM [REF-PCM], +!:mime audio/x-dec-basic +>12 lelong 3 16-bit linear PCM, +!:mime audio/x-dec-basic +>12 lelong 4 24-bit linear PCM, +!:mime audio/x-dec-basic +>12 lelong 5 32-bit linear PCM, +!:mime audio/x-dec-basic +>12 lelong 6 32-bit IEEE floating point, +!:mime audio/x-dec-basic +>12 lelong 7 64-bit IEEE floating point, +!:mime audio/x-dec-basic +>12 belong 8 Fragmented sample data, +>12 belong 10 DSP program, +>12 belong 11 8-bit fixed point, +>12 belong 12 16-bit fixed point, +>12 belong 13 24-bit fixed point, +>12 belong 14 32-bit fixed point, +>12 belong 18 16-bit linear with emphasis, +>12 belong 19 16-bit linear compressed, +>12 belong 20 16-bit linear with emphasis and compression, +>12 belong 21 Music kit DSP commands, +>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), +!:mime audio/x-dec-basic +>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) +>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), +>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), +>12 belong 27 8-bit A-law (CCITT G.711), +>20 lelong 1 mono, +>20 lelong 2 stereo, +>20 lelong 4 quad, +>16 lelong >0 %d Hz + +# Creative Labs AUDIO stuff +0 string MThd Standard MIDI data +!:mime audio/midi +>8 beshort x (format %d) +>10 beshort x using %d track +>10 beshort >1 \bs +>12 beshort&0x7fff x at 1/%d +>12 beshort&0x8000 >0 SMPTE + +0 string CTMF Creative Music (CMF) data +!:mime audio/x-unknown +0 string SBI SoundBlaster instrument data +!:mime audio/x-unknown +0 string Creative\ Voice\ File Creative Labs voice data +!:mime audio/x-unknown +# is this next line right? it came this way... +>19 byte 0x1A +>23 byte >0 - version %d +>22 byte >0 \b.%d + +# first entry is also the string "NTRK" +0 belong 0x4e54524b MultiTrack sound data +>4 belong x - version %ld + +# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED +# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] +0 string EMOD Extended MOD sound data, +>4 byte&0xf0 x version %d +>4 byte&0x0f x \b.%d, +>45 byte x %d instruments +>83 byte 0 (module) +>83 byte 1 (song) + +# Real Audio (Magic .ra\0375) +0 belong 0x2e7261fd RealAudio sound file +!:mime audio/x-pn-realaudio +0 string .RMF\0\0\0 RealMedia file +!:mime application/vnd.rn-realmedia +#video/x-pn-realvideo +#video/vnd.rn-realvideo +#application/vnd.rn-realmedia +# sigh, there are many mimes for that but the above are the most common. + +# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] +# Oct 31, 1995 +# fixed by <doj@cubic.org> 2003-06-24 +# Too short... +#0 string MTM MultiTracker Module sound file +#0 string if Composer 669 Module sound data +#0 string JN Composer 669 Module sound data (extended format) +0 string MAS_U ULT(imate) Module sound data + +#0 string FAR Module sound data +#>4 string >\15 Title: "%s" + +0x2c string SCRM ScreamTracker III Module sound data +>0 string >\0 Title: "%s" + +# Gravis UltraSound patches +# From <ache@nagual.ru> + +0 string GF1PATCH110\0ID#000002\0 GUS patch +0 string GF1PATCH100\0ID#000002\0 Old GUS patch + +# mime types according to http://www.geocities.com/nevilo/mod.htm: +# audio/it .it +# audio/x-zipped-it .itz +# audio/xm fasttracker modules +# audio/x-s3m screamtracker modules +# audio/s3m screamtracker modules +# audio/x-zipped-mod mdz +# audio/mod mod +# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) + +# +# Taken from loader code from mikmod version 2.14 +# by Steve McIntyre (stevem@chiark.greenend.org.uk) +# <doj@cubic.org> added title printing on 2003-06-24 +0 string MAS_UTrack_V00 +>14 string >/0 ultratracker V1.%.1s module sound data +!:mime audio/x-mod +#audio/x-tracker-module + +0 string UN05 MikMod UNI format module sound data + +0 string Extended\ Module: Fasttracker II module sound data +!:mime audio/x-mod +#audio/x-tracker-module +>17 string >\0 Title: "%s" + +21 string/c =!SCREAM! Screamtracker 2 module sound data +!:mime audio/x-mod +#audio/x-screamtracker-module +21 string BMOD2STM Screamtracker 2 module sound data +!:mime audio/x-mod +#audio/x-screamtracker-module +1080 string M.K. 4-channel Protracker module sound data +!:mime audio/x-mod +#audio/x-protracker-module +>0 string >\0 Title: "%s" +1080 string M!K! 4-channel Protracker module sound data +!:mime audio/x-mod +#audio/x-protracker-module +>0 string >\0 Title: "%s" +1080 string FLT4 4-channel Startracker module sound data +!:mime audio/x-mod +#audio/x-startracker-module +>0 string >\0 Title: "%s" +1080 string FLT8 8-channel Startracker module sound data +!:mime audio/x-mod +#audio/x-startracker-module +>0 string >\0 Title: "%s" +1080 string 4CHN 4-channel Fasttracker module sound data +!:mime audio/x-mod +#audio/x-fasttracker-module +>0 string >\0 Title: "%s" +1080 string 6CHN 6-channel Fasttracker module sound data +!:mime audio/x-mod +#audio/x-fasttracker-module +>0 string >\0 Title: "%s" +1080 string 8CHN 8-channel Fasttracker module sound data +!:mime audio/x-mod +#audio/x-fasttracker-module +>0 string >\0 Title: "%s" +1080 string CD81 8-channel Octalyser module sound data +!:mime audio/x-mod +#audio/x-octalysertracker-module +>0 string >\0 Title: "%s" +1080 string OKTA 8-channel Octalyzer module sound data +!:mime audio/x-mod +#audio/x-octalysertracker-module +>0 string >\0 Title: "%s" +# Not good enough. +#1082 string CH +#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data +1080 string 16CN 16-channel Taketracker module sound data +!:mime audio/x-mod +#audio/x-taketracker-module +>0 string >\0 Title: "%s" +1080 string 32CN 32-channel Taketracker module sound data +!:mime audio/x-mod +#audio/x-taketracker-module +>0 string >\0 Title: "%s" + +# TOC sound files -Trevor Johnson <trevor@jpj.net> +# +0 string TOC TOC sound file + +# sidfiles <pooka@iki.fi> +# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 +0 string SIDPLAY\ INFOFILE Sidplay info file + +0 string PSID PlaySID v2.2+ (AMIGA) sidtune +>4 beshort >0 w/ header v%d, +>14 beshort =1 single song, +>14 beshort >1 %d songs, +>16 beshort >0 default song: %d +>0x16 string >\0 name: "%s" +>0x36 string >\0 author: "%s" +>0x56 string >\0 copyright: "%s" + +0 string RSID RSID sidtune PlaySID compatible +>4 beshort >0 w/ header v%d, +>14 beshort =1 single song, +>14 beshort >1 %d songs, +>16 beshort >0 default song: %d +>0x16 string >\0 name: "%s" +>0x36 string >\0 author: "%s" +>0x56 string >\0 copyright: "%s" + +# IRCAM sound files - Michael Pruett <michael@68k.org> +# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html +0 belong 0x64a30100 IRCAM file (VAX little-endian) +0 belong 0x0001a364 IRCAM file (VAX big-endian) +0 belong 0x64a30200 IRCAM file (Sun big-endian) +0 belong 0x0002a364 IRCAM file (Sun little-endian) +0 belong 0x64a30300 IRCAM file (MIPS little-endian) +0 belong 0x0003a364 IRCAM file (MIPS big-endian) +0 belong 0x64a30400 IRCAM file (NeXT big-endian) +0 belong 0x64a30400 IRCAM file (NeXT big-endian) +0 belong 0x0004a364 IRCAM file (NeXT little-endian) + +# NIST SPHERE <mpruett@sgi.com> +0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file + +# Sample Vision <mpruett@sgi.com> +0 string SOUND\ SAMPLE\ DATA\ Sample Vision file + +# Audio Visual Research <tonigonenstein@users.sourceforge.net> +0 string 2BIT Audio Visual Research file, +>12 beshort =0 mono, +>12 beshort =-1 stereo, +>14 beshort x %d bits +>16 beshort =0 unsigned, +>16 beshort =-1 signed, +>22 belong&0x00ffffff x %d Hz, +>18 beshort =0 no loop, +>18 beshort =-1 loop, +>21 ubyte <128 note %d, +>22 byte =0 replay 5.485 KHz +>22 byte =1 replay 8.084 KHz +>22 byte =2 replay 10.971 KHz +>22 byte =3 replay 16.168 KHz +>22 byte =4 replay 21.942 KHz +>22 byte =5 replay 32.336 KHz +>22 byte =6 replay 43.885 KHz +>22 byte =7 replay 47.261 KHz + +# SGI SoundTrack <mpruett@sgi.com> +0 string _SGI_SoundTrack SGI SoundTrack project file +# ID3 version 2 tags <waschk@informatik.uni-rostock.de> +0 string ID3 Audio file with ID3 version 2 +>3 byte x \b.%d +>4 byte x \b.%d +>>5 byte &0x80 \b, unsynchronized frames +>>5 byte &0x40 \b, extended header +>>5 byte &0x20 \b, experimental +>>5 byte &0x10 \b, footer present +>(6.I) indirect x \b, contains: + +# NSF (NES sound file) magic +0 string NESM\x1a NES Sound File +>14 string >\0 ("%s" by +>46 string >\0 %s, copyright +>78 string >\0 %s), +>5 byte x version %d, +>6 byte x %d tracks, +>122 byte&0x2 =1 dual PAL/NTSC +>122 byte&0x1 =1 PAL +>122 byte&0x1 =0 NTSC + +# Type: SNES SPC700 sound files +# From: Josh Triplett <josh@freedesktop.org> +0 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file +>&0 string 0.30 \b, version %s +>>0x23 byte 0x1B \b, without ID666 tag +>>0x23 byte 0x1A \b, with ID666 tag +>>>0x2E string >\0 \b, song "%.32s" +>>>0x4E string >\0 \b, game "%.32s" + +# Impulse tracker module (audio/x-it) +0 string IMPM Impulse Tracker module sound data - +!:mime audio/x-mod +>4 string >\0 "%s" +>40 leshort !0 compatible w/ITv%x +>42 leshort !0 created w/ITv%x + +# Imago Orpheus module (audio/x-imf) +60 string IM10 Imago Orpheus module sound data - +>0 string >\0 "%s" + +# From <collver1@attbi.com> +# These are the /etc/magic entries to decode modules, instruments, and +# samples in Impulse Tracker's native format. + +0 string IMPS Impulse Tracker Sample +>18 byte &2 16 bit +>18 byte ^2 8 bit +>18 byte &4 stereo +>18 byte ^4 mono +0 string IMPI Impulse Tracker Instrument +>28 leshort !0 ITv%x +>30 byte !0 %d samples + +# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files +# From <collver1@attbi.com> +0 string LM8953 Yamaha TX Wave +>22 byte 0x49 looped +>22 byte 0xC9 non-looped +>23 byte 1 33kHz +>23 byte 2 50kHz +>23 byte 3 16kHz + +# scream tracker: file(1) magic for Scream Tracker sample files +# +# From <collver1@attbi.com> +76 string SCRS Scream Tracker Sample +>0 byte 1 sample +>0 byte 2 adlib melody +>0 byte >2 adlib drum +>31 byte &2 stereo +>31 byte ^2 mono +>31 byte &4 16bit little endian +>31 byte ^4 8bit +>30 byte 0 unpacked +>30 byte 1 packed + +# audio +# From: Cory Dikkers <cdikkers@swbell.net> +0 string MMD0 MED music file, version 0 +0 string MMD1 OctaMED Pro music file, version 1 +0 string MMD3 OctaMED Soundstudio music file, version 3 +0 string OctaMEDCmpr OctaMED Soundstudio compressed file +0 string MED MED_Song +0 string SymM Symphonie SymMOD music file +# +0 string THX AHX version +>3 byte =0 1 module data +>3 byte =1 2 module data +# +0 string OKTASONG Oktalyzer module data +# +0 string DIGI\ Booster\ module\0 %s +>20 byte >0 %c +>>21 byte >0 \b%c +>>>22 byte >0 \b%c +>>>>23 byte >0 \b%c +>610 string >\0 \b, "%s" +# +0 string DBM0 DIGI Booster Pro Module +>4 byte >0 V%X. +>>5 byte x \b%02X +>16 string >\0 \b, "%s" +# +0 string FTMN FaceTheMusic module +>16 string >\0d \b, "%s" + +# From: <doj@cubic.org> 2003-06-24 +0 string AMShdr\32 Velvet Studio AMS Module v2.2 +0 string Extreme Extreme Tracker AMS Module v1.3 +0 string DDMF Xtracker DMF Module +>4 byte x v%i +>0xD string >\0 Title: "%s" +>0x2B string >\0 Composer: "%s" +0 string DSM\32 Dynamic Studio Module DSM +0 string SONG DigiTrekker DTM Module +0 string DMDL DigiTrakker MDL Module +0 string PSM\32 Protracker Studio PSM Module +44 string PTMF Poly Tracker PTM Module +>0 string >\32 Title: "%s" +0 string MT20 MadTracker 2.0 Module MT2 +0 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD +0 string RTMM RTM Module +0x426 string MaDoKaN96 XMS Adlib Module +>0 string >\0 Composer: "%s" +0 string AMF AMF Module +>4 string >\0 Title: "%s" +0 string MODINFO1 Open Cubic Player Module Inforation MDZ +0 string Extended\40Instrument: Fast Tracker II Instrument + +# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> +# NOA Nancy Codec file +0 string \210NOA\015\012\032 NOA Nancy Codec Movie file +# Yamaha SMAF format +0 string MMMD Yamaha SMAF file +# Sharp Jisaku Melody format for PDC +0 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody +>20 string Ver01.00 Ver. 1.00 +>>32 byte x , %d tracks + +# Free lossless audio codec <http://flac.sourceforge.net> +# From: Przemyslaw Augustyniak <silvathraec@rpg.pl> +0 string fLaC FLAC audio bitstream data +!:mime audio/x-flac +>4 byte&0x7f >0 \b, unknown version +>4 byte&0x7f 0 \b +# some common bits/sample values +>>20 beshort&0x1f0 0x030 \b, 4 bit +>>20 beshort&0x1f0 0x050 \b, 6 bit +>>20 beshort&0x1f0 0x070 \b, 8 bit +>>20 beshort&0x1f0 0x0b0 \b, 12 bit +>>20 beshort&0x1f0 0x0f0 \b, 16 bit +>>20 beshort&0x1f0 0x170 \b, 24 bit +>>20 byte&0xe 0x0 \b, mono +>>20 byte&0xe 0x2 \b, stereo +>>20 byte&0xe 0x4 \b, 3 channels +>>20 byte&0xe 0x6 \b, 4 channels +>>20 byte&0xe 0x8 \b, 5 channels +>>20 byte&0xe 0xa \b, 6 channels +>>20 byte&0xe 0xc \b, 7 channels +>>20 byte&0xe 0xe \b, 8 channels +# some common sample rates +>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz +>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz +>>17 belong&0xfffff0 0x07d000 \b, 32 kHz +>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz +>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz +>>17 belong&0xfffff0 0x03e800 \b, 16 kHz +>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz +>>17 belong&0xfffff0 0x02ee00 \b, 12 kHz +>>17 belong&0xfffff0 0x01f400 \b, 8 kHz +>>17 belong&0xfffff0 0x177000 \b, 96 kHz +>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz +>>21 byte&0xf >0 \b, >4G samples +>>21 byte&0xf 0 \b +>>>22 belong >0 \b, %u samples +>>>22 belong 0 \b, length unknown + +# (ISDN) VBOX voice message file (Wolfram Kleff) +0 string VBOX VBOX voice message data + +# ReBorn Song Files (.rbs) +# David J. Singer <doc@deadvirgins.org.uk> +8 string RB40 RBS Song file +>29 string ReBorn created by ReBorn +>37 string Propellerhead created by ReBirth + +# Synthesizer Generator and Kimwitu share their file format +0 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data +# Kimwitu++ uses a slightly different magic +0 string A#S#C#S#S#L#HUB Kimwitu++ data + +# From "Simon Hosie +0 string TFMX-SONG TFMX module sound data + +# Monkey's Audio compressed audio format (.ape) +# From danny.milo@gmx.net (Danny Milosavljevic) +# New version from Abel Cheung <abel (@) oaka.org> +0 string MAC\040 Monkey's Audio compressed format +!:mime audio/x-ape +>4 uleshort >0x0F8B version %d +>>(0x08.l) uleshort =1000 with fast compression +>>(0x08.l) uleshort =2000 with normal compression +>>(0x08.l) uleshort =3000 with high compression +>>(0x08.l) uleshort =4000 with extra high compression +>>(0x08.l) uleshort =5000 with insane compression +>>(0x08.l+18) uleshort =1 \b, mono +>>(0x08.l+18) uleshort =2 \b, stereo +>>(0x08.l+20) ulelong x \b, sample rate %d +>4 uleshort <0x0F8C version %d +>>6 uleshort =1000 with fast compression +>>6 uleshort =2000 with normal compression +>>6 uleshort =3000 with high compression +>>6 uleshort =4000 with extra high compression +>>6 uleshort =5000 with insane compression +>>10 uleshort =1 \b, mono +>>10 uleshort =2 \b, stereo +>>12 ulelong x \b, sample rate %d + +# adlib sound files +# From Gurkan Sengun <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu +0 string RAWADATA RdosPlay RAW + +1068 string RoR AMUSIC Adlib Tracker + +0 string JCH EdLib + +0 string mpu401tr MPU-401 Trakker + +0 string SAdT Surprise! Adlib Tracker +>4 byte x Version %d + +0 string XAD! eXotic ADlib + +0 string ofTAZ! eXtra Simple Music + +# Spectrum 128 tunes (.ay files). +# From: Emanuel Haupt <ehaupt@critical.ch> +0 string ZXAYEMUL Spectrum 128 tune + +0 string \0BONK BONK, +#>5 byte x version %d +>14 byte x %d channel(s), +>15 byte =1 lossless, +>15 byte =0 lossy, +>16 byte x mid-side + +384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) + +# format VQF (proprietary codec for sound) +# some infos on the header file available at : +# http://www.twinvq.org/english/technology_format.html +0 string TWIN97012000 VQF data +>27 short 0 \b, Mono +>27 short 1 \b, Stereo +>31 short >0 \b, %d kbit/s +>35 short >0 \b, %d kHz + +# Nelson A. de Oliveira (naoliv@gmail.com) +# .eqf +0 string Winamp\ EQ\ library\ file %s +# it will match only versions like v<digit>.<digit> +# Since I saw only eqf files with version v1.1 I think that it's OK +>23 string x \b%.4s +# .preset +0 string [Equalizer\ preset] XMMS equalizer preset +# .m3u +0 search/1 #EXTM3U M3U playlist text +# .pls +0 search/1 [playlist] PLS playlist text +# licq.conf +1 string [licq] LICQ configuration file + +# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> +0 string ICE! SNDH Atari ST music +0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music + +# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> +0 string MP+ Musepack audio +!:mime audio/x-musepack +>3 byte 255 \b, SV pre8 +>3 byte&0xF 0x6 \b, SV 6 +>3 byte&0xF 0x8 \b, SV 8 +>3 byte&0xF 0x7 \b, SV 7 +>>3 byte&0xF0 0x0 \b.0 +>>3 byte&0xF0 0x10 \b.1 +>>3 byte&0xF0 240 \b.15 +>>10 byte&0xF0 0x0 \b, no profile +>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' +>>10 byte&0xF0 0x50 \b, quality 0 +>>10 byte&0xF0 0x60 \b, quality 1 +>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) +>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) +>>10 byte&0xF0 0x90 \b, quality 4 (Radio) +>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) +>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) +>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) +>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) +>>10 byte&0xF0 0xE0 \b, quality 9 +>>10 byte&0xF0 0xF0 \b, quality 10 +>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 +>>27 byte 102 \b, Beta 1.02 +>>27 byte 104 \b, Beta 1.04 +>>27 byte 105 \b, Alpha 1.05 +>>27 byte 106 \b, Beta 1.06 +>>27 byte 110 \b, Release 1.1 +>>27 byte 111 \b, Alpha 1.11 +>>27 byte 112 \b, Beta 1.12 +>>27 byte 113 \b, Alpha 1.13 +>>27 byte 114 \b, Beta 1.14 +>>27 byte 115 \b, Alpha 1.15 + +# IMY +# from http://filext.com/detaillist.php?extdetail=IMY +# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm +# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html +# http://www.wx800.com/msg/download/irda/iMelody.pdf +0 string BEGIN:IMELODY iMelody Ringtone Format + +# From: "Mateus Caruccio" <mateus@caruccio.com> +# guitar pro v3,4,5 from http://filext.com/file-extension/gp3 +0 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature + +# From: "Leslie P. Polzer" <leslie.polzer@gmx.net> +60 string SONG SoundFX Module sound file + +# Type: Adaptive Multi-Rate Codec +# URL: http://filext.com/detaillist.php?extdetail=AMR +# From: Russell Coker <russell@coker.com.au> +0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) + +# Type: SuperCollider 3 Synth Definition File Format +# From: Mario Lang <mlang@debian.org> +0 string SCgf SuperCollider3 Synth Definition file, +>4 belong x version %d + +# Type: True Audio Lossless Audio +# URL: http://wiki.multimedia.cx/index.php?title=True_Audio +# From: Mike Melanson <mike@multimedia.cx> +0 string TTA1 True Audio Lossless Audio + +# Type: WavPack Lossless Audio +# URL: http://wiki.multimedia.cx/index.php?title=WavPack +# From: Mike Melanson <mike@multimedia.cx> +0 string wvpk WavPack Lossless Audio diff --git a/magic/Magdir/basis b/magic/Magdir/basis new file mode 100644 index 0000000..128aa4c --- /dev/null +++ b/magic/Magdir/basis @@ -0,0 +1,18 @@ + +#---------------------------------------------------------------- +# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $ +# basis: file(1) magic for BBx/Pro5-files +# Oliver Dammer <dammer@olida.de> 2005/11/07 +# http://www.basis.com business-basic-files. +# +0 string \074\074bbx\076\076 BBx +>7 string \000 indexed file +>7 string \001 serial file +>7 string \002 keyed file +>>13 short 0 (sort) +>7 string \004 program +>>18 byte x (LEVEL %d) +>>>23 string >\000 psaved +>7 string \006 mkeyed file +>>13 short 0 (sort) +>>8 string \000 (mkey) diff --git a/magic/Magdir/bflt b/magic/Magdir/bflt new file mode 100644 index 0000000..03eb59d --- /dev/null +++ b/magic/Magdir/bflt @@ -0,0 +1,14 @@ + +#------------------------------------------------------------------------------ +# $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $ +# bFLT: file(1) magic for BFLT uclinux binary files +# +# From Philippe De Muyter <phdm@macqel.be> +# +0 string bFLT BFLT executable +>4 belong x - version %ld +>4 belong 4 +>>36 belong&0x1 0x1 ram +>>36 belong&0x2 0x2 gotpic +>>36 belong&0x4 0x4 gzip +>>36 belong&0x8 0x8 gzdata diff --git a/magic/Magdir/blcr b/magic/Magdir/blcr new file mode 100644 index 0000000..70ea563 --- /dev/null +++ b/magic/Magdir/blcr @@ -0,0 +1,25 @@ +# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files +# http://ftg.lbl.gov/checkpoint +0 string C\0\0\0R\0\0\0 BLCR +>16 lelong 1 x86 +>16 lelong 3 alpha +>16 lelong 5 x86-64 +>16 lelong 7 ARM +>8 lelong x context data (little endian, version %d) +# Uncomment the following only of your "file" program supports "search" +#>0 search/1024 VMA\06 for kernel +#>>&1 byte x %d. +#>>&2 byte x %d. +#>>&3 byte x %d +0 string \0\0\0C\0\0\0R BLCR +>16 belong 2 SPARC +>16 belong 4 ppc +>16 belong 6 ppc64 +>16 belong 7 ARMEB +>16 belong 8 SPARC64 +>8 belong x context data (big endian, version %d) +# Uncomment the following only of your "file" program supports "search" +#>0 search/1024 VMA\06 for kernel +#>>&1 byte x %d. +#>>&2 byte x \b%d. +#>>&3 byte x \b%d diff --git a/magic/Magdir/blender b/magic/Magdir/blender new file mode 100644 index 0000000..1814738 --- /dev/null +++ b/magic/Magdir/blender @@ -0,0 +1,39 @@ + +#------------------------------------------------------------------------------ +# $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $ +# blender: file(1) magic for Blender 3D related files +# +# Native format rule v1.2. For questions use the developers list +# http://lists.blender.org/mailman/listinfo/bf-committers +# GLOB chunk was moved near start and provides subversion info since 2.42 + +0 string =BLENDER Blender3D, +>7 string =_ saved as 32-bits +>>8 string =v little endian +>>>9 byte x with version %c. +>>>10 byte x \b%c +>>>11 byte x \b%c +>>>0x40 string =GLOB \b. +>>>>0x58 leshort x \b%.4d +>>8 string =V big endian +>>>9 byte x with version %c. +>>>10 byte x \b%c +>>>11 byte x \b%c +>>>0x40 string =GLOB \b. +>>>>0x58 beshort x \b%.4d +>7 string =- saved as 64-bits +>>8 string =v little endian +>>9 byte x with version %c. +>>10 byte x \b%c +>>11 byte x \b%c +>>0x44 string =GLOB \b. +>>>0x60 leshort x \b%.4d +>>8 string =V big endian +>>>9 byte x with version %c. +>>>10 byte x \b%c +>>>11 byte x \b%c +>>>0x44 string =GLOB \b. +>>>>0x60 beshort x \b%.4d + +# Scripts that run in the embeded Python interpreter +0 string #!BPY Blender3D BPython script diff --git a/magic/Magdir/blit b/magic/Magdir/blit new file mode 100644 index 0000000..d5b687f --- /dev/null +++ b/magic/Magdir/blit @@ -0,0 +1,20 @@ + +#------------------------------------------------------------------------------ +# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $ +# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine +# +# Note that this 0407 conflicts with several other a.out formats... +# +# XXX - should this be redone with "be" and "le", so that it works on +# little-endian machines as well? If so, what's the deal with +# "VAX-order" and "VAX-order2"? +# +#0 long 0407 68K Blit (standalone) executable +#0 short 0407 VAX-order2 68K Blit (standalone) executable +0 short 03401 VAX-order 68K Blit (standalone) executable +0 long 0406 68k Blit mpx/mux executable +0 short 0406 VAX-order2 68k Blit mpx/mux executable +0 short 03001 VAX-order 68k Blit mpx/mux executable +# Need more values for WE32 DMD executables. +# Note that 0520 is the same as COFF +#0 short 0520 tty630 layers executable diff --git a/magic/Magdir/bout b/magic/Magdir/bout new file mode 100644 index 0000000..693cc2a --- /dev/null +++ b/magic/Magdir/bout @@ -0,0 +1,11 @@ + +#------------------------------------------------------------------------------ +# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $ +# i80960 b.out objects and archives +# +0 long 0x10d i960 b.out relocatable object +>16 long >0 not stripped +# +# b.out archive (hp-rt on i960) +0 string =!<bout> b.out archive +>8 string __.SYMDEF random library diff --git a/magic/Magdir/bsdi b/magic/Magdir/bsdi new file mode 100644 index 0000000..e8a6c35 --- /dev/null +++ b/magic/Magdir/bsdi @@ -0,0 +1,33 @@ + +#------------------------------------------------------------------------------ +# $File: bsdi,v 1.6 2013/01/09 22:37:24 christos Exp $ +# bsdi: file(1) magic for BSD/OS (from BSDI) objects +# Some object/executable formats use the same magic numbers as are used +# in other OSes; those are handled by entries in aout. +# + +0 lelong 0314 386 compact demand paged pure executable +>16 lelong >0 not stripped +>32 byte 0x6a (uses shared libs) + +# same as in SunOS 4.x, except for static shared libraries +0 belong&077777777 0600413 sparc demand paged +>0 byte &0x80 +>>20 belong <4096 shared library +>>20 belong =4096 dynamically linked executable +>>20 belong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +>36 belong 0xb4100001 (uses shared libs) + +0 belong&077777777 0600410 sparc pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +>36 belong 0xb4100001 (uses shared libs) + +0 belong&077777777 0600407 sparc +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +>36 belong 0xb4100001 (uses shared libs) diff --git a/magic/Magdir/bsi b/magic/Magdir/bsi new file mode 100644 index 0000000..51a6289 --- /dev/null +++ b/magic/Magdir/bsi @@ -0,0 +1,9 @@ +# Chiasmus is a encryption standard developed by the German Federal +# Office for Information Security (Bundesamt fuer Sicherheit in der +# Informationstechnik). + +# Extension: .xia +0 string XIA1 Chiasmus encrypted data + +# Extension: .xis +0 string XIS Chiasmus key diff --git a/magic/Magdir/btsnoop b/magic/Magdir/btsnoop new file mode 100644 index 0000000..d72daad --- /dev/null +++ b/magic/Magdir/btsnoop @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $ +# BTSnoop: file(1) magic for BTSnoop files +# +# From <marcel@holtmann.org> +0 string btsnoop\0 BTSnoop +>8 belong x version %d, +>12 belong 1001 Unencapsulated HCI +>12 belong 1002 HCI UART (H4) +>12 belong 1003 HCI BCSP +>12 belong 1004 HCI Serial (H5) +>>12 belong x type %d diff --git a/magic/Magdir/c-lang b/magic/Magdir/c-lang new file mode 100644 index 0000000..41dfb62 --- /dev/null +++ b/magic/Magdir/c-lang @@ -0,0 +1,57 @@ +#------------------------------------------------------------------------------ +# $File: c-lang,v 1.17 2012/04/28 21:20:26 christos Exp $ +# c-lang: file(1) magic for C and related languages programs +# + +# BCPL +0 search/8192 "libhdr" BCPL source text +!:mime text/x-bcpl +0 search/8192 "LIBHDR" BCPL source text +!:mime text/x-bcpl + +# C +0 regex \^#include C source text +!:mime text/x-c +0 regex \^char C source text +!:mime text/x-c +0 regex \^double C source text +!:mime text/x-c +0 regex \^extern C source text +!:mime text/x-c +0 regex \^float C source text +!:mime text/x-c +0 regex \^struct C source text +!:mime text/x-c +0 regex \^union C source text +!:mime text/x-c +0 search/8192 main( C source text +!:mime text/x-c + +# C++ +# The strength of these rules is increased so they beat the C rules above +0 regex \^template C++ source text +!:strength + 5 +!:mime text/x-c++ +0 regex \^virtual C++ source text +!:strength + 5 +!:mime text/x-c++ +0 regex \^class C++ source text +!:strength + 5 +!:mime text/x-c++ +0 regex \^public: C++ source text +!:strength + 5 +!:mime text/x-c++ +0 regex \^private: C++ source text +!:strength + 5 +!:mime text/x-c++ + +# From: Mikhail Teterin <mi@aldan.algebra.com> +0 string cscope cscope reference data +>7 string x version %.2s +# We skip the path here, because it is often long (so file will +# truncate it) and mostly redundant. +# The inverted index functionality was added some time betwen +# versions 11 and 15, so look for -q if version is above 14: +>7 string >14 +>>10 search/100 \ -q\ with inverted index +>10 search/100 \ -c\ text (non-compressed) diff --git a/magic/Magdir/c64 b/magic/Magdir/c64 new file mode 100644 index 0000000..eea3e31 --- /dev/null +++ b/magic/Magdir/c64 @@ -0,0 +1,43 @@ + +#------------------------------------------------------------------------------ +# $File: c64,v 1.5 2009/09/19 16:28:08 christos Exp $ +# c64: file(1) magic for various commodore 64 related files +# +# From: Dirk Jagdmann <doj@cubic.org> + +0x16500 belong 0x12014100 D64 Image +0x16500 belong 0x12014180 D71 Image +0x61800 belong 0x28034400 D81 Image +0 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image +0 belong 0x43154164 X64 Image + +0 string GCR-1541 GCR Image +>8 byte x version: %i +>9 byte x tracks: %i + +9 string PSUR ARC archive (c64) +2 string -LH1- LHA archive (c64) + +0 string C64File PC64 Emulator file +>8 string >\0 "%s" +0 string C64Image PC64 Freezer Image + +0 beshort 0x38CD C64 PCLink Image +0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot + +0 belong 0xFF424CFF WRAptor packer (c64) + +0 string C64S\x20tape\x20file T64 tape Image +>32 leshort x Version:0x%x +>36 leshort !0 Entries:%i +>40 string x Name:%.24s + +0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image +>32 leshort x Version:0x%x +>36 leshort !0 Entries:%i +>40 string x Name:%.24s + +0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image +>32 leshort x Version:0x%x +>36 leshort !0 Entries:%i +>40 string x Name:%.24s diff --git a/magic/Magdir/cad b/magic/Magdir/cad new file mode 100644 index 0000000..cc4ef34 --- /dev/null +++ b/magic/Magdir/cad @@ -0,0 +1,118 @@ + +#------------------------------------------------------------------------------ +# $File: cad,v 1.11 2011/12/08 12:12:46 rrt Exp $ +# autocad: file(1) magic for cad files +# + +# AutoCAD DWG versions R13/R14 (www.autodesk.com) +# Written December 01, 2003 by Lester Hightower +# Based on the DWG File Format Specifications at http://www.opendwg.org/ +0 string \101\103\061\060\061 AutoCAD +>5 string \062\000\000\000\000 DWG ver. R13 +>5 string \064\000\000\000\000 DWG ver. R14 + +# Microstation DGN/CIT Files (www.bentley.com) +# Last updated July 29, 2005 by Lester Hightower +# DGN is the default file extension of Microstation/Intergraph CAD files. +# CIT is the proprietary raster format (similar to TIFF) used to attach +# raster underlays to Microstation DGN (vector) drawings. +# +# http://www.wotsit.org/search.asp +# http://filext.com/detaillist.php?extdetail=DGN +# http://filext.com/detaillist.php?extdetail=CIT +# +# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 +# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 +# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 +# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F +0 string \010\011\376 Microstation +>3 string \002 +>>30 string \026\105 DGNFile +>>30 string \034\105 DGNFile +>>30 string \073\107 DGNFile +>>30 string \073\110 DGNFile +>>30 string \106\107 DGNFile +>>30 string \110\103 DGNFile +>>30 string \120\104 DGNFile +>>30 string \172\104 DGNFile +>>30 string \172\105 DGNFile +>>30 string \172\106 DGNFile +>>30 string \234\106 DGNFile +>>30 string \273\105 DGNFile +>>30 string \306\106 DGNFile +>>30 string \310\104 DGNFile +>>30 string \341\104 DGNFile +>>30 string \372\103 DGNFile +>>30 string \372\104 DGNFile +>>30 string \372\106 DGNFile +>>30 string \376\103 DGNFile +>4 string \030\000\000 CITFile +>4 string \030\000\003 CITFile + +# AutoCad, from Nahuel Greco +# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) +0 string AC1012 DWG AutoDesk AutoCad (release 12) +0 string AC1013 DWG AutoDesk AutoCad (release 13) +0 string AC1014 DWG AutoDesk AutoCad (release 14) +# A new version of AutoCAD DWG +# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, +# ICQ 358572321) +# From various sources like: +# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html +0 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 +0 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 +0 string AC1024 DWG AutoDesk AutoCAD 2010/2011 + +# KOMPAS 2D drawing from ASCON +# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor +# gathered nor specification +# ASCON http://ascon.net/main/ in English, +# http://ascon.ru/ main site in Russian +# Extension is CDW for drawing and FRW for fragment of drawing +# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, +# ICQ 358572321, http://vkontakte.ru/id16076543) +# From: +# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 +# (in russian) and my experiments +0 string KF +>2 belong 0x4E00000C Kompas drawing 12.0 SP1 +>2 belong 0x4D00000C Kompas drawing 12.0 +>2 belong 0x3200000B Kompas drawing 11.0 SP1 +>2 belong 0x3100000B Kompas drawing 11.0 +>2 belong 0x2310000A Kompas drawing 10.0 SP1 +>2 belong 0x2110000A Kompas drawing 10.0 +>2 belong 0x08000009 Kompas drawing 9.0 SP1 +>2 belong 0x05000009 Kompas drawing 9.0 +>2 belong 0x33010008 Kompas drawing 8+ +>2 belong 0x1A000008 Kompas drawing 8.0 +>2 belong 0x2C010107 Kompas drawing 7+ +>2 belong 0x05000007 Kompas drawing 7.0 +>2 belong 0x32000006 Kompas drawing 6+ +>2 belong 0x09000006 Kompas drawing 6.0 +>2 belong 0x5C009005 Kompas drawing 5.11R03 +>2 belong 0x54009005 Kompas drawing 5.11R02 +>2 belong 0x51009005 Kompas drawing 5.11R01 +>2 belong 0x22009005 Kompas drawing 5.10R03 +>2 belong 0x22009005 Kompas drawing 5.10R02 mar +>2 belong 0x21009005 Kompas drawing 5.10R02 febr +>2 belong 0x19009005 Kompas drawing 5.10R01 +>2 belong 0xF4008005 Kompas drawing 5.9R01.003 +>2 belong 0x1C008005 Kompas drawing 5.9R01.002 +>2 belong 0x11008005 Kompas drawing 5.8R01.003 + +# CAD: file(1) magic for computer aided design files +# Phillip Griffith <phillip dot griffith at gmail dot com> +# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. +# +0 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library +0 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD +0 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD +0 beshort 0x0809 Bentley/Intergraph MicroStation +>0x02 byte 0xfe +>>0x04 beshort 0x1800 CIT raster CAD +0 string AC1012 AutoDesk AutoCAD R13 +0 string AC1014 AutoDesk AutoCAD R14 +0 string AC1015 AutoDesk AutoCAD R2000 + +# 3DS (3d Studio files) Conflicts with diff output 0x3d '=' +#16 beshort 0x3d3d image/x-3ds diff --git a/magic/Magdir/cafebabe b/magic/Magdir/cafebabe new file mode 100644 index 0000000..ea4846d --- /dev/null +++ b/magic/Magdir/cafebabe @@ -0,0 +1,78 @@ + +#------------------------------------------------------------------------------ +# $File: cafebabe,v 1.12 2013/01/11 16:45:23 christos Exp $ +# Cafe Babes unite! +# +# Since Java bytecode and Mach-O universal binaries have the same magic number, +# the test must be performed in the same "magic" sequence to get both right. +# The long at offset 4 in a Mach-O universal binary tells the number of +# architectures; the short at offset 4 in a Java bytecode file is the JVM minor +# version and the short at offset 6 is the JVM major version. Since there are only +# only 18 labeled Mach-O architectures at current, and the first released +# Java class format was version 43.0, we can safely choose any number +# between 18 and 39 to test the number of architectures against +# (and use as a hack). Let's not use 18, because the Mach-O people +# might add another one or two as time goes by... +# +### JAVA START ### +0 belong 0xcafebabe +!:mime application/x-java-applet +>4 belong >30 compiled Java class data, +>>6 beshort x version %d. +>>4 beshort x \b%d +# Which is which? +#>>4 belong 0x032d (Java 1.0) +#>>4 belong 0x032d (Java 1.1) +>>4 belong 0x002e (Java 1.2) +>>4 belong 0x002f (Java 1.3) +>>4 belong 0x0030 (Java 1.4) +>>4 belong 0x0031 (Java 1.5) +>>4 belong 0x0032 (Java 1.6) + +0 belong 0xcafed00d JAR compressed with pack200, +>5 byte x version %d. +>4 byte x \b%d +!:mime application/x-java-pack200 + + +0 belong 0xcafed00d JAR compressed with pack200, +>5 byte x version %d. +>4 byte x \b%d +!:mime application/x-java-pack200 + +### JAVA END ### +### MACH-O START ### + +# 16777216 = 0x01000000 +0 name mach-o \b [ +>0 belong 0xffffffff \bAny +>0 belong 1 \bVax +>0 belong 6 \bMC680x0 +>0 belong 7 \bI386 +>0 belong 8 \bMIPS +>0 belong 10 \bMC98000 +>0 belong 11 \bHPPA +>0 belong 12 \bARM +>0 belong 13 \bMC88000 +>0 belong 14 \bSPARC +>0 belong 15 \bI860 +>0 belong 16 \bALPHA +>0 belong 17 \bPOWERPC +>0 belong 16777223 \bX86_64 +>0 belong 16777233 \bPOWERPC64 +>&(8.L) indirect : +>0 belong x \b] + +0 belong 0xcafebabe +>4 belong 1 Mach-O universal binary with 1 architecture: +>>8 use mach-o +>4 belong >1 +>>4 belong <20 Mach-O universal binary with %ld architectures: +>>>8 use mach-o +>>>28 use mach-o +>>>4 belong >2 +>>>>48 use mach-o +>>>>>4 belong >3 +>>>>>68 use mach-o + +### MACH-O END ### diff --git a/magic/Magdir/cddb b/magic/Magdir/cddb new file mode 100644 index 0000000..5d8a851 --- /dev/null +++ b/magic/Magdir/cddb @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $ +# CDDB: file(1) magic for CDDB(tm) format CD text data files +# +# From <steve@gracenote.com> +# +# This is the /etc/magic entry to decode datafiles as used by +# CDDB-enabled CD player applications. +# + +0 search/1/w #\040xmcd CDDB(tm) format CD text data diff --git a/magic/Magdir/chord b/magic/Magdir/chord new file mode 100644 index 0000000..00d0bec --- /dev/null +++ b/magic/Magdir/chord @@ -0,0 +1,15 @@ + +#------------------------------------------------------------------------------ +# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $ +# chord: file(1) magic for Chord music sheet typesetting utility input files +# +# From Philippe De Muyter <phdm@macqel.be> +# File format is actually free, but many distributed files begin with `{title' +# +0 string {title Chord text file + +# Type: PowerTab file format +# URL: http://www.power-tab.net/ +# From: Jelmer Vernooij <jelmer@samba.org> +0 string ptab\003\000 Power-Tab v3 Tablature File +0 string ptab\004\000 Power-Tab v4 Tablature File diff --git a/magic/Magdir/cisco b/magic/Magdir/cisco new file mode 100644 index 0000000..0279bbb --- /dev/null +++ b/magic/Magdir/cisco @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $ +# cisco: file(1) magic for cisco Systems routers +# +# Most cisco file-formats are covered by the generic elf code +# +# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. +0 belong&0xffffff00 0x85011400 cisco IOS microcode +>7 string >\0 for '%s' +0 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode +>7 string >\0 for '%s' diff --git a/magic/Magdir/citrus b/magic/Magdir/citrus new file mode 100644 index 0000000..ff2471e --- /dev/null +++ b/magic/Magdir/citrus @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $ +# citrus locale declaration +# + +0 string RuneCT Citrus locale declaration for LC_CTYPE + diff --git a/magic/Magdir/clarion b/magic/Magdir/clarion new file mode 100644 index 0000000..cff7a3b --- /dev/null +++ b/magic/Magdir/clarion @@ -0,0 +1,27 @@ + +#------------------------------------------------------------------------------ +# $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $ +# clarion: file(1) magic for # Clarion Personal/Professional Developer +# (v2 and above) +# From: Julien Blache <jb@jblache.org> + +# Database files +# signature +0 leshort 0x3343 Clarion Developer (v2 and above) data file +# attributes +>2 leshort &0x0001 \b, locked +>2 leshort &0x0004 \b, encrypted +>2 leshort &0x0008 \b, memo file exists +>2 leshort &0x0010 \b, compressed +>2 leshort &0x0040 \b, read only +# number of records +>5 lelong x \b, %ld records + +# Memo files +0 leshort 0x334d Clarion Developer (v2 and above) memo data + +# Key/Index files +# No magic? :( + +# Help files +0 leshort 0x49e0 Clarion Developer (v2 and above) help data diff --git a/magic/Magdir/claris b/magic/Magdir/claris new file mode 100644 index 0000000..3f447bc --- /dev/null +++ b/magic/Magdir/claris @@ -0,0 +1,47 @@ + +#------------------------------------------------------------------------------ +# $File: claris,v 1.6 2012/06/20 21:19:05 christos Exp $ +# claris: file(1) magic for claris +# "H. Nanosecond" <aldomel@ix.netcom.com> +# Claris Works a word processor, etc. +# Version 3.0 + +# .pct claris works clip art files +#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 +#* +#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 +#null to byte 1000 octal +514 string \377\377\377\377\000 +>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art +514 string \377\377\377\377\001 +>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art + +# Claris works files +# .cwk +0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document +# .plt +0 string \020\341\000\000\010\010 Claris Works pallete files .plt + +# .msp a dictionary file I am not sure about this I have only one .msp file +0 string \002\271\262\000\040\002\000\164 Claris works dictionary + +# .usp are user dictionary bits +# I am not sure about a magic header: +#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 +# soh S p f 8 U D sp ^ S cr nl p o d i +#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 +# a t r i s t sp ^ S cr nl d i v sp # + +# .mth Thesaurus +# starts with \0 but no magic header + +# .chy Hyphenation file +# I am not sure: 000 210 034 000 000 + +# other claris files +#./windows/claris/useng.ndx: data +#./windows/claris/xtndtran.l32: data +#./windows/claris/xtndtran.lst: data +#./windows/claris/clworks.lbl: data +#./windows/claris/clworks.prf: data +#./windows/claris/userd.spl: data diff --git a/magic/Magdir/clipper b/magic/Magdir/clipper new file mode 100644 index 0000000..9f47534 --- /dev/null +++ b/magic/Magdir/clipper @@ -0,0 +1,65 @@ + +#------------------------------------------------------------------------------ +# $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $ +# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. +# +# XXX - what byte order does the Clipper use? +# +# XXX - what's the "!" stuff: +# +# >18 short !074000,000000 C1 R1 +# >18 short !074000,004000 C2 R1 +# >18 short !074000,010000 C3 R1 +# >18 short !074000,074000 TEST +# +# I shall assume it's ANDing the field with the first value and +# comparing it with the second, and rewrite it as: +# +# >18 short&074000 000000 C1 R1 +# >18 short&074000 004000 C2 R1 +# >18 short&074000 010000 C3 R1 +# >18 short&074000 074000 TEST +# +# as SVR3.1's "file" doesn't support anything of the "!074000,000000" +# sort, nor does SunOS 4.x, so either it's something Intergraph added +# in CLIX, or something AT&T added in SVR3.2 or later, or something +# somebody else thought was a good idea; it's not documented in the +# man page for this version of "magic", nor does it appear to be +# implemented (at least not after I blew off the bogus code to turn +# old-style "&"s into new-style "&"s, which just didn't work at all). +# +0 short 0575 CLIPPER COFF executable (VAX #) +>20 short 0407 (impure) +>20 short 0410 (5.2 compatible) +>20 short 0411 (pure) +>20 short 0413 (demand paged) +>20 short 0443 (target shared library) +>12 long >0 not stripped +>22 short >0 - version %ld +0 short 0577 CLIPPER COFF executable +>18 short&074000 000000 C1 R1 +>18 short&074000 004000 C2 R1 +>18 short&074000 010000 C3 R1 +>18 short&074000 074000 TEST +>20 short 0407 (impure) +>20 short 0410 (pure) +>20 short 0411 (separate I&D) +>20 short 0413 (paged) +>20 short 0443 (target shared library) +>12 long >0 not stripped +>22 short >0 - version %ld +>48 long&01 01 alignment trap enabled +>52 byte 1 -Ctnc +>52 byte 2 -Ctsw +>52 byte 3 -Ctpw +>52 byte 4 -Ctcb +>53 byte 1 -Cdnc +>53 byte 2 -Cdsw +>53 byte 3 -Cdpw +>53 byte 4 -Cdcb +>54 byte 1 -Csnc +>54 byte 2 -Cssw +>54 byte 3 -Cspw +>54 byte 4 -Cscb +4 string pipe CLIPPER instruction trace +4 string prof CLIPPER instruction profile diff --git a/magic/Magdir/commands b/magic/Magdir/commands new file mode 100644 index 0000000..157dae0 --- /dev/null +++ b/magic/Magdir/commands @@ -0,0 +1,95 @@ + +#------------------------------------------------------------------------------ +# $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $ +# commands: file(1) magic for various shells and interpreters +# +#0 string/w : shell archive or script for antique kernel text +0 string/wt #!\ /bin/sh POSIX shell script text executable +!:mime text/x-shellscript +0 string/wt #!\ /bin/csh C shell script text executable +!:mime text/x-shellscript +# korn shell magic, sent by George Wu, gwu@clyde.att.com +0 string/wt #!\ /bin/ksh Korn shell script text executable +!:mime text/x-shellscript +0 string/wt #!\ /bin/tcsh Tenex C shell script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable +!:mime text/x-shellscript + +# +# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) +0 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable +!:mime text/x-shellscript +0 string/wt #!\ /bin/nawk new awk script text executable +!:mime text/x-nawk +0 string/wt #!\ /usr/bin/nawk new awk script text executable +!:mime text/x-nawk +0 string/wt #!\ /usr/local/bin/nawk new awk script text executable +!:mime text/x-nawk +0 string/wt #!\ /bin/gawk GNU awk script text executable +!:mime text/x-gawk +0 string/wt #!\ /usr/bin/gawk GNU awk script text executable +!:mime text/x-gawk +0 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable +!:mime text/x-gawk +# +0 string/wt #!\ /bin/awk awk script text executable +!:mime text/x-awk +0 string/wt #!\ /usr/bin/awk awk script text executable +!:mime text/x-awk +0 regex =^\\s*BEGIN\\s*[{] awk script text + +# AT&T Bell Labs' Plan 9 shell +0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable + +# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) +0 string/wt #!\ /bin/bash Bourne-Again shell script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable +!:mime text/x-shellscript + +# PHP scripts +# Ulf Harnhammar <ulfh@update.uu.se> +0 search/1/c =<?php PHP script text +!:strength + 10 +!:mime text/x-php +0 search/1 =<?\n PHP script text +!:mime text/x-php +0 search/1 =<?\r PHP script text +!:mime text/x-php +0 search/1/w #!\ /usr/local/bin/php PHP script text executable +!:strength + 10 +!:mime text/x-php +0 search/1/w #!\ /usr/bin/php PHP script text executable +!:strength + 10 +!:mime text/x-php +# Smarty compiled template, http://www.smarty.net/ +# Elan Ruusamae <glen@delfi.ee> +0 string =<?php\ /*\ Smarty\ version Smarty compiled template +>24 regex [0-9.]+ \b, version %s +!:mime text/x-php + +0 string Zend\x00 PHP script Zend Optimizer data + +0 string/t $! DCL command file + +# Type: Pdmenu +# URL: http://packages.debian.org/pdmenu +# From: Edward Betts <edward@debian.org> +0 string #!/usr/bin/pdmenu Pdmenu configuration file text diff --git a/magic/Magdir/communications b/magic/Magdir/communications new file mode 100644 index 0000000..8e1d908 --- /dev/null +++ b/magic/Magdir/communications @@ -0,0 +1,22 @@ + +#---------------------------------------------------------------------------- +# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $ +# communication + +# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. +# It is used for conformance testing of communication protocols. +# Added by W. Borgert <debacle@debian.org>. +0 string $Suite TTCN Abstract Test Suite +>&1 string $SuiteId +>>&1 string >\n %s +>&2 string $SuiteId +>>&1 string >\n %s +>&3 string $SuiteId +>>&1 string >\n %s + +# MSC (message sequence charts) are a formal description technique, +# described in ITU-T Z.120, mainly used for communication protocols. +# Added by W. Borgert <debacle@debian.org>. +0 string mscdocument Message Sequence Chart (document) +0 string msc Message Sequence Chart (chart) +0 string submsc Message Sequence Chart (subchart) diff --git a/magic/Magdir/compress b/magic/Magdir/compress new file mode 100644 index 0000000..94c209d --- /dev/null +++ b/magic/Magdir/compress @@ -0,0 +1,231 @@ +#------------------------------------------------------------------------------ +# $File: compress,v 1.49 2011/12/07 22:04:27 christos Exp $ +# compress: file(1) magic for pure-compression formats (no archives) +# +# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. +# +# Formats for various forms of compressed data +# Formats for "compress" proper have been moved into "compress.c", +# because it tries to uncompress it to figure out what's inside. + +# standard unix compress +0 string \037\235 compress'd data +!:mime application/x-compress +!:apple LZIVZIVU +>2 byte&0x80 >0 block compressed +>2 byte&0x1f x %d bits + +# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) +# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 +# * Original filename is only at offset 10 if "extra field" absent +# * Produce shorter output - notably, only report compression methods +# other than 8 ("deflate", the only method defined in RFC 1952). +0 string \037\213 gzip compressed data +!:mime application/x-gzip +>2 byte <8 \b, reserved method +>2 byte >8 \b, unknown method +>3 byte &0x01 \b, ASCII +>3 byte &0x02 \b, has CRC +>3 byte &0x04 \b, extra field +>3 byte&0xC =0x08 +>>10 string x \b, was "%s" +>3 byte &0x10 \b, has comment +>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) +>9 byte =0x01 \b, from Amiga +>9 byte =0x02 \b, from VMS +>9 byte =0x03 \b, from Unix +>9 byte =0x04 \b, from VM/CMS +>9 byte =0x05 \b, from Atari +>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) +>9 byte =0x07 \b, from MacOS +>9 byte =0x08 \b, from Z-System +>9 byte =0x09 \b, from CP/M +>9 byte =0x0A \b, from TOPS/20 +>9 byte =0x0B \b, from NTFS filesystem (NT) +>9 byte =0x0C \b, from QDOS +>9 byte =0x0D \b, from Acorn RISCOS +>3 byte &0x10 \b, comment +>3 byte &0x20 \b, encrypted +>4 ledate >0 \b, last modified: %s +>8 byte 2 \b, max compression +>8 byte 4 \b, max speed + +# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis +0 string \037\036 packed data +!:mime application/octet-stream +>2 belong >1 \b, %d characters originally +>2 belong =1 \b, %d character originally +# +# This magic number is byte-order-independent. +0 short 0x1f1f old packed data +!:mime application/octet-stream + +# XXX - why *two* entries for "compacted data", one of which is +# byte-order independent, and one of which is byte-order dependent? +# +0 short 0x1fff compacted data +!:mime application/octet-stream +# This string is valid for SunOS (BE) and a matching "short" is listed +# in the Ultrix (LE) magic file. +0 string \377\037 compacted data +!:mime application/octet-stream +0 short 0145405 huf output +!:mime application/octet-stream + +# bzip2 +0 string BZh bzip2 compressed data +!:mime application/x-bzip2 +>3 byte >47 \b, block size = %c00k + +# lzip +0 string LZIP lzip compressed data +!:mime application/x-lzip +>4 byte x \b, version: %d + +# squeeze and crunch +# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> +0 beshort 0x76FF squeezed data, +>4 string x original name %s +0 beshort 0x76FE crunched data, +>2 string x original name %s +0 beshort 0x76FD LZH compressed data, +>2 string x original name %s + +# Freeze +0 string \037\237 frozen file 2.1 +0 string \037\236 frozen file 1.0 (or gzip 0.5) + +# SCO compress -H (LZH) +0 string \037\240 SCO compress -H (LZH) data + +# European GSM 06.10 is a provisional standard for full-rate speech +# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse +# excitation/long term prediction) coding at 13 kbit/s. +# +# There's only a magic nibble (4 bits); that nibble repeats every 33 +# bytes. This isn't suited for use, but maybe we can use it someday. +# +# This will cause very short GSM files to be declared as data and +# mismatches to be declared as data too! +#0 byte&0xF0 0xd0 data +#>33 byte&0xF0 0xd0 +#>66 byte&0xF0 0xd0 +#>99 byte&0xF0 0xd0 +#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio + +# bzip a block-sorting file compressor +# by Julian Seward <sewardj@cs.man.ac.uk> and others +# +#0 string BZ bzip compressed data +#>2 byte x \b, version: %c +#>3 string =1 \b, compression block size 100k +#>3 string =2 \b, compression block size 200k +#>3 string =3 \b, compression block size 300k +#>3 string =4 \b, compression block size 400k +#>3 string =5 \b, compression block size 500k +#>3 string =6 \b, compression block size 600k +#>3 string =7 \b, compression block size 700k +#>3 string =8 \b, compression block size 800k +#>3 string =9 \b, compression block size 900k + +# lzop from <markus.oberhumer@jk.uni-linz.ac.at> +0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data +>9 beshort <0x0940 +>>9 byte&0xf0 =0x00 - version 0. +>>9 beshort&0x0fff x \b%03x, +>>13 byte 1 LZO1X-1, +>>13 byte 2 LZO1X-1(15), +>>13 byte 3 LZO1X-999, +## >>22 bedate >0 last modified: %s, +>>14 byte =0x00 os: MS-DOS +>>14 byte =0x01 os: Amiga +>>14 byte =0x02 os: VMS +>>14 byte =0x03 os: Unix +>>14 byte =0x05 os: Atari +>>14 byte =0x06 os: OS/2 +>>14 byte =0x07 os: MacOS +>>14 byte =0x0A os: Tops/20 +>>14 byte =0x0B os: WinNT +>>14 byte =0x0E os: Win32 +>9 beshort >0x0939 +>>9 byte&0xf0 =0x00 - version 0. +>>9 byte&0xf0 =0x10 - version 1. +>>9 byte&0xf0 =0x20 - version 2. +>>9 beshort&0x0fff x \b%03x, +>>15 byte 1 LZO1X-1, +>>15 byte 2 LZO1X-1(15), +>>15 byte 3 LZO1X-999, +## >>25 bedate >0 last modified: %s, +>>17 byte =0x00 os: MS-DOS +>>17 byte =0x01 os: Amiga +>>17 byte =0x02 os: VMS +>>17 byte =0x03 os: Unix +>>17 byte =0x05 os: Atari +>>17 byte =0x06 os: OS/2 +>>17 byte =0x07 os: MacOS +>>17 byte =0x0A os: Tops/20 +>>17 byte =0x0B os: WinNT +>>17 byte =0x0E os: Win32 + +# 4.3BSD-Quasijarus Strong Compression +# http://minnie.tuhs.org/Quasijarus/compress.html +0 string \037\241 Quasijarus strong compressed data + +# From: Cory Dikkers <cdikkers@swbell.net> +0 string XPKF Amiga xpkf.library compressed data +0 string PP11 Power Packer 1.1 compressed data +0 string PP20 Power Packer 2.0 compressed data, +>4 belong 0x09090909 fast compression +>4 belong 0x090A0A0A mediocre compression +>4 belong 0x090A0B0B good compression +>4 belong 0x090A0C0C very good compression +>4 belong 0x090A0C0D best compression + +# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) +# http://www.7-zip.org or DOC/7zFormat.txt +# +0 string 7z\274\257\047\034 7-zip archive data, +>6 byte x version %d +>7 byte x \b.%d +!:mime application/x-7z-compressed + +# Type: LZMA +0 lelong&0xffffff =0x5d +>12 leshort =0xff LZMA compressed data, +>>5 lequad =0xffffffffffffffff streamed +>>5 lequad !0xffffffffffffffff non-streamed, size %lld +!:mime application/x-lzma + +# http://tukaani.org/xz/xz-file-format.txt +0 ustring \xFD7zXZ\x00 XZ compressed data +!:mime application/x-xz + +# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt +0 string LRZI LRZIP compressed data +>4 byte x - version %d +>5 byte x \b.%d +!:mime application/x-lrzip + +# AFX compressed files (Wolfram Kleff) +2 string -afx- AFX compressed file data + +# Supplementary magic data for the file(1) command to support +# rzip(1). The format is described in magic(5). +# +# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with +# this file. +# +0 string RZIP rzip compressed data +>4 byte x - version %d +>5 byte x \b.%d +>6 belong x (%d bytes) + +0 string ArC\x01 FreeArc archive <http://freearc.org> + +# Type: DACT compressed files +0 long 0x444354C3 DACT compressed data +>4 byte >-1 (version %i. +>5 byte >-1 %i. +>6 byte >-1 %i) +>7 long >0 , original size: %i bytes +>15 long >30 , block size: %i bytes diff --git a/magic/Magdir/console b/magic/Magdir/console new file mode 100644 index 0000000..27227a4 --- /dev/null +++ b/magic/Magdir/console @@ -0,0 +1,264 @@ + +#------------------------------------------------------------------------------ +# $File: console,v 1.19 2013/02/06 14:18:52 christos Exp $ +# Console game magic +# Toby Deshane <hac@shoelace.digivill.net> +# ines: file(1) magic for Marat's iNES Nintendo Entertainment System +# ROM dump format + +0 string NES\032 iNES ROM dump, +>4 byte x %dx16k PRG +>5 byte x \b, %dx8k CHR +>6 byte&0x01 =0x1 \b, [Vert.] +>6 byte&0x01 =0x0 \b, [Horiz.] +>6 byte&0x02 =0x2 \b, [SRAM] +>6 byte&0x04 =0x4 \b, [Trainer] +>6 byte&0x04 =0x8 \b, [4-Scr] + +#------------------------------------------------------------------------------ +# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format +# +0x104 belong 0xCEED6666 Gameboy ROM: +>0x134 string >\0 "%.16s" +>0x146 byte 0x03 \b,[SGB] +>0x147 byte 0x00 \b, [ROM ONLY] +>0x147 byte 0x01 \b, [ROM+MBC1] +>0x147 byte 0x02 \b, [ROM+MBC1+RAM] +>0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT] +>0x147 byte 0x05 \b, [ROM+MBC2] +>0x147 byte 0x06 \b, [ROM+MBC2+BATTERY] +>0x147 byte 0x08 \b, [ROM+RAM] +>0x147 byte 0x09 \b, [ROM+RAM+BATTERY] +>0x147 byte 0x0B \b, [ROM+MMM01] +>0x147 byte 0x0C \b, [ROM+MMM01+SRAM] +>0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT] +>0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT] +>0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT] +>0x147 byte 0x11 \b, [ROM+MBC3] +>0x147 byte 0x12 \b, [ROM+MBC3+RAM] +>0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT] +>0x147 byte 0x19 \b, [ROM+MBC5] +>0x147 byte 0x1A \b, [ROM+MBC5+RAM] +>0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT] +>0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE] +>0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM] +>0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT] +>0x147 byte 0x1F \b, [Pocket Camera] +>0x147 byte 0xFD \b, [Bandai TAMA5] +>0x147 byte 0xFE \b, [Hudson HuC-3] +>0x147 byte 0xFF \b, [Hudson HuC-1] + +>0x148 byte 0 \b, ROM: 256Kbit +>0x148 byte 1 \b, ROM: 512Kbit +>0x148 byte 2 \b, ROM: 1Mbit +>0x148 byte 3 \b, ROM: 2Mbit +>0x148 byte 4 \b, ROM: 4Mbit +>0x148 byte 5 \b, ROM: 8Mbit +>0x148 byte 6 \b, ROM: 16Mbit +>0x148 byte 0x52 \b, ROM: 9Mbit +>0x148 byte 0x53 \b, ROM: 10Mbit +>0x148 byte 0x54 \b, ROM: 12Mbit + +>0x149 byte 1 \b, RAM: 16Kbit +>0x149 byte 2 \b, RAM: 64Kbit +>0x149 byte 3 \b, RAM: 128Kbit +>0x149 byte 4 \b, RAM: 1Mbit + +#>0x14e long x \b, CRC: %x + +#------------------------------------------------------------------------------ +# genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format +# +0x100 string SEGA Sega MegaDrive/Genesis raw ROM dump +>0x120 string >\0 Name: "%.16s" +>0x110 string >\0 %.16s +>0x1B0 string RA with SRAM + +#------------------------------------------------------------------------------ +# genesis: file(1) magic for the Super MegaDrive ROM dump format +# +0x280 string EAGN Super MagicDrive ROM dump +>0 byte x %dx16k blocks +>2 byte 0 \b, last in series or standalone +>2 byte >0 \b, split ROM +>8 byte 0xAA +>9 byte 0xBB + +#------------------------------------------------------------------------------ +# genesis: file(1) alternate magic for the Super MegaDrive ROM dump format +# +0x280 string EAMG Super MagicDrive ROM dump +>0 byte x %dx16k blocks +>2 byte x \b, last in series or standalone +>8 byte 0xAA +>9 byte 0xBB + +#------------------------------------------------------------------------------ +# smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps +# +# Does not detect all images. Very preliminary guesswork. Need more data +# on format. +# +# FIXME: need a little more info...;P +# +#0 byte 0xF3 +#>1 byte 0xED Sega Master System/Game Gear ROM dump +#>1 byte 0x31 Sega Master System/Game Gear ROM dump +#>1 byte 0xDB Sega Master System/Game Gear ROM dump +#>1 byte 0xAF Sega Master System/Game Gear ROM dump +#>1 byte 0xC3 Sega Master System/Game Gear ROM dump + +#------------------------------------------------------------------------------ +# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format +# +0 belong 0x21068028 Sega Dreamcast VMU game image +0 string LCDi Dream Animator file + +#------------------------------------------------------------------------------ +# v64: file(1) uncertain magic for the V64 format N64 ROM dumps +# +0 belong 0x37804012 V64 Nintendo 64 ROM dump + +# From: "Nelson A. de Oliveira" <naoliv@gmail.com> +# Nintendo .nds +192 string \044\377\256Qi\232 Nintendo DS Game ROM Image +# Nintendo .gba +0 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image + +#------------------------------------------------------------------------------ +# msx: file(1) magic for MSX game cartridge dumps +# Too simple - MPi +#0 beshort 0x4142 MSX game cartridge dump + +#------------------------------------------------------------------------------ +# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : +0 string PS-X\ EXE Sony Playstation executable +# Area: +>113 string x (%s) + +#------------------------------------------------------------------------------ +# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>) +0 string XBEH XBE, Microsoft Xbox executable +# probabilistic checks whether signed or not +>0x0004 ulelong =0x0 +>>&2 ulelong =0x0 +>>>&2 ulelong =0x0 \b, not signed +>0x0004 ulelong >0 +>>&2 ulelong >0 +>>>&2 ulelong >0 \b, signed +# expect base address of 0x10000 +>0x0104 ulelong =0x10000 +>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions +>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007 +>>>(0x0118-0x0FF60) ulelong >0 (regions: +>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA +>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan +>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World +>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer +>>>(0x0118-0x0FF60) ulelong >0 \b) + +# -------------------------------- +# Microsoft Xbox data file formats +0 string XIP0 XIP, Microsoft Xbox data +0 string XTF0 XTF, Microsoft Xbox data + +# Atari Lynx cartridge dump (EXE/BLL header) +# From: "Stefan A. Haubenthal" <polluks@web.de> + +# Double-check that the image type matches too, 0x8008 conflicts with +# 8 character OMF-86 object file headers. +0 beshort 0x8008 +>6 string BS93 Lynx homebrew cartridge +>>2 beshort x \b, RAM start $%04x +>6 string LYNX Lynx cartridge +>>2 beshort x \b, RAM start $%04x + +# Opera file system that is used on the 3DO console +# From: Serge van den Boom <svdb@stack.nl> +0 string \x01ZZZZZ\x01 3DO "Opera" file system + +# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu +0 string GBS Nintendo Gameboy Music/Audio Data +12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module + +# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> +0 string PPF30 Playstation Patch File version 3.0 +>5 byte 0 \b, PPF 1.0 patch +>5 byte 1 \b, PPF 2.0 patch +>5 byte 2 \b, PPF 3.0 patch +>>56 byte 0 \b, Imagetype BIN (any) +>>56 byte 1 \b, Imagetype GI (PrimoDVD) +>>57 byte 0 \b, Blockcheck disabled +>>57 byte 1 \b, Blockcheck enabled +>>58 byte 0 \b, Undo data not available +>>58 byte 1 \b, Undo data available +>6 string x \b, description: %s + +0 string PPF20 Playstation Patch File version 2.0 +>5 byte 0 \b, PPF 1.0 patch +>5 byte 1 \b, PPF 2.0 patch +>>56 lelong >0 \b, size of file to patch %d +>6 string x \b, description: %s + +0 string PPF10 Playstation Patch File version 1.0 +>5 byte 0 \b, Simple Encoding +>6 string x \b, description: %s + +# From: Daniel Dawson <ddawson@icehouse.net> +# SNES9x .smv "movie" file format. +0 string SMV\x1A SNES9x input recording +>0x4 lelong x \b, version %d +# version 4 is latest so far +>0x4 lelong <5 +>>0x8 ledate x \b, recorded at %s +>>0xc lelong >0 \b, rerecorded %d times +>>0x10 lelong x \b, %d frames long +>>0x14 byte >0 \b, data for controller(s): +>>>0x14 byte &0x1 #1 +>>>0x14 byte &0x2 #2 +>>>0x14 byte &0x4 #3 +>>>0x14 byte &0x8 #4 +>>>0x14 byte &0x10 #5 +>>0x15 byte ^0x1 \b, begins from snapshot +>>0x15 byte &0x1 \b, begins from reset +>>0x15 byte ^0x2 \b, NTSC standard +>>0x15 byte &0x2 \b, PAL standard +>>0x17 byte &0x1 \b, settings: +# WIP1Timing not used as of version 4 +>>>0x4 lelong <4 +>>>>0x17 byte &0x2 WIP1Timing +>>>0x17 byte &0x4 Left+Right +>>>0x17 byte &0x8 VolumeEnvX +>>>0x17 byte &0x10 FakeMute +>>>0x17 byte &0x20 SyncSound +# New flag as of version 4 +>>>0x4 lelong >3 +>>>>0x17 byte &0x80 NoCPUShutdown +>>0x4 lelong <4 +>>>0x18 lelong >0x23 +>>>>0x20 leshort !0 +>>>>>0x20 lestring16 x \b, metadata: "%s" +>>0x4 lelong >3 +>>>0x24 byte >0 \b, port 1: +>>>>0x24 byte 1 joypad +>>>>0x24 byte 2 mouse +>>>>0x24 byte 3 SuperScope +>>>>0x24 byte 4 Justifier +>>>>0x24 byte 5 multitap +>>>0x24 byte >0 \b, port 2: +>>>>0x25 byte 1 joypad +>>>>0x25 byte 2 mouse +>>>>0x25 byte 3 SuperScope +>>>>0x25 byte 4 Justifier +>>>>0x25 byte 5 multitap +>>>0x18 lelong >0x43 +>>>>0x40 leshort !0 +>>>>>0x40 lestring16 x \b, metadata: "%s" +>>0x17 byte &0x40 \b, ROM: +>>>(0x18.l-26) lelong x CRC32 0x%08x +>>>(0x18.l-23) string x "%s" + +# Type: scummVM savegame files +# From: Sven Hartge <debian@ds9.argh.org> +0 string SCVM ScummVM savegame +>12 string >\0 "%s" diff --git a/magic/Magdir/convex b/magic/Magdir/convex new file mode 100644 index 0000000..6b28f76 --- /dev/null +++ b/magic/Magdir/convex @@ -0,0 +1,69 @@ + +#------------------------------------------------------------------------------ +# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $ +# convex: file(1) magic for Convex boxes +# +# Convexes are big-endian. +# +# /*\ +# * Below are the magic numbers and tests added for Convex. +# * Added at beginning, because they are expected to be used most. +# \*/ +0 belong 0507 Convex old-style object +>16 belong >0 not stripped +0 belong 0513 Convex old-style demand paged executable +>16 belong >0 not stripped +0 belong 0515 Convex old-style pre-paged executable +>16 belong >0 not stripped +0 belong 0517 Convex old-style pre-paged, non-swapped executable +>16 belong >0 not stripped +0 belong 0x011257 Core file +# +# The following are a series of dump format magic numbers. Each one +# corresponds to a drastically different dump format. The first on is +# the original dump format on a 4.1 BSD or earlier file system. The +# second marks the change between the 4.1 file system and the 4.2 file +# system. The Third marks the changing of the block size from 1K +# to 2K to be compatible with an IDC file system. The fourth indicates +# a dump that is dependent on Convex Storage Manager, because data in +# secondary storage is not physically contained within the dump. +# The restore program uses these number to determine how the data is +# to be extracted. +# +24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) +24 belong =60014 dump format, Convex Storage Manager by-reference dump +# +# what follows is a bunch of bit-mask checks on the flags field of the opthdr. +# If there is no `=' sign, assume just checking for whether the bit is set? +# +0 belong 0601 Convex SOFF +>88 belong&0x000f0000 =0x00000000 c1 +>88 belong &0x00010000 c2 +>88 belong &0x00020000 c2mp +>88 belong &0x00040000 parallel +>88 belong &0x00080000 intrinsic +>88 belong &0x00000001 demand paged +>88 belong &0x00000002 pre-paged +>88 belong &0x00000004 non-swapped +>88 belong &0x00000008 POSIX +# +>84 belong &0x80000000 executable +>84 belong &0x40000000 object +>84 belong&0x20000000 =0 not stripped +>84 belong&0x18000000 =0x00000000 native fpmode +>84 belong&0x18000000 =0x10000000 ieee fpmode +>84 belong&0x18000000 =0x18000000 undefined fpmode +# +0 belong 0605 Convex SOFF core +# +0 belong 0607 Convex SOFF checkpoint +>88 belong&0x000f0000 =0x00000000 c1 +>88 belong &0x00010000 c2 +>88 belong &0x00020000 c2mp +>88 belong &0x00040000 parallel +>88 belong &0x00080000 intrinsic +>88 belong &0x00000008 POSIX +# +>84 belong&0x18000000 =0x00000000 native fpmode +>84 belong&0x18000000 =0x10000000 ieee fpmode +>84 belong&0x18000000 =0x18000000 undefined fpmode diff --git a/magic/Magdir/cracklib b/magic/Magdir/cracklib new file mode 100644 index 0000000..1676596 --- /dev/null +++ b/magic/Magdir/cracklib @@ -0,0 +1,14 @@ + +#------------------------------------------------------------------------------ +# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ +# cracklib: file (1) magic for cracklib v2.7 + +0 lelong 0x70775631 Cracklib password index, little endian +>4 long >0 (%i words) +>4 long 0 ("64-bit") +>>8 long >-1 (%i words) +0 belong 0x70775631 Cracklib password index, big endian +>4 belong >-1 (%i words) +# really bellong 0x0000000070775631 +0 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") +>12 belong >0 (%i words) diff --git a/magic/Magdir/ctags b/magic/Magdir/ctags new file mode 100644 index 0000000..f480d32 --- /dev/null +++ b/magic/Magdir/ctags @@ -0,0 +1,6 @@ + +# ---------------------------------------------------------------------------- +# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $ +# ctags: file (1) magic for Exuberant Ctags files +# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> +0 search/1 =!_TAG Exuberant Ctags tag file text diff --git a/magic/Magdir/cubemap b/magic/Magdir/cubemap new file mode 100644 index 0000000..e2f87d8 --- /dev/null +++ b/magic/Magdir/cubemap @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $ +# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com> +# +0 string ACMP Map file for the AssaultCube FPS game +0 string CUBE Map file for cube and cube2 engine games +0 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games diff --git a/magic/Magdir/cups b/magic/Magdir/cups new file mode 100644 index 0000000..54167fc --- /dev/null +++ b/magic/Magdir/cups @@ -0,0 +1,56 @@ + +#------------------------------------------------------------------------------ +# $File: cups,v 1.2 2012/11/02 21:50:29 christos Exp $ +# Cups: file(1) magic for the cups raster file format +# From: Laurent Martelli <martellilaurent@gmail.com> +# http://www.cups.org/documentation.php/spec-raster.html +# + +0 name cups-be +>280 lelong x \b, %d +>284 lelong x \bx%d dpi +>376 lelong x \b, %dx +>380 lelong x \b%d pixels +>388 lelong x %d bits/color +>392 lelong x %d bits/pixel +>400 lelong 0 ColorOrder=Chunky +>400 lelong 1 ColorOrder=Banded +>400 lelong 2 ColorOrder=Planar +>404 lelong 0 ColorSpace=gray +>404 lelong 1 ColorSpace=RGB +>404 lelong 2 ColorSpace=RGBA +>404 lelong 3 ColorSpace=black +>404 lelong 4 ColorSpace=CMY +>404 lelong 5 ColorSpace=YMC +>404 lelong 6 ColorSpace=CMYK +>404 lelong 7 ColorSpace=YMCK +>404 lelong 8 ColorSpace=KCMY +>404 lelong 9 ColorSpace=KCMYcm +>404 lelong 10 ColorSpace=GMCK +>404 lelong 11 ColorSpace=GMCS +>404 lelong 12 ColorSpace=WHITE +>404 lelong 13 ColorSpace=GOLD +>404 lelong 14 ColorSpace=SILVER +>404 lelong 15 ColorSpace=CIE XYZ +>404 lelong 16 ColorSpace=CIE Lab +>404 lelong 17 ColorSpace=RGBW +>404 lelong 18 ColorSpace=sGray +>404 lelong 19 ColorSpace=sRGB +>404 lelong 20 ColorSpace=AdobeRGB + +# Cups Raster image format, Big Endian +0 string RaS +>3 string t Cups Raster version 1, Big Endian +>3 string 2 Cups Raster version 2, Big Endian +>3 string 3 Cups Raster version 3, Big Endian +!:mime application/vnd.cups-raster +>0 use ^cups-be + + +# Cups Raster image format, Little Endian +1 string SaR +>0 string t Cups Raster version 1, Little Endian +>0 string 2 Cups Raster version 2, Little Endian +>0 string 3 Cups Raster version 3, Little Endian +!:mime application/vnd.cups-raster +>0 use \^cups-be diff --git a/magic/Magdir/dact b/magic/Magdir/dact new file mode 100644 index 0000000..04627c9 --- /dev/null +++ b/magic/Magdir/dact @@ -0,0 +1,11 @@ + +#------------------------------------------------------------------------------ +# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $ +# dact: file(1) magic for DACT compressed files +# +0 long 0x444354C3 DACT compressed data +>4 byte >-1 (version %i. +>5 byte >-1 $BS%i. +>6 byte >-1 $BS%i) +>7 long >0 $BS, original size: %i bytes +>15 long >30 $BS, block size: %i bytes diff --git a/magic/Magdir/database b/magic/Magdir/database new file mode 100644 index 0000000..39e11c3 --- /dev/null +++ b/magic/Magdir/database @@ -0,0 +1,292 @@ + +#------------------------------------------------------------------------------ +# $File: database,v 1.32 2013/02/06 14:18:52 christos Exp $ +# database: file(1) magic for various databases +# +# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) +# +# +# GDBM magic numbers +# Will be maintained as part of the GDBM distribution in the future. +# <downsj@teeny.org> +0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian +!:mime application/x-gdbm +0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian +!:mime application/x-gdbm +0 string GDBM GNU dbm 2.x database +!:mime application/x-gdbm +# +# Berkeley DB +# +# Ian Darwin's file /etc/magic files: big/little-endian version. +# +# Hash 1.85/1.86 databases store metadata in network byte order. +# Btree 1.85/1.86 databases store the metadata in host byte order. +# Hash and Btree 2.X and later databases store the metadata in host byte order. + +0 long 0x00061561 Berkeley DB +!:mime application/x-dbm +>8 belong 4321 +>>4 belong >2 1.86 +>>4 belong <3 1.85 +>>4 belong >0 (Hash, version %d, native byte-order) +>8 belong 1234 +>>4 belong >2 1.86 +>>4 belong <3 1.85 +>>4 belong >0 (Hash, version %d, little-endian) + +0 belong 0x00061561 Berkeley DB +>8 belong 4321 +>>4 belong >2 1.86 +>>4 belong <3 1.85 +>>4 belong >0 (Hash, version %d, big-endian) +>8 belong 1234 +>>4 belong >2 1.86 +>>4 belong <3 1.85 +>>4 belong >0 (Hash, version %d, native byte-order) + +0 long 0x00053162 Berkeley DB 1.85/1.86 +>4 long >0 (Btree, version %d, native byte-order) +0 belong 0x00053162 Berkeley DB 1.85/1.86 +>4 belong >0 (Btree, version %d, big-endian) +0 lelong 0x00053162 Berkeley DB 1.85/1.86 +>4 lelong >0 (Btree, version %d, little-endian) + +12 long 0x00061561 Berkeley DB +>16 long >0 (Hash, version %d, native byte-order) +12 belong 0x00061561 Berkeley DB +>16 belong >0 (Hash, version %d, big-endian) +12 lelong 0x00061561 Berkeley DB +>16 lelong >0 (Hash, version %d, little-endian) + +12 long 0x00053162 Berkeley DB +>16 long >0 (Btree, version %d, native byte-order) +12 belong 0x00053162 Berkeley DB +>16 belong >0 (Btree, version %d, big-endian) +12 lelong 0x00053162 Berkeley DB +>16 lelong >0 (Btree, version %d, little-endian) + +12 long 0x00042253 Berkeley DB +>16 long >0 (Queue, version %d, native byte-order) +12 belong 0x00042253 Berkeley DB +>16 belong >0 (Queue, version %d, big-endian) +12 lelong 0x00042253 Berkeley DB +>16 lelong >0 (Queue, version %d, little-endian) + +# From Max Bowsher. +12 long 0x00040988 Berkeley DB +>16 long >0 (Log, version %d, native byte-order) +12 belong 0x00040988 Berkeley DB +>16 belong >0 (Log, version %d, big-endian) +12 lelong 0x00040988 Berkeley DB +>16 lelong >0 (Log, version %d, little-endian) + +# +# +# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> +0 string RRD RRDTool DB +>4 string x version %s +#---------------------------------------------------------------------- +# ROOT: file(1) magic for ROOT databases +# +0 string root\0 ROOT file +>4 belong x Version %d +>33 belong x (Compression: %d) + +# XXX: Weak magic. +# Alex Ott <ott@jet.msk.su> +## Paradox file formats +#2 leshort 0x0800 Paradox +#>0x39 byte 3 v. 3.0 +#>0x39 byte 4 v. 3.5 +#>0x39 byte 9 v. 4.x +#>0x39 byte 10 v. 5.x +#>0x39 byte 11 v. 5.x +#>0x39 byte 12 v. 7.x +#>>0x04 byte 0 indexed .DB data file +#>>0x04 byte 1 primary index .PX file +#>>0x04 byte 2 non-indexed .DB data file +#>>0x04 byte 3 non-incrementing secondary index .Xnn file +#>>0x04 byte 4 secondary index .Ynn file +#>>0x04 byte 5 incrementing secondary index .Xnn file +#>>0x04 byte 6 non-incrementing secondary index .XGn file +#>>0x04 byte 7 secondary index .YGn file +#>>>0x04 byte 8 incrementing secondary index .XGn file + +## XBase database files +#0 byte 0x02 +#>8 leshort >0 +#>>12 leshort 0 FoxBase +#!:mime application/x-dbf +#>>>0x04 lelong 0 (no records) +#>>>0x04 lelong >0 (%ld records) +# +#0 byte 0x03 +#!:mime application/x-dbf +#>8 leshort >0 +#>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo +#>>>0x04 lelong 0 (no records) +#>>>0x04 lelong >0 (%ld records) +# +#0 byte 0x04 +#!:mime application/x-dbf +#>8 leshort >0 +#>>12 leshort 0 dBASE IV no memo file +#>>>0x04 lelong 0 (no records) +#>>>0x04 lelong >0 (%ld records) +# +#0 byte 0x05 +#!:mime application/x-dbf +#>8 leshort >0 +#>>12 leshort 0 dBASE V no memo file +#>>>0x04 lelong 0 (no records) +#>>>0x04 lelong >0 (%ld records) +# +#0 byte 0x30 +#!:mime application/x-dbf +#>8 leshort >0 +#>>12 leshort 0 Visual FoxPro +#>>>0x04 lelong 0 (no records) +#>>>0x04 lelong >0 (%ld records) +# +#0 byte 0x43 +#!:mime application/x-dbf +#>8 leshort >0 +#>>12 leshort 0 FlagShip with memo var size +#>>>0x04 lelong 0 (no records) +#>>>0x04 lelong >0 (%ld records) +# +#0 byte 0x7b +#!:mime application/x-dbf +#>8 leshort >0 +#>>12 leshort 0 dBASEIV with memo +#>>>0x04 lelong 0 (no records) +#>>>0x04 lelong >0 (%ld records) +# +#0 byte 0x83 +#!:mime application/x-dbf +#>8 leshort >0 +#>>12 leshort 0 FoxBase+, dBaseIII+ with memo +#>>>0x04 lelong 0 (no records) +#>>>0x04 lelong >0 (%ld records) +# +#0 byte 0x8b +#!:mime application/x-dbf +#>8 leshort >0 +#>>12 leshort 0 dBaseIV with memo +#>>>0x04 lelong 0 (no records) +#>>>0x04 lelong >0 (%ld records) +# +#0 byte 0x8e +#!:mime application/x-dbf +#>8 leshort >0 +#>>12 leshort 0 dBaseIV with SQL Table +#>>>0x04 lelong 0 (no records) +#>>>0x04 lelong >0 (%ld records) +# +#0 byte 0xb3 +#!:mime application/x-dbf +#>8 leshort >0 +#>>12 leshort 0 FlagShip with .dbt memo +#>>>0x04 lelong 0 (no records) +#>>>0x04 lelong >0 (%ld records) +# +#0 byte 0xf5 +#!:mime application/x-dbf +#>8 leshort >0 +#>>12 leshort 0 FoxPro with memo +#>>>0x04 lelong 0 (no records) +#>>>0x04 lelong >0 (%ld records) +# +#0 leshort 0x0006 DBase 3 index file + +# MS Access database +4 string Standard\ Jet\ DB Microsoft Access Database +!:mime application/x-msaccess +4 string Standard\ ACE\ DB Microsoft Access Database +!:mime application/x-msaccess + +# TDB database from Samba et al - Martin Pool <mbp@samba.org> +0 string TDB\ file TDB database +>32 lelong 0x2601196D version 6, little-endian +>>36 lelong x hash size %d bytes + +# SE Linux policy database +0 lelong 0xf97cff8c SE Linux policy +>16 lelong x v%d +>20 lelong 1 MLS +>24 lelong x %d symbols +>28 lelong x %d ocons + +# ICE authority file data (Wolfram Kleff) +2 string ICE ICE authority data + +# X11 Xauthority file (Wolfram Kleff) +10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data +11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data +12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data +13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data +14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data +15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data +16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data +17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data +18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data + +# From: Maxime Henrion <mux@FreeBSD.org> +# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> +0 string PGDMP PostgreSQL custom database dump +>5 byte x - v%d +>6 byte x \b.%d +>5 beshort <0x101 \b-0 +>5 beshort >0x100 +>>7 byte x \b-%d + +# Type: Advanced Data Format (ADF) database +# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ +# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> +0 string @(#)ADF\ Database CGNS Advanced Data Format + +# Tokyo Cabinet magic data +# http://tokyocabinet.sourceforge.net/index.html +0 string ToKyO\ CaBiNeT\n Tokyo Cabinet +>14 string x \b (%s) +>32 byte 0 \b, Hash +!:mime application/x-tokyocabinet-hash +>32 byte 1 \b, B+ tree +!:mime application/x-tokyocabinet-btree +>32 byte 2 \b, Fixed-length +!:mime application/x-tokyocabinet-fixed +>32 byte 3 \b, Table +!:mime application/x-tokyocabinet-table +>33 byte &1 \b, [open] +>33 byte &2 \b, [fatal] +>34 byte x \b, apow=%d +>35 byte x \b, fpow=%d +>36 byte &0x01 \b, [large] +>36 byte &0x02 \b, [deflate] +>36 byte &0x04 \b, [bzip] +>36 byte &0x08 \b, [tcbs] +>36 byte &0x10 \b, [excodec] +>40 lequad x \b, bnum=%lld +>48 lequad x \b, rnum=%lld +>56 lequad x \b, fsiz=%lld + +# Type: QDBM Quick Database Manager +# From: Benoit Sibaud <bsibaud@april.org> +0 string \\[depot\\]\n\f Quick Database Manager, little endian +0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian + +# Type: TokyoCabinet database +# URL: http://tokyocabinet.sourceforge.net/ +# From: Benoit Sibaud <bsibaud@april.org> +0 string ToKyO\ CaBiNeT\n TokyoCabinet database +>14 string x (version %s) + +# From: Stephane Blondon http://www.yaal.fr +# Database file for Zope (done by FileStorage) +0 string FS21 Zope Object Database File Storage (data) +# Cache file for the database of Zope (done by ClientStorage) +0 string ZEC3 Zope Object Database Client Cache File (data) + +# IDA (Interactive Disassembler) database +0 string IDA1 IDA (Interactive Disassembler) database diff --git a/magic/Magdir/diamond b/magic/Magdir/diamond new file mode 100644 index 0000000..39d1ed6 --- /dev/null +++ b/magic/Magdir/diamond @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $ +# diamond: file(1) magic for Diamond system +# +# ... diamond is a multi-media mail and electronic conferencing system.... +# +# XXX - I think it was either renamed Slate, or replaced by Slate.... +# +# The full deal is too long... +#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document +0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document diff --git a/magic/Magdir/diff b/magic/Magdir/diff new file mode 100644 index 0000000..5924380 --- /dev/null +++ b/magic/Magdir/diff @@ -0,0 +1,40 @@ + +#------------------------------------------------------------------------------ +# $File: diff,v 1.14 2012/09/16 23:08:54 christos Exp $ +# diff: file(1) magic for diff(1) output +# +0 search/1 diff\ diff output text +!:mime text/x-diff +0 search/1 ***\ diff output text +!:mime text/x-diff +0 search/1 Only\ in\ diff output text +!:mime text/x-diff +0 search/1 Common\ subdirectories:\ diff output text +!:mime text/x-diff + +0 search/1 Index: RCS/CVS diff output text +!:mime text/x-diff + +# bsdiff: file(1) magic for bsdiff(1) output +0 string/b BSDIFF40 bsdiff(1) patch file + + +# unified diff +0 search/4096 ---\ +>&0 search/1024 \n +>>&0 search/1 +++\ +>>>&0 search/1024 \n +>>>>&0 search/1 @@ unified diff output text +!:mime text/x-diff +!:strength + 90 + +# librsync -- the library for network deltas +# +# Copyright (C) 2001 by Martin Pool. You may do whatever you want with +# this file. +# +0 belong 0x72730236 rdiff network-delta data + +0 belong 0x72730136 rdiff network-delta signature data +>4 belong x (block length=%d, +>8 belong x signature strength=%d) diff --git a/magic/Magdir/digital b/magic/Magdir/digital new file mode 100644 index 0000000..f66e0bc --- /dev/null +++ b/magic/Magdir/digital @@ -0,0 +1,58 @@ + +#------------------------------------------------------------------------------ +# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $ +# Digital UNIX - Info +# +0 string =!<arch>\n________64E Alpha archive +>22 string X -- out of date +# + +0 leshort 0603 +>24 leshort 0410 COFF format alpha pure +>24 leshort 0413 COFF format alpha demand paged +>>22 leshort&030000 !020000 executable +>>22 leshort&020000 !0 dynamically linked +>>16 lelong !0 not stripped +>>16 lelong 0 stripped +>>27 byte x - version %d +>>26 byte x \b.%d +>>28 byte x \b-%d +>24 leshort 0407 COFF format alpha object +>>22 leshort&030000 020000 shared library +>>27 byte x - version %d +>>26 byte x \b.%d +>>28 byte x \b-%d + +# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> +# +# The actual magic number is just "Core", followed by a 2-byte version +# number; however, treating any file that begins with "Core" as a Digital +# UNIX core dump file may produce too many false hits, so we include one +# byte of the version number as well; DU 5.0 appears only to be up to +# version 2. +# +0 string Core\001 Alpha COFF format core dump (Digital UNIX) +>24 string >\0 \b, from '%s' +0 string Core\002 Alpha COFF format core dump (Digital UNIX) +>24 string >\0 \b, from '%s' +# +# The next is incomplete, we could tell more about this format, +# but its not worth it. +0 leshort 0x188 Alpha compressed COFF +0 leshort 0x18f Alpha u-code object +# +# +# Some other interesting Digital formats, +0 string \377\377\177 ddis/ddif +0 string \377\377\174 ddis/dots archive +0 string \377\377\176 ddis/dtif table data +0 string \033c\033 LN03 output +0 long 04553207 X image +# +0 string =!<PDF>!\n profiling data file +# +# Locale data tables (MIPS and Alpha). +# +0 short 0x0501 locale data table +>6 short 0x24 for MIPS +>6 short 0x40 for Alpha diff --git a/magic/Magdir/dolby b/magic/Magdir/dolby new file mode 100644 index 0000000..8c61d62 --- /dev/null +++ b/magic/Magdir/dolby @@ -0,0 +1,61 @@ + +#------------------------------------------------------------------------------ +# $File: dolby,v 1.6 2012/10/31 13:39:42 christos Exp $ +# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> +# from http://www.atsc.org/standards/a_52a.pdf +# corrections, additions, etc. are always welcome! +# +# syncword +0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, +!:mime audio/vnd.dolby.dd-raw +# fscod +>4 byte&0xc0 0x00 48 kHz, +>4 byte&0xc0 0x40 44.1 kHz, +>4 byte&0xc0 0x80 32 kHz, +# is this one used for 96 kHz? +>4 byte&0xc0 0xc0 reserved frequency, +# +>5 byte&7 = 0 \b, complete main (CM) +>5 byte&7 = 1 \b, music and effects (ME) +>5 byte&7 = 2 \b, visually impaired (VI) +>5 byte&7 = 3 \b, hearing impaired (HI) +>5 byte&7 = 4 \b, dialogue (D) +>5 byte&7 = 5 \b, commentary (C) +>5 byte&7 = 6 \b, emergency (E) +# acmod +>6 byte&0xe0 0x00 1+1 front, +>6 byte&0xe0 0x20 1 front/0 rear, +>6 byte&0xe0 0x40 2 front/0 rear, +>6 byte&0xe0 0x60 3 front/0 rear, +>6 byte&0xe0 0x80 2 front/1 rear, +>6 byte&0xe0 0xa0 3 front/1 rear, +>6 byte&0xe0 0xc0 2 front/2 rear, +>6 byte&0xe0 0xe0 3 front/2 rear, +# lfeon (these may be incorrect) +>7 byte&0x40 0x00 LFE off, +>7 byte&0x40 0x40 LFE on, +# +>4 byte&0x3e = 0x00 \b, 32 kbit/s +>4 byte&0x3e = 0x02 \b, 40 kbit/s +>4 byte&0x3e = 0x04 \b, 48 kbit/s +>4 byte&0x3e = 0x06 \b, 56 kbit/s +>4 byte&0x3e = 0x08 \b, 64 kbit/s +>4 byte&0x3e = 0x0a \b, 80 kbit/s +>4 byte&0x3e = 0x0c \b, 96 kbit/s +>4 byte&0x3e = 0x0e \b, 112 kbit/s +>4 byte&0x3e = 0x10 \b, 128 kbit/s +>4 byte&0x3e = 0x12 \b, 160 kbit/s +>4 byte&0x3e = 0x14 \b, 192 kbit/s +>4 byte&0x3e = 0x16 \b, 224 kbit/s +>4 byte&0x3e = 0x18 \b, 256 kbit/s +>4 byte&0x3e = 0x1a \b, 320 kbit/s +>4 byte&0x3e = 0x1c \b, 384 kbit/s +>4 byte&0x3e = 0x1e \b, 448 kbit/s +>4 byte&0x3e = 0x20 \b, 512 kbit/s +>4 byte&0x3e = 0x22 \b, 576 kbit/s +>4 byte&0x3e = 0x24 \b, 640 kbit/s +# dsurmod (these may be incorrect) +>6 beshort&0x0180 0x0000 Dolby Surround not indicated +>6 beshort&0x0180 0x0080 not Dolby Surround encoded +>6 beshort&0x0180 0x0100 Dolby Surround encoded +>6 beshort&0x0180 0x0180 reserved Dolby Surround mode diff --git a/magic/Magdir/dump b/magic/Magdir/dump new file mode 100644 index 0000000..b4a7240 --- /dev/null +++ b/magic/Magdir/dump @@ -0,0 +1,94 @@ + +#------------------------------------------------------------------------------ +# $File: dump,v 1.12 2012/11/01 04:26:40 christos Exp $ +# dump: file(1) magic for dump file format--for new and old dump filesystems +# +# We specify both byte orders in order to recognize byte-swapped dumps. +# +0 name new-dump-be +>4 bedate x Previous dump %s, +>8 bedate x This dump %s, +>12 belong >0 Volume %ld, +>692 belong 0 Level zero, type: +>692 belong >0 Level %d, type: +>0 belong 1 tape header, +>0 belong 2 beginning of file record, +>0 belong 3 map of inodes on tape, +>0 belong 4 continuation of file record, +>0 belong 5 end of volume, +>0 belong 6 map of inodes deleted, +>0 belong 7 end of medium (for floppy), +>676 string >\0 Label %s, +>696 string >\0 Filesystem %s, +>760 string >\0 Device %s, +>824 string >\0 Host %s, +>888 belong >0 Flags %x + +0 name old-dump-be +#>4 bedate x Previous dump %s, +#>8 bedate x This dump %s, +>12 belong >0 Volume %ld, +>692 belong 0 Level zero, type: +>692 belong >0 Level %d, type: +>0 belong 1 tape header, +>0 belong 2 beginning of file record, +>0 belong 3 map of inodes on tape, +>0 belong 4 continuation of file record, +>0 belong 5 end of volume, +>0 belong 6 map of inodes deleted, +>0 belong 7 end of medium (for floppy), +>676 string >\0 Label %s, +>696 string >\0 Filesystem %s, +>760 string >\0 Device %s, +>824 string >\0 Host %s, +>888 belong >0 Flags %x + +0 name ufs2-dump-be +>896 beqdate x Previous dump %s, +>904 beqdate x This dump %s, +>12 belong >0 Volume %ld, +>692 belong 0 Level zero, type: +>692 belong >0 Level %d, type: +>0 belong 1 tape header, +>0 belong 2 beginning of file record, +>0 belong 3 map of inodes on tape, +>0 belong 4 continuation of file record, +>0 belong 5 end of volume, +>0 belong 6 map of inodes deleted, +>0 belong 7 end of medium (for floppy), +>676 string >\0 Label %s, +>696 string >\0 Filesystem %s, +>760 string >\0 Device %s, +>824 string >\0 Host %s, +>888 belong >0 Flags %x + +24 belong 60012 new-fs dump file (big endian), +>0 use new-dump-be + +24 belong 60011 old-fs dump file (big endian), +>0 use old-dump-be + +24 lelong 60012 new-fs dump file (little endian), +>0 use \^new-dump-be + +24 lelong 60011 old-fs dump file (little endian), +>0 use \^old-dump-be + + +24 belong 0x19540119 new-fs dump file (ufs2, big endian), +>0 use ufs2-dump-be + +24 lelong 0x19540119 new-fs dump file (ufs2, little endian), +>0 use \^ufs2-dump-be + +18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), +>2 medate x Previous dump %s, +>6 medate x This dump %s, +>10 leshort >0 Volume %ld, +>0 leshort 1 tape header. +>0 leshort 2 beginning of file record. +>0 leshort 3 map of inodes on tape. +>0 leshort 4 continuation of file record. +>0 leshort 5 end of volume. +>0 leshort 6 map of inodes deleted. +>0 leshort 7 end of medium (for floppy). diff --git a/magic/Magdir/dyadic b/magic/Magdir/dyadic new file mode 100644 index 0000000..c1a2c3c --- /dev/null +++ b/magic/Magdir/dyadic @@ -0,0 +1,46 @@ + +#------------------------------------------------------------------------------ +# $File: dyadic,v 1.5 2010/09/20 18:55:20 rrt Exp $ +# Dyadic: file(1) magic for Dyalog APL. +# +0 byte 0xaa +>1 byte <4 Dyalog APL +>>1 byte 0x00 incomplete workspace +>>1 byte 0x01 component file +>>1 byte 0x02 external variable +>>1 byte 0x03 workspace +>>2 byte x version %d +>>3 byte x .%d + +0 beshort 0xaa03 Dyalog APL +>2 byte x workspace type %d +>3 byte x subtype %d +>7 byte&0x28 0x00 32-bit +>7 byte&0x28 0x20 64-bit +>7 byte&0x0c 0x00 classic +>7 byte&0x0c 0x04 unicode +>7 byte&0x88 0x00 big-endian +>7 byte&0x88 0x80 little-endian + +0 byte 0xaa Dyalog APL +>1 byte 0x00 aplcore +>1 byte 0x01 component file 32-bit non-journaled non-checksummed +>1 byte 0x02 external variable exclusive +>1 byte 0x06 external variable shared +>1 byte 0x07 session +>1 byte 0x08 mapped file 32-bit +>1 byte 0x09 component file 64-bit non-journaled non-checksummed +>1 byte 0x0a mapped file 64-bit +>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed +>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed +>1 byte 0x0d component file 32-bit level 1 journaled checksummed +>1 byte 0x0e component file 64-bit level 1 journaled checksummed +>1 byte 0x0f component file 32-bit level 2 journaled checksummed +>1 byte 0x10 component file 64-bit level 2 journaled checksummed +>1 byte 0x11 component file 32-bit level 3 journaled checksummed +>1 byte 0x12 component file 64-bit level 3 journaled checksummed +>1 byte 0x13 component file 32-bit non-journaled checksummed +>1 byte 0x14 component file 64-bit non-journaled checksummed +>1 byte 0x80 DDB + +0 short 0x6060 Dyalog APL transfer diff --git a/magic/Magdir/ebml b/magic/Magdir/ebml new file mode 100644 index 0000000..d5d1743 --- /dev/null +++ b/magic/Magdir/ebml @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $ +# ebml: file(1) magic for various Extensible Binary Meta Language +# http://www.matroska.org/technical/specs/index.html#track +0 belong 0x1a45dfa3 EBML file +>4 search/b/100 \102\202 +>>&1 string x \b, creator %.8s diff --git a/magic/Magdir/editors b/magic/Magdir/editors new file mode 100644 index 0000000..4c5b8a6 --- /dev/null +++ b/magic/Magdir/editors @@ -0,0 +1,18 @@ + +#------------------------------------------------------------------------------ +# $File: editors,v 1.8 2009/09/19 16:28:09 christos Exp $ +# T602 editor documents +# by David Necas <yeti@physics.muni.cz> +0 string @CT\ T602 document data, +>4 string 0 Kamenicky +>4 string 1 CP 852 +>4 string 2 KOI8-CS +>4 string >2 unknown encoding + +# Vi IMproved Encrypted file +# by David Necas <yeti@physics.muni.cz> +0 string VimCrypt~ Vim encrypted file data +# Vi IMproved Swap file +# by Sven Wegener <swegener@gentoo.org> +0 string b0VIM\ Vim swap file +>&0 string >\0 \b, version %s diff --git a/magic/Magdir/efi b/magic/Magdir/efi new file mode 100644 index 0000000..7335c5c --- /dev/null +++ b/magic/Magdir/efi @@ -0,0 +1,15 @@ + +#------------------------------------------------------------------------------ +# $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $ +# efi: file(1) magic for Universal EFI binaries + +0 lelong 0x0ef1fab9 +>4 lelong 1 Universal EFI binary with 1 architecture +>>&0 lelong 7 \b, i386 +>>&0 lelong 0x01000007 \b, x86_64 +>4 lelong 2 Universal EFI binary with 2 architectures +>>&0 lelong 7 \b, i386 +>>&0 lelong 0x01000007 \b, x86_64 +>>&20 lelong 7 \b, i386 +>>&20 lelong 0x01000007 \b, x86_64 +>4 lelong >2 Universal EFI binary with %ld architectures diff --git a/magic/Magdir/elf b/magic/Magdir/elf new file mode 100644 index 0000000..f80f6d9 --- /dev/null +++ b/magic/Magdir/elf @@ -0,0 +1,217 @@ + +#------------------------------------------------------------------------------ +# $File: elf,v 1.58 2012/11/06 20:43:52 christos Exp $ +# elf: file(1) magic for ELF executables +# +# We have to check the byte order flag to see what byte order all the +# other stuff in the header is in. +# +# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? +# +# Created by: unknown +# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> +# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) +# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) +# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) +# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) + +0 name elf-le +>16 leshort 0 no file type, +!:strength *2 +!:mime application/octet-stream +>16 leshort 1 relocatable, +!:mime application/x-object +>16 leshort 2 executable, +!:mime application/x-executable +>16 leshort 3 shared object, +!:mime application/x-sharedlib +>16 leshort 4 core file +!:mime application/x-coredump +# Core file detection is not reliable. +#>>>(0x38+0xcc) string >\0 of '%s' +#>>>(0x38+0x10) lelong >0 (signal %d), +>16 leshort &0xff00 processor-specific, +>18 leshort 0 no machine, +>18 leshort 1 AT&T WE32100 +>18 leshort 2 SPARC +>18 leshort 3 Intel 80386, +>18 leshort 4 Motorola +>>4 byte 1 +>>>36 lelong &0x01000000 68000 - invalid byte order, +>>>36 lelong &0x00810000 CPU32 - invalid byte order, +>>>36 lelong 0 68020 - invalid byte order, +>18 leshort 5 Motorola 88000 - invalid byte order, +>18 leshort 6 Intel 80486, +>18 leshort 7 Intel 80860, +# The official e_machine number for MIPS is now #8, regardless of endianness. +# The second number (#10) will be deprecated later. For now, we still +# say something if #10 is encountered, but only gory details for #8. +>18 leshort 8 MIPS, +>>4 byte 1 +>>>36 lelong &0x20 N32 +>18 leshort 10 MIPS, +>>4 byte 1 +>>>36 lelong &0x20 N32 +>18 leshort 8 +# only for 32-bit +>>4 byte 1 +>>>36 lelong&0xf0000000 0x00000000 MIPS-I +>>>36 lelong&0xf0000000 0x10000000 MIPS-II +>>>36 lelong&0xf0000000 0x20000000 MIPS-III +>>>36 lelong&0xf0000000 0x30000000 MIPS-IV +>>>36 lelong&0xf0000000 0x40000000 MIPS-V +>>>36 lelong&0xf0000000 0x50000000 MIPS32 +>>>36 lelong&0xf0000000 0x60000000 MIPS64 +>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2 +>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2 +# only for 64-bit +>>4 byte 2 +>>>48 lelong&0xf0000000 0x00000000 MIPS-I +>>>48 lelong&0xf0000000 0x10000000 MIPS-II +>>>48 lelong&0xf0000000 0x20000000 MIPS-III +>>>48 lelong&0xf0000000 0x30000000 MIPS-IV +>>>48 lelong&0xf0000000 0x40000000 MIPS-V +>>>48 lelong&0xf0000000 0x50000000 MIPS32 +>>>48 lelong&0xf0000000 0x60000000 MIPS64 +>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2 +>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2 +>18 leshort 9 Amdahl - invalid byte order, +>18 leshort 10 MIPS (deprecated), +>18 leshort 11 RS6000 - invalid byte order, +>18 leshort 15 PA-RISC - invalid byte order, +# only for 32-bit +>>4 byte 1 +>>>38 leshort 0x0214 2.0 +>>>36 leshort &0x0008 (LP64) +# only for 64-bit +>>4 byte 2 +>>>50 leshort 0x0214 2.0 +>>>48 leshort &0x0008 (LP64) +>18 leshort 16 nCUBE, +>18 leshort 17 Fujitsu VPP500, +>18 leshort 18 SPARC32PLUS, +# only for 32-bit +>>4 byte 1 +>>>36 lelong&0xffff00 0x000100 V8+ Required, +>>>36 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, +>>>36 lelong&0xffff00 0x000400 HaL R1 Extensions Required, +>>>36 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, +>18 leshort 20 PowerPC or cisco 4500, +>18 leshort 21 64-bit PowerPC or cisco 7500, +>18 leshort 22 IBM S/390, +>18 leshort 23 Cell SPU, +>18 leshort 24 cisco SVIP, +>18 leshort 25 cisco 7200, +>18 leshort 36 NEC V800 or cisco 12000, +>18 leshort 37 Fujitsu FR20, +>18 leshort 38 TRW RH-32, +>18 leshort 39 Motorola RCE, +>18 leshort 40 ARM, +>>4 byte 1 +>>>36 lelong&0xff000000 0x04000000 EABI4 +>>>36 lelong&0xff000000 0x05000000 EABI5 +>18 leshort 41 Alpha, +>18 leshort 0xa390 IBM S/390 (obsolete), +>18 leshort 42 Renesas SH, +>18 leshort 43 SPARC V9, +>>4 byte 2 +>>>48 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, +>>>48 lelong&0xffff00 0x000400 HaL R1 Extensions Required, +>>>48 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, +>>>48 lelong&0x3 0 total store ordering, +>>>48 lelong&0x3 1 partial store ordering, +>>>48 lelong&0x3 2 relaxed memory ordering, +>18 leshort 44 Siemens Tricore Embedded Processor, +>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., +>18 leshort 46 Renesas H8/300, +>18 leshort 47 Renesas H8/300H, +>18 leshort 48 Renesas H8S, +>18 leshort 49 Renesas H8/500, +>18 leshort 50 IA-64, +>18 leshort 51 Stanford MIPS-X, +>18 leshort 52 Motorola Coldfire, +>18 leshort 53 Motorola M68HC12, +>18 leshort 54 Fujitsu MMA, +>18 leshort 55 Siemens PCP, +>18 leshort 56 Sony nCPU, +>18 leshort 57 Denso NDR1, +>18 leshort 58 Start*Core, +>18 leshort 59 Toyota ME16, +>18 leshort 60 ST100, +>18 leshort 61 Tinyj emb., +>18 leshort 62 x86-64, +>18 leshort 63 Sony DSP, +>18 leshort 66 FX66, +>18 leshort 67 ST9+ 8/16 bit, +>18 leshort 68 ST7 8 bit, +>18 leshort 69 MC68HC16, +>18 leshort 70 MC68HC11, +>18 leshort 71 MC68HC08, +>18 leshort 72 MC68HC05, +>18 leshort 73 SGI SVx or Cray NV1, +>18 leshort 74 ST19 8 bit, +>18 leshort 75 Digital VAX, +>18 leshort 76 Axis cris, +>18 leshort 77 Infineon 32-bit embedded, +>18 leshort 78 Element 14 64-bit DSP, +>18 leshort 79 LSI Logic 16-bit DSP, +>18 leshort 80 MMIX, +>18 leshort 81 Harvard machine-independent, +>18 leshort 82 SiTera Prism, +>18 leshort 83 Atmel AVR 8-bit, +>18 leshort 84 Fujitsu FR30, +>18 leshort 85 Mitsubishi D10V, +>18 leshort 86 Mitsubishi D30V, +>18 leshort 87 NEC v850, +>18 leshort 88 Renesas M32R, +>18 leshort 89 Matsushita MN10300, +>18 leshort 90 Matsushita MN10200, +>18 leshort 91 picoJava, +>18 leshort 92 OpenRISC, +>18 leshort 93 ARC Cores Tangent-A5, +>18 leshort 94 Tensilica Xtensa, +>18 leshort 97 NatSemi 32k, +>18 leshort 106 Analog Devices Blackfin, +>18 leshort 113 Altera Nios II, +>18 leshort 174 META, +>18 leshort 183 ARM aarch64, +>18 leshort 187 Tilera TILE64, +>18 leshort 188 Tilera TILEPro, +>18 leshort 191 Tilera TILE-Gx, +>18 leshort 0x3426 OpenRISC (obsolete), +>18 leshort 0x8472 OpenRISC (obsolete), +>18 leshort 0x9026 Alpha (unofficial), +>20 lelong 0 invalid version +>20 lelong 1 version 1 + +0 string \177ELF ELF +>4 byte 0 invalid class +>4 byte 1 32-bit +>4 byte 2 64-bit +>5 byte 0 invalid byte order +>5 byte 1 LSB +>>0 use elf-le +>5 byte 2 MSB +>>0 use \^elf-le +# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed +# like proper ELF, but extracting the string had bad results. +>4 byte <0x80 +>>8 string >\0 (%s) +>8 string \0 +>>7 byte 0 (SYSV) +>>7 byte 1 (HP-UX) +>>7 byte 2 (NetBSD) +>>7 byte 3 (GNU/Linux) +>>7 byte 4 (GNU/Hurd) +>>7 byte 5 (86Open) +>>7 byte 6 (Solaris) +>>7 byte 7 (Monterey) +>>7 byte 8 (IRIX) +>>7 byte 9 (FreeBSD) +>>7 byte 10 (Tru64) +>>7 byte 11 (Novell Modesto) +>>7 byte 12 (OpenBSD) +>8 string \2 +>>7 byte 13 (OpenVMS) +>>7 byte 97 (ARM) +>>7 byte 255 (embedded) diff --git a/magic/Magdir/encore b/magic/Magdir/encore new file mode 100644 index 0000000..ef82eed --- /dev/null +++ b/magic/Magdir/encore @@ -0,0 +1,22 @@ + +#------------------------------------------------------------------------------ +# $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $ +# encore: file(1) magic for Encore machines +# +# XXX - needs to have the byte order specified (NS32K was little-endian, +# dunno whether they run the 88K in little-endian mode or not). +# +0 short 0x154 Encore +>20 short 0x107 executable +>20 short 0x108 pure executable +>20 short 0x10b demand-paged executable +>20 short 0x10f unsupported executable +>12 long >0 not stripped +>22 short >0 - version %ld +>22 short 0 - +#>4 date x stamp %s +0 short 0x155 Encore unsupported executable +>12 long >0 not stripped +>22 short >0 - version %ld +>22 short 0 - +#>4 date x stamp %s diff --git a/magic/Magdir/epoc b/magic/Magdir/epoc new file mode 100644 index 0000000..8b11a2e --- /dev/null +++ b/magic/Magdir/epoc @@ -0,0 +1,62 @@ + +#------------------------------------------------------------------------------ +# $File: epoc,v 1.8 2012/06/16 14:43:36 christos Exp $ +# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] +# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> +# Useful information for improving this file can be found at: +# http://software.frodo.looijaard.name/psiconv/formats/Index.html +#------------------------------------------------------------------------------ +0 lelong 0x10000037 Psion Series 5 +>4 lelong 0x10000039 font file +>4 lelong 0x1000003A printer driver +>4 lelong 0x1000003B clipboard +>4 lelong 0x10000042 multi-bitmap image +!:mime image/x-epoc-mbm +>4 lelong 0x1000006A application information file +>4 lelong 0x1000006D +>>8 lelong 0x1000007D Sketch image +!:mime image/x-epoc-sketch +>>8 lelong 0x1000007E voice note +>>8 lelong 0x1000007F Word file +!:mime application/x-epoc-word +>>8 lelong 0x10000085 OPL program (TextEd) +!:mime application/x-epoc-opl +>>8 lelong 0x10000087 Comms settings +>>8 lelong 0x10000088 Sheet file +!:mime application/x-epoc-sheet +>>8 lelong 0x100001C4 EasyFax initialisation file +>4 lelong 0x10000073 OPO module +!:mime application/x-epoc-opo +>4 lelong 0x10000074 OPL application +!:mime application/x-epoc-app +>4 lelong 0x1000008A exported multi-bitmap image +>4 lelong 0x1000016D +>>8 lelong 0x10000088 Comms names + +0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image + +0 lelong 0x10000050 Psion Series 5 +>4 lelong 0x1000006D database +>>8 lelong 0x10000084 Agenda file +!:mime application/x-epoc-agenda +>>8 lelong 0x10000086 Data file +!:mime application/x-epoc-data +>>8 lelong 0x10000CEA Jotter file +!:mime application/x-epoc-jotter +>4 lelong 0x100000E4 ini file + +0 lelong 0x10000079 Psion Series 5 binary: +>4 lelong 0x00000000 DLL +>4 lelong 0x10000049 comms hardware library +>4 lelong 0x1000004A comms protocol library +>4 lelong 0x1000005D OPX +>4 lelong 0x1000006C application +>4 lelong 0x1000008D DLL +>4 lelong 0x100000AC logical device driver +>4 lelong 0x100000AD physical device driver +>4 lelong 0x100000E5 file transfer protocol +>4 lelong 0x100000E5 file transfer protocol +>4 lelong 0x10000140 printer definition +>4 lelong 0x10000141 printer definition + +0 lelong 0x1000007A Psion Series 5 executable diff --git a/magic/Magdir/erlang b/magic/Magdir/erlang new file mode 100644 index 0000000..b604a06 --- /dev/null +++ b/magic/Magdir/erlang @@ -0,0 +1,21 @@ + +#------------------------------------------------------------------------------ +# $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $ +# erlang: file(1) magic for Erlang JAM and BEAM files +# URL: http://www.erlang.org/faq/x779.html#AEN812 + +# OTP R3-R4 +0 string \0177BEAM! Old Erlang BEAM file +>6 short >0 - version %d + +# OTP R5 and onwards +0 string FOR1 +>8 string BEAM Erlang BEAM file + +# 4.2 version may have a copyright notice! +4 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 +79 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 + +4 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 + +0 bequad 0x0000000000ABCDEF Erlang DETS file diff --git a/magic/Magdir/esri b/magic/Magdir/esri new file mode 100644 index 0000000..e070e4f --- /dev/null +++ b/magic/Magdir/esri @@ -0,0 +1,28 @@ + +#------------------------------------------------------------------------------ +# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $ +# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) +# Based on info from +# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> +0 belong 9994 ESRI Shapefile +>4 belong =0 +>8 belong =0 +>12 belong =0 +>16 belong =0 +>20 belong =0 +>28 lelong x version %d +>24 belong x length %d +>32 lelong =0 type Null Shape +>32 lelong =1 type Point +>32 lelong =3 type PolyLine +>32 lelong =5 type Polygon +>32 lelong =8 type MultiPoint +>32 lelong =11 type PointZ +>32 lelong =13 type PolyLineZ +>32 lelong =15 type PolygonZ +>32 lelong =18 type MultiPointZ +>32 lelong =21 type PointM +>32 lelong =23 type PolyLineM +>32 lelong =25 type PolygonM +>32 lelong =28 type MultiPointM +>32 lelong =31 type MultiPatch diff --git a/magic/Magdir/fcs b/magic/Magdir/fcs new file mode 100644 index 0000000..613437f --- /dev/null +++ b/magic/Magdir/fcs @@ -0,0 +1,9 @@ + +#------------------------------------------------------------------------------ +# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $ +# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files +# From Roger Leigh <roger@whinlatter.uklinux.net> +0 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 +0 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 +0 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 + diff --git a/magic/Magdir/filesystems b/magic/Magdir/filesystems new file mode 100644 index 0000000..2a85454 --- /dev/null +++ b/magic/Magdir/filesystems @@ -0,0 +1,1979 @@ + +#------------------------------------------------------------------------------ +# $File: filesystems,v 1.76 2013/02/18 18:45:41 christos Exp $ +# filesystems: file(1) magic for different filesystems +# +0 string \366\366\366\366 PC formatted floppy with no filesystem +# Sun disk labels +# From /usr/include/sun/dklabel.h: +0774 beshort 0xdabe +# modified by Joerg Jenderek, because original test +# succeeds for Cabinet archive dao360.dl_ with negative blocks +>0770 long >0 Sun disk label +>>0 string x '%s +>>>31 string >\0 \b%s +>>>>63 string >\0 \b%s +>>>>>95 string >\0 \b%s +>>0 string x \b' +>>0734 short >0 %d rpm, +>>0736 short >0 %d phys cys, +>>0740 short >0 %d alts/cyl, +>>0746 short >0 %d interleave, +>>0750 short >0 %d data cyls, +>>0752 short >0 %d alt cyls, +>>0754 short >0 %d heads/partition, +>>0756 short >0 %d sectors/track, +>>0764 long >0 start cyl %ld, +>>0770 long x %ld blocks +# Is there a boot block written 1 sector in? +>512 belong&077777777 0600407 \b, boot block present + +# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk +# (http://btmgr.sourceforge.net/docs/user-guide-3.html) +0 string SBMBAKUP_ Smart Boot Manager backup file +>9 string x \b, version %-5.5s +>>14 string =_ +>>>15 string x %-.1s +>>>>16 string =_ \b. +>>>>>17 string x \b%-.1s +>>>>>>18 string =_ \b. +>>>>>>>19 string x \b%-.1s +>>>22 ubyte 0 +>>>>21 ubyte x \b, from drive 0x%x +>>>22 ubyte >0 +>>>>21 string x \b, from drive %s +>>>535 search/17 \x55\xAA +>>>>&-512 indirect x \b; contains + +# updated by Joerg Jenderek at Nov 2012 +# DOS Emulator image is 128 byte, null right padded header + harddisc image +0 string DOSEMU\0 +>0x27E leshort 0xAA55 +#offset is 128 +>>19 ubyte 128 +>>>(19.b-1) ubyte 0x0 DOS Emulator image +>>>>7 ulelong >0 \b, %u heads +>>>>11 ulelong >0 \b, %d sectors/track +>>>>15 ulelong >0 \b, %d cylinders +>>>>128 indirect x \b; contains + +# x86 boot sector updated by Joerg Jenderek at Sep 2007,May 2011 +# for any allowed sector sizes +30 search/481 \x55\xAA +# to display x86 boot sector (40) before old one (strength=50), SYSLINUX MBR (?) and DOS BPB information (71) like in previous file version +!:strength +30 +# for sector sizes < 512 Bytes +>11 uleshort <512 +>>(11.s-2) uleshort 0xAA55 x86 boot sector +# for sector sizes with 512 or more Bytes +>0x1FE leshort 0xAA55 x86 boot sector +# keep old x86 boot sector as dummy for mbr and bootloader displaying +# only for sector sizes with 512 or more Bytes +0x1FE leshort 0xAA55 +# to display information (51) before DOS BPB (strength=71) and after DOS floppy (120) like in old file version +!:strength +21 +>2 string OSBS \b, OS/BS MBR +# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/ +# and http://en.wikipedia.org/wiki/Master_Boot_Record +# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by +# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 +>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR +# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) +# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld +>>8 ubequad 0x8bf45007501ffbfc +# http://thestarman.pcministry.com/asm/mbr/200MBR.htm +>>>0x16 ubyte 0xF3 \b,DOS 2 +>>>>219 regex Author\ -\ Author: +# found "David Litton" , "A Pehrsson " +>>>>>&0 string x "%s" +>>>0x16 ubyte 0xF2 +# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm +# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz +>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 +# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) +>>>>0x22 default x \b,D0S version 3.3-7.0 +# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) +# where nn is string offset varying for different languages +# "Invalid partition table" nn=0x8b for english version +>>>>>(0x49.b) string Invalid\ partition\ table english +>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german +>>>>>(0x49.b) string Table\ de\ partition\ invalide french +>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese +>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish +>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian +>>>>>0x49 ubyte >0 at offset 0x%x +>>>>>>(0x49.b) string >\0 "%s" +# "Error loading operating system" nn=0xa3 for english version +# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version +# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version +# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version +# "Error al cargar sistema operativo" nn=0xa8 for spanish version +# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version +>>>>>0x74 ubyte >0 at offset 0x%x +>>>>>>(0x74.b) string >\0 "%s" +# "Missing operating system" nn=0xc2 for english version +# "Betriebssystem fehlt" nn=0xcd for german version +# "Syst\212me d'exploitation absent" nn=0xd2 for french version +# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version +# "Falta sistema operativo" nn=0xca for spanish version +# "Sistema operativo mancante" nn=0xe2 for italian version +>>>>>0x79 ubyte >0 at offset 0x%x +>>>>>>(0x79.b) string >\0 "%s" +# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) +# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b +>>8 ubequad 0x5007501ffcbe1b7c +# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 +>>>24 ubequad 0xf3a4cbbebe07b104 9M +# "Invalid partition table" nn=0x10F for english version +# "Ungültige Partitionstabelle" nn=0x10F for german version +# "Table de partition erronée" nn=0x10F for french version +# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version +>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english +>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german +>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french +>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian +>>>>0x3C ubyte x at offset 0x%x+0xFF +>>>>(0x3C.b+0x0FF) string >\0 "%s" +# "Error loading operating system" nn=0x127 for english version +# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version +# "Erreur lors du chargement du système d'exploitation" nn=0x12a for french version +# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version +>>>>0xBD ubyte x at offset 0x1%x +>>>>(0xBD.b+0x100) string >\0 "%s" +# "Missing operating system" nn=0x146 for english version +# "Betriebssystem fehlt" nn=0x151 for german version +# "Système d'exploitation manquant" nn=0x15e for french version +# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version +>>>>0xA9 ubyte x at offset 0x1%x +>>>>(0xA9.b+0x100) string >\0 "%s" +# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm +# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 +>>>24 ubequad 0xf3a4cbbdbe07b104 XP +# where xxyyzz are lower bits from offsets of error messages varying for different languages +>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english +>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german +# "Invalid partition table" xx=0x12C for english version +# "Ungültige Partitionstabelle" xx=0x12C for german version +>>>>0x1b5 ubyte >0 at offset 0x1%x +>>>>(0x1b5.b+0x100) string >\0 "%s" +# "Error loading operating system" yy=0x144 for english version +# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version +>>>>0x1b6 ubyte >0 at offset 0x1%x +>>>>(0x1b6.b+0x100) string >\0 "%s" +# "Missing operating system" zz=0x163 for english version +# "Betriebssystem nicht vorhanden" zz=0x16e for german version +>>>>0x1b7 ubyte >0 at offset 0x1%x +>>>>(0x1b7.b+0x100) string >\0 "%s" +# Microsoft Windows Vista or 7 +# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 +>>8 ubequad 0xc08ed8be007cbf00 +# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) +# assembler instructions: jnz 0729;cmp ebx,"TCPA" +>>>0xEC ubequad 0x753b6681fb544350 Vista +# where xxyyzz are lower bits from offsets of error messages varying for different languages +>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english +#>>>>0x1B4 ubelong&0x00FFFFFF ? german +# "Invalid partition table" xx=0x162 for english version +# "Ungültige Partitionstabelle" xx=0x1?? for german version +>>>>0x1b5 ubyte >0 at offset 0x1%x +>>>>(0x1b5.b+0x100) string >\0 "%s" +# "Error loading operating system" yy=0x17a for english version +# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version +>>>>0x1b6 ubyte >0 at offset 0x1%x +>>>>(0x1b6.b+0x100) string >\0 "%s" +# "Missing operating system" zz=0x199 for english version +# "Betriebssystem nicht vorhanden" zz=0x1?? for german version +>>>>0x1b7 ubyte >0 at offset 0x1%x +>>>>(0x1b7.b+0x100) string >\0 "%s" +# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm) +# assembler instructions: cmp ebx,"TCPA";cmp +>>>0xEC ubequad 0x6681fb5443504175 Windows 7 +# where xxyyzz are lower bits from offsets of error messages varying for different languages +>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english +#>>>>0x1B4 ubelong&0x00FFFFFF ? german +# "Invalid partition table" xx=0x163 for english version +# "Ungültige Partitionstabelle" xx=0x1?? for german version +>>>>0x1b5 ubyte >0 at offset 0x1%x +>>>>(0x1b5.b+0x100) string >\0 "%s" +# "Error loading operating system" yy=0x17b for english version +# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version +>>>>0x1b6 ubyte >0 at offset 0x1%x +>>>>(0x1b6.b+0x100) string >\0 "%s" +# "Missing operating system" zz=0x19a for english version +# "Betriebssystem nicht vorhanden" zz=0x1?? for german version +>>>>0x1b7 ubyte >0 at offset 0x1%x +>>>>(0x1b7.b+0x100) string >\0 "%s" +# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs +# http://en.wikipedia.org/wiki/MBR_disk_signature#ID +>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x +# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm +>>0xDA uleshort 0 +>>>0xDC ulelong >0 \b, created +# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive +>>>>0xDC ubyte x with driveID 0x%x +# hours, minutes and seconds +>>>>0xDf ubyte x at %x +>>>>0xDe ubyte x \b:%x +>>>>0xDd ubyte x \b:%x +# special case for Microsoft MS-DOS 3.21 spanish +# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov +>0 ubequad 0xfab830008ed0bc00 +# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov +>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish +# Microsoft MBR IPL end + +# dr-dos with some upper-, lowercase variants +>0x9D string Invalid\ partition\ table$ +>>181 string No\ Operating\ System$ +>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 +>0x9D string Invalid\ partition\ table$ +>>181 string No\ operating\ system$ +>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 +>342 string Invalid\ partition\ table$ +>>366 string No\ operating\ system$ +>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 +>295 string NEWLDR\0 +>>302 string Bad\ PT\ $ +>>>310 string No\ OS\ $ +>>>>317 string OS\ load\ err$ +>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r +>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ +>>>>>>>387 string Copyright\ (c)\ 1984,1998 +>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) +# +# tests for different MS-DOS Master Boot Records (MBR) moved and merged +# +#>0x145 string Default:\ F \b, FREE-DOS MBR +#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR +>0x145 search/7 Default:\ F \b, FREE-DOS MBR +#>>313 string F0\ .\ .\ . +#>>>322 string disk\ 1 +#>>>>382 string FAT3 +>64 string no\ active\ partition\ found +>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR +# Ranish Partition Manager http://www.ranish.com/part/ +>387 search/4 \0\ Error!\r +>>378 search/7 Virus! +>>>397 search/4 Booting\ +>>>>408 search/4 HD1/\0 \b, Ranish MBR ( +>>>>>416 string Writing\ changes... \b2.37 +>>>>>>438 ubyte x \b,0x%x dots +>>>>>>440 ubyte >0 \b,virus check +>>>>>>441 ubyte >0 \b,partition %c +#2.38,2.42,2.44 +>>>>>416 string !Writing\ changes... \b +>>>>>>418 ubyte 1 \bvirus check, +>>>>>>419 ubyte x \b0x%x seconds +>>>>>>420 ubyte&0x0F >0 \b,partition +>>>>>>>420 ubyte&0x0F <5 \b %x +>>>>>>>420 ubyte&0x0F 0Xf \b ask +>>>>>420 ubyte x \b) +# +# SYSLINUX MBR moved +# http://www.acronis.de/ +>362 string MBR\ Error\ \0\r +>>376 string ress\ any\ key\ to\ +>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR +# added by Joerg Jenderek +# http://www.visopsys.org/ +# http://partitionlogic.org.uk/ +>309 string No\ bootable\ partition\ found\r +>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR +>349 string No\ bootable\ partition\ found\r +>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR +# bootloader, bootmanager +>0x40 string SBML +# label with 11 characters of FAT 12 bit filesystem +>>43 string SMART\ BTMGR +>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager +# OEM-ID not always "SBM" +#>>>>3 strings SBM +>>>>6 string >\0 \b, version %s +>382 string XOSLLOADXCF \b, eXtended Operating System Loader +>6 string LILO \b, LInux i386 boot LOader +>>120 string LILO \b, version 22.3.4 SuSe +>>172 string LILO \b, version 22.5.8 Debian +# updated by Joerg Jenderek at Oct 2008 +# variables according to grub-0.97/stage1/stage1.S or +# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data +# usual values are marked with comments to get only informations of strange GRUB loaders +>342 search/60 \0Geom\0 +#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 +>>0x41 ubyte <2 +>>>0x3E ubyte >2 \b; GRand Unified Bootloader +# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 +>>>>0x3E ubyte x \b, stage1 version 0x%x +#If it is 0xFF, use a drive passed by BIOS +>>>>0x40 ubyte <0xFF \b, boot drive 0x%x +# in most case 0,1,0x2e for GRUB 0.5.95 +>>>>0x41 ubyte >0 \b, LBA flag 0x%x +>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x +#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) +>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x +#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) +>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x +>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x +#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) +>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x +>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>>>>394 string stage1 \b, GRUB version 0.5.95 +>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 +>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 +>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 +>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 +#unkown version +>>>343 string Geom\0Read\0\ Error\0 +>>>>321 string Loading\ stage1.5 \b, GRUB version x.y +>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>>>374 string GRUB\ \0 \b, GRUB version n.m +# SYSLINUX bootloader moved +>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader +# http://www.bcdwb.de/bcdw/index_e.htm +>3 string BCDL +>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) +# mbr partition table entries +# OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs +>3 string !MS +>>3 string !SYSLINUX +>>>3 string !MTOOL +>>>>3 string !NEWLDR +>>>>>5 string !DOS +# not FAT (32 bit) +>>>>>>82 string !FAT32 +#not Linux kernel +>>>>>>>514 string !HdrS +#not BeOS +>>>>>>>>422 string !Be\ Boot\ Loader +# active flag 0 or 0x80 and type > 0 +>>>>>>>>>446 ubyte <0x81 +>>>>>>>>>>446 ubyte&0x7F 0 +>>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x +>>>>>>>>>>>>446 ubyte 0x80 \b, active +>>>>>>>>>>>>447 ubyte x \b, starthead %u +#>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x +#>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>>>>>>454 ulelong x \b, startsector %u +>>>>>>>>>>>>458 ulelong x \b, %u sectors +# +>>>>>>>>>462 ubyte <0x81 +>>>>>>>>>>462 ubyte&0x7F 0 +>>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x +>>>>>>>>>>>>462 ubyte 0x80 \b, active +>>>>>>>>>>>>463 ubyte x \b, starthead %u +#>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x +#>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>>>>>>470 ulelong x \b, startsector %u +>>>>>>>>>>>>474 ulelong x \b, %u sectors +# +>>>>>>>>>478 ubyte <0x81 +>>>>>>>>>>478 ubyte&0x7F 0 +>>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x +>>>>>>>>>>>>478 ubyte 0x80 \b, active +>>>>>>>>>>>>479 ubyte x \b, starthead %u +#>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x +#>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x +#>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>>>>>>486 ulelong x \b, startsector %u +>>>>>>>>>>>>490 ulelong x \b, %u sectors +# +>>>>>>>>>494 ubyte <0x81 +>>>>>>>>>>494 ubyte&0x7F 0 +>>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x +>>>>>>>>>>>>494 ubyte 0x80 \b, active +>>>>>>>>>>>>495 ubyte x \b, starthead %u +#>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x +#>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>>>>>>502 ulelong x \b, startsector %u +>>>>>>>>>>>>506 ulelong x \b, %u sectors +# mbr partition table entries end +# http://www.acronis.de/ +#FAT label=ACRONIS\ SZ +#OEM-ID=BOOTWIZ0 +>442 string Non-system\ disk,\ +>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader +# updated by Joerg Jenderek at Nov 2012 +# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes +>>>477 ubyte&0xDF >0 +>>>>477 string x \b %-.3s +>>>>>480 ubyte&0xDF >0 +>>>>>>480 string x \b%-.4s +>>>>>>>484 ubyte&0xDF >0 +>>>>>>>>484 string x \b%-.1s +>>>>485 ubyte&0xDF >0 +>>>>>485 string x \b.%-.3s +# +>185 string FDBOOT\ Version\ +>>204 string \rNo\ Systemdisk.\ +>>>220 string Booting\ from\ harddisk.\n\r +>>>245 string Cannot\ load\ from\ harddisk.\n\r +>>>>273 string Insert\ Systemdisk\ +>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader +>>>>>>200 string >\0 \b, version %-3s +>242 string Bootsector\ from\ C.H.\ Hochst\204 +# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c +# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string +# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut +>242 search/127 Bootsector\ from\ C.H.\ Hochst +>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk +# followed by variants with point,CR-NL or NL-CR +>>>208 search/261 Cannot\ load\ from\ harddisk. +# followed by variants CR-NL or NL-CR +>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. +# followed by variants with point,CR-NL or NL-CR +>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader +# followed by string like "6.50 (c) 1993-2004 Gilles Vollant" +>>>>>>&0 string x \b, version %-4.4s +>(1.b+2) ubyte 0xe +>>(1.b+3) ubyte 0x1f +>>>(1.b+4) ubyte 0xbe +# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others +>>>>(1.b+5) ubyte&0xd3 0x53 +>>>>>(1.b+6) ubyte 0x7c +# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, +>>>>>>(1.b+7) ubyte 0xac +>>>>>>>(1.b+8) ubyte 0x22 +>>>>>>>>(1.b+9) ubyte 0xc0 +>>>>>>>>>(1.b+10) ubyte 0x74 +>>>>>>>>>>(1.b+11) ubyte 0x0b +>>>>>>>>>>>(1.b+12) ubyte 0x56 +>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display +# FAT1X version +>>>>>>>>>>>>>(1.b+5) ubyte 0x5b +>>>>>>>>>>>>>>0x5b string >\0 "%-s" +# FAT32 version +>>>>>>>>>>>>>(1.b+5) ubyte 0x77 +>>>>>>>>>>>>>>0x77 string >\0 "%-s" +>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display +#>>244 string from\ dosemu-freedos-*-bin.tgz\r +#>>>170 string Sorry,\ could\ not\ load\ an\ +#>>>>195 string operating\ system.\r\n +# +>103 string This\ is\ not\ a\ bootable\ disk.\ +>>132 string Please\ insert\ a\ bootable\ +>>>157 string floppy\ and\r\n +>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display +# +>66 string Solaris\ Boot\ Sector +>>99 string Incomplete\ MDBoot\ load. +>>>89 string Version \b, Sun Solaris Bootloader +>>>>97 byte x version %c +# +>408 string OS/2\ !!\ SYS01475\r\0 +>>429 string OS/2\ !!\ SYS02025\r\0 +>>>450 string OS/2\ !!\ SYS02027\r\0 +>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader +# +>409 string OS/2\ !!\ SYS01475\r\0 +>>430 string OS/2\ !!\ SYS02025\r\0 +>>>451 string OS/2\ !!\ SYS02027\r\0 +>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader +>112 string This\ disk\ is\ not\ bootable\r +>>142 string If\ you\ wish\ to\ make\ it\ bootable +>>>176 string run\ the\ DOS\ program\ SYS\ +>>>200 string after\ the\r +>>>>216 string system\ has\ been\ loaded\r\n +>>>>>242 string Please\ insert\ a\ DOS\ diskette\ +>>>>>271 string into\r\n\ the\ drive\ and\ +>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display +# XP +>430 string NTLDR\ is\ missing\xFF\r\n +>>449 string Disk\ error\xFF\r\n +>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader +# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# +>>>>371 ubyte >0x20 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s +# +>430 string NTLDR\ nicht\ gefunden\xFF\r\n +>>453 string Datentr\204gerfehler\xFF\r\n +>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# offset variant +>>>>379 string \0 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +# +>430 string NTLDR\ fehlt\xFF\r\n +>>444 string Datentr\204gerfehler\xFF\r\n +>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# variant +>>>>371 ubyte >0x20 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s +# +>430 string NTLDR\ fehlt\xFF\r\n +>>444 string Medienfehler\xFF\r\n +>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) +>>>>371 ubyte >0x20 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s +# variant +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# +>430 string Datentr\204ger\ entfernen\xFF\r\n +>>454 string Medienfehler\xFF\r\n +>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) +>>>>379 string \0 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s +# variant +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# + +#>3 string NTFS\ \ \ \ +>389 string Fehler\ beim\ Lesen\ +>>407 string des\ Datentr\204gers +>>>426 string NTLDR\ fehlt +>>>>440 string NTLDR\ ist\ komprimiert +>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) +#>3 string NTFS\ \ \ \ +>313 string A\ disk\ read\ error\ occurred.\r +>>345 string A\ kernel\ file\ is\ missing\ +>>>370 string from\ the\ disk.\r +>>>>484 string NTLDR\ is\ compressed +>>>>>429 string Insert\ a\ system\ diskette\ +>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS +# DOS loader variants different languages,offsets +>472 ubyte&0xDF >0 +>>389 string Invalid\ system\ disk\xFF\r\n +>>>411 string Disk\ I/O\ error +>>>>428 string Replace\ the\ disk,\ and\ +>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader +#IO.SYS +>>>>>>472 ubyte&0xDF >0 +>>>>>>>472 string x \b %-.2s +>>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>>474 string x \b%-.5s +>>>>>>>>>>479 ubyte&0xDF >0 +>>>>>>>>>>>479 string x \b%-.1s +>>>>>>>480 ubyte&0xDF >0 +>>>>>>>>480 string x \b.%-.3s +#MSDOS.SYS +>>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>>483 string x \b%-.5s +>>>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>>>488 string x \b%-.3s +>>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>>491 string x \b.%-.3s +# +>>390 string Invalid\ system\ disk\xFF\r\n +>>>412 string Disk\ I/O\ error\xFF\r\n +>>>>429 string Replace\ the\ disk,\ and\ +>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader +>>388 string Ungueltiges\ System\ \xFF\r\n +>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n +>>>>427 string Datentraeger\ wechseln\ und\ +>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) +#WINBOOT.SYS only not spaces (0xDF) +>>>>>>497 ubyte&0xDF >0 +>>>>>>>497 string x %-.5s +>>>>>>>>502 ubyte&0xDF >0 +>>>>>>>>>502 string x \b%-.1s +>>>>>>>>>>503 ubyte&0xDF >0 +>>>>>>>>>>>503 string x \b%-.1s +>>>>>>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>>>>>>504 string x \b%-.1s +>>>>>>505 ubyte&0xDF >0 +>>>>>>>505 string x \b.%-.3s +#IO.SYS +>>>>>>472 ubyte&0xDF >0 or +>>>>>>>472 string x \b %-.2s +>>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>>474 string x \b%-.5s +>>>>>>>>>>479 ubyte&0xDF >0 +>>>>>>>>>>>479 string x \b%-.1s +>>>>>>>480 ubyte&0xDF >0 +>>>>>>>>480 string x \b.%-.3s +#MSDOS.SYS +>>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>>483 string x \b%-.5s +>>>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>>>488 string x \b%-.3s +>>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>>491 string x \b.%-.3s +# +>>390 string Ungueltiges\ System\ \xFF\r\n +>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n +>>>>429 string Datentraeger\ wechseln\ und\ +>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) +#WINBOOT.SYS only not spaces (0xDF) +>>>>>>497 ubyte&0xDF >0 +>>>>>>>497 string x %-.7s +>>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>>504 string x \b%-.1s +>>>>>>505 ubyte&0xDF >0 +>>>>>>>505 string x \b.%-.3s +#IO.SYS +>>>>>>472 ubyte&0xDF >0 or +>>>>>>>472 string x \b %-.2s +>>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>>474 string x \b%-.6s +>>>>>>>480 ubyte&0xDF >0 +>>>>>>>>480 string x \b.%-.3s +#MSDOS.SYS +>>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>>483 string x \b%-.5s +>>>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>>>488 string x \b%-.3s +>>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>>491 string x \b.%-.3s +# +>>389 string Ungueltiges\ System\ \xFF\r\n +>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n +>>>>428 string Datentraeger\ wechseln\ und\ +>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) +# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes +>>>>>>472 string x %-.2s +>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>474 string x \b%-.5s +>>>>>>>>479 ubyte&0xDF >0 +>>>>>>>>>479 string x \b%-.1s +>>>>>>480 ubyte&0xDF >0 +>>>>>>>480 string x \b.%-.3s +>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>483 string x \b%-.5s +>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>488 string x \b%-.2s +>>>>>>>>490 ubyte&0xDF >0 +>>>>>>>>>490 string x \b%-.1s +>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>491 string x \b.%-.3s +>479 ubyte&0xDF >0 +>>416 string Kein\ System\ oder\ +>>>433 string Laufwerksfehler +>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) +#IO.SYS +>>>>>479 string x \b %-.2s +>>>>>>481 ubyte&0xDF >0 +>>>>>>>481 string x \b%-.6s +>>>>>487 ubyte&0xDF >0 +>>>>>>487 string x \b.%-.3s +#MSDOS.SYS +>>>>>>490 ubyte&0xDF >0 \b+ +>>>>>>>490 string x \b%-.5s +>>>>>>>>495 ubyte&0xDF >0 +>>>>>>>>>495 string x \b%-.3s +>>>>>>>498 ubyte&0xDF >0 +>>>>>>>>498 string x \b.%-.3s +# +>376 search/41 Non-System\ disk\ or\ +>>395 search/41 disk\ error\r +>>>407 search/41 Replace\ and\ +>>>>419 search/41 press\ \b, +>>>>419 search/41 strike\ \b, old +>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader +#449 Disk\ Boot\ failure\r MS 3.21 +#466 Boot\ Failure\r MS 3.30 +>>>>>468 search/18 \0 +#IO.SYS,IBMBIO.COM +>>>>>>&0 string x \b %-.2s +>>>>>>>&-20 ubyte&0xDF >0 +>>>>>>>>&-1 string x \b%-.4s +>>>>>>>>>&-16 ubyte&0xDF >0 +>>>>>>>>>>&-1 string x \b%-.2s +>>>>>>&8 ubyte&0xDF >0 \b. +>>>>>>>&-1 string x \b%-.3s +#MSDOS.SYS,IBMDOS.COM +>>>>>>&11 ubyte&0xDF >0 \b+ +>>>>>>>&-1 string x \b%-.5s +>>>>>>>>&-6 ubyte&0xDF >0 +>>>>>>>>>&-1 string x \b%-.1s +>>>>>>>>>>&-5 ubyte&0xDF >0 +>>>>>>>>>>>&-1 string x \b%-.2s +>>>>>>>&7 ubyte&0xDF >0 \b. +>>>>>>>>&-1 string x \b%-.3s +>441 string Cannot\ load\ from\ harddisk.\n\r +>>469 string Insert\ Systemdisk\ +>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader +#>43 string \224R-LOADER\ \ SYS =label +>54 string SYS +>>324 string VASKK +>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) +# +>98 string Press\ a\ key\ to\ retry\0\r +>>120 string Cannot\ find\ file\ \0\r +>>>139 string Disk\ read\ error\0\r +>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader +#DRBIOS.SYS +>>>>>44 ubyte&0xDF >0 +>>>>>>44 string x \b %-.6s +>>>>>>>50 ubyte&0xDF >0 +>>>>>>>>50 string x \b%-.2s +>>>>>>52 ubyte&0xDF >0 +>>>>>>>52 string x \b.%-.3s +# +>70 string IBMBIO\ \ COM +>>472 string Cannot\ load\ DOS!\ +>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader +>>471 string Cannot\ load\ DOS\ +>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader +#?? +>444 string KERNEL\ \ SYS +>>314 string BOOT\ error! \b, FREE-DOS Bootloader +>499 string KERNEL\ \ SYS +>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader +>449 string KERNEL\ \ SYS +>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader +# +>449 string Loading\ FreeDOS +>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +# +>331 string Error!.0 \b, FREE-DOS 1.0 bootloader +# +>125 string Loading\ FreeDOS...\r +>>311 string BOOT\ error!\r \b, FREE-DOS bootloader +>>>441 ubyte&0xDF >0 +>>>>441 string x \b %-.6s +>>>>>447 ubyte&0xDF >0 +>>>>>>447 string x \b%-.1s +>>>>>>>448 ubyte&0xDF >0 +>>>>>>>>448 string x \b%-.1s +>>>>449 ubyte&0xDF >0 +>>>>>449 string x \b.%-.3s +>124 string FreeDOS\0 +>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader +# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +>336 string Error!\ +>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +# added by Joerg Jenderek +# http://www.visopsys.org/ +# http://partitionlogic.org.uk/ +# OEM-ID=Visopsys +>478 ulelong 0 +>>(1.b+326) string I/O\ Error\ reading\ +>>>(1.b+344) string Visopsys\ loader\r +>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader +# http://alexfru.chat.ru/epm.html#bootprog +>494 ubyte >0x4D +>>495 string >E +>>>495 string <S +#OEM-ID is not reliable +>>>>3 string BootProg +# It just looks for a program file name at the root directory +# and loads corresponding file with following execution. +# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes +>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader +>>>>>499 string x \b %-.1s +>>>>>>500 ubyte&0xDF >0 +>>>>>>>500 string x \b%-.1s +>>>>>>>>501 ubyte&0xDF >0 +>>>>>>>>>501 string x \b%-.1s +>>>>>>>>>>502 ubyte&0xDF >0 +>>>>>>>>>>>502 string x \b%-.1s +>>>>>>>>>>>>503 ubyte&0xDF >0 +>>>>>>>>>>>>>503 string x \b%-.1s +>>>>>>>>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>>>>>>>>504 string x \b%-.1s +>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 +>>>>>>>>>>>>>>>>>505 string x \b%-.1s +>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 +>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s +#name extension +>>>>>507 ubyte&0xDF >0 \b. +>>>>>>507 string x \b%-.1s +>>>>>>>508 ubyte&0xDF >0 +>>>>>>>>508 string x \b%-.1s +>>>>>>>>>509 ubyte&0xDF >0 +>>>>>>>>>>509 string x \b%-.1s +#If the boot sector fails to read any other sector, +#it prints a very short message ("RE") to the screen and hangs the computer. +#If the boot sector fails to find needed program in the root directory, +#it also hangs with another message ("NF"). +>>>>>492 string RENF \b, FAT (12 bit) +>>>>>495 string RENF \b, FAT (16 bit) +# http://alexfru.chat.ru/epm.html#bootprog +>494 ubyte >0x4D +>>495 string >E +>>>495 string <S +#OEM-ID is not reliable +>>>>3 string BootProg +# It just looks for a program file name at the root directory +# and loads corresponding file with following execution. +# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes +>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader +>>>>>499 string x \b %-.1s +>>>>>>500 ubyte&0xDF >0 +>>>>>>>500 string x \b%-.1s +>>>>>>>>501 ubyte&0xDF >0 +>>>>>>>>>501 string x \b%-.1s +>>>>>>>>>>502 ubyte&0xDF >0 +>>>>>>>>>>>502 string x \b%-.1s +>>>>>>>>>>>>503 ubyte&0xDF >0 +>>>>>>>>>>>>>503 string x \b%-.1s +>>>>>>>>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>>>>>>>>504 string x \b%-.1s +>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 +>>>>>>>>>>>>>>>>>505 string x \b%-.1s +>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 +>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s +#name extension +>>>>>507 ubyte&0xDF >0 \b. +>>>>>>507 string x \b%-.1s +>>>>>>>508 ubyte&0xDF >0 +>>>>>>>>508 string x \b%-.1s +>>>>>>>>>509 ubyte&0xDF >0 +>>>>>>>>>>509 string x \b%-.1s +#If the boot sector fails to read any other sector, +#it prints a very short message ("RE") to the screen and hangs the computer. +#If the boot sector fails to find needed program in the root directory, +#it also hangs with another message ("NF"). +>>>>>492 string RENF \b, FAT (12 bit) +>>>>>495 string RENF \b, FAT (16 bit) +# x86 bootloader end + +# added by Joerg Jenderek at Nov 2012 +# http://www.thenakedpc.com/articles/v04/08/0408-05.html +# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data +0 string PNCIHISK\0 Norton Utilities disc image data +# real x86 boot sector with jump instruction +>509 search/1026 \x55\xAA\xeb +>>&-1 indirect x \b; contains +# http://file-extension.net/seeker/file_extension_dat +0 string PNCIUNDO Norton Disk Doctor UnDo file +# + +# updated by Joerg Jenderek at Sep 2007 +>3 ubyte 0 +#no active flag +>>446 ubyte 0 +# partition 1 not empty +>>>450 ubyte >0 +# partitions 3,4 empty +>>>>482 ubyte 0 +>>>>>498 ubyte 0 +# partition 2 ID=0,5,15 +>>>>>>466 ubyte <0x10 +>>>>>>>466 ubyte 0x05 \b, extended partition table +>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) +>>>>>>>466 ubyte 0x0 \b, extended partition table (last) + +# DOS x86 sector separated and moved from "x86 boot sector" by Joerg Jenderek at May 2011 + +>0x200 lelong 0x82564557 \b, BSD disklabel +# FATX +0 string FATX FATX filesystem data + +# romfs filesystems - Juan Cespedes <cespedes@debian.org> +0 string -rom1fs- romfs filesystem, version 1 +>8 belong x %d bytes, +>16 string x named %s. + +# netboot image - Juan Cespedes <cespedes@debian.org> +0 lelong 0x1b031336L Netboot image, +>4 lelong&0xFFFFFF00 0 +>>4 lelong&0x100 0x000 mode 2 +>>4 lelong&0x100 0x100 mode 3 +>4 lelong&0xFFFFFF00 !0 unknown mode + +0x18b string OS/2 OS/2 Boot Manager + +# updated by Joerg Jenderek at Oct 2008 and Sep 2012 +# http://syslinux.zytor.com/iso.php +# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 +# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop +0 ulequad&0x909000007cc0eafa 0x909000007c40eafa +>631 search/689 ISOLINUX\ isolinux Loader +>>&0 string x (version %-4.4s) +# http://syslinux.zytor.com/pxe.php +# assembler instructions: jmp 7C05 +0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) +# assembler instructions: pushfd;pushad +0 ulelong 0x60669c66 pxelinux loader +# assembler instructions: jmp 05 +0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) +# http://syslinux.zytor.com/wiki/index.php/SYSLINUX +0 string LDLINUX\ SYS\ SYSLINUX loader +>12 string x (older version %-4.4s) +0 string \r\nSYSLINUX\ SYSLINUX loader +>11 string x (version %-4.4s) +# syslinux updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 +# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" +0 ulelong&0x80909bEB 0x009018EB +# OEM-ID not always "SYSLINUX" +>434 search/47 Boot\ failed +# followed by \r\n\0 or :\ +>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) +>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) +>459 search/30 Boot\ error\r\n\0 +>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) +# SYSLINUX MBR updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012 +# assembler instructions: mov di,0600h;mov cx,0100h +16 search/4 \xbf\x00\x06\xb9\x00\x01 +>94 search/249 Missing\ operating\ system +# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other +# skip Ranish MBR +>>408 search/4 HD1/\0 +>>408 default x +>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR +# followed by "ing " or space +>>>>292 search/98 error +>>>>>&0 string \r (version 3.35 or older) +>>>>>&0 string .\r (version 3.52 or newer) +>>>>>&0 default x (version 3.36-3.51 ) +>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR +>>156 search/10 \0Boot\ partition\ not\ found\r\n +>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) +>>174 search/10 \0Missing\ OS\r\n +>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) +# SYSLINUX END + +# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 +# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, +0 ubequad 0x31c08ed0bc007c8e +# mbr_bootsel magic before partition table not reliable with small ipl fragments +#>444 uleshort 0xb5e1 +>0004 uleshort x +# ERRorTeXT +>>181 search/166 Error\ \0\r\n NetBSD mbr +# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS +>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x +# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx +>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector +# BOOT_EXTENDED definitions contains assembler instructions: +# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 +>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended +# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al +>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO +# not TERSE_ERROR +>>>196 search/106 No\ active\ partition\0 +>>>>&0 string Disk\ read\ error\0 +>>>>>&0 string No\ operating\ system\0 \b,verbose +# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 +>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS +# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 +>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check +# assembler instructions: movw nametab,bx +>>>0x26 search/21 \xBB\x94\x07 +# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf +>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 +>>>>>181 search/166 Error\ \0 +# "a: disk" , "Fn: diskn" or "NetBSD MBR boot" +>>>>>>&3 string x \b,"%s" +# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html +# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 +# assembler instructions: jmp short 0x58;nop;ASCII +0 ubequad&0xeb58908000000000 0xeb58900000000000 +# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, +>(1.b+2) ubequad 0xfa31c08ed88ec08e +# Error messages at end of code +>>376 string No\ operating\ system\r\n\0 +>>>398 string Disk\ error\r\n\0FDD\0HDD\0 +>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr + +# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ +# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 +# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, +# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, +0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC +# pointer to the data starting with Neil Turton signature string +>(0x1BC.s) string NDTmbr +>>&-14 string 1234F\0 Turton mbr ( +# parameters also viewed by install-mbr --list +>>>(0x1BC.s+7) ubyte x \b%u<= +>>>(0x1BC.s+9) ubyte x \bVersion<=%u +#>>>(0x1BC.s+8) ubyte x asm_flag_%x +>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix +# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode +>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk +#0x1~1,..,0x8~4,0x10~F,0x80~A enabled +#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x +#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot +#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x +# for older versions +>>>(0x1BC.s+9) ubyte <2 +#>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds +>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds +# floppy A: or B: +>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x +>>>>(0x1BC.s+13) ubyte >1 +# 1st hard disc +#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x +# not 1st hard disc +>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x +# for version >= 2 maximal timeout can be 65534 +>>>(0x1BC.s+9) ubyte >1 +#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds +>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds +# floppy A: or B: +>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x +>>>>(0x1BC.s+14) ubyte >1 +# 1st hard disc +#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x +# not 1st hard disc +>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x +>>>0 ubyte x \b) + +# added by Joerg Jenderek +# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or +# grub-1.94/kern/i386/pc/startup.S +# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data +# usual values are marked with comments to get only informations of strange GRUB loaders +0x200 uleshort 0x70EA +# found only version 3.{1,2} +>0x206 ubeshort >0x0300 +# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" +>>0x212 ubyte >0x29 +>>>0x213 ubyte >0x29 +# not iso9660_stage1_5 +#>>>0 ulelong&0x00BE5652 0x00BE5652 +>>>>0x213 ubyte >0x29 GRand Unified Bootloader +# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" +>>>>0x217 ubyte 0xFF stage1_5 +>>>>0x217 ubyte <0xFF stage2 +>>>>0x206 ubyte x \b version %u +>>>>0x207 ubyte x \b.%u +# module_size for 1.94 +>>>>0x208 ulelong <0xffffff \b, installed partition %u +#>>>>0x208 ulelong =0xffffff \b, %u (default) +>>>>0x208 ulelong >0xffffff \b, installed partition %u +# GRUB 0.5.95 unofficial +>>>>0x20C ulelong&0x2E300000 0x2E300000 +# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs +>>>>>0x20C ubyte x \b, identifier 0x%x +#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) +>>>>>0x20D ubyte >0 \b, LBA flag 0x%x +# GRUB version as string +>>>>>0x20E string >\0 \b, GRUB version %-s +# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default +>>>>>>0x215 ulong 0xffffffff +>>>>>>>0x219 string >\0 \b, configuration file %-s +>>>>>>0x215 ulong !0xffffffff +>>>>>>>0x215 string >\0 \b, configuration file %-s +# newer GRUB versions +>>>>0x20C ulelong&0x2E300000 !0x2E300000 +##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) +>>>>>0x20C ulelong >0 \b, saved entry %d +# for 1.94 contains kernel image size +# for 0.93,0.94,0.96,0.97 +# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 +>>>>>0x210 ubyte x \b, identifier 0x%x +# The flag for LBA forcing is in most cases 0 +#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) +>>>>>0x211 ubyte >0 \b, LBA flag 0x%x +# GRUB version as string +>>>>>0x212 string >\0 \b, GRUB version %-s +# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default +>>>>>0x217 ulong 0xffffffff +>>>>>>0x21b string >\0 \b, configuration file %-s +>>>>>0x217 ulong !0xffffffff +>>>>>>0x217 string >\0 \b, configuration file %-s + +# DOS x86 sector updated and separated from "x86 boot sector" by Joerg Jenderek at May 2011 +# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 +# over BIOS parameter block (BPB) +# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD +# older drives may use Near JuMP instruction E9 xx xx +# minimal short forward jump found 0x29 for bootloaders or 0x0 +# maximal short forward jump is 0x7f +# OEM-ID is empty or contain readable bytes +0 ulelong&0x804000E9 0x000000E9 +# mtools-3.9.8/msdos.h +# usual values are marked with comments to get only informations of strange FAT systems +# valid sectorsize must be a power of 2 from 32 to 32768 +>11 uleshort&0xf001f 0 +>>11 uleshort <32769 +>>>11 uleshort >31 +>>>>21 ubyte&0xf0 0xF0 +>>>>>0 ubyte 0xEB +>>>>>>1 ubyte x \b, code offset 0x%x+2 +>>>>>0 ubyte 0xE9 +>>>>>>1 uleshort x \b, code offset 0x%x+2 +>>>>>3 string >\0 \b, OEM-ID "%-.8s" +#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC +>>>>>>8 string IHC \b cached by Windows 9M +>>>>>11 uleshort >512 \b, Bytes/sector %u +#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) +>>>>>11 uleshort <512 \b, Bytes/sector %u +>>>>>13 ubyte >1 \b, sectors/cluster %u +#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) +>>>>>82 string FAT32 +>>>>>>14 uleshort !32 \b, reserved sectors %u +#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) +>>>>>82 string !FAT32 +>>>>>>14 uleshort >1 \b, reserved sectors %u +#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) +#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) +>>>>>16 ubyte >2 \b, FATs %u +#>>>>>16 ubyte =2 \b, FATs %u (usual) +>>>>>16 ubyte =1 \b, FAT %u +>>>>>16 ubyte >0 +>>>>>17 uleshort >0 \b, root entries %u +#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) +>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) +#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) +>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x +#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) +>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x +>>>>>22 uleshort >0 \b, sectors/FAT %u +#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) +>>>>>24 uleshort x \b, sectors/track %u +>>>>>26 ubyte >2 \b, heads %u +#>>>>>26 ubyte =2 \b, heads %u (usual floppy) +>>>>>26 ubyte =1 \b, heads %u +# valid only for sector sizes with more then 32 Bytes +>>>>>11 uleshort >32 +# skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk +>>>>>>38 ubyte !0x70 +>>>>>>>28 ulelong >0 \b, hidden sectors %u +#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) +>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) +#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) +# FAT<32 bit specific +>>>>>>>82 string !FAT32 +#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) +#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) +>>>>>>>>36 ubyte !0x80 +>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x +>>>>>>>>37 ubyte >0 \b, reserved 0x%x +#>>>>>>>>37 ubyte =0 \b, reserved 0x%x +# value is 0x80 for NTFS +>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) +>>>>>>>>38 ubyte =0x29 +>>>>>>>>>39 ulelong x \b, serial number 0x%x +>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" +>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" +>>>>>>>>>43 string =NO\ NAME \b, unlabeled +# there exist some old floppies without word FAT at offset 54 +# a word like "FATnm " is only a hint for a FAT size on nm-bits +# Normally the number of clusters is calculated by the values of BPP. +# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, +# otherwise FAT is 16 bit. +# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html +>>>>>>54 string FAT \b, FAT +>>>>>>>54 string FAT12 \b (12 bit) +>>>>>>>54 string FAT16 \b (16 bit) +# FAT32 bit specific +>>>>>82 string FAT32 \b, FAT (32 bit) +>>>>>>36 ulelong x \b, sectors/FAT %u +# http://technet.microsoft.com/en-us/library/cc977221.aspx +>>>>>>40 uleshort >0 \b, extension flags 0x%x +#>>>>>>40 uleshort =0 \b, extension flags %u +>>>>>>42 uleshort >0 \b, fsVersion %u +#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) +>>>>>>44 ulelong >2 \b, rootdir cluster %u +#>>>>>>44 ulelong =2 \b, rootdir cluster %u +#>>>>>>44 ulelong =1 \b, rootdir cluster %u +>>>>>>48 uleshort >1 \b, infoSector %u +#>>>>>>48 uleshort =1 \b, infoSector %u (usual) +>>>>>>48 uleshort <1 \b, infoSector %u +>>>>>>50 uleshort >6 \b, Backup boot sector %u +#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) +>>>>>>50 uleshort <6 \b, Backup boot sector %u +# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO +>>>>>>52 ulelong >0 \b, reserved1 0x%x +>>>>>>56 ulelong >0 \b, reserved2 0x%x +>>>>>>60 ulelong >0 \b, reserved3 0x%x +# same structure as FAT1X +#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) +#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) +>>>>>>64 ubyte !0x80 +>>>>>>>64 ubyte >0 \b, physical drive 0x%x +# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too +>>>>>>65 ubyte >0 \b, reserved 0x%x +>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) +>>>>>>66 ubyte =0x29 +>>>>>>>67 ulelong x \b, serial number 0x%x +>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" +>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" +>>>>>>>71 string =NO\ NAME \b, unlabeled +# additional tests for floppy image added by Joerg Jenderek +# no fixed disk +>>>>>21 ubyte !0xF8 +# floppy media with 12 bit FAT +>>>>>>54 string !FAT16 +# test for FAT after bootsector +>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT +# floppy image +!:mime application/x-ima +# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm +# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html +# 0 FATs +>>>>>16 ubyte =0 +# 0 root entries +>>>>>>17 uleshort =0 +# 0 DOS sectors +>>>>>>>19 uleshort =0 +# 0 sectors/FAT +# dos < 4.0 BootSector value found is 0x80 +#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) +>>>>>>>>22 uleshort =0 \b; NTFS +>>>>>>>>>24 uleshort >0 \b, sectors/track %u +>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x +>>>>>>>>>40 ulequad >0 \b, sectors %lld +>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld +>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld +# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. +# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. +>>>>>>>>>64 lelong <256 +>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d +>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi) +# Values 0 to 127 represent index block sizes of 0 to 127 clusters. +# Values 128 to 255 represent index block sizes of 2^(256-N) byte +>>>>>>>>>68 ulelong <256 +>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d +#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) +>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi) +>>>>>>>>>72 ulequad x \b, serial number 0%llx +>>>>>>>>>80 ulelong >0 \b, checksum 0x%x +#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) +>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 +>>>>>>>>>>&-92 indirect x \b; contains +# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 +# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm +# unused assembler instructions JMP y2;NOP;NOP +0x056 ulelong&0xFFFF0FFF 0x909002EB +# unicode loadername terminated by CTRL-D +>(0.s*2) ulelong&0xFFFFFF00 0x00040000 +# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR +>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s +>>0x12 string $ +>>>0x0c lestring16 x \b%-2.2s +### DOS,NTFS boot sectors end + +9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), +>8404 string x last mounted on %s, +#>9504 ledate x last checked at %s, +>8224 ledate x last written at %s, +>8401 byte x clean flag %d, +>8228 lelong x number of blocks %d, +>8232 lelong x number of data blocks %d, +>8236 lelong x number of cylinder groups %d, +>8240 lelong x block size %d, +>8244 lelong x fragment size %d, +>8252 lelong x minimum percentage of free blocks %d, +>8256 lelong x rotational delay %dms, +>8260 lelong x disk rotational speed %drps, +>8320 lelong 0 TIME optimization +>8320 lelong 1 SPACE optimization + +42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) +>&-1164 string x last mounted on %s, +>&-696 string >\0 volume name %s, +>&-304 leqldate x last written at %s, +>&-1167 byte x clean flag %d, +>&-1168 byte x readonly flag %d, +>&-296 lequad x number of blocks %lld, +>&-288 lequad x number of data blocks %lld, +>&-1332 lelong x number of cylinder groups %d, +>&-1328 lelong x block size %d, +>&-1324 lelong x fragment size %d, +>&-180 lelong x average file size %d, +>&-176 lelong x average number of files in dir %d, +>&-272 lequad x pending blocks to free %lld, +>&-264 lelong x pending inodes to free %ld, +>&-664 lequad x system-wide uuid %0llx, +>&-1316 lelong x minimum percentage of free blocks %d, +>&-1248 lelong 0 TIME optimization +>&-1248 lelong 1 SPACE optimization + +66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) +>&-1164 string x last mounted on %s, +>&-696 string >\0 volume name %s, +>&-304 leqldate x last written at %s, +>&-1167 byte x clean flag %d, +>&-1168 byte x readonly flag %d, +>&-296 lequad x number of blocks %lld, +>&-288 lequad x number of data blocks %lld, +>&-1332 lelong x number of cylinder groups %d, +>&-1328 lelong x block size %d, +>&-1324 lelong x fragment size %d, +>&-180 lelong x average file size %d, +>&-176 lelong x average number of files in dir %d, +>&-272 lequad x pending blocks to free %lld, +>&-264 lelong x pending inodes to free %ld, +>&-664 lequad x system-wide uuid %0llx, +>&-1316 lelong x minimum percentage of free blocks %d, +>&-1248 lelong 0 TIME optimization +>&-1248 lelong 1 SPACE optimization + +9564 belong 0x00011954 Unix Fast File system [v1] (big-endian), +>7168 belong 0x4c41424c Apple UFS Volume +>>7186 string x named %s, +>>7176 belong x volume label version %d, +>>7180 bedate x created on %s, +>8404 string x last mounted on %s, +#>9504 bedate x last checked at %s, +>8224 bedate x last written at %s, +>8401 byte x clean flag %d, +>8228 belong x number of blocks %d, +>8232 belong x number of data blocks %d, +>8236 belong x number of cylinder groups %d, +>8240 belong x block size %d, +>8244 belong x fragment size %d, +>8252 belong x minimum percentage of free blocks %d, +>8256 belong x rotational delay %dms, +>8260 belong x disk rotational speed %drps, +>8320 belong 0 TIME optimization +>8320 belong 1 SPACE optimization + +42332 belong 0x19540119 Unix Fast File system [v2] (big-endian) +>&-1164 string x last mounted on %s, +>&-696 string >\0 volume name %s, +>&-304 beqldate x last written at %s, +>&-1167 byte x clean flag %d, +>&-1168 byte x readonly flag %d, +>&-296 bequad x number of blocks %lld, +>&-288 bequad x number of data blocks %lld, +>&-1332 belong x number of cylinder groups %d, +>&-1328 belong x block size %d, +>&-1324 belong x fragment size %d, +>&-180 belong x average file size %d, +>&-176 belong x average number of files in dir %d, +>&-272 bequad x pending blocks to free %lld, +>&-264 belong x pending inodes to free %ld, +>&-664 bequad x system-wide uuid %0llx, +>&-1316 belong x minimum percentage of free blocks %d, +>&-1248 belong 0 TIME optimization +>&-1248 belong 1 SPACE optimization + +66908 belong 0x19540119 Unix Fast File system [v2] (big-endian) +>&-1164 string x last mounted on %s, +>&-696 string >\0 volume name %s, +>&-304 beqldate x last written at %s, +>&-1167 byte x clean flag %d, +>&-1168 byte x readonly flag %d, +>&-296 bequad x number of blocks %lld, +>&-288 bequad x number of data blocks %lld, +>&-1332 belong x number of cylinder groups %d, +>&-1328 belong x block size %d, +>&-1324 belong x fragment size %d, +>&-180 belong x average file size %d, +>&-176 belong x average number of files in dir %d, +>&-272 bequad x pending blocks to free %lld, +>&-264 belong x pending inodes to free %ld, +>&-664 bequad x system-wide uuid %0llx, +>&-1316 belong x minimum percentage of free blocks %d, +>&-1248 belong 0 TIME optimization +>&-1248 belong 1 SPACE optimization + +# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> +# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> +# volume label and UUID Russell Coker +# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ +0x438 leshort 0xEF53 Linux +>0x44c lelong x rev %d +>0x43e leshort x \b.%d +# No journal? ext2 +>0x45c lelong ^0x0000004 ext2 filesystem data +>>0x43a leshort ^0x0000001 (mounted or unclean) +# Has a journal? ext3 or ext4 +>0x45c lelong &0x0000004 +# and small INCOMPAT? +>>0x460 lelong <0x0000040 +# and small RO_COMPAT? +>>>0x464 lelong <0x0000008 ext3 filesystem data +# else large RO_COMPAT? +>>>0x464 lelong >0x0000007 ext4 filesystem data +# else large INCOMPAT? +>>0x460 lelong >0x000003f ext4 filesystem data +>0x468 belong x \b, UUID=%08x +>0x46c beshort x \b-%04x +>0x46e beshort x \b-%04x +>0x470 beshort x \b-%04x +>0x472 belong x \b-%08x +>0x476 beshort x \b%04x +>0x478 string >0 \b, volume name "%s" +# General flags for any ext* fs +>0x460 lelong &0x0000004 (needs journal recovery) +>0x43a leshort &0x0000002 (errors) +# INCOMPAT flags +>0x460 lelong &0x0000001 (compressed) +#>0x460 lelong &0x0000002 (filetype) +#>0x460 lelong &0x0000010 (meta bg) +>0x460 lelong &0x0000040 (extents) +>0x460 lelong &0x0000080 (64bit) +#>0x460 lelong &0x0000100 (mmp) +#>0x460 lelong &0x0000200 (flex bg) +# RO_INCOMPAT flags +#>0x464 lelong &0x0000001 (sparse super) +>0x464 lelong &0x0000002 (large files) +>0x464 lelong &0x0000008 (huge files) +#>0x464 lelong &0x0000010 (gdt checksum) +#>0x464 lelong &0x0000020 (many subdirs) +#>0x463 lelong &0x0000040 (extra isize) + +# Minix filesystems - Juan Cespedes <cespedes@debian.org> +0x410 leshort 0x137f +!:strength / 2 +>0x402 beshort < 100 +>0x402 beshort > -1 Minix filesystem, V1, %d zones +>0x1e string minix \b, bootable +0x410 beshort 0x137f +!:strength / 2 +>0x402 beshort < 100 +>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones +>0x1e string minix \b, bootable +0x410 leshort 0x138f +!:strength / 2 +>0x402 beshort < 100 +>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones +>0x1e string minix \b, bootable +0x410 beshort 0x138f +!:strength / 2 +>0x402 beshort < 100 +>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones +>0x1e string minix \b, bootable +0x410 leshort 0x2468 +>0x402 beshort < 100 +>>0x402 beshort > -1 Minix filesystem, V2, %d zones +>0x1e string minix \b, bootable +0x410 beshort 0x2468 +>0x402 beshort < 100 +>0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones +>0x1e string minix \b, bootable + +0x410 leshort 0x2478 +>0x402 beshort < 100 +>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones +>0x1e string minix \b, bootable +0x410 leshort 0x2478 +>0x402 beshort < 100 +>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones +>0x1e string minix \b, bootable +0x410 beshort 0x2478 +>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones +>0x1e string minix \b, bootable +0x410 leshort 0x4d5a +>0x402 beshort !0 Minix filesystem, V3, %d zones +>0x1e string minix \b, bootable + +# SGI disk labels - Nathan Scott <nathans@debian.org> +0 belong 0x0BE5A941 SGI disk label (volume header) + +# SGI XFS filesystem - Nathan Scott <nathans@debian.org> +0 belong 0x58465342 SGI XFS filesystem data +>0x4 belong x (blksz %d, +>0x68 beshort x inosz %d, +>0x64 beshort ^0x2004 v1 dirs) +>0x64 beshort &0x2004 v2 dirs) + +############################################################################ +# Minix-ST kernel floppy +0x800 belong 0x46fc2700 Atari-ST Minix kernel image +>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy +>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy + +############################################################################ +# Hmmm, is this a better way of detecting _standard_ floppy images ? +19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k +>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector +19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k +>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector +19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k +>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector + +19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM +>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector +19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs +>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector + +19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k +19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k + +# Valid media descriptor bytes for MS-DOS: +# +# Byte Capacity Media Size and Type +# ------------------------------------------------- +# +# F0 2.88 MB 3.5-inch, 2-sided, 36-sector +# F0 1.44 MB 3.5-inch, 2-sided, 18-sector +# F9 720K 3.5-inch, 2-sided, 9-sector +# F9 1.2 MB 5.25-inch, 2-sided, 15-sector +# FD 360K 5.25-inch, 2-sided, 9-sector +# FF 320K 5.25-inch, 2-sided, 8-sector +# FC 180K 5.25-inch, 1-sided, 9-sector +# FE 160K 5.25-inch, 1-sided, 8-sector +# FE 250K 8-inch, 1-sided, single-density +# FD 500K 8-inch, 2-sided, single-density +# FE 1.2 MB 8-inch, 2-sided, double-density +# F8 ----- Fixed disk +# +# FC xxxK Apricot 70x1x9 boot disk. +# +# Originally a bitmap: +# xxxxxxx0 Not two sided +# xxxxxxx1 Double sided +# xxxxxx0x Not 8 SPT +# xxxxxx1x 8 SPT +# xxxxx0xx Not Removable drive +# xxxxx1xx Removable drive +# 11111xxx Must be one. +# +# But now it's rather random: +# 111111xx Low density disk +# 00 SS, Not 8 SPT +# 01 DS, Not 8 SPT +# 10 SS, 8 SPT +# 11 DS, 8 SPT +# +# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 +# 11110000 High density 3 1/2 floppy disk +# 11111000 Hard disk any format +# + +# CDROM Filesystems +# Modified for UDF by gerardo.cacciari@gmail.com +32769 string CD001 # +!:mime application/x-iso9660-image +>38913 string !NSR0 ISO 9660 CD-ROM filesystem data +>38913 string NSR0 UDF filesystem data +>>38917 string 1 (version 1.0) +>>38917 string 2 (version 1.5) +>>38917 string 3 (version 2.0) +>>38917 byte >0x33 (unknown version, ID 0x%X) +>>38917 byte <0x31 (unknown version, ID 0x%X) +# "application id" which appears to be used as a volume label +>32808 string/T >\0 '%s' +>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) +37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) +!:mime application/x-iso9660-image +32776 string CDROM High Sierra CD-ROM filesystem data + +# .cso files +0 string CISO Compressed ISO CD image + +# cramfs filesystem - russell@coker.com.au +0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian +>4 lelong x size %lu +>8 lelong &1 version #2 +>8 lelong &2 sorted_dirs +>8 lelong &4 hole_support +>32 lelong x CRC 0x%x, +>36 lelong x edition %lu, +>40 lelong x %lu blocks, +>44 lelong x %lu files + +0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian +>4 belong x size %lu +>8 belong &1 version #2 +>8 belong &2 sorted_dirs +>8 belong &4 hole_support +>32 belong x CRC 0x%x, +>36 belong x edition %lu, +>40 belong x %lu blocks, +>44 belong x %lu files + +# reiserfs - russell@coker.com.au +0x10034 string ReIsErFs ReiserFS V3.5 +0x10034 string ReIsEr2Fs ReiserFS V3.6 +0x10034 string ReIsEr3Fs ReiserFS V3.6.19 +>0x1002c leshort x block size %d +>0x10032 leshort &2 (mounted or unclean) +>0x10000 lelong x num blocks %d +>0x10040 lelong 1 tea hash +>0x10040 lelong 2 yura hash +>0x10040 lelong 3 r5 hash + +# JFFS - russell@coker.com.au +0 lelong 0x34383931 Linux Journalled Flash File system, little endian +0 belong 0x34383931 Linux Journalled Flash File system, big endian + +# EST flat binary format (which isn't, but anyway) +# From: Mark Brown <broonie@sirena.org.uk> +0 string ESTFBINR EST flat binary + +# Aculab VoIP firmware +# From: Mark Brown <broonie@sirena.org.uk> +0 string VoIP\ Startup\ and Aculab VoIP firmware +>35 string x format %s + +# From: Mark Brown <broonie@sirena.org.uk> [old] +# From: Behan Webster <behanw@websterwood.com> +0 belong 0x27051956 u-boot legacy uImage, +>32 string x %s, +>28 byte 0 Invalid os/ +>28 byte 1 OpenBSD/ +>28 byte 2 NetBSD/ +>28 byte 3 FreeBSD/ +>28 byte 4 4.4BSD/ +>28 byte 5 Linux/ +>28 byte 6 SVR4/ +>28 byte 7 Esix/ +>28 byte 8 Solaris/ +>28 byte 9 Irix/ +>28 byte 10 SCO/ +>28 byte 11 Dell/ +>28 byte 12 NCR/ +>28 byte 13 LynxOS/ +>28 byte 14 VxWorks/ +>28 byte 15 pSOS/ +>28 byte 16 QNX/ +>28 byte 17 Firmware/ +>28 byte 18 RTEMS/ +>28 byte 19 ARTOS/ +>28 byte 20 Unity OS/ +>28 byte 21 INTEGRITY/ +>29 byte 0 \bInvalid CPU, +>29 byte 1 \bAlpha, +>29 byte 2 \bARM, +>29 byte 3 \bIntel x86, +>29 byte 4 \bIA64, +>29 byte 5 \bMIPS, +>29 byte 6 \bMIPS 64-bit, +>29 byte 7 \bPowerPC, +>29 byte 8 \bIBM S390, +>29 byte 9 \bSuperH, +>29 byte 10 \bSparc, +>29 byte 11 \bSparc 64-bit, +>29 byte 12 \bM68K, +>29 byte 13 \bNios-32, +>29 byte 14 \bMicroBlaze, +>29 byte 15 \bNios-II, +>29 byte 16 \bBlackfin, +>29 byte 17 \bAVR32, +>29 byte 18 \bSTMicroelectronics ST200, +>30 byte 0 Invalid Image +>30 byte 1 Standalone Program +>30 byte 2 OS Kernel Image +>30 byte 3 RAMDisk Image +>30 byte 4 Multi-File Image +>30 byte 5 Firmware Image +>30 byte 6 Script File +>30 byte 7 Filesystem Image (any type) +>30 byte 8 Binary Flat Device Tree BLOB +>31 byte 0 (Not compressed), +>31 byte 1 (gzip), +>31 byte 2 (bzip2), +>31 byte 3 (lzma), +>12 belong x %d bytes, +>8 bedate x %s, +>16 belong x Load Address: 0x%08X, +>20 belong x Entry Point: 0x%08X, +>4 belong x Header CRC: 0x%08X, +>24 belong x Data CRC: 0x%08X + +# JFFS2 file system +0 leshort 0x1984 Linux old jffs2 filesystem data little endian +0 leshort 0x1985 Linux jffs2 filesystem data little endian + +# Squashfs +0 string sqsh Squashfs filesystem, big endian, +>28 beshort x version %d. +>30 beshort x \b%d, +>28 beshort <3 +>>8 belong x %d bytes, +>28 beshort >2 +>>28 beshort <4 +>>>63 bequad x %lld bytes, +>>28 beshort >3 +>>>40 bequad x %lld bytes, +#>>67 belong x %d bytes, +>4 belong x %d inodes, +>28 beshort <2 +>>32 beshort x blocksize: %d bytes, +>28 beshort >1 +>>28 beshort <4 +>>>51 belong x blocksize: %d bytes, +>>28 beshort >3 +>>>12 belong x blocksize: %d bytes, +>28 beshort <4 +>>39 bedate x created: %s +>28 beshort >3 +>>8 bedate x created: %s +0 string hsqs Squashfs filesystem, little endian, +>28 leshort x version %d. +>30 leshort x \b%d, +>28 leshort <3 +>>8 lelong x %d bytes, +>28 leshort >2 +>>28 leshort <4 +>>>63 lequad x %lld bytes, +>>28 leshort >3 +>>>40 lequad x %lld bytes, +#>>63 lelong x %d bytes, +>4 lelong x %d inodes, +>28 leshort <2 +>>32 leshort x blocksize: %d bytes, +>28 leshort >1 +>>28 leshort <4 +>>>51 lelong x blocksize: %d bytes, +>>28 leshort >3 +>>>12 lelong x blocksize: %d bytes, +>28 leshort <4 +>>39 ledate x created: %s +>28 leshort >3 +>>8 ledate x created: %s + +# AFS Dump Magic +# From: Ty Sarna <tsarna@sarna.org> +0 string \x01\xb3\xa1\x13\x22 AFS Dump +>&0 belong x (v%d) +>>&0 byte 0x76 +>>>&0 belong x Vol %d, +>>>>&0 byte 0x6e +>>>>>&0 string x %s +>>>>>>&1 byte 0x74 +>>>>>>>&0 beshort 2 +>>>>>>>>&4 bedate x on: %s +>>>>>>>>&0 bedate =0 full dump +>>>>>>>>&0 bedate !0 incremental since: %s + +#---------------------------------------------------------- +#delta ISO Daniel Novotny (dnovotny@redhat.com) +0 string DISO Delta ISO data +>4 belong x version %d + +# VMS backup savesets - gerardo.cacciari@gmail.com +# +4 string \x01\x00\x01\x00\x01\x00 +>(0.s+16) string \x01\x01 +>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data +>>>40 lelong x (block size %d, +>>>49 string >\0 original name '%s', +>>>2 short 1024 VAX generated) +>>>2 short 2048 AXP generated) +>>>2 short 4096 I64 generated) + +# Summary: Oracle Clustered Filesystem +# Created by: Aaron Botsis <redhat@digitalmafia.org> +8 string OracleCFS Oracle Clustered Filesystem, +>4 long x rev %d +>0 long x \b.%d, +>560 string x label: %.64s, +>136 string x mountpoint: %.128s + +# Summary: Oracle ASM tagged volume +# Created by: Aaron Botsis <redhat@digitalmafia.org> +32 string ORCLDISK Oracle ASM Volume, +>40 string x Disk Name: %0.12s +32 string ORCLCLRD Oracle ASM Volume (cleared), +>40 string x Disk Name: %0.12s + +# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> +8 string OracleCFS Oracle Clustered Filesystem, +>4 long x rev %d +>0 long x \b.%d, +>560 string x label: %.64s, +>136 string x mountpoint: %.128s + +# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> +32 string ORCLDISK Oracle ASM Volume, +>40 string x Disk Name: %0.12s +32 string ORCLCLRD Oracle ASM Volume (cleared), +>40 string x Disk Name: %0.12s + +# Compaq/HP RILOE floppy image +# From: Dirk Jagdmann <doj@cubic.org> +0 string CPQRFBLO Compaq/HP RILOE floppy image + +#------------------------------------------------------------------------------ +# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). +# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, +# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com +# +1008 string DECFILE11 Files-11 On-Disk Structure +>525 byte x Level %d +>525 byte x (ODS-%d); +>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; +>1017 string B +>>525 byte 2 VAX/VMS or OpenVMS file system; +>>525 byte 5 OpenVMS Alpha or Itanium file system; +>984 string x volume label is '%-12.12s' + +# From: Thomas Klausner <wiz@NetBSD.org> +# http://filext.com/file-extension/DAA +# describes the daa file format. The magic would be: +0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive + +# From Albert Cahalan <acahalan@gmail.com> +# really le32 operation,destination,payloadsize (but quite predictable) +# 01 00 00 00 00 00 00 c0 00 02 00 00 +0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware + +# From Eric Sandeen +# GFS2 +0x10000 belong 0x01161970 +>0x10018 belong 0x0000051d GFS1 Filesystem +>>0x10024 belong x (blocksize %d, +>>0x10060 string >\0 lockproto %s) +>0x10018 belong 0x00000709 GFS2 Filesystem +>>0x10024 belong x (blocksize %d, +>>0x10060 string >\0 lockproto %s) + +# BTRFS +0x10040 string _BHRfS_M BTRFS Filesystem +>0x1012b string >\0 (label "%s", +>0x10090 lelong x sectorsize %d, +>0x10094 lelong x nodesize %d, +>0x10098 lelong x leafsize %d) + + +# dvdisaster's .ecc +# From: "Nelson A. de Oliveira" <naoliv@gmail.com> +0 string *dvdisaster* dvdisaster error correction file + +# xfs metadump image +# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog +# but can we do the << ? For now it's always 512 (0x200) anyway. +0 string XFSM +>0x200 string XFSB XFS filesystem metadump image + +# Type: CROM filesystem +# From: Werner Fink <werner@suse.de> +0 string CROMFS CROMFS +>6 string >\0 \b version %2.2s, +>8 ulequad >0 \b block data at %lld, +>16 ulequad >0 \b fblock table at %lld, +>24 ulequad >0 \b inode table at %lld, +>32 ulequad >0 \b root at %lld, +>40 ulelong >0 \b fblock size = %ld, +>44 ulelong >0 \b block size = %ld, +>48 ulequad >0 \b bytes = %lld + +# Type: xfs metadump image +# From: Daniel Novotny <dnovotny@redhat.com> +# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog +# but can we do the << ? For now it's always 512 (0x200) anyway. +0 string XFSM +>0x200 string XFSB XFS filesystem metadump image + +# Type: delta ISO +# From: Daniel Novotny <dnovotny@redhat.com> +0 string DISO Delta ISO data, +>4 belong x version %d + +# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) +# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +0x8000 string JFS1 +# Because it's text-only magic, check a binary value (version) to be sure. +# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be +# mountable. +>&0 lelong <3 JFS2 filesystem image +# Label is followed by a UUID; we have to limit string length to avoid +# appending the UUID in the case of a 16-byte label. +>>&144 regex [\x20-\x7E]{1,16} (label "%s") +>>&0 lequad x \b, %lld blocks +>>&8 lelong x \b, blocksize %d +>>&32 lelong&0x00000006 >0 (dirty) +>>&36 lelong >0 (compressed) + +# LFS +0 lelong 0x070162 LFS filesystem image +>4 lelong 1 version 1, +>>8 lelong x \b blocks %u, +>>12 lelong x \b blocks per segment %u, +>4 lelong 2 version 2, +>>8 lelong x \b fragments %u, +>>12 lelong x \b bytes per segment %u, +>16 lelong x \b disk blocks %u, +>20 lelong x \b block size %u, +>24 lelong x \b fragment size %u, +>28 lelong x \b fragments per block %u, +>32 lelong x \b start for free list %u, +>36 lelong x \b number of free blocks %d, +>40 lelong x \b number of files %u, +>44 lelong x \b blocks available for writing %d, +>48 lelong x \b inodes in cache %d, +>52 lelong x \b inode file disk address 0x%x, +>56 lelong x \b inode file inode number %u, +>60 lelong x \b address of last segment written 0x%x, +>64 lelong x \b address of next segment to write 0x%x, +>68 lelong x \b address of current segment written 0x%x + +0 string td\000 floppy image data (TeleDisk, compressed) +0 string TD\000 floppy image data (TeleDisk) + +0 string CQ\024 floppy image data (CopyQM, +>16 leshort x %d sectors, +>18 leshort x %d heads.) + +0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) + +0 beshort 0xAA58 floppy image data (IBM SaveDskF, old) +0 beshort 0xAA59 floppy image data (IBM SaveDskF) +0 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) + +0 string \074CPM_Disk\076 disk image data (YAZE) diff --git a/magic/Magdir/flash b/magic/Magdir/flash new file mode 100644 index 0000000..dea35ae --- /dev/null +++ b/magic/Magdir/flash @@ -0,0 +1,25 @@ + +#------------------------------------------------------------------------------ +# $File: flash,v 1.9 2009/11/08 01:30:01 christos Exp $ +# flash: file(1) magic for Macromedia Flash file format +# +# See +# +# http://www.macromedia.com/software/flash/open/ +# +0 string FWS Macromedia Flash data, +>3 byte x version %d +!:mime application/x-shockwave-flash +0 string CWS Macromedia Flash data (compressed), +!:mime application/x-shockwave-flash +>3 byte x version %d +# From: Cal Peake <cp@absolutedigital.net> +0 string FLV Macromedia Flash Video +!:mime video/x-flv + +# +# Yosu Gomez +0 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document +0 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document +# From Dave Wilson +0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document diff --git a/magic/Magdir/fonts b/magic/Magdir/fonts new file mode 100644 index 0000000..88ca91c --- /dev/null +++ b/magic/Magdir/fonts @@ -0,0 +1,93 @@ + +#------------------------------------------------------------------------------ +# $File: fonts,v 1.25 2013/02/06 14:18:52 christos Exp $ +# fonts: file(1) magic for font data +# +0 search/1 FONT ASCII vfont text +0 short 0436 Berkeley vfont data +0 short 017001 byte-swapped Berkeley vfont data + +# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com +0 string %!PS-AdobeFont-1. PostScript Type 1 font text +>20 string >\0 (%s) +6 string %!PS-AdobeFont-1. PostScript Type 1 font program data +0 string %!FontType1 PostScript Type 1 font program data +6 string %!FontType1 PostScript Type 1 font program data +0 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text + +# X11 font files in SNF (Server Natural Format) format +0 belong 00000004 X11 SNF font data, MSB first +0 lelong 00000004 X11 SNF font data, LSB first + +# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) +0 search/1 STARTFONT\ X11 BDF font text + +# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) +# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) +0 string \001fcp X11 Portable Compiled Font data +>12 byte 0x02 \b, LSB first +>12 byte 0x0a \b, MSB first +0 string D1.0\015 X11 Speedo font data + +#------------------------------------------------------------------------------ +# FIGlet fonts and controlfiles +# From figmagic supplied with Figlet version 2.2 +# "David E. O'Brien" <obrien@FreeBSD.ORG> +0 string flf FIGlet font +>3 string >2a version %-2.2s +0 string flc FIGlet controlfile +>3 string >2a version %-2.2s + +# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) +# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ +0 belong 0x14025919 libGrx font data, +>8 leshort x %dx +>10 leshort x \b%d +>40 string x %s +# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) +0 belong 0xff464f4e DOS code page font data collection +7 belong 0x00454741 DOS code page font data +7 belong 0x00564944 DOS code page font data (from Linux?) +4098 string DOSFONT DOSFONT2 encrypted font data + +# downloadable fonts for browser (prints type) anthon@mnt.org +0 string PFR1 PFR1 font +>102 string >0 \b: %s + +# True Type fonts +0 string \000\001\000\000\000 TrueType font data +!:mime application/x-font-ttf + +0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font +0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font + +# TrueType/OpenType font collections (.ttc) +# http://www.microsoft.com/typography/otspec/otff.htm +0 string ttcf TrueType font collection data +>4 belong 0x00010000 \b, 1.0 +>>8 belong >0 \b, %d fonts +>4 belong 0x00020000 \b, 2.0 +>>8 belong >0 \b, %d fonts +# 0x44454947 = 'DSIG' +>>>16 belong 0x44534947 \b, digitally signed + +# Opentype font data from Avi Bercovich +0 string OTTO OpenType font data +!:mime application/vnd.ms-opentype + +# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu +0 string SplineFontDB: Spline Font Database +!:mime application/vnd.font-fontforge-sfd +>14 string x version %s + +# EOT +34 string LP Embedded OpenType (EOT) +!:mime application/vnd.ms-fontobject + +# Web Open Font Format (.woff) +# http://www.w3.org/TR/WOFF/ +0 string wOFF Web Open Font Format +>4 belong x \b, flavor %d +>8 belong x \b, length %d +>20 beshort x \b, version %hd +>22 beshort x \b.%hd diff --git a/magic/Magdir/fortran b/magic/Magdir/fortran new file mode 100644 index 0000000..0604c25 --- /dev/null +++ b/magic/Magdir/fortran @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# $File: fortran,v 1.7 2012/06/21 01:55:02 christos Exp $ +# FORTRAN source +0 regex/100 \^[Cc][\ \t] FORTRAN program +!:mime text/x-fortran +!:strength - 5 diff --git a/magic/Magdir/frame b/magic/Magdir/frame new file mode 100644 index 0000000..babe890 --- /dev/null +++ b/magic/Magdir/frame @@ -0,0 +1,50 @@ + +#------------------------------------------------------------------------------ +# $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $ +# frame: file(1) magic for FrameMaker files +# +# This stuff came on a FrameMaker demo tape, most of which is +# copyright, but this file is "published" as witness the following: +# +# Note that this is the Framemaker Maker Interchange Format, not the +# Normal format which would be application/vnd.framemaker. +# +0 string \<MakerFile FrameMaker document +!:mime application/x-mif +>11 string 5.5 (5.5 +>11 string 5.0 (5.0 +>11 string 4.0 (4.0 +>11 string 3.0 (3.0 +>11 string 2.0 (2.0 +>11 string 1.0 (1.0 +>14 byte x %c) +0 string \<MIFFile FrameMaker MIF (ASCII) file +!:mime application/x-mif +>9 string 4.0 (4.0) +>9 string 3.0 (3.0) +>9 string 2.0 (2.0) +>9 string 1.0 (1.x) +0 search/1 \<MakerDictionary FrameMaker Dictionary text +!:mime application/x-mif +>17 string 3.0 (3.0) +>17 string 2.0 (2.0) +>17 string 1.0 (1.x) +0 string \<MakerScreenFont FrameMaker Font file +!:mime application/x-mif +>17 string 1.01 (%s) +0 string \<MML FrameMaker MML file +!:mime application/x-mif +0 string \<BookFile FrameMaker Book file +!:mime application/x-mif +>10 string 3.0 (3.0 +>10 string 2.0 (2.0 +>10 string 1.0 (1.0 +>13 byte x %c) +# XXX - this book entry should be verified, if you find one, uncomment this +#0 string \<Book\ FrameMaker Book (ASCII) file +#!:mime application/x-mif +#>6 string 3.0 (3.0) +#>6 string 2.0 (2.0) +#>6 string 1.0 (1.0) +0 string \<Maker Intermediate Print File FrameMaker IPL file +!:mime application/x-mif diff --git a/magic/Magdir/freebsd b/magic/Magdir/freebsd new file mode 100644 index 0000000..a01ac4a --- /dev/null +++ b/magic/Magdir/freebsd @@ -0,0 +1,144 @@ + +#------------------------------------------------------------------------------ +# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ +# freebsd: file(1) magic for FreeBSD objects +# +# All new-style FreeBSD magic numbers are in host byte order (i.e., +# little-endian on x86). +# +# XXX - this comes from the file "freebsd" in a recent FreeBSD version of +# "file"; it, and the NetBSD stuff in "netbsd", appear to use different +# schemes for distinguishing between executable images, shared libraries, +# and object files. +# +# FreeBSD says: +# +# Regardless of whether it's pure, demand-paged, or none of the +# above: +# +# if the entry point is < 4096, then it's a shared library if +# the "has run-time loader information" bit is set, and is +# position-independent if the "is position-independent" bit +# is set; +# +# if the entry point is >= 4096 (or >4095, same thing), then it's +# an executable, and is dynamically-linked if the "has run-time +# loader information" bit is set. +# +# On x86, NetBSD says: +# +# If it's neither pure nor demand-paged: +# +# if it has the "has run-time loader information" bit set, it's +# a dynamically-linked executable; +# +# if it doesn't have that bit set, then: +# +# if it has the "is position-independent" bit set, it's +# position-independent; +# +# if the entry point is non-zero, it's an executable, otherwise +# it's an object file. +# +# If it's pure: +# +# if it has the "has run-time loader information" bit set, it's +# a dynamically-linked executable, otherwise it's just an +# executable. +# +# If it's demand-paged: +# +# if it has the "has run-time loader information" bit set, +# then: +# +# if the entry point is < 4096, it's a shared library; +# +# if the entry point is = 4096 or > 4096 (i.e., >= 4096), +# it's a dynamically-linked executable); +# +# if it doesn't have the "has run-time loader information" bit +# set, then it's just an executable. +# +# (On non-x86, NetBSD does much the same thing, except that it uses +# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K +# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's +# had 8K pages; dunno about MIPS.) +# +# I suspect the two will differ only in perverse and uninteresting cases +# ("shared" libraries that aren't demand-paged and whose pages probably +# won't actually be shared, executables with entry points <4096). +# +# I leave it to those more familiar with FreeBSD and NetBSD to figure out +# what the right answer is (although using ">4095", FreeBSD-style, is +# probably better than separately checking for "=4096" and ">4096", +# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged +# executables using the NetBSD technique.) +# +0 lelong&0377777777 041400407 FreeBSD/i386 +>20 lelong <4096 +>>3 byte&0xC0 &0x80 shared library +>>3 byte&0xC0 0x40 PIC object +>>3 byte&0xC0 0x00 object +>20 lelong >4095 +>>3 byte&0x80 0x80 dynamically linked executable +>>3 byte&0x80 0x00 executable +>16 lelong >0 not stripped + +0 lelong&0377777777 041400410 FreeBSD/i386 pure +>20 lelong <4096 +>>3 byte&0xC0 &0x80 shared library +>>3 byte&0xC0 0x40 PIC object +>>3 byte&0xC0 0x00 object +>20 lelong >4095 +>>3 byte&0x80 0x80 dynamically linked executable +>>3 byte&0x80 0x00 executable +>16 lelong >0 not stripped + +0 lelong&0377777777 041400413 FreeBSD/i386 demand paged +>20 lelong <4096 +>>3 byte&0xC0 &0x80 shared library +>>3 byte&0xC0 0x40 PIC object +>>3 byte&0xC0 0x00 object +>20 lelong >4095 +>>3 byte&0x80 0x80 dynamically linked executable +>>3 byte&0x80 0x00 executable +>16 lelong >0 not stripped + +0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged +>20 lelong <4096 +>>3 byte&0xC0 &0x80 shared library +>>3 byte&0xC0 0x40 PIC object +>>3 byte&0xC0 0x00 object +>20 lelong >4095 +>>3 byte&0x80 0x80 dynamically linked executable +>>3 byte&0x80 0x00 executable +>16 lelong >0 not stripped + +# XXX gross hack to identify core files +# cores start with a struct tss; we take advantage of the following: +# byte 7: highest byte of the kernel stack pointer, always 0xfe +# 8/9: kernel (ring 0) ss value, always 0x0010 +# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 +# 28: low order byte of the current PTD entry, always 0 since the +# PTD is page-aligned +# +7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file +>1039 string >\0 from '%s' + +# /var/run/ld.so.hints +# What are you laughing about? +0 lelong 011421044151 ld.so hints file (Little Endian +>4 lelong >0 \b, version %d) +>4 belong <1 \b) +0 belong 011421044151 ld.so hints file (Big Endian +>4 belong >0 \b, version %d) +>4 belong <1 \b) + +# +# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities +# +0 string SCRSHOT_ scrshot(1) screenshot, +>8 byte x version %d, +>9 byte 2 %d bytes in header, +>>10 byte x %d chars wide by +>>11 byte x %d chars high diff --git a/magic/Magdir/fsav b/magic/Magdir/fsav new file mode 100644 index 0000000..0a7a7f8 --- /dev/null +++ b/magic/Magdir/fsav @@ -0,0 +1,63 @@ + +#------------------------------------------------------------------------------ +# $File: fsav,v 1.11 2009/09/19 16:28:09 christos Exp $ +# fsav: file(1) magic for datafellows fsav virus definition files +# Anthon van der Neut (anthon@mnt.org) + +# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} +0 beshort 0x1575 fsav macro virus signatures +>8 leshort >0 (%d- +>11 byte >0 \b%02d- +>10 byte >0 \b%02d) +# ftp://ftp.f-prot.com/pub/sign.zip +#10 ubyte <12 +#>9 ubyte <32 +#>>8 ubyte 0x0a +#>>>12 ubyte 0x07 +#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- +#>>>>10 byte 0 \b01- +#>>>>10 byte 1 \b02- +#>>>>10 byte 2 \b03- +#>>>>10 byte 3 \b04- +#>>>>10 byte 4 \b05- +#>>>>10 byte 5 \b06- +#>>>>10 byte 6 \b07- +#>>>>10 byte 7 \b08- +#>>>>10 byte 8 \b09- +#>>>>10 byte 9 \b10- +#>>>>10 byte 10 \b11- +#>>>>10 byte 11 \b12- +#>>>>9 ubyte >0 \b%02d) +# ftp://ftp.f-prot.com/pub/sign2.zip +#0 ubyte 0x62 +#>1 ubyte 0xF5 +#>>2 ubyte 0x1 +#>>>3 ubyte 0x1 +#>>>>4 ubyte 0x0e +#>>>>>13 ubyte >0 fsav virus signatures +#>>>>>>11 ubyte x size 0x%02x +#>>>>>>12 ubyte x \b%02x +#>>>>>>13 ubyte x \b%02x bytes + +# Joerg Jenderek: joerg dot jenderek at web dot de +# http://www.clamav.net/doc/latest/html/node45.html +# .cvd files start with a 512 bytes colon separated header +# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime +# + gzipped tarball files +0 string ClamAV-VDB: +>11 string >\0 Clam AntiVirus database %-.23s +>>34 string : +>>>35 string !: \b, version +>>>>35 string x \b%-.1s +>>>>>36 string !: +>>>>>>36 string x \b%-.1s +>>>>>>>37 string !: +>>>>>>>>37 string x \b%-.1s +>>>>>>>>>38 string !: +>>>>>>>>>>38 string x \b%-.1s +>512 string \037\213 \b, gzipped +>769 string ustar\0 \b, tarred + +# Type: Grisoft AVG AntiVirus +# From: David Newgas <david@newgas.net> +0 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data diff --git a/magic/Magdir/fusecompress b/magic/Magdir/fusecompress new file mode 100644 index 0000000..165cf3c --- /dev/null +++ b/magic/Magdir/fusecompress @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $ +# fusecompress: file(1) magic for fusecompress +0 string \037\135\211 FuseCompress(ed) data +>3 byte 0x00 (none format) +>3 byte 0x01 (bz2 format) +>3 byte 0x02 (gz format) +>3 byte 0x03 (lzo format) +>3 byte 0x04 (xor format) +>3 byte >0x04 (unknown format) +>4 long x uncompressed size: %d diff --git a/magic/Magdir/games b/magic/Magdir/games new file mode 100644 index 0000000..e811628 --- /dev/null +++ b/magic/Magdir/games @@ -0,0 +1,265 @@ + +#------------------------------------------------------------------------------ +# $File: games,v 1.13 2012/02/13 22:50:50 christos Exp $ +# games: file(1) for games + +# Fabio Bonelli <fabiobonelli@libero.it> +# Quake II - III data files +0 string IDP2 Quake II 3D Model file, +>20 long x %lu skin(s), +>8 long x (%lu x +>12 long x %lu), +>40 long x %lu frame(s), +>16 long x Frame size %lu bytes, +>24 long x %lu vertices/frame, +>28 long x %lu texture coordinates, +>32 long x %lu triangles/frame + +0 string IBSP Quake +>4 long 0x26 II Map file (BSP) +>4 long 0x2E III Map file (BSP) + +0 string IDS2 Quake II SP2 sprite file + +#--------------------------------------------------------------------------- +# Doom and Quake +# submitted by Nicolas Patrois + +0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo +# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 + +24 string LxD\ 203 Linuxdoom save +>0 string x , name=%s +>44 string x , world=%s + +# Quake + +0 string PACK Quake I or II world or extension +>8 lelong >0 \b, %d entries + +#0 string -1\x0a Quake I demo +#>30 string x version %.4s +#>61 string x level %s + +#0 string 5\x0a Quake I save + +# The levels + +# Quake 1 + +0 string 5\x0aIntroduction Quake I save: start Introduction +0 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex +0 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned +0 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis +0 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto +0 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) +0 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep +0 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon +0 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon +0 string 5\x0athe_Installation Quake I save: e2m1 The installation +0 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel +0 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) +0 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) +0 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress +0 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse +0 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette +0 string 5\x0aTermination_Central Quake I save: e3m1 Termination central +0 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin +0 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror +0 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight +0 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) +0 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels +0 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment +0 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system +0 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair +0 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine +0 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate +0 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium +0 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) +0 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze +0 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony +0 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit + +# Quake DeathMatch levels + +0 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths +0 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis +0 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base +0 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place +0 string 5\x0aThe_Cistern Quake I save: dm5 The cistern +0 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone + +# Scourge of Armagon + +0 string 5\x0aCommand_HQ Quake I save: start Command HQ +0 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station +0 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility +0 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) +0 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine +0 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility +0 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms +0 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) +0 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral +0 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs +0 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt +0 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep +0 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment +0 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium +0 string 5\x0aLimbo Quake I save: hip3m3 Limbo +0 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) +0 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet +0 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair + +# Malice + +0 string 5\x0aThe_Academy Quake I save: start The academy +0 string 5\x0aThe_Lab Quake I save: d1 The lab +0 string 5\x0aArea_33 Quake I save: d1b Area 33 +0 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions +0 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) +0 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) +0 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice +0 string 5\x0aArea44 Quake I save: d1c Area 44 +0 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers +0 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life +0 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood +0 string 5\x0aThe_Flood Quake I save: d5 The flood +0 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant +0 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant +0 string 5\x0aThe_Foundry Quake I save: d7b The foundry +0 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base +0 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base +0 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories +0 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive +0 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ +0 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! + +# Malice DeathMatch levels + +0 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct +0 string 5\x0aSub_Station Quake I save: ddm2 Sub station +0 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! +0 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa +0 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse +0 string 5\x0aDOMINO Quake I save: ddm6 Domino +0 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder + + +0 string MComprHD MAME CHD compressed hard disk image, +>12 belong x version %lu + +# doom - submitted by Jon Dowland + +0 string =IWAD doom main IWAD data +>4 lelong x containing %d lumps +0 string =PWAD doom patch PWAD data +>4 lelong x containing %d lumps + +# Build engine group files (Duke Nukem, Shadow Warrior, ...) +# Extension: .grp +# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org> +0 string KenSilverman Build engine group file +>12 lelong x containing %d files + +# Summary: Warcraft 3 save +# Extension: .w3g +# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> +0 string Warcraft\ III\ recorded\ game %s + + +# Summary: Warcraft 3 map +# Extension: .w3m +# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> +0 string HM3W Warcraft III map file + + +# Summary: SGF Smart Game Format +# Extension: .sgf +# Reference: http://www.red-bean.com/sgf/ +# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> +# Modified by (1): Abel Cheung (regex, more game format) +# FIXME: Some games don't have GM (game type) +0 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format +>2 search/0x200/b GM[ +>>&0 string 1] (Go) +>>&0 string 2] (Othello) +>>&0 string 3] (chess) +>>&0 string 4] (Gomoku+Renju) +>>&0 string 5] (Nine Men's Morris) +>>&0 string 6] (Backgammon) +>>&0 string 7] (Chinese chess) +>>&0 string 8] (Shogi) +>>&0 string 9] (Lines of Action) +>>&0 string 10] (Ataxx) +>>&0 string 11] (Hex) +>>&0 string 12] (Jungle) +>>&0 string 13] (Neutron) +>>&0 string 14] (Philosopher's Football) +>>&0 string 15] (Quadrature) +>>&0 string 16] (Trax) +>>&0 string 17] (Tantrix) +>>&0 string 18] (Amazons) +>>&0 string 19] (Octi) +>>&0 string 20] (Gess) +>>&0 string 21] (Twixt) +>>&0 string 22] (Zertz) +>>&0 string 23] (Plateau) +>>&0 string 24] (Yinsh) +>>&0 string 25] (Punct) +>>&0 string 26] (Gobblet) +>>&0 string 27] (hive) +>>&0 string 28] (Exxit) +>>&0 string 29] (Hnefatal) +>>&0 string 30] (Kuba) +>>&0 string 31] (Tripples) +>>&0 string 32] (Chase) +>>&0 string 33] (Tumbling Down) +>>&0 string 34] (Sahara) +>>&0 string 35] (Byte) +>>&0 string 36] (Focus) +>>&0 string 37] (Dvonn) +>>&0 string 38] (Tamsk) +>>&0 string 39] (Gipf) +>>&0 string 40] (Kropki) + +############################################## +# NetImmerse/Gamebryo game engine entries + +# Summary: Gamebryo game engine file +# Extension: .nif, .kf +# Created by: Abel Cheung <abelcheung@gmail.com> +0 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file +>&0 regex [0-9a-z.]+ \b, version %s + +# Summary: Gamebryo game engine file +# Extension: .kfm +# Created by: Abel Cheung <abelcheung@gmail.com> +0 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File +>&0 regex [0-9a-z.]+ \b, version %s + +# Summary: NetImmerse game engine file +# Extension .nif +# Created by: Abel Cheung <abelcheung@gmail.com> +0 string NetImmerse\ File\ Format,\ Versio +>&0 string n\ NetImmerse game engine file +>>&0 regex [0-9a-z.]+ \b, version %s + +# Type: SGF Smart Game Format +# URL: http://www.red-bean.com/sgf/ +# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> +2 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format +>2 regex/c GM\\[1\\] - Go Game +>2 regex/c GM\\[6\\] - BackGammon Game +>2 regex/c GM\\[11\\] - Hex Game +>2 regex/c GM\\[18\\] - Amazons Game +>2 regex/c GM\\[19\\] - Octi Game +>2 regex/c GM\\[20\\] - Gess Game +>2 regex/c GM\\[21\\] - twix Game + +# Epic Games/Unreal Engine Package +# +0 lelong 0x9E2A83C1 Unreal Engine Package, +>4 leshort x version: %i +>12 lelong !0 \b, names: %i +>28 lelong !0 \b, imports: %i +>20 lelong !0 \b, exports: %i diff --git a/magic/Magdir/gcc b/magic/Magdir/gcc new file mode 100644 index 0000000..893d0d9 --- /dev/null +++ b/magic/Magdir/gcc @@ -0,0 +1,17 @@ + +#------------------------------------------------------------------------------ +# $File: gcc,v 1.4 2009/09/19 16:28:09 christos Exp $ +# gcc: file(1) magic for GCC special files +# +0 string gpch GCC precompiled header + +# The version field is annoying. It's 3 characters, not zero-terminated. +>5 byte x (version %c +>6 byte x \b%c +>7 byte x \b%c) + +# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' +>4 byte 67 for C +>4 byte 111 for Objective C +>4 byte 43 for C++ +>4 byte 79 for Objective C++ diff --git a/magic/Magdir/geo b/magic/Magdir/geo new file mode 100644 index 0000000..9a765fe --- /dev/null +++ b/magic/Magdir/geo @@ -0,0 +1,117 @@ + +#------------------------------------------------------------------------------ +# $File: geo,v 1.3 2013/01/04 00:47:02 christos Exp $ +# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu> + +###################################################################### +# +# Acoustic Doppler Current Profilers (ADCP) +# +###################################################################### + +0 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP) + +###################################################################### +# +# Metadata +# +###################################################################### + +0 string Identification_Information FGDC ASCII metadata + +###################################################################### +# +# Seimsic / Subbottom +# +###################################################################### + +# Knudsen subbottom chirp profiler - Binary File Format: B9 +# KEB D409-03167 V1.75 Huffman +0 string KEB\ Knudsen seismic KEL binary (KEB) - +>4 regex [-A-Z0-9]* Software: %s +>>&1 regex V[0-9]*\.[0-9]* version %s + +###################################################################### +# +# LIDAR - Laser altimetry or bathy +# +###################################################################### + + +# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data +0 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar +>4 regex [0-9]*\.[0-9]* version %s + +0 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data +>3 byte x version %d . +>4 byte x %d + + +###################################################################### +# +# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ +# +###################################################################### + +# GeoAcoustics - GeoSwath Plus +4 beshort 0x2002 GeoSwath RDF +0 string Start:- GeoSwatch auf text file + +# Seabeam 2100 +# mbsystem code mb41 +0 string SB2100 SeaBeam 2100 multibeam sonar +0 string SB2100DR SeaBeam 2100 DR multibeam sonar +0 string SB2100PR SeaBeam 2100 PR multibeam sonar + +# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor +# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR. +0 string $HSF XSE multibeam + +# mb121 http://www.saic.com/maritime/gsf/ +8 string GSF-v SAIC generic sensor format (GSF) sonar data, +>&0 regex [0-9]*\.[0-9]* version %s + +# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm +# mb161 +9 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format + +# MBSystem processing caches the mbinfo output +1 string Swath\ Data\ File: mbsystem info cache + +# Caris John Hughes Clark format +0 string HDCS Caris multibeam sonar related data +1 string Start/Stop\ parameter\ header: Caris ASCII project summary + +###################################################################### +# +# Visualization and 3D modeling +# +###################################################################### + +# IVS - IVS3d.com Tagged Data Represetation +0 string %%\ TDR\ 2.0 IVS Fledermaus TDR file + +# http://www.ecma-international.org/publications/standards/Ecma-363.htm +# 3D in PDFs +0 string U3D ECMA-363, Universal 3D + +###################################################################### +# +# Support files +# +###################################################################### + +# https://midas.psi.ch/elog/ +0 string $@MID@$ elog journal entry + +# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm +0 string DSBB Surfer 6 binary grid file +>4 leshort x \b, %d +>6 leshort x \bx%d +>8 ledouble x \b, minx=%g +>16 ledouble x \b, maxx=%g +>24 ledouble x \b, miny=%g +>32 ledouble x \b, maxy=%g +>40 ledouble x \b, minz=%g +>48 ledouble x \b, maxz=%g + diff --git a/magic/Magdir/geos b/magic/Magdir/geos new file mode 100644 index 0000000..66c2bd1 --- /dev/null +++ b/magic/Magdir/geos @@ -0,0 +1,20 @@ + +#------------------------------------------------------------------------------ +# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $ +# GEOS files (Vidar Madsen, vidar@gimp.org) +# semi-commonly used in embedded and handheld systems. +0 belong 0xc745c153 GEOS +>40 byte 1 executable +>40 byte 2 VMFile +>40 byte 3 binary +>40 byte 4 directory label +>40 byte <1 unknown +>40 byte >4 unknown +>4 string >\0 \b, name "%s" +#>44 short x \b, version %d +#>46 short x \b.%d +#>48 short x \b, rev %d +#>50 short x \b.%d +#>52 short x \b, proto %d +#>54 short x \br%d +#>168 string >\0 \b, copyright "%s" diff --git a/magic/Magdir/gimp b/magic/Magdir/gimp new file mode 100644 index 0000000..a360bd8 --- /dev/null +++ b/magic/Magdir/gimp @@ -0,0 +1,43 @@ + +#------------------------------------------------------------------------------ +# $File: gimp,v 1.7 2010/09/20 18:55:20 rrt Exp $ +# GIMP Gradient: file(1) magic for the GIMP's gradient data files +# by Federico Mena <federico@nuclecu.unam.mx> + +0 string GIMP\ Gradient GIMP gradient data + +#------------------------------------------------------------------------------ +# XCF: file(1) magic for the XCF image format used in the GIMP developed +# by Spencer Kimball and Peter Mattis +# ('Bucky' LaDieu, nega@vt.edu) + +0 string gimp\ xcf GIMP XCF image data, +!:mime image/x-xcf +>9 string file version 0, +>9 string v version +>>10 string >\0 %s, +>14 belong x %lu x +>18 belong x %lu, +>22 belong 0 RGB Color +>22 belong 1 Greyscale +>22 belong 2 Indexed Color +>22 belong >2 Unknown Image Type. + +#------------------------------------------------------------------------------ +# XCF: file(1) magic for the patterns used in the GIMP, developed +# by Spencer Kimball and Peter Mattis +# ('Bucky' LaDieu, nega@vt.edu) + +20 string GPAT GIMP pattern data, +>24 string x %s + +#------------------------------------------------------------------------------ +# XCF: file(1) magic for the brushes used in the GIMP, developed +# by Spencer Kimball and Peter Mattis +# ('Bucky' LaDieu, nega@vt.edu) + +20 string GIMP GIMP brush data + +# GIMP Curves File +# From: "Nelson A. de Oliveira" <naoliv@gmail.com> +0 string #\040GIMP\040Curves\040File GIMP curve file diff --git a/magic/Magdir/gnome b/magic/Magdir/gnome new file mode 100644 index 0000000..14d5aeb --- /dev/null +++ b/magic/Magdir/gnome @@ -0,0 +1,59 @@ + +#------------------------------------------------------------------------------ +# $File: gnome,v 1.3 2013/02/05 15:20:47 christos Exp $ +# GNOME related files + +# Contributed by Josh Triplett +# FIXME: Could be simplified if pstring supported two-byte counts +0 string GnomeKeyring\n\r\0\n GNOME keyring +>&0 ubyte 0 \b, major version 0 +>>&0 ubyte 0 \b, minor version 0 +>>>&0 ubyte 0 \b, crypto type 0 (AES) +>>>&0 ubyte >0 \b, crypto type %hhu (unknown) +>>>&1 ubyte 0 \b, hash type 0 (MD5) +>>>&1 ubyte >0 \b, hash type %hhu (unknown) +>>>&2 ubelong 0xFFFFFFFF \b, name NULL +>>>&2 ubelong !0xFFFFFFFF +>>>>&-4 ubelong >255 \b, name too long for file's pstring type +>>>>&-4 ubelong <256 +>>>>>&-1 pstring x \b, name "%s" +>>>>>>&0 ubeqdate x \b, last modified %s +>>>>>>&8 ubeqdate x \b, created %s +>>>>>>&16 ubelong &1 +>>>>>>>&0 ubelong x \b, locked if idle for %u seconds +>>>>>>&16 ubelong ^1 \b, not locked if idle +>>>>>>&24 ubelong x \b, hash iterations %u +>>>>>>&28 ubequad x \b, salt %llu +>>>>>>&52 ubelong x \b, %u item(s) + +# From: Alex Beregszaszi <alex@fsn.hu> +4 string gtktalog GNOME Catalogue (gtktalog) +>13 string >\0 version %s + +# Summary: GStreamer binary registry +# Extension: .bin +# Submitted by: Josh Triplett <josh@joshtriplett.org> +0 belong 0xc0def00d GStreamer binary registry +>4 string x \b, version %s + +# GVariant Database file +# By Elan Ruusamae <glen@delfi.ee> +# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h +# It's always "GVariant", it's byte swapped on incompatible archs +# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c +# file_builder_serialise() +# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant +0 string GVariant GVariant Database file, +# version is never filled. probably future extension +>8 lelong x version %d +# not sure are these usable, so commented out +#>>16 lelong x start %d, +#>>>20 lelong x end %d + +# G-IR database made by gobject-introspect toolset, +# http://live.gnome.org/GObjectIntrospection +0 string GOBJ\nMETADATA\r\n\032 G-IR binary database +>16 byte x \b, v%d +>17 byte x \b.%d +>20 leshort x \b, %d entries +>22 leshort x \b/%d local diff --git a/magic/Magdir/gnu b/magic/Magdir/gnu new file mode 100644 index 0000000..6e746b2 --- /dev/null +++ b/magic/Magdir/gnu @@ -0,0 +1,72 @@ + +#------------------------------------------------------------------------------ +# $File: gnu,v 1.14 2012/10/03 23:38:12 christos Exp $ +# gnu: file(1) magic for various GNU tools +# +# GNU nlsutils message catalog file format +# +# GNU message catalog (.mo and .gmo files) + +0 string \336\22\4\225 GNU message catalog (little endian), +>6 leshort x revision %d. +>4 leshort >0 \b%d, +>>8 lelong x %d messages, +>>36 lelong x %d sysdep messages +>4 leshort =0 \b%d, +>>8 lelong x %d messages + +0 string \225\4\22\336 GNU message catalog (big endian), +>4 beshort x revision %d. +>6 beshort >0 \b%d, +>>8 belong x %d messages, +>>36 belong x %d sysdep messages +>6 beshort =0 \b%d, +>>8 belong x %d messages + + +# GnuPG +# The format is very similar to pgp +0 string \001gpg GPG key trust database +>4 byte x version %d +# Note: magic.mime had 0x8501 for the next line instead of 0x8502 +0 beshort 0x8502 GPG encrypted data +!:mime text/PGP # encoding: data + +# This magic is not particularly good, as the keyrings don't have true +# magic. Nevertheless, it covers many keyrings. +0 beshort 0x9901 GPG key public ring +!:mime application/x-gnupg-keyring + +# Symmetric encryption +0 leshort 0x0d8c +>4 leshort 0x0203 +>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher) +>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher) +>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher) +>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher) +>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher) +>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher) +>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher) +>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher) +>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher) +>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher) + + +# Gnumeric spreadsheet +# This entry is only semi-helpful, as Gnumeric compresses its files, so +# they will ordinarily reported as "compressed", but at least -z helps +39 string =<gmr:Workbook Gnumeric spreadsheet + +# From: James Youngman <jay@gnu.org> +# gnu find magic +0 string \0LOCATE GNU findutils locate database data +>7 string >\0 \b, format %s +>7 string 02 \b (frcode) + +# Files produced by GNU gettext +0 long 0xDE120495 GNU-format message catalog data +0 long 0x950412DE GNU-format message catalog data + +# gettext message catalogue +0 regex \^msgid\ GNU gettext message catalogue text +!:mime text/x-po diff --git a/magic/Magdir/gnumeric b/magic/Magdir/gnumeric new file mode 100644 index 0000000..928ad3e --- /dev/null +++ b/magic/Magdir/gnumeric @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $ +# gnumeric: file(1) magic for Gnumeric spreadsheet +# This entry is only semi-helpful, as Gnumeric compresses its files, so +# they will ordinarily reported as "compressed", but at least -z helps +39 string =<gmr:Workbook Gnumeric spreadsheet +!:mime application/x-gnumeric diff --git a/magic/Magdir/gpt b/magic/Magdir/gpt new file mode 100644 index 0000000..74aaaf7 --- /dev/null +++ b/magic/Magdir/gpt @@ -0,0 +1,241 @@ + +#------------------------------------------------------------------------------ +# $File: gpt,v 1.1 2013/02/18 18:31:09 christos Exp $ +# +# GPT Partition table patterns. +# Author: Rogier Goossens (goossens.rogier@gmail.com) +# Note that a GPT-formatted disk must contain an MBR as well. +# + +# The initial segment (up to >>>>>>>>422) was copied from the X86 +# partition table code (aka MBR). +# This is kept separate, so that MBR partitions are not reported as well. +# (use -k if you do want them as well) + +# First, detect the MBR partiton table +# If more than one GPT protective MBR partition exists, don't print anything +# (the other MBR detection code will then just print the MBR partition table) +0x1FE leshort 0xAA55 +>3 string !MS +>>3 string !SYSLINUX +>>>3 string !MTOOL +>>>>3 string !NEWLDR +>>>>>5 string !DOS +# not FAT (32 bit) +>>>>>>82 string !FAT32 +#not Linux kernel +>>>>>>>514 string !HdrS +#not BeOS +>>>>>>>>422 string !Be\ Boot\ Loader +# GPT with protective MBR entry in partition 1 (only) +>>>>>>>>>450 ubyte 0xee +>>>>>>>>>>466 ubyte !0xee +>>>>>>>>>>>482 ubyte !0xee +>>>>>>>>>>>>498 ubyte !0xee +#>>>>>>>>>>>>>446 use gpt-mbr-partition +>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>0 ubyte x of 8192 bytes +>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART +>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes +>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART +>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes +>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART +>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes +>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART +>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes +# GPT with protective MBR entry in partition 2 (only) +>>>>>>>>>450 ubyte !0xee +>>>>>>>>>>466 ubyte 0xee +>>>>>>>>>>>482 ubyte !0xee +>>>>>>>>>>>>498 ubyte !0xee +#>>>>>>>>>>>>>462 use gpt-mbr-partition +>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>0 ubyte x of 8192 bytes +>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART +>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes +>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART +>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes +>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART +>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes +>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART +>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes +# GPT with protective MBR entry in partition 3 (only) +>>>>>>>>>450 ubyte !0xee +>>>>>>>>>>466 ubyte !0xee +>>>>>>>>>>>482 ubyte 0xee +>>>>>>>>>>>>498 ubyte !0xee +#>>>>>>>>>>>>>478 use gpt-mbr-partition +>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>0 ubyte x of 8192 bytes +>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART +>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes +>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART +>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes +>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART +>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes +>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART +>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes +# GPT with protective MBR entry in partition 4 (only) +>>>>>>>>>450 ubyte !0xee +>>>>>>>>>>466 ubyte !0xee +>>>>>>>>>>>482 ubyte !0xee +>>>>>>>>>>>>498 ubyte 0xee +#>>>>>>>>>>>>>494 use gpt-mbr-partition +>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>0 ubyte x of 8192 bytes +>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART +>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes +>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART +>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes +>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART +>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes +>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART +>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table +>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type +>>>>>>>>>>>>>>>>>>&-8 use gpt-table +>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes + +# The following code does GPT detection and processing, including +# sector size detection. +# It has to be duplicated above because the top-level pattern +# (i.e. not called using 'use') must print *something* for file +# to count it as a match. Text only printed in named patterns is +# not counted, and causes file to continue, and try and match +# other patterns. +# +# Unfortunately, when assuming sector sizes >=16k, if the sector size +# happens to be 512 instead, we may find confusing data after the GPT +# table... If the GPT table has less than 128 entries, this may even +# happen for assumed sector sizes as small as 4k +# This could be solved by checking for the presence of the backup GPT +# header as well, but that makes the logic extremely complex +##0 name gpt-mbr-partition +##>(8.l*8192) string EFI\ PART +##>>(8.l*8192) use gpt-mbr-type +##>>&-8 use gpt-table +##>>0 ubyte x of 8192 bytes +##>(8.l*8192) string !EFI\ PART +##>>(8.l*4096) string EFI\ PART GPT partition table +##>>>0 use gpt-mbr-type +##>>>&-8 use gpt-table +##>>>0 ubyte x of 4096 bytes +##>>(8.l*4096) string !EFI\ PART +##>>>(8.l*2048) string EFI\ PART GPT partition table +##>>>>0 use gpt-mbr-type +##>>>>&-8 use gpt-table +##>>>>0 ubyte x of 2048 bytes +##>>>(8.l*2048) string !EFI\ PART +##>>>>(8.l*1024) string EFI\ PART GPT partition table +##>>>>>0 use gpt-mbr-type +##>>>>>&-8 use gpt-table +##>>>>>0 ubyte x of 1024 bytes +##>>>>(8.l*1024) string !EFI\ PART +##>>>>>(8.l*512) string EFI\ PART GPT partition table +##>>>>>>0 use gpt-mbr-type +##>>>>>>&-8 use gpt-table +##>>>>>>0 ubyte x of 512 bytes + +# Print details of MBR type for a GPT-disk +# Calling code ensures that there is only one 0xee partition. +0 name gpt-mbr-type +# GPT with protective MBR entry in partition 1 +>450 ubyte 0xee +>>454 ulelong 1 +>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) +>>454 ulelong !1 \b (nonstandard: not at LBA 1) +# GPT with protective MBR entry in partition 2 +>466 ubyte 0xee +>>470 ulelong 1 +>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 +>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) +>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) +>>470 ulelong !1 \b (nonstandard: not at LBA 1) +# GPT with protective MBR entry in partition 3 +>482 ubyte 0xee +>>486 ulelong 1 +>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 +>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) +>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) +>>486 ulelong !1 \b (nonstandard: not at LBA 1) +# GPT with protective MBR entry in partition 4 +>498 ubyte 0xee +>>502 ulelong 1 +>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) +>>502 ulelong !1 \b (nonstandard: not at LBA 1) + +# Print the information from a GPT partition table structure +0 name gpt-table +>10 uleshort x \b, version %u +>8 uleshort x \b.%u +# a GUID is just like a UUID, except it's displayed mixed-endian. +>56 ulelong x \b, GUID: %08x +>60 uleshort x \b-%04x +>62 uleshort x \b-%04x +>64 ubeshort x \b-%04x +>66 ubeshort x \b-%04x +>68 ubelong x \b%08x +#>80 uleshort x \b, %d partition entries +>32 ulequad+1 x \b, disk size: %lld sectors + +# In case a GPT data-structure is at LBA 0, report it as well +# This covers systems which are not GPT-aware, and which show +# and allow access to the protective partition. This code will +# detect the contents of such a partition. +0 string EFI\ PART GPT data structure (nonstandard: at LBA 0) +>0 use gpt-table +>0 ubyte x (sector size unknown) + + diff --git a/magic/Magdir/grace b/magic/Magdir/grace new file mode 100644 index 0000000..25bd759 --- /dev/null +++ b/magic/Magdir/grace @@ -0,0 +1,21 @@ + +#------------------------------------------------------------------------------ +# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ +# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE +# +# ACE/gr binary +0 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file +>39 byte >0 - version %c +# ACE/gr ascii +0 string #\ xvgr\ parameter\ file ACE/gr ascii file +0 string #\ xmgr\ parameter\ file ACE/gr ascii file +0 string #\ ACE/gr\ parameter\ file ACE/gr ascii file +# Grace projects +0 string #\ Grace\ project\ file Grace project file +>23 string @version\ (version +>>32 byte >0 %c +>>33 string >\0 \b.%.2s +>>35 string >\0 \b.%.2s) +# ACE/gr fit description files +0 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file +# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE diff --git a/magic/Magdir/graphviz b/magic/Magdir/graphviz new file mode 100644 index 0000000..b944d46 --- /dev/null +++ b/magic/Magdir/graphviz @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $ +# graphviz: file(1) magic for http://www.graphviz.org/ + +# FIXME: These patterns match too generally. For example, the first +# line matches a LaTeX file containing the word "graph" (with a { +# following later) and the second line matches this file. +#0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text +#!:mime text/vnd.graphviz +#0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text +#!:mime text/vnd.graphviz diff --git a/magic/Magdir/gringotts b/magic/Magdir/gringotts new file mode 100644 index 0000000..2bfef1b --- /dev/null +++ b/magic/Magdir/gringotts @@ -0,0 +1,48 @@ + +#------------------------------------------------------------------------------ +# $File: gringotts,v 1.5 2009/09/19 16:28:09 christos Exp $ +# gringotts: file(1) magic for Gringotts +# http://devel.pluto.linux.it/projects/Gringotts/ +# author: Germano Rizzo <mano@pluto.linux.it> +#GRG3????Y +0 string GRG Gringotts data file +#file format 1 +>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 +#file format 2 +>3 string 2 v.2, MCRYPT S2K, +>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, +>>8 byte&0x70 0x10 SERPENT crypt, +>>8 byte&0x70 0x20 TWOFISH crypt, +>>8 byte&0x70 0x30 CAST-256 crypt, +>>8 byte&0x70 0x40 SAFER+ crypt, +>>8 byte&0x70 0x50 LOKI97 crypt, +>>8 byte&0x70 0x60 3DES crypt, +>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, +>>8 byte&0x08 0x00 SHA1 hash, +>>8 byte&0x08 0x08 RIPEMD-160 hash, +>>8 byte&0x04 0x00 ZLib +>>8 byte&0x04 0x04 BZip2 +>>8 byte&0x03 0x00 lvl.0 +>>8 byte&0x03 0x01 lvl.3 +>>8 byte&0x03 0x02 lvl.6 +>>8 byte&0x03 0x03 lvl.9 +#file format 3 +>3 string 3 v.3, OpenPGP S2K, +>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, +>>8 byte&0x70 0x10 SERPENT crypt, +>>8 byte&0x70 0x20 TWOFISH crypt, +>>8 byte&0x70 0x30 CAST-256 crypt, +>>8 byte&0x70 0x40 SAFER+ crypt, +>>8 byte&0x70 0x50 LOKI97 crypt, +>>8 byte&0x70 0x60 3DES crypt, +>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, +>>8 byte&0x08 0x00 SHA1 hash, +>>8 byte&0x08 0x08 RIPEMD-160 hash, +>>8 byte&0x04 0x00 ZLib +>>8 byte&0x04 0x04 BZip2 +>>8 byte&0x03 0x00 lvl.0 +>>8 byte&0x03 0x01 lvl.3 +>>8 byte&0x03 0x02 lvl.6 +>>8 byte&0x03 0x03 lvl.9 +#file format >3 +>3 string >3 v.%.1s (unknown details) diff --git a/magic/Magdir/guile b/magic/Magdir/guile new file mode 100644 index 0000000..7ee0c48 --- /dev/null +++ b/magic/Magdir/guile @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $ +# Guile file magic from <dalepsmith@gmail.com> +# http://www.gnu.org/s/guile/ +# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250 + +0 string GOOF---- Guile Object +>8 string LE \b, little endian +>8 string BE \b, big endian +>11 string 4 \b, 32bit +>11 string 8 \b, 64bit +>13 regex .\.. \b, bytecode v%s diff --git a/magic/Magdir/hitachi-sh b/magic/Magdir/hitachi-sh new file mode 100644 index 0000000..213d2d6 --- /dev/null +++ b/magic/Magdir/hitachi-sh @@ -0,0 +1,22 @@ + +#------------------------------------------------------------------------------ +# $File: hitachi-sh,v 1.6 2013/01/29 19:31:33 christos Exp $ +# hitach-sh: file(1) magic for Hitachi Super-H +# +# Super-H COFF +# +# below test line conflicts with 2nd NTFS filesystem sector +0 beshort 0x0500 Hitachi SH big-endian COFF +# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR +#0 ubelong&0xFFFFNMPQ 0x0500NMPQ Hitachi SH big-endian COFF +>18 beshort&0x0002 =0x0000 object +>18 beshort&0x0002 =0x0002 executable +>18 beshort&0x0008 =0x0008 \b, stripped +>18 beshort&0x0008 =0x0000 \b, not stripped +# +0 leshort 0x0550 Hitachi SH little-endian COFF +>18 leshort&0x0002 =0x0000 object +>18 leshort&0x0002 =0x0002 executable +>18 leshort&0x0008 =0x0008 \b, stripped +>18 leshort&0x0008 =0x0000 \b, not stripped + diff --git a/magic/Magdir/hp b/magic/Magdir/hp new file mode 100644 index 0000000..3201c15 --- /dev/null +++ b/magic/Magdir/hp @@ -0,0 +1,439 @@ + +#------------------------------------------------------------------------------ +# $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $ +# hp: file(1) magic for Hewlett Packard machines (see also "printer") +# +# XXX - somebody should figure out whether any byte order needs to be +# applied to the "TML" stuff; I'm assuming the Apollo stuff is +# big-endian as it was mostly 68K-based. +# +# I think the 500 series was the old stack-based machines, running a +# UNIX environment atop the "SUN kernel"; dunno whether it was +# big-endian or little-endian. +# +# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; +# hp300 are 68020+68881 based; hp400 are also 68k. The following basic +# HP magic is useful for reference, but using "long" magic is a better +# practice in order to avoid collisions. +# +# Guy Harris (guy@netapp.com): some additions to this list came from +# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, +# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 +# "/etc/magic", though, except for the "archive file relocatable library" +# stuff, and the 68030 and 68040 stuff isn't there at all - are they not +# used in executables, or have they just not yet updated "/etc/magic" +# completely? +# +# 0 beshort 200 hp200 (68010) BSD binary +# 0 beshort 300 hp300 (68020+68881) BSD binary +# 0 beshort 0x20c hp200/300 HP-UX binary +# 0 beshort 0x20d hp400 (68030) HP-UX binary +# 0 beshort 0x20e hp400 (68040?) HP-UX binary +# 0 beshort 0x20b PA-RISC1.0 HP-UX binary +# 0 beshort 0x210 PA-RISC1.1 HP-UX binary +# 0 beshort 0x211 PA-RISC1.2 HP-UX binary +# 0 beshort 0x214 PA-RISC2.0 HP-UX binary + +# +# The "misc" stuff needs a byte order; the archives look suspiciously +# like the old 177545 archives (0xff65 = 0177545). +# +#### Old Apollo stuff +0 beshort 0627 Apollo m68k COFF executable +>18 beshort ^040000 not stripped +>22 beshort >0 - version %ld +0 beshort 0624 apollo a88k COFF executable +>18 beshort ^040000 not stripped +>22 beshort >0 - version %ld +0 long 01203604016 TML 0123 byte-order format +0 long 01702407010 TML 1032 byte-order format +0 long 01003405017 TML 2301 byte-order format +0 long 01602007412 TML 3210 byte-order format +#### PA-RISC 1.1 +0 belong 0x02100106 PA-RISC1.1 relocatable object +0 belong 0x02100107 PA-RISC1.1 executable +>168 belong &0x00000004 dynamically linked +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 - not stripped + +0 belong 0x02100108 PA-RISC1.1 shared executable +>168 belong&0x4 0x4 dynamically linked +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 - not stripped + +0 belong 0x0210010b PA-RISC1.1 demand-load executable +>168 belong&0x4 0x4 dynamically linked +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 - not stripped + +0 belong 0x0210010e PA-RISC1.1 shared library +>96 belong >0 - not stripped + +0 belong 0x0210010d PA-RISC1.1 dynamic load library +>96 belong >0 - not stripped + +#### PA-RISC 2.0 +0 belong 0x02140106 PA-RISC2.0 relocatable object + +0 belong 0x02140107 PA-RISC2.0 executable +>168 belong &0x00000004 dynamically linked +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 - not stripped + +0 belong 0x02140108 PA-RISC2.0 shared executable +>168 belong &0x00000004 dynamically linked +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 - not stripped + +0 belong 0x0214010b PA-RISC2.0 demand-load executable +>168 belong &0x00000004 dynamically linked +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 - not stripped + +0 belong 0x0214010e PA-RISC2.0 shared library +>96 belong >0 - not stripped + +0 belong 0x0214010d PA-RISC2.0 dynamic load library +>96 belong >0 - not stripped + +#### 800 +0 belong 0x020b0106 PA-RISC1.0 relocatable object + +0 belong 0x020b0107 PA-RISC1.0 executable +>168 belong&0x4 0x4 dynamically linked +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 - not stripped + +0 belong 0x020b0108 PA-RISC1.0 shared executable +>168 belong&0x4 0x4 dynamically linked +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 - not stripped + +0 belong 0x020b010b PA-RISC1.0 demand-load executable +>168 belong&0x4 0x4 dynamically linked +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 - not stripped + +0 belong 0x020b010e PA-RISC1.0 shared library +>96 belong >0 - not stripped + +0 belong 0x020b010d PA-RISC1.0 dynamic load library +>96 belong >0 - not stripped + +0 belong 0x213c6172 archive file +>68 belong 0x020b0619 - PA-RISC1.0 relocatable library +>68 belong 0x02100619 - PA-RISC1.1 relocatable library +>68 belong 0x02110619 - PA-RISC1.2 relocatable library +>68 belong 0x02140619 - PA-RISC2.0 relocatable library + +#### 500 +0 long 0x02080106 HP s500 relocatable executable +>16 long >0 - version %ld + +0 long 0x02080107 HP s500 executable +>16 long >0 - version %ld + +0 long 0x02080108 HP s500 pure executable +>16 long >0 - version %ld + +#### 200 +0 belong 0x020c0108 HP s200 pure executable +>4 beshort >0 - version %ld +>8 belong &0x80000000 save fp regs +>8 belong &0x40000000 dynamically linked +>8 belong &0x20000000 debuggable +>36 belong >0 not stripped + +0 belong 0x020c0107 HP s200 executable +>4 beshort >0 - version %ld +>8 belong &0x80000000 save fp regs +>8 belong &0x40000000 dynamically linked +>8 belong &0x20000000 debuggable +>36 belong >0 not stripped + +0 belong 0x020c010b HP s200 demand-load executable +>4 beshort >0 - version %ld +>8 belong &0x80000000 save fp regs +>8 belong &0x40000000 dynamically linked +>8 belong &0x20000000 debuggable +>36 belong >0 not stripped + +0 belong 0x020c0106 HP s200 relocatable executable +>4 beshort >0 - version %ld +>6 beshort >0 - highwater %d +>8 belong &0x80000000 save fp regs +>8 belong &0x20000000 debuggable +>8 belong &0x10000000 PIC + +0 belong 0x020a0108 HP s200 (2.x release) pure executable +>4 beshort >0 - version %ld +>36 belong >0 not stripped + +0 belong 0x020a0107 HP s200 (2.x release) executable +>4 beshort >0 - version %ld +>36 belong >0 not stripped + +0 belong 0x020c010e HP s200 shared library +>4 beshort >0 - version %ld +>6 beshort >0 - highwater %d +>36 belong >0 not stripped + +0 belong 0x020c010d HP s200 dynamic load library +>4 beshort >0 - version %ld +>6 beshort >0 - highwater %d +>36 belong >0 not stripped + +#### MISC +0 long 0x0000ff65 HP old archive +0 long 0x020aff65 HP s200 old archive +0 long 0x020cff65 HP s200 old archive +0 long 0x0208ff65 HP s500 old archive + +0 long 0x015821a6 HP core file + +0 long 0x4da7eee8 HP-WINDOWS font +>8 byte >0 - version %ld +0 string Bitmapfile HP Bitmapfile + +0 string IMGfile CIS compimg HP Bitmapfile +# XXX - see "lif" +#0 short 0x8000 lif file +0 long 0x020c010c compiled Lisp + +0 string msgcat01 HP NLS message catalog, +>8 long >0 %d messages + +# Summary: HP-48/49 calculator +# Created by: phk@data.fls.dk +# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> +# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) +0 string HPHP HP +>4 string 48 48 binary +>4 string 49 49 binary +>7 byte >64 - Rev %c +>8 leshort 0x2911 (ADR) +>8 leshort 0x2933 (REAL) +>8 leshort 0x2955 (LREAL) +>8 leshort 0x2977 (COMPLX) +>8 leshort 0x299d (LCOMPLX) +>8 leshort 0x29bf (CHAR) +>8 leshort 0x29e8 (ARRAY) +>8 leshort 0x2a0a (LNKARRAY) +>8 leshort 0x2a2c (STRING) +>8 leshort 0x2a4e (HXS) +>8 leshort 0x2a74 (LIST) +>8 leshort 0x2a96 (DIR) +>8 leshort 0x2ab8 (ALG) +>8 leshort 0x2ada (UNIT) +>8 leshort 0x2afc (TAGGED) +>8 leshort 0x2b1e (GROB) +>8 leshort 0x2b40 (LIB) +>8 leshort 0x2b62 (BACKUP) +>8 leshort 0x2b88 (LIBDATA) +>8 leshort 0x2d9d (PROG) +>8 leshort 0x2dcc (CODE) +>8 leshort 0x2e48 (GNAME) +>8 leshort 0x2e6d (LNAME) +>8 leshort 0x2e92 (XLIB) + +0 string %%HP: HP text +>6 string T(0) - T(0) +>6 string T(1) - T(1) +>6 string T(2) - T(2) +>6 string T(3) - T(3) +>10 string A(D) A(D) +>10 string A(R) A(R) +>10 string A(G) A(G) +>14 string F(.) F(.); +>14 string F(,) F(,); + + +# Summary: HP-38/39 calculator +# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> +0 string HP3 +>3 string 8 HP 38 +>3 string 9 HP 39 +>4 string Bin binary +>4 string Asc ASCII +>7 string A (Directory List) +>7 string B (Zaplet) +>7 string C (Note) +>7 string D (Program) +>7 string E (Variable) +>7 string F (List) +>7 string G (Matrix) +>7 string H (Library) +>7 string I (Target List) +>7 string J (ASCII Vector specification) +>7 string K (wildcard) + +# Summary: HP-38/39 calculator +# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> +0 string HP3 +>3 string 8 HP 38 +>3 string 9 HP 39 +>4 string Bin binary +>4 string Asc ASCII +>7 string A (Directory List) +>7 string B (Zaplet) +>7 string C (Note) +>7 string D (Program) +>7 string E (Variable) +>7 string F (List) +>7 string G (Matrix) +>7 string H (Library) +>7 string I (Target List) +>7 string J (ASCII Vector specification) +>7 string K (wildcard) + +# hpBSD magic numbers +0 beshort 200 hp200 (68010) BSD +>2 beshort 0407 impure binary +>2 beshort 0410 read-only binary +>2 beshort 0413 demand paged binary +0 beshort 300 hp300 (68020+68881) BSD +>2 beshort 0407 impure binary +>2 beshort 0410 read-only binary +>2 beshort 0413 demand paged binary +# +# From David Gero <dgero@nortelnetworks.com> +# HP-UX 10.20 core file format from /usr/include/sys/core.h +# Unfortunately, HP-UX uses corehead blocks without specifying the order +# There are four we care about: +# CORE_KERNEL, which starts with the string "HP-UX" +# CORE_EXEC, which contains the name of the command +# CORE_PROC, which contains the signal number that caused the core dump +# CORE_FORMAT, which contains the version of the core file format (== 1) +# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC +# but we include all 6 variations of the order of the first 3, and +# assume that PROC will always be last +# Order 1: KERNEL, EXEC, FORMAT, PROC +0x10 string HP-UX +>0 belong 2 +>>0xC belong 0x3C +>>>0x4C belong 0x100 +>>>>0x58 belong 0x44 +>>>>>0xA0 belong 1 +>>>>>>0xAC belong 4 +>>>>>>>0xB0 belong 1 +>>>>>>>>0xB4 belong 4 core file +>>>>>>>>>0x90 string >\0 from '%s' +>>>>>>>>>0xC4 belong 3 - received SIGQUIT +>>>>>>>>>0xC4 belong 4 - received SIGILL +>>>>>>>>>0xC4 belong 5 - received SIGTRAP +>>>>>>>>>0xC4 belong 6 - received SIGABRT +>>>>>>>>>0xC4 belong 7 - received SIGEMT +>>>>>>>>>0xC4 belong 8 - received SIGFPE +>>>>>>>>>0xC4 belong 10 - received SIGBUS +>>>>>>>>>0xC4 belong 11 - received SIGSEGV +>>>>>>>>>0xC4 belong 12 - received SIGSYS +>>>>>>>>>0xC4 belong 33 - received SIGXCPU +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ +# Order 2: KERNEL, FORMAT, EXEC, PROC +>>>0x4C belong 1 +>>>>0x58 belong 4 +>>>>>0x5C belong 1 +>>>>>>0x60 belong 0x100 +>>>>>>>0x6C belong 0x44 +>>>>>>>>0xB4 belong 4 core file +>>>>>>>>>0xA4 string >\0 from '%s' +>>>>>>>>>0xC4 belong 3 - received SIGQUIT +>>>>>>>>>0xC4 belong 4 - received SIGILL +>>>>>>>>>0xC4 belong 5 - received SIGTRAP +>>>>>>>>>0xC4 belong 6 - received SIGABRT +>>>>>>>>>0xC4 belong 7 - received SIGEMT +>>>>>>>>>0xC4 belong 8 - received SIGFPE +>>>>>>>>>0xC4 belong 10 - received SIGBUS +>>>>>>>>>0xC4 belong 11 - received SIGSEGV +>>>>>>>>>0xC4 belong 12 - received SIGSYS +>>>>>>>>>0xC4 belong 33 - received SIGXCPU +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ +# Order 3: FORMAT, KERNEL, EXEC, PROC +0x24 string HP-UX +>0 belong 1 +>>0xC belong 4 +>>>0x10 belong 1 +>>>>0x14 belong 2 +>>>>>0x20 belong 0x3C +>>>>>>0x60 belong 0x100 +>>>>>>>0x6C belong 0x44 +>>>>>>>>0xB4 belong 4 core file +>>>>>>>>>0xA4 string >\0 from '%s' +>>>>>>>>>0xC4 belong 3 - received SIGQUIT +>>>>>>>>>0xC4 belong 4 - received SIGILL +>>>>>>>>>0xC4 belong 5 - received SIGTRAP +>>>>>>>>>0xC4 belong 6 - received SIGABRT +>>>>>>>>>0xC4 belong 7 - received SIGEMT +>>>>>>>>>0xC4 belong 8 - received SIGFPE +>>>>>>>>>0xC4 belong 10 - received SIGBUS +>>>>>>>>>0xC4 belong 11 - received SIGSEGV +>>>>>>>>>0xC4 belong 12 - received SIGSYS +>>>>>>>>>0xC4 belong 33 - received SIGXCPU +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ +# Order 4: EXEC, KERNEL, FORMAT, PROC +0x64 string HP-UX +>0 belong 0x100 +>>0xC belong 0x44 +>>>0x54 belong 2 +>>>>0x60 belong 0x3C +>>>>>0xA0 belong 1 +>>>>>>0xAC belong 4 +>>>>>>>0xB0 belong 1 +>>>>>>>>0xB4 belong 4 core file +>>>>>>>>>0x44 string >\0 from '%s' +>>>>>>>>>0xC4 belong 3 - received SIGQUIT +>>>>>>>>>0xC4 belong 4 - received SIGILL +>>>>>>>>>0xC4 belong 5 - received SIGTRAP +>>>>>>>>>0xC4 belong 6 - received SIGABRT +>>>>>>>>>0xC4 belong 7 - received SIGEMT +>>>>>>>>>0xC4 belong 8 - received SIGFPE +>>>>>>>>>0xC4 belong 10 - received SIGBUS +>>>>>>>>>0xC4 belong 11 - received SIGSEGV +>>>>>>>>>0xC4 belong 12 - received SIGSYS +>>>>>>>>>0xC4 belong 33 - received SIGXCPU +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ +# Order 5: FORMAT, EXEC, KERNEL, PROC +0x78 string HP-UX +>0 belong 1 +>>0xC belong 4 +>>>0x10 belong 1 +>>>>0x14 belong 0x100 +>>>>>0x20 belong 0x44 +>>>>>>0x68 belong 2 +>>>>>>>0x74 belong 0x3C +>>>>>>>>0xB4 belong 4 core file +>>>>>>>>>0x58 string >\0 from '%s' +>>>>>>>>>0xC4 belong 3 - received SIGQUIT +>>>>>>>>>0xC4 belong 4 - received SIGILL +>>>>>>>>>0xC4 belong 5 - received SIGTRAP +>>>>>>>>>0xC4 belong 6 - received SIGABRT +>>>>>>>>>0xC4 belong 7 - received SIGEMT +>>>>>>>>>0xC4 belong 8 - received SIGFPE +>>>>>>>>>0xC4 belong 10 - received SIGBUS +>>>>>>>>>0xC4 belong 11 - received SIGSEGV +>>>>>>>>>0xC4 belong 12 - received SIGSYS +>>>>>>>>>0xC4 belong 33 - received SIGXCPU +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ +# Order 6: EXEC, FORMAT, KERNEL, PROC +>0 belong 0x100 +>>0xC belong 0x44 +>>>0x54 belong 1 +>>>>0x60 belong 4 +>>>>>0x64 belong 1 +>>>>>>0x68 belong 2 +>>>>>>>0x74 belong 0x2C +>>>>>>>>0xB4 belong 4 core file +>>>>>>>>>0x44 string >\0 from '%s' +>>>>>>>>>0xC4 belong 3 - received SIGQUIT +>>>>>>>>>0xC4 belong 4 - received SIGILL +>>>>>>>>>0xC4 belong 5 - received SIGTRAP +>>>>>>>>>0xC4 belong 6 - received SIGABRT +>>>>>>>>>0xC4 belong 7 - received SIGEMT +>>>>>>>>>0xC4 belong 8 - received SIGFPE +>>>>>>>>>0xC4 belong 10 - received SIGBUS +>>>>>>>>>0xC4 belong 11 - received SIGSEGV +>>>>>>>>>0xC4 belong 12 - received SIGSYS +>>>>>>>>>0xC4 belong 33 - received SIGXCPU +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ + + diff --git a/magic/Magdir/human68k b/magic/Magdir/human68k new file mode 100644 index 0000000..b3d66ce --- /dev/null +++ b/magic/Magdir/human68k @@ -0,0 +1,26 @@ + +#------------------------------------------------------------------------------ +# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $ +# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats +# Magic too short! +#0 string HU Human68k +#>68 string LZX LZX compressed +#>>72 string >\0 (version %s) +#>(8.L+74) string LZX LZX compressed +#>>(8.L+78) string >\0 (version %s) +#>60 belong >0 binded +#>(8.L+66) string #HUPAIR hupair +#>0 string HU X executable +#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 +#>4 belong >0 - base address 0x%x +#>28 belong >0 not stripped +#>32 belong >0 with debug information +#0 beshort 0x601a Human68k Z executable +#0 beshort 0x6000 Human68k object file +#0 belong 0xd1000000 Human68k ar binary archive +#0 belong 0xd1010000 Human68k ar ascii archive +#0 beshort 0x0068 Human68k lib archive +#4 string LZX Human68k LZX compressed +#>8 string >\0 (version %s) +#>4 string LZX R executable +#2 string #HUPAIR Human68k hupair R executable diff --git a/magic/Magdir/ibm370 b/magic/Magdir/ibm370 new file mode 100644 index 0000000..37d17bd --- /dev/null +++ b/magic/Magdir/ibm370 @@ -0,0 +1,48 @@ + +#------------------------------------------------------------------------------ +# $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $ +# ibm370: file(1) magic for IBM 370 and compatibles. +# +# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". +# What the heck *is* "USS/370"? +# AIX 4.1's "/etc/magic" has +# +# 0 short 0535 370 sysV executable +# >12 long >0 not stripped +# >22 short >0 - version %d +# >30 long >0 - 5.2 format +# 0 short 0530 370 sysV pure executable +# >12 long >0 not stripped +# >22 short >0 - version %d +# >30 long >0 - 5.2 format +# +# instead of the "USS/370" versions of the same magic numbers. +# +0 beshort 0537 370 XA sysV executable +>12 belong >0 not stripped +>22 beshort >0 - version %d +>30 belong >0 - 5.2 format +0 beshort 0532 370 XA sysV pure executable +>12 belong >0 not stripped +>22 beshort >0 - version %d +>30 belong >0 - 5.2 format +0 beshort 054001 370 sysV pure executable +>12 belong >0 not stripped +0 beshort 055001 370 XA sysV pure executable +>12 belong >0 not stripped +0 beshort 056401 370 sysV executable +>12 belong >0 not stripped +0 beshort 057401 370 XA sysV executable +>12 belong >0 not stripped +0 beshort 0531 SVR2 executable (Amdahl-UTS) +>12 belong >0 not stripped +>24 belong >0 - version %ld +0 beshort 0534 SVR2 pure executable (Amdahl-UTS) +>12 belong >0 not stripped +>24 belong >0 - version %ld +0 beshort 0530 SVR2 pure executable (USS/370) +>12 belong >0 not stripped +>24 belong >0 - version %ld +0 beshort 0535 SVR2 executable (USS/370) +>12 belong >0 not stripped +>24 belong >0 - version %ld diff --git a/magic/Magdir/ibm6000 b/magic/Magdir/ibm6000 new file mode 100644 index 0000000..df27491 --- /dev/null +++ b/magic/Magdir/ibm6000 @@ -0,0 +1,28 @@ + +#------------------------------------------------------------------------------ +# $File: ibm6000,v 1.11 2013/01/08 20:13:01 christos Exp $ +# ibm6000: file(1) magic for RS/6000 and the RT PC. +# +0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module +>12 belong >0 not stripped +# Breaks sun4 statically linked execs. +#0 beshort 0x0103 executable (RT Version 2) or obj module +#>2 byte 0x50 pure +#>28 belong >0 not stripped +#>6 beshort >0 - version %ld +0 beshort 0x0104 shared library +0 beshort 0x0105 ctab data +0 beshort 0xfe04 structured file +0 string 0xabcdef AIX message catalog +0 belong 0x000001f9 AIX compiled message catalog +0 string \<aiaff> archive +0 string \<bigaf> archive (big format) + +0 beshort 0x01f7 64-bit XCOFF executable or object module +>20 belong 0 not stripped +4 belong &0x0feeddb0 AIX core file +>1 byte &0x01 fulldump +>7 byte &0x01 32-bit +>>0x6e0 string >\0 \b, %s +>7 byte &0x02 64-bit +>>0x524 string >\0 \b, %s diff --git a/magic/Magdir/icc b/magic/Magdir/icc new file mode 100644 index 0000000..37fa30e --- /dev/null +++ b/magic/Magdir/icc @@ -0,0 +1,51 @@ + +#------------------------------------------------------------------------------ +# $File: icc,v 1.1 2013/01/08 01:43:18 christos Exp $ +# icc: file(1) magic for International Color Consortium file formats + +# +# Color profiles as per the ICC's "Image technology colour management - +# Architecture, profile format, and data structure" specification. +# See +# +# http://www.color.org/specification/ICC1v43_2010-12.pdf +# +# for Specification ICC.1:2010 (Profile version 4.3.0.0). +# +# Bytes 36 to 39 contain a generic profile file signature of "acsp"; +# bytes 40 to 43 "may be used to identify the primary platform/operating +# system framework for which the profile was created". +# +# There are other fields that might be worth dumping as well. +# + +# This appears to be what's used for Apple ColorSync profiles. +# Instead of adding that, Apple just changed the generic "acsp" entry +# to be for "ColorSync ICC Color Profile" rather than "Kodak Color +# Management System, ICC Profile". +# Yes, it's "APPL", not "AAPL"; see the spec. +36 string acspAPPL ColorSync ICC Profile +!:mime application/vnd.iccprofile + +# Microsoft ICM color profile +36 string acspMSFT Microsoft ICM Color Profile +!:mime application/vnd.iccprofile + +# Yes, that's a blank after "SGI". +36 string acspSGI\ SGI ICC Profile +!:mime application/vnd.iccprofile + +# XXX - is this what's used for the Sun KCMS or not? The standard file +# uses just "acsp" for that, but Apple's file uses it for "ColorSync", +# and there *is* an identified "primary platform" value of SUNW. +36 string acspSUNW Sun KCMS ICC Profile +!:mime application/vnd.iccprofile + +# Any other profile. +# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles, +# and use "acsp" for everything else and dump the "primary platform" +# string in those cases? +36 string acsp ICC Profile +!:mime application/vnd.iccprofile + + diff --git a/magic/Magdir/iff b/magic/Magdir/iff new file mode 100644 index 0000000..b991ab7 --- /dev/null +++ b/magic/Magdir/iff @@ -0,0 +1,71 @@ + +#------------------------------------------------------------------------------ +# $File: iff,v 1.13 2011/09/06 11:00:06 christos Exp $ +# iff: file(1) magic for Interchange File Format (see also "audio" & "images") +# +# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic +# Arts for file interchange. It has also been used by Apple, SGI, and +# especially Commodore-Amiga. +# +# IFF files begin with an 8 byte FORM header, followed by a 4 character +# FORM type, which is followed by the first chunk in the FORM. + +0 string FORM IFF data +#>4 belong x \b, FORM is %d bytes long +# audio formats +>8 string AIFF \b, AIFF audio +!:mime audio/x-aiff +>8 string AIFC \b, AIFF-C compressed audio +!:mime audio/x-aiff +>8 string 8SVX \b, 8SVX 8-bit sampled sound voice +!:mime audio/x-aiff +>8 string 16SV \b, 16SV 16-bit sampled sound voice +>8 string SAMP \b, SAMP sampled audio +>8 string MAUD \b, MAUD MacroSystem audio +>8 string SMUS \b, SMUS simple music +>8 string CMUS \b, CMUS complex music +# image formats +>8 string ILBMBMHD \b, ILBM interleaved image +>>20 beshort x \b, %d x +>>22 beshort x %d +>8 string RGBN \b, RGBN 12-bit RGB image +>8 string RGB8 \b, RGB8 24-bit RGB image +>8 string DEEP \b, DEEP TVPaint/XiPaint image +>8 string DR2D \b, DR2D 2-D object +>8 string TDDD \b, TDDD 3-D rendering +>8 string LWOB \b, LWOB 3-D object +>8 string LWO2 \b, LWO2 3-D object, v2 +>8 string LWLO \b, LWLO 3-D layered object +>8 string REAL \b, REAL Real3D rendering +>8 string MC4D \b, MC4D MaxonCinema4D rendering +>8 string ANIM \b, ANIM animation +>8 string YAFA \b, YAFA animation +>8 string SSA\ \b, SSA super smooth animation +>8 string ACBM \b, ACBM continuous image +>8 string FAXX \b, FAXX fax image +# other formats +>8 string FTXT \b, FTXT formatted text +>8 string CTLG \b, CTLG message catalog +>8 string PREF \b, PREF preferences +>8 string DTYP \b, DTYP datatype description +>8 string PTCH \b, PTCH binary patch +>8 string AMFF \b, AMFF AmigaMetaFile format +>8 string WZRD \b, WZRD StormWIZARD resource +>8 string DOC\ \b, DOC desktop publishing document +>8 string WVQA \b, Westwood Studios VQA Multimedia, +>>24 leshort x %d video frames, +>>26 leshort x %d x +>>28 leshort x %d +>8 string MOVE \b, Wing Commander III Video +>>12 string _PC_ \b, PC version +>>12 string 3DO_ \b, 3DO version + +# These go at the end of the iff rules +# +# I don't see why these might collide with anything else. +# +# Interactive Fiction related formats +# +>8 string IFRS \b, Blorb Interactive Fiction +>>24 string Exec with executable chunk +>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) diff --git a/magic/Magdir/images b/magic/Magdir/images new file mode 100644 index 0000000..fe8e449 --- /dev/null +++ b/magic/Magdir/images @@ -0,0 +1,829 @@ + +#------------------------------------------------------------------------------ +# $File: images,v 1.80 2013/02/06 14:18:52 christos Exp $ +# images: file(1) magic for image formats (see also "iff", and "c-lang" for +# XPM bitmaps) +# +# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), +# additions by janl@ifi.uio.no as well as others. Jan also suggested +# merging several one- and two-line files into here. +# +# little magic: PCX (first byte is 0x0a) + +# Targa - matches `povray', `ppmtotga' and `xv' outputs +# by Philippe De Muyter <phdm@macqel.be> +# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 +# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise +# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs +# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) +# `tgatoppm' recognizes a superset (Index may be anything) +1 belong&0xfff7ffff 0x01010000 Targa image data - Map +>2 byte&8 8 - RLE +>12 leshort >0 %hd x +>14 leshort >0 %hd +1 belong&0xfff7ffff 0x00020000 Targa image data - RGB +>2 byte&8 8 - RLE +>12 leshort >0 %hd x +>14 leshort >0 %hd +1 belong&0xfff7ffff 0x00030000 Targa image data - Mono +>2 byte&8 8 - RLE +>12 leshort >0 %hd x +>14 leshort >0 %hd + +# PBMPLUS images +# The next byte following the magic is always whitespace. +# strength is changed to try these patterns before "x86 boot sector" +0 search/1 P1 +>3 regex =[0-9]*\ [0-9]* Netpbm PBM image text +>3 regex =[0-9]+\ \b, size = %sx +>>3 regex =\ [0-9]+ \b%s +!:strength + 45 +!:mime image/x-portable-bitmap +0 search/1 P2 +>3 regex =[0-9]*\ [0-9]* Netpbm PGM image text +>3 regex =[0-9]+\ \b, size = %sx +>>3 regex =\ [0-9]+ \b%s +!:strength + 45 +!:mime image/x-portable-greymap +0 search/1 P3 Netpbm PPM image text +>3 regex =[0-9]*\ [0-9]* Netpbm PPM image text +>3 regex =[0-9]+\ \b, size = %sx +>>3 regex =\ [0-9]+ \b%s +!:strength + 45 +!:mime image/x-portable-pixmap +0 string P4 +>3 regex =[0-9]*\ [0-9]* Netpbm PBM "rawbits" image data +>3 regex =[0-9]+\ \b, size = %sx +>>3 regex =\ [0-9]+ \b%s +!:strength + 45 +!:mime image/x-portable-bitmap +0 string P5 +>3 regex =[0-9]*\ [0-9]* Netpbm PGM "rawbits" image data +>3 regex =[0-9]+\ \b, size = %sx +>>3 regex =\ [0-9]+ \b%s +!:strength + 45 +!:mime image/x-portable-greymap +0 string P6 +>3 regex =[0-9]*\ [0-9]* Netpbm PPM "rawbits" image data +>3 regex =[0-9]+\ \b, size = %sx +>>3 regex =\ [0-9]+ \b%s +!:strength + 45 +!:mime image/x-portable-pixmap +0 string P7 Netpbm PAM image file +!:mime image/x-portable-pixmap + +# From: bryanh@giraffe-data.com (Bryan Henderson) +0 string \117\072 Solitaire Image Recorder format +>4 string \013 MGI Type 11 +>4 string \021 MGI Type 17 +0 string .MDA MicroDesign data +>21 byte 48 version 2 +>21 byte 51 version 3 +0 string .MDP MicroDesign page data +>21 byte 48 version 2 +>21 byte 51 version 3 + +# NIFF (Navy Interchange File Format, a modification of TIFF) images +# [GRR: this *must* go before TIFF] +0 string IIN1 NIFF image data +!:mime image/x-niff + +# Canon RAW version 1 (CRW) files are a type of Canon Image File Format +# (CIFF) file. These are apparently all little-endian. +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html +0 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data +!:mime image/x-canon-crw +>16 leshort x \b, version %d. +>14 leshort x \b%d + +# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic +# number. Put this above the TIFF test to make sure we detect them. +# These are apparently all little-endian. +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2 +0 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data +!:mime image/x-canon-cr2 +>10 byte x \b, version %d. +>11 byte x \b%d + +# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) +# The second word of TIFF files is the TIFF version number, 42, which has +# never changed. The TIFF specification recommends testing for it. +0 string MM\x00\x2a TIFF image data, big-endian +!:mime image/tiff +0 string II\x2a\x00 TIFF image data, little-endian +!:mime image/tiff + +0 string MM\x00\x2b Big TIFF image data, big-endian +!:mime image/tiff +0 string II\x2b\x00 Big TIFF image data, little-endian +!:mime image/tiff + +# PNG [Portable Network Graphics, or "PNG's Not GIF"] images +# (Greg Roelofs, newt@uchicago.edu) +# (Albert Cahalan, acahalan@cs.uml.edu) +# +# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... +# +0 string \x89PNG\x0d\x0a\x1a\x0a PNG image data +!:mime image/png +>16 belong x \b, %ld x +>20 belong x %ld, +>24 byte x %d-bit +>25 byte 0 grayscale, +>25 byte 2 \b/color RGB, +>25 byte 3 colormap, +>25 byte 4 gray+alpha, +>25 byte 6 \b/color RGBA, +#>26 byte 0 deflate/32K, +>28 byte 0 non-interlaced +>28 byte 1 interlaced + +# possible GIF replacements; none yet released! +# (Greg Roelofs, newt@uchicago.edu) +# +# GRR 950115: this was mine ("Zip GIF"): +0 string GIF94z ZIF image (GIF+deflate alpha) +!:mime image/x-unknown +# +# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): +# +0 string FGF95a FGF image (GIF+deflate beta) +!:mime image/x-unknown +# +# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal +# (best; not yet implemented): +# +0 string PBF PBF image (deflate compression) +!:mime image/x-unknown + +# GIF +0 string GIF8 GIF image data +!:mime image/gif +!:apple 8BIMGIFf +>4 string 7a \b, version 8%s, +>4 string 9a \b, version 8%s, +>6 leshort >0 %hd x +>8 leshort >0 %hd +#>10 byte &0x80 color mapped, +#>10 byte&0x07 =0x00 2 colors +#>10 byte&0x07 =0x01 4 colors +#>10 byte&0x07 =0x02 8 colors +#>10 byte&0x07 =0x03 16 colors +#>10 byte&0x07 =0x04 32 colors +#>10 byte&0x07 =0x05 64 colors +#>10 byte&0x07 =0x06 128 colors +#>10 byte&0x07 =0x07 256 colors + +# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, +# 1 plane, no encoding. +0 string \361\0\100\273 CMU window manager raster image data +>4 lelong >0 %d x +>8 lelong >0 %d, +>12 lelong >0 %d-bit + +# Magick Image File Format +0 string id=ImageMagick MIFF image data + +# Artisan +0 long 1123028772 Artisan image data +>4 long 1 \b, rectangular 24-bit +>4 long 2 \b, rectangular 8-bit with colormap +>4 long 3 \b, rectangular 32-bit (24-bit with matte) + +# FIG (Facility for Interactive Generation of figures), an object-based format +0 search/1 #FIG FIG image text +>5 string x \b, version %.3s + +# PHIGS +0 string ARF_BEGARF PHIGS clear text archive +0 string @(#)SunPHIGS SunPHIGS +# version number follows, in the form m.n +>40 string SunBin binary +>32 string archive archive + +# GKS (Graphics Kernel System) +0 string GKSM GKS Metafile +>24 string SunGKS \b, SunGKS + +# CGM image files +0 string BEGMF clear text Computer Graphics Metafile + +# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) +0 string yz MGR bitmap, modern format, 8-bit aligned +0 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned +0 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned +0 string yx MGR bitmap, modern format, squeezed + +# Fuzzy Bitmap (FBM) images +0 string %bitmap\0 FBM image data +>30 long 0x31 \b, mono +>30 long 0x33 \b, color + +# facsimile data +1 string PC\ Research,\ Inc group 3 fax data +>29 byte 0 \b, normal resolution (204x98 DPI) +>29 byte 1 \b, fine resolution (204x196 DPI) +# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> +0 string Sfff structured fax file + +# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net> +# most files with the extension .EPA and some with .BMP +0 string \x11\x06 Award BIOS Logo, 136 x 84 +!:mime image/x-award-bioslogo +0 string \x11\x09 Award BIOS Logo, 136 x 126 +!:mime image/x-award-bioslogo +#0 string \x07\x1f BIOS Logo corrupted? +# http://www.blackfiveservices.co.uk/awbmtools.shtml +# http://biosgfx.narod.ru/v3/ +# http://biosgfx.narod.ru/abr-2/ +0 string AWBM +>4 leshort <1981 Award BIOS bitmap +!:mime image/x-award-bmp +# image width is a multiple of 4 +>>4 leshort&0x0003 0 +>>>4 leshort x \b, %d +>>>6 leshort x x %d +>>4 leshort&0x0003 >0 \b, +>>>4 leshort&0x0003 =1 +>>>>4 leshort x %d+3 +>>>4 leshort&0x0003 =2 +>>>>4 leshort x %d+2 +>>>4 leshort&0x0003 =3 +>>>>4 leshort x %d+1 +>>>6 leshort x x %d +# at offset 8 starts imagedata followed by "RGB " marker + +# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) +0 string BM +>14 leshort 12 PC bitmap, OS/2 1.x format +!:mime image/x-ms-bmp +>>18 leshort x \b, %d x +>>20 leshort x %d +>14 leshort 64 PC bitmap, OS/2 2.x format +!:mime image/x-ms-bmp +>>18 leshort x \b, %d x +>>20 leshort x %d +>14 leshort 40 PC bitmap, Windows 3.x format +!:mime image/x-ms-bmp +>>18 lelong x \b, %d x +>>22 lelong x %d x +>>28 leshort x %d +>14 leshort 128 PC bitmap, Windows NT/2000 format +!:mime image/x-ms-bmp +>>18 lelong x \b, %d x +>>22 lelong x %d x +>>28 leshort x %d +# Too simple - MPi +#0 string IC PC icon data +#0 string PI PC pointer image data +#0 string CI PC color icon data +#0 string CP PC color pointer image data +# Conflicts with other entries [BABYL] +#0 string BA PC bitmap array data + +# XPM icons (Greg Roelofs, newt@uchicago.edu) +0 search/1 /*\ XPM\ */ X pixmap image text +!:mime image/x-xpmi + +# Utah Raster Toolkit RLE images (janl@ifi.uio.no) +0 leshort 0xcc52 RLE image data, +>6 leshort x %d x +>8 leshort x %d +>2 leshort >0 \b, lower left corner: %d +>4 leshort >0 \b, lower right corner: %d +>10 byte&0x1 =0x1 \b, clear first +>10 byte&0x2 =0x2 \b, no background +>10 byte&0x4 =0x4 \b, alpha channel +>10 byte&0x8 =0x8 \b, comment +>11 byte >0 \b, %d color channels +>12 byte >0 \b, %d bits per pixel +>13 byte >0 \b, %d color map channels + +# image file format (Robert Potter, potter@cs.rochester.edu) +0 string Imagefile\ version- iff image data +# this adds the whole header (inc. version number), informative but longish +>10 string >\0 %s + +# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) +0 belong 0x59a66a95 Sun raster image data +>4 belong >0 \b, %d x +>8 belong >0 %d, +>12 belong >0 %d-bit, +#>16 belong >0 %d bytes long, +>20 belong 0 old format, +#>20 belong 1 standard, +>20 belong 2 compressed, +>20 belong 3 RGB, +>20 belong 4 TIFF, +>20 belong 5 IFF, +>20 belong 0xffff reserved for testing, +>24 belong 0 no colormap +>24 belong 1 RGB colormap +>24 belong 2 raw colormap +#>28 belong >0 colormap is %d bytes long + +# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) +# +# See +# http://reality.sgi.com/grafica/sgiimage.html +# +0 beshort 474 SGI image data +#>2 byte 0 \b, verbatim +>2 byte 1 \b, RLE +#>3 byte 1 \b, normal precision +>3 byte 2 \b, high precision +>4 beshort x \b, %d-D +>6 beshort x \b, %d x +>8 beshort x %d +>10 beshort x \b, %d channel +>10 beshort !1 \bs +>80 string >0 \b, "%s" + +0 string IT01 FIT image data +>4 belong x \b, %d x +>8 belong x %d x +>12 belong x %d +# +0 string IT02 FIT image data +>4 belong x \b, %d x +>8 belong x %d x +>12 belong x %d +# +2048 string PCD_IPI Kodak Photo CD image pack file +>0xe02 byte&0x03 0x00 , landscape mode +>0xe02 byte&0x03 0x01 , portrait mode +>0xe02 byte&0x03 0x02 , landscape mode +>0xe02 byte&0x03 0x03 , portrait mode +0 string PCD_OPA Kodak Photo CD overview pack file + +# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> +# FITS is the Flexible Image Transport System, the de facto standard for +# data and image transfer, storage, etc., for the astronomical community. +# (FITS floating point formats are big-endian.) +0 string SIMPLE\ \ = FITS image data +>109 string 8 \b, 8-bit, character or unsigned binary integer +>108 string 16 \b, 16-bit, two's complement binary integer +>107 string \ 32 \b, 32-bit, two's complement binary integer +>107 string -32 \b, 32-bit, floating point, single precision +>107 string -64 \b, 64-bit, floating point, double precision + +# other images +0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file + +# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image +# stuff. +# +0 beshort 0x1010 PEX Binary Archive + +# DICOM medical imaging data +128 string DICM DICOM medical imaging data +!:mime application/dicom + +# XWD - X Window Dump file. +# As described in /usr/X11R6/include/X11/XWDFile.h +# used by the xwd program. +# Bradford Castalia, idaeim, 1/01 +# updated by Adam Buchbinder, 2/09 +# The following assumes version 7 of the format; the first long is the length +# of the header, which is at least 25 4-byte longs, and the one at offset 8 +# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth, +# which is a maximum of 32. +0 belong >100 +>8 belong <3 +>>12 belong <33 +>>>4 belong 7 XWD X Window Dump image data +!:mime image/x-xwindowdump +>>>>100 string >\0 \b, "%s" +>>>>16 belong x \b, %dx +>>>>20 belong x \b%dx +>>>>12 belong x \b%d + +# PDS - Planetary Data System +# These files use Parameter Value Language in the header section. +# Unfortunately, there is no certain magic, but the following +# strings have been found to be most likely. +0 string NJPL1I00 PDS (JPL) image data +2 string NJPL1I PDS (JPL) image data +0 string CCSD3ZF PDS (CCSD) image data +2 string CCSD3Z PDS (CCSD) image data +0 string PDS_ PDS image data +0 string LBLSIZE= PDS (VICAR) image data + +# pM8x: ATARI STAD compressed bitmap format +# +# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 +# p M 8 5/6 xx yy zz data... +# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. +# bytes either run horizontally (pM85) or vertically (pM86). yy is the +# most frequent byte, xx and zz are runlength escape codes, where xx is +# used for runs of yy. +# +0 string pM85 Atari ST STAD bitmap image data (hor) +>5 byte 0x00 (white background) +>5 byte 0xFF (black background) +0 string pM86 Atari ST STAD bitmap image data (vert) +>5 byte 0x00 (white background) +>5 byte 0xFF (black background) + +# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu +# http://www.atarimax.com/jindroush.atari.org/afmtatr.html +0 leshort 0x0296 Atari ATR image + +# XXX: +# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other +# magic. +# SGI RICE image file <mpruett@sgi.com> +#0 beshort 0x5249 RICE image +#>2 beshort x v%d +#>4 beshort x (%d x +#>6 beshort x %d) +#>8 beshort 0 8 bit +#>8 beshort 1 10 bit +#>8 beshort 2 12 bit +#>8 beshort 3 13 bit +#>10 beshort 0 4:2:2 +#>10 beshort 1 4:2:2:4 +#>10 beshort 2 4:4:4 +#>10 beshort 3 4:4:4:4 +#>12 beshort 1 RGB +#>12 beshort 2 CCIR601 +#>12 beshort 3 RP175 +#>12 beshort 4 YUV + +# PCX image files +# From: Dan Fandrich <dan@coneharvesters.com> +0 beshort 0x0a00 PCX ver. 2.5 image data +0 beshort 0x0a02 PCX ver. 2.8 image data, with palette +0 beshort 0x0a03 PCX ver. 2.8 image data, without palette +0 beshort 0x0a04 PCX for Windows image data +0 beshort 0x0a05 PCX ver. 3.0 image data +>4 leshort x bounding box [%hd, +>6 leshort x %hd] - +>8 leshort x [%hd, +>10 leshort x %hd], +>65 byte >1 %d planes each of +>3 byte x %hhd-bit +>68 byte 0 image, +>68 byte 1 colour, +>68 byte 2 grayscale, +>68 byte >2 image, +>68 byte <0 image, +>12 leshort >0 %hd x +>>14 leshort x %hd dpi, +>2 byte 0 uncompressed +>2 byte 1 RLE compressed + +# Adobe Photoshop +# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> +0 string 8BPS Adobe Photoshop Image +!:mime image/vnd.adobe.photoshop +>4 beshort 2 (PSB) +>18 belong x \b, %d x +>14 belong x %d, +>24 beshort 0 bitmap +>24 beshort 1 grayscale +>>12 beshort 2 with alpha +>24 beshort 2 indexed +>24 beshort 3 RGB +>>12 beshort 4 \bA +>24 beshort 4 CMYK +>>12 beshort 5 \bA +>24 beshort 7 multichannel +>24 beshort 8 duotone +>24 beshort 9 lab +>12 beshort > 1 +>>12 beshort x \b, %dx +>12 beshort 1 \b, +>22 beshort x %d-bit channel +>12 beshort > 1 \bs + +# XV thumbnail indicator (ThMO) +0 string P7\ 332 XV thumbnail image data + +# NITF is defined by United States MIL-STD-2500A +0 string NITF National Imagery Transmission Format +>25 string >\0 dated %.14s + +# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) +0 belong 0x00010008 GEM Image data +>12 beshort x %d x +>14 beshort x %d, +>4 beshort x %d planes, +>8 beshort x %d x +>10 beshort x %d pixelsize + +# GEM Metafile (Wolfram Kleff) +0 lelong 0x0018FFFF GEM Metafile data +>4 leshort x version %d + +# +# SMJPEG. A custom Motion JPEG format used by Loki Entertainment +# Software Torbjorn Andersson <d91tan@Update.UU.SE>. +# +0 string \0\nSMJPEG SMJPEG +>8 belong x %d.x data +# According to the specification you could find any number of _TXT +# headers here, but I can't think of any way of handling that. None of +# the SMJPEG files I tried it on used this feature. Even if such a +# file is encountered the output should still be reasonable. +>16 string _SND \b, +>>24 beshort >0 %d Hz +>>26 byte 8 8-bit +>>26 byte 16 16-bit +>>28 string NONE uncompressed +# >>28 string APCM ADPCM compressed +>>27 byte 1 mono +>>28 byte 2 stereo +# Help! Isn't there any way to avoid writing this part twice? +>>32 string _VID \b, +# >>>48 string JFIF JPEG +>>>40 belong >0 %d frames +>>>44 beshort >0 (%d x +>>>46 beshort >0 %d) +>16 string _VID \b, +# >>32 string JFIF JPEG +>>24 belong >0 %d frames +>>28 beshort >0 (%d x +>>30 beshort >0 %d) + +0 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File + +# "thumbnail file" (icon) +# descended from "xv", but in use by other applications as well (Wolfram Kleff) +0 string P7\ 332 XV "thumbnail file" (icon) data + +# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) +0 string KiSS KISS/GS +>4 byte 16 color +>>5 byte x %d bit +>>8 leshort x %d colors +>>10 leshort x %d groups +>4 byte 32 cell +>>5 byte x %d bit +>>8 leshort x %d x +>>10 leshort x %d +>>12 leshort x +%d +>>14 leshort x +%d + +# Webshots (www.webshots.com), by John Harrison +0 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file + +# Hercules DASD image files +# From Jan Jaeger <jj@septa.nl> +0 string CKD_P370 Hercules CKD DASD image file +>8 long x \b, %d heads per cylinder +>12 long x \b, track size %d bytes +>16 byte x \b, device type 33%2.2X + +0 string CKD_C370 Hercules compressed CKD DASD image file +>8 long x \b, %d heads per cylinder +>12 long x \b, track size %d bytes +>16 byte x \b, device type 33%2.2X + +0 string CKD_S370 Hercules CKD DASD shadow file +>8 long x \b, %d heads per cylinder +>12 long x \b, track size %d bytes +>16 byte x \b, device type 33%2.2X + +# Squeak images and programs - etoffi@softhome.net +0 string \146\031\0\0 Squeak image data +0 search/1 'From\040Squeak Squeak program text + +# partimage: file(1) magic for PartImage files (experimental, incomplete) +# Author: Hans-Joachim Baader <hjb@pro-linux.de> +0 string PaRtImAgE-VoLuMe PartImage +>0x0020 string 0.6.1 file version %s +>>0x0060 lelong >-1 volume %ld +#>>0x0064 8 byte identifier +#>>0x007c reserved +>>0x0200 string >\0 type %s +>>0x1400 string >\0 device %s, +>>0x1600 string >\0 original filename %s, +# Some fields omitted +>>0x2744 lelong 0 not compressed +>>0x2744 lelong 1 gzip compressed +>>0x2744 lelong 2 bzip2 compressed +>>0x2744 lelong >2 compressed with unknown algorithm +>0x0020 string >0.6.1 file version %s +>0x0020 string <0.6.1 file version %s + +# DCX is multi-page PCX, using a simple header of up to 1024 +# offsets for the respective PCX components. +# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> +0 lelong 987654321 DCX multi-page PCX image data + +# Simon Walton <simonw@matteworld.com> +# Kodak Cineon format for scanned negatives +# http://www.kodak.com/US/en/motion/support/dlad/ +0 lelong 0xd75f2a80 Cineon image data +>200 belong >0 \b, %ld x +>204 belong >0 %ld + + +# Bio-Rad .PIC is an image format used by microscope control systems +# and related image processing software used by biologists. +# From: Vebjorn Ljosa <vebjorn@ljosa.com> +# BOOL values are two-byte integers; use them to rule out false positives. +# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt +# Samples: http://www.loci.wisc.edu/software/sample-data +14 leshort <2 +>62 leshort <2 +>>54 leshort 12345 Bio-Rad .PIC Image File +>>>0 leshort >0 %hd x +>>>2 leshort >0 %hd, +>>>4 leshort =1 1 image in file +>>>4 leshort >1 %hd images in file + +# From Jan "Yenya" Kasprzak <kas@fi.muni.cz> +# The description of *.mrw format can be found at +# http://www.dalibor.cz/minolta/raw_file_format.htm +0 string \000MRM Minolta Dimage camera raw image data + +# Summary: DjVu image / document +# Extension: .djvu +# Reference: http://djvu.org/docs/DjVu3Spec.djvu +# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> +# Modified by (1): Abel Cheung <abelcheung@gmail.com> +0 string AT&TFORM +>12 string DJVM DjVu multiple page document +!:mime image/vnd.djvu +>12 string DJVU DjVu image or single page document +!:mime image/vnd.djvu +>12 string DJVI DjVu shared document +!:mime image/vnd.djvu +>12 string THUM DjVu page thumbnails +!:mime image/vnd.djvu + +# Originally by Marc Espie +# Modified by Robert Minsk <robertminsk at yahoo.com> +# http://www.openexr.com/openexrfilelayout.pdf +0 lelong 20000630 OpenEXR image data, +!:mime image/x-exr +>4 lelong&0x000000ff x version %d, +>4 lelong ^0x00000200 storage: scanline +>4 lelong &0x00000200 storage: tiled +>8 search/0x1000 compression\0 \b, compression: +>>&16 byte 0 none +>>&16 byte 1 rle +>>&16 byte 2 zips +>>&16 byte 3 zip +>>&16 byte 4 piz +>>&16 byte 5 pxr24 +>>&16 byte 6 b44 +>>&16 byte 7 b44a +>>&16 byte >7 unknown +>8 search/0x1000 dataWindow\0 \b, dataWindow: +>>&10 lelong x (%d +>>&14 lelong x %d)- +>>&18 lelong x \b(%d +>>&22 lelong x %d) +>8 search/0x1000 displayWindow\0 \b, displayWindow: +>>&10 lelong x (%d +>>&14 lelong x %d)- +>>&18 lelong x \b(%d +>>&22 lelong x %d) +>8 search/0x1000 lineOrder\0 \b, lineOrder: +>>&14 byte 0 increasing y +>>&14 byte 1 decreasing y +>>&14 byte 2 random y +>>&14 byte >2 unknown + +# SMPTE Digital Picture Exchange Format, SMPTE DPX +# +# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital +# Moving-Picture Exchange (DPX), v1.0, 18 February 1994 +# Robert Minsk <robertminsk at yahoo.com> +0 string SDPX DPX image data, big-endian, +!:mime image/x-dpx +>768 beshort <4 +>>772 belong x %dx +>>776 belong x \b%d, +>768 beshort >3 +>>776 belong x %dx +>>772 belong x \b%d, +>768 beshort 0 left to right/top to bottom +>768 beshort 1 right to left/top to bottom +>768 beshort 2 left to right/bottom to top +>768 beshort 3 right to left/bottom to top +>768 beshort 4 top to bottom/left to right +>768 beshort 5 top to bottom/right to left +>768 leshort 6 bottom to top/left to right +>768 leshort 7 bottom to top/right to left + +# From: Tom Hilinski <tom.hilinski@comcast.net> +# http://www.unidata.ucar.edu/packages/netcdf/ +0 string CDF\001 NetCDF Data Format data + +#----------------------------------------------------------------------- +# Hierarchical Data Format, used to facilitate scientific data exchange +# specifications at http://hdf.ncsa.uiuc.edu/ +0 belong 0x0e031301 Hierarchical Data Format (version 4) data +!:mime application/x-hdf +0 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data +!:mime application/x-hdf + +# From: Tobias Burnus <burnus@net-b.de> +# Xara (for a while: Corel Xara) is a graphic package, see +# http://www.xara.com/ for Windows and as GPL application for Linux +0 string XARA\243\243 Xara graphics file + +# http://www.cartesianinc.com/Tech/ +0 string CPC\262 Cartesian Perceptual Compression image +!:mime image/x-cpi + +# From Albert Cahalan <acahalan@gmail.com> +# puredigital used it for the CVS disposable camcorder +#8 lelong 4 ZBM bitmap image data +#>4 leshort x %u x +#>6 leshort x %u + +# From Albert Cahalan <acahalan@gmail.com> +# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons +0 string C565 OLPC firmware icon image data +>4 leshort x %u x +>6 leshort x %u + +# Applied Images - Image files from Cytovision +# Gustavo Junior Alves <gjalves@gjalves.com.br> +0 string \xce\xda\xde\xfa Cytovision Metaphases file +0 string \xed\xad\xef\xac Cytovision Karyotype file +0 string \x0b\x00\x03\x00 Cytovision FISH Probe file +0 string \xed\xfe\xda\xbe Cytovision FLEX file +0 string \xed\xab\xed\xfe Cytovision FLEX file +0 string \xad\xfd\xea\xad Cytovision RATS file + +# Wavelet Scalar Quantization format used in gray-scale fingerprint images +# From Tano M Fotang <mfotang@quanteq.com> +0 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data + +# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches +# From: Markus Heidelberg <markus.heidelberg at web.de> +0 string/t [BitmapInfo2] Polar Monitor Bitmap text +!:mime image/x-polar-monitor-bitmap + +# From: Rick Richardson <rick.richardson@comcast.net> +0 string GARMIN\ BITMAP\ 01 Garmin Bitmap file + +# Type: Ulead Photo Explorer5 (.pe5) +# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese) +# From: Simon Horman <horms@debian.org> +0 string IIO2H Ulead Photo Explorer5 + +# Type: X11 cursor +# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup +# From: Mathias Brodala <info@noctus.net> +0 string Xcur X11 cursor + +# Type: Olympus ORF raw images. +# URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +0 string MMOR Olympus ORF raw image data, big-endian +!:mime image/x-olympus-orf +0 string IIRO Olympus ORF raw image data, little-endian +!:mime image/x-olympus-orf +0 string IIRS Olympus ORF raw image data, little-endian +!:mime image/x-olympus-orf + +# Type: files used in modern AVCHD camcoders to store clip information +# Extension: .cpi +# From: Alexander Danilov <alexander.a.danilov@gmail.com> +0 string HDMV0100 AVCHD Clip Information + +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/ +# Radiance HDR; usually has .pic or .hdr extension. +0 string #?RADIANCE\n Radiance HDR image data +#!mime image/vnd.radiance + +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf +# Used by the pfstools packages. The regex matches for the image size could +# probably use some work. The MIME type is made up; if there's one in +# actual common use, it should replace the one below. +0 string PFS1\x0a PFS HDR image data +#!mime image/x-pfs +>1 regex [0-9]*\ \b, %s +>>1 regex \ [0-9]{4} \bx%s + +# Type: Foveon X3F +# URL: http://www.photofo.com/downloads/x3f-raw-format.pdf +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# Note that the MIME type isn't defined anywhere that I can find; if +# there's a canonical type for this format, it should replace this one. +0 string FOVb Foveon X3F raw image data +!:mime image/x-x3f +>6 leshort x \b, version %d. +>4 leshort x \b%d +>28 lelong x \b, %dx +>32 lelong x \b%d + +# Paint.NET file +# From Adam Buchbinder <adam.buchbinder@gmail.com> +0 string PDN3 Paint.NET image data +!:mime image/x-paintnet + +# Not really an image. +# From: "Tano M. Fotang" <mfotang@quanteq.com> +0 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR) diff --git a/magic/Magdir/inform b/magic/Magdir/inform new file mode 100644 index 0000000..fe518ec --- /dev/null +++ b/magic/Magdir/inform @@ -0,0 +1,9 @@ + +#------------------------------------------------------------------------------ +# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $ +# inform: file(1) magic for Inform interactive fiction language + +# URL: http://www.inform-fiction.org/ +# From: Reuben Thomas <rrt@sc3d.org> + +0 search/100/cW constant\ story Inform source text diff --git a/magic/Magdir/intel b/magic/Magdir/intel new file mode 100644 index 0000000..c3657f0 --- /dev/null +++ b/magic/Magdir/intel @@ -0,0 +1,53 @@ + +#------------------------------------------------------------------------------ +# $File: intel,v 1.11 2013/02/06 14:18:52 christos Exp $ +# intel: file(1) magic for x86 Unix +# +# Various flavors of x86 UNIX executable/object (other than Xenix, which +# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do +# Windows as well. +# +# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and +# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere +# as well, if, as, and when IBM makes it portable. +# +# The `versions' should be un-commented if they work for you. +# (Was the problem just one of endianness?) +# +0 leshort 0502 basic-16 executable +>12 lelong >0 not stripped +#>22 leshort >0 - version %ld +0 leshort 0503 basic-16 executable (TV) +>12 lelong >0 not stripped +#>22 leshort >0 - version %ld +0 leshort 0510 x86 executable +>12 lelong >0 not stripped +0 leshort 0511 x86 executable (TV) +>12 lelong >0 not stripped +0 leshort =0512 iAPX 286 executable small model (COFF) +>12 lelong >0 not stripped +#>22 leshort >0 - version %ld +0 leshort =0522 iAPX 286 executable large model (COFF) +>12 lelong >0 not stripped +#>22 leshort >0 - version %ld +# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan +0 leshort =0514 80386 COFF executable +>12 lelong >0 not stripped +>22 leshort >0 - version %ld + +# rom: file(1) magic for BIOS ROM Extensions found in intel machines +# mapped into memory between 0xC0000 and 0xFFFFF +# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu +0 beshort 0x55AA BIOS (ia32) ROM Ext. +>5 string USB USB +>7 string LDR UNDI image +>30 string IBM IBM comp. Video +>26 string Adaptec Adaptec +>28 string Adaptec Adaptec +>42 string PROMISE Promise +>2 byte x (%d*512) + +# Flash descriptors for Intel SPI flash roms. +# From Dr. Jesus <j@hug.gs> +0 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step +16 lelong 0x0ff0a55a Intel serial flash for PCH ROM diff --git a/magic/Magdir/interleaf b/magic/Magdir/interleaf new file mode 100644 index 0000000..8e3aaf5 --- /dev/null +++ b/magic/Magdir/interleaf @@ -0,0 +1,9 @@ + +#------------------------------------------------------------------------------ +# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $ +# interleaf: file(1) magic for InterLeaf TPS: +# +0 string =\210OPS Interleaf saved data +0 string =<!OPS Interleaf document text +>5 string ,\ Version\ = \b, version +>>17 string >\0 %.3s diff --git a/magic/Magdir/island b/magic/Magdir/island new file mode 100644 index 0000000..f40521a --- /dev/null +++ b/magic/Magdir/island @@ -0,0 +1,10 @@ + +#------------------------------------------------------------------------------ +# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $ +# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 +# "/etc/magic": +# From: guy@netapp.com (Guy Harris) +# +4 string pgscriptver IslandWrite document +13 string DrawFile IslandDraw document + diff --git a/magic/Magdir/ispell b/magic/Magdir/ispell new file mode 100644 index 0000000..57a6e9e --- /dev/null +++ b/magic/Magdir/ispell @@ -0,0 +1,63 @@ + +#------------------------------------------------------------------------------ +# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $ +# ispell: file(1) magic for ispell +# +# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic +# will match 0x9600 through 0x9603 in *both* little endian and big endian. +# (No other current magic entries collide.) +# +# Updated by Daniel Quinlan (quinlan@yggdrasil.com) +# +0 leshort&0xFFFC 0x9600 little endian ispell +>0 byte 0 hash file (?), +>0 byte 1 3.0 hash file, +>0 byte 2 3.1 hash file, +>0 byte 3 hash file (?), +>2 leshort 0x00 8-bit, no capitalization, 26 flags +>2 leshort 0x01 7-bit, no capitalization, 26 flags +>2 leshort 0x02 8-bit, capitalization, 26 flags +>2 leshort 0x03 7-bit, capitalization, 26 flags +>2 leshort 0x04 8-bit, no capitalization, 52 flags +>2 leshort 0x05 7-bit, no capitalization, 52 flags +>2 leshort 0x06 8-bit, capitalization, 52 flags +>2 leshort 0x07 7-bit, capitalization, 52 flags +>2 leshort 0x08 8-bit, no capitalization, 128 flags +>2 leshort 0x09 7-bit, no capitalization, 128 flags +>2 leshort 0x0A 8-bit, capitalization, 128 flags +>2 leshort 0x0B 7-bit, capitalization, 128 flags +>2 leshort 0x0C 8-bit, no capitalization, 256 flags +>2 leshort 0x0D 7-bit, no capitalization, 256 flags +>2 leshort 0x0E 8-bit, capitalization, 256 flags +>2 leshort 0x0F 7-bit, capitalization, 256 flags +>4 leshort >0 and %d string characters +0 beshort&0xFFFC 0x9600 big endian ispell +>1 byte 0 hash file (?), +>1 byte 1 3.0 hash file, +>1 byte 2 3.1 hash file, +>1 byte 3 hash file (?), +>2 beshort 0x00 8-bit, no capitalization, 26 flags +>2 beshort 0x01 7-bit, no capitalization, 26 flags +>2 beshort 0x02 8-bit, capitalization, 26 flags +>2 beshort 0x03 7-bit, capitalization, 26 flags +>2 beshort 0x04 8-bit, no capitalization, 52 flags +>2 beshort 0x05 7-bit, no capitalization, 52 flags +>2 beshort 0x06 8-bit, capitalization, 52 flags +>2 beshort 0x07 7-bit, capitalization, 52 flags +>2 beshort 0x08 8-bit, no capitalization, 128 flags +>2 beshort 0x09 7-bit, no capitalization, 128 flags +>2 beshort 0x0A 8-bit, capitalization, 128 flags +>2 beshort 0x0B 7-bit, capitalization, 128 flags +>2 beshort 0x0C 8-bit, no capitalization, 256 flags +>2 beshort 0x0D 7-bit, no capitalization, 256 flags +>2 beshort 0x0E 8-bit, capitalization, 256 flags +>2 beshort 0x0F 7-bit, capitalization, 256 flags +>4 beshort >0 and %d string characters +# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> +# Ispell 4.0 +0 string ISPL ispell +>4 long x hash file version %d, +>8 long x lexletters %d, +>12 long x lexsize %d, +>16 long x hashsize %d, +>20 long x stblsize %d diff --git a/magic/Magdir/isz b/magic/Magdir/isz new file mode 100644 index 0000000..316bbd4 --- /dev/null +++ b/magic/Magdir/isz @@ -0,0 +1,15 @@ + +#------------------------------------------------------------------------------ +# $File: isz,v 1.1 2010/03/27 16:17:09 christos Exp $ +# ISO Zipped file format +# http://www.ezbsystems.com/isz/iszspec.txt +0 string IsZ! ISO Zipped file +>4 byte x \b, header size %u +>5 byte x \b, version %u +>8 lelong x \b, serial %u +#12 leshort x \b, sector size %u +#>16 lelong x \b, total sectors %u +>17 byte >0 \b, password protected +#>24 lequad x \b, segment size %llu +#>32 lelong x \b, blocks %u +#>36 lelong x \b, block size %u diff --git a/magic/Magdir/java b/magic/Magdir/java new file mode 100644 index 0000000..f494f61 --- /dev/null +++ b/magic/Magdir/java @@ -0,0 +1,39 @@ + +#------------------------------------------------------------ +# $File: java,v 1.14 2013/02/08 16:54:45 christos Exp $ +# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the +# same magic number, 0xcafebabe, so they are both handled +# in the entry called "cafebabe". +#------------------------------------------------------------ +# Java serialization +# From Martin Pool (m.pool@pharos.com.au) +0 beshort 0xaced Java serialization data +>2 beshort >0x0004 \b, version %d + +0 belong 0xfeedfeed Java KeyStore +!:mime application/x-java-keystore +0 belong 0xcececece Java JCE KeyStore +!:mime application/x-java-jce-keystore + +# Dalvik .dex format. http://retrodev.com/android/dexformat.html +# From <mkf@google.com> "Mike Fleming" +0 string dex\n +>0 regex dex\n[0-9][0-9][0-9]\0 Dalvik dex file +>4 string >000 version %s +0 string dey\n +>0 regex dey\n[0-9][0-9][0-9]\0 Dalvik dex file (optimized for host) +>4 string >000 version %s + +# Java source +0 regex ^import.*;$ Java source +!:mime text/x-java + +# http://android.stackexchange.com/questions/23357/\ +# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\ +# 23608#23608 +0 string ANDROID\040BACKUP\n Android Backup +>15 string 1\n \b, version 1 +>17 string 0\n \b, uncompressed +>17 string 1\n \b, compressed +>19 string none\n \b, unencrypted +>19 string AES-256\n \b, encrypted AES-256 diff --git a/magic/Magdir/javascript b/magic/Magdir/javascript new file mode 100644 index 0000000..8f66453 --- /dev/null +++ b/magic/Magdir/javascript @@ -0,0 +1,17 @@ + +#------------------------------------------------------------------------------ +# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $ +# javascript: magic for javascript and node.js scripts. +# +0 search/1/w #!/bin/node Node.js script text executable +!:mime application/javascript +0 search/1/w #!/usr/bin/node Node.js script text executable +!:mime application/javascript +0 search/1/w #!/bin/nodejs Node.js script text executable +!:mime application/javascript +0 search/1/w #!/usr/bin/nodejs Node.js script text executable +!:mime application/javascript +0 search/1 #!/usr/bin/env\ node Node.js script text executable +!:mime application/javascript +0 search/1 #!/usr/bin/env\ nodejs Node.js script text executable +!:mime application/javascript diff --git a/magic/Magdir/jpeg b/magic/Magdir/jpeg new file mode 100644 index 0000000..bc8b342 --- /dev/null +++ b/magic/Magdir/jpeg @@ -0,0 +1,174 @@ + +#------------------------------------------------------------------------------ +# $File: jpeg,v 1.19 2013/02/04 15:50:03 christos Exp $ +# JPEG images +# SunOS 5.5.1 had +# +# 0 string \377\330\377\340 JPEG file +# 0 string \377\330\377\356 JPG file +# +# both of which turn into "JPEG image data" here. +# +0 beshort 0xffd8 JPEG image data +!:mime image/jpeg +!:apple 8BIMJPEG +!:strength +2 +>6 string JFIF \b, JFIF standard +# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 +# in a vain attempt to add image size reporting for JFIF. Note that these +# tests are not fool-proof since some perfectly valid JPEGs are currently +# impossible to specify in magic(4) format. +# First, a little JFIF version info: +>>11 byte x \b %d. +>>12 byte x \b%02d +# Next, the resolution or aspect ratio of the image: +#>>13 byte 0 \b, aspect ratio +#>>13 byte 1 \b, resolution (DPI) +#>>13 byte 2 \b, resolution (DPCM) +#>>4 beshort x \b, segment length %d +# Next, show thumbnail info, if it exists: +>>18 byte !0 \b, thumbnail %dx +>>>19 byte x \b%d + +# EXIF moved down here to avoid reporting a bogus version number, +# and EXIF version number printing added. +# - Patrik R=E5dman <patrik+file-magic@iki.fi> +>6 string Exif \b, EXIF standard +# Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD. +# All possible combinations of entries have to be enumerated, since no looping +# is possible. And both endians are possible... +# The combinations included below are from real-world JPEGs. +# Little-endian +>>12 string II +# IFD 0 Entry #5: +>>>70 leshort 0x8769 +# EXIF IFD Entry #1: +>>>>(78.l+14) leshort 0x9000 +>>>>>(78.l+23) byte x %c +>>>>>(78.l+24) byte x \b.%c +>>>>>(78.l+25) byte !0x30 \b%c +# IFD 0 Entry #9: +>>>118 leshort 0x8769 +# EXIF IFD Entry #3: +>>>>(126.l+38) leshort 0x9000 +>>>>>(126.l+47) byte x %c +>>>>>(126.l+48) byte x \b.%c +>>>>>(126.l+49) byte !0x30 \b%c +# IFD 0 Entry #10 +>>>130 leshort 0x8769 +# EXIF IFD Entry #3: +>>>>(138.l+38) leshort 0x9000 +>>>>>(138.l+47) byte x %c +>>>>>(138.l+48) byte x \b.%c +>>>>>(138.l+49) byte !0x30 \b%c +# EXIF IFD Entry #4: +>>>>(138.l+50) leshort 0x9000 +>>>>>(138.l+59) byte x %c +>>>>>(138.l+60) byte x \b.%c +>>>>>(138.l+61) byte !0x30 \b%c +# EXIF IFD Entry #5: +>>>>(138.l+62) leshort 0x9000 +>>>>>(138.l+71) byte x %c +>>>>>(138.l+72) byte x \b.%c +>>>>>(138.l+73) byte !0x30 \b%c +# IFD 0 Entry #11 +>>>142 leshort 0x8769 +# EXIF IFD Entry #3: +>>>>(150.l+38) leshort 0x9000 +>>>>>(150.l+47) byte x %c +>>>>>(150.l+48) byte x \b.%c +>>>>>(150.l+49) byte !0x30 \b%c +# EXIF IFD Entry #4: +>>>>(150.l+50) leshort 0x9000 +>>>>>(150.l+59) byte x %c +>>>>>(150.l+60) byte x \b.%c +>>>>>(150.l+61) byte !0x30 \b%c +# EXIF IFD Entry #5: +>>>>(150.l+62) leshort 0x9000 +>>>>>(150.l+71) byte x %c +>>>>>(150.l+72) byte x \b.%c +>>>>>(150.l+73) byte !0x30 \b%c +# Big-endian +>>12 string MM +# IFD 0 Entry #9: +>>>118 beshort 0x8769 +# EXIF IFD Entry #1: +>>>>(126.L+14) beshort 0x9000 +>>>>>(126.L+23) byte x %c +>>>>>(126.L+24) byte x \b.%c +>>>>>(126.L+25) byte !0x30 \b%c +# EXIF IFD Entry #3: +>>>>(126.L+38) beshort 0x9000 +>>>>>(126.L+47) byte x %c +>>>>>(126.L+48) byte x \b.%c +>>>>>(126.L+49) byte !0x30 \b%c +# IFD 0 Entry #10 +>>>130 beshort 0x8769 +# EXIF IFD Entry #3: +>>>>(138.L+38) beshort 0x9000 +>>>>>(138.L+47) byte x %c +>>>>>(138.L+48) byte x \b.%c +>>>>>(138.L+49) byte !0x30 \b%c +# EXIF IFD Entry #5: +>>>>(138.L+62) beshort 0x9000 +>>>>>(138.L+71) byte x %c +>>>>>(138.L+72) byte x \b.%c +>>>>>(138.L+73) byte !0x30 \b%c +# IFD 0 Entry #11 +>>>142 beshort 0x8769 +# EXIF IFD Entry #4: +>>>>(150.L+50) beshort 0x9000 +>>>>>(150.L+59) byte x %c +>>>>>(150.L+60) byte x \b.%c +>>>>>(150.L+61) byte !0x30 \b%c +# Here things get sticky. We can do ONE MORE marker segment with +# indirect addressing, and that's all. It would be great if we could +# do pointer arithemetic like in an assembler language. Christos? +# And if there was some sort of looping construct to do searches, plus a few +# named accumulators, it would be even more effective... +# At least we can show a comment if no other segments got inserted before: +>(4.S+5) byte 0xFE \b, comment: +>>(4.S+6) pstring/HJ x "%s" +# Or, we can show the encoding type (I've included only the three most common) +# and image dimensions if we are lucky and the SOFn (image segment) is here: +>(4.S+5) byte 0xC0 \b, baseline +>>(4.S+6) byte x \b, precision %d +>>(4.S+7) beshort x \b, %dx +>>(4.S+9) beshort x \b%d +>(4.S+5) byte 0xC1 \b, extended sequential +>>(4.S+6) byte x \b, precision %d +>>(4.S+7) beshort x \b, %dx +>>(4.S+9) beshort x \b%d +>(4.S+5) byte 0xC2 \b, progressive +>>(4.S+6) byte x \b, precision %d +>>(4.S+7) beshort x \b, %dx +>>(4.S+9) beshort x \b%d +# I've commented-out quantisation table reporting. I doubt anyone cares yet. +#>(4.S+5) byte 0xDB \b, quantisation table +#>>(4.S+6) beshort x \b length=%d +#>14 beshort x \b, %d x +#>16 beshort x \b %d + +# HSI is Handmade Software's proprietary JPEG encoding scheme +0 string hsi1 JPEG image data, HSI proprietary + +# From: David Santinoli <david@santinoli.com> +0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 +# From: Johan van der Knijff <johan.vanderknijff@kb.nl> +# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes +# https://github.com/bitsgalore/jp2kMagic +# +# Now read value of 'Brand' field, which yields a few possibilities: +>20 string \x6a\x70\x32\x20 Part 1 (JP2) +!:mime image/jp2 +>20 string \x6a\x70\x78\x20 Part 2 (JPX) +!:mime image/jpx +>20 string \x6a\x70\x6d\x20 Part 6 (JPM) +!:mime image/jpm +>20 string \x6d\x6a\x70\x32 Part 3 (MJ2) +!:mime video/mj2 + +# Type: JPEG 2000 codesream +# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> +0 belong 0xff4fff51 JPEG 2000 codestream +45 beshort 0xff52 diff --git a/magic/Magdir/karma b/magic/Magdir/karma new file mode 100644 index 0000000..007a4b7 --- /dev/null +++ b/magic/Magdir/karma @@ -0,0 +1,9 @@ + +#------------------------------------------------------------------------------ +# $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $ +# karma: file(1) magic for Karma data files +# +# From <rgooch@atnf.csiro.au> + +0 string KarmaRHD Version Karma Data Structure Version +>16 belong x %lu diff --git a/magic/Magdir/kde b/magic/Magdir/kde new file mode 100644 index 0000000..dda5819 --- /dev/null +++ b/magic/Magdir/kde @@ -0,0 +1,11 @@ + +#------------------------------------------------------------------------------ +# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $ +# kde: file(1) magic for KDE + +0 string/t [KDE\ Desktop\ Entry] KDE desktop entry +!:mime application/x-kdelnk +0 string/t #\ KDE\ Config\ File KDE config file +!:mime application/x-kdelnk +0 string/t #\ xmcd xmcd database file for kscd +!:mime text/x-xmcd diff --git a/magic/Magdir/keepass b/magic/Magdir/keepass new file mode 100644 index 0000000..ba132d5 --- /dev/null +++ b/magic/Magdir/keepass @@ -0,0 +1,20 @@ + +#------------------------------------------------------------------------------ +# $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $ +# keepass: file(1) magic for KeePass file +# +# Keepass Password Safe: +# * original one: http://keepass.info/ +# * *nix port: http://www.keepassx.org/ +# * android port: http://code.google.com/p/keepassdroid/ + +0 lelong 0x9AA2D903 Keepass password database +>4 lelong 0xB54BFB65 1.x KDB +>>48 lelong >0 \b, %d groups +>>52 lelong >0 \b, %d entries +>>8 lelong&0x0f 1 \b, SHA-256 +>>8 lelong&0x0f 2 \b, AES +>>8 lelong&0x0f 4 \b, RC4 +>>8 lelong&0x0f 8 \b, Twofish +>>120 lelong >0 \b, %d key transformation rounds +>4 lelong 0xB54BFB67 2.x KDBX diff --git a/magic/Magdir/kml b/magic/Magdir/kml new file mode 100644 index 0000000..ed0f42e --- /dev/null +++ b/magic/Magdir/kml @@ -0,0 +1,34 @@ + +#------------------------------------------------------------------------------ +# $File: kml,v 1.3 2010/11/25 15:00:12 christos Exp $ +# Type: Google KML, formerly Keyhole Markup Language +# Future development of this format has been handed +# over to the Open Geospatial Consortium. +# http://www.opengeospatial.org/standards/kml/ +# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> +0 string/t \<?xml +>20 search/400 \ xmlns= +>>&0 regex ['"]http://earth.google.com/kml Google KML document +!:mime application/vnd.google-earth.kml+xml +>>>&1 string 2.0' \b, version 2.0 +>>>&1 string 2.1' \b, version 2.1 +>>>&1 string 2.2' \b, version 2.2 + +#------------------------------------------------------------------------------ +# Type: OpenGIS KML, formerly Keyhole Markup Language +# This standard is maintained by the +# Open Geospatial Consortium. +# http://www.opengeospatial.org/standards/kml/ +# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> +>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document +!:mime application/vnd.google-earth.kml+xml +>>>&1 string/t 2.2 \b, version 2.2 + +#------------------------------------------------------------------------------ +# Type: Google KML Archive (ZIP based) +# http://code.google.com/apis/kml/documentation/kml_tut.html +# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> +0 string PK\003\004 +>4 byte 0x14 +>>30 string doc.kml Compressed Google KML Document, including resources. +!:mime application/vnd.google-earth.kmz diff --git a/magic/Magdir/lecter b/magic/Magdir/lecter new file mode 100644 index 0000000..6ae87c1 --- /dev/null +++ b/magic/Magdir/lecter @@ -0,0 +1,6 @@ + +#------------------------------------------------------------------------------ +# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $ +# DEC SRC Virtual Paper: Lectern files +# Karl M. Hegbloom <karlheg@inetarena.com> +0 string lect DEC SRC Virtual Paper Lectern file diff --git a/magic/Magdir/lex b/magic/Magdir/lex new file mode 100644 index 0000000..cc9fac5 --- /dev/null +++ b/magic/Magdir/lex @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $ +# lex: file(1) magic for lex +# +# derived empirically, your offsets may vary! +0 search/100 yyprevious C program text (from lex) +>3 search/1 >\0 for %s +# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> +0 search/100 generated\ by\ flex C program text (from flex) +# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> +0 search/1 %{ lex description text diff --git a/magic/Magdir/lif b/magic/Magdir/lif new file mode 100644 index 0000000..a7a0a8a --- /dev/null +++ b/magic/Magdir/lif @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $ +# lif: file(1) magic for lif +# +# (Daniel Quinlan <quinlan@yggdrasil.com>) +# +0 beshort 0x8000 lif file diff --git a/magic/Magdir/linux b/magic/Magdir/linux new file mode 100644 index 0000000..1b03e25 --- /dev/null +++ b/magic/Magdir/linux @@ -0,0 +1,346 @@ + +#------------------------------------------------------------------------------ +# $File: linux,v 1.47 2013/02/06 14:18:52 christos Exp $ +# linux: file(1) magic for Linux files +# +# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> +# The following basic Linux magic is useful for reference, but using +# "long" magic is a better practice in order to avoid collisions. +# +# 2 leshort 100 Linux/i386 +# >0 leshort 0407 impure executable (OMAGIC) +# >0 leshort 0410 pure executable (NMAGIC) +# >0 leshort 0413 demand-paged executable (ZMAGIC) +# >0 leshort 0314 demand-paged executable (QMAGIC) +# +0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) +>16 lelong 0 \b, stripped +0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) +>16 lelong 0 \b, stripped +0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) +>16 lelong 0 \b, stripped +0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) +>16 lelong 0 \b, stripped +# +0 string \007\001\000 Linux/i386 object file +>20 lelong >0x1020 \b, DLL library +# Linux-8086 stuff: +0 string \01\03\020\04 Linux-8086 impure executable +>28 long !0 not stripped +0 string \01\03\040\04 Linux-8086 executable +>28 long !0 not stripped +# +0 string \243\206\001\0 Linux-8086 object file +# +0 string \01\03\020\20 Minix-386 impure executable +>28 long !0 not stripped +0 string \01\03\040\20 Minix-386 executable +>28 long !0 not stripped +0 string \01\03\04\20 Minix-386 NSYM/GNU executable +>28 long !0 not stripped +# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> +216 lelong 0421 Linux/i386 core file +>220 string >\0 of '%s' +>200 lelong >0 (signal %d) +# +# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> +# this can be overridden by the DOS executable (COM) entry +2 string LILO Linux/i386 LILO boot/chain loader +# +# Linux make config build file, from Ole Aamot <oka@oka.no> +28 string make\ config Linux make config build file +# +# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> +# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> +# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html +0 leshort 0x0436 Linux/i386 PC Screen Font v1 data, +>2 byte&0x01 0 256 characters, +>2 byte&0x01 !0 512 characters, +>2 byte&0x02 0 no directory, +>2 byte&0x02 !0 Unicode directory, +>3 byte >0 8x%d +0 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data, +>16 lelong x %d characters, +>12 lelong&0x01 0 no directory, +>12 lelong&0x01 !0 Unicode directory, +>24 lelong x %d +>28 lelong x \bx%d + +# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> +4086 string SWAP-SPACE Linux/i386 swap file +# From: Jeff Bailey <jbailey@ubuntu.com> +# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> +4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image +# From: James Hunt <james.hunt@ubuntu.com> +4076 string SWAPSPACE2LINHIB0001 Linux/i386 swap file (new style) (compressed hibernate) +# according to man page of mkswap (8) March 1999 +# volume label and UUID Russell Coker +# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ +4086 string SWAPSPACE2 Linux/i386 swap file (new style), +>0x400 long x version %d (4K pages), +>0x404 long x size %d pages, +>1052 string \0 no label, +>1052 string >\0 LABEL=%s, +>0x40c belong x UUID=%08x +>0x410 beshort x \b-%04x +>0x412 beshort x \b-%04x +>0x414 beshort x \b-%04x +>0x416 belong x \b-%08x +>0x41a beshort x \b%04x +# From Daniel Novotny <dnovotny@redhat.com> +# swap file for PowerPC +65526 string SWAPSPACE2 Linux/ppc swap file +16374 string SWAPSPACE2 Linux/ia64 swap file +# +# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> +# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> +# and Nicolas Lichtmaier <nick@debian.org> +# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 +# Linux kernel boot images (i386 arch) (Wolfram Kleff) +514 string HdrS Linux kernel +!:strength + 5 +>510 leshort 0xAA55 x86 boot executable +>>518 leshort >0x1ff +>>>529 byte 0 zImage, +>>>529 byte 1 bzImage, +>>>(526.s+0x200) string >\0 version %s, +>>498 leshort 1 RO-rootFS, +>>498 leshort 0 RW-rootFS, +>>508 leshort >0 root_dev 0x%X, +>>502 leshort >0 swap_dev 0x%X, +>>504 leshort >0 RAMdisksize %u KB, +>>506 leshort 0xFFFF Normal VGA +>>506 leshort 0xFFFE Extended VGA +>>506 leshort 0xFFFD Prompt for Videomode +>>506 leshort >0 Video mode %d +# This also matches new kernels, which were caught above by "HdrS". +0 belong 0xb8c0078e Linux kernel +>0x1e3 string Loading version 1.3.79 or older +>0x1e9 string Loading from prehistoric times + +# System.map files - Nicolas Lichtmaier <nick@debian.org> +8 search/1 \ A\ _text Linux kernel symbol map text + +# LSM entries - Nicolas Lichtmaier <nick@debian.org> +0 search/1 Begin3 Linux Software Map entry text +0 search/1 Begin4 Linux Software Map entry text (new format) + +# From Matt Zimmerman, enhanced for v3 by Matthew Palmer +0 belong 0x4f4f4f4d User-mode Linux COW file +>4 belong <3 \b, version %d +>>8 string >\0 \b, backing file %s +>4 belong >2 \b, version %d +>>32 string >\0 \b, backing file %s + +############################################################################ +# Linux kernel versions + +0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux +>497 leshort 0 x86 boot sector +>>514 belong 0x8e of a kernel from the dawn of time! +>>514 belong 0x908ed8b4 version 0.99-1.1.42 +>>514 belong 0x908ed8b8 for memtest86 + +>497 leshort !0 x86 kernel +>>504 leshort >0 RAMdisksize=%u KB +>>502 leshort >0 swap=0x%X +>>508 leshort >0 root=0x%X +>>>498 leshort 1 \b-ro +>>>498 leshort 0 \b-rw +>>506 leshort 0xFFFF vga=normal +>>506 leshort 0xFFFE vga=extended +>>506 leshort 0xFFFD vga=ask +>>506 leshort >0 vga=%d +>>514 belong 0x908ed881 version 1.1.43-1.1.45 +>>514 belong 0x15b281cd +>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 +>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 +>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 +>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 +>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 +>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 +>>514 string HdrS +>>>518 leshort >0x1FF +>>>>529 byte 0 \b, zImage +>>>>529 byte 1 \b, bzImage +>>>>(526.s+0x200) string >\0 \b, version %s + +# Linux boot sector thefts. +0 belong 0xb8c0078e Linux +>0x1e6 belong 0x454c4b53 ELKS Kernel +>0x1e6 belong !0x454c4b53 style boot sector + +############################################################################ +# Linux S390 kernel image +# Created by: Jan Kaluza <jkaluza@redhat.com> +8 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 +>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc +# 64bit +>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel +>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel +>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel +>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel +# 32bit +>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel +>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel +>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel +>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel + +# Linux ARM compressed kernel image +# From: Kevin Cernekee <cernekee@gmail.com> +36 lelong 0x016f2818 Linux kernel ARM boot executable zImage (little-endian) +36 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian) + +############################################################################ +# Linux 8086 executable +0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless +>5 string . +>>4 string >\0 \b, libc version %s + +0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable +>2 byte&0x01 !0 \b, unmapped zero page +>2 byte&0x20 0 \b, impure +>2 byte&0x20 !0 +>>2 byte&0x10 !0 \b, A_EXEC +>2 byte&0x02 !0 \b, A_PAL +>2 byte&0x04 !0 \b, A_NSYM +>2 byte&0x08 !0 \b, A_STAND +>2 byte&0x40 !0 \b, A_PURE +>2 byte&0x80 !0 \b, A_TOVLY +>28 long !0 \b, not stripped +>37 string . +>>36 string >\0 \b, libc version %s + +# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable +# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable +# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable +# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable + +# SYSLINUX boot logo files (from 'ppmtolss16' sources) +# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename: +# file extension .lss .16 +0 lelong =0x1413f33d SYSLINUX' LSS16 image data +# syslinux-4.05/mime/image/x-lss16.xml +!:mime image/x-lss16 +>4 leshort x \b, width %d +>6 leshort x \b, height %d + +0 string OOOM User-Mode-Linux's Copy-On-Write disk image +>4 belong x version %d + +# SE Linux policy database +# From: Mike Frysinger <vapier@gentoo.org> +0 lelong 0xf97cff8c SE Linux policy +>16 lelong x v%d +>20 lelong 1 MLS +>24 lelong x %d symbols +>28 lelong x %d ocons + +# Linux Logical Volume Manager (LVM) +# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> +# +# System ID, UUID and volume group name are 128 bytes long +# but they should never be full and initialized with zeros... +# +# LVM1 +# +0x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 +>0x12c string >\0 , System ID: %s + +0x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 +>0x12c string >\0 , System ID: %s + +# LVM2 +# +# It seems that the label header can be in one the four first sector +# of the disk... (from _find_labeller in lib/label/label.c of LVM2) +# +# 0x200 seems to be the common case + +0x218 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) +# read the offset to add to the start of the header, and the header +# start in 0x200 +>&(&-12.l-0x21) byte x +# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) +>>&0x0 string >\x2f \b, UUID: %.6s +>>&0x6 string >\x2f \b-%.4s +>>&0xa string >\x2f \b-%.4s +>>&0xe string >\x2f \b-%.4s +>>&0x12 string >\x2f \b-%.4s +>>&0x16 string >\x2f \b-%.4s +>>&0x1a string >\x2f \b-%.6s +>>&0x20 lequad x \b, size: %lld + +0x018 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) +>&(&-12.l-0x21) byte x +# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) +>>&0x0 string >\x2f \b, UUID: %.6s +>>&0x6 string >\x2f \b-%.4s +>>&0xa string >\x2f \b-%.4s +>>&0xe string >\x2f \b-%.4s +>>&0x12 string >\x2f \b-%.4s +>>&0x16 string >\x2f \b-%.4s +>>&0x1a string >\x2f \b-%.6s +>>&0x20 lequad x \b, size: %lld + +0x418 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) +>&(&-12.l-0x21) byte x +# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) +>>&0x0 string >\x2f \b, UUID: %.6s +>>&0x6 string >\x2f \b-%.4s +>>&0xa string >\x2f \b-%.4s +>>&0xe string >\x2f \b-%.4s +>>&0x12 string >\x2f \b-%.4s +>>&0x16 string >\x2f \b-%.4s +>>&0x1a string >\x2f \b-%.6s +>>&0x20 lequad x \b, size: %lld + +0x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) +>&(&-12.l-0x21) byte x +# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) +>>&0x0 string >\x2f \b, UUID: %.6s +>>&0x6 string >\x2f \b-%.4s +>>&0xa string >\x2f \b-%.4s +>>&0xe string >\x2f \b-%.4s +>>&0x12 string >\x2f \b-%.4s +>>&0x16 string >\x2f \b-%.4s +>>&0x1a string >\x2f \b-%.6s +>>&0x20 lequad x \b, size: %lld + +# LVM snapshot +# from Jason Farrel +0 string SnAp LVM Snapshot (CopyOnWrite store) +>4 lelong !0 - valid, +>4 lelong 0 - invalid, +>8 lelong x version %d, +>12 lelong x chunk_size %d + +# SE Linux policy database +0 lelong 0xf97cff8c SE Linux policy +>16 lelong x v%d +>20 lelong 1 MLS +>24 lelong x %d symbols +>28 lelong x %d ocons + +# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec +# Anthon van der Neut (anthon@mnt.org) +0 string LUKS\xba\xbe LUKS encrypted file, +>6 beshort x ver %d +>8 string x [%s, +>40 string x %s, +>72 string x %s] +>168 string x UUID: %s + + +# Summary: Xen saved domain file +# Created by: Radek Vokal <rvokal@redhat.com> +0 string LinuxGuestRecord Xen saved domain +>20 search/256 (name +>>&1 string x (name %s) + +# Type: Xen, the virtual machine monitor +# From: Radek Vokal <rvokal@redhat.com> +0 string LinuxGuestRecord Xen saved domain +#>2 regex \(name\ [^)]*\) %s +>20 search/256 (name (name +>>&1 string x %s...) diff --git a/magic/Magdir/lisp b/magic/Magdir/lisp new file mode 100644 index 0000000..1109880 --- /dev/null +++ b/magic/Magdir/lisp @@ -0,0 +1,52 @@ + +#------------------------------------------------------------------------------ +# $File: lisp,v 1.23 2009/09/19 16:28:10 christos Exp $ +# lisp: file(1) magic for lisp programs +# +# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) + +# updated by Joerg Jenderek +# GRR: This lot is too weak +#0 string ;; +# windows INF files often begin with semicolon and use CRLF as line end +# lisp files are mainly created on unix system with LF as line end +#>2 search/4096 !\r Lisp/Scheme program text +#>2 search/4096 \r Windows INF file + +0 search/4096 (setq\ Lisp/Scheme program text +!:mime text/x-lisp +0 search/4096 (defvar\ Lisp/Scheme program text +!:mime text/x-lisp +0 search/4096 (defparam\ Lisp/Scheme program text +!:mime text/x-lisp +0 search/4096 (defun\ Lisp/Scheme program text +!:mime text/x-lisp +0 search/4096 (autoload\ Lisp/Scheme program text +!:mime text/x-lisp +0 search/4096 (custom-set-variables\ Lisp/Scheme program text +!:mime text/x-lisp + +# Emacs 18 - this is always correct, but not very magical. +0 string \012( Emacs v18 byte-compiled Lisp data +!:mime application/x-elc +# Emacs 19+ - ver. recognition added by Ian Springer +# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs +# - Chris Chittleborough <cchittleborough@yahoo.com.au> +0 string ;ELC +>4 byte >18 +>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data +!:mime application/x-elc + +# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> +0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) +0 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text + +0 long 0x70768BD2 CLISP memory image data +0 long 0xD28B7670 CLISP memory image data, other endian + +#.com and .bin for MIT scheme +0 string \372\372\372\372 MIT scheme (library?) + +# From: David Allouche <david@allouche.net> +0 search/1 \<TeXmacs| TeXmacs document text +!:mime text/texmacs diff --git a/magic/Magdir/llvm b/magic/Magdir/llvm new file mode 100644 index 0000000..1f15eac --- /dev/null +++ b/magic/Magdir/llvm @@ -0,0 +1,21 @@ + +#------------------------------------------------------------------------------ +# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $ +# llvm: file(1) magic for LLVM byte-codes +# URL: http://llvm.org/docs/BitCodeFormat.html +# From: Al Stone <ahs3@fc.hp.com> + +0 string llvm LLVM byte-codes, uncompressed +0 string llvc0 LLVM byte-codes, null compression +0 string llvc1 LLVM byte-codes, gzip compression +0 string llvc2 LLVM byte-codes, bzip2 compression + +0 lelong 0x0b17c0de LLVM bitcode, wrapper +# Are these Mach-O ABI values? They appear to be. +>16 lelong 0x01000007 x86_64 +>16 lelong 0x00000007 i386 +>16 lelong 0x00000012 ppc +>16 lelong 0x01000012 ppc64 +>16 lelong 0x0000000c arm + +0 string BC\xc0\xde LLVM IR bitcode diff --git a/magic/Magdir/lua b/magic/Magdir/lua new file mode 100644 index 0000000..4c578be --- /dev/null +++ b/magic/Magdir/lua @@ -0,0 +1,22 @@ + +#------------------------------------------------------------------------------ +# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $ +# lua: file(1) magic for Lua scripting language +# URL: http://www.lua.org/ +# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> + +# Lua scripts +0 search/1/w #!\ /usr/bin/lua Lua script text executable +!:mime text/x-lua +0 search/1/w #!\ /usr/local/bin/lua Lua script text executable +!:mime text/x-lua +0 search/1 #!/usr/bin/env\ lua Lua script text executable +!:mime text/x-lua +0 search/1 #!\ /usr/bin/env\ lua Lua script text executable +!:mime text/x-lua + +# Lua bytecode +0 string \033Lua Lua bytecode, +>4 byte 0x50 version 5.0 +>4 byte 0x51 version 5.1 +>4 byte 0x52 version 5.2 diff --git a/magic/Magdir/luks b/magic/Magdir/luks new file mode 100644 index 0000000..6ecc40a --- /dev/null +++ b/magic/Magdir/luks @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $ +# luks: file(1) magic for Linux Unified Key Setup +# URL: http://luks.endorphin.org/spec +# From: Anthon van der Neut <anthon@mnt.org> + +0 string LUKS\xba\xbe LUKS encrypted file, +>6 beshort x ver %d +>8 string x [%s, +>40 string x %s, +>72 string x %s] +>168 string x UUID: %s diff --git a/magic/Magdir/m4 b/magic/Magdir/m4 new file mode 100644 index 0000000..f6b5e52 --- /dev/null +++ b/magic/Magdir/m4 @@ -0,0 +1,6 @@ +#------------------------------------------------------------------------------ +# $File: m4,v 1.1 2011/12/08 12:12:46 rrt Exp $ +# make: file(1) magic for M4 scripts +# +0 regex \^dnl\ M4 macro processor script text +!:mime text/x-m4 diff --git a/magic/Magdir/mach b/magic/Magdir/mach new file mode 100644 index 0000000..a9128a1 --- /dev/null +++ b/magic/Magdir/mach @@ -0,0 +1,208 @@ + +#------------------------------------------------------------ +# $File: mach,v 1.14 2013/01/04 23:35:53 christos Exp $ +# Mach has two magic numbers, 0xcafebabe and 0xfeedface. +# Unfortunately the first, cafebabe, is shared with +# Java ByteCode, so they are both handled in the file "cafebabe". +# The "feedface" ones are handled herein. +#------------------------------------------------------------ + +0 name mach-o-be +>0 byte 0xcf 64-bit +# if set, it's for the 64-bit version of the architecture +# yes, this is separate from the low-order magic number bit +# it's also separate from the "64-bit libraries" bit in the +# upper 8 bits of the CPU subtype +>4 belong&0x01000000 0 +# +# 32-bit ABIs. +# +# 1 vax +>>4 belong&0x00ffffff 1 +>>>8 belong&0x00ffffff 0 vax +>>>8 belong&0x00ffffff 1 vax11/780 +>>>8 belong&0x00ffffff 2 vax11/785 +>>>8 belong&0x00ffffff 3 vax11/750 +>>>8 belong&0x00ffffff 4 vax11/730 +>>>8 belong&0x00ffffff 5 uvaxI +>>>8 belong&0x00ffffff 6 uvaxII +>>>8 belong&0x00ffffff 7 vax8200 +>>>8 belong&0x00ffffff 8 vax8500 +>>>8 belong&0x00ffffff 9 vax8600 +>>>8 belong&0x00ffffff 10 vax8650 +>>>8 belong&0x00ffffff 11 vax8800 +>>>8 belong&0x00ffffff 12 uvaxIII +>>>8 belong&0x00ffffff >12 vax subarchitecture=%ld +>>4 belong&0x00ffffff 2 romp +>>4 belong&0x00ffffff 3 architecture=3 +>>4 belong&0x00ffffff 4 ns32032 +>>4 belong&0x00ffffff 5 ns32332 +>>4 belong&0x00ffffff 6 m68k +# 7 x86 +>>4 belong&0x00ffffff 7 +>>>8 belong&0x0000000f 3 i386 +>>>8 belong&0x0000000f 4 i486 +>>>>8 belong&0x00fffff0 0 +>>>>8 belong&0x00fffff0 0x80 \bsx +>>>8 belong&0x0000000f 5 i586 +>>>8 belong&0x0000000f 6 +>>>>8 belong&0x00fffff0 0 p6 +>>>>8 belong&0x00fffff0 0x10 pentium_pro +>>>>8 belong&0x00fffff0 0x20 pentium_2_m0x20 +>>>>8 belong&0x00fffff0 0x30 pentium_2_m3 +>>>>8 belong&0x00fffff0 0x40 pentium_2_m0x40 +>>>>8 belong&0x00fffff0 0x50 pentium_2_m5 +>>>>8 belong&0x00fffff0 >0x50 pentium_2_m0x%lx +>>>8 belong&0x0000000f 7 celeron +>>>>8 belong&0x00fffff0 0x00 \b_m0x%lx +>>>>8 belong&0x00fffff0 0x10 \b_m0x%lx +>>>>8 belong&0x00fffff0 0x20 \b_m0x%lx +>>>>8 belong&0x00fffff0 0x30 \b_m0x%lx +>>>>8 belong&0x00fffff0 0x40 \b_m0x%lx +>>>>8 belong&0x00fffff0 0x50 \b_m0x%lx +>>>>8 belong&0x00fffff0 0x60 +>>>>8 belong&0x00fffff0 0x70 \b_mobile +>>>>8 belong&0x00fffff0 >0x70 \b_m0x%lx +>>>8 belong&0x0000000f 8 pentium_3 +>>>>8 belong&0x00fffff0 0x00 +>>>>8 belong&0x00fffff0 0x10 \b_m +>>>>8 belong&0x00fffff0 0x20 \b_xeon +>>>>8 belong&0x00fffff0 >0x20 \b_m0x%lx +>>>8 belong&0x0000000f 9 pentiumM +>>>>8 belong&0x00fffff0 0x00 +>>>>8 belong&0x00fffff0 >0x00 \b_m0x%lx +>>>8 belong&0x0000000f 10 pentium_4 +>>>>8 belong&0x00fffff0 0x00 +>>>>8 belong&0x00fffff0 0x10 \b_m +>>>>8 belong&0x00fffff0 >0x10 \b_m0x%lx +>>>8 belong&0x0000000f 11 itanium +>>>>8 belong&0x00fffff0 0x00 +>>>>8 belong&0x00fffff0 0x10 \b_2 +>>>>8 belong&0x00fffff0 >0x10 \b_m0x%lx +>>>8 belong&0x0000000f 12 xeon +>>>>8 belong&0x00fffff0 0x00 +>>>>8 belong&0x00fffff0 0x10 \b_mp +>>>>8 belong&0x00fffff0 >0x10 \b_m0x%lx +>>>8 belong&0x0000000f >12 ia32 family=%ld +>>>>8 belong&0x00fffff0 0x00 +>>>>8 belong&0x00fffff0 >0x00 model=%lx +>>4 belong&0x00ffffff 8 mips +>>>8 belong&0x00ffffff 1 R2300 +>>>8 belong&0x00ffffff 2 R2600 +>>>8 belong&0x00ffffff 3 R2800 +>>>8 belong&0x00ffffff 4 R2000a +>>>8 belong&0x00ffffff 5 R2000 +>>>8 belong&0x00ffffff 6 R3000a +>>>8 belong&0x00ffffff 7 R3000 +>>>8 belong&0x00ffffff >7 subarchitecture=%ld +>>4 belong&0x00ffffff 9 ns32532 +>>4 belong&0x00ffffff 10 mc98000 +>>4 belong&0x00ffffff 11 hppa +>>>8 belong&0x00ffffff 0 7100 +>>>8 belong&0x00ffffff 1 7100LC +>>>8 belong&0x00ffffff >1 subarchitecture=%ld +>>4 belong&0x00ffffff 12 arm +>>>8 belong&0x00ffffff 0 +>>>8 belong&0x00ffffff 1 subarchitecture=%ld +>>>8 belong&0x00ffffff 2 subarchitecture=%ld +>>>8 belong&0x00ffffff 3 subarchitecture=%ld +>>>8 belong&0x00ffffff 4 subarchitecture=%ld +>>>8 belong&0x00ffffff 5 \b_v4t +>>>8 belong&0x00ffffff 6 \b_v6 +>>>8 belong&0x00ffffff 7 \b_v5tej +>>>8 belong&0x00ffffff 8 \b_xscale +>>>8 belong&0x00ffffff 9 \b_v7 +>>>8 belong&0x00ffffff 10 \b_v7f +>>>8 belong&0x00ffffff 11 subarchitecture=%ld +>>>8 belong&0x00ffffff 12 \b_v7k +>>>8 belong&0x00ffffff >12 subarchitecture=%ld +# 13 m88k +>>4 belong&0x00ffffff 13 +>>>8 belong&0x00ffffff 0 mc88000 +>>>8 belong&0x00ffffff 1 mc88100 +>>>8 belong&0x00ffffff 2 mc88110 +>>>8 belong&0x00ffffff >2 mc88000 subarchitecture=%ld +>>4 belong&0x00ffffff 14 sparc +>>4 belong&0x00ffffff 15 i860g +>>4 belong&0x00ffffff 16 alpha +>>4 belong&0x00ffffff 17 rs6000 +>>4 belong&0x00ffffff 18 ppc +>>>8 belong&0x00ffffff 0 +>>>8 belong&0x00ffffff 1 \b_601 +>>>8 belong&0x00ffffff 2 \b_602 +>>>8 belong&0x00ffffff 3 \b_603 +>>>8 belong&0x00ffffff 4 \b_603e +>>>8 belong&0x00ffffff 5 \b_603ev +>>>8 belong&0x00ffffff 6 \b_604 +>>>8 belong&0x00ffffff 7 \b_604e +>>>8 belong&0x00ffffff 8 \b_620 +>>>8 belong&0x00ffffff 9 \b_650 +>>>8 belong&0x00ffffff 10 \b_7400 +>>>8 belong&0x00ffffff 11 \b_7450 +>>>8 belong&0x00ffffff 100 \b_970 +>>>8 belong&0x00ffffff >100 subarchitecture=%ld +>>4 belong&0x00ffffff >18 architecture=%ld +>4 belong&0x01000000 0x01000000 +# +# 64-bit ABIs. +# +>>4 belong&0x00ffffff 0 64-bit architecture=%ld +>>4 belong&0x00ffffff 1 64-bit architecture=%ld +>>4 belong&0x00ffffff 2 64-bit architecture=%ld +>>4 belong&0x00ffffff 3 64-bit architecture=%ld +>>4 belong&0x00ffffff 4 64-bit architecture=%ld +>>4 belong&0x00ffffff 5 64-bit architecture=%ld +>>4 belong&0x00ffffff 6 64-bit architecture=%ld +>>4 belong&0x00ffffff 7 x86_64 +>>>8 belong&0x00ffffff 0 subarchitecture=%ld +>>>8 belong&0x00ffffff 1 subarchitecture=%ld +>>>8 belong&0x00ffffff 2 subarchitecture=%ld +>>>8 belong&0x00ffffff 3 +>>>8 belong&0x00ffffff 4 \b_arch1 +>>>8 belong&0x00ffffff >4 subarchitecture=%ld +>>4 belong&0x00ffffff 8 64-bit architecture=%ld +>>4 belong&0x00ffffff 9 64-bit architecture=%ld +>>4 belong&0x00ffffff 10 64-bit architecture=%ld +>>4 belong&0x00ffffff 11 64-bit architecture=%ld +>>4 belong&0x00ffffff 12 64-bit architecture=%ld +>>4 belong&0x00ffffff 13 64-bit architecture=%ld +>>4 belong&0x00ffffff 14 64-bit architecture=%ld +>>4 belong&0x00ffffff 15 64-bit architecture=%ld +>>4 belong&0x00ffffff 16 64-bit architecture=%ld +>>4 belong&0x00ffffff 17 64-bit architecture=%ld +>>4 belong&0x00ffffff 18 ppc64 +>>>8 belong&0x00ffffff 0 +>>>8 belong&0x00ffffff 1 \b_601 +>>>8 belong&0x00ffffff 2 \b_602 +>>>8 belong&0x00ffffff 3 \b_603 +>>>8 belong&0x00ffffff 4 \b_603e +>>>8 belong&0x00ffffff 5 \b_603ev +>>>8 belong&0x00ffffff 6 \b_604 +>>>8 belong&0x00ffffff 7 \b_604e +>>>8 belong&0x00ffffff 8 \b_620 +>>>8 belong&0x00ffffff 9 \b_650 +>>>8 belong&0x00ffffff 10 \b_7400 +>>>8 belong&0x00ffffff 11 \b_7450 +>>>8 belong&0x00ffffff 100 \b_970 +>>>8 belong&0x00ffffff >100 subarchitecture=%ld +>>4 belong&0x00ffffff >18 64-bit architecture=%ld +>12 belong 1 object +>12 belong 2 executable +>12 belong 3 fixed virtual memory shared library +>12 belong 4 core +>12 belong 5 preload executable +>12 belong 6 dynamically linked shared library +>12 belong 7 dynamic linker +>12 belong 8 bundle +>12 belong 9 dynamically linked shared library stub +>12 belong 10 dSYM companion file +>12 belong 11 kext bundle +>12 belong >11 +>>12 belong x filetype=%ld + +# +0 lelong&0xfffffffe 0xfeedface Mach-O +>0 use \^mach-o-be + +0 belong&0xfffffffe 0xfeedface Mach-O +>0 use mach-o-be diff --git a/magic/Magdir/macintosh b/magic/Magdir/macintosh new file mode 100644 index 0000000..b9933b1 --- /dev/null +++ b/magic/Magdir/macintosh @@ -0,0 +1,390 @@ + +#------------------------------------------------------------------------------ +# $File: macintosh,v 1.22 2011/05/17 17:40:31 rrt Exp $ +# macintosh description +# +# BinHex is the Macintosh ASCII-encoded file format (see also "apple") +# Daniel Quinlan, quinlan@yggdrasil.com +11 string must\ be\ converted\ with\ BinHex BinHex binary text +!:mime application/mac-binhex40 +>41 string x \b, version %.3s + +# Stuffit archives are the de facto standard of compression for Macintosh +# files obtained from most archives. (franklsm@tuns.ca) +0 string SIT! StuffIt Archive (data) +!:mime application/x-stuffit +!:apple SIT!SIT! +>2 string x : %s +0 string SITD StuffIt Deluxe (data) +>2 string x : %s +0 string Seg StuffIt Deluxe Segment (data) +>2 string x : %s + +# Newer StuffIt archives (grant@netbsd.org) +0 string StuffIt StuffIt Archive +!:mime application/x-stuffit +!:apple SIT!SIT! +#>162 string >0 : %s + +# Macintosh Applications and Installation binaries (franklsm@tuns.ca) +# GRR: Too weak +#0 string APPL Macintosh Application (data) +#>2 string x \b: %s + +# Macintosh System files (franklsm@tuns.ca) +# GRR: Too weak +#0 string zsys Macintosh System File (data) +#0 string FNDR Macintosh Finder (data) +#0 string libr Macintosh Library (data) +#>2 string x : %s +#0 string shlb Macintosh Shared Library (data) +#>2 string x : %s +#0 string cdev Macintosh Control Panel (data) +#>2 string x : %s +#0 string INIT Macintosh Extension (data) +#>2 string x : %s +#0 string FFIL Macintosh Truetype Font (data) +#>2 string x : %s +#0 string LWFN Macintosh Postscript Font (data) +#>2 string x : %s + +# Additional Macintosh Files (franklsm@tuns.ca) +# GRR: Too weak +#0 string PACT Macintosh Compact Pro Archive (data) +#>2 string x : %s +#0 string ttro Macintosh TeachText File (data) +#>2 string x : %s +#0 string TEXT Macintosh TeachText File (data) +#>2 string x : %s +#0 string PDF Macintosh PDF File (data) +#>2 string x : %s + +# MacBinary format (Eric Fischer, enf@pobox.com) +# +# Unfortunately MacBinary doesn't really have a magic number prior +# to the MacBinary III format. The checksum is really the way to +# do it, but the magic file format isn't up to the challenge. +# +# 0 byte 0 +# 1 byte # filename length +# 2 string # filename +# 65 string # file type +# 69 string # file creator +# 73 byte # Finder flags +# 74 byte 0 +# 75 beshort # vertical posn in window +# 77 beshort # horiz posn in window +# 79 beshort # window or folder ID +# 81 byte # protected? +# 82 byte 0 +# 83 belong # length of data segment +# 87 belong # length of resource segment +# 91 belong # file creation date +# 95 belong # file modification date +# 99 beshort # length of comment after resource +# 101 byte # new Finder flags +# 102 string mBIN # (only in MacBinary III) +# 106 byte # char. code of file name +# 107 byte # still more Finder flags +# 116 belong # total file length +# 120 beshort # length of add'l header +# 122 byte 129 # for MacBinary II +# 122 byte 130 # for MacBinary III +# 123 byte 129 # minimum version that can read fmt +# 124 beshort # checksum +# +# This attempts to use the version numbers as a magic number, requiring +# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second +# be 0x81. This works for the files I have, but maybe not for everyone's. + +# Unfortunately, this magic is quite weak - MPi +#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data + +# MacBinary I doesn't have the version number field at all, but MacBinary II +# has been in use since 1987 so I hope there aren't many really old files +# floating around that this will miss. The original spec calls for using +# the nulls in 0, 74, and 82 as the magic number. +# +# Another possibility, that would also work for MacBinary I, is to use +# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will +# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, +# and that 74 will be 0. So something like +# +# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data +# +# >73 byte&0x01 0x01 \b, inited +# >73 byte&0x02 0x02 \b, changed +# >73 byte&0x04 0x04 \b, busy +# >73 byte&0x08 0x08 \b, bozo +# >73 byte&0x10 0x10 \b, system +# >73 byte&0x10 0x20 \b, bundle +# >73 byte&0x10 0x40 \b, invisible +# >73 byte&0x10 0x80 \b, locked + +#>65 string x \b, type "%4.4s" + +#>65 string 8BIM (PhotoShop) +#>65 string ALB3 (PageMaker 3) +#>65 string ALB4 (PageMaker 4) +#>65 string ALT3 (PageMaker 3) +#>65 string APPL (application) +#>65 string AWWP (AppleWorks word processor) +#>65 string CIRC (simulated circuit) +#>65 string DRWG (MacDraw) +#>65 string EPSF (Encapsulated PostScript) +#>65 string FFIL (font suitcase) +#>65 string FKEY (function key) +#>65 string FNDR (Macintosh Finder) +#>65 string GIFf (GIF image) +#>65 string Gzip (GNU gzip) +#>65 string INIT (system extension) +#>65 string LIB\ (library) +#>65 string LWFN (PostScript font) +#>65 string MSBC (Microsoft BASIC) +#>65 string PACT (Compact Pro archive) +#>65 string PDF\ (Portable Document Format) +#>65 string PICT (picture) +#>65 string PNTG (MacPaint picture) +#>65 string PREF (preferences) +#>65 string PROJ (Think C project) +#>65 string QPRJ (Think Pascal project) +#>65 string SCFL (Defender scores) +#>65 string SCRN (startup screen) +#>65 string SITD (StuffIt Deluxe) +#>65 string SPn3 (SuperPaint) +#>65 string STAK (HyperCard stack) +#>65 string Seg\ (StuffIt segment) +#>65 string TARF (Unix tar archive) +#>65 string TEXT (ASCII) +#>65 string TIFF (TIFF image) +#>65 string TOVF (Eudora table of contents) +#>65 string WDBN (Microsoft Word word processor) +#>65 string WORD (MacWrite word processor) +#>65 string XLS\ (Microsoft Excel) +#>65 string ZIVM (compress (.Z)) +#>65 string ZSYS (Pre-System 7 system file) +#>65 string acf3 (Aldus FreeHand) +#>65 string cdev (control panel) +#>65 string dfil (Desk Acessory suitcase) +#>65 string libr (library) +#>65 string nX^d (WriteNow word processor) +#>65 string nX^w (WriteNow dictionary) +#>65 string rsrc (resource) +#>65 string scbk (Scrapbook) +#>65 string shlb (shared library) +#>65 string ttro (SimpleText read-only) +#>65 string zsys (system file) + +#>69 string x \b, creator "%4.4s" + +# Somewhere, Apple has a repository of registered Creator IDs. These are +# just the ones that I happened to have files from and was able to identify. + +#>69 string 8BIM (Adobe Photoshop) +#>69 string ALD3 (PageMaker 3) +#>69 string ALD4 (PageMaker 4) +#>69 string ALFA (Alpha editor) +#>69 string APLS (Apple Scanner) +#>69 string APSC (Apple Scanner) +#>69 string BRKL (Brickles) +#>69 string BTFT (BitFont) +#>69 string CCL2 (Common Lisp 2) +#>69 string CCL\ (Common Lisp) +#>69 string CDmo (The Talking Moose) +#>69 string CPCT (Compact Pro) +#>69 string CSOm (Eudora) +#>69 string DMOV (Font/DA Mover) +#>69 string DSIM (DigSim) +#>69 string EDIT (Macintosh Edit) +#>69 string ERIK (Macintosh Finder) +#>69 string EXTR (self-extracting archive) +#>69 string Gzip (GNU gzip) +#>69 string KAHL (Think C) +#>69 string LWFU (LaserWriter Utility) +#>69 string LZIV (compress) +#>69 string MACA (MacWrite) +#>69 string MACS (Macintosh operating system) +#>69 string MAcK (MacKnowledge terminal emulator) +#>69 string MLND (Defender) +#>69 string MPNT (MacPaint) +#>69 string MSBB (Microsoft BASIC (binary)) +#>69 string MSWD (Microsoft Word) +#>69 string NCSA (NCSA Telnet) +#>69 string PJMM (Think Pascal) +#>69 string PSAL (Hunt the Wumpus) +#>69 string PSI2 (Apple File Exchange) +#>69 string R*ch (BBEdit) +#>69 string RMKR (Resource Maker) +#>69 string RSED (Resource Editor) +#>69 string Rich (BBEdit) +#>69 string SIT! (StuffIt) +#>69 string SPNT (SuperPaint) +#>69 string Unix (NeXT Mac filesystem) +#>69 string VIM! (Vim editor) +#>69 string WILD (HyperCard) +#>69 string XCEL (Microsoft Excel) +#>69 string aCa2 (Fontographer) +#>69 string aca3 (Aldus FreeHand) +#>69 string dosa (Macintosh MS-DOS file system) +#>69 string movr (Font/DA Mover) +#>69 string nX^n (WriteNow) +#>69 string pdos (Apple ProDOS file system) +#>69 string scbk (Scrapbook) +#>69 string ttxt (SimpleText) +#>69 string ufox (Foreign File Access) + +# Just in case... + +102 string mBIN MacBinary III data with surprising version number + +# sas magic from Bruce Foster (bef@nwu.edu) +# +#0 string SAS SAS +#>8 string x %s +0 string SAS SAS +>24 string DATA data file +>24 string CATALOG catalog +>24 string INDEX data file index +>24 string VIEW data view +# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) +# +0x54 string SAS SAS 7+ +>0x9C string DATA data file +>0x9C string CATALOG catalog +>0x9C string INDEX data file index +>0x9C string VIEW data view + +# spss magic for SPSS system and portable files, +# from Bruce Foster (bef@nwu.edu). + +0 long 0xc1e2c3c9 SPSS Portable File +>40 string x %s + +0 string $FL2 SPSS System File +>24 string x %s + +# Macintosh filesystem data +# From "Tom N Harris" <telliamed@mac.com> +# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> +# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these +# entries depend on the data arithmetic added after v.35 +# There's also some Pascal strings in here, ditto... + +# The boot block signature, according to IM:Files, is +# "for HFS volumes, this field always contains the value 0x4C4B." +# But if this is true for MFS or HFS+ volumes, I don't know. +# Alternatively, the boot block is supposed to be zeroed if it's +# unused, so a simply >0 should suffice. + +0x400 beshort 0xD2D7 Macintosh MFS data +>0 beshort 0x4C4B (bootable) +>0x40a beshort &0x8000 (locked) +>0x402 beldate-0x7C25B080 x created: %s, +>0x406 beldate-0x7C25B080 >0 last backup: %s, +>0x414 belong x block size: %d, +>0x412 beshort x number of blocks: %d, +>0x424 pstring x volume name: %s + +# "BD" gives many false positives +#0x400 beshort 0x4244 Macintosh HFS data +#>0 beshort 0x4C4B (bootable) +#>0x40a beshort &0x8000 (locked) +#>0x40a beshort ^0x0100 (mounted) +#>0x40a beshort &0x0200 (spared blocks) +#>0x40a beshort &0x0800 (unclean) +#>0x47C beshort 0x482B (Embedded HFS+ Volume) +#>0x402 beldate-0x7C25B080 x created: %s, +#>0x406 beldate-0x7C25B080 x last modified: %s, +#>0x440 beldate-0x7C25B080 >0 last backup: %s, +#>0x414 belong x block size: %d, +#>0x412 beshort x number of blocks: %d, +#>0x424 pstring x volume name: %s + +0x400 beshort 0x482B Macintosh HFS Extended +>&0 beshort x version %d data +>0 beshort 0x4C4B (bootable) +>0x404 belong ^0x00000100 (mounted) +>&2 belong &0x00000200 (spared blocks) +>&2 belong &0x00000800 (unclean) +>&2 belong &0x00008000 (locked) +>&6 string x last mounted by: '%.4s', +# really, that should be treated as a belong and we print a string +# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" +>&14 beldate-0x7C25B080 x created: %s, +# only the creation date is local time, all other timestamps in HFS+ are UTC. +>&18 bedate-0x7C25B080 x last modified: %s, +>&22 bedate-0x7C25B080 >0 last backup: %s, +>&26 bedate-0x7C25B080 >0 last checked: %s, +>&38 belong x block size: %d, +>&42 belong x number of blocks: %d, +>&46 belong x free blocks: %d + +# I don't think this is really necessary since it doesn't do much and +# anything with a valid driver descriptor will also have a valid +# partition map +#0 beshort 0x4552 Apple Device Driver data +#>&24 beshort =1 \b, MacOS + +# Is that the partition type a cstring or a pstring? Well, IM says "strings +# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a +# cstring. Of course, partitions can contain more than four entries, but +# what're you gonna do? +# GRR: This magic is too weak, it is just "PM" +#0x200 beshort 0x504D Apple Partition data +#>0x2 beshort x (block size: %d): +#>0x230 string x first type: %s, +#>0x210 string x name: %s, +#>0x254 belong x number of blocks: %d, +#>0x400 beshort 0x504D +#>>0x430 string x second type: %s, +#>>0x410 string x name: %s, +#>>0x454 belong x number of blocks: %d, +#>>0x600 beshort 0x504D +#>>>0x630 string x third type: %s, +#>>>0x610 string x name: %s, +#>>>0x654 belong x number of blocks: %d, +#>>0x800 beshort 0x504D +#>>>0x830 string x fourth type: %s, +#>>>0x810 string x name: %s, +#>>>0x854 belong x number of blocks: %d, +#>>>0xa00 beshort 0x504D +#>>>>0xa30 string x fifth type: %s, +#>>>>0xa10 string x name: %s, +#>>>>0xa54 belong x number of blocks: %d +#>>>0xc00 beshort 0x504D +#>>>>0xc30 string x sixth type: %s, +#>>>>0xc10 string x name: %s, +#>>>>0xc54 belong x number of blocks: %d +## AFAIK, only the signature is different +#0x200 beshort 0x5453 Apple Old Partition data +#>0x2 beshort x block size: %d, +#>0x230 string x first type: %s, +#>0x210 string x name: %s, +#>0x254 belong x number of blocks: %d, +#>0x400 beshort 0x504D +#>>0x430 string x second type: %s, +#>>0x410 string x name: %s, +#>>0x454 belong x number of blocks: %d, +#>>0x800 beshort 0x504D +#>>>0x830 string x third type: %s, +#>>>0x810 string x name: %s, +#>>>0x854 belong x number of blocks: %d, +#>>>0xa00 beshort 0x504D +#>>>>0xa30 string x fourth type: %s, +#>>>>0xa10 string x name: %s, +#>>>>0xa54 belong x number of blocks: %d + +# From: Remi Mommsen <mommsen@slac.stanford.edu> +0 string BOMStore Mac OS X bill of materials (BOM) file + +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# URL: http://en.wikipedia.org/wiki/Datafork_TrueType +# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is +# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I +# don't know what they mean. +0 belong 0x100 +>(0x4.L+24) beshort x +>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType +>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' +>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' +>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript diff --git a/magic/Magdir/macos b/magic/Magdir/macos new file mode 100644 index 0000000..0bacc13 --- /dev/null +++ b/magic/Magdir/macos @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $ +# MacOS files +# + +0 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file diff --git a/magic/Magdir/magic b/magic/Magdir/magic new file mode 100644 index 0000000..0de332a --- /dev/null +++ b/magic/Magdir/magic @@ -0,0 +1,10 @@ + +#------------------------------------------------------------------------------ +# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $ +# magic: file(1) magic for magic files +# +0 string/t #\ Magic magic text file for file(1) cmd +0 lelong 0xF11E041C magic binary file for file(1) cmd +>4 lelong x (version %d) (little endian) +0 belong 0xF11E041C magic binary file for file(1) cmd +>4 belong x (version %d) (big endian) diff --git a/magic/Magdir/mail.news b/magic/Magdir/mail.news new file mode 100644 index 0000000..7a8123a --- /dev/null +++ b/magic/Magdir/mail.news @@ -0,0 +1,67 @@ +#------------------------------------------------------------------------------ +# $File: mail.news,v 1.22 2013/01/04 14:22:07 christos Exp $ +# mail.news: file(1) magic for mail and news +# +# Unfortunately, saved netnews also has From line added in some news software. +#0 string From mail text +0 string/t Relay-Version: old news text +!:mime message/rfc822 +0 string/t #!\ rnews batched news text +!:mime message/rfc822 +0 string/t N#!\ rnews mailed, batched news text +!:mime message/rfc822 +0 string/t Forward\ to mail forwarding text +!:mime message/rfc822 +0 string/t Pipe\ to mail piping text +!:mime message/rfc822 +0 string/tc delivered-to: SMTP mail text +!:mime message/rfc822 +0 string/tc return-path: SMTP mail text +!:mime message/rfc822 +0 string/t Path: news text +!:mime message/news +0 string/t Xref: news text +!:mime message/news +0 string/t From: news or mail text +!:mime message/rfc822 +0 string/t Article saved news text +!:mime message/news +0 string/t BABYL Emacs RMAIL text +0 string/t Received: RFC 822 mail text +!:mime message/rfc822 +0 string/t MIME-Version: MIME entity text +#0 string/t Content- MIME entity text + +# TNEF files... +0 lelong 0x223E9F78 Transport Neutral Encapsulation Format +!:mime application/vnd.ms-tnef + +# From: Kevin Sullivan <ksulliva@psc.edu> +0 string *mbx* MBX mail folder + +# From: Simon Matter <simon.matter@invoca.ch> +0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB + +# JAM(mbp) Fidonet message area databases +# JHR file +0 string JAM\0 JAM message area header file +>12 leshort >0 (%d messages) + +# Squish Fidonet message area databases +# SQD file (requires at least one message in the area) +# XXX: Weak magic +#256 leshort 0xAFAE4453 Squish message area data file +#>4 leshort >0 (%d messages) + +#0 string \<!--\ MHonArc text/html; x-type=mhonarc + +# Cyrus: file(1) magic for compiled Cyrus sieve scripts +# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php +# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master +# From: Philipp Hahn <hahn@univention.de> + +# Compiled Cyrus sieve script +0 string CyrSBytecode Cyrus sieve bytecode data, +>12 belong =1 version 1, big-endian +>12 lelong =1 version 1, little-endian +>12 belong x version %d, network-endian diff --git a/magic/Magdir/make b/magic/Magdir/make new file mode 100644 index 0000000..ba7630d --- /dev/null +++ b/magic/Magdir/make @@ -0,0 +1,15 @@ +#------------------------------------------------------------------------------ +# $File: make,v 1.1 2011/12/08 12:12:46 rrt Exp $ +# make: file(1) magic for makefiles +# +0 regex \^CFLAGS makefile script text +!:mime text/x-makefile +0 regex \^LDFLAGS makefile script text +!:mime text/x-makefile +0 regex \^all: makefile script text +!:mime text/x-makefile +0 regex \^.PRECIOUS makefile script text +!:mime text/x-makefile + +0 regex \^SUBDIRS automake makefile script text +!:mime text/x-makefile diff --git a/magic/Magdir/maple b/magic/Magdir/maple new file mode 100644 index 0000000..05a8eaf --- /dev/null +++ b/magic/Magdir/maple @@ -0,0 +1,57 @@ + +#------------------------------------------------------------------------------ +# $File: maple,v 1.7 2013/01/11 16:45:23 christos Exp $ +# maple: file(1) magic for maple files +# "H. Nanosecond" <aldomel@ix.netcom.com> +# Maple V release 4, a multi-purpose math program +# + +# maple library .lib +0 string \000MVR4\nI MapleVr4 library + +# .ind +# no magic for these :-( +# they are compiled indexes for maple files + +# .hdb +0 string \000\004\000\000 Maple help database + +# .mhp +# this has the form <PACKAGE=name> +0 string \<PACKAGE= Maple help file +0 string \<HELP\ NAME= Maple help file +0 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) +#0 string #\ Newton Maple help file, old style +0 string #\ daub Maple help file, old style +#0 string #=========== Maple help file, old style + +# .mws +0 string \000\000\001\044\000\221 Maple worksheet +#this is anomalous +0 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird +# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n +# that is {VERSION major_version miunor_version computer_type version_string} +0 string {VERSION\ Maple worksheet +>9 string >\0 version %.1s. +>>11 string >\0 %.1s + +# .mps +0 string \0\0\001$ Maple something +# from byte 4 it is either 'nul E' or 'soh R' +# I think 'nul E' means a file that was saved as a different name +# a sort of revision marking +# 'soh R' means new +>4 string \000\105 An old revision +>4 string \001\122 The latest save + +# .mpl +# some of these are the same as .mps above +#0000000 000 000 001 044 000 105 same as .mps +#0000000 000 000 001 044 001 122 same as .mps + +0 string #\n##\ <SHAREFILE= Maple something +0 string \n#\n##\ <SHAREFILE= Maple something +0 string ##\ <SHAREFILE= Maple something +0 string #\r##\ <SHAREFILE= Maple something +0 string \r#\r##\ <SHAREFILE= Maple something +0 string #\ \r##\ <DESCRIBE> Maple something anomalous. diff --git a/magic/Magdir/marc21 b/magic/Magdir/marc21 new file mode 100644 index 0000000..83f7959 --- /dev/null +++ b/magic/Magdir/marc21 @@ -0,0 +1,28 @@ +#-------------------------------------------- +# marc21: file(1) magic for MARC 21 Format +# +# Kevin Ford (kefo@loc.gov) +# +# MARC21 formats are for the representation and communication +# of bibliographic and related information in machine-readable +# form. For more info, see http://www.loc.gov/marc/ + + +# leader position 20-21 must be 45 +20 string 45 + +# leader starts with 5 digits, followed by codes specific to MARC format +>0 regex/1 (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic +!:mime application/marc +>0 regex/1 (^[0-9]{5})[acdnosx][z] MARC21 Authority +!:mime application/marc +>0 regex/1 (^[0-9]{5})[cdn][uvxy] MARC21 Holdings +!:mime application/marc +0 regex/1 (^[0-9]{5})[acdn][w] MARC21 Classification +!:mime application/marc +>0 regex/1 (^[0-9]{5})[cdn][q] MARC21 Community +!:mime application/marc + +# leader position 22-23, should be "00" but is it? +>0 regex/1 (^.{21})([^0]{2}) (non-conforming) +!:mime application/marc diff --git a/magic/Magdir/mathcad b/magic/Magdir/mathcad new file mode 100644 index 0000000..b186641 --- /dev/null +++ b/magic/Magdir/mathcad @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $ +# mathcad: file(1) magic for Mathcad documents +# URL: http://www.mathsoft.com/ +# From: Josh Triplett <josh@freedesktop.org> + +0 string .MCAD\t Mathcad document diff --git a/magic/Magdir/mathematica b/magic/Magdir/mathematica new file mode 100644 index 0000000..3c10a57 --- /dev/null +++ b/magic/Magdir/mathematica @@ -0,0 +1,70 @@ + +#------------------------------------------------------------------------------ +# $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $ +# mathematica: file(1) magic for mathematica files +# "H. Nanosecond" <aldomel@ix.netcom.com> +# Mathematica a multi-purpose math program +# versions 2.2 and 3.0 + +#mathematica .mb +0 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook +0 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook + +# .ma +# multiple possibilites: + +0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook +#>41 string >\0 %s + +#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x + +#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x +#>675 string >\0 %s #doesn't work well + +# there may be 'cr' instread of 'nl' in some does this matter? + +# generic: +0 string (*^\r\r::[\011 Mathematica notebook version 2.x +0 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x +0 string (*^\015 Mathematica notebook version 2.x +0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x +0 string (*^\r::[\011 Mathematica notebook version 2.x +0 string (*^\r\n::[\011 Mathematica notebook version 2.x +0 string (*^\n\n::[\011 Mathematica notebook version 2.x +0 string (*^\n::[\011 Mathematica notebook version 2.x + + +# Mathematica .mx files + +#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file +0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file +#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 +# >71... is optional +>88 string >\0 from %s + + +# Mathematica files PBF: +# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 +0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) + +# .ml files These are menu resources I think +# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ +# how to put that into a magic rule? +4 string \ A~ MAthematica .ml file + +# .nb files +#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook +0 string (*********************** Mathematica 3.0 notebook + +# other (* matches it is a comment start in these langs +# GRR: Too weak; also matches other languages e.g. ML +#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text + +######################### +# MatLab v5 +0 string MATLAB Matlab v5 mat-file +>126 short 0x494d (big endian) +>>124 beshort x version 0x%04x +>126 short 0x4d49 (little endian) +>>124 leshort x version 0x%04x + diff --git a/magic/Magdir/matroska b/magic/Magdir/matroska new file mode 100644 index 0000000..0c0e299 --- /dev/null +++ b/magic/Magdir/matroska @@ -0,0 +1,17 @@ + +#------------------------------------------------------------------------------ +# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $ +# matroska: file(1) magic for Matroska files +# +# See http://www.matroska.org/ +# + +# EBML id: +0 belong 0x1a45dfa3 +# DocType id: +>4 search/4096 \x42\x82 +# DocType contents: +>>&1 string webm WebM +!:mime video/webm +>>&1 string matroska Matroska data +!:mime video/x-matroska diff --git a/magic/Magdir/mcrypt b/magic/Magdir/mcrypt new file mode 100644 index 0000000..9c66af4 --- /dev/null +++ b/magic/Magdir/mcrypt @@ -0,0 +1,38 @@ + +#------------------------------------------------------------------------------ +# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $ +# Mavroyanopoulos Nikos <nmav@hellug.gr> +# mcrypt: file(1) magic for mcrypt 2.2.x; +0 string \0m\3 mcrypt 2.5 encrypted data, +>4 string >\0 algorithm: %s, +>>&1 leshort >0 keysize: %d bytes, +>>>&0 string >\0 mode: %s, + +0 string \0m\2 mcrypt 2.2 encrypted data, +>3 byte 0 algorithm: blowfish-448, +>3 byte 1 algorithm: DES, +>3 byte 2 algorithm: 3DES, +>3 byte 3 algorithm: 3-WAY, +>3 byte 4 algorithm: GOST, +>3 byte 6 algorithm: SAFER-SK64, +>3 byte 7 algorithm: SAFER-SK128, +>3 byte 8 algorithm: CAST-128, +>3 byte 9 algorithm: xTEA, +>3 byte 10 algorithm: TWOFISH-128, +>3 byte 11 algorithm: RC2, +>3 byte 12 algorithm: TWOFISH-192, +>3 byte 13 algorithm: TWOFISH-256, +>3 byte 14 algorithm: blowfish-128, +>3 byte 15 algorithm: blowfish-192, +>3 byte 16 algorithm: blowfish-256, +>3 byte 100 algorithm: RC6, +>3 byte 101 algorithm: IDEA, +>4 byte 0 mode: CBC, +>4 byte 1 mode: ECB, +>4 byte 2 mode: CFB, +>4 byte 3 mode: OFB, +>4 byte 4 mode: nOFB, +>5 byte 0 keymode: 8bit +>5 byte 1 keymode: 4bit +>5 byte 2 keymode: SHA-1 hash +>5 byte 3 keymode: MD5 hash diff --git a/magic/Magdir/mercurial b/magic/Magdir/mercurial new file mode 100644 index 0000000..8bc5a54 --- /dev/null +++ b/magic/Magdir/mercurial @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $ +# mercurial: file(1) magic for Mercurial changeset bundles +# http://www.selenic.com/mercurial/wiki/ +# +# Jesse Glick (jesse.glick@sun.com) +# + +0 string HG10 Mercurial changeset bundle +>4 string UN (uncompressed) +>4 string GZ (gzip compressed) +>4 string BZ (bzip2 compressed) diff --git a/magic/Magdir/metastore b/magic/Magdir/metastore new file mode 100644 index 0000000..285c3cf --- /dev/null +++ b/magic/Magdir/metastore @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: metastore,v 1.1 2011/04/06 12:37:44 christos Exp $ +# metastore: file(1) magic for metastore files +# From: Thomas Wissen +# see http://david.hardeman.nu/software.php#metastore +0 string MeTaSt00r3 Metastore data file, +>10 bequad x version %0llx diff --git a/magic/Magdir/mime b/magic/Magdir/mime new file mode 100644 index 0000000..42ca52d --- /dev/null +++ b/magic/Magdir/mime @@ -0,0 +1,9 @@ + +#------------------------------------------------------------------------------ +# $File: mime,v 1.6 2010/11/25 15:00:12 christos Exp $ +# mime: file(1) magic for MIME encoded files +# +0 string/t Content-Type:\ +>14 string >\0 %s +0 string/t Content-Type: +>13 string >\0 %s diff --git a/magic/Magdir/mips b/magic/Magdir/mips new file mode 100644 index 0000000..8ed3567 --- /dev/null +++ b/magic/Magdir/mips @@ -0,0 +1,120 @@ + +#------------------------------------------------------------------------------ +# $File: mips,v 1.9 2013/01/12 03:09:51 christos Exp $ +# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX +# and DEC Ultrix +# +0 beshort 0x0160 MIPSEB ECOFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x \b.%ld +# +0 beshort 0x0162 MIPSEL-BE ECOFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %d +>22 byte x \b.%ld +# +0 beshort 0x6001 MIPSEB-LE ECOFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %d +>22 byte x \b.%ld +# +0 beshort 0x6201 MIPSEL ECOFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>22 byte x \b.%ld +# +# MIPS 2 additions +# +0 beshort 0x0163 MIPSEB MIPS-II ECOFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x \b.%ld +# +0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x \b.%ld +# +0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>22 byte x \b.%ld +# +0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>22 byte x \b.%ld +# +# MIPS 3 additions +# +0 beshort 0x0140 MIPSEB MIPS-III ECOFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x \b.%ld +# +0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x \b.%ld +# +0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>22 byte x \b.%ld +# +0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>22 byte x \b.%ld +# +0 beshort 0x180 MIPSEB Ucode +0 beshort 0x182 MIPSEL-BE Ucode diff --git a/magic/Magdir/mirage b/magic/Magdir/mirage new file mode 100644 index 0000000..cdeb3fc --- /dev/null +++ b/magic/Magdir/mirage @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $ +# mirage: file(1) magic for Mirage executables +# +# XXX - byte order? +# +0 long 31415 Mirage Assembler m.out executable diff --git a/magic/Magdir/misctools b/magic/Magdir/misctools new file mode 100644 index 0000000..06bd7b7 --- /dev/null +++ b/magic/Magdir/misctools @@ -0,0 +1,23 @@ + +#----------------------------------------------------------------------------- +# $File: misctools,v 1.13 2013/01/16 13:53:10 christos Exp $ +# misctools: file(1) magic for miscellaneous UNIX tools. +# +0 search/1 %%!! X-Post-It-Note text +0 string/c BEGIN:VCALENDAR vCalendar calendar file +!:mime text/calendar +0 string/c BEGIN:VCARD vCard visiting card +!:mime text/x-vcard + +# Summary: Libtool library file +# Extension: .la +# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> +0 search/80 .la\ -\ a\ libtool\ library\ file libtool library file + +# Summary: Libtool object file +# Extension: .lo +# Submitted by: Abel Cheung <abelcheung@gmail.com> +0 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file + +# From: Daniel Novotny <dnovotny@redhat.com> +0 string MDMP\x93\xA7 MDMP crash report data diff --git a/magic/Magdir/mkid b/magic/Magdir/mkid new file mode 100644 index 0000000..faad396 --- /dev/null +++ b/magic/Magdir/mkid @@ -0,0 +1,11 @@ + +#------------------------------------------------------------------------------ +# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $ +# mkid: file(1) magic for mkid(1) databases +# +# ID is the binary tags database produced by mkid(1). +# +# XXX - byte order? +# +0 string \311\304 ID tags data +>2 short >0 version %d diff --git a/magic/Magdir/mlssa b/magic/Magdir/mlssa new file mode 100644 index 0000000..3c8875e --- /dev/null +++ b/magic/Magdir/mlssa @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $ +# mlssa: file(1) magic for MLSSA datafiles +# +0 lelong 0xffffabcd MLSSA datafile, +>4 leshort x algorithm %d, +>10 lelong x %d samples diff --git a/magic/Magdir/mmdf b/magic/Magdir/mmdf new file mode 100644 index 0000000..5576a66 --- /dev/null +++ b/magic/Magdir/mmdf @@ -0,0 +1,6 @@ + +#------------------------------------------------------------------------------ +# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $ +# mmdf: file(1) magic for MMDF mail files +# +0 string \001\001\001\001 MMDF mailbox diff --git a/magic/Magdir/modem b/magic/Magdir/modem new file mode 100644 index 0000000..84bdb28 --- /dev/null +++ b/magic/Magdir/modem @@ -0,0 +1,35 @@ + +#------------------------------------------------------------------------------ +# $File: modem,v 1.5 2010/09/20 18:55:20 rrt Exp $ +# modem: file(1) magic for modem programs +# +# From: Florian La Roche <florian@knorke.saar.de> +1 string PC\ Research,\ Inc Digifax-G3-File +>29 byte 1 \b, fine resolution +>29 byte 0 \b, normal resolution + +0 short 0x0100 raw G3 data, byte-padded +0 short 0x1400 raw G3 data +# +# Magic data for vgetty voice formats +# (Martin Seine & Marc Eberhard) + +# +# raw modem data version 1 +# +0 string RMD1 raw modem data +>4 string >\0 (%s / +>20 short >0 compression type 0x%04x) + +# +# portable voice format 1 +# +0 string PVF1\n portable voice format +>5 string >\0 (binary %s) + +# +# portable voice format 2 +# +0 string PVF2\n portable voice format +>5 string >\0 (ascii %s) + diff --git a/magic/Magdir/motorola b/magic/Magdir/motorola new file mode 100644 index 0000000..b56e5e4 --- /dev/null +++ b/magic/Magdir/motorola @@ -0,0 +1,71 @@ + +#------------------------------------------------------------------------------ +# $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $ +# motorola: file(1) magic for Motorola 68K and 88K binaries +# +# 68K +# +0 beshort 0520 mc68k COFF +>18 beshort ^00000020 object +>18 beshort &00000020 executable +>12 belong >0 not stripped +>168 string .lowmem Apple toolbox +>20 beshort 0407 (impure) +>20 beshort 0410 (pure) +>20 beshort 0413 (demand paged) +>20 beshort 0421 (standalone) +0 beshort 0521 mc68k executable (shared) +>12 belong >0 not stripped +0 beshort 0522 mc68k executable (shared demand paged) +>12 belong >0 not stripped +# +# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) +# +0 beshort 0554 68K BCS executable +# +# 88K +# +# Motorola/88Open BCS +# +0 beshort 0555 88K BCS executable +# +# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> +0 string S0 Motorola S-Record; binary data in text format + +# ATARI ST relocatable PRG +# +# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 +# (according to Roland Waldi, Oct 21, 1987) +# besides the magic 0x601a, the text segment size is checked to be +# not larger than 1 MB (which is a lot on ST). +# The additional 0x601b distinction I took from Doug Lee's magic. +0 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable +>2 belong x (txt=%ld, +>6 belong x dat=%ld, +>10 belong x bss=%ld, +>14 belong x sym=%ld) +0 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable +>2 belong x (txt=%ld, +>6 belong x dat=%ld, +>10 belong x bss=%ld, +>14 belong x sym=%ld) + +# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) +0 beshort 0x601A Atari 68xxx executable, +>2 belong x text len %lu, +>6 belong x data len %lu, +>10 belong x BSS len %lu, +>14 belong x symboltab len %lu, +>18 belong 0 +>22 belong &0x01 fastload flag, +>22 belong &0x02 may be loaded to alternate RAM, +>22 belong &0x04 malloc may be from alternate RAM, +>22 belong x flags: 0x%lX, +>26 beshort 0 no relocation tab +>26 beshort !0 + relocation tab +>30 string SFX [Self-Extracting LZH SFX archive] +>38 string SFX [Self-Extracting LZH SFX archive] +>44 string ZIP! [Self-Extracting ZIP SFX archive] + +0 beshort 0x0064 Atari 68xxx CPX file +>8 beshort x (version %04lx) diff --git a/magic/Magdir/mozilla b/magic/Magdir/mozilla new file mode 100644 index 0000000..1f89589 --- /dev/null +++ b/magic/Magdir/mozilla @@ -0,0 +1,9 @@ + +#------------------------------------------------------------------------------ +# $File: mozilla,v 1.4 2009/09/19 16:28:11 christos Exp $ +# mozilla: file(1) magic for Mozilla XUL fastload files +# (XUL.mfasl and XPC.mfasl) +# URL: http://www.mozilla.org/ +# From: Josh Triplett <josh@freedesktop.org> + +0 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data diff --git a/magic/Magdir/msdos b/magic/Magdir/msdos new file mode 100644 index 0000000..1498509 --- /dev/null +++ b/magic/Magdir/msdos @@ -0,0 +1,915 @@ + +#------------------------------------------------------------------------------ +# $File: msdos,v 1.84 2013/02/05 13:55:22 christos Exp $ +# msdos: file(1) magic for MS-DOS files +# + +# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) +# updated by Joerg Jenderek at Oct 2008,Apr 2011 +0 string/t @ +>1 string/cW \ echo\ off DOS batch file text +!:mime text/x-msdos-batch +>1 string/cW echo\ off DOS batch file text +!:mime text/x-msdos-batch +>1 string/cW rem DOS batch file text +!:mime text/x-msdos-batch +>1 string/cW set\ DOS batch file text +!:mime text/x-msdos-batch + + +# OS/2 batch files are REXX. the second regex is a bit generic, oh well +# the matched commands seem to be common in REXX and uncommon elsewhere +100 search/0xffff rxfuncadd +>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text +100 search/0xffff say +>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text + +0 leshort 0x14c MS Windows COFF Intel 80386 object file +#>4 ledate x stamp %s +0 leshort 0x166 MS Windows COFF MIPS R4000 object file +#>4 ledate x stamp %s +0 leshort 0x184 MS Windows COFF Alpha object file +#>4 ledate x stamp %s +0 leshort 0x268 MS Windows COFF Motorola 68000 object file +#>4 ledate x stamp %s +0 leshort 0x1f0 MS Windows COFF PowerPC object file +#>4 ledate x stamp %s +0 leshort 0x290 MS Windows COFF PA-RISC object file +#>4 ledate x stamp %s + +# Tests for various EXE types. +# +# Many of the compressed formats were extraced from IDARC 1.23 source code. +# +0 string/b MZ +!:mime application/x-dosexec +# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. +>0x18 leshort <0x40 MS-DOS executable +# These traditional tests usually work but not always. When test quality support is +# implemented these can be turned on. +#>>0x18 leshort 0x1c (Borland compiler) +#>>0x18 leshort 0x1e (MS compiler) + +# If the relocation table is 0x40 or more bytes into the file, it's definitely +# not a DOS EXE. +>0x18 leshort >0x3f + +# Maybe it's a PE? +>>(0x3c.l) string PE\0\0 PE +>>>(0x3c.l+24) leshort 0x010b \b32 executable +>>>(0x3c.l+24) leshort 0x020b \b32+ executable +>>>(0x3c.l+24) leshort 0x0107 ROM image +>>>(0x3c.l+24) default x Unknown PE signature +>>>>&0 leshort x 0x%x +>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) +>>>(0x3c.l+92) leshort 1 (native) +>>>(0x3c.l+92) leshort 2 (GUI) +>>>(0x3c.l+92) leshort 3 (console) +>>>(0x3c.l+92) leshort 7 (POSIX) +>>>(0x3c.l+92) leshort 9 (Windows CE) +>>>(0x3c.l+92) leshort 10 (EFI application) +>>>(0x3c.l+92) leshort 11 (EFI boot service driver) +>>>(0x3c.l+92) leshort 12 (EFI runtime driver) +>>>(0x3c.l+92) leshort 13 (EFI ROM) +>>>(0x3c.l+92) leshort 14 (XBOX) +>>>(0x3c.l+92) leshort 15 (Windows boot application) +>>>(0x3c.l+92) default x (Unknown subsystem +>>>>&0 leshort x 0x%x) +>>>(0x3c.l+4) leshort 0x14c Intel 80386 +>>>(0x3c.l+4) leshort 0x166 MIPS R4000 +>>>(0x3c.l+4) leshort 0x168 MIPS R10000 +>>>(0x3c.l+4) leshort 0x184 Alpha +>>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 +>>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 +>>>(0x3c.l+4) leshort 0x1c0 ARM +>>>(0x3c.l+4) leshort 0x1c2 ARM Thumb +>>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb +>>>(0x3c.l+4) leshort 0x1f0 PowerPC +>>>(0x3c.l+4) leshort 0x200 Intel Itanium +>>>(0x3c.l+4) leshort 0x266 MIPS16 +>>>(0x3c.l+4) leshort 0x268 Motorola 68000 +>>>(0x3c.l+4) leshort 0x290 PA-RISC +>>>(0x3c.l+4) leshort 0x366 MIPSIV +>>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU +>>>(0x3c.l+4) leshort 0xebc EFI byte code +>>>(0x3c.l+4) leshort 0x8664 x86-64 +>>>(0x3c.l+4) leshort 0xc0ee MSIL +>>>(0x3c.l+4) default x Unknown processor type +>>>>&0 leshort x 0x%x +>>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) +>>>(0x3c.l+22) leshort&0x1000 >0 system file +>>>(0x3c.l+24) leshort 0x010b +>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly +>>>(0x3c.l+24) leshort 0x020b +>>>>(0x3c.l+248) lelong >0 Mono/.Net assembly + +# hooray, there's a DOS extender using the PE format, with a valid PE +# executable inside (which just prints a message and exits if run in win) +>>>(8.s*16) string 32STUB \b, 32rtm DOS extender +>>>(8.s*16) string !32STUB \b, for MS Windows +>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed +>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed +>>>(0x3c.l+0xf8) search/0x140 UPX2 +>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) +>>>(0x3c.l+0xf8) search/0x140 .idata +>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) +>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive +>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive +>>>(0x3c.l+0xf8) search/0x140 .rsrc +>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive +>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive +>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive +>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive +>>>(0x3c.l+0xf8) search/0x140 .data +>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive +>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed +>>>>(0x3c.l+0xf7) byte x +>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive +>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive +>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive +>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) +>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive +>>>0x30 string Inno \b, InnoSetup self-extracting archive + +# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, +# must be one of the unusual subformats. +>>(0x3c.l) string !PE\0\0 MS-DOS executable + +>>(0x3c.l) string NE \b, NE +>>>(0x3c.l+0x36) byte 1 for OS/2 1.x +>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x +>>>(0x3c.l+0x36) byte 3 for MS-DOS +>>>(0x3c.l+0x36) byte 4 for Windows 386 +>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services +>>>(0x3c.l+0x36) default x +>>>>(0x3c.l+0x36) byte x (unknown OS %x) +>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender +>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL) +>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver) +>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive +>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) + +>>(0x3c.l) string LX\0\0 \b, LX +>>>(0x3c.l+0x0a) leshort <1 (unknown OS) +>>>(0x3c.l+0x0a) leshort 1 for OS/2 +>>>(0x3c.l+0x0a) leshort 2 for MS Windows +>>>(0x3c.l+0x0a) leshort 3 for DOS +>>>(0x3c.l+0x0a) leshort >3 (unknown OS) +>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) +>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) +>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) +>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) +>>>(0x3c.l+0x08) leshort 1 i80286 +>>>(0x3c.l+0x08) leshort 2 i80386 +>>>(0x3c.l+0x08) leshort 3 i80486 +>>>(8.s*16) string emx \b, emx +>>>>&1 string x %s +>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive + +# MS Windows system file, supposedly a collection of LE executables +>>(0x3c.l) string W3 \b, W3 for MS Windows + +>>(0x3c.l) string LE\0\0 \b, LE executable +>>>(0x3c.l+0x0a) leshort 1 +# some DOS extenders use LE files with OS/2 header +>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender +>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender +>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender +>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender +>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) +>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) +>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) +# this is a wild guess; hopefully it is a specific signature +>>>>&0x24 lelong <0x50 +>>>>>(&0x4c.l) string \xfc\xb8WATCOM +>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed +# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP +#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 +# fails with DOS-Extenders. +>>>(0x3c.l+0x0a) leshort 2 for MS Windows +>>>(0x3c.l+0x0a) leshort 3 for DOS +>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) +>>>(&0x7c.l+0x26) string UPX \b, UPX compressed +>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive + +# looks like ASCII, probably some embedded copyright message. +# and definitely not NE/LE/LX/PE +>>0x3c lelong >0x20000000 +>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS +# header data too small for extended executable +>2 long !0 +>>0x18 leshort <0x40 +>>>(4.s*512) leshort !0x014c + +>>>>&(2.s-514) string !LE +>>>>>&-2 string !BW \b, MZ for MS-DOS +>>>>&(2.s-514) string LE \b, LE +>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender +# educated guess since indirection is still not capable enough for complex offset +# calculations (next embedded executable would be at &(&2*512+&0-2) +# I suspect there are only LE executables in these multi-exe files +>>>>&(2.s-514) string BW +>>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded) +>>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS + +# This sequence skips to the first COFF segment, usually .text +>(4.s*512) leshort 0x014c \b, COFF +>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender +>>(8.s*16) string emx +>>>&1 string x for DOS, Win or OS/2, emx %s +>>&(&0x42.l-3) byte x +>>>&0x26 string UPX \b, UPX compressed +# and yet another guess: small .text, and after large .data is unusal, could be 32lite +>>&0x2c search/0xa0 .text +>>>&0x0b lelong <0x2000 +>>>>&0 lelong >0x6000 \b, 32lite compressed + +>(8.s*16) string $WdX \b, WDos/X DOS extender + +# By now an executable type should have been printed out. The executable +# may be a self-uncompressing archive, so look for evidence of that and +# print it out. +# +# Some signatures below from Greg Roelofs, newt@uchicago.edu. +# +>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed +>0xe7 string LH/2\ Self-Extract \b, %s +>0x1c string UC2X \b, UCEXE compressed +>0x1c string WWP\ \b, WWPACK compressed +>0x1c string RJSX \b, ARJ self-extracting archive +>0x1c string diet \b, diet compressed +>0x1c string LZ09 \b, LZEXE v0.90 compressed +>0x1c string LZ91 \b, LZEXE v0.91 compressed +>0x1c string tz \b, TinyProg compressed +>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive +!:mime application/zip +# Yes, this really is "Copr", not "Corp." +>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive +!:mime application/zip +# winarj stores a message in the stub instead of the sig in the MZ header +>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive +>0x20 string AIN +>>0x23 string 2 \b, AIN 2.x compressed +>>0x23 string <2 \b, AIN 1.x compressed +>>0x23 string >2 \b, AIN 1.x compressed +>0x24 string LHa's\ SFX \b, LHa self-extracting archive +!:mime application/x-lha +>0x24 string LHA's\ SFX \b, LHa self-extracting archive +!:mime application/x-lha +>0x24 string \ $ARX \b, ARX self-extracting archive +>0x24 string \ $LHarc \b, LHarc self-extracting archive +>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive +>0x40 string aPKG \b, aPackage self-extracting archive +>0x64 string W\ Collis\0\0 \b, Compack compressed +>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive +>>&0xf4 search/0x140 \x0\x40\x1\x0 +>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive +>1638 string -lh5- \b, LHa self-extracting archive v2.13S +>0x17888 string Rar! \b, RAR self-extracting archive + +# Skip to the end of the EXE. This will usually work fine in the PE case +# because the MZ image is hardcoded into the toolchain and almost certainly +# won't match any of these signatures. +>(4.s*512) long x +>>&(2.s-517) byte x +>>>&0 string PK\3\4 \b, ZIP self-extracting archive +>>>&0 string Rar! \b, RAR self-extracting archive +>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive +>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive +>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive +>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive +>>>&7 search/400 **ACE** \b, ACE self-extracting archive +>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive + +# a few unknown ZIP sfxes, no idea if they are needed or if they are +# already captured by the generic patterns above +>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) +# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive +# + +# TELVOX Teleinformatica CODEC self-extractor for OS/2: +>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 +>>49824 leshort =1 \b, 1 file +>>49824 leshort >1 \b, %u files + +# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc +# and http://www.freedos.org/software/?prog=kpdos +# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD +0 string/b KCF FreeDOS KEYBoard Layout collection +# only version=0x100 found +>3 uleshort x \b, version 0x%x +# length of string containing author,info and special characters +>6 ubyte >0 +#>>6 pstring x \b, name=%s +>>7 string >\0 \b, author=%-.14s +>>7 search/254 \xff \b, info= +#>>>&0 string x \b%-s +>>>&0 string x \b%-.15s +# for FreeDOS *.KL files +0 string/b KLF FreeDOS KEYBoard Layout file +# only version=0x100 or 0x101 found +>3 uleshort x \b, version 0x%x +# stringlength +>5 ubyte >0 +>>8 string x \b, name=%-.2s +0 string \xffKEYB\ \ \ \0\0\0\0 +>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file + +# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com) +# Uncommenting only the first two lines will cover about 2/3 of COM files, +# but it isn't feasible to match all COM files since there must be at least +# two dozen different one-byte "magics". +# test too generic ? +0 byte 0xe9 DOS executable (COM) +>0x1FE leshort 0xAA55 \b, boot code +>6 string SFX\ of\ LHarc (%s) + +# DOS device driver updated by Joerg Jenderek at May 2011 +# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 +0 ulequad&0x07a0ffffffff 0xffffffff DOS executable ( +>40 search/7 UPX! \bUPX compressed +# DOS device driver attributes +>4 uleshort&0x8000 0x0000 \bblock device driver +# character device +>4 uleshort&0x8000 0x8000 \b +>>4 uleshort&0x0008 0x0008 \bclock +# fast video output by int 29h +>>4 uleshort&0x0010 0x0010 \bfast +# standard input/output device +>>4 uleshort&0x0003 >0 \bstandard +>>>4 uleshort&0x0001 0x0001 \binput +>>>4 uleshort&0x0003 0x0003 \b/ +>>>4 uleshort&0x0002 0x0002 \boutput +>>4 uleshort&0x8000 0x8000 \bcharacter device driver +>0 ubyte x +# upx compressed device driver has garbage instead of real in name field of header +>>40 search/7 UPX! +>>40 default x +# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped +>>>12 ubyte >0x27 \b +>>>>10 ubyte >0x20 +>>>>>10 ubyte !0x2E +>>>>>>10 ubyte !0x2A \b%c +>>>>11 ubyte >0x20 +>>>>>11 ubyte !0x2E \b%c +>>>>12 ubyte >0x20 +>>>>>12 ubyte !0x39 +>>>>>>12 ubyte !0x2E \b%c +>>>13 ubyte >0x20 +>>>>13 ubyte !0x2E \b%c +>>>>14 ubyte >0x20 +>>>>>14 ubyte !0x2E \b%c +>>>>15 ubyte >0x20 +>>>>>15 ubyte !0x2E \b%c +>>>>16 ubyte >0x20 +>>>>>16 ubyte !0x2E +>>>>>>16 ubyte <0xCB \b%c +>>>>17 ubyte >0x20 +>>>>>17 ubyte !0x2E +>>>>>>17 ubyte <0x90 \b%c +# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field +>>>4 uleshort&0x8000 0x8000 +>>>>12 ubyte <0x2F +# they have their real name at offset 22 +>>>>>22 string >\0 \b%-.5s +>4 uleshort&0x8000 0x0000 +# 32 bit sector adressing ( > 32 MB) for block devices +>>4 uleshort&0x0002 0x0002 \b,32-bit sector- +# support by driver functions 13h, 17h, 18h +>4 uleshort&0x0040 0x0040 \b,IOCTL- +# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh +>4 uleshort&0x0800 0x0800 \b,close media- +# output until busy support by int 10h for character device driver +>4 uleshort&0x8000 0x8000 +>>4 uleshort&0x2000 0x2000 \b,until busy- +# direct read/write support by driver functions 03h,0Ch +>4 uleshort&0x4000 0x4000 \b,control strings- +>4 uleshort&0x8000 0x8000 +>>4 uleshort&0x6840 >0 \bsupport +>4 uleshort&0x8000 0x0000 +>>4 uleshort&0x4842 >0 \bsupport +>0 ubyte x \b) +# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header +# Too weak, matches files that only contain 0's +#0 ulequad&0x000007a0ffffffed 0x0000000000000000 DOS-executable ( +#>4 uleshort&0x8000 0x8000 \bcharacter device driver +#>>10 string x %-.8s +#>4 uleshort&0x4000 0x4000 \b,control strings-support) + +# test too generic ? +0 byte 0x8c DOS executable (COM) +# updated by Joerg Jenderek at Oct 2008 +0 ulelong 0xffff10eb DR-DOS executable (COM) +# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb +0 ubeshort&0xeb8d >0xeb00 +# DR-DOS STACKER.COM SCREATE.SYS missed +>0 byte 0xeb +>>0x1FE leshort 0xAA55 DOS executable (COM), boot code +>>85 string UPX DOS executable (COM), UPX compressed +>>4 string \ $ARX DOS executable (COM), ARX self-extracting archive +>>4 string \ $LHarc DOS executable (COM), LHarc self-extracting archive +>>0x20e string SFX\ by\ LARC DOS executable (COM), LARC self-extracting archive +# updated by Joerg Jenderek at Oct 2008 +#0 byte 0xb8 COM executable +0 uleshort&0x80ff 0x00b8 +# modified by Joerg Jenderek +>1 lelong !0x21cd4cff COM executable for DOS +# http://syslinux.zytor.com/comboot.php +# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode +# start with assembler instructions mov eax,21cd4cffh +0 uleshort&0xc0ff 0xc0b8 +>1 lelong 0x21cd4cff COM executable (32-bit COMBOOT) +# syslinux:doc/comboot.txt +# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov +# eax,21cd4cfeh) as a magic number. +0 string/b \xb8\xfe\x4c\xcd\x21 COM executable (COM32R) +# start with assembler instructions mov eax,21cd4cfeh +0 uleshort&0xc0ff 0xc0b8 +>1 lelong 0x21cd4cfe COM executable (32-bit COMBOOT, relocatable) +0 string/b \x81\xfc +>4 string \x77\x02\xcd\x20\xb9 +>>36 string UPX! FREE-DOS executable (COM), UPX compressed +252 string Must\ have\ DOS\ version DR-DOS executable (COM) +# added by Joerg Jenderek at Oct 2008 +# GRR search is not working +#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed +34 string UPX! FREE-DOS executable (COM), UPX compressed +35 string UPX! FREE-DOS executable (COM), UPX compressed +# GRR search is not working +#2 search/28 \xcd\x21 COM executable for MS-DOS +#WHICHFAT.cOM +2 string \xcd\x21 COM executable for DOS +#DELTREE.cOM DELTREE2.cOM +4 string \xcd\x21 COM executable for DOS +#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM +5 string \xcd\x21 COM executable for DOS +#DELTMP.COm HASFAT32.cOM +7 string \xcd\x21 +>0 byte !0xb8 COM executable for DOS +#COMP.cOM MORE.COm +10 string \xcd\x21 +>5 string !\xcd\x21 COM executable for DOS +#comecho.com +13 string \xcd\x21 COM executable for DOS +#HELP.COm EDIT.coM +18 string \xcd\x21 COM executable for MS-DOS +#NWRPLTRM.COm +23 string \xcd\x21 COM executable for MS-DOS +#LOADFIX.cOm LOADFIX.cOm +30 string \xcd\x21 COM executable for MS-DOS +#syslinux.com 3.11 +70 string \xcd\x21 COM executable for DOS +# many compressed/converted COMs start with a copy loop instead of a jump +0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS +0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS +>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed +0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed +# FIXME: missing diet .com compression + +# miscellaneous formats +0 string/b LZ MS-DOS executable (built-in) +#0 byte 0xf0 MS-DOS program library data +# + +# AAF files: +# <stuartc@rd.bbc.co.uk> Stuart Cunningham +0 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage +>30 byte 9 (512B sectors) +>30 byte 12 (4kB sectors) +0 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage +>30 byte 9 (512B sectors) +>30 byte 12 (4kB sectors) + +# Popular applications +2080 string Microsoft\ Word\ 6.0\ Document %s +!:mime application/msword +2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data +!:mime application/msword +# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) +2112 string MSWordDoc Microsoft Word document data +!:mime application/msword +# +0 belong 0x31be0000 Microsoft Word Document +!:mime application/msword +# +0 string/b PO^Q` Microsoft Word 6.0 Document +!:mime application/msword +# +0 string/b \376\067\0\043 Microsoft Office Document +!:mime application/msword +0 string/b \333\245-\0\0\0 Microsoft Office Document +!:mime application/msword +512 string/b \354\245\301 Microsoft Word Document +!:mime application/msword + +# +0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document +!:mime application/msword +# +2080 string Microsoft\ Excel\ 5.0\ Worksheet %s +!:mime application/vnd.ms-excel +# +0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document +!:mime application/msword + +2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s +!:mime application/vnd.ms-excel +# +# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) +2114 string Biff5 Microsoft Excel 5.0 Worksheet +!:mime application/vnd.ms-excel +# Italian MS-Excel +2121 string Biff5 Microsoft Excel 5.0 Worksheet +!:mime application/vnd.ms-excel +0 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet +!:mime application/vnd.ms-excel +# +0 belong 0x00001a00 Lotus 1-2-3 +!:mime application/x-123 +>4 belong 0x00100400 wk3 document data +>4 belong 0x02100400 wk4 document data +>4 belong 0x07800100 fm3 or fmb document data +>4 belong 0x07800000 fm3 or fmb document data +# +0 belong 0x00000200 Lotus 1-2-3 +!:mime application/x-123 +>4 belong 0x06040600 wk1 document data +>4 belong 0x06800200 fmt document data +0 string/b WordPro\0 Lotus WordPro +!:mime application/vnd.lotus-wordpro +0 string/b WordPro\r\373 Lotus WordPro +!:mime application/vnd.lotus-wordpro + + +# Summary: Script used by InstallScield to uninstall applications +# Extension: .isu +# Submitted by: unknown +# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) +0 string \x71\xa8\x00\x00\x01\x02 +>12 string Stirling\ Technologies, InstallShield Uninstall Script + +# Winamp .avs +#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player +0 string/b Nullsoft\ AVS\ Preset\ Winamp plug in + +# Windows Metafont .WMF +0 string/b \327\315\306\232 ms-windows metafont .wmf +0 string/b \002\000\011\000 ms-windows metafont .wmf +0 string/b \001\000\011\000 ms-windows metafont .wmf + +#tz3 files whatever that is (MS Works files) +0 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file +0 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file +0 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file + +# PGP sig files .sig +#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig +0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig +0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig +0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig +0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig +0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig +0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig + +# windows zips files .dmf +0 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file + + +#ico files +0 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows + +# Windows icons (Ian Springer <ips@fpk.hp.com>) +0 string/b \000\000\001\000 MS Windows icon resource +!:mime image/x-icon +>4 byte 1 - 1 icon +>4 byte >1 - %d icons +>>6 byte >0 \b, %dx +>>>7 byte >0 \b%d +>>8 byte 0 \b, 256-colors +>>8 byte >0 \b, %d-colors + + +# .chr files +0 string/b PK\010\010BGI Borland font +>4 string >\0 %s +# then there is a copyright notice + + +# .bgi files +0 string/b pk\010\010BGI Borland device +>4 string >\0 %s +# then there is a copyright notice + + +# Windows Recycle Bin record file (named INFO2) +# By Abel Cheung (abelcheung AT gmail dot com) +# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes +# Since Vista uses another structure, INFO2 structure probably won't change +# anymore. Detailed analysis in: +# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf +0 lelong 0x00000004 +>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) + +0 lelong 0x00000005 +>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) + + +##### put in Either Magic/font or Magic/news +# Acroread or something files wrongly identified as G3 .pfm +# these have the form \000 \001 any? \002 \000 \000 +# or \000 \001 any? \022 \000 \000 +0 belong&0xffff00ff 0x00010012 PFM data +>4 string \000\000 +>6 string >\060 - %s + +0 belong&0xffff00ff 0x00010002 PFM data +>4 string \000\000 +>6 string >\060 - %s +#0 string \000\001 pfm? +#>3 string \022\000\000Copyright\ yes +#>3 string \002\000\000Copyright\ yes +#>3 string >\0 oops, not a font file. Cancel that. +#it clashes with ttf files so put it lower down. + +# From Doug Lee via a FreeBSD pr +9 string GERBILDOC First Choice document +9 string GERBILDB First Choice database +9 string GERBILCLIP First Choice database +0 string GERBIL First Choice device file +9 string RABBITGRAPH RabbitGraph file +0 string DCU1 Borland Delphi .DCU file +0 string =!<spell> MKS Spell hash list (old format) +0 string =!<spell2> MKS Spell hash list +# Too simple - MPi +#0 string AH Halo(TM) bitmapped font file +0 lelong 0x08086b70 TurboC BGI file +0 lelong 0x08084b50 TurboC Font file + +# WARNING: below line conflicts with Infocom game data Z-machine 3 +0 byte 0x03 +>0x02 byte <0x13 DBase 3 data file +>>0x04 lelong 0 (no records) +>>0x04 lelong >0 (%ld records) +0 byte 0x83 +>0x02 byte <0x13 DBase 3 data file with memo(s) +>>0x04 lelong 0 (no records) +>>0x04 lelong >0 (%ld records) +0 leshort 0x0006 DBase 3 index file +0 string PMCC Windows 3.x .GRP file +1 string RDC-meg MegaDots +>8 byte >0x2F version %c +>9 byte >0x2F \b.%c file +0 lelong 0x4C +>4 lelong 0x00021401 Windows shortcut file + +# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm +# only for windows versions equal or greater 3.0 +0x171 string MICROSOFT\ PIFEX\0 Windows Program Information File +!:mime application/x-dosexec +#>2 string >\0 \b, Title:%.30s +>0x24 string >\0 \b for %.63s +>0x65 string >\0 \b, directory=%.64s +>0xA5 string >\0 \b, parameters=%.64s +#>0x181 leshort x \b, offset %x +#>0x183 leshort x \b, offsetdata %x +#>0x185 leshort x \b, section length %x +>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 +>>&0x5e ubyte >0 +>>>&-1 string <PIFMGR.DLL \b, icon=%s +#>>>&-1 string PIFMGR.DLL \b, icon=%s +>>>&-1 string >PIFMGR.DLL \b, icon=%s +>>&0xF0 ubyte >0 +>>>&-1 string <Terminal \b, font=%.32s +#>>>&-1 string =Terminal \b, font=%.32s +>>>&-1 string >Terminal \b, font=%.32s +>>&0x110 ubyte >0 +>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s +#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s +>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s +#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style +#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style +>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style +#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style +>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS +#>>&06 string x \b:%s +>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT +#>>&06 string x \b:%s + +# DOS EPS Binary File Header +# From: Ed Sznyter <ews@Black.Market.NET> +0 belong 0xC5D0D3C6 DOS EPS Binary File +>4 long >0 Postscript starts at byte %d +>>8 long >0 length %d +>>>12 long >0 Metafile starts at byte %d +>>>>16 long >0 length %d +>>>20 long >0 TIFF starts at byte %d +>>>>24 long >0 length %d + +# TNEF magic From "Joomy" <joomy@se-ed.net> +# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) +0 leshort 0x223e9f78 TNEF +!:mime application/vnd.ms-tnef + +# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS +# of http://www.4dos.info/ +# pointer,HelpID[8]=4DHnnnmm +0 ulelong 0x48443408 4DOS help file +>4 string x \b, version %-4.4s + +# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp +0 ulequad 0x3a000000024e4c MS Advisor help file + +# HtmlHelp files (.chm) +0 string/b ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data + +# GFA-BASIC (Wolfram Kleff) +2 string/b GFA-BASIC3 GFA-BASIC 3 data + +#------------------------------------------------------------------------------ +# From Stuart Caie <kyzer@4u.net> (developer of cabextract) +# Microsoft Cabinet files +0 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data +!:mime application/vnd.ms-cab-compressed +>8 lelong x \b, %u bytes +>28 leshort 1 \b, 1 file +>28 leshort >1 \b, %u files + +# InstallShield Cabinet files +0 string/b ISc( InstallShield Cabinet archive data +>5 byte&0xf0 =0x60 version 6, +>5 byte&0xf0 !0x60 version 4/5, +>(12.l+40) lelong x %u files + +# Windows CE package files +0 string/b MSCE\0\0\0\0 Microsoft WinCE install header +>20 lelong 0 \b, architecture-independent +>20 lelong 103 \b, Hitachi SH3 +>20 lelong 104 \b, Hitachi SH4 +>20 lelong 0xA11 \b, StrongARM +>20 lelong 4000 \b, MIPS R4000 +>20 lelong 10003 \b, Hitachi SH3 +>20 lelong 10004 \b, Hitachi SH3E +>20 lelong 10005 \b, Hitachi SH4 +>20 lelong 70001 \b, ARM 7TDMI +>52 leshort 1 \b, 1 file +>52 leshort >1 \b, %u files +>56 leshort 1 \b, 1 registry entry +>56 leshort >1 \b, %u registry entries + + +# Windows Enhanced Metafile (EMF) +# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp +# for further information. +0 ulelong 1 +>40 string \ EMF Windows Enhanced Metafile (EMF) image data +>>44 ulelong x version 0x%x + +# From: Alex Beregszaszi <alex@fsn.hu> +0 string/b COWD VMWare3 +>4 byte 3 disk image +>>32 lelong x (%d/ +>>36 lelong x \b%d/ +>>40 lelong x \b%d) +>4 byte 2 undoable disk image +>>32 string >\0 (%s) + +0 string/b VMDK VMware4 disk image +0 string/b KDMV VMware4 disk image + +#-------------------------------------------------------------------- +# Qemu Emulator Images +# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) +# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) +# Made by reading sources, reading documentation, and doing trial and error +# on existing QCOW files +0 string/b QFI\xFB QEMU QCOW Image + +# Uncomment the following line to display Magic (only used for debugging +# this magic number) +#>0 string/b x , Magic: %s + +# There are currently 2 Versions: "1" and "2". +# http://www.gnome.org/~markmc/qcow-image-format-version-1.html +>4 belong 1 (v1) + +# Using the existence of the Backing File Offset to determine whether +# to read Backing File Information +>>12 belong >0 \b, has backing file ( +# Note that this isn't a null-terminated string; the length is actually +# (16.L). Assuming a null-terminated string happens to work usually, but it +# may spew junk until it reaches a \0 in some cases. +>>>(12.L) string >\0 \bpath %s + +# Modification time of the Backing File +# Really useful if you want to know if your backing +# file is still usable together with this image +>>>>20 bedate >0 \b, mtime %s) +>>>>20 default x \b) + +# Size is stored in bytes in a big-endian u64. +>>24 bequad x \b, %lld bytes + +# 1 for AES encryption, 0 for none. +>>36 belong 1 \b, AES-encrypted + +# http://www.gnome.org/~markmc/qcow-image-format.html +>4 belong 2 (v2) +# Using the existence of the Backing File Offset to determine whether +# to read Backing File Information +>>8 bequad >0 \b, has backing file +# Note that this isn't a null-terminated string; the length is actually +# (16.L). Assuming a null-terminated string happens to work usually, but it +# may spew junk until it reaches a \0 in some cases. Also, since there's no +# .Q modifier, we just use the bottom four bytes as an offset. Note that if +# the file is over 4G, and the backing file path is stored after the first 4G, +# the wrong filename will be printed. (This should be (8.Q), when that syntax +# is introduced.) +>>>(12.L) string >\0 (path %s) +>>24 bequad x \b, %lld bytes +>>32 belong 1 \b, AES-encrypted + +>4 default x (unknown version) + +0 string/b QEVM QEMU suspend to disk image + +# QEMU QED Image +# http://wiki.qemu.org/Features/QED/Specification +0 string/b QED\0 QEMU QED Image + +# VDI Image +64 string/b \x7f\x10\xda\xbe VDI Image +>68 string/b \x01\x00\x01\x00 version 1.1 +>0 string >\0 (%s) +>368 lequad x \b, %lld bytes + +0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, +>32 string x type %s, +>48 string x subtype %s + +0 lelong 0x02468ace Bochs Sparse disk image + +# from http://filext.com by Derek M Jones <derek@knosof.co.uk> +# False positive with PPT (also currently this string is too long) +#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer +0 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document +#>48 byte 0x1B Excel Document +#!:mime application/vnd.ms-excel +>546 string bjbj Microsoft Word Document +!:mime application/msword +>546 string jbjb Microsoft Word Document +!:mime application/msword + +0 string/b \224\246\056 Microsoft Word Document +!:mime application/msword + +512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document +!:mime application/msword + +# From: "Nelson A. de Oliveira" <naoliv@gmail.com> +# Magic type for Dell's BIOS .hdr files +# Dell's .hdr +0 string/b $RBU +>23 string Dell %s system BIOS +>5 byte 2 +>>48 byte x version %d. +>>49 byte x \b%d. +>>50 byte x \b%d +>5 byte <2 +>>48 string x version %.3s + +# Type: Microsoft DirectDraw Surface +# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp +# From: Morten Hustveit <morten@debian.org> +0 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS), +>16 lelong >0 %hd x +>12 lelong >0 %hd, +>84 string x %.4s + +# Type: Microsoft Document Imaging Format (.mdi) +# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format +# From: Daniele Sempione <scrows@oziosi.org> +0 short 0x5045 Microsoft Document Imaging Format + +# MS eBook format (.lit) +0 string/b ITOLITLS Microsoft Reader eBook Data +>8 lelong x \b, version %u +!:mime application/x-ms-reader + +# Windows CE Binary Image Data Format +# From: Dr. Jesus <j@hug.gs> +0 string/b B000FF\n Windows Embedded CE binary image + +# Windows Imaging (WIM) Image +0 string/b MSWIM\000\000\000 Windows imaging (WIM) image + +# The second byte of these signatures is a file version; I don't know what, +# if anything, produced files with version numbers 0-2. +# From: John Elliott <johne@seasip.demon.co.uk> +0 string \xfc\x03\x00 Mallard BASIC program data (v1.11) +0 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) +0 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) +0 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) + +0 string MIOPEN Mallard BASIC Jetsam data +0 string Jetsam0 Mallard BASIC Jetsam index data + diff --git a/magic/Magdir/msooxml b/magic/Magdir/msooxml new file mode 100644 index 0000000..c627644 --- /dev/null +++ b/magic/Magdir/msooxml @@ -0,0 +1,35 @@ + +#------------------------------------------------------------------------------ +# $File: msooxml,v 1.2 2013/01/25 23:04:37 christos Exp $ +# msooxml: file(1) magic for Microsoft Office XML +# From: Ralf Brown <ralf.brown@gmail.com> + +# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP +# archive. The first member file is normally "[Content_Types].xml". +# Since MSOOXML doesn't have anything like the uncompressed "mimetype" +# file of ePub or OpenDocument, we'll have to scan for a filename +# which can distinguish between the three types + +# start by checking for ZIP local file header signature +0 string PK\003\004 +# make sure the first file is correct +>0x1E string [Content_Types].xml +# skip to the second local file header +# since some documents include a 520-byte extra field following the file +# header, we need to scan for the next header +>>(18.l+49) search/2000 PK\003\004 +# now skip to the *third* local file header; again, we need to scan due to a +# 520-byte extra field following the file header +>>>&26 search/1000 PK\003\004 +# and check the subdirectory name to determine which type of OOXML +# file we have +# Correct the mimetype with the registered ones: +# http://technet.microsoft.com/en-us/library/cc179224.aspx +>>>>&26 string word/ Microsoft Word 2007+ +!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document +>>>>&26 string ppt/ Microsoft PowerPoint 2007+ +!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation +>>>>&26 string xl/ Microsoft Excel 2007+ +!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet +>>>>&26 default x Microsoft OOXML +!:strength +10 diff --git a/magic/Magdir/msvc b/magic/Magdir/msvc new file mode 100644 index 0000000..1095d05 --- /dev/null +++ b/magic/Magdir/msvc @@ -0,0 +1,45 @@ + +#------------------------------------------------------------------------------ +# $File: msvc,v 1.5 2009/09/19 16:28:11 christos Exp $ +# msvc: file(1) magic for msvc +# "H. Nanosecond" <aldomel@ix.netcom.com> +# Microsoft visual C +# +# I have version 1.0 + +# .aps +0 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file + +# .ide +#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide +0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide + +# .res +0 string \000\000\000\000\040\000\000\000\377 MSVC .res +0 string \377\003\000\377\001\000\020\020\350 MSVC .res +0 string \377\003\000\377\001\000\060\020\350 MSVC .res + +#.lib +0 string \360\015\000\000 Microsoft Visual C library +0 string \360\075\000\000 Microsoft Visual C library +0 string \360\175\000\000 Microsoft Visual C library + +#.pch +0 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch + +# .pdb +# too long 0 string Microsoft\ C/C++\ program\ database\ +0 string Microsoft\ C/C++\ MSVC program database +>18 string program\ database\ +>33 string >\0 ver %s + +#.sbr +0 string \000\002\000\007\000 MSVC .sbr +>5 string >\0 %s + +#.bsc +0 string \002\000\002\001 MSVC .bsc + +#.wsp +0 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 +# these seem to start with the version and contain menus diff --git a/magic/Magdir/mup b/magic/Magdir/mup new file mode 100644 index 0000000..5060c01 --- /dev/null +++ b/magic/Magdir/mup @@ -0,0 +1,24 @@ + +# ------------------------------------------------------------------------ +# $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $ +# mup: file(1) magic for Mup (Music Publisher) input file. +# +# From: Abel Cheung <abel (@) oaka.org> +# +# NOTE: This header is mainly proposed in the Arkkra mailing list, +# and is not a mandatory header because of old mup input file +# compatibility. Noteedit also use mup format, but is not forcing +# user to use any header as well. +# +0 search/1 //!Mup Mup music publication program input text +>6 string -Arkkra (Arkkra) +>>13 string - +>>>16 string . +>>>>14 string x \b, need V%.4s +>>>15 string . +>>>>14 string x \b, need V%.3s +>6 string - +>>9 string . +>>>7 string x \b, need V%.4s +>>8 string . +>>>7 string x \b, need V%.3s diff --git a/magic/Magdir/music b/magic/Magdir/music new file mode 100644 index 0000000..ad8da65 --- /dev/null +++ b/magic/Magdir/music @@ -0,0 +1,17 @@ +#------------------------------------------------------------------------------ +# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $ +# music: file (1) magic for music formats + +# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks +# and Bagpipe Writer by Doug Wickstrom +# +0 string Bagpipe Bagpipe +>8 string Reader Reader +>>15 string >\0 (version %.3s) +>8 string Music\ Writer Music Writer +>>20 string : +>>>21 string >\0 (version %.3s) +>>21 string Gold Gold +>>>25 string : +>>>>26 string >\0 (version %.3s) + diff --git a/magic/Magdir/natinst b/magic/Magdir/natinst new file mode 100644 index 0000000..0a936c5 --- /dev/null +++ b/magic/Magdir/natinst @@ -0,0 +1,24 @@ + +#----------------------------------------------------------------------------- +# $File: natinst,v 1.5 2013/02/06 14:18:52 christos Exp $ +# natinst: file(1) magic for National Instruments Code Files + +# +# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores +# version 1 +# Many formats still missing, we use, for the moment LabVIEW +# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing +# +0 string RSRC National Instruments, +# Check if it's a LabVIEW File +>8 string LV LabVIEW File, +# Check wich kind of file is +>>10 string SB Code Resource File, data +>>10 string IN Virtual Instrument Program, data +>>10 string AR VI Library, data +# This is for Menu Libraries +>8 string LMNULBVW Portable File Names, data +# This is for General Resources +>8 string rsc Resources File, data +# This is for VXI Package +0 string VMAP National Instruments, VXI File, data diff --git a/magic/Magdir/ncr b/magic/Magdir/ncr new file mode 100644 index 0000000..4067596 --- /dev/null +++ b/magic/Magdir/ncr @@ -0,0 +1,49 @@ + +#------------------------------------------------------------------------------ +# $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $ +# ncr: file(1) magic for NCR Tower objects +# +# contributed by +# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa +# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP +# +0 beshort 000610 Tower/XP rel 2 object +>12 belong >0 not stripped +>20 beshort 0407 executable +>20 beshort 0410 pure executable +>22 beshort >0 - version %ld +0 beshort 000615 Tower/XP rel 2 object +>12 belong >0 not stripped +>20 beshort 0407 executable +>20 beshort 0410 pure executable +>22 beshort >0 - version %ld +0 beshort 000620 Tower/XP rel 3 object +>12 belong >0 not stripped +>20 beshort 0407 executable +>20 beshort 0410 pure executable +>22 beshort >0 - version %ld +0 beshort 000625 Tower/XP rel 3 object +>12 belong >0 not stripped +>20 beshort 0407 executable +>20 beshort 0410 pure executable +>22 beshort >0 - version %ld +0 beshort 000630 Tower32/600/400 68020 object +>12 belong >0 not stripped +>20 beshort 0407 executable +>20 beshort 0410 pure executable +>22 beshort >0 - version %ld +0 beshort 000640 Tower32/800 68020 +>18 beshort &020000 w/68881 object +>18 beshort &040000 compatible object +>18 beshort &060000 object +>20 beshort 0407 executable +>20 beshort 0413 pure executable +>12 belong >0 not stripped +>22 beshort >0 - version %ld +0 beshort 000645 Tower32/800 68010 +>18 beshort &040000 compatible object +>18 beshort &060000 object +>20 beshort 0407 executable +>20 beshort 0413 pure executable +>12 belong >0 not stripped +>22 beshort >0 - version %ld diff --git a/magic/Magdir/netbsd b/magic/Magdir/netbsd new file mode 100644 index 0000000..fd0eed3 --- /dev/null +++ b/magic/Magdir/netbsd @@ -0,0 +1,284 @@ + +#------------------------------------------------------------------------------ +# $File: netbsd,v 1.20 2013/01/09 22:37:24 christos Exp $ +# netbsd: file(1) magic for NetBSD objects +# +# All new-style magic numbers are in network byte order. +# The old-style magic numbers are indistinguishable from the same magic +# numbers used in other systems, and are handled, for all those systems, +# in aout. +# + +0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 041400410 a.out NetBSD/i386 pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 041400407 a.out NetBSD/i386 +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 041400507 a.out NetBSD/i386 core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) + +0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged +>0 byte &0x80 +>>20 belong <8192 shared library +>>20 belong =8192 dynamically linked executable +>>20 belong >8192 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 041600410 a.out NetBSD/m68k pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 041600407 a.out NetBSD/m68k +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 belong !0 executable +>>20 belong =0 object file +>16 belong >0 not stripped +0 belong&0377777777 041600507 a.out NetBSD/m68k core +>12 string >\0 from '%s' +>32 belong !0 (signal %d) + +0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged +>0 byte &0x80 +>>20 belong <4096 shared library +>>20 belong =4096 dynamically linked executable +>>20 belong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 042000410 a.out NetBSD/m68k4k pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 042000407 a.out NetBSD/m68k4k +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 belong !0 executable +>>20 belong =0 object file +>16 belong >0 not stripped +0 belong&0377777777 042000507 a.out NetBSD/m68k4k core +>12 string >\0 from '%s' +>32 belong !0 (signal %d) + +0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 042200410 a.out NetBSD/ns32532 pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 042200407 a.out NetBSD/ns32532 +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 042200507 a.out NetBSD/ns32532 core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) + +0 belong&0377777777 045200507 a.out NetBSD/powerpc core +>12 string >\0 from '%s' + +0 belong&0377777777 042400413 a.out NetBSD/sparc demand paged +>0 byte &0x80 +>>20 belong <8192 shared library +>>20 belong =8192 dynamically linked executable +>>20 belong >8192 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 042400410 a.out NetBSD/sparc pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 042400407 a.out NetBSD/sparc +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 belong !0 executable +>>20 belong =0 object file +>16 belong >0 not stripped +0 belong&0377777777 042400507 a.out NetBSD/sparc core +>12 string >\0 from '%s' +>32 belong !0 (signal %d) + +0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 042600410 a.out NetBSD/pmax pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 042600407 a.out NetBSD/pmax +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 042600507 a.out NetBSD/pmax core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) + +0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 043000410 a.out NetBSD/vax 1k pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 043000407 a.out NetBSD/vax 1k +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 043000507 a.out NetBSD/vax 1k core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) + +0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 045400410 a.out NetBSD/vax 4k pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 045400407 a.out NetBSD/vax 4k +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 045400507 a.out NetBSD/vax 4k core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) + +# NetBSD/alpha does not support (and has never supported) a.out objects, +# so no rules are provided for them. NetBSD/alpha ELF objects are +# dealt with in "elf". +0 lelong 0x00070185 ECOFF NetBSD/alpha binary +>10 leshort 0x0001 not stripped +>10 leshort 0x0000 stripped +0 belong&0377777777 043200507 a.out NetBSD/alpha core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) + +0 belong&0377777777 043400413 a.out NetBSD/mips demand paged +>0 byte &0x80 +>>20 belong <8192 shared library +>>20 belong =8192 dynamically linked executable +>>20 belong >8192 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 043400410 a.out NetBSD/mips pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 043400407 a.out NetBSD/mips +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 belong !0 executable +>>20 belong =0 object file +>16 belong >0 not stripped +0 belong&0377777777 043400507 a.out NetBSD/mips core +>12 string >\0 from '%s' +>32 belong !0 (signal %d) + +0 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 043600410 a.out NetBSD/arm32 pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 043600407 a.out NetBSD/arm32 +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +# NetBSD/arm26 has always used ELF objects, but it shares a core file +# format with NetBSD/arm32. +0 belong&0377777777 043600507 a.out NetBSD/arm core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) + +# Kernel core dump format +0 belong&0x0000ffff 0x00008fca NetBSD kernel core file +>0 belong&0x03ff0000 0x00000000 \b, Unknown +>0 belong&0x03ff0000 0x00001000 \b, sun 68010/68020 +>0 belong&0x03ff0000 0x00020000 \b, sun 68020 +>0 belong&0x03ff0000 0x00640000 \b, 386 PC +>0 belong&0x03ff0000 0x00860000 \b, i386 BSD +>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages) +>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages) +>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD +>0 belong&0x03ff0000 0x008a0000 \b, sparc/32 BSD +>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD +>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages) +>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD +>0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian) +>0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD +>0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages) +>0 belong&0x03ff0000 0x00910000 \b, sh3 BSD +>0 belong&0x03ff0000 0x00920000 \b, ppc BSD (Big Endian) +>0 belong&0x03ff0000 0x00930000 \b, vax BSD (4K pages) +>0 belong&0x03ff0000 0x00940000 \b, mips1 BSD +>0 belong&0x03ff0000 0x00950000 \b, mips2 BSD +>0 belong&0x03ff0000 0x00960000 \b, parisc BSD +>0 belong&0x03ff0000 0x00970000 \b, sh5/64 BSD +>0 belong&0x03ff0000 0x00980000 \b, sparc/64 BSD +>0 belong&0x03ff0000 0x00990000 \b, amd64 BSD +>0 belong&0x03ff0000 0x009a0000 \b, hp200 (68010) BSD +>0 belong&0x03ff0000 0x009b0000 \b, hp300 (68020+68881) BSD +>0 belong&0x03ff0000 0x009b0000 \b, hp300 (68020+68881) BSD +>0 belong&0x03ff0000 0x00c80000 \b, hp200 +>0 belong&0x03ff0000 0x020b0000 \b, hp300 (68020+68881) HP-UX +>0 belong&0x03ff0000 0x020c0000 \b, hp300 (68020+68881) HP-UX +>0 belong&0xfc000000 0x04000000 \b, CPU +>0 belong&0xfc000000 0x08000000 \b, DATA +>0 belong&0xfc000000 0x10000000 \b, STACK +>4 leshort x \b, (headersize = %d +>6 leshort x \b, segmentsize = %d +>6 lelong x \b, segments = %d) diff --git a/magic/Magdir/netscape b/magic/Magdir/netscape new file mode 100644 index 0000000..942f08a --- /dev/null +++ b/magic/Magdir/netscape @@ -0,0 +1,25 @@ + +#------------------------------------------------------------------------------ +# $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $ +# netscape: file(1) magic for Netscape files +# "H. Nanosecond" <aldomel@ix.netcom.com> +# version 3 and 4 I think +# + +# Netscape Address book .nab +0 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book + +# Netscape Communicator address book +0 string \000\017\102\111 Netscape Communicator address book + +# .snm Caches +0 string #\ Netscape\ folder\ cache Netscape folder cache +0 string \000\036\204\220\000 Netscape folder cache +# .n2p +# Net 2 Phone +#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 +0 string SX961999 Net2phone + +# +#This is files ending in .art, FIXME add more rules +0 string JG\004\016\0\0\0\0 ART diff --git a/magic/Magdir/netware b/magic/Magdir/netware new file mode 100644 index 0000000..c3f57e8 --- /dev/null +++ b/magic/Magdir/netware @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $ +# netware: file(1) magic for NetWare Loadable Modules (NLMs) +# From: Mads Martin Joergensen <mmj@suse.de> + +0 string NetWare\ Loadable\ Module NetWare Loadable Module diff --git a/magic/Magdir/news b/magic/Magdir/news new file mode 100644 index 0000000..eea8aed --- /dev/null +++ b/magic/Magdir/news @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $ +# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") +# +0 string StartFontMetrics ASCII font metrics +0 string StartFont ASCII font bits +0 belong 0x137A2944 NeWS bitmap font +0 belong 0x137A2947 NeWS font family +0 belong 0x137A2950 scalable OpenFont binary +0 belong 0x137A2951 encrypted scalable OpenFont binary +8 belong 0x137A2B45 X11/NeWS bitmap font +8 belong 0x137A2B48 X11/NeWS font family diff --git a/magic/Magdir/nitpicker b/magic/Magdir/nitpicker new file mode 100644 index 0000000..d1a6628 --- /dev/null +++ b/magic/Magdir/nitpicker @@ -0,0 +1,14 @@ + +#------------------------------------------------------------------------------ +# $File: nitpicker,v 1.4 2009/09/19 16:28:11 christos Exp $ +# nitpicker: file(1) magic for Flowfiles. +# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de +0 string NPFF NItpicker Flow File +>4 byte x V%d. +>5 byte x %d +>6 bedate x started: %s +>10 bedate x stopped: %s +>14 belong x Bytes: %u +>18 belong x Bytes1: %u +>22 belong x Flows: %u +>26 belong x Pkts: %u diff --git a/magic/Magdir/oasis b/magic/Magdir/oasis new file mode 100644 index 0000000..e527185 --- /dev/null +++ b/magic/Magdir/oasis @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: oasis,v 1.1 2011/03/15 02:09:38 christos Exp $ +# OASIS +# Summary: OASIS stream file +# Long descripton: Open Artwork System Interchange Standard +# File extension: .oas +# Full name: Ben Cowley (bcowley@broadcom.com) +# Philip Dixon (pdixon@broadcom.com) +# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf +# (see page 3) +0 string %SEMI-OASIS\r\n OASIS Stream file diff --git a/magic/Magdir/ocaml b/magic/Magdir/ocaml new file mode 100644 index 0000000..3ec3100 --- /dev/null +++ b/magic/Magdir/ocaml @@ -0,0 +1,14 @@ + +#------------------------------------------------------------------------------ +# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $ +# ocaml: file(1) magic for Objective Caml files. +0 string Caml1999 OCaml +>8 string X exec file +>8 string I interface file (.cmi) +>8 string O object file (.cmo) +>8 string A library file (.cma) +>8 string Y native object file (.cmx) +>8 string Z native library file (.cmxa) +>8 string M abstract syntax tree implementation file +>8 string N abstract syntax tree interface file +>9 string >\0 (Version %3.3s) diff --git a/magic/Magdir/octave b/magic/Magdir/octave new file mode 100644 index 0000000..49ea3e7 --- /dev/null +++ b/magic/Magdir/octave @@ -0,0 +1,6 @@ + +#------------------------------------------------------------------------------ +# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $ +# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> +0 string Octave-1-L Octave binary data (little endian) +0 string Octave-1-B Octave binary data (big endian) diff --git a/magic/Magdir/ole2compounddocs b/magic/Magdir/ole2compounddocs new file mode 100644 index 0000000..383948b --- /dev/null +++ b/magic/Magdir/ole2compounddocs @@ -0,0 +1,14 @@ + +#------------------------------------------------------------------------------ +# $File: ole2compounddocs,v 1.4 2009/09/19 16:28:11 christos Exp $ +# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured +# storage (http://en.wikipedia.org/wiki/Structured_Storage) +# Additional tests for OLE 2 Compound Documents should be under this recipe. + +0 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document +# - Microstation V8 DGN files (www.bentley.com) +# Last update on 10/23/2006 by Lester Hightower +> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN +# - Visio documents +# Last update on 10/23/2006 by Lester Hightower +> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document diff --git a/magic/Magdir/olf b/magic/Magdir/olf new file mode 100644 index 0000000..6ae3fc0 --- /dev/null +++ b/magic/Magdir/olf @@ -0,0 +1,98 @@ + +#------------------------------------------------------------------------------ +# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $ +# olf: file(1) magic for OLF executables +# +# We have to check the byte order flag to see what byte order all the +# other stuff in the header is in. +# +# MIPS R3000 may also be for MIPS R2000. +# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? +# +# Created by Erik Theisen <etheisen@openbsd.org> +# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> +0 string \177OLF OLF +>4 byte 0 invalid class +>4 byte 1 32-bit +>4 byte 2 64-bit +>7 byte 0 invalid os +>7 byte 1 OpenBSD +>7 byte 2 NetBSD +>7 byte 3 FreeBSD +>7 byte 4 4.4BSD +>7 byte 5 Linux +>7 byte 6 SVR4 +>7 byte 7 esix +>7 byte 8 Solaris +>7 byte 9 Irix +>7 byte 10 SCO +>7 byte 11 Dell +>7 byte 12 NCR +>5 byte 0 invalid byte order +>5 byte 1 LSB +>>16 leshort 0 no file type, +>>16 leshort 1 relocatable, +>>16 leshort 2 executable, +>>16 leshort 3 shared object, +# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> +# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> +>>16 leshort 4 core file +>>>(0x38+0xcc) string >\0 of '%s' +>>>(0x38+0x10) lelong >0 (signal %d), +>>16 leshort &0xff00 processor-specific, +>>18 leshort 0 no machine, +>>18 leshort 1 AT&T WE32100 - invalid byte order, +>>18 leshort 2 SPARC - invalid byte order, +>>18 leshort 3 Intel 80386, +>>18 leshort 4 Motorola 68000 - invalid byte order, +>>18 leshort 5 Motorola 88000 - invalid byte order, +>>18 leshort 6 Intel 80486, +>>18 leshort 7 Intel 80860, +>>18 leshort 8 MIPS R3000_BE - invalid byte order, +>>18 leshort 9 Amdahl - invalid byte order, +>>18 leshort 10 MIPS R3000_LE, +>>18 leshort 11 RS6000 - invalid byte order, +>>18 leshort 15 PA-RISC - invalid byte order, +>>18 leshort 16 nCUBE, +>>18 leshort 17 VPP500, +>>18 leshort 18 SPARC32PLUS, +>>18 leshort 20 PowerPC, +>>18 leshort 0x9026 Alpha, +>>20 lelong 0 invalid version +>>20 lelong 1 version 1 +>>36 lelong 1 MathCoPro/FPU/MAU Required +>8 string >\0 (%s) +>5 byte 2 MSB +>>16 beshort 0 no file type, +>>16 beshort 1 relocatable, +>>16 beshort 2 executable, +>>16 beshort 3 shared object, +>>16 beshort 4 core file, +>>>(0x38+0xcc) string >\0 of '%s' +>>>(0x38+0x10) belong >0 (signal %d), +>>16 beshort &0xff00 processor-specific, +>>18 beshort 0 no machine, +>>18 beshort 1 AT&T WE32100, +>>18 beshort 2 SPARC, +>>18 beshort 3 Intel 80386 - invalid byte order, +>>18 beshort 4 Motorola 68000, +>>18 beshort 5 Motorola 88000, +>>18 beshort 6 Intel 80486 - invalid byte order, +>>18 beshort 7 Intel 80860, +>>18 beshort 8 MIPS R3000_BE, +>>18 beshort 9 Amdahl, +>>18 beshort 10 MIPS R3000_LE - invalid byte order, +>>18 beshort 11 RS6000, +>>18 beshort 15 PA-RISC, +>>18 beshort 16 nCUBE, +>>18 beshort 17 VPP500, +>>18 beshort 18 SPARC32PLUS, +>>18 beshort 20 PowerPC or cisco 4500, +>>18 beshort 21 cisco 7500, +>>18 beshort 24 cisco SVIP, +>>18 beshort 25 cisco 7200, +>>18 beshort 36 cisco 12000, +>>18 beshort 0x9026 Alpha, +>>20 belong 0 invalid version +>>20 belong 1 version 1 +>>36 belong 1 MathCoPro/FPU/MAU Required diff --git a/magic/Magdir/os2 b/magic/Magdir/os2 new file mode 100644 index 0000000..8643adc --- /dev/null +++ b/magic/Magdir/os2 @@ -0,0 +1,48 @@ + +#------------------------------------------------------------------------------ +# $File: os2,v 1.7 2009/09/19 16:28:11 christos Exp $ +# os2: file(1) magic for OS/2 files +# + +# Provided 1998/08/22 by +# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> +1 search/1 InternetShortcut MS Windows 95 Internet shortcut text +>24 search/1 >\ (URL=<%s>) + +# OS/2 URL objects +# Provided 1998/08/22 by +# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> +#0 string http: OS/2 URL object text +#>5 string >\ (WWW) <http:%s> +#0 string mailto: OS/2 URL object text +#>7 string >\ (email) <%s> +#0 string news: OS/2 URL object text +#>5 string >\ (Usenet) <%s> +#0 string ftp: OS/2 URL object text +#>4 string >\ (FTP) <ftp:%s> +#0 string file: OS/2 URL object text +#>5 string >\ (Local file) <%s> + +# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) +# Carl Hauser (chauser.parc@xerox.com) and +# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) +# list the following header format in inf02a.doc: +# +# int16 ID; // ID magic word (5348h = "HS") +# int8 unknown1; // unknown purpose, could be third letter of ID +# int8 flags; // probably a flag word... +# // bit 0: set if INF style file +# // bit 4: set if HLP style file +# // patching this byte allows reading HLP files +# // using the VIEW command, while help files +# // seem to work with INF settings here as well. +# int16 hdrsize; // total size of header +# int16 unknown2; // unknown purpose +# +0 string HSP\x01\x9b\x00 OS/2 INF +>107 string >0 (%s) +0 string HSP\x10\x9b\x00 OS/2 HLP +>107 string >0 (%s) + +# OS/2 INI (this is a guess) +0 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI diff --git a/magic/Magdir/os400 b/magic/Magdir/os400 new file mode 100644 index 0000000..6a05f08 --- /dev/null +++ b/magic/Magdir/os400 @@ -0,0 +1,39 @@ + +#------------------------------------------------------------------------------ +# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $ +# os400: file(1) magic for IBM OS/400 files +# +# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com +# In spite of its quite variable format (due to internal memory page +# length differences between CISC and RISC versions of the OS) the +# SAVF structure hasn't suitable offsets to identify the catalog +# header in the first descriptor where there are some useful infos, +# so we must search in a somewhat large area for a particular string +# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore +# descriptor space) preceded by a two byte constant. +# +1090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data +>&212 byte 0x01 \b, created with SAVOBJ +>&212 byte 0x02 \b, created with SAVLIB +>&212 byte 0x07 \b, created with SAVCFG +>&212 byte 0x08 \b, created with SAVSECDTA +>&212 byte 0x0A \b, created with SAVSECDTA +>&212 byte 0x0B \b, created with SAVDLO +>&212 byte 0x0D \b, created with SAVLICPGM +>&212 byte 0x11 \b, created with SAVCHGOBJ +>&213 byte 0x44 \b, at least V5R4 to open +>&213 byte 0x43 \b, at least V5R3 to open +>&213 byte 0x42 \b, at least V5R2 to open +>&213 byte 0x41 \b, at least V5R1 to open +>&213 byte 0x40 \b, at least V4R5 to open +>&213 byte 0x3F \b, at least V4R4 to open +>&213 byte 0x3E \b, at least V4R3 to open +>&213 byte 0x3C \b, at least V4R2 to open +>&213 byte 0x3D \b, at least V4R1M4 to open +>&213 byte 0x3B \b, at least V4R1 to open +>&213 byte 0x3A \b, at least V3R7 to open +>&213 byte 0x35 \b, at least V3R6 to open +>&213 byte 0x36 \b, at least V3R2 to open +>&213 byte 0x34 \b, at least V3R1 to open +>&213 byte 0x31 \b, at least V3R0M5 to open +>&213 byte 0x30 \b, at least V2R3 to open diff --git a/magic/Magdir/os9 b/magic/Magdir/os9 new file mode 100644 index 0000000..52b04be --- /dev/null +++ b/magic/Magdir/os9 @@ -0,0 +1,80 @@ + +#------------------------------------------------------------------------------ +# $File: os9,v 1.7 2011/05/13 22:15:54 christos Exp $ +# +# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR +# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES +# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. +# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; +# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF +# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# +# +# +# OS9/6809 module descriptions: +# +0 beshort 0x87CD OS9/6809 module: +# +>6 byte&0x0f 0x00 non-executable +>6 byte&0x0f 0x01 machine language +>6 byte&0x0f 0x02 BASIC I-code +>6 byte&0x0f 0x03 Pascal P-code +>6 byte&0x0f 0x04 C I-code +>6 byte&0x0f 0x05 COBOL I-code +>6 byte&0x0f 0x06 Fortran I-code +# +>6 byte&0xf0 0x10 program executable +>6 byte&0xf0 0x20 subroutine +>6 byte&0xf0 0x30 multi-module +>6 byte&0xf0 0x40 data module +# +>6 byte&0xf0 0xC0 system module +>6 byte&0xf0 0xD0 file manager +>6 byte&0xf0 0xE0 device driver +>6 byte&0xf0 0xF0 device descriptor +# +# OS9/m68k stuff (to be continued) +# +0 beshort 0x4AFC OS9/68K module: +# +# attr +>0x14 byte&0x80 0x80 re-entrant +>0x14 byte&0x40 0x40 ghost +>0x14 byte&0x20 0x20 system-state +# +# lang: +# +>0x13 byte 1 machine language +>0x13 byte 2 BASIC I-code +>0x13 byte 3 Pascal P-code +>0x13 byte 4 C I-code +>0x13 byte 5 COBOL I-code +>0x13 byte 6 Fortran I-code +# +# +# type: +# +>0x12 byte 1 program executable +>0x12 byte 2 subroutine +>0x12 byte 3 multi-module +>0x12 byte 4 data module +>0x12 byte 11 trap library +>0x12 byte 12 system module +>0x12 byte 13 file manager +>0x12 byte 14 device driver +>0x12 byte 15 device descriptor diff --git a/magic/Magdir/osf1 b/magic/Magdir/osf1 new file mode 100644 index 0000000..4e91471 --- /dev/null +++ b/magic/Magdir/osf1 @@ -0,0 +1,10 @@ + +#------------------------------------------------------------------------------ +# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $ +# +# Mach magic number info +# +0 long 0xefbe OSF/Rose object +# I386 magic number info +# +0 short 0565 i386 COFF object diff --git a/magic/Magdir/palm b/magic/Magdir/palm new file mode 100644 index 0000000..536f384 --- /dev/null +++ b/magic/Magdir/palm @@ -0,0 +1,99 @@ + +#------------------------------------------------------------------------------ +# $File: palm,v 1.9 2012/01/16 15:16:43 christos Exp $ +# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks +# +# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> + +# These are weak, byte 59 is not guaranteed to be 0 and there are +# 8 character identifiers at byte 60, one I found for appl is BIGb. +# What are the possibilities and where is this documented? + +# appl +#59 byte \0 +#>60 string appl PalmOS application +#>0 string >\0 "%s" +# TEXt +#59 byte \0 +#>60 belong TEXt AportisDoc file +#>0 string >\0 "%s" +# HACK +#59 byte \0 +#>60 string HACK HackMaster hack +#>0 string >\0 "%s" + +# Variety of PalmOS document types +# Michael-John Turner <mj@debian.org> +# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType +60 string BVokBDIC BDicty PalmOS document +>0 string >\0 "%s" +60 string DB99DBOS DB PalmOS document +>0 string >\0 "%s" +60 string vIMGView FireViewer/ImageViewer PalmOS document +>0 string >\0 "%s" +60 string PmDBPmDB HanDBase PalmOS document +>0 string >\0 "%s" +60 string InfoINDB InfoView PalmOS document +>0 string >\0 "%s" +60 string ToGoToGo iSilo PalmOS document +>0 string >\0 "%s" +60 string JfDbJBas JFile PalmOS document +>0 string >\0 "%s" +60 string JfDbJFil JFile Pro PalmOS document +>0 string >\0 "%s" +60 string DATALSdb List PalmOS document +>0 string >\0 "%s" +60 string Mdb1Mdb1 MobileDB PalmOS document +>0 string >\0 "%s" +60 string PNRdPPrs PeanutPress PalmOS document +>0 string >\0 "%s" +60 string DataPlkr Plucker PalmOS document +>0 string >\0 "%s" +60 string DataSprd QuickSheet PalmOS document +>0 string >\0 "%s" +60 string SM01SMem SuperMemo PalmOS document +>0 string >\0 "%s" +60 string TEXtTlDc TealDoc PalmOS document +>0 string >\0 "%s" +60 string InfoTlIf TealInfo PalmOS document +>0 string >\0 "%s" +60 string DataTlMl TealMeal PalmOS document +>0 string >\0 "%s" +60 string DataTlPt TealPaint PalmOS document +>0 string >\0 "%s" +60 string dataTDBP ThinkDB PalmOS document +>0 string >\0 "%s" +60 string TdatTide Tides PalmOS document +>0 string >\0 "%s" +60 string ToRaTRPW TomeRaider PalmOS document +>0 string >\0 "%s" + +# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) +# For version 1.xx zTXTs, outputs version and numbers of bookmarks and +# annotations. +# For other versions, just outputs version. +# +60 string zTXT A GutenPalm zTXT e-book +>0 string >\0 "%s" +>(0x4E.L) byte 0 +>>(0x4E.L+1) byte x (v0.%02d) +>(0x4E.L) byte 1 +>>(0x4E.L+1) byte x (v1.%02d) +>>>(0x4E.L+10) beshort >0 +>>>>(0x4E.L+10) beshort <2 - 1 bookmark +>>>>(0x4E.L+10) beshort >1 - %d bookmarks +>>>(0x4E.L+14) beshort >0 +>>>>(0x4E.L+14) beshort <2 - 1 annotation +>>>>(0x4E.L+14) beshort >1 - %d annotations +>(0x4E.L) byte >1 (v%d. +>>(0x4E.L+1) byte x %02d) + +# Palm OS .prc file types +60 string libr Palm OS dynamic library data +>0 string >\0 "%s" +60 string ptch Palm OS operating system patch data +>0 string >\0 "%s" + +# Mobipocket (www.mobipocket.com), donated by Carl Witty +60 string BOOKMOBI Mobipocket E-book +>0 string >\0 "%s" diff --git a/magic/Magdir/parix b/magic/Magdir/parix new file mode 100644 index 0000000..221f491 --- /dev/null +++ b/magic/Magdir/parix @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $ +# +# Parix COFF executables +# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> +# +0 beshort&0xfff 0xACE PARIX +>0 byte&0xf0 0x80 T800 +>0 byte&0xf0 0x90 T9000 +>19 byte&0x02 0x02 executable +>19 byte&0x02 0x00 object +>19 byte&0x0c 0x00 not stripped diff --git a/magic/Magdir/parrot b/magic/Magdir/parrot new file mode 100644 index 0000000..24e9236 --- /dev/null +++ b/magic/Magdir/parrot @@ -0,0 +1,22 @@ +#------------------------------------------------------------------------------ +# $File: parrot,v 1.1 2010/07/08 20:18:40 christos Exp $ +# parrot: file(1) magic for Parrot Virtual Machine +# URL: http://www.lua.org/ +# From: Lubomir Rintel <lkundrak@v3.sk> + +# Compiled Parrot byte code +0 string \376PBC\r\n\032\n Parrot bytecode +>64 byte x %d. +>72 byte x \b%d, +>8 byte >0 %d byte words, +>16 byte 0 little-endian, +>16 byte 1 big-endian, +>32 byte 0 IEEE-754 8 byte double floats, +>32 byte 1 x86 12 byte long double floats, +>32 byte 2 IEEE-754 16 byte long double floats, +>32 byte 3 MIPS 16 byte long double floats, +>32 byte 4 AIX 16 byte long double floats, +>32 byte 5 4-byte floats, +>40 byte x Parrot %d. +>48 byte x \b%d. +>56 byte x \b%d diff --git a/magic/Magdir/pascal b/magic/Magdir/pascal new file mode 100644 index 0000000..a134a47 --- /dev/null +++ b/magic/Magdir/pascal @@ -0,0 +1,10 @@ +#------------------------------------------------------------------------------ +# $File: pascal,v 1.1 2011/12/08 12:12:46 rrt Exp $ +# pascal: file(1) magic for Pascal source +# +0 search/8192 (input, Pascal source text +!:mime text/x-pascal +0 regex \^program Pascal source text +!:mime text/x-pascal +0 regex \^record Pascal source text +!:mime text/x-pascal diff --git a/magic/Magdir/pbm b/magic/Magdir/pbm new file mode 100644 index 0000000..40ecf49 --- /dev/null +++ b/magic/Magdir/pbm @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $ +# pbm: file(1) magic for Portable Bitmap files +# +# XXX - byte order? +# +0 short 0x2a17 "compact bitmap" format (Poskanzer) diff --git a/magic/Magdir/pdf b/magic/Magdir/pdf new file mode 100644 index 0000000..ccde22f --- /dev/null +++ b/magic/Magdir/pdf @@ -0,0 +1,16 @@ + +#------------------------------------------------------------------------------ +# $File: pdf,v 1.6 2009/09/19 16:28:11 christos Exp $ +# pdf: file(1) magic for Portable Document Format +# + +0 string %PDF- PDF document +!:mime application/pdf +>5 byte x \b, version %c +>7 byte x \b.%c + +# From: Nick Schmalenberger <nick@schmalenberger.us> +# Forms Data Format +0 string %FDF- FDF document +>5 byte x \b, version %c +>7 byte x \b.%c diff --git a/magic/Magdir/pdp b/magic/Magdir/pdp new file mode 100644 index 0000000..fa4b82b --- /dev/null +++ b/magic/Magdir/pdp @@ -0,0 +1,36 @@ + +#------------------------------------------------------------------------------ +# $File: pdp,v 1.8 2009/09/19 16:28:11 christos Exp $ +# pdp: file(1) magic for PDP-11 executable/object and APL workspace +# +0 lelong 0101555 PDP-11 single precision APL workspace +0 lelong 0101554 PDP-11 double precision APL workspace +# +# PDP-11 a.out +# +0 leshort 0407 PDP-11 executable +>8 leshort >0 not stripped +>15 byte >0 - version %ld + +0 leshort 0401 PDP-11 UNIX/RT ldp +0 leshort 0405 PDP-11 old overlay + +0 leshort 0410 PDP-11 pure executable +>8 leshort >0 not stripped +>15 byte >0 - version %ld + +0 leshort 0411 PDP-11 separate I&D executable +>8 leshort >0 not stripped +>15 byte >0 - version %ld + +0 leshort 0437 PDP-11 kernel overlay + +# These last three are derived from 2.11BSD file(1) +0 leshort 0413 PDP-11 demand-paged pure executable +>8 leshort >0 not stripped + +0 leshort 0430 PDP-11 overlaid pure executable +>8 leshort >0 not stripped + +0 leshort 0431 PDP-11 overlaid separate executable +>8 leshort >0 not stripped diff --git a/magic/Magdir/perl b/magic/Magdir/perl new file mode 100644 index 0000000..1d7bd31 --- /dev/null +++ b/magic/Magdir/perl @@ -0,0 +1,62 @@ +#------------------------------------------------------------------------------ +# $File: perl,v 1.20 2012/06/21 01:16:49 christos Exp $ +# perl: file(1) magic for Larry Wall's perl language. +# +# The `eval' lines recognizes an outrageously clever hack. +# Keith Waclena <keith@cerberus.uchicago.edu> +# Send additions to <perl5-porters@perl.org> +0 search/1/w #!\ /bin/perl Perl script text executable +!:mime text/x-perl +0 search/1 eval\ "exec\ /bin/perl Perl script text +!:mime text/x-perl +0 search/1/w #!\ /usr/bin/perl Perl script text executable +!:mime text/x-perl +0 search/1 eval\ "exec\ /usr/bin/perl Perl script text +!:mime text/x-perl +0 search/1/w #!\ /usr/local/bin/perl Perl script text executable +!:mime text/x-perl +0 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text +!:mime text/x-perl +0 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text +!:mime text/x-perl +0 search/1 #!/usr/bin/env\ perl Perl script text executable +!:mime text/x-perl +0 search/1 #!\ /usr/bin/env\ perl Perl script text executable +!:mime text/x-perl + +# by Dmitry V. Levin and Alexey Tourbin +# check the first line +0 search/1 package +>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text +!:strength + 10 +# not 'p', check other lines +0 search/1 !p +>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; +>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text +!:strength + 10 + +# Perl POD documents +# From: Tom Hukins <tom@eborcom.com> +0 search/1/W \=pod\n Perl POD document text +0 search/1/W \n\=pod\n Perl POD document text +0 search/1/W \=head1\ Perl POD document text +0 search/1/W \n\=head1\ Perl POD document text +0 search/1/W \=head2\ Perl POD document text +0 search/1/W \n\=head2\ Perl POD document text +0 search/1/W \=encoding\ Perl POD document text +0 search/1/W \n\=encoding\ Perl POD document text + + +# Perl Storable data files. +0 string perl-store perl Storable (v0.6) data +>4 byte >0 (net-order %d) +>>4 byte &01 (network-ordered) +>>4 byte =3 (major 1) +>>4 byte =2 (major 1) + +0 string pst0 perl Storable (v0.7) data +>4 byte >0 +>>4 byte &01 (network-ordered) +>>4 byte =5 (major 2) +>>4 byte =4 (major 2) +>>5 byte >0 (minor %d) diff --git a/magic/Magdir/pgp b/magic/Magdir/pgp new file mode 100644 index 0000000..a8d3c9a --- /dev/null +++ b/magic/Magdir/pgp @@ -0,0 +1,27 @@ + +#------------------------------------------------------------------------------ +# $File: pgp,v 1.9 2009/09/19 16:28:11 christos Exp $ +# pgp: file(1) magic for Pretty Good Privacy +# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html +# +0 beshort 0x9900 PGP key public ring +!:mime application/x-pgp-keyring +0 beshort 0x9501 PGP key security ring +!:mime application/x-pgp-keyring +0 beshort 0x9500 PGP key security ring +!:mime application/x-pgp-keyring +0 beshort 0xa600 PGP encrypted data +#!:mime application/pgp-encrypted +#0 string -----BEGIN\040PGP text/PGP armored data +!:mime text/PGP # encoding: armored data +#>15 string PUBLIC\040KEY\040BLOCK- public key block +#>15 string MESSAGE- message +#>15 string SIGNED\040MESSAGE- signed message +#>15 string PGP\040SIGNATURE- signature + +2 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block +!:mime application/pgp-keys +0 string -----BEGIN\040PGP\40MESSAGE- PGP message +!:mime application/pgp +0 string -----BEGIN\040PGP\40SIGNATURE- PGP signature +!:mime application/pgp-signature diff --git a/magic/Magdir/pkgadd b/magic/Magdir/pkgadd new file mode 100644 index 0000000..7dfb286 --- /dev/null +++ b/magic/Magdir/pkgadd @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $ +# pkgadd: file(1) magic for SysV R4 PKG Datastreams +# +0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) +!:mime application/x-svr4-package diff --git a/magic/Magdir/plan9 b/magic/Magdir/plan9 new file mode 100644 index 0000000..da5eb66 --- /dev/null +++ b/magic/Magdir/plan9 @@ -0,0 +1,18 @@ + +#------------------------------------------------------------------------------ +# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $ +# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables +# From: "Stefan A. Haubenthal" <polluks@web.de> +# +0 belong 0x00000107 Plan 9 executable, Motorola 68k +0 belong 0x000001EB Plan 9 executable, Intel 386 +0 belong 0x00000247 Plan 9 executable, Intel 960 +0 belong 0x000002AB Plan 9 executable, SPARC +0 belong 0x00000407 Plan 9 executable, MIPS R3000 +0 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 +0 belong 0x00000517 Plan 9 executable, MIPS R4000 BE +0 belong 0x000005AB Plan 9 executable, AMD 29000 +0 belong 0x00000647 Plan 9 executable, ARM 7-something +0 belong 0x000006EB Plan 9 executable, PowerPC +0 belong 0x00000797 Plan 9 executable, MIPS R4000 LE +0 belong 0x0000084B Plan 9 executable, DEC Alpha diff --git a/magic/Magdir/plus5 b/magic/Magdir/plus5 new file mode 100644 index 0000000..795cca1 --- /dev/null +++ b/magic/Magdir/plus5 @@ -0,0 +1,18 @@ + +#------------------------------------------------------------------------------ +# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $ +# plus5: file(1) magic for Plus Five's UNIX MUMPS +# +# XXX - byte order? Paging Hokey.... +# +0 short 0x259 mumps avl global +>2 byte >0 (V%d) +>6 byte >0 with %d byte name +>7 byte >0 and %d byte data cells +0 short 0x25a mumps blt global +>2 byte >0 (V%d) +>8 short >0 - %d byte blocks +>15 byte 0x00 - P/D format +>15 byte 0x01 - P/K/D format +>15 byte 0x02 - K/D format +>15 byte >0x02 - Bad Flags diff --git a/magic/Magdir/printer b/magic/Magdir/printer new file mode 100644 index 0000000..d9d39ee --- /dev/null +++ b/magic/Magdir/printer @@ -0,0 +1,134 @@ + +#------------------------------------------------------------------------------ +# $File: printer,v 1.25 2011/05/20 23:31:46 christos Exp $ +# printer: file(1) magic for printer-formatted files +# + +# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) +0 string %! PostScript document text +!:mime application/postscript +!:apple ASPSTEXT +>2 string PS-Adobe- conforming +>>11 string >\0 DSC level %.3s +>>>15 string EPS \b, type %s +>>>15 string Query \b, type %s +>>>15 string ExitServer \b, type %s +>>>15 search/1000 %%LanguageLevel:\ +>>>>&0 string >\0 \b, Level %s +# Some PCs have the annoying habit of adding a ^D as a document separator +0 string \004%! PostScript document text +!:mime application/postscript +!:apple ASPSTEXT +>3 string PS-Adobe- conforming +>>12 string >\0 DSC level %.3s +>>>16 string EPS \b, type %s +>>>16 string Query \b, type %s +>>>16 string ExitServer \b, type %s +>>>16 search/1000 %%LanguageLevel:\ +>>>>&0 string >\0 \b, Level %s +0 string \033%-12345X%!PS PostScript document + +# DOS EPS Binary File Header +# From: Ed Sznyter <ews@Black.Market.NET> +0 belong 0xC5D0D3C6 DOS EPS Binary File +>4 long >0 Postscript starts at byte %d +>>8 long >0 length %d +>>>12 long >0 Metafile starts at byte %d +>>>>16 long >0 length %d +>>>20 long >0 TIFF starts at byte %d +>>>>24 long >0 length %d + +# Summary: Adobe's PostScript Printer Description File +# Extension: .ppd +# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 +# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> +# +0 string *PPD-Adobe:\x20 PPD file +>&0 string x \b, version %s + +# HP Printer Job Language +0 string \033%-12345X@PJL HP Printer Job Language data +# HP Printer Job Language +# The header found on Win95 HP plot files is the "Silliest Thing possible" +# (TM) +# Every driver puts the language at some random position, with random case +# (LANGUAGE and Language) +# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 +# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> +# +0 string \033%-12345X@PJL HP Printer Job Language data +>&0 string >\0 %s +>>&0 string >\0 %s +>>>&0 string >\0 %s +>>>>&0 string >\0 %s +#>15 string \ ENTER\ LANGUAGE\ = +#>31 string PostScript PostScript + +# From: Stefan Thurner <thurners@nicsys.de> +0 string \033%-12345X@PJL +>&0 search/10000 %! PJL encapsulated PostScript document text + +# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) +0 string \033E\033 HP PCL printer data +>3 string \&l0A - default page size +>3 string \&l1A - US executive page size +>3 string \&l2A - US letter page size +>3 string \&l3A - US legal page size +>3 string \&l26A - A4 page size +>3 string \&l80A - Monarch envelope size +>3 string \&l81A - No. 10 envelope size +>3 string \&l90A - Intl. DL envelope size +>3 string \&l91A - Intl. C5 envelope size +>3 string \&l100A - Intl. B5 envelope size +>3 string \&l-81A - No. 10 envelope size (landscape) +>3 string \&l-90A - Intl. DL envelope size (landscape) + +# IMAGEN printer-ready files: +0 string @document( Imagen printer +# this only works if "language xxx" is first item in Imagen header. +>10 string language\ impress (imPRESS data) +>10 string language\ daisy (daisywheel text) +>10 string language\ diablo (daisywheel text) +>10 string language\ printer (line printer emulation) +>10 string language\ tektronix (Tektronix 4014 emulation) +# Add any other languages that your Imagen uses - remember +# to keep the word `text' if the file is human-readable. +# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] +# +# Now magic for IMAGEN font files... +0 string Rast RST-format raster font data +>45 string >0 face %s +# From Jukka Ukkonen +0 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data + +# From <mike@flyn.org> +# These are the /etc/magic entries to decode data sent to an Epson printer. +0 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data + + +#------------------------------------------------------------------------------ +# zenographics: file(1) magic for Zenographics ZjStream printer data +# Rick Richardson rickr@mn.rr.com +0 string JZJZ +>0x12 string ZZ Zenographics ZjStream printer data (big-endian) +0 string ZJZJ +>0x12 string ZZ Zenographics ZjStream printer data (little-endian) + + +#------------------------------------------------------------------------------ +# Oak Technologies printer stream +# Rick Richardson <rickr@mn.rr.com> +0 string OAK +>0x07 byte 0 +>0x0b byte 0 Oak Technologies printer stream + +# This would otherwise be recognized as PostScript - nick@debian.org +0 string %!VMF SunClock's Vector Map Format data + +#------------------------------------------------------------------------------ +# HP LaserJet 1000 series downloadable firmware file +0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware + +# From: Paolo <oopla@users.sf.net> +# Epson ESC/Page, ESC/PageColor +0 string \x1b\x01@EJL Epson ESC/Page language printer data diff --git a/magic/Magdir/project b/magic/Magdir/project new file mode 100644 index 0000000..efa5d40 --- /dev/null +++ b/magic/Magdir/project @@ -0,0 +1,10 @@ + +#------------------------------------------------------------------------------ +# $File: project,v 1.4 2009/09/19 16:28:11 christos Exp $ +# project: file(1) magic for Project management +# +# Magic strings for ftnchek project files. Alexander Mai +0 string FTNCHEK_\ P project file for ftnchek +>10 string 1 version 2.7 +>10 string 2 version 2.8 to 2.10 +>10 string 3 version 2.11 or later diff --git a/magic/Magdir/psdbms b/magic/Magdir/psdbms new file mode 100644 index 0000000..09c733f --- /dev/null +++ b/magic/Magdir/psdbms @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: psdbms,v 1.6 2009/09/19 16:28:11 christos Exp $ +# psdbms: file(1) magic for psdatabase +# +0 belong&0xff00ffff 0x56000000 ps database +>1 string >\0 version %s +>4 string >\0 from kernel %s diff --git a/magic/Magdir/pulsar b/magic/Magdir/pulsar new file mode 100644 index 0000000..7cb6f18 --- /dev/null +++ b/magic/Magdir/pulsar @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $ +# pulsar: file(1) magic for Pulsar POP3 daemon binary files +# +# http://pulsar.sourceforge.net +# mailto:rok.papez@lugos.si +# + +0 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. +>4 ubelong x Version: %d. +>8 ubelong x \b%d + diff --git a/magic/Magdir/pwsafe b/magic/Magdir/pwsafe new file mode 100644 index 0000000..93dcfb1 --- /dev/null +++ b/magic/Magdir/pwsafe @@ -0,0 +1,14 @@ + +#------------------------------------------------------------------------------ +# $File: pwsafe,v 1.1 2012/10/25 00:12:19 christos Exp $ +# pwsafe: file(1) magic for passwordsafe file +# +# Password Safe +# http://passwordsafe.sourceforge.net/ +# file format specs +# http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt +# V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt +# V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt +# V2 and V1 have no easy identifier that I can find +# .psafe3 +0 string PWS3 Password Safe V3 database diff --git a/magic/Magdir/pyramid b/magic/Magdir/pyramid new file mode 100644 index 0000000..ee47c80 --- /dev/null +++ b/magic/Magdir/pyramid @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $ +# pyramid: file(1) magic for Pyramids +# +# XXX - byte order? +# +0 long 0x50900107 Pyramid 90x family executable +0 long 0x50900108 Pyramid 90x family pure executable +>16 long >0 not stripped +0 long 0x5090010b Pyramid 90x family demand paged pure executable +>16 long >0 not stripped diff --git a/magic/Magdir/python b/magic/Magdir/python new file mode 100644 index 0000000..a882425 --- /dev/null +++ b/magic/Magdir/python @@ -0,0 +1,66 @@ + +#------------------------------------------------------------------------------ +# $File: python,v 1.21 2012/06/21 01:12:51 christos Exp $ +# python: file(1) magic for python +# +# Outlook puts """ too for urgent messages +# From: David Necas <yeti@physics.muni.cz> +# often the module starts with a multiline string +0 string/t """ Python script text executable +# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming +# that Py_UnicodeFlag is off for Python 2) +# 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n" +0 belong 0x994e0d0a python 1.5/1.6 byte-compiled +0 belong 0x87c60d0a python 2.0 byte-compiled +0 belong 0x2aeb0d0a python 2.1 byte-compiled +0 belong 0x2ded0d0a python 2.2 byte-compiled +0 belong 0x3bf20d0a python 2.3 byte-compiled +0 belong 0x6df20d0a python 2.4 byte-compiled +0 belong 0xb3f20d0a python 2.5 byte-compiled +0 belong 0xd1f20d0a python 2.6 byte-compiled +0 belong 0x03f30d0a python 2.7 byte-compiled +0 belong 0x3b0c0d0a python 3.0 byte-compiled +0 belong 0x4f0c0d0a python 3.1 byte-compiled +0 belong 0x6c0c0d0a python 3.2 byte-compiled + +0 search/1/w #!\ /usr/bin/python Python script text executable +!:mime text/x-python +0 search/1/w #!\ /usr/local/bin/python Python script text executable +!:mime text/x-python +0 search/1 #!/usr/bin/env\ python Python script text executable +!:mime text/x-python +0 search/1 #!\ /usr/bin/env\ python Python script text executable +!:mime text/x-python + + +# from module.submodule import func1, func2 +0 regex \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable +!:mime text/x-python + +# def __init__ (self, ...): +0 search/4096 def\ __init__ +>&0 search/64 self Python script text executable +!:mime text/x-python + +# comments +0 search/4096 ''' +>&0 regex .*'''$ Python script text executable +!:mime text/x-python + +0 search/4096 """ +>&0 regex .*"""$ Python script text executable +!:mime text/x-python + +# try: +# except: or finally: +# block +0 search/4096 try: +>&0 regex \^\\s*except.*: Python script text executable +!:mime text/x-python +>&0 search/4096 finally: Python script text executable +!:mime text/x-python + +# def name(args, args): +0 regex \^(\ |\\t)*def\ +[a-zA-Z]+ +>&0 regex \ *\\(([a-zA-Z]|,|\ )*\\):$ Python script text executable +!:mime text/x-python diff --git a/magic/Magdir/revision b/magic/Magdir/revision new file mode 100644 index 0000000..e4e4de1 --- /dev/null +++ b/magic/Magdir/revision @@ -0,0 +1,52 @@ + +#------------------------------------------------------------------------------ +# $File: revision,v 1.9 2013/02/06 14:18:52 christos Exp $ +# file(1) magic for revision control files +# From Hendrik Scholz <hendrik@scholz.net> +0 string/t /1\ :pserver: cvs password text file + +# Conary changesets +# From: Jonathan Smith <smithj@rpath.com> +0 belong 0xea3f81bb Conary changeset data + +# Type: Git bundles (git-bundle) +# From: Josh Triplett <josh@freedesktop.org> +0 string #\ v2\ git\ bundle\n Git bundle + +# Type: Git pack +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, +# those have a little-endian offset immediately following the magic 'PACK', +# the first byte of which is never 0, while the first byte of the Git pack +# version, since it's a tiny number stored in big-endian format, is always 0. +0 string PACK\0 Git pack +>4 belong >0 \b, version %d +>>8 belong >0 \b, %d objects + +# Type: Git pack index +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +0 string \377tOc Git pack index +>4 belong =2 \b, version 2 + +# Type: Git index file +# From: Frederic Briare <fbriere@fbriere.net> +0 string DIRC Git index +>4 belong >0 \b, version %d +>>8 belong >0 \b, %d entries + +# Type: Mercurial bundles +# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> +0 string HG10 Mercurial bundle, +>4 string UN uncompressed +>4 string BZ bzip2 compressed + +# Type: Subversion (SVN) dumps +# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de> +0 string SVN-fs-dump-format-version: Subversion dumpfile +>28 string >\0 (version: %s) + +# Type: Bazaar revision bundles and merge requests +# URL: http://www.bazaar-vcs.org/ +# From: Jelmer Vernooij <jelmer@samba.org> +0 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle +0 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive diff --git a/magic/Magdir/riff b/magic/Magdir/riff new file mode 100644 index 0000000..b41d0bd --- /dev/null +++ b/magic/Magdir/riff @@ -0,0 +1,258 @@ + +#------------------------------------------------------------------------------ +# $File: riff,v 1.23 2013/02/06 14:18:52 christos Exp $ +# riff: file(1) magic for RIFF format +# See +# +# http://www.seanet.com/users/matts/riffmci/riffmci.htm +# +# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi> +# +0 string RIFF RIFF (little-endian) data +# RIFF Palette format +>8 string PAL \b, palette +>>16 leshort x \b, version %d +>>18 leshort x \b, %d entries +# RIFF Device Independent Bitmap format +>8 string RDIB \b, device-independent bitmap +>>16 string BM +>>>30 leshort 12 \b, OS/2 1.x format +>>>>34 leshort x \b, %d x +>>>>36 leshort x %d +>>>30 leshort 64 \b, OS/2 2.x format +>>>>34 leshort x \b, %d x +>>>>36 leshort x %d +>>>30 leshort 40 \b, Windows 3.x format +>>>>34 lelong x \b, %d x +>>>>38 lelong x %d x +>>>>44 leshort x %d +# RIFF MIDI format +>8 string RMID \b, MIDI +# RIFF Multimedia Movie File format +>8 string RMMP \b, multimedia movie +# RIFF wrapper for MP3 +>8 string RMP3 \b, MPEG Layer 3 audio +# Microsoft WAVE format (*.wav) +>8 string WAVE \b, WAVE audio +!:mime audio/x-wav +>>20 leshort 1 \b, Microsoft PCM +>>>34 leshort >0 \b, %d bit +>>20 leshort 2 \b, Microsoft ADPCM +>>20 leshort 6 \b, ITU G.711 A-law +>>20 leshort 7 \b, ITU G.711 mu-law +>>20 leshort 8 \b, Microsoft DTS +>>20 leshort 17 \b, IMA ADPCM +>>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha) +>>20 leshort 49 \b, GSM 6.10 +>>20 leshort 64 \b, ITU G.721 ADPCM +>>20 leshort 80 \b, MPEG +>>20 leshort 85 \b, MPEG Layer 3 +>>20 leshort 0x2001 \b, DTS +>>22 leshort =1 \b, mono +>>22 leshort =2 \b, stereo +>>22 leshort >2 \b, %d channels +>>24 lelong >0 %d Hz +# Corel Draw Picture +>8 string CDRA \b, Corel Draw Picture +!:mime image/x-coreldraw +# AVI == Audio Video Interleave +>8 string AVI\040 \b, AVI +!:mime video/x-msvideo +>>12 string LIST +>>>20 string hdrlavih +>>>>&36 lelong x \b, %lu x +>>>>&40 lelong x %lu, +>>>>&4 lelong >1000000 <1 fps, +>>>>&4 lelong 1000000 1.00 fps, +>>>>&4 lelong 500000 2.00 fps, +>>>>&4 lelong 333333 3.00 fps, +>>>>&4 lelong 250000 4.00 fps, +>>>>&4 lelong 200000 5.00 fps, +>>>>&4 lelong 166667 6.00 fps, +>>>>&4 lelong 142857 7.00 fps, +>>>>&4 lelong 125000 8.00 fps, +>>>>&4 lelong 111111 9.00 fps, +>>>>&4 lelong 100000 10.00 fps, +# ]9.9,10.1[ +>>>>&4 lelong <101010 +>>>>>&-4 lelong >99010 +>>>>>>&-4 lelong !100000 ~10 fps, +>>>>&4 lelong 83333 12.00 fps, +# ]11.9,12.1[ +>>>>&4 lelong <84034 +>>>>>&-4 lelong >82645 +>>>>>>&-4 lelong !83333 ~12 fps, +>>>>&4 lelong 66667 15.00 fps, +# ]14.9,15.1[ +>>>>&4 lelong <67114 +>>>>>&-4 lelong >66225 +>>>>>>&-4 lelong !66667 ~15 fps, +>>>>&4 lelong 50000 20.00 fps, +>>>>&4 lelong 41708 23.98 fps, +>>>>&4 lelong 41667 24.00 fps, +# ]23.9,24.1[ +>>>>&4 lelong <41841 +>>>>>&-4 lelong >41494 +>>>>>>&-4 lelong !41708 +>>>>>>>&-4 lelong !41667 ~24 fps, +>>>>&4 lelong 40000 25.00 fps, +# ]24.9,25.1[ +>>>>&4 lelong <40161 +>>>>>&-4 lelong >39841 +>>>>>>&-4 lelong !40000 ~25 fps, +>>>>&4 lelong 33367 29.97 fps, +>>>>&4 lelong 33333 30.00 fps, +# ]29.9,30.1[ +>>>>&4 lelong <33445 +>>>>>&-4 lelong >33223 +>>>>>>&-4 lelong !33367 +>>>>>>>&-4 lelong !33333 ~30 fps, +>>>>&4 lelong <32224 >30 fps, +##>>>>&4 lelong x (%lu) +##>>>>&20 lelong x %lu frames, +# Note: The tests below assume that the AVI has 1 or 2 streams, +# "vids" optionally followed by "auds". +# (Should cover 99.9% of all AVIs.) +# assuming avih length = 56 +>>>88 string LIST +>>>>96 string strlstrh +>>>>>108 string vids video: +>>>>>>&0 lelong 0 uncompressed +# skip past vids strh +>>>>>>(104.l+108) string strf +>>>>>>>(104.l+132) lelong 1 RLE 8bpp +>>>>>>>(104.l+132) string/c cvid Cinepak +>>>>>>>(104.l+132) string/c i263 Intel I.263 +>>>>>>>(104.l+132) string/c iv32 Indeo 3.2 +>>>>>>>(104.l+132) string/c iv41 Indeo 4.1 +>>>>>>>(104.l+132) string/c iv50 Indeo 5.0 +>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 +>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 +>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 +>>>>>>>(104.l+132) string/c mjpg Motion JPEG +>>>>>>>(104.l+132) string/c div3 DivX 3 +>>>>>>>>112 string/c div3 Low-Motion +>>>>>>>>112 string/c div4 Fast-Motion +>>>>>>>(104.l+132) string/c divx DivX 4 +>>>>>>>(104.l+132) string/c dx50 DivX 5 +>>>>>>>(104.l+132) string/c xvid XviD +>>>>>>>(104.l+132) string/c h264 H.264 +>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 +>>>>>>>(104.l+132) string/c h264 X.264 or H.264 +>>>>>>>(104.l+132) lelong 0 +##>>>>>>>(104.l+132) string x (%.4s) +# skip past first (video) LIST +>>>>(92.l+96) string LIST +>>>>>(92.l+104) string strlstrh +>>>>>>(92.l+116) string auds \b, audio: +# auds strh length = 56: +>>>>>>>(92.l+172) string strf +>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM +>>>>>>>>(92.l+180) leshort 0x0002 ADPCM +>>>>>>>>(92.l+180) leshort 0x0006 aLaw +>>>>>>>>(92.l+180) leshort 0x0007 uLaw +>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 +>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 +>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 +>>>>>>>>(92.l+180) leshort 0x0161 DivX +##>>>>>>>>(92.l+180) leshort x (0x%.4x) +>>>>>>>>(92.l+182) leshort 1 (mono, +>>>>>>>>(92.l+182) leshort 2 (stereo, +>>>>>>>>(92.l+182) leshort >2 (%d channels, +>>>>>>>>(92.l+184) lelong x %d Hz) +# auds strh length = 64: +>>>>>>>(92.l+180) string strf +>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM +>>>>>>>>(92.l+188) leshort 0x0002 ADPCM +>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 +>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 +>>>>>>>>(92.l+188) leshort 0x0161 DivX +##>>>>>>>>(92.l+188) leshort x (0x%.4x) +>>>>>>>>(92.l+190) leshort 1 (mono, +>>>>>>>>(92.l+190) leshort 2 (stereo, +>>>>>>>>(92.l+190) leshort >2 (%d channels, +>>>>>>>>(92.l+192) lelong x %d Hz) +# Animated Cursor format +>8 string ACON \b, animated cursor +# SoundFont 2 <mpruett@sgi.com> +>8 string sfbk SoundFont/Bank +# MPEG-1 wrapped in a RIFF, apparently +>8 string CDXA \b, wrapped MPEG-1 (CDXA) +>8 string 4XMV \b, 4X Movie file +# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV +>8 string AMV\040 \b, AMV + +# +# XXX - some of the below may only appear in little-endian form. +# +# Also "MV93" appears to be for one form of Macromedia Director +# files, and "GDMF" appears to be another multimedia format. +# +0 string RIFX RIFF (big-endian) data +# RIFF Palette format +>8 string PAL \b, palette +>>16 beshort x \b, version %d +>>18 beshort x \b, %d entries +# RIFF Device Independent Bitmap format +>8 string RDIB \b, device-independent bitmap +>>16 string BM +>>>30 beshort 12 \b, OS/2 1.x format +>>>>34 beshort x \b, %d x +>>>>36 beshort x %d +>>>30 beshort 64 \b, OS/2 2.x format +>>>>34 beshort x \b, %d x +>>>>36 beshort x %d +>>>30 beshort 40 \b, Windows 3.x format +>>>>34 belong x \b, %d x +>>>>38 belong x %d x +>>>>44 beshort x %d +# RIFF MIDI format +>8 string RMID \b, MIDI +# RIFF Multimedia Movie File format +>8 string RMMP \b, multimedia movie +# Microsoft WAVE format (*.wav) +>8 string WAVE \b, WAVE audio +>>20 leshort 1 \b, Microsoft PCM +>>>34 leshort >0 \b, %d bit +>>22 beshort =1 \b, mono +>>22 beshort =2 \b, stereo +>>22 beshort >2 \b, %d channels +>>24 belong >0 %d Hz +# Corel Draw Picture +>8 string CDRA \b, Corel Draw Picture +# AVI == Audio Video Interleave +>8 string AVI\040 \b, AVI +# Animated Cursor format +>8 string ACON \b, animated cursor +# Notation Interchange File Format (big-endian only) +>8 string NIFF \b, Notation Interchange File Format +# SoundFont 2 <mpruett@sgi.com> +>8 string sfbk SoundFont/Bank + +#------------------------------------------------------------------------------ +# Sony Wave64 +# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf +# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian +0 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data +# 128 bit + total file size (64 bits) so 24 bytes +# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A } +>24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio +!:mime audio/x-w64 +# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A } +>>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b +>>>&10 leshort =1 \b, mono +>>>&10 leshort =2 \b, stereo +>>>&10 leshort >2 \b, %d channels +>>>&12 lelong >0 %d Hz + +#------------------------------------------------------------------------------ +# MBWF/RF64 +# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf +0 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio +!:mime audio/x-wav +>40 search/256 fmt\x20 \b +>>&6 leshort =1 \b, mono +>>&6 leshort =2 \b, stereo +>>&6 leshort >2 \b, %d channels +>>&8 lelong >0 %d Hz + diff --git a/magic/Magdir/rinex b/magic/Magdir/rinex new file mode 100644 index 0000000..c5f2bcb --- /dev/null +++ b/magic/Magdir/rinex @@ -0,0 +1,44 @@ + +#------------------------------------------------------------------------------ +# $File: rinex,v 1.4 2011/05/03 01:44:17 christos Exp $ +# rinex: file(1) magic for RINEX files +# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt +# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf +# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data +60 string RINEX +>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/broadcast +>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp) +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/observation +>80 search/256 XXRINEXC RINEX Data, Clock +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/clock +>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/navigation +>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/navigation +>80 search/256 XXRINEXL RINEX Data, Galileo Navigation +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/navigation +>80 search/256 XXRINEXM RINEX Data, Meteorological +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/meteorological +>80 search/256 XXRINEXN RINEX Data, Navigation +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/navigation +>80 search/256 XXRINEXO RINEX Data, Observation +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/observation diff --git a/magic/Magdir/rpm b/magic/Magdir/rpm new file mode 100644 index 0000000..9a795f8 --- /dev/null +++ b/magic/Magdir/rpm @@ -0,0 +1,45 @@ + +#------------------------------------------------------------------------------ +# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $ +# +# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) +# +0 belong 0xedabeedb RPM +!:mime application/x-rpm +>4 byte x v%d +>5 byte x \b.%d +>6 beshort 1 src +>6 beshort 0 bin +>>8 beshort 1 i386/x86_64 +>>8 beshort 2 Alpha/Sparc64 +>>8 beshort 3 Sparc +>>8 beshort 4 MIPS +>>8 beshort 5 PowerPC +>>8 beshort 6 68000 +>>8 beshort 7 SGI +>>8 beshort 8 RS6000 +>>8 beshort 9 IA64 +>>8 beshort 10 Sparc64 +>>8 beshort 11 MIPSel +>>8 beshort 12 ARM +>>8 beshort 13 MiNT +>>8 beshort 14 S/390 +>>8 beshort 15 S/390x +>>8 beshort 16 PowerPC64 +>>8 beshort 17 SuperH +>>8 beshort 18 Xtensa +>>8 beshort 255 noarch + +#delta RPM Daniel Novotny (dnovotny@redhat.com) +0 string drpm Delta RPM +!:mime application/x-rpm +>12 string x %s +>>8 beshort 11 MIPSel +>>8 beshort 12 ARM +>>8 beshort 13 MiNT +>>8 beshort 14 S/390 +>>8 beshort 15 S/390x +>>8 beshort 16 PowerPC64 +>>8 beshort 17 SuperH +>>8 beshort 18 Xtensa +>>10 string x %s diff --git a/magic/Magdir/rtf b/magic/Magdir/rtf new file mode 100644 index 0000000..dca3195 --- /dev/null +++ b/magic/Magdir/rtf @@ -0,0 +1,16 @@ + +#------------------------------------------------------------------------------ +# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $ +# rtf: file(1) magic for Rich Text Format (RTF) +# +# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk +# +0 string {\\rtf Rich Text Format data, +!:mime text/rtf +>5 string 1 version 1, +>>6 string \\ansi ANSI +>>6 string \\mac Apple Macintosh +>>6 string \\pc IBM PC, code page 437 +>>6 string \\pca IBM PS/2, code page 850 +>>6 default x unknown character set +>5 default x unknown version diff --git a/magic/Magdir/ruby b/magic/Magdir/ruby new file mode 100644 index 0000000..26630f3 --- /dev/null +++ b/magic/Magdir/ruby @@ -0,0 +1,28 @@ + +#------------------------------------------------------------------------------ +# $File: ruby,v 1.5 2010/07/21 16:47:17 christos Exp $ +# ruby: file(1) magic for Ruby scripting language +# URL: http://www.ruby-lang.org/ +# From: Reuben Thomas <rrt@sc3d.org> + +# Ruby scripts +0 search/1/w #!\ /usr/bin/ruby Ruby script text executable +!:mime text/x-ruby +0 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable +!:mime text/x-ruby +0 search/1 #!/usr/bin/env\ ruby Ruby script text executable +!:mime text/x-ruby +0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable +!:mime text/x-ruby + +# What looks like ruby, but does not have a shebang +# (modules and such) +# From: Lubomir Rintel <lkundrak@v3.sk> +0 regex \^[\ \t]*require[\ \t]'[A-Za-z_/]+' +>0 regex include\ [A-Z]|def\ [a-z]|\ do$ +>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby script text +!:mime text/x-ruby +0 regex \^[\ \t]*(class|module)[\ \t][A-Z] +>0 regex (modul|includ)e\ [A-Z]|def\ [a-z] +>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby module source text +!:mime text/x-ruby diff --git a/magic/Magdir/sc b/magic/Magdir/sc new file mode 100644 index 0000000..dc6d6c8 --- /dev/null +++ b/magic/Magdir/sc @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $ +# sc: file(1) magic for "sc" spreadsheet +# +38 string Spreadsheet sc spreadsheet file +!:mime application/x-sc diff --git a/magic/Magdir/sccs b/magic/Magdir/sccs new file mode 100644 index 0000000..95b3a5d --- /dev/null +++ b/magic/Magdir/sccs @@ -0,0 +1,22 @@ + +#------------------------------------------------------------------------------ +# $File: sccs,v 1.6 2009/09/19 16:28:12 christos Exp $ +# sccs: file(1) magic for SCCS archives +# +# SCCS archive structure: +# \001h01207 +# \001s 00276/00000/00000 +# \001d D 1.1 87/09/23 08:09:20 ian 1 0 +# \001c date and time created 87/09/23 08:09:20 by ian +# \001e +# \001u +# \001U +# ... etc. +# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). +# *Sigh*. And these both came from various parts of the USG. +# Maybe we should just switch everybody from SCCS to RCS! +# Further, you can't just say '\001h0', because the five-digit number +# is a checksum that could (presumably) have any leading digit, +# and we don't have regular expression matching yet. +# Hence the following official kludge: +8 string \001s\ SCCS archive data diff --git a/magic/Magdir/scientific b/magic/Magdir/scientific new file mode 100644 index 0000000..7418f1b --- /dev/null +++ b/magic/Magdir/scientific @@ -0,0 +1,106 @@ + +#------------------------------------------------------------------------------ +# $File: scientific,v 1.7 2010/09/20 19:19:17 rrt Exp $ +# scientific: file(1) magic for scientific formats +# +# From: Joe Krahn <krahn@niehs.nih.gov> + +######################################################## +# CCP4 data and plot files: +0 string MTZ\040 MTZ reflection file + +92 string PLOT%%84 Plot84 plotting file +>52 byte 1 , Little-endian +>55 byte 1 , Big-endian + +######################################################## +# Electron density MAP/MASK formats + +0 string EZD_MAP NEWEZD Electron Density Map +109 string MAP\040( Old EZD Electron Density Map + +0 string/c :-)\040Origin BRIX Electron Density Map +>170 string >0 , Sigma:%.12s +#>4 string >0 %.178s +#>4 addr x %.178s + +7 string 18\040!NTITLE XPLOR ASCII Electron Density Map +9 string \040!NTITLE\012\040REMARK CNS ASCII electron density map + +208 string MAP\040 CCP4 Electron Density Map +# Assumes same stamp for float and double (normal case) +>212 byte 17 \b, Big-endian +>212 byte 34 \b, VAX format +>212 byte 68 \b, Little-endian +>212 byte 85 \b, Convex native + +############################################################ +# X-Ray Area Detector images +0 string R-AXIS4\ \ \ R-Axis Area Detector Image: +>796 lelong <20 Little-endian, IP #%d, +>>768 lelong >0 Size=%dx +>>772 lelong >0 \b%d +>796 belong <20 Big-endian, IP #%d, +>>768 belong >0 Size=%dx +>>772 belong >0 \b%d + +0 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: +>796 lelong <20 Little-endian, IP #%d, +>>768 lelong >0 Size=%dx +>>772 lelong >0 \b%d +>796 belong <20 Big-endian, IP #%d, +>>768 belong >0 Size=%dx +>>772 belong >0 \b%d + + +1028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, +>1072 ulong >1 Compressed(%d), +>1100 ulong >1 %d headers, +>1104 ulong >0 %d x +>1108 ulong >0 %d, +>1120 ulong >0 %d bits/pixel + +# Type: GEDCOM genealogical (family history) data +# From: Giuseppe Bilotta +0 search/1/c 0\ HEAD GEDCOM genealogy text +>&0 search 1\ GEDC +>>&0 search 2\ VERS version +>>>&1 search/1 >\0 %s +# From: Phil Endecott <phil05@chezphil.org> +0 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data +0 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data +0 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data +0 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data + +# PDB: Protein Data Bank files +# Adam Buchbinder <adam.buchbinder@gmail.com> +# +# http://www.wwpdb.org/documentation/format32/sect2.html +# http://www.ch.ic.ac.uk/chemime/ +# +# The PDB file format is fixed-field, 80 columns. From the spec: +# +# COLS DATA +# 1 - 6 "HEADER" +# 11 - 50 String(40) +# 51 - 59 Date +# 63 - 66 IDcode +# +# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the +# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and +# uppercase letters. However, examples have been seen without the date string, +# e.g., the example on the chemime site. +0 string HEADER\ \ \ \ +>&0 regex/1 \^.{40} +>>&0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3} +>>>&0 regex/1s [A-Z0-9]{4}.{14}$ +>>>>&0 regex/1 [A-Z0-9]{4} Protein Data Bank data, ID Code %s +!:mime chemical/x-pdb +>>>>0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s + +# Type: GDSII Stream file +0 belong 0x00060002 GDSII Stream file +>4 byte 0x00 +>>5 byte x version %d.0 +>4 byte >0x00 version %d +>>5 byte x \b.%d diff --git a/magic/Magdir/securitycerts b/magic/Magdir/securitycerts new file mode 100644 index 0000000..8785dd8 --- /dev/null +++ b/magic/Magdir/securitycerts @@ -0,0 +1,6 @@ + +#------------------------------------------------------------------------------ +# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $ +0 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text +0 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text +0 belong 0xedfeedfe Sun 'jks' Java Keystore File data diff --git a/magic/Magdir/selinux b/magic/Magdir/selinux new file mode 100644 index 0000000..5f22946 --- /dev/null +++ b/magic/Magdir/selinux @@ -0,0 +1,24 @@ +# Type: SE Linux policy modules *.pp reference policy +# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny. +# URL: http://doc.coker.com.au/computers/selinux-magic +# From: Russell Coker <russell@coker.com.au> + +0 lelong 0xf97cff8f SE Linux modular policy +>4 lelong x version %d, +>8 lelong x %d sections, +>>(12.l) lelong 0xf97cff8d +>>>(12.l+27) lelong x mod version %d, +>>>(12.l+31) lelong 0 Not MLS, +>>>(12.l+31) lelong 1 MLS, +>>>(12.l+23) lelong 2 +>>>>(12.l+47) string >\0 module name %s +>>>(12.l+23) lelong 1 base + +1 string policy_module( SE Linux policy module source +2 string policy_module( SE Linux policy module source + +0 string ##\ <summary> SE Linux policy interface source + +#0 search gen_context( SE Linux policy file contexts + +#0 search gen_sens( SE Linux policy MLS constraints source diff --git a/magic/Magdir/sendmail b/magic/Magdir/sendmail new file mode 100644 index 0000000..aeb6203 --- /dev/null +++ b/magic/Magdir/sendmail @@ -0,0 +1,20 @@ + +#------------------------------------------------------------------------------ +# $File: sendmail,v 1.7 2009/09/19 16:28:12 christos Exp $ +# sendmail: file(1) magic for sendmail config files +# +# XXX - byte order? +# +0 byte 046 Sendmail frozen configuration +>16 string >\0 - version %s +0 short 0x271c Sendmail frozen configuration +>16 string >\0 - version %s + +#------------------------------------------------------------------------------ +# sendmail: file(1) magic for sendmail m4(1) files +# +# From Hendrik Scholz <hendrik@scholz.net> +# i.e. files in /usr/share/sendmail/cf/ +# +0 string divert(-1)\n sendmail m4 text file + diff --git a/magic/Magdir/sequent b/magic/Magdir/sequent new file mode 100644 index 0000000..0ce6bf2 --- /dev/null +++ b/magic/Magdir/sequent @@ -0,0 +1,35 @@ + +#------------------------------------------------------------------------------ +# $File: sequent,v 1.8 2009/09/19 16:28:12 christos Exp $ +# sequent: file(1) magic for Sequent machines +# +# Sequent information updated by Don Dwiggins <atsun!dwiggins>. +# For Sequent's multiprocessor systems (incomplete). +0 lelong 0x00ea BALANCE NS32000 .o +>16 lelong >0 not stripped +>124 lelong >0 version %ld +0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) +>16 lelong >0 not stripped +>124 lelong >0 version %ld +0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) +>16 lelong >0 not stripped +>124 lelong >0 version %ld +0 lelong 0x30ea BALANCE NS32000 standalone executable +>16 lelong >0 not stripped +>124 lelong >0 version %ld +# +# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. +# Symmetry magic nums will not be reached if DOS COM comes before them; +# byte 0xeb is matched before these get a chance. +0 leshort 0x12eb SYMMETRY i386 .o +>16 lelong >0 not stripped +>124 lelong >0 version %ld +0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) +>16 lelong >0 not stripped +>124 lelong >0 version %ld +0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) +>16 lelong >0 not stripped +>124 lelong >0 version %ld +0 leshort 0x42eb SYMMETRY i386 standalone executable +>16 lelong >0 not stripped +>124 lelong >0 version %ld diff --git a/magic/Magdir/sgi b/magic/Magdir/sgi new file mode 100644 index 0000000..40aae0b --- /dev/null +++ b/magic/Magdir/sgi @@ -0,0 +1,138 @@ + +#------------------------------------------------------------------------------ +# $File: sgi,v 1.19 2013/01/12 03:09:51 christos Exp $ +# sgi: file(1) magic for Silicon Graphics operating systems and applications +# +# Executable images are handled either in aout (for old-style a.out +# files for 68K; they are indistinguishable from other big-endian 32-bit +# a.out files) or in mips (for MIPS ECOFF and Ucode files) +# + +# kbd file definitions +0 string kbd!map kbd map file +>8 byte >0 Ver %d: +>10 short >0 with %d table(s) + +0 beshort 0x8765 disk quotas file + +0 beshort 0x0506 IRIS Showcase file +>2 byte 0x49 - +>3 byte x - version %ld +0 beshort 0x0226 IRIS Showcase template +>2 byte 0x63 - +>3 byte x - version %ld +0 belong 0x5343464d IRIS Showcase file +>4 byte x - version %ld +0 belong 0x5443464d IRIS Showcase template +>4 byte x - version %ld +0 belong 0xdeadbabe IRIX Parallel Arena +>8 belong >0 - version %ld + +# core files +# +# 32bit core file +0 belong 0xdeadadb0 IRIX core dump +>4 belong 1 of +>16 string >\0 '%s' +# 64bit core file +0 belong 0xdeadad40 IRIX 64-bit core dump +>4 belong 1 of +>16 string >\0 '%s' +# N32bit core file +0 belong 0xbabec0bb IRIX N32 core dump +>4 belong 1 of +>16 string >\0 '%s' +# New style crash dump file +0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of +>36 string >\0 '%s' + +# Trusted IRIX info +0 string SGIAUDIT SGI Audit file +>8 byte x - version %d +>9 byte x \b.%ld +# +0 string WNGZWZSC Wingz compiled script +0 string WNGZWZSS Wingz spreadsheet +0 string WNGZWZHP Wingz help file +# +0 string #Inventor V IRIS Inventor 1.0 file +0 string #Inventor V2 Open Inventor 2.0 file +# GLF is OpenGL stream encoding +0 string glfHeadMagic(); GLF_TEXT +4 belong 0x7d000000 GLF_BINARY_LSB_FIRST +!:strength -30 +4 belong 0x0000007d GLF_BINARY_MSB_FIRST +!:strength -30 +# GLS is OpenGL stream encoding; GLS is the successor of GLF +0 string glsBeginGLS( GLS_TEXT +4 belong 0x10000000 GLS_BINARY_LSB_FIRST +!:strength -30 +4 belong 0x00000010 GLS_BINARY_MSB_FIRST +!:strength -30 + +# +# +# Performance Co-Pilot file types +0 string PmNs PCP compiled namespace (V.0) +0 string PmN PCP compiled namespace +>3 string >\0 (V.%1.1s) +#3 lelong 0x84500526 PCP archive +3 belong 0x84500526 PCP archive +>7 byte x (V.%d) +#>20 lelong -2 temporal index +#>20 lelong -1 metadata +#>20 lelong 0 log volume #0 +#>20 lelong >0 log volume #%ld +>20 belong -2 temporal index +>20 belong -1 metadata +>20 belong 0 log volume #0 +>20 belong >0 log volume #%ld +>24 string >\0 host: %s +0 string PCPFolio PCP +>9 string Version: Archive Folio +>18 string >\0 (V.%s) +0 string #pmchart PCP pmchart view +>9 string Version +>17 string >\0 (V%-3.3s) +0 string #kmchart PCP kmchart view +>9 string Version +>17 string >\0 (V.%s) +0 string pmview PCP pmview config +>7 string Version +>15 string >\0 (V%-3.3s) +0 string #pmlogger PCP pmlogger config +>10 string Version +>18 string >\0 (V%1.1s) +0 string #pmdahotproc PCP pmdahotproc config +>13 string Version +>21 string >\0 (V%-3.3s) +0 string PcPh PCP Help +>4 string 1 Index +>4 string 2 Text +>5 string >\0 (V.%1.1s) +0 string #pmieconf-rules PCP pmieconf rules +>16 string >\0 (V.%1.1s) +3 string pmieconf-pmie PCP pmie config +>17 string >\0 (V.%1.1s) + +# SpeedShop data files +0 lelong 0x13130303 SpeedShop data file + +# mdbm files +0 lelong 0x01023962 mdbm file, version 0 (obsolete) +0 string mdbm mdbm file, +>5 byte x version %d, +>6 byte x 2^%d pages, +>7 byte x pagesize 2^%d, +>17 byte x hash %d, +>11 byte x dataformat %d + +# Alias Maya files +0 string/t //Maya ASCII Alias Maya Ascii File, +>13 string >\0 version %s +8 string MAYAFOR4 Alias Maya Binary File, +>32 string >\0 version %s scene +8 string MayaFOR4 Alias Maya Binary File, +>32 string >\0 version %s scene +8 string CIMG Alias Maya Image File +8 string DEEP Alias Maya Image File diff --git a/magic/Magdir/sgml b/magic/Magdir/sgml new file mode 100644 index 0000000..8b3b91a --- /dev/null +++ b/magic/Magdir/sgml @@ -0,0 +1,101 @@ +#------------------------------------------------------------------------------ +# $File: sgml,v 1.29 2012/08/26 10:25:41 christos Exp $ +# Type: SVG Vectorial Graphics +# From: Noel Torres <tecnico@ejerciciosresueltos.com> +0 string \<?xml\ version=" +>15 string >\0 +>>19 search/4096 \<svg SVG Scalable Vector Graphics image +!:mime image/svg+xml +>>19 search/4096 \<gnc-v2 GnuCash file +!:mime application/x-gnucash + +# Sitemap file +0 string/t \<?xml\ version=" +>15 string >\0 +>>19 search/4096 \<urlset XML Sitemap document text +!:mime application/xml-sitemap + +# xhtml +0 string/t \<?xml\ version=" +>15 string >\0 +>>19 search/4096/cWbt \<!doctype\ html XHTML document text +!:mime text/html +0 string/t \<?xml\ version=' +>15 string >\0 +>>19 search/4096/cWbt \<!doctype\ html XHTML document text +!:mime text/html +0 string/t \<?xml\ version=" +>15 string >\0 +>>19 search/4096/cWbt \<html broken XHTML document text +!:mime text/html + +#------------------------------------------------------------------------------ +# sgml: file(1) magic for Standard Generalized Markup Language +# HyperText Markup Language (HTML) is an SGML document type, +# from Daniel Quinlan (quinlan@yggdrasil.com) +# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) +0 search/4096/cWt \<!doctype\ html HTML document text +!:mime text/html +!:strength + 5 +0 search/4096/cwt \<head HTML document text +!:mime text/html +!:strength + 5 +0 search/4096/cwt \<title HTML document text +!:mime text/html +!:strength + 5 +0 search/4096/cwt \<html HTML document text +!:mime text/html +!:strength + 5 +0 search/4096/cwt \<script HTML document text +!:mime text/html +!:strength + 5 +0 search/4096/cwt \<style HTML document text +!:mime text/html +!:strength + 5 +0 search/4096/cwt \<table HTML document text +!:mime text/html +!:strength + 5 +0 search/4096/cwt \<a\ href= HTML document text +!:mime text/html +!:strength + 5 + +# Extensible markup language (XML), a subset of SGML +# from Marc Prud'hommeaux (marc@apocalypse.org) +0 search/1/cwt \<?xml XML document text +!:mime application/xml +!:strength + 5 +0 string/t \<?xml\ version\ " XML +!:mime application/xml +!:strength + 5 +0 string/t \<?xml\ version=" XML +!:mime application/xml +!:strength + 5 +>15 string/t >\0 %.3s document text +>>23 search/1 \<xsl:stylesheet (XSL stylesheet) +>>24 search/1 \<xsl:stylesheet (XSL stylesheet) +0 string \<?xml\ version=' XML +!:mime application/xml +!:strength + 5 +>15 string/t >\0 %.3s document text +>>23 search/1 \<xsl:stylesheet (XSL stylesheet) +>>24 search/1 \<xsl:stylesheet (XSL stylesheet) +0 search/1/wbt \<?xml XML document text +!:mime application/xml +!:strength - 10 +0 search/1/wt \<?XML broken XML document text +!:mime application/xml +!:strength - 10 + + +# SGML, mostly from rph@sq +0 search/4096/cwt \<!doctype exported SGML document text +0 search/4096/cwt \<!subdoc exported SGML subdocument text +0 search/4096/cwt \<!-- exported SGML document text +!:strength - 10 + +# Web browser cookie files +# (Mozilla, Galeon, Netscape 4, Konqueror..) +# Ulf Harnhammar <ulfh@update.uu.se> +0 search/1 #\ HTTP\ Cookie\ File Web browser cookie text +0 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text +0 search/1 #\ KDE\ Cookie\ File Konqueror cookie text diff --git a/magic/Magdir/sharc b/magic/Magdir/sharc new file mode 100644 index 0000000..d5f3604 --- /dev/null +++ b/magic/Magdir/sharc @@ -0,0 +1,23 @@ + +#------------------------------------------------------------------------ +# $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $ +# file(1) magic for sharc files +# +# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by +# FutureGroove Music (dsp@futuregroove.de) + +#------------------------------------------------------------------------ +#0 string Draw RiscOS Drawfile +#0 string PACK RiscOS PackdDir archive + +#------------------------------------------------------------------------ +# SHARC DSP stuff (based on the FGM SHARC DSP SDK) + +#0 string =! Assembler source +#0 string Analog ADi asm listing file +0 string .SYSTEM SHARC architecture file +0 string .system SHARC architecture file + +0 leshort 0x521C SHARC COFF binary +>2 leshort >1 , %hd sections +>>12 lelong >0 , not stripped diff --git a/magic/Magdir/sinclair b/magic/Magdir/sinclair new file mode 100644 index 0000000..5882a64 --- /dev/null +++ b/magic/Magdir/sinclair @@ -0,0 +1,45 @@ + +#------------------------------------------------------------------------------ +# $File: sinclair,v 1.5 2009/09/19 16:28:12 christos Exp $ +# sinclair: file(1) sinclair QL + +# additions to /etc/magic by Thomas M. Ott (ThMO) + +# Sinclair QL floppy disk formats (ThMO) +0 string =QL5 QL disk dump data, +>3 string =A 720 KB, +>3 string =B 1.44 MB, +>3 string =C 3.2 MB, +>4 string >\0 label:%.10s + +# Sinclair QL OS dump (ThMO) +# (NOTE: if `file' would be able to use indirect references in a endian format +# differing from the natural host format, this could be written more +# reliably and faster...) +# +# we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more +# than the first 8K of a file... #-( +# +#0 belong =0x30000 +#>49124 belong <47104 +#>>49128 belong <47104 +#>>>49132 belong <47104 +#>>>>49136 belong <47104 QL OS dump data, +#>>>>>49148 string >\0 type %.3s, +#>>>>>49142 string >\0 version %.4s + +# Sinclair QL firmware executables (ThMO) +0 string NqNqNq`\004 QL firmware executable (BCPL) + +# Sinclair QL libraries (was ThMO) +0 beshort 0xFB01 QDOS object +>2 pstring x '%s' + +# Sinclair QL executables (was ThMO) +4 belong 0x4AFB QDOS executable +>9 pstring x '%s' + +# Sinclair QL ROM (ThMO) +0 belong =0x4AFB0001 QL plugin-ROM data, +>9 pstring =\0 un-named +>9 pstring >\0 named: %s diff --git a/magic/Magdir/sisu b/magic/Magdir/sisu new file mode 100644 index 0000000..ba7104f --- /dev/null +++ b/magic/Magdir/sisu @@ -0,0 +1,18 @@ +# Type: SiSU Markup Language +# URL: http://www.sisudoc.org/ +# From: Ralph Amissah <ralph.amissah@gmail.com> + +0 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert +>5 regex [0-9.]+ %s + +0 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master +>5 regex [0-9.]+ %s + +0 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text +>5 regex [0-9.]+ %s + +0 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text +>5 regex [0-9.]+ %s + +0 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text +>5 regex [0-9.]+ %s diff --git a/magic/Magdir/sketch b/magic/Magdir/sketch new file mode 100644 index 0000000..82dacb8 --- /dev/null +++ b/magic/Magdir/sketch @@ -0,0 +1,6 @@ + +#------------------------------------------------------------------------------ +# $File: sketch,v 1.4 2009/09/19 16:28:12 christos Exp $ +# Sketch Drawings: http://sketch.sourceforge.net/ +# From: Edwin Mons <e@ik.nu> +0 search/1 ##Sketch Sketch document text diff --git a/magic/Magdir/smalltalk b/magic/Magdir/smalltalk new file mode 100644 index 0000000..9ff2c6b --- /dev/null +++ b/magic/Magdir/smalltalk @@ -0,0 +1,25 @@ + +#----------------------------------------------- +# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $ +# GNU Smalltalk image, starting at version 1.6.2 +# From: catull_us@yahoo.com +# +0 string GSTIm\0\0 GNU SmallTalk +# little-endian +>7 byte&1 =0 LE image version +>>10 byte x %d. +>>9 byte x \b%d. +>>8 byte x \b%d +#>>12 lelong x , data: %ld +#>>16 lelong x , table: %ld +#>>20 lelong x , memory: %ld +# big-endian +>7 byte&1 =1 BE image version +>>8 byte x %d. +>>9 byte x \b%d. +>>10 byte x \b%d +#>>12 belong x , data: %ld +#>>16 belong x , table: %ld +#>>20 belong x , memory: %ld + + diff --git a/magic/Magdir/smile b/magic/Magdir/smile new file mode 100644 index 0000000..d196de5 --- /dev/null +++ b/magic/Magdir/smile @@ -0,0 +1,34 @@ + +#------------------------------------------------------------------------------ +# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $ +# smile: file(1) magic for Smile serialization +# +# The Smile serialization format uses a 4-byte header: +# +# Constant byte #0: 0x3A (ASCII ':') +# Constant byte #1: 0x29 (ASCII ')') +# Constant byte #2: 0x0A (ASCII linefeed, '\n') +# Variable byte #3, consisting of bits: +# Bits 4-7 (4 MSB): 4-bit version number +# Bits 3: Reserved +# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content +# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false +# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true +# +# Reference: http://wiki.fasterxml.com/SmileFormatSpec +# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org> + +# Detection +0 string :)\n Smile binary data + +# Versioning +>3 byte&0xF0 x version %d: + +# Properties +>3 byte&0x04 0x04 binary raw, +>3 byte&0x04 0x00 binary encoded, +>3 byte&0x02 0x02 shared String values enabled, +>3 byte&0x02 0x00 shared String values disabled, +>3 byte&0x01 0x01 shared field names enabled +>3 byte&0x01 0x00 shared field names disabled + diff --git a/magic/Magdir/sniffer b/magic/Magdir/sniffer new file mode 100644 index 0000000..34eb7c4 --- /dev/null +++ b/magic/Magdir/sniffer @@ -0,0 +1,271 @@ + +#------------------------------------------------------------------------------ +# $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $ +# sniffer: file(1) magic for packet capture files +# +# From: guy@alum.mit.edu (Guy Harris) +# + +# +# Microsoft Network Monitor 1.x capture files. +# +0 string RTSS NetMon capture file +>5 byte x - version %d +>4 byte x \b.%d +>6 leshort 0 (Unknown) +>6 leshort 1 (Ethernet) +>6 leshort 2 (Token Ring) +>6 leshort 3 (FDDI) +>6 leshort 4 (ATM) +>6 leshort >4 (type %d) + +# +# Microsoft Network Monitor 2.x capture files. +# +0 string GMBU NetMon capture file +>5 byte x - version %d +>4 byte x \b.%d +>6 leshort 0 (Unknown) +>6 leshort 1 (Ethernet) +>6 leshort 2 (Token Ring) +>6 leshort 3 (FDDI) +>6 leshort 4 (ATM) +>6 leshort 5 (IP-over-IEEE 1394) +>6 leshort 6 (802.11) +>6 leshort 7 (Raw IP) +>6 leshort 8 (Raw IP) +>6 leshort 9 (Raw IP) +>6 leshort >9 (type %d) + +# +# Network General Sniffer capture files. +# Sorry, make that "Network Associates Sniffer capture files." +# Sorry, make that "Network General old DOS Sniffer capture files." +# +0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file +>33 byte 2 (compressed) +>23 leshort x - version %d +>25 leshort x \b.%d +>32 byte 0 (Token Ring) +>32 byte 1 (Ethernet) +>32 byte 2 (ARCNET) +>32 byte 3 (StarLAN) +>32 byte 4 (PC Network broadband) +>32 byte 5 (LocalTalk) +>32 byte 6 (Znet) +>32 byte 7 (Internetwork Analyzer) +>32 byte 9 (FDDI) +>32 byte 10 (ATM) + +# +# Cinco Networks NetXRay capture files. +# Sorry, make that "Network General Sniffer Basic capture files." +# Sorry, make that "Network Associates Sniffer Basic capture files." +# Sorry, make that "Network Associates Sniffer Basic, and Windows +# Sniffer Pro", capture files." +# Sorry, make that "Network General Sniffer capture files." +# Sorry, make that "NetScout Sniffer capture files." +# +0 string XCP\0 NetXRay capture file +>4 string >\0 - version %s +>44 leshort 0 (Ethernet) +>44 leshort 1 (Token Ring) +>44 leshort 2 (FDDI) +>44 leshort 3 (WAN) +>44 leshort 8 (ATM) +>44 leshort 9 (802.11) + +# +# "libpcap" capture files. +# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is +# the main program that uses that format, but there are other programs +# that use "libpcap", or that use the same capture file format.) +# +0 name pcap-be +>4 beshort x - version %d +>6 beshort x \b.%d +>20 belong 0 (No link-layer encapsulation +>20 belong 1 (Ethernet +>20 belong 2 (3Mb Ethernet +>20 belong 3 (AX.25 +>20 belong 4 (ProNET +>20 belong 5 (CHAOS +>20 belong 6 (Token Ring +>20 belong 7 (BSD ARCNET +>20 belong 8 (SLIP +>20 belong 9 (PPP +>20 belong 10 (FDDI +>20 belong 11 (RFC 1483 ATM +>20 belong 12 (raw IP +>20 belong 13 (BSD/OS SLIP +>20 belong 14 (BSD/OS PPP +>20 belong 19 (Linux ATM Classical IP +>20 belong 50 (PPP or Cisco HDLC +>20 belong 51 (PPP-over-Ethernet +>20 belong 99 (Symantec Enterprise Firewall +>20 belong 100 (RFC 1483 ATM +>20 belong 101 (raw IP +>20 belong 102 (BSD/OS SLIP +>20 belong 103 (BSD/OS PPP +>20 belong 104 (BSD/OS Cisco HDLC +>20 belong 105 (802.11 +>20 belong 106 (Linux Classical IP over ATM +>20 belong 107 (Frame Relay +>20 belong 108 (OpenBSD loopback +>20 belong 109 (OpenBSD IPsec encrypted +>20 belong 112 (Cisco HDLC +>20 belong 113 (Linux "cooked" +>20 belong 114 (LocalTalk +>20 belong 117 (OpenBSD PFLOG +>20 belong 119 (802.11 with Prism header +>20 belong 122 (RFC 2625 IP over Fibre Channel +>20 belong 123 (SunATM +>20 belong 127 (802.11 with radiotap header +>20 belong 129 (Linux ARCNET +>20 belong 138 (Apple IP over IEEE 1394 +>20 belong 139 (MTP2 with pseudo-header +>20 belong 140 (MTP2 +>20 belong 141 (MTP3 +>20 belong 142 (SCCP +>20 belong 143 (DOCSIS +>20 belong 144 (IrDA +>20 belong 147 (Private use 0 +>20 belong 148 (Private use 1 +>20 belong 149 (Private use 2 +>20 belong 150 (Private use 3 +>20 belong 151 (Private use 4 +>20 belong 152 (Private use 5 +>20 belong 153 (Private use 6 +>20 belong 154 (Private use 7 +>20 belong 155 (Private use 8 +>20 belong 156 (Private use 9 +>20 belong 157 (Private use 10 +>20 belong 158 (Private use 11 +>20 belong 159 (Private use 12 +>20 belong 160 (Private use 13 +>20 belong 161 (Private use 14 +>20 belong 162 (Private use 15 +>20 belong 163 (802.11 with AVS header +>20 belong 165 (BACnet MS/TP +>20 belong 166 (PPPD +>20 belong 169 (GPRS LLC +>20 belong 177 (Linux LAPD +>20 belong 187 (Bluetooth HCI H4 +>20 belong 189 (Linux USB +>20 belong 192 (PPI +>20 belong 195 (802.15.4 +>20 belong 196 (SITA +>20 belong 197 (Endace ERF +>20 belong 201 (Bluetooth HCI H4 with pseudo-header +>20 belong 202 (AX.25 with KISS header +>20 belong 203 (LAPD +>20 belong 204 (PPP with direction pseudo-header +>20 belong 205 (Cisco HDLC with direction pseudo-header +>20 belong 206 (Frame Relay with direction pseudo-header +>20 belong 209 (Linux IPMB +>20 belong 215 (802.15.4 with non-ASK PHY header +>20 belong 220 (Memory-mapped Linux USB +>20 belong 224 (Fibre Channel FC-2 +>20 belong 225 (Fibre Channel FC-2 with frame delimiters +>20 belong 226 (Solaris IPNET +>20 belong 227 (SocketCAN +>20 belong 228 (Raw IPv4 +>20 belong 229 (Raw IPv6 +>20 belong 230 (802.15.4 without FCS +>20 belong 231 (D-Bus messages +>20 belong 235 (DVB-CI +>20 belong 236 (MUX27010 +>20 belong 237 (STANAG 5066 D_PDUs +>20 belong 239 (Linux netlink NFLOG messages +>20 belong 240 (Hilscher netAnalyzer +>20 belong 241 (Hilscher netAnalyzer with delimiters +>20 belong 242 (IP-over-Infiniband +>20 belong 243 (MPEG-2 Transport Stream packets +>20 belong 244 (ng4t ng40 +>20 belong 245 (NFC LLCP +>20 belong 247 (Infiniband +>20 belong 248 (SCTP +>16 belong x \b, capture length %d) + +0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) +!:mime application/vnd.tcpdump.pcap +>0 use pcap-be +0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) +!:mime application/vnd.tcpdump.pcap +>0 use \^pcap-be + +# +# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. +# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is +# the main program that uses that format, but there are other programs +# that use "libpcap", or that use the same capture file format.) +# +0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian) +>0 use pcap-be +0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian) +>0 use \^pcap-be + +# +# "pcap-ng" capture files. +# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html +# Pcap-ng files can contain multiple sections. Printing the endianness, +# snaplen, or other information from the first SHB may be misleading. +# +0 ubelong 0x0a0d0d0a +>8 ubelong 0x1a2b3c4d pcap-ng capture file +>>12 beshort x - version %d +>>14 beshort x \b.%d +0 ulelong 0x0a0d0d0a +>8 ulelong 0x1a2b3c4d pcap-ng capture file +>>12 leshort x - version %d +>>14 leshort x \b.%d + +# +# AIX "iptrace" capture files. +# +0 string iptrace\ 1.0 "iptrace" capture file +0 string iptrace\ 2.0 "iptrace" capture file + +# +# Novell LANalyzer capture files. +# +0 leshort 0x1001 LANalyzer capture file +0 leshort 0x1007 LANalyzer capture file + +# +# HP-UX "nettl" capture files. +# +0 string \x54\x52\x00\x64\x00 "nettl" capture file + +# +# RADCOM WAN/LAN Analyzer capture files. +# +0 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file + +# +# NetStumbler log files. Not really packets, per se, but about as +# close as you can get. These are log files from NetStumbler, a +# Windows program, that scans for 802.11b networks. +# +0 string NetS NetStumbler log file +>8 lelong x \b, %d stations found + +# +# *Peek tagged capture files. +# +0 string \177ver EtherPeek/AiroPeek/OmniPeek capture file + +# +# Visual Networks traffic capture files. +# +0 string \x05VNF Visual Networks traffic capture file + +# +# Network Instruments Observer capture files. +# +0 string ObserverPktBuffe Network Instruments Observer capture file + +# +# Files from Accellent Group's 5View products. +# +0 string \xaa\xaa\xaa\xaa 5View capture file diff --git a/magic/Magdir/softquad b/magic/Magdir/softquad new file mode 100644 index 0000000..06c1f01 --- /dev/null +++ b/magic/Magdir/softquad @@ -0,0 +1,37 @@ + +#------------------------------------------------------------------------------ +# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $ +# softquad: file(1) magic for SoftQuad Publishing Software +# +# Author/Editor and RulesBuilder +# +# XXX - byte order? +# +0 string \<!SQ\ DTD> Compiled SGML rules file +>9 string >\0 Type %s +0 string \<!SQ\ A/E> A/E SGML Document binary +>9 string >\0 Type %s +0 string \<!SQ\ STS> A/E SGML binary styles file +>9 string >\0 Type %s +0 short 0xc0de Compiled PSI (v1) data +0 short 0xc0da Compiled PSI (v2) data +>3 string >\0 (%s) +# Binary sqtroff font/desc files... +0 short 0125252 SoftQuad DESC or font file binary +>2 short >0 - version %d +# Bitmaps... +0 search/1 SQ\ BITMAP1 SoftQuad Raster Format text +#0 string SQ\ BITMAP2 SoftQuad Raster Format data +# sqtroff intermediate language (replacement for ditroff int. lang.) +0 string X\ SoftQuad troff Context intermediate +>2 string 495 for AT&T 495 laser printer +>2 string hp for Hewlett-Packard LaserJet +>2 string impr for IMAGEN imPRESS +>2 string ps for PostScript + +# From: Michael Piefel <piefel@debian.org> +# sqtroff intermediate language (replacement for ditroff int. lang.) +0 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer +0 string X\ hp SoftQuad troff Context intermediate for HP LaserJet +0 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS +0 string X\ ps SoftQuad troff Context intermediate for PostScript diff --git a/magic/Magdir/spec b/magic/Magdir/spec new file mode 100644 index 0000000..c504b1f --- /dev/null +++ b/magic/Magdir/spec @@ -0,0 +1,21 @@ + +#------------------------------------------------------------------------------ +# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $ +# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) +# +# Cloyce D. Spradling <cloyce@headgear.org> + +0 string spec SPEC +>4 string .cpu CPU +>>8 string <: \b%.4s +>>12 string . raw result text + +17 string version=SPECjbb SPECjbb +>32 string <: \b%.4s +>>37 string <: v%.4s raw result text + +0 string BEGIN\040SPECWEB SPECweb +>13 string <: \b%.2s +>>15 string _SSL \b_SSL +>>>20 string <: v%.4s raw result text +>>16 string <: v%.4s raw result text diff --git a/magic/Magdir/spectrum b/magic/Magdir/spectrum new file mode 100644 index 0000000..d2c414b --- /dev/null +++ b/magic/Magdir/spectrum @@ -0,0 +1,54 @@ + +#------------------------------------------------------------------------------ +# $File: spectrum,v 1.7 2010/09/20 18:55:20 rrt Exp $ +# spectrum: file(1) magic for Spectrum emulator files. +# +# John Elliott <jce@seasip.demon.co.uk> + +# +# Spectrum +3DOS header +# +0 string PLUS3DOS\032 Spectrum +3 data +>15 byte 0 - BASIC program +>15 byte 1 - number array +>15 byte 2 - character array +>15 byte 3 - memory block +>>16 belong 0x001B0040 (screen) +>15 byte 4 - Tasword document +>15 string TAPEFILE - ZXT tapefile +# +# Tape file. This assumes the .TAP starts with a Spectrum-format header, +# which nearly all will. +# +# Update: Sanity-check string contents to be printable. +# -Adam Buchbinder <adam.buchbinder@gmail.com> +# +0 string \023\000\000 +>4 string >\0 +>>4 string <\177 Spectrum .TAP data "%-10.10s" +>>>3 byte 0 - BASIC program +>>>3 byte 1 - number array +>>>3 byte 2 - character array +>>>3 byte 3 - memory block +>>>>14 belong 0x001B0040 (screen) + +# The following three blocks are from pak21-spectrum@srcf.ucam.org +# TZX tape images +0 string ZXTape!\x1a Spectrum .TZX data +>8 byte x version %d +>9 byte x \b.%d + +# RZX input recording files +0 string RZX! Spectrum .RZX data +>4 byte x version %d +>5 byte x \b.%d + +# Floppy disk images +0 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data +0 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data +0 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data +0 string SINCLAIR Spectrum .SCL Betadisk image + +# Hard disk images +0 string RS-IDE\x1a Spectrum .HDF hard disk image +>7 byte x \b, version 0x%02x diff --git a/magic/Magdir/sql b/magic/Magdir/sql new file mode 100644 index 0000000..7839c80 --- /dev/null +++ b/magic/Magdir/sql @@ -0,0 +1,65 @@ + +#------------------------------------------------------------------------------ +# $File: sql,v 1.11 2013/02/21 15:27:01 christos Exp $ +# sql: file(1) magic for SQL files +# +# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> +# Recognize some MySQL files. +# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures +# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic +# +0 beshort 0xfe01 MySQL table definition file +>2 byte x Version %d +0 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file +>3 byte x Version %d +0 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file +>3 byte x Version %d +0 belong&0xffffff00 0xfefe0900 MySQL Maria index file +>3 byte x Version %d +0 belong&0xffffff00 0xfefe0A00 MySQL Maria compressed data file +>3 byte x Version %d +0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file +>3 byte x Version %d +0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file +>3 byte x Version %d +0 string \376bin MySQL replication log +0 belong&0xffffff00 0xfefe0b00 +>4 string MARIALOG MySQL Maria transaction log file +>>3 byte x Version %d +0 belong&0xffffff00 0xfefe0c00 +>4 string MACF MySQL Maria control file +>>3 byte x Version %d + +#------------------------------------------------------------------------------ +# iRiver H Series database file +# From Ken Guest <ken@linux.ie> +# As observed from iRivNavi.iDB and unencoded firmware +# +0 string iRivDB iRiver Database file +>11 string >\0 Version %s +>39 string iHP-100 [H Series] + +#------------------------------------------------------------------------------ +# SQLite database files +# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg +# +# Version 1 used GDBM internally; its files cannot be distinguished +# from other GDBM files. +# +# Version 2 used this format: +0 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database + +# Version 3 of SQLite allows applications to embed their own "user version" +# number in the database. Detect this and distinguish those files. + +0 string SQLite\ format\ 3 +>60 string _MTN Monotone source repository +>60 belong !0 SQLite 3.x database, user version %u +>60 belong 0 SQLite 3.x database + +# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek +# http://www.ullrich.es/job/service-menue/panasonic/panasonic-sendersortierung-sat-am-pc/ +# pceditor_V2003.jar +0 string PSDB\0 Panasonic channel list database +>126 string SQLite\ format\ 3 +>>&-15 indirect x \b; contains diff --git a/magic/Magdir/ssh b/magic/Magdir/ssh new file mode 100644 index 0000000..c87f388 --- /dev/null +++ b/magic/Magdir/ssh @@ -0,0 +1,8 @@ +# Type: OpenSSH key files +# From: Nicolas Collignon <tsointsoin@gmail.com> + +0 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key, +>28 string >\0 version %s + +0 string ssh-dss\ OpenSSH DSA public key +0 string ssh-rsa\ OpenSSH RSA public key diff --git a/magic/Magdir/ssl b/magic/Magdir/ssl new file mode 100644 index 0000000..4d8706e --- /dev/null +++ b/magic/Magdir/ssl @@ -0,0 +1,7 @@ +# Type: OpenSSL certificates/key files +# From: Nicolas Collignon <tsointsoin@gmail.com> + +0 string -----BEGIN\ CERTIFICATE----- PEM certificate +0 string -----BEGIN\ CERTIFICATE\ REQ PEM certificate request +0 string -----BEGIN\ RSA\ PRIVATE PEM RSA private key +0 string -----BEGIN\ DSA\ PRIVATE PEM DSA private key diff --git a/magic/Magdir/sun b/magic/Magdir/sun new file mode 100644 index 0000000..86ffad2 --- /dev/null +++ b/magic/Magdir/sun @@ -0,0 +1,141 @@ + +#------------------------------------------------------------------------------ +# $File: sun,v 1.25 2013/01/09 22:37:24 christos Exp $ +# sun: file(1) magic for Sun machines +# +# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x +# releases. (5.x uses ELF.) Entries for executables without an +# architecture type, used before the 68020-based Sun-3's came out, +# are in aout, as they're indistinguishable from other big-endian +# 32-bit a.out files. +# +0 belong&077777777 0600413 a.out SunOS sparc demand paged +>0 byte &0x80 +>>20 belong <4096 shared library +>>20 belong =4096 dynamically linked executable +>>20 belong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped + +0 belong&077777777 0600410 a.out SunOS sparc pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped + +0 belong&077777777 0600407 a.out SunOS sparc +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped + +0 belong&077777777 0400413 a.out SunOS mc68020 demand paged +>0 byte &0x80 +>>20 belong <4096 shared library +>>20 belong =4096 dynamically linked executable +>>20 belong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped + +0 belong&077777777 0400410 a.out SunOS mc68020 pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped + +0 belong&077777777 0400407 a.out SunOS mc68020 +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped + +0 belong&077777777 0200413 a.out SunOS mc68010 demand paged +>0 byte &0x80 +>>20 belong <4096 shared library +>>20 belong =4096 dynamically linked executable +>>20 belong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped + +0 belong&077777777 0200410 a.out SunOS mc68010 pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped + +0 belong&077777777 0200407 a.out SunOS mc68010 +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped + +# +# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC +# binary executed in compatibility mode under SunOS 5.x". +# +0 belong 0x080456 SunOS core file +>4 belong 432 (SPARC) +>>132 string >\0 from '%s' +>>116 belong =3 (quit) +>>116 belong =4 (illegal instruction) +>>116 belong =5 (trace trap) +>>116 belong =6 (abort) +>>116 belong =7 (emulator trap) +>>116 belong =8 (arithmetic exception) +>>116 belong =9 (kill) +>>116 belong =10 (bus error) +>>116 belong =11 (segmentation violation) +>>116 belong =12 (bad argument to system call) +>>116 belong =29 (resource lost) +>>120 belong x (T=%dK, +>>124 belong x D=%dK, +>>128 belong x S=%dK) +>4 belong 826 (68K) +>>128 string >\0 from '%s' +>4 belong 456 (SPARC 4.x BCP) +>>152 string >\0 from '%s' +# Sun SunPC +0 long 0xfa33c08e SunPC 4.0 Hard Disk +0 string #SUNPC_CONFIG SunPC 4.0 Properties Values +# Sun snoop (see RFC 1761, which describes the capture file format, +# RFC 3827, which describes some additional datalink types, and +# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml, +# which is the IANA registry of Snoop datalink types) +# +0 string snoop Snoop capture file +>8 belong >0 - version %ld +>12 belong 0 (IEEE 802.3) +>12 belong 1 (IEEE 802.4) +>12 belong 2 (IEEE 802.5) +>12 belong 3 (IEEE 802.6) +>12 belong 4 (Ethernet) +>12 belong 5 (HDLC) +>12 belong 6 (Character synchronous) +>12 belong 7 (IBM channel-to-channel adapter) +>12 belong 8 (FDDI) +>12 belong 9 (Other) +>12 belong 10 (type %ld) +>12 belong 11 (type %ld) +>12 belong 12 (type %ld) +>12 belong 13 (type %ld) +>12 belong 14 (type %ld) +>12 belong 15 (type %ld) +>12 belong 16 (Fibre Channel) +>12 belong 17 (ATM) +>12 belong 18 (ATM Classical IP) +>12 belong 19 (type %ld) +>12 belong 20 (type %ld) +>12 belong 21 (type %ld) +>12 belong 22 (type %ld) +>12 belong 23 (type %ld) +>12 belong 24 (type %ld) +>12 belong 25 (type %ld) +>12 belong 26 (IP over Infiniband) +>12 belong >26 (type %ld) + +#--------------------------------------------------------------------------- +# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a +# lead Sun/Cobalt developer) who agrees that they are good and worthy of +# inclusion. + +# Boot ROM images for Sun/Cobalt Linux server appliances +0 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom +>38 string x V%.4s + +# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code +# at the very end where file(1) can't get it. +0 string CRfs COBALT boot rom data (Flat boot rom or file system) diff --git a/magic/Magdir/sysex b/magic/Magdir/sysex new file mode 100644 index 0000000..70b5b1c --- /dev/null +++ b/magic/Magdir/sysex @@ -0,0 +1,318 @@ + +#------------------------------------------------------------------------ +# $File: sysex,v 1.6 2009/09/19 16:28:12 christos Exp $ +# sysex: file(1) magic for MIDI sysex files +# +# +0 byte 0xF0 SysEx File - + +# North American Group +>1 byte 0x01 Sequential +>1 byte 0x02 IDP +>1 byte 0x03 OctavePlateau +>1 byte 0x04 Moog +>1 byte 0x05 Passport +>1 byte 0x06 Lexicon +>1 byte 0x07 Kurzweil/Future Retro +>>3 byte 0x77 777 +>>4 byte 0x00 Bank +>>4 byte 0x01 Song +>>5 byte 0x0f 16 +>>5 byte 0x0e 15 +>>5 byte 0x0d 14 +>>5 byte 0x0c 13 +>>5 byte 0x0b 12 +>>5 byte 0x0a 11 +>>5 byte 0x09 10 +>>5 byte 0x08 9 +>>5 byte 0x07 8 +>>5 byte 0x06 7 +>>5 byte 0x05 6 +>>5 byte 0x04 5 +>>5 byte 0x03 4 +>>5 byte 0x02 3 +>>5 byte 0x01 2 +>>5 byte 0x00 1 +>>5 byte 0x10 (ALL) +>>2 byte x \b, Channel %d +>1 byte 0x08 Fender +>1 byte 0x09 Gulbransen +>1 byte 0x0a AKG +>1 byte 0x0b Voyce +>1 byte 0x0c Waveframe +>1 byte 0x0d ADA +>1 byte 0x0e Garfield +>1 byte 0x0f Ensoniq +>1 byte 0x10 Oberheim +>>2 byte 0x06 Matrix 6 series +>>3 byte 0x0A Dump (All) +>>3 byte 0x01 Dump (Bank) +>>4 belong 0x0002040E Matrix 1000 +>>>11 byte <2 User bank %d +>>>11 byte >1 Preset bank %d +>1 byte 0x11 Apple +>1 byte 0x12 GreyMatter +>1 byte 0x14 PalmTree +>1 byte 0x15 JLCooper +>1 byte 0x16 Lowrey +>1 byte 0x17 AdamsSmith +>1 byte 0x18 E-mu +>1 byte 0x19 Harmony +>1 byte 0x1a ART +>1 byte 0x1b Baldwin +>1 byte 0x1c Eventide +>1 byte 0x1d Inventronics +>1 byte 0x1f Clarity + +# European Group +>1 byte 0x21 SIEL +>1 byte 0x22 Synthaxe +>1 byte 0x24 Hohner +>1 byte 0x25 Twister +>1 byte 0x26 Solton +>1 byte 0x27 Jellinghaus +>1 byte 0x28 Southworth +>1 byte 0x29 PPG +>1 byte 0x2a JEN +>1 byte 0x2b SSL +>1 byte 0x2c AudioVertrieb + +>1 byte 0x2f ELKA +>>3 byte 0x09 EK-44 + +>1 byte 0x30 Dynacord +>1 byte 0x31 Jomox +>1 byte 0x33 Clavia +>1 byte 0x39 Soundcraft +# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs +>1 byte 0x3e Waldorf +>>2 byte 0x00 microWave +>>2 byte 0x0E microwave2 / XT +>>2 byte 0x0F Q / Q+ +>>3 byte =0 (default id) +>>3 byte >0 ( +>>>3 byte <0x7F \bdevice %d) +>>>3 byte =0x7F \bbroadcast id) +>>3 byte 0x7f Microwave I +>>>4 byte 0x00 SNDR (Sound Request) +>>>4 byte 0x10 SNDD (Sound Dump) +>>>4 byte 0x20 SNDP (Sound Parameter Change) +>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) +>>>4 byte 0x70 BOOT (Sound Reserved) +>>>4 byte 0x01 MULR (Multi Request) +>>>4 byte 0x11 MULD (Multi Dump) +>>>4 byte 0x21 MULP (Multi Parameter Change) +>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) +>>>4 byte 0x71 OS (Multi Reserved) +>>>4 byte 0x02 DRMR (Drum Map Request) +>>>4 byte 0x12 DRMD (Drum Map Dump) +>>>4 byte 0x22 DRMP (Drum Map Parameter Change) +>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) +>>>4 byte 0x72 BIN (Drum Map Reserved) +>>>4 byte 0x03 PATR (Sequencer Pattern Request) +>>>4 byte 0x13 PATD (Sequencer Pattern Dump) +>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) +>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) +>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) +>>>4 byte 0x04 GLBR (Global Parameter Request) +>>>4 byte 0x14 GLBD (Global Parameter Dump) +>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) +>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) +>>>4 byte 0x07 MODR (Mode Parameter Request) +>>>4 byte 0x17 MODD (Mode Parameter Dump) +>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) +>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) +>>2 byte 0x10 microQ +>>>4 byte 0x00 SNDR (Sound Request) +>>>4 byte 0x10 SNDD (Sound Dump) +>>>4 byte 0x20 SNDP (Sound Parameter Change) +>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) +>>>4 byte 0x70 (Sound Reserved) +>>>4 byte 0x01 MULR (Multi Request) +>>>4 byte 0x11 MULD (Multi Dump) +>>>4 byte 0x21 MULP (Multi Parameter Change) +>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) +>>>4 byte 0x71 OS (Multi Reserved) +>>>4 byte 0x02 DRMR (Drum Map Request) +>>>4 byte 0x12 DRMD (Drum Map Dump) +>>>4 byte 0x22 DRMP (Drum Map Parameter Change) +>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) +>>>4 byte 0x72 BIN (Drum Map Reserved) +>>>4 byte 0x04 GLBR (Global Parameter Request) +>>>4 byte 0x14 GLBD (Global Parameter Dump) +>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) +>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) +>>2 byte 0x11 rackAttack +>>>4 byte 0x00 SNDR (Sound Parameter Request) +>>>4 byte 0x10 SNDD (Sound Parameter Dump) +>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) +>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) +>>>4 byte 0x01 PRGR (Program Parameter Request) +>>>4 byte 0x11 PRGD (Program Parameter Dump) +>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) +>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) +>>>4 byte 0x71 OS (Program Parameter Reserved) +>>>4 byte 0x03 PATR (Pattern Parameter Request) +>>>4 byte 0x13 PATD (Pattern Parameter Dump) +>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) +>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) +>>>4 byte 0x04 GLBR (Global Parameter Request) +>>>4 byte 0x14 GLBD (Global Parameter Dump) +>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) +>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) +>>>4 byte 0x05 EFXR (FX Parameter Request) +>>>4 byte 0x15 EFXD (FX Parameter Dump) +>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) +>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) +>>>4 byte 0x07 MODR (Mode Command Request) +>>>4 byte 0x17 MODD (Mode Command Dump) +>>>4 byte 0x27 MODP (Mode Command Parameter Change) +>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) +>>2 byte 0x03 Wave +>>>4 byte 0x00 SBPR (Soundprogram) +>>>4 byte 0x01 SAPR (Performance) +>>>4 byte 0x02 SWAVE (Wave) +>>>4 byte 0x03 SWTBL (Wave control table) +>>>4 byte 0x04 SVT (Velocity Curve) +>>>4 byte 0x05 STT (Tuning Table) +>>>4 byte 0x06 SGLB (Global Parameters) +>>>4 byte 0x07 SARRMAP (Performance Program Change Map) +>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) +>>>4 byte 0x09 SBPRPAR (Sound Parameter) +>>>4 byte 0x0A SARRPAR (Performance Parameter) +>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) +>>>4 byte 0x0F SBULK (Bulk Switch on/off) + +# Japanese Group +>1 byte 0x40 Kawai +>>3 byte 0x20 K1 +>>3 byte 0x22 K4 + +>1 byte 0x41 Roland +>>3 byte 0x14 D-50 +>>3 byte 0x2b U-220 +>>3 byte 0x02 TR-707 + +>1 byte 0x42 Korg +>>3 byte 0x19 M1 + +>1 byte 0x43 Yamaha +>1 byte 0x44 Casio +>1 byte 0x46 Kamiya +>1 byte 0x47 Akai +>1 byte 0x48 Victor +>1 byte 0x49 Mesosha +>1 byte 0x4b Fujitsu +>1 byte 0x4c Sony +>1 byte 0x4e Teac +>1 byte 0x50 Matsushita +>1 byte 0x51 Fostex +>1 byte 0x52 Zoom +>1 byte 0x54 Matsushita +>1 byte 0x57 Acoustic tech. lab. + +>1 belong&0xffffff00 0x00007400 Ta Horng +>1 belong&0xffffff00 0x00007500 e-Tek +>1 belong&0xffffff00 0x00007600 E-Voice +>1 belong&0xffffff00 0x00007700 Midisoft +>1 belong&0xffffff00 0x00007800 Q-Sound +>1 belong&0xffffff00 0x00007900 Westrex +>1 belong&0xffffff00 0x00007a00 Nvidia* +>1 belong&0xffffff00 0x00007b00 ESS +>1 belong&0xffffff00 0x00007c00 Mediatrix +>1 belong&0xffffff00 0x00007d00 Brooktree +>1 belong&0xffffff00 0x00007e00 Otari +>1 belong&0xffffff00 0x00007f00 Key Electronics +>1 belong&0xffffff00 0x00010000 Shure +>1 belong&0xffffff00 0x00010100 AuraSound +>1 belong&0xffffff00 0x00010200 Crystal +>1 belong&0xffffff00 0x00010300 Rockwell +>1 belong&0xffffff00 0x00010400 Silicon Graphics +>1 belong&0xffffff00 0x00010500 Midiman +>1 belong&0xffffff00 0x00010600 PreSonus +>1 belong&0xffffff00 0x00010800 Topaz +>1 belong&0xffffff00 0x00010900 Cast Lightning +>1 belong&0xffffff00 0x00010a00 Microsoft +>1 belong&0xffffff00 0x00010b00 Sonic Foundry +>1 belong&0xffffff00 0x00010c00 Line 6 +>1 belong&0xffffff00 0x00010d00 Beatnik Inc. +>1 belong&0xffffff00 0x00010e00 Van Koerving +>1 belong&0xffffff00 0x00010f00 Altech Systems +>1 belong&0xffffff00 0x00011000 S & S Research +>1 belong&0xffffff00 0x00011100 VLSI Technology +>1 belong&0xffffff00 0x00011200 Chromatic +>1 belong&0xffffff00 0x00011300 Sapphire +>1 belong&0xffffff00 0x00011400 IDRC +>1 belong&0xffffff00 0x00011500 Justonic Tuning +>1 belong&0xffffff00 0x00011600 TorComp +>1 belong&0xffffff00 0x00011700 Newtek Inc. +>1 belong&0xffffff00 0x00011800 Sound Sculpture +>1 belong&0xffffff00 0x00011900 Walker Technical +>1 belong&0xffffff00 0x00011a00 Digital Harmony +>1 belong&0xffffff00 0x00011b00 InVision +>1 belong&0xffffff00 0x00011c00 T-Square +>1 belong&0xffffff00 0x00011d00 Nemesys +>1 belong&0xffffff00 0x00011e00 DBX +>1 belong&0xffffff00 0x00011f00 Syndyne +>1 belong&0xffffff00 0x00012000 Bitheadz +>1 belong&0xffffff00 0x00012100 Cakewalk +>1 belong&0xffffff00 0x00012200 Staccato +>1 belong&0xffffff00 0x00012300 National Semicon. +>1 belong&0xffffff00 0x00012400 Boom Theory +>1 belong&0xffffff00 0x00012500 Virtual DSP Corp +>1 belong&0xffffff00 0x00012600 Antares +>1 belong&0xffffff00 0x00012700 Angel Software +>1 belong&0xffffff00 0x00012800 St Louis Music +>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX +>1 belong&0xffffff00 0x00012a00 Ashley Audio +>1 belong&0xffffff00 0x00012b00 Vari-Lite +>1 belong&0xffffff00 0x00012c00 Summit Audio +>1 belong&0xffffff00 0x00012d00 Aureal Semicon. +>1 belong&0xffffff00 0x00012e00 SeaSound +>1 belong&0xffffff00 0x00012f00 U.S. Robotics +>1 belong&0xffffff00 0x00013000 Aurisis +>1 belong&0xffffff00 0x00013100 Nearfield Multimedia +>1 belong&0xffffff00 0x00013200 FM7 Inc. +>1 belong&0xffffff00 0x00013300 Swivel Systems +>1 belong&0xffffff00 0x00013400 Hyperactive +>1 belong&0xffffff00 0x00013500 MidiLite +>1 belong&0xffffff00 0x00013600 Radical +>1 belong&0xffffff00 0x00013700 Roger Linn +>1 belong&0xffffff00 0x00013800 Helicon +>1 belong&0xffffff00 0x00013900 Event +>1 belong&0xffffff00 0x00013a00 Sonic Network +>1 belong&0xffffff00 0x00013b00 Realtime Music +>1 belong&0xffffff00 0x00013c00 Apogee Digital + +>1 belong&0xffffff00 0x00202b00 Medeli Electronics +>1 belong&0xffffff00 0x00202c00 Charlie Lab +>1 belong&0xffffff00 0x00202d00 Blue Chip Music +>1 belong&0xffffff00 0x00202e00 BEE OH Corp +>1 belong&0xffffff00 0x00202f00 LG Semicon America +>1 belong&0xffffff00 0x00203000 TESI +>1 belong&0xffffff00 0x00203100 EMAGIC +>1 belong&0xffffff00 0x00203200 Behringer +>1 belong&0xffffff00 0x00203300 Access Music +>1 belong&0xffffff00 0x00203400 Synoptic +>1 belong&0xffffff00 0x00203500 Hanmesoft Corp +>1 belong&0xffffff00 0x00203600 Terratec +>1 belong&0xffffff00 0x00203700 Proel SpA +>1 belong&0xffffff00 0x00203800 IBK MIDI +>1 belong&0xffffff00 0x00203900 IRCAM +>1 belong&0xffffff00 0x00203a00 Propellerhead Software +>1 belong&0xffffff00 0x00203b00 Red Sound Systems +>1 belong&0xffffff00 0x00203c00 Electron ESI AB +>1 belong&0xffffff00 0x00203d00 Sintefex Audio +>1 belong&0xffffff00 0x00203e00 Music and More +>1 belong&0xffffff00 0x00203f00 Amsaro +>1 belong&0xffffff00 0x00204000 CDS Advanced Technology +>1 belong&0xffffff00 0x00204100 Touched by Sound +>1 belong&0xffffff00 0x00204200 DSP Arts +>1 belong&0xffffff00 0x00204300 Phil Rees Music +>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH +>1 belong&0xffffff00 0x00204500 Soundart +>1 belong&0xffffff00 0x00204600 C-Mexx Software +>1 belong&0xffffff00 0x00204700 Klavis Tech. +>1 belong&0xffffff00 0x00204800 Noteheads AB + +0 string T707 Roland TR-707 Data diff --git a/magic/Magdir/tcl b/magic/Magdir/tcl new file mode 100644 index 0000000..223f93b --- /dev/null +++ b/magic/Magdir/tcl @@ -0,0 +1,29 @@ +#------------------------------------------------------------------------------ +# file: file(1) magic for Tcl scripting language +# URL: http://www.tcl.tk/ +# From: gustaf neumann + +# Tcl scripts +0 search/1/w #!\ /usr/bin/tcl Tcl script text executable +!:mime text/x-lua +0 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable +!:mime text/x-tcl +0 search/1 #!/usr/bin/env\ tcl Tcl script text executable +!:mime text/x-tcl +0 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable +!:mime text/x-tcl +0 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable +!:mime text/x-tcl +0 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable +!:mime text/x-tcl +0 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable +!:mime text/x-tcl +0 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable +!:mime text/x-tcl + +# check the first line +0 search/1 package\ req +>0 regex \^package[\ \t]+req Tcl script +# not 'p', check other lines +0 search/1 !p +>0 regex \^package[\ \t]+req Tcl script diff --git a/magic/Magdir/teapot b/magic/Magdir/teapot new file mode 100644 index 0000000..b6577b6 --- /dev/null +++ b/magic/Magdir/teapot @@ -0,0 +1,6 @@ + +#------------------------------------------------------------------------------ +# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $ +# teapot: file(1) magic for "teapot" spreadsheet +# +0 string #!teapot\012xdr teapot work sheet (XDR format) diff --git a/magic/Magdir/terminfo b/magic/Magdir/terminfo new file mode 100644 index 0000000..97ea429 --- /dev/null +++ b/magic/Magdir/terminfo @@ -0,0 +1,10 @@ + +#------------------------------------------------------------------------------ +# $File: terminfo,v 1.6 2009/09/19 16:28:12 christos Exp $ +# terminfo: file(1) magic for terminfo +# +# XXX - byte order for screen images? +# +0 string \032\001 Compiled terminfo entry +0 short 0433 Curses screen image +0 short 0434 Curses screen image diff --git a/magic/Magdir/tex b/magic/Magdir/tex new file mode 100644 index 0000000..e8d2e87 --- /dev/null +++ b/magic/Magdir/tex @@ -0,0 +1,105 @@ + +#------------------------------------------------------------------------------ +# $File: tex,v 1.18 2011/02/08 13:45:15 christos Exp $ +# tex: file(1) magic for TeX files +# +# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) +# +# From <conklin@talisman.kaleida.com> + +# Although we may know the offset of certain text fields in TeX DVI +# and font files, we can't use them reliably because they are not +# zero terminated. [but we do anyway, christos] +0 string \367\002 TeX DVI file +!:mime application/x-dvi +>16 string >\0 (%s) +0 string \367\203 TeX generic font data +0 string \367\131 TeX packed font data +>3 string >\0 (%s) +0 string \367\312 TeX virtual font data +0 search/1 This\ is\ TeX, TeX transcript text +0 search/1 This\ is\ METAFONT, METAFONT transcript text + +# There is no way to detect TeX Font Metric (*.tfm) files without +# breaking them apart and reading the data. The following patterns +# match most *.tfm files generated by METAFONT or afm2tfm. +2 string \000\021 TeX font metric data +!:mime application/x-tex-tfm +>33 string >\0 (%s) +2 string \000\022 TeX font metric data +!:mime application/x-tex-tfm +>33 string >\0 (%s) + +# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) +0 search/1 \\input\ texinfo Texinfo source text +!:mime text/x-texinfo +0 search/1 This\ is\ Info\ file GNU Info text +!:mime text/x-info + +# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) +0 search/4096 \\input TeX document text +!:mime text/x-tex +!:strength + 15 +0 search/4096 \\section LaTeX document text +!:mime text/x-tex +!:strength + 18 +0 search/4096 \\setlength LaTeX document text +!:mime text/x-tex +!:strength + 15 +0 search/4096 \\documentstyle LaTeX document text +!:mime text/x-tex +!:strength + 18 +0 search/4096 \\chapter LaTeX document text +!:mime text/x-tex +!:strength + 18 +0 search/4096 \\documentclass LaTeX 2e document text +!:mime text/x-tex +!:strength + 15 +0 search/4096 \\relax LaTeX auxiliary file +!:mime text/x-tex +!:strength + 15 +0 search/4096 \\contentsline LaTeX table of contents +!:mime text/x-tex +!:strength + 15 +0 search/4096 %\ -*-latex-*- LaTeX document text +!:mime text/x-tex + +# Tex document, from Hendrik Scholz <hendrik@scholz.net> +0 search/1 \\ifx TeX document text + +# Index and glossary files +0 search/4096 \\indexentry LaTeX raw index file +0 search/4096 \\begin{theindex} LaTeX sorted index +0 search/4096 \\glossaryentry LaTeX raw glossary +0 search/4096 \\begin{theglossary} LaTeX sorted glossary +0 search/4096 This\ is\ makeindex Makeindex log file + +# End of TeX + +#------------------------------------------------------------------------------ +# file(1) magic for BibTex text files +# From Hendrik Scholz <hendrik@scholz.net> + +0 search/1/c @article{ BibTeX text file +0 search/1/c @book{ BibTeX text file +0 search/1/c @inbook{ BibTeX text file +0 search/1/c @incollection{ BibTeX text file +0 search/1/c @inproceedings{ BibTeX text file +0 search/1/c @manual{ BibTeX text file +0 search/1/c @misc{ BibTeX text file +0 search/1/c @preamble{ BibTeX text file +0 search/1/c @phdthesis{ BibTeX text file +0 search/1/c @techreport{ BibTeX text file +0 search/1/c @unpublished{ BibTeX text file + +73 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) + +73 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) + +0 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file + +0 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file + +0 search/1 @c\ @mapfile{ TeX font aliases text file + +0 string #LyX LyX document text diff --git a/magic/Magdir/tgif b/magic/Magdir/tgif new file mode 100644 index 0000000..e80b3a7 --- /dev/null +++ b/magic/Magdir/tgif @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $ +# file(1) magic for tgif(1) files +# From Hendrik Scholz <hendrik@scholz.net> +0 string %TGIF\ Tgif file version +>6 string x %s diff --git a/magic/Magdir/ti-8x b/magic/Magdir/ti-8x new file mode 100644 index 0000000..d7903fe --- /dev/null +++ b/magic/Magdir/ti-8x @@ -0,0 +1,239 @@ + +#------------------------------------------------------------------------------ +# $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $ +# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. +# +# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). +# +# Update: Romain Lievin (roms@lpg.ticalc.org). +# +# NOTE: This list is not complete. +# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the +# program/group magic numbers in here because I cannot find any. +0 string **TI80** TI-80 Graphing Calculator File. +0 string **TI81** TI-81 Graphing Calculator File. +# +# Magic Numbers for the TI-73 +# +0 string **TI73** TI-73 Graphing Calculator +>0x00003B byte 0x00 (real number) +>0x00003B byte 0x01 (list) +>0x00003B byte 0x02 (matrix) +>0x00003B byte 0x03 (equation) +>0x00003B byte 0x04 (string) +>0x00003B byte 0x05 (program) +>0x00003B byte 0x06 (assembly program) +>0x00003B byte 0x07 (picture) +>0x00003B byte 0x08 (gdb) +>0x00003B byte 0x0C (complex number) +>0x00003B byte 0x0F (window settings) +>0x00003B byte 0x10 (zoom) +>0x00003B byte 0x11 (table setup) +>0x00003B byte 0x13 (backup) + +# Magic Numbers for the TI-82 +# +0 string **TI82** TI-82 Graphing Calculator +>0x00003B byte 0x00 (real) +>0x00003B byte 0x01 (list) +>0x00003B byte 0x02 (matrix) +>0x00003B byte 0x03 (Y-variable) +>0x00003B byte 0x05 (program) +>0x00003B byte 0x06 (protected prgm) +>0x00003B byte 0x07 (picture) +>0x00003B byte 0x08 (gdb) +>0x00003B byte 0x0B (window settings) +>0x00003B byte 0x0C (window settings) +>0x00003B byte 0x0D (table setup) +>0x00003B byte 0x0E (screenshot) +>0x00003B byte 0x0F (backup) +# +# Magic Numbers for the TI-83 +# +0 string **TI83** TI-83 Graphing Calculator +>0x00003B byte 0x00 (real) +>0x00003B byte 0x01 (list) +>0x00003B byte 0x02 (matrix) +>0x00003B byte 0x03 (Y-variable) +>0x00003B byte 0x04 (string) +>0x00003B byte 0x05 (program) +>0x00003B byte 0x06 (protected prgm) +>0x00003B byte 0x07 (picture) +>0x00003B byte 0x08 (gdb) +>0x00003B byte 0x0B (window settings) +>0x00003B byte 0x0C (window settings) +>0x00003B byte 0x0D (table setup) +>0x00003B byte 0x0E (screenshot) +>0x00003B byte 0x13 (backup) +# +# Magic Numbers for the TI-83+ +# +0 string **TI83F* TI-83+ Graphing Calculator +>0x00003B byte 0x00 (real number) +>0x00003B byte 0x01 (list) +>0x00003B byte 0x02 (matrix) +>0x00003B byte 0x03 (equation) +>0x00003B byte 0x04 (string) +>0x00003B byte 0x05 (program) +>0x00003B byte 0x06 (assembly program) +>0x00003B byte 0x07 (picture) +>0x00003B byte 0x08 (gdb) +>0x00003B byte 0x0C (complex number) +>0x00003B byte 0x0F (window settings) +>0x00003B byte 0x10 (zoom) +>0x00003B byte 0x11 (table setup) +>0x00003B byte 0x13 (backup) +>0x00003B byte 0x15 (application variable) +>0x00003B byte 0x17 (group of variable) + +# +# Magic Numbers for the TI-85 +# +0 string **TI85** TI-85 Graphing Calculator +>0x00003B byte 0x00 (real number) +>0x00003B byte 0x01 (complex number) +>0x00003B byte 0x02 (real vector) +>0x00003B byte 0x03 (complex vector) +>0x00003B byte 0x04 (real list) +>0x00003B byte 0x05 (complex list) +>0x00003B byte 0x06 (real matrix) +>0x00003B byte 0x07 (complex matrix) +>0x00003B byte 0x08 (real constant) +>0x00003B byte 0x09 (complex constant) +>0x00003B byte 0x0A (equation) +>0x00003B byte 0x0C (string) +>0x00003B byte 0x0D (function GDB) +>0x00003B byte 0x0E (polar GDB) +>0x00003B byte 0x0F (parametric GDB) +>0x00003B byte 0x10 (diffeq GDB) +>0x00003B byte 0x11 (picture) +>0x00003B byte 0x12 (program) +>0x00003B byte 0x13 (range) +>0x00003B byte 0x17 (window settings) +>0x00003B byte 0x18 (window settings) +>0x00003B byte 0x19 (window settings) +>0x00003B byte 0x1A (window settings) +>0x00003B byte 0x1B (zoom) +>0x00003B byte 0x1D (backup) +>0x00003B byte 0x1E (unknown) +>0x00003B byte 0x2A (equation) +>0x000032 string ZS4 - ZShell Version 4 File. +>0x000032 string ZS3 - ZShell Version 3 File. +# +# Magic Numbers for the TI-86 +# +0 string **TI86** TI-86 Graphing Calculator +>0x00003B byte 0x00 (real number) +>0x00003B byte 0x01 (complex number) +>0x00003B byte 0x02 (real vector) +>0x00003B byte 0x03 (complex vector) +>0x00003B byte 0x04 (real list) +>0x00003B byte 0x05 (complex list) +>0x00003B byte 0x06 (real matrix) +>0x00003B byte 0x07 (complex matrix) +>0x00003B byte 0x08 (real constant) +>0x00003B byte 0x09 (complex constant) +>0x00003B byte 0x0A (equation) +>0x00003B byte 0x0C (string) +>0x00003B byte 0x0D (function GDB) +>0x00003B byte 0x0E (polar GDB) +>0x00003B byte 0x0F (parametric GDB) +>0x00003B byte 0x10 (diffeq GDB) +>0x00003B byte 0x11 (picture) +>0x00003B byte 0x12 (program) +>0x00003B byte 0x13 (range) +>0x00003B byte 0x17 (window settings) +>0x00003B byte 0x18 (window settings) +>0x00003B byte 0x19 (window settings) +>0x00003B byte 0x1A (window settings) +>0x00003B byte 0x1B (zoom) +>0x00003B byte 0x1D (backup) +>0x00003B byte 0x1E (unknown) +>0x00003B byte 0x2A (equation) +# +# Magic Numbers for the TI-89 +# +0 string **TI89** TI-89 Graphing Calculator +>0x000048 byte 0x00 (expression) +>0x000048 byte 0x04 (list) +>0x000048 byte 0x06 (matrix) +>0x000048 byte 0x0A (data) +>0x000048 byte 0x0B (text) +>0x000048 byte 0x0C (string) +>0x000048 byte 0x0D (graphic data base) +>0x000048 byte 0x0E (figure) +>0x000048 byte 0x10 (picture) +>0x000048 byte 0x12 (program) +>0x000048 byte 0x13 (function) +>0x000048 byte 0x14 (macro) +>0x000048 byte 0x1C (zipped) +>0x000048 byte 0x21 (assembler) +# +# Magic Numbers for the TI-92 +# +0 string **TI92** TI-92 Graphing Calculator +>0x000048 byte 0x00 (expression) +>0x000048 byte 0x04 (list) +>0x000048 byte 0x06 (matrix) +>0x000048 byte 0x0A (data) +>0x000048 byte 0x0B (text) +>0x000048 byte 0x0C (string) +>0x000048 byte 0x0D (graphic data base) +>0x000048 byte 0x0E (figure) +>0x000048 byte 0x10 (picture) +>0x000048 byte 0x12 (program) +>0x000048 byte 0x13 (function) +>0x000048 byte 0x14 (macro) +>0x000048 byte 0x1D (backup) +# +# Magic Numbers for the TI-92+/V200 +# +0 string **TI92P* TI-92+/V200 Graphing Calculator +>0x000048 byte 0x00 (expression) +>0x000048 byte 0x04 (list) +>0x000048 byte 0x06 (matrix) +>0x000048 byte 0x0A (data) +>0x000048 byte 0x0B (text) +>0x000048 byte 0x0C (string) +>0x000048 byte 0x0D (graphic data base) +>0x000048 byte 0x0E (figure) +>0x000048 byte 0x10 (picture) +>0x000048 byte 0x12 (program) +>0x000048 byte 0x13 (function) +>0x000048 byte 0x14 (macro) +>0x000048 byte 0x1C (zipped) +>0x000048 byte 0x21 (assembler) +# +# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades +# +0x0000016 string Advanced TI-XX Graphing Calculator (FLASH) +0 string **TIFL** TI-XX Graphing Calculator (FLASH) +>8 byte >0 - Revision %d +>>9 byte x \b.%d, +>12 byte >0 Revision date %02x +>>13 byte x \b/%02x +>>14 beshort x \b/%04x, +>17 string >/0 name: '%s', +>48 byte 0x74 device: TI-73, +>48 byte 0x73 device: TI-83+, +>48 byte 0x98 device: TI-89, +>48 byte 0x88 device: TI-92+, +>49 byte 0x23 type: OS upgrade, +>49 byte 0x24 type: application, +>49 byte 0x25 type: certificate, +>49 byte 0x3e type: license, +>74 lelong >0 size: %ld bytes + +# VTi & TiEmu skins (TI Graphing Calculators). +# From: Romain Lievin (roms@lpg.ticalc.org). +# Magic Numbers for the VTi skins +0 string VTI Virtual TI skin +>3 string v - Version +>>4 byte >0 \b %c +>>6 byte x \b.%c +# Magic Numbers for the TiEmu skins +0 string TiEmu TiEmu skin +>6 string v - Version +>>7 byte >0 \b %c +>>9 byte x \b.%c +>>10 byte x \b%c diff --git a/magic/Magdir/timezone b/magic/Magdir/timezone new file mode 100644 index 0000000..9381a0c --- /dev/null +++ b/magic/Magdir/timezone @@ -0,0 +1,32 @@ + +#------------------------------------------------------------------------------ +# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $ +# timezone: file(1) magic for timezone data +# +# from Daniel Quinlan (quinlan@yggdrasil.com) +# this should work on Linux, SunOS, and maybe others +# Added new official magic number for recent versions of the Olson code +0 string TZif timezone data +>4 byte 0 \b, old version +>4 byte >0 \b, version %c +>20 belong 0 \b, no gmt time flags +>20 belong 1 \b, 1 gmt time flag +>20 belong >1 \b, %d gmt time flags +>24 belong 0 \b, no std time flags +>20 belong 1 \b, 1 std time flag +>24 belong >1 \b, %d std time flags +>28 belong 0 \b, no leap seconds +>28 belong 1 \b, 1 leap second +>28 belong >1 \b, %d leap seconds +>32 belong 0 \b, no transition times +>32 belong 1 \b, 1 transition time +>32 belong >1 \b, %d transition times +>36 belong 0 \b, no abbreviation chars +>36 belong 1 \b, 1 abbreviation char +>36 belong >1 \b, %d abbreviation chars +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data diff --git a/magic/Magdir/troff b/magic/Magdir/troff new file mode 100644 index 0000000..b24ea0a --- /dev/null +++ b/magic/Magdir/troff @@ -0,0 +1,38 @@ + +#------------------------------------------------------------------------------ +# $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $ +# troff: file(1) magic for *roff +# +# updated by Daniel Quinlan (quinlan@yggdrasil.com) + +# troff input +0 search/1 .\\" troff or preprocessor input text +!:mime text/troff +0 search/1 '\\" troff or preprocessor input text +!:mime text/troff +0 search/1 '.\\" troff or preprocessor input text +!:mime text/troff +0 search/1 \\" troff or preprocessor input text +!:mime text/troff +0 search/1 ''' troff or preprocessor input text +!:mime text/troff +0 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text +!:mime text/troff +0 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text +!:mime text/troff + +# ditroff intermediate output text +0 search/1 x\ T ditroff output text +>4 search/1 cat for the C/A/T phototypesetter +>4 search/1 ps for PostScript +>4 search/1 dvi for DVI +>4 search/1 ascii for ASCII +>4 search/1 lj4 for LaserJet 4 +>4 search/1 latin1 for ISO 8859-1 (Latin 1) +>4 search/1 X75 for xditview at 75dpi +>>7 search/1 -12 (12pt) +>4 search/1 X100 for xditview at 100dpi +>>8 search/1 -12 (12pt) + +# output data formats +0 string \100\357 very old (C/A/T) troff output data diff --git a/magic/Magdir/tuxedo b/magic/Magdir/tuxedo new file mode 100644 index 0000000..191501d --- /dev/null +++ b/magic/Magdir/tuxedo @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $ +# tuxedo: file(1) magic for BEA TUXEDO data files +# +# from Ian Springer <ispringer@hotmail.com> +# +0 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data diff --git a/magic/Magdir/typeset b/magic/Magdir/typeset new file mode 100644 index 0000000..e99fe37 --- /dev/null +++ b/magic/Magdir/typeset @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $ +# typeset: file(1) magic for other typesetting +# +0 string Interpress/Xerox Xerox InterPress data +>16 string / (version +>>17 string >\0 %s) diff --git a/magic/Magdir/unicode b/magic/Magdir/unicode new file mode 100644 index 0000000..f7eb5a2 --- /dev/null +++ b/magic/Magdir/unicode @@ -0,0 +1,16 @@ + +#------------------------------------------------------------------------------ +# $File: unicode,v 1.6 2010/09/20 18:55:20 rrt Exp $ +# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> +# GRR: These types should be recognised in file_ascmagic so these +# encodings can be treated by text patterns. +# Missing types are already dealt with internally. +# +0 string +/v8 Unicode text, UTF-7 +0 string +/v9 Unicode text, UTF-7 +0 string +/v+ Unicode text, UTF-7 +0 string +/v/ Unicode text, UTF-7 +0 string \335\163\146\163 Unicode text, UTF-8-EBCDIC +0 string \000\000\376\377 Unicode text, UTF-32, big-endian +0 string \377\376\000\000 Unicode text, UTF-32, little-endian +0 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) diff --git a/magic/Magdir/unknown b/magic/Magdir/unknown new file mode 100644 index 0000000..578a8ea --- /dev/null +++ b/magic/Magdir/unknown @@ -0,0 +1,34 @@ + +#------------------------------------------------------------------------------ +# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $ +# unknown: file(1) magic for unknown machines +# +# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11 +# (executable, pure, and split I&D, respectively), but the PDP-11 version +# doesn't have the "version %ld", which may be a bogus COFFism (I don't +# think there was ever COFF for the PDP-11). +# +# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a +# long, as it would be on a VAX. In any case, that could collide with +# VAX demand-paged files, as the magic number is little-endian on those +# binaries, so the first 16 bits of the file would contain 0x10B. +# +# Therefore, those entries are commented out. +# +# 0x10C is 0414 and 0x10E is 0416; those *are* unknown. +# +#0 short 0x107 unknown machine executable +#>8 short >0 not stripped +#>15 byte >0 - version %ld +#0 short 0x108 unknown pure executable +#>8 short >0 not stripped +#>15 byte >0 - version %ld +#0 short 0x109 PDP-11 separate I&D +#>8 short >0 not stripped +#>15 byte >0 - version %ld +#0 short 0x10b unknown pure executable +#>8 short >0 not stripped +#>15 byte >0 - version %ld +0 long 0x10c unknown demand paged pure executable +>16 long >0 not stripped +0 long 0x10e unknown readable demand paged pure executable diff --git a/magic/Magdir/uterus b/magic/Magdir/uterus new file mode 100644 index 0000000..c5a139b --- /dev/null +++ b/magic/Magdir/uterus @@ -0,0 +1,16 @@ + +#------------------------------------------------------------------------------ +# $File: uterus,v 1.1 2012/12/18 18:53:32 christos Exp $ +# file(1) magic for uterus files +# http://freecode.com/projects/uterus +# +0 string UTE+ uterus file +>4 string v \b, version +>5 byte x %c +>6 string . \b. +>7 byte x \b%c +>8 string \<\> \b, big-endian +>>16 belong >0 \b, slut size %u +>8 string \>\< \b, litte-endian +>>16 lelong >0 \b, slut size %u +>10 byte &8 \b, compressed diff --git a/magic/Magdir/uuencode b/magic/Magdir/uuencode new file mode 100644 index 0000000..c00ddab --- /dev/null +++ b/magic/Magdir/uuencode @@ -0,0 +1,31 @@ + +#------------------------------------------------------------------------------ +# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $ +# uuencode: file(1) magic for ASCII-encoded files +# + +# GRR: the first line of xxencoded files is identical to that in uuencoded +# files, but the first character in most subsequent lines is 'h' instead of +# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's +# punctuation and survives BITNET gateways better.) If regular expressions +# were supported, this entry could possibly be split into two with +# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). +0 search/1 begin\ uuencoded or xxencoded text + +# btoa(1) is an alternative to uuencode that requires less space. +0 search/1 xbtoa\ Begin btoa'd text + +# ship(1) is another, much cooler alternative to uuencode. +# Greg Roelofs, newt@uchicago.edu +0 search/1 $\012ship ship'd binary text + +# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) +# Greg Roelofs, newt@uchicago.edu +0 search/1 Decode\ the\ following\ with\ bdeco bencoded News text + +# BinHex is the Macintosh ASCII-encoded file format (see also "apple") +# Daniel Quinlan, quinlan@yggdrasil.com +11 search/1 must\ be\ converted\ with\ BinHex BinHex binary text +>41 search/1 x \b, version %.3s + +# GRR: handle BASE64 diff --git a/magic/Magdir/varied.out b/magic/Magdir/varied.out new file mode 100644 index 0000000..3d8aa92 --- /dev/null +++ b/magic/Magdir/varied.out @@ -0,0 +1,46 @@ + +#------------------------------------------------------------------------------ +# $File: varied.out,v 1.22 2010/07/02 00:06:27 christos Exp $ +# varied.out: file(1) magic for various USG systems +# +# Herewith many of the object file formats used by USG systems. +# Most have been moved to files for a particular processor, +# and deleted if they duplicate other entries. +# +0 short 0610 Perkin-Elmer executable +# AMD 29K +0 beshort 0572 amd 29k coff noprebar executable +0 beshort 01572 amd 29k coff prebar executable +0 beshort 0160007 amd 29k coff archive +# Cray +6 beshort 0407 unicos (cray) executable +# Ultrix 4.3 +596 string \130\337\377\377 Ultrix core file +>600 string >\0 from '%s' +# BeOS and MAcOS PEF executables +# From: hplus@zilker.net (Jon Watte) +0 string Joy!peffpwpc header for PowerPC PEF executable +# +# ava assembler/linker Uros Platise <uros.platise@ijs.si> +0 string avaobj AVR assembler object code +>7 string >\0 version '%s' +# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> +0 string gmon GNU prof performance data +>4 long x - version %ld +# From: Dave Pearson <davep@davep.org> +# Harbour <URL:http://harbour-project.org/> HRB files. +0 string \xc0HRB Harbour HRB file +>4 leshort x version %d +# Harbour HBV files +0 string \xc0HBV Harbour variable dump file +>4 leshort x version %d + +# From: Alex Beregszaszi <alex@fsn.hu> +# 0 string exec BugOS executable +# 0 string pack BugOS archive + +# From: Jason Spence <jspence@lightconsulting.com> +# Generated by the "examples" in STM's ST40 devkit, and derived code. +0 lelong 0x13a9f17e ST40 component image format +>4 string >\0 \b, name '%s' + diff --git a/magic/Magdir/varied.script b/magic/Magdir/varied.script new file mode 100644 index 0000000..50259d3 --- /dev/null +++ b/magic/Magdir/varied.script @@ -0,0 +1,31 @@ +#------------------------------------------------------------------------------ +# $File: varied.script,v 1.9 2011/12/16 16:32:48 rrt Exp $ +# varied.script: file(1) magic for various interpreter scripts + +0 string/t #!\ / a +>3 string >\0 %s script text executable +!:strength / 2 +0 string/t #!\t/ a +>3 string >\0 %s script text executable +!:strength / 2 +0 string/t #!/ a +>2 string >\0 %s script text executable +!:strength / 2 +0 string/t #!\ script text executable +>3 string >\0 for %s +!:strength / 3 + +# using env +0 string/t #!/usr/bin/env a +>15 string/t >\0 %s script text executable +!:strength / 10 +0 string/t #!\ /usr/bin/env a +>16 string/t >\0 %s script text executable +!:strength / 10 + +# From: arno <arenevier@fdn.fr> +# mozilla xpconnect typelib +# see http://www.mozilla.org/scriptable/typelib_file.html +0 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib +>0x10 byte x version %d +>>0x11 byte x \b.%d diff --git a/magic/Magdir/vax b/magic/Magdir/vax new file mode 100644 index 0000000..5a096e8 --- /dev/null +++ b/magic/Magdir/vax @@ -0,0 +1,27 @@ + +#------------------------------------------------------------------------------ +# $File: vax,v 1.8 2013/01/09 22:37:24 christos Exp $ +# vax: file(1) magic for VAX executable/object and APL workspace +# +0 lelong 0101557 VAX single precision APL workspace +0 lelong 0101556 VAX double precision APL workspace + +# +# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian +# executables, and are handled in aout) +# +0 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable +>16 lelong >0 not stripped + +# +# VAX COFF +# +# The `versions' were commented out, but have been un-commented out. +# (Was the problem just one of endianness?) +# +0 leshort 0570 VAX COFF executable +>12 lelong >0 not stripped +>22 leshort >0 - version %ld +0 leshort 0575 VAX COFF pure executable +>12 lelong >0 not stripped +>22 leshort >0 - version %ld diff --git a/magic/Magdir/vicar b/magic/Magdir/vicar new file mode 100644 index 0000000..59d843d --- /dev/null +++ b/magic/Magdir/vicar @@ -0,0 +1,17 @@ + +#------------------------------------------------------------------------------ +# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $ +# vicar: file(1) magic for VICAR files. +# +# From: Ossama Othman <othman@astrosun.tn.cornell.edu +# VICAR is JPL's in-house spacecraft image processing program +# VICAR image +0 string LBLSIZE= VICAR image data +>32 string BYTE \b, 8 bits = VAX byte +>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 +>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 +>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 +>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 +>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 +# VICAR label file +43 string SFDU_LABEL VICAR label file diff --git a/magic/Magdir/virtual b/magic/Magdir/virtual new file mode 100644 index 0000000..7b729d4 --- /dev/null +++ b/magic/Magdir/virtual @@ -0,0 +1,17 @@ + +#------------------------------------------------------------------------------ +# $File: virtual,v 1.2 2011/11/22 13:30:05 christos Exp $ +# From: James Nobis <quel@quelrod.net> +# Microsoft hard disk images for: +# Virtual Server +# Virtual PC +# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx +# .vhd +0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC + +# Sun xVM VirtualBox Disk Image +# From: Richard W.M. Jones <rich@annexia.org> +# VirtualBox Disk Image +0x40 ulelong 0xbeda107f VirtualBox Disk Image +>0x44 uleshort >0 \b, major %u +>0x46 uleshort >0 \b, minor %u diff --git a/magic/Magdir/virtutech b/magic/Magdir/virtutech new file mode 100644 index 0000000..410ab9e --- /dev/null +++ b/magic/Magdir/virtutech @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $ +# Virtutech Compressed Random Access File Format +# +# From <gustav@virtutech.com> +0 string \211\277\036\203 Virtutech CRAFF +>4 belong x v%d +>20 belong 0 uncompressed +>20 belong 1 bzipp2ed +>20 belong 2 gzipped +>24 belong 0 not clean diff --git a/magic/Magdir/visx b/magic/Magdir/visx new file mode 100644 index 0000000..fe5c827 --- /dev/null +++ b/magic/Magdir/visx @@ -0,0 +1,32 @@ + +#------------------------------------------------------------------------------ +# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $ +# visx: file(1) magic for Visx format files +# +0 short 0x5555 VISX image file +>2 byte 0 (zero) +>2 byte 1 (unsigned char) +>2 byte 2 (short integer) +>2 byte 3 (float 32) +>2 byte 4 (float 64) +>2 byte 5 (signed char) +>2 byte 6 (bit-plane) +>2 byte 7 (classes) +>2 byte 8 (statistics) +>2 byte 10 (ascii text) +>2 byte 15 (image segments) +>2 byte 100 (image set) +>2 byte 101 (unsigned char vector) +>2 byte 102 (short integer vector) +>2 byte 103 (float 32 vector) +>2 byte 104 (float 64 vector) +>2 byte 105 (signed char vector) +>2 byte 106 (bit plane vector) +>2 byte 121 (feature vector) +>2 byte 122 (feature vector library) +>2 byte 124 (chain code) +>2 byte 126 (bit vector) +>2 byte 130 (graph) +>2 byte 131 (adjacency graph) +>2 byte 132 (adjacency graph library) +>2 string .VISIX (ascii text) diff --git a/magic/Magdir/vms b/magic/Magdir/vms new file mode 100644 index 0000000..d114dfd --- /dev/null +++ b/magic/Magdir/vms @@ -0,0 +1,28 @@ + +#------------------------------------------------------------------------------ +# $File: vms,v 1.6 2009/09/19 16:28:13 christos Exp $ +# vms: file(1) magic for VMS executables (experimental) +# +# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) + +# GRR 950122: I'm just guessing on these, based on inspection of the headers +# of three executables each for Alpha and VAX architectures. The VAX files +# all had headers similar to this: +# +# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 +# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ +# +0 string \xb0\0\x30\0 VMS VAX executable +>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption +# +# The AXP files all looked like this, except that the byte at offset 0x22 +# was 06 in some of them and 07 in others: +# +# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ +# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... +# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ +# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ +# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ +# +0 belong 0x03000000 VMS Alpha executable +>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption diff --git a/magic/Magdir/vmware b/magic/Magdir/vmware new file mode 100644 index 0000000..b6b6a61 --- /dev/null +++ b/magic/Magdir/vmware @@ -0,0 +1,6 @@ + +#------------------------------------------------------------------------------ +# $File: vmware,v 1.7 2009/09/19 16:28:13 christos Exp $ +# VMware specific files (deducted from version 1.1 and log file entries) +# Anthon van der Neut (anthon@mnt.org) +0 belong 0x4d52564e VMware nvram diff --git a/magic/Magdir/vorbis b/magic/Magdir/vorbis new file mode 100644 index 0000000..ed6c040 --- /dev/null +++ b/magic/Magdir/vorbis @@ -0,0 +1,118 @@ + +#------------------------------------------------------------------------------ +# $File: vorbis,v 1.16 2009/09/19 16:28:13 christos Exp $ +# vorbis: file(1) magic for Ogg/Vorbis files +# +# From Felix von Leitner <leitner@fefe.de> +# Extended by Beni Cherniavsky <cben@crosswinds.net> +# Further extended by Greg Wooledge <greg@wooledge.org> +# +# Most (everything but the number of channels and bitrate) is commented +# out with `##' as it's not interesting to the average user. The most +# probable things advanced users would want to uncomment are probably +# the number of comments and the encoder version. +# +# FIXME: The first match has been made a search, so that it can skip +# over prepended ID3 tags. This will work for MIME type detection, but +# won't work for detecting other properties of the file (they all need +# to be made relative to the search). In any case, if the file has ID3 +# tags, the ID3 information will be printed, not the Ogg information, +# so until that's fixed, this doesn't matter. +# FIXME[2]: Disable the above for now, since search assumes text mode. +# +# --- Ogg Framing --- +#0 search/1000 OggS Ogg data +0 string OggS Ogg data +!:mime application/ogg +>4 byte !0 UNKNOWN REVISION %u +##>4 byte 0 revision 0 +>4 byte 0 +##>>14 lelong x (Serial %lX) +# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) +>>28 string \x7fFLAC \b, FLAC audio +# non-Vorbis content: Theora +>>28 string \x80theora \b, Theora video +# non-Vorbis content: Kate +>>28 string \x80kate\0\0\0\0 \b, Kate +>>>37 ubyte x v%u +>>>38 ubyte x \b.%u, +>>>40 byte 0 utf8 encoding, +>>>40 byte !0 unknown character encoding, +>>>60 string >\0 language %s, +>>>60 string \0 no language set, +>>>76 string >\0 category %s +>>>76 string \0 no category set +# non-Vorbis content: Skeleton +>>28 string fishead\0 \b, Skeleton +>>>36 short x v%u +>>>40 short x \b.%u +# non-Vorbis content: Speex +>>28 string Speex\ \ \ \b, Speex audio +# non-Vorbis content: OGM +>>28 string \x01video\0\0\0 \b, OGM video +>>>37 string/c div3 (DivX 3) +>>>37 string/c divx (DivX 4) +>>>37 string/c dx50 (DivX 5) +>>>37 string/c xvid (XviD) +# --- First vorbis packet - general header --- +>>28 string \x01vorbis \b, Vorbis audio, +>>>35 lelong !0 UNKNOWN VERSION %lu, +##>>>35 lelong 0 version 0, +>>>35 lelong 0 +>>>>39 ubyte 1 mono, +>>>>39 ubyte 2 stereo, +>>>>39 ubyte >2 %u channels, +>>>>40 lelong x %lu Hz +# Minimal, nominal and maximal bitrates specified when encoding +>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, +# The above tests if at least one of these is specified: +>>>>>52 lelong !-1 +# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields +# instead of -1. +# Vorbis 1.0 uses 0 instead of -1. +>>>>>>52 lelong !0 +>>>>>>>52 lelong !-1000 +>>>>>>>>52 lelong x <%lu +>>>>>48 lelong !-1 +>>>>>>48 lelong x ~%lu +>>>>>44 lelong !-1 +>>>>>>44 lelong !-1000 +>>>>>>>44 lelong !0 +>>>>>>>>44 lelong x >%lu +>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps +# -- Second vorbis header packet - the comments +# A kludge to read the vendor string. It's a counted string, not a +# zero-terminated one, so file(1) can't read it in a generic way. +# libVorbis is the only one existing currently, so I detect specifically +# it. The interesting value is the cvs date (8 digits decimal). +# Post-RC1 Ogg files have the second header packet (and thus the version) +# in a different place, so we must use an indirect offset. +>>>(84.b+85) string \x03vorbis +>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I +>>>>>(84.b+120) string >00000000 +# Map to beta version numbers: +>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) +>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) +>>>>>>(84.b+120) string >20000508 +>>>>>>>(84.b+120) string <20001031 (beta2-3) +>>>>>>(84.b+120) string 20001031 (1.0 beta 3) +>>>>>>(84.b+120) string >20001031 +>>>>>>>(84.b+120) string <20010225 (beta3-4) +>>>>>>(84.b+120) string 20010225 (1.0 beta 4) +>>>>>>(84.b+120) string >20010225 +>>>>>>>(84.b+120) string <20010615 (beta4-RC1) +>>>>>>(84.b+120) string 20010615 (1.0 RC1) +>>>>>>(84.b+120) string 20010813 (1.0 RC2) +>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) +>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) +>>>>>>(84.b+120) string 20011217 (1.0 RC3) +>>>>>>(84.b+120) string 20011231 (1.0 RC3) +# Some pre-1.0 CVS snapshots still had "Xiphphorus"... +>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) +# For the 1.0 release, Xiphophorus is replaced by Xiph.Org +>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I +>>>>>(84.b+117) string >00000000 +>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) +>>>>>>(84.b+117) string 20020717 (1.0) +>>>>>>(84.b+117) string 20030909 (1.0.1) +>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) diff --git a/magic/Magdir/vxl b/magic/Magdir/vxl new file mode 100644 index 0000000..0fdc68a --- /dev/null +++ b/magic/Magdir/vxl @@ -0,0 +1,14 @@ + +#------------------------------------------------------------------------------ +# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $ +# VXL: file(1) magic for VXL binary IO data files +# +# from Ian Scott <scottim@sf.net> +# +# VXL is a collection of C++ libraries for Computer Vision. +# See the vsl chapter in the VXL Book for more info +# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html +# http:/vxl.sf.net + +2 lelong 0x472b2c4e VXL data file, +>0 leshort >0 schema version no %d diff --git a/magic/Magdir/warc b/magic/Magdir/warc new file mode 100644 index 0000000..f4ba079 --- /dev/null +++ b/magic/Magdir/warc @@ -0,0 +1,16 @@ + +#------------------------------------------------------------------------------ +# $File: warc,v 1.3 2010/11/25 15:05:43 christos Exp $ +# warc: file(1) magic for WARC files + +0 string WARC/ WARC Archive +>5 string x version %.4s +!:mime application/warc + +#------------------------------------------------------------------------------ +# Arc File Format from Internet Archive +# see http://www.archive.org/web/researcher/ArcFileFormat.php +0 string filedesc:// Internet Archive File +!:mime application/x-ia-arc +>11 search/256 \x0A \b +>>&0 ubyte >0 \b version %c diff --git a/magic/Magdir/weak b/magic/Magdir/weak new file mode 100644 index 0000000..6dc1793 --- /dev/null +++ b/magic/Magdir/weak @@ -0,0 +1,16 @@ + +#------------------------------------------------------------------------------ +# weak: file(1) magic for very weak magic entries, disabled by default +# +# These entries are so weak that they might interfere identification of +# other formats. Example include: +# - Only identify for 1 or 2 bytes +# - Match against very wide range of values +# - Match against generic word in some spoken languages (e.g. English) + +# Summary: Computer Graphics Metafile +# Extension: .cgm +#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile +#0 beshort 0x3020 character Computer Graphics Metafile + +#0 string =!! Bennet Yee's "face" format diff --git a/magic/Magdir/windows b/magic/Magdir/windows new file mode 100644 index 0000000..1ab78d4 --- /dev/null +++ b/magic/Magdir/windows @@ -0,0 +1,165 @@ + +#------------------------------------------------------------------------------ +# $File: windows,v 1.5 2012/04/03 22:25:07 christos Exp $ +# windows: file(1) magic for Microsoft Windows +# +# This file is mainly reserved for files where programs +# using them are run almost always on MS Windows 3.x or +# above, or files only used exclusively in Windows OS, +# where there is no better category to allocate for. +# For example, even though WinZIP almost run on Windows +# only, it is better to treat them as "archive" instead. +# For format usable in DOS, such as generic executable +# format, please specify under "msdos" file. +# + + +# Summary: Outlook Express DBX file +# Extension: .dbx +# Created by: Christophe Monniez +0 string \xCF\xAD\x12\xFE MS Outlook Express DBX file +>4 byte =0xC5 \b, message database +>4 byte =0xC6 \b, folder database +>4 byte =0xC7 \b, account information +>4 byte =0x30 \b, offline database + + +# Summary: Windows crash dump +# Extension: .dmp +# Created by: Andreas Schuster (http://computer.forensikblog.de/) +# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html +# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) +0 string PAGE +>4 string DUMP MS Windows 32bit crash dump +>>0x05c byte 0 \b, no PAE +>>0x05c byte 1 \b, PAE +>>0xf88 lelong 1 \b, full dump +>>0xf88 lelong 2 \b, kernel dump +>>0xf88 lelong 3 \b, small dump +>>0x068 lelong x \b, %ld pages +>4 string DU64 MS Windows 64bit crash dump +>>0xf98 lelong 1 \b, full dump +>>0xf98 lelong 2 \b, kernel dump +>>0xf98 lelong 3 \b, small dump +>>0x090 lequad x \b, %lld pages + + +# Summary: Vista Event Log +# Extension: .evtx +# Created by: Andreas Schuster (http://computer.forensikblog.de/) +# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html +0 string ElfFile\0 MS Windows Vista Event Log +>0x2a leshort x \b, %d chunks +>>0x10 lelong x \b (no. %d in use) +>0x18 lelong >1 \b, next record no. %d +>0x18 lelong =1 \b, empty +>0x78 lelong &1 \b, DIRTY +>0x78 lelong &2 \b, FULL + + +# Summary: Windows 3.1 group files +# Extension: .grp +# Created by: unknown +0 string \120\115\103\103 MS Windows 3.1 group files + + +# Summary: Old format help files +# Extension: .hlp +# Created by: Dirk Jagdmann <doj@cubic.org> +0 lelong 0x00035f3f MS Windows 3.x help file + + +# Summary: Hyper terminal +# Extension: .ht +# Created by: unknown +0 string HyperTerminal\ +>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile + +# http://ithreats.files.wordpress.com/2009/05/\ +# lnk_the_windows_shortcut_file_format.pdf +# Summary: Windows shortcut +# Extension: .lnk +# Created by: unknown +# 'L' + GUUID +0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut +>20 lelong&1 1 \b, Item id list present +>20 lelong&2 2 \b, Points to a file or directory +>20 lelong&4 4 \b, Has Description string +>20 lelong&8 8 \b, Has Relative path +>20 lelong&16 16 \b, Has Working directory +>20 lelong&32 32 \b, Has command line arguments +>20 lelong&64 64 \b, Icon +>>56 lelong \b number=%d +>24 lelong&1 1 \b, Read-Only +>24 lelong&2 2 \b, Hidden +>24 lelong&4 4 \b, System +>24 lelong&8 8 \b, Volume Label +>24 lelong&16 16 \b, Directory +>24 lelong&32 32 \b, Archive +>24 lelong&64 64 \b, Encrypted +>24 lelong&128 128 \b, Normal +>24 lelong&256 256 \b, Temporary +>24 lelong&512 512 \b, Sparse +>24 lelong&1024 1024 \b, Reparse point +>24 lelong&2048 2048 \b, Compressed +>24 lelong&4096 4096 \b, Offline +>28 leqwdate x \b, ctime=%s +>36 leqwdate x \b, mtime=%s +>44 leqwdate x \b, atime=%s +>52 lelong x \b, length=%u, window= +>60 lelong&1 1 \bhide +>60 lelong&2 2 \bnormal +>60 lelong&4 4 \bshowminimized +>60 lelong&8 8 \bshowmaximized +>60 lelong&16 16 \bshownoactivate +>60 lelong&32 32 \bminimize +>60 lelong&64 64 \bshowminnoactive +>60 lelong&128 128 \bshowna +>60 lelong&256 256 \brestore +>60 lelong&512 512 \bshowdefault +#>20 lelong&1 0 +#>>20 lelong&2 2 +#>>>(72.l-64) pstring/h x \b [%s] +#>20 lelong&1 1 +#>>20 lelong&2 2 +#>>>(72.s) leshort x +#>>>&75 pstring/h x \b [%s] + +# Summary: Outlook Personal Folders +# Created by: unknown +0 lelong 0x4E444221 Microsoft Outlook email folder +>10 leshort 0x0e (<=2002) +>10 leshort 0x17 (>=2003) + + +# Summary: Windows help cache +# Created by: unknown +0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache + + +# Summary: IE cache file +# Created by: Christophe Monniez +0 string Client\ UrlCache\ MMF Internet Explorer cache file +>20 string >\0 version %s + + +# Summary: Registry files +# Created by: unknown +# Modified by (1): Joerg Jenderek +0 string regf MS Windows registry file, NT/2000 or above +0 string CREG MS Windows 95/98/ME registry file +0 string SHCC3 MS Windows 3.1 registry file + + +# Summary: Windows Registry text +# Extension: .reg +# Submitted by: Abel Cheung <abelcheung@gmail.com> +0 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above) +0 string Windows\ Registry\ Editor\ +>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) + + +# From: Pal Tamas <folti@balabit.hu> +# Autorun File +0 string/c [autorun]\r\n Microsoft Windows Autorun file. +!:mime application/x-setupscript. diff --git a/magic/Magdir/wireless b/magic/Magdir/wireless new file mode 100644 index 0000000..badb73b --- /dev/null +++ b/magic/Magdir/wireless @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $ +# wireless-regdb: file(1) magic for CRDA wireless-regdb file format +# +0 string RGDB CRDA wireless regulatory database file +>4 belong 19 (Version 1) diff --git a/magic/Magdir/wordprocessors b/magic/Magdir/wordprocessors new file mode 100644 index 0000000..024b57d --- /dev/null +++ b/magic/Magdir/wordprocessors @@ -0,0 +1,167 @@ + +#------------------------------------------------------------------------------ +# $File: wordprocessors,v 1.17 2013/02/06 14:18:52 christos Exp $ +# wordprocessors: file(1) magic fo word processors. +# +####### PWP file format used on Smith Corona Personal Word Processors: +2 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP +>24 byte 2 \b, single spaced +>24 byte 3 \b, 1.5 spaced +>24 byte 4 \b, double spaced +>25 byte 0x42 \b, letter +>25 byte 0x54 \b, legal +>26 byte 0x46 \b, A4 + +#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE +0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable file +>15 byte 0 Optimized for Intel +>15 byte 1 Optimized for Non-Intel +1 string WPC (Corel/WP) +>8 short 257 WordPerfect macro +>8 short 258 WordPerfect help file +>8 short 259 WordPerfect keyboard file +>8 short 266 WordPerfect document +>8 short 267 WordPerfect dictionary +>8 short 268 WordPerfect thesaurus +>8 short 269 WordPerfect block +>8 short 270 WordPerfect rectangular block +>8 short 271 WordPerfect column block +>8 short 272 WordPerfect printer data +>8 short 275 WordPerfect printer data +>8 short 276 WordPerfect driver resource data +>8 short 279 WordPerfect hyphenation code +>8 short 280 WordPerfect hyphenation data +>8 short 281 WordPerfect macro resource data +>8 short 283 WordPerfect hyphenation lex +>8 short 285 WordPerfect wordlist +>8 short 286 WordPerfect equation resource data +>8 short 289 WordPerfect spell rules +>8 short 290 WordPerfect dictionary rules +>8 short 295 WordPerfect spell rules (Microlytics) +>8 short 299 WordPerfect settings file +>8 short 301 WordPerfect 4.2 document +>8 short 325 WordPerfect dialog file +>8 short 332 WordPerfect button bar +>8 short 513 Shell macro +>8 short 522 Shell definition +>8 short 769 Notebook macro +>8 short 770 Notebook help file +>8 short 771 Notebook keyboard file +>8 short 778 Notebook definition +>8 short 1026 Calculator help file +>8 short 1538 Calendar help file +>8 short 1546 Calendar data file +>8 short 1793 Editor macro +>8 short 1794 Editor help file +>8 short 1795 Editor keyboard file +>8 short 1817 Editor macro resource file +>8 short 2049 Macro editor macro +>8 short 2050 Macro editor help file +>8 short 2051 Macro editor keyboard file +>8 short 2305 PlanPerfect macro +>8 short 2306 PlanPerfect help file +>8 short 2307 PlanPerfect keyboard file +>8 short 2314 PlanPerfect worksheet +>8 short 2319 PlanPerfect printer definition +>8 short 2322 PlanPerfect graphic definition +>8 short 2323 PlanPerfect data +>8 short 2324 PlanPerfect temporary printer +>8 short 2329 PlanPerfect macro resource data +>8 byte 11 Mail +>8 short 2818 help file +>8 short 2821 distribution list +>8 short 2826 out box +>8 short 2827 in box +>8 short 2836 users archived mailbox +>8 short 2837 archived message database +>8 short 2838 archived attachments +>8 short 3083 Printer temporary file +>8 short 3330 Scheduler help file +>8 short 3338 Scheduler in file +>8 short 3339 Scheduler out file +>8 short 3594 GroupWise settings file +>8 short 3601 GroupWise directory services +>8 short 3627 GroupWise settings file +>8 short 4362 Terminal resource data +>8 short 4363 Terminal resource data +>8 short 4395 Terminal resource data +>8 short 4619 GUI loadable text +>8 short 4620 graphics resource data +>8 short 4621 printer settings file +>8 short 4622 port definition file +>8 short 4623 print queue parameters +>8 short 4624 compressed file +>8 short 5130 Network service msg file +>8 short 5131 Network service msg file +>8 short 5132 Async gateway login msg +>8 short 5134 GroupWise message file +>8 short 7956 GroupWise admin domain database +>8 short 7957 GroupWise admin host database +>8 short 7959 GroupWise admin remote host database +>8 short 7960 GroupWise admin ADS deferment data file +>8 short 8458 IntelliTAG (SGML) compiled DTD +>8 long 18219264 WordPerfect graphic image (1.0) +>8 long 18219520 WordPerfect graphic image (2.0) +#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE + +# Hangul (Korean) Word Processor File +0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 +# From: Won-Kyu Park <wkpark@kldp.org> +512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000 +!:mime application/x-hwp + +# CosmicBook, from Benoit Rouits +0 string CSBK Ted Neslson's CosmicBook hypertext file + +2 string EYWR AmigaWriter file + +# chi: file(1) magic for ChiWriter files +0 string \\1cw\ ChiWriter file +>5 string >\0 version %s +0 string \\1cw ChiWriter file + +# Quark Express from http://www.garykessler.net/library/file_sigs.html +2 string IIXPR3 Intel Quark Express Document (English) +2 string IIXPRa Intel Quark Express Document (Korean) +2 string MMXPR3 Motorola Quark Express Document (English) +!:mime application/x-quark-xpress-3 +2 string MMXPRa Motorola Quark Express Document (Korean) + +# adobe indesign (document, whatever...) from querkan +0 belong 0x0606edf5 Adobe InDesign +>16 string DOCUMENT Document + +#------------------------------------------------------------------------------ +# ichitaro456: file(1) magic for Just System Word Processor Ichitaro +# +# Contributor kenzo-: +# Reversed-engineered JS Ichitaro magic numbers +# + +0 string DOC +>43 byte 0x14 Just System Word Processor Ichitaro v4 +!:mime application/x-ichitaro4 +>144 string JDASH application/x-ichitaro4 + +0 string DOC +>43 byte 0x15 Just System Word Processor Ichitaro v5 +!:mime application/x-ichitaro5 + +0 string DOC +>43 byte 0x16 Just System Word Processor Ichitaro v6 +!:mime application/x-ichitaro6 + +# Type: Freemind mindmap documents +# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk> +0 string/w \<map\ version Freemind document +!:mime application/x-freemind + +# Type: Scribus +# From: Werner Fink <werner@suse.de> +0 string \<SCRIBUSUTF8\ Version Scribus Document +0 string \<SCRIBUSUTF8NEW\ Version Scribus Document +!:mime application/x-scribus + +# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek +# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14 +0 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file diff --git a/magic/Magdir/wsdl b/magic/Magdir/wsdl new file mode 100644 index 0000000..94bd1d1 --- /dev/null +++ b/magic/Magdir/wsdl @@ -0,0 +1,23 @@ + +#------------------------------------------------------------------------------ +# $File: wsdl,v 1.3 2013/02/06 14:18:52 christos Exp $ +# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php +# Cache format extracted from source: +# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup +# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html +# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011 +0 string wsdl PHP WSDL cache, +>4 byte x version 0x%02x +>6 ledate x \b, created %s + +# uri +>10 lelong <0x7fffffff +>>10 pstring/l x \b, uri: "%s" + +# source +>>>&0 lelong <0x7fffffff +>>>>&-4 pstring/l x \b, source: "%s" + +# target_ns +>>>>>&0 lelong <0x7fffffff +>>>>>>&-4 pstring/l x \b, target_ns: "%s" diff --git a/magic/Magdir/xdelta b/magic/Magdir/xdelta new file mode 100644 index 0000000..fde1d26 --- /dev/null +++ b/magic/Magdir/xdelta @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $ +# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> +# +0 string %XDELTA% XDelta binary patch file 0.14 +0 string %XDZ000% XDelta binary patch file 0.18 +0 string %XDZ001% XDelta binary patch file 0.20 +0 string %XDZ002% XDelta binary patch file 1.0 +0 string %XDZ003% XDelta binary patch file 1.0.4 +0 string %XDZ004% XDelta binary patch file 1.1 + +0 string \xD6\xC3\xC4\x00 VCDIFF binary diff diff --git a/magic/Magdir/xenix b/magic/Magdir/xenix new file mode 100644 index 0000000..3d238df --- /dev/null +++ b/magic/Magdir/xenix @@ -0,0 +1,73 @@ + +#------------------------------------------------------------------------------ +# $File: xenix,v 1.9 2009/09/19 16:28:13 christos Exp $ +# xenix: file(1) magic for Microsoft Xenix +# +# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small +# model" lifted from "magic.xenix", with comment "derived empirically; +# treat as folklore until proven" +# +# "small model", "large model", "huge model" stuff lifted from XXX +# +# XXX - "x.out" collides with PDP-11 archives +# +0 string core core file (Xenix) +0 byte 0x80 8086 relocatable (Microsoft) +0 leshort 0xff65 x.out +>2 string __.SYMDEF randomized +>0 byte x archive +0 leshort 0x206 Microsoft a.out +>8 leshort 1 Middle model +>0x1e leshort &0x10 overlay +>0x1e leshort &0x2 separate +>0x1e leshort &0x4 pure +>0x1e leshort &0x800 segmented +>0x1e leshort &0x400 standalone +>0x1e leshort &0x8 fixed-stack +>0x1c byte &0x80 byte-swapped +>0x1c byte &0x40 word-swapped +>0x10 lelong >0 not-stripped +>0x1e leshort ^0xc000 pre-SysV +>0x1e leshort &0x4000 V2.3 +>0x1e leshort &0x8000 V3.0 +>0x1c byte &0x4 86 +>0x1c byte &0xb 186 +>0x1c byte &0x9 286 +>0x1c byte &0xa 386 +>0x1f byte <0x040 small model +>0x1f byte =0x048 large model +>0x1f byte =0x049 huge model +>0x1e leshort &0x1 executable +>0x1e leshort ^0x1 object file +>0x1e leshort &0x40 Large Text +>0x1e leshort &0x20 Large Data +>0x1e leshort &0x120 Huge Objects Enabled +>0x10 lelong >0 not stripped + +0 leshort 0x140 old Microsoft 8086 x.out +>0x3 byte &0x4 separate +>0x3 byte &0x2 pure +>0 byte &0x1 executable +>0 byte ^0x1 relocatable +>0x14 lelong >0 not stripped + +0 lelong 0x206 b.out +>0x1e leshort &0x10 overlay +>0x1e leshort &0x2 separate +>0x1e leshort &0x4 pure +>0x1e leshort &0x800 segmented +>0x1e leshort &0x400 standalone +>0x1e leshort &0x1 executable +>0x1e leshort ^0x1 object file +>0x1e leshort &0x4000 V2.3 +>0x1e leshort &0x8000 V3.0 +>0x1c byte &0x4 86 +>0x1c byte &0xb 186 +>0x1c byte &0x9 286 +>0x1c byte &0x29 286 +>0x1c byte &0xa 386 +>0x1e leshort &0x4 Large Text +>0x1e leshort &0x2 Large Data +>0x1e leshort &0x102 Huge Objects Enabled + +0 leshort 0x580 XENIX 8086 relocatable or 80286 small model diff --git a/magic/Magdir/xilinx b/magic/Magdir/xilinx new file mode 100644 index 0000000..dd47aa1 --- /dev/null +++ b/magic/Magdir/xilinx @@ -0,0 +1,38 @@ + +#------------------------------------------------------------------------------ +# $File: xilinx,v 1.5 2013/01/08 03:06:50 christos Exp $ +# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. +# Xilinx-Magic@RevRagnarok.com +# Got the info from FPGA-FAQ 0026 +# +# First there is the sync header and its length +0 beshort 0x0009 +>2 belong =0x0ff00ff0 +>>&0 belong =0x0ff00ff0 +>>>&0 beshort =0x0000 +>>>>&0 pstring a Xilinx BIT data +# Next is a Pascal-style string with the NCD name. We want to capture that. +>>>>0x0F pstring x - from %s +# It is followed by a NUL +>>>>>&1 byte 0x00 +# And then 'b' +>>>>>&2 string b +# With the part number: +#>>>>>&5 string 4v (Virtex4) +#>>>>>&5 string 2v (Virtex II +#>>>>>>&0 string !p \b) +#>>>>>>&0 string p Pro) +>>>>>&4 pstring x - for %s +# And then NUL / 'c' / Build Data / NUL / 'd' / Date / NUL / 'e' / Data Length +>>>>>>&1 byte 0x00 +>>>>>>&2 string c +>>>>>>&4 pstring x - built %s +>>>>>>>&1 byte 0x00 +>>>>>>>&2 string d +>>>>>>>&4 pstring x \b(%s) +>>>>>>>>&1 byte 0x00 +>>>>>>>>&2 string e +>>>>>>>>&4 belong x - data length 0x%lx +# Raw bitstream files +0 long 0xffffffff +>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN) diff --git a/magic/Magdir/xo65 b/magic/Magdir/xo65 new file mode 100644 index 0000000..7b38818 --- /dev/null +++ b/magic/Magdir/xo65 @@ -0,0 +1,30 @@ + +#------------------------------------------------------------------------------ +# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $ +# xo65 object files +# From: "Ullrich von Bassewitz" <uz@cc65.org> +# +0 string \x55\x7A\x6E\x61 xo65 object, +>4 leshort x version %d, +>6 leshort&0x0001 =0x0001 with debug info +>6 leshort&0x0001 =0x0000 no debug info + +# xo65 library files +0 string \x6E\x61\x55\x7A xo65 library, +>4 leshort x version %d + +# o65 object files +0 string \x01\x00\x6F\x36\x35 o65 +>6 leshort&0x1000 =0x0000 executable, +>6 leshort&0x1000 =0x1000 object, +>5 byte x version %d, +>6 leshort&0x8000 =0x8000 65816, +>6 leshort&0x8000 =0x0000 6502, +>6 leshort&0x2000 =0x2000 32 bit, +>6 leshort&0x2000 =0x0000 16 bit, +>6 leshort&0x4000 =0x4000 page reloc, +>6 leshort&0x4000 =0x0000 byte reloc, +>6 leshort&0x0003 =0x0000 alignment 1 +>6 leshort&0x0003 =0x0001 alignment 2 +>6 leshort&0x0003 =0x0002 alignment 4 +>6 leshort&0x0003 =0x0003 alignment 256 diff --git a/magic/Magdir/xwindows b/magic/Magdir/xwindows new file mode 100644 index 0000000..6ebe676 --- /dev/null +++ b/magic/Magdir/xwindows @@ -0,0 +1,35 @@ + +#------------------------------------------------------------------------------ +# $File: xwindows,v 1.8 2013/02/08 17:25:57 christos Exp $ +# xwindows: file(1) magic for various X/Window system file formats. + +# Compiled X Keymap +# XKM (compiled X keymap) files (including version and byte ordering) +1 string mkx Compiled XKB Keymap: lsb, +>0 byte >0 version %d +>0 byte =0 obsolete +0 string xkm Compiled XKB Keymap: msb, +>3 byte >0 version %d +>3 byte =0 obsolete + +# xfsdump archive +0 string xFSdump0 xfsdump archive +>8 belong x (version %d) + +# Jaleo XFS files +0 long 395726 Jaleo XFS file +>4 long x - version %ld +>8 long x - [%ld - +>20 long x \b%ldx +>24 long x \b%ldx +>28 long 1008 \bYUV422] +>28 long 1000 \bRGB24] + +# Xcursor data +# X11 mouse cursor format defined in libXcursor, see +# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html +# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h +0 string Xcur Xcursor data +!:mime image/x-xcursor +>10 leshort x version %hd +>>8 leshort x \b.%hd diff --git a/magic/Magdir/zfs b/magic/Magdir/zfs new file mode 100644 index 0000000..1f74409 --- /dev/null +++ b/magic/Magdir/zfs @@ -0,0 +1,96 @@ +#------------------------------------------------------------------------------ +# zfs: file(1) magic for ZFS dumps +# +# From <rea-fbsd@codelabs.ru> +# ZFS dump header has the following structure (as per zfs_ioctl.h +# in FreeBSD with drr_type is set to DRR_BEGIN) +# +# enum { +# DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS, +# DRR_WRITE, DRR_FREE, DRR_END, +# } drr_type; +# uint32_t drr_pad; +# uint64_t drr_magic; +# uint64_t drr_version; +# uint64_t drr_creation_time; +# dmu_objset_type_t drr_type; +# uint32_t drr_pad; +# uint64_t drr_toguid; +# uint64_t drr_fromguid; +# char drr_toname[MAXNAMELEN]; +# +# Backup magic is 0x00000002f5bacbac (quad word) +# The drr_type is defined as +# typedef enum dmu_objset_type { +# DMU_OST_NONE, +# DMU_OST_META, +# DMU_OST_ZFS, +# DMU_OST_ZVOL, +# DMU_OST_OTHER, /* For testing only! */ +# DMU_OST_ANY, /* Be careful! */ +# DMU_OST_NUMTYPES +# } dmu_objset_type_t; +# +# Almost all uint64_t fields are printed as the 32-bit ones (with high +# 32 bits zeroed), because there is no simple way to print them as the +# full 64-bit values. + +# Big-endian values +8 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine), +>20 belong x version %lu, +>32 belong 0 type: NONE, +>32 belong 1 type: META, +>32 belong 2 type: ZFS, +>32 belong 3 type: ZVOL, +>32 belong 4 type: OTHER, +>32 belong 5 type: ANY, +>32 belong >5 type: UNKNOWN (%lu), +>40 byte x destination GUID: %02X +>41 byte x %02X +>42 byte x %02X +>43 byte x %02X +>44 byte x %02X +>45 byte x %02X +>46 byte x %02X +>47 byte x %02X, +>48 ulong >0 +>>52 ulong >0 +>>>48 byte x source GUID: %02X +>>>49 byte x %02X +>>>50 byte x %02X +>>>51 byte x %02X +>>>52 byte x %02X +>>>53 byte x %02X +>>>54 byte x %02X +>>>55 byte x %02X, +>56 string >\0 name: '%s' + +# Little-endian values +8 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine), +>16 lelong x version %lu, +>32 lelong 0 type: NONE, +>32 lelong 1 type: META, +>32 lelong 2 type: ZFS, +>32 lelong 3 type: ZVOL, +>32 lelong 4 type: OTHER, +>32 lelong 5 type: ANY, +>32 lelong >5 type: UNKNOWN (%lu), +>47 byte x destination GUID: %02X +>46 byte x %02X +>45 byte x %02X +>44 byte x %02X +>43 byte x %02X +>42 byte x %02X +>41 byte x %02X +>40 byte x %02X, +>48 ulong >0 +>>52 ulong >0 +>>>55 byte x source GUID: %02X +>>>54 byte x %02X +>>>53 byte x %02X +>>>52 byte x %02X +>>>51 byte x %02X +>>>50 byte x %02X +>>>49 byte x %02X +>>>48 byte x %02X, +>56 string >\0 name: '%s' diff --git a/magic/Magdir/zilog b/magic/Magdir/zilog new file mode 100644 index 0000000..1c861fb --- /dev/null +++ b/magic/Magdir/zilog @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $ +# zilog: file(1) magic for Zilog Z8000. +# +# Was it big-endian or little-endian? My Product Specification doesn't +# say. +# +0 long 0xe807 object file (z8000 a.out) +0 long 0xe808 pure object file (z8000 a.out) +0 long 0xe809 separate object file (z8000 a.out) +0 long 0xe805 overlay object file (z8000 a.out) diff --git a/magic/Magdir/zyxel b/magic/Magdir/zyxel new file mode 100644 index 0000000..d3a43e4 --- /dev/null +++ b/magic/Magdir/zyxel @@ -0,0 +1,17 @@ + +#------------------------------------------------------------------------------ +# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $ +# zyxel: file(1) magic for ZyXEL modems +# +# From <rob@pe1chl.ampr.org> +# These are the /etc/magic entries to decode datafiles as used for the +# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a +# ZyXEL-defined standard) + +0 string ZyXEL\002 ZyXEL voice data +>10 byte 0 - CELP encoding +>10 byte&0x0B 1 - ADPCM2 encoding +>10 byte&0x0B 2 - ADPCM3 encoding +>10 byte&0x0B 3 - ADPCM4 encoding +>10 byte&0x0B 8 - New ADPCM3 encoding +>10 byte&0x04 4 with resync diff --git a/magic/Makefile.am b/magic/Makefile.am new file mode 100644 index 0000000..6a587c7 --- /dev/null +++ b/magic/Makefile.am @@ -0,0 +1,289 @@ +# +# $File: Makefile.am,v 1.89 2013/02/18 18:31:09 christos Exp $ +# +MAGIC_FRAGMENT_BASE = Magdir +MAGIC_DIR = $(top_srcdir)/magic +MAGIC_FRAGMENT_DIR = $(MAGIC_DIR)/$(MAGIC_FRAGMENT_BASE) + +pkgdata_DATA = magic.mgc + +EXTRA_DIST = \ +$(MAGIC_DIR)/Header \ +$(MAGIC_DIR)/Localstuff \ +$(MAGIC_FRAGMENT_DIR)/acorn \ +$(MAGIC_FRAGMENT_DIR)/adi \ +$(MAGIC_FRAGMENT_DIR)/adventure \ +$(MAGIC_FRAGMENT_DIR)/allegro \ +$(MAGIC_FRAGMENT_DIR)/alliant \ +$(MAGIC_FRAGMENT_DIR)/amanda \ +$(MAGIC_FRAGMENT_DIR)/amigaos \ +$(MAGIC_FRAGMENT_DIR)/animation \ +$(MAGIC_FRAGMENT_DIR)/aout \ +$(MAGIC_FRAGMENT_DIR)/apl \ +$(MAGIC_FRAGMENT_DIR)/apple \ +$(MAGIC_FRAGMENT_DIR)/applix \ +$(MAGIC_FRAGMENT_DIR)/archive \ +$(MAGIC_FRAGMENT_DIR)/assembler \ +$(MAGIC_FRAGMENT_DIR)/asterix \ +$(MAGIC_FRAGMENT_DIR)/att3b \ +$(MAGIC_FRAGMENT_DIR)/audio \ +$(MAGIC_FRAGMENT_DIR)/basis \ +$(MAGIC_FRAGMENT_DIR)/bflt \ +$(MAGIC_FRAGMENT_DIR)/blcr \ +$(MAGIC_FRAGMENT_DIR)/blender \ +$(MAGIC_FRAGMENT_DIR)/blit \ +$(MAGIC_FRAGMENT_DIR)/bout \ +$(MAGIC_FRAGMENT_DIR)/bsdi \ +$(MAGIC_FRAGMENT_DIR)/bsi \ +$(MAGIC_FRAGMENT_DIR)/btsnoop \ +$(MAGIC_FRAGMENT_DIR)/c-lang \ +$(MAGIC_FRAGMENT_DIR)/c64 \ +$(MAGIC_FRAGMENT_DIR)/cad \ +$(MAGIC_FRAGMENT_DIR)/cafebabe \ +$(MAGIC_FRAGMENT_DIR)/cddb \ +$(MAGIC_FRAGMENT_DIR)/chord \ +$(MAGIC_FRAGMENT_DIR)/cisco \ +$(MAGIC_FRAGMENT_DIR)/citrus \ +$(MAGIC_FRAGMENT_DIR)/clarion \ +$(MAGIC_FRAGMENT_DIR)/claris \ +$(MAGIC_FRAGMENT_DIR)/clipper \ +$(MAGIC_FRAGMENT_DIR)/commands \ +$(MAGIC_FRAGMENT_DIR)/communications \ +$(MAGIC_FRAGMENT_DIR)/compress \ +$(MAGIC_FRAGMENT_DIR)/console \ +$(MAGIC_FRAGMENT_DIR)/convex \ +$(MAGIC_FRAGMENT_DIR)/cracklib \ +$(MAGIC_FRAGMENT_DIR)/ctags \ +$(MAGIC_FRAGMENT_DIR)/cubemap \ +$(MAGIC_FRAGMENT_DIR)/cups \ +$(MAGIC_FRAGMENT_DIR)/dact \ +$(MAGIC_FRAGMENT_DIR)/database \ +$(MAGIC_FRAGMENT_DIR)/diamond \ +$(MAGIC_FRAGMENT_DIR)/diff \ +$(MAGIC_FRAGMENT_DIR)/digital \ +$(MAGIC_FRAGMENT_DIR)/dolby \ +$(MAGIC_FRAGMENT_DIR)/dump \ +$(MAGIC_FRAGMENT_DIR)/dyadic \ +$(MAGIC_FRAGMENT_DIR)/ebml \ +$(MAGIC_FRAGMENT_DIR)/editors \ +$(MAGIC_FRAGMENT_DIR)/efi \ +$(MAGIC_FRAGMENT_DIR)/elf \ +$(MAGIC_FRAGMENT_DIR)/encore \ +$(MAGIC_FRAGMENT_DIR)/epoc \ +$(MAGIC_FRAGMENT_DIR)/erlang \ +$(MAGIC_FRAGMENT_DIR)/esri \ +$(MAGIC_FRAGMENT_DIR)/fcs \ +$(MAGIC_FRAGMENT_DIR)/filesystems \ +$(MAGIC_FRAGMENT_DIR)/flash \ +$(MAGIC_FRAGMENT_DIR)/fonts \ +$(MAGIC_FRAGMENT_DIR)/fortran \ +$(MAGIC_FRAGMENT_DIR)/frame \ +$(MAGIC_FRAGMENT_DIR)/freebsd \ +$(MAGIC_FRAGMENT_DIR)/fsav \ +$(MAGIC_FRAGMENT_DIR)/fusecompress \ +$(MAGIC_FRAGMENT_DIR)/games \ +$(MAGIC_FRAGMENT_DIR)/gcc \ +$(MAGIC_FRAGMENT_DIR)/geo \ +$(MAGIC_FRAGMENT_DIR)/geos \ +$(MAGIC_FRAGMENT_DIR)/gimp \ +$(MAGIC_FRAGMENT_DIR)/gnome \ +$(MAGIC_FRAGMENT_DIR)/gnu \ +$(MAGIC_FRAGMENT_DIR)/gnumeric \ +$(MAGIC_FRAGMENT_DIR)/gpt \ +$(MAGIC_FRAGMENT_DIR)/grace \ +$(MAGIC_FRAGMENT_DIR)/graphviz \ +$(MAGIC_FRAGMENT_DIR)/gringotts \ +$(MAGIC_FRAGMENT_DIR)/guile \ +$(MAGIC_FRAGMENT_DIR)/hitachi-sh \ +$(MAGIC_FRAGMENT_DIR)/hp \ +$(MAGIC_FRAGMENT_DIR)/human68k \ +$(MAGIC_FRAGMENT_DIR)/ibm370 \ +$(MAGIC_FRAGMENT_DIR)/ibm6000 \ +$(MAGIC_FRAGMENT_DIR)/icc \ +$(MAGIC_FRAGMENT_DIR)/iff \ +$(MAGIC_FRAGMENT_DIR)/images \ +$(MAGIC_FRAGMENT_DIR)/inform \ +$(MAGIC_FRAGMENT_DIR)/intel \ +$(MAGIC_FRAGMENT_DIR)/interleaf \ +$(MAGIC_FRAGMENT_DIR)/island \ +$(MAGIC_FRAGMENT_DIR)/ispell \ +$(MAGIC_FRAGMENT_DIR)/isz \ +$(MAGIC_FRAGMENT_DIR)/java \ +$(MAGIC_FRAGMENT_DIR)/javascript \ +$(MAGIC_FRAGMENT_DIR)/jpeg \ +$(MAGIC_FRAGMENT_DIR)/karma \ +$(MAGIC_FRAGMENT_DIR)/kde \ +$(MAGIC_FRAGMENT_DIR)/keepass \ +$(MAGIC_FRAGMENT_DIR)/kml \ +$(MAGIC_FRAGMENT_DIR)/lecter \ +$(MAGIC_FRAGMENT_DIR)/lex \ +$(MAGIC_FRAGMENT_DIR)/lif \ +$(MAGIC_FRAGMENT_DIR)/linux \ +$(MAGIC_FRAGMENT_DIR)/lisp \ +$(MAGIC_FRAGMENT_DIR)/llvm \ +$(MAGIC_FRAGMENT_DIR)/lua \ +$(MAGIC_FRAGMENT_DIR)/luks \ +$(MAGIC_FRAGMENT_DIR)/m4 \ +$(MAGIC_FRAGMENT_DIR)/mach \ +$(MAGIC_FRAGMENT_DIR)/macos \ +$(MAGIC_FRAGMENT_DIR)/macintosh \ +$(MAGIC_FRAGMENT_DIR)/magic \ +$(MAGIC_FRAGMENT_DIR)/mail.news \ +$(MAGIC_FRAGMENT_DIR)/make \ +$(MAGIC_FRAGMENT_DIR)/maple \ +$(MAGIC_FRAGMENT_DIR)/marc21 \ +$(MAGIC_FRAGMENT_DIR)/mathcad \ +$(MAGIC_FRAGMENT_DIR)/mathematica \ +$(MAGIC_FRAGMENT_DIR)/matroska \ +$(MAGIC_FRAGMENT_DIR)/mcrypt \ +$(MAGIC_FRAGMENT_DIR)/mercurial \ +$(MAGIC_FRAGMENT_DIR)/metastore \ +$(MAGIC_FRAGMENT_DIR)/mime \ +$(MAGIC_FRAGMENT_DIR)/mips \ +$(MAGIC_FRAGMENT_DIR)/mirage \ +$(MAGIC_FRAGMENT_DIR)/misctools \ +$(MAGIC_FRAGMENT_DIR)/mkid \ +$(MAGIC_FRAGMENT_DIR)/mlssa \ +$(MAGIC_FRAGMENT_DIR)/mmdf \ +$(MAGIC_FRAGMENT_DIR)/modem \ +$(MAGIC_FRAGMENT_DIR)/motorola \ +$(MAGIC_FRAGMENT_DIR)/mozilla \ +$(MAGIC_FRAGMENT_DIR)/msdos \ +$(MAGIC_FRAGMENT_DIR)/msooxml \ +$(MAGIC_FRAGMENT_DIR)/msvc \ +$(MAGIC_FRAGMENT_DIR)/mup \ +$(MAGIC_FRAGMENT_DIR)/music \ +$(MAGIC_FRAGMENT_DIR)/natinst \ +$(MAGIC_FRAGMENT_DIR)/ncr \ +$(MAGIC_FRAGMENT_DIR)/netbsd \ +$(MAGIC_FRAGMENT_DIR)/netscape \ +$(MAGIC_FRAGMENT_DIR)/netware \ +$(MAGIC_FRAGMENT_DIR)/news \ +$(MAGIC_FRAGMENT_DIR)/nitpicker \ +$(MAGIC_FRAGMENT_DIR)/oasis \ +$(MAGIC_FRAGMENT_DIR)/ocaml \ +$(MAGIC_FRAGMENT_DIR)/octave \ +$(MAGIC_FRAGMENT_DIR)/ole2compounddocs \ +$(MAGIC_FRAGMENT_DIR)/olf \ +$(MAGIC_FRAGMENT_DIR)/os2 \ +$(MAGIC_FRAGMENT_DIR)/os400 \ +$(MAGIC_FRAGMENT_DIR)/os9 \ +$(MAGIC_FRAGMENT_DIR)/osf1 \ +$(MAGIC_FRAGMENT_DIR)/palm \ +$(MAGIC_FRAGMENT_DIR)/parix \ +$(MAGIC_FRAGMENT_DIR)/parrot \ +$(MAGIC_FRAGMENT_DIR)/pascal \ +$(MAGIC_FRAGMENT_DIR)/pbm \ +$(MAGIC_FRAGMENT_DIR)/pdf \ +$(MAGIC_FRAGMENT_DIR)/pdp \ +$(MAGIC_FRAGMENT_DIR)/perl \ +$(MAGIC_FRAGMENT_DIR)/pgp \ +$(MAGIC_FRAGMENT_DIR)/pkgadd \ +$(MAGIC_FRAGMENT_DIR)/plan9 \ +$(MAGIC_FRAGMENT_DIR)/plus5 \ +$(MAGIC_FRAGMENT_DIR)/printer \ +$(MAGIC_FRAGMENT_DIR)/project \ +$(MAGIC_FRAGMENT_DIR)/psdbms \ +$(MAGIC_FRAGMENT_DIR)/pulsar \ +$(MAGIC_FRAGMENT_DIR)/pwsafe \ +$(MAGIC_FRAGMENT_DIR)/pyramid \ +$(MAGIC_FRAGMENT_DIR)/python \ +$(MAGIC_FRAGMENT_DIR)/revision \ +$(MAGIC_FRAGMENT_DIR)/riff \ +$(MAGIC_FRAGMENT_DIR)/rinex \ +$(MAGIC_FRAGMENT_DIR)/rpm \ +$(MAGIC_FRAGMENT_DIR)/rtf \ +$(MAGIC_FRAGMENT_DIR)/ruby \ +$(MAGIC_FRAGMENT_DIR)/sc \ +$(MAGIC_FRAGMENT_DIR)/sccs \ +$(MAGIC_FRAGMENT_DIR)/scientific \ +$(MAGIC_FRAGMENT_DIR)/securitycerts \ +$(MAGIC_FRAGMENT_DIR)/selinux \ +$(MAGIC_FRAGMENT_DIR)/sendmail \ +$(MAGIC_FRAGMENT_DIR)/sequent \ +$(MAGIC_FRAGMENT_DIR)/sgi \ +$(MAGIC_FRAGMENT_DIR)/sgml \ +$(MAGIC_FRAGMENT_DIR)/sharc \ +$(MAGIC_FRAGMENT_DIR)/sinclair \ +$(MAGIC_FRAGMENT_DIR)/sisu \ +$(MAGIC_FRAGMENT_DIR)/sketch \ +$(MAGIC_FRAGMENT_DIR)/smalltalk \ +$(MAGIC_FRAGMENT_DIR)/smile \ +$(MAGIC_FRAGMENT_DIR)/sniffer \ +$(MAGIC_FRAGMENT_DIR)/softquad \ +$(MAGIC_FRAGMENT_DIR)/spec \ +$(MAGIC_FRAGMENT_DIR)/spectrum \ +$(MAGIC_FRAGMENT_DIR)/sql \ +$(MAGIC_FRAGMENT_DIR)/ssh \ +$(MAGIC_FRAGMENT_DIR)/ssl \ +$(MAGIC_FRAGMENT_DIR)/sun \ +$(MAGIC_FRAGMENT_DIR)/sysex \ +$(MAGIC_FRAGMENT_DIR)/tcl \ +$(MAGIC_FRAGMENT_DIR)/teapot \ +$(MAGIC_FRAGMENT_DIR)/terminfo \ +$(MAGIC_FRAGMENT_DIR)/tex \ +$(MAGIC_FRAGMENT_DIR)/tgif \ +$(MAGIC_FRAGMENT_DIR)/ti-8x \ +$(MAGIC_FRAGMENT_DIR)/timezone \ +$(MAGIC_FRAGMENT_DIR)/troff \ +$(MAGIC_FRAGMENT_DIR)/tuxedo \ +$(MAGIC_FRAGMENT_DIR)/typeset \ +$(MAGIC_FRAGMENT_DIR)/unicode \ +$(MAGIC_FRAGMENT_DIR)/unknown \ +$(MAGIC_FRAGMENT_DIR)/uterus \ +$(MAGIC_FRAGMENT_DIR)/uuencode \ +$(MAGIC_FRAGMENT_DIR)/varied.out \ +$(MAGIC_FRAGMENT_DIR)/varied.script \ +$(MAGIC_FRAGMENT_DIR)/vax \ +$(MAGIC_FRAGMENT_DIR)/vicar \ +$(MAGIC_FRAGMENT_DIR)/virtual \ +$(MAGIC_FRAGMENT_DIR)/virtutech \ +$(MAGIC_FRAGMENT_DIR)/visx \ +$(MAGIC_FRAGMENT_DIR)/vms \ +$(MAGIC_FRAGMENT_DIR)/vmware \ +$(MAGIC_FRAGMENT_DIR)/vorbis \ +$(MAGIC_FRAGMENT_DIR)/vxl \ +$(MAGIC_FRAGMENT_DIR)/warc \ +$(MAGIC_FRAGMENT_DIR)/weak \ +$(MAGIC_FRAGMENT_DIR)/windows \ +$(MAGIC_FRAGMENT_DIR)/wireless \ +$(MAGIC_FRAGMENT_DIR)/wordprocessors \ +$(MAGIC_FRAGMENT_DIR)/wsdl \ +$(MAGIC_FRAGMENT_DIR)/xdelta \ +$(MAGIC_FRAGMENT_DIR)/xenix \ +$(MAGIC_FRAGMENT_DIR)/xilinx \ +$(MAGIC_FRAGMENT_DIR)/xo65 \ +$(MAGIC_FRAGMENT_DIR)/xwindows \ +$(MAGIC_FRAGMENT_DIR)/zfs \ +$(MAGIC_FRAGMENT_DIR)/zilog \ +$(MAGIC_FRAGMENT_DIR)/zyxel + +MAGIC = magic.mgc +CLEANFILES = ${MAGIC} $(MAGIC_FRAGMENT_DIR)/Localstuff + +# FIXME: Build file natively as well so that it can be used to compile +# the target's magic file; for now we bail if the local version does not match +if IS_CROSS_COMPILE +FILE_COMPILE = file +FILE_COMPILE_DEP = +else +FILE_COMPILE = $(top_builddir)/src/file +FILE_COMPILE_DEP = $(FILE_COMPILE) +endif + +${MAGIC}: $(EXTRA_DIST) $(FILE_COMPILE_DEP) + @rm -fr magic + @mkdir magic && cp -p $(EXTRA_DIST) magic + @(if expr "${FILE_COMPILE}" : '.*/.*' > /dev/null; then \ + echo "Using ${FILE_COMPILE} to generate ${MAGIC}" > /dev/null; \ + else \ + v=$$(file --version | sed -e s/file-// -e q); \ + if [ "$$v" != "${PACKAGE_VERSION}" ]; then \ + echo "Cannot use the installed version of file ($$v) to"; \ + echo "cross-compile file ${PACKAGE_VERSION}"; \ + echo "Please install file ${PACKAGE_VERSION} locally first"; \ + exit 1; \ + fi; \ + fi) + $(FILE_COMPILE) -C -m magic + @rm -fr magic diff --git a/magic/Makefile.in b/magic/Makefile.in new file mode 100644 index 0000000..f9f6c3f --- /dev/null +++ b/magic/Makefile.in @@ -0,0 +1,697 @@ +# Makefile.in generated by automake 1.11.1 from Makefile.am. +# @configure_input@ + +# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, +# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation, +# Inc. +# This Makefile.in is free software; the Free Software Foundation +# gives unlimited permission to copy and/or distribute it, +# with or without modifications, as long as this notice is preserved. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY, to the extent permitted by law; without +# even the implied warranty of MERCHANTABILITY or FITNESS FOR A +# PARTICULAR PURPOSE. + +@SET_MAKE@ + +VPATH = @srcdir@ +pkgincludedir = $(includedir)/@PACKAGE@ +pkglibdir = $(libdir)/@PACKAGE@ +pkglibexecdir = $(libexecdir)/@PACKAGE@ +am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd +install_sh_DATA = $(install_sh) -c -m 644 +install_sh_PROGRAM = $(install_sh) -c +install_sh_SCRIPT = $(install_sh) -c +INSTALL_HEADER = $(INSTALL_DATA) +transform = $(program_transform_name) +NORMAL_INSTALL = : +PRE_INSTALL = : +POST_INSTALL = : +NORMAL_UNINSTALL = : +PRE_UNINSTALL = : +POST_UNINSTALL = : +build_triplet = @build@ +host_triplet = @host@ +subdir = magic +DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in +ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 +am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \ + $(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \ + $(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \ + $(top_srcdir)/m4/visibility.m4 $(top_srcdir)/acinclude.m4 \ + $(top_srcdir)/configure.ac +am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ + $(ACLOCAL_M4) +mkinstalldirs = $(install_sh) -d +CONFIG_HEADER = $(top_builddir)/config.h +CONFIG_CLEAN_FILES = +CONFIG_CLEAN_VPATH_FILES = +AM_V_GEN = $(am__v_GEN_$(V)) +am__v_GEN_ = $(am__v_GEN_$(AM_DEFAULT_VERBOSITY)) +am__v_GEN_0 = @echo " GEN " $@; +AM_V_at = $(am__v_at_$(V)) +am__v_at_ = $(am__v_at_$(AM_DEFAULT_VERBOSITY)) +am__v_at_0 = @ +SOURCES = +DIST_SOURCES = +am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; +am__vpath_adj = case $$p in \ + $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \ + *) f=$$p;; \ + esac; +am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`; +am__install_max = 40 +am__nobase_strip_setup = \ + srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'` +am__nobase_strip = \ + for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||" +am__nobase_list = $(am__nobase_strip_setup); \ + for p in $$list; do echo "$$p $$p"; done | \ + sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \ + $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \ + if (++n[$$2] == $(am__install_max)) \ + { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \ + END { for (dir in files) print dir, files[dir] }' +am__base_list = \ + sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ + sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' +am__installdirs = "$(DESTDIR)$(pkgdatadir)" +DATA = $(pkgdata_DATA) +DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) +pkgdatadir = @pkgdatadir@ +ACLOCAL = @ACLOCAL@ +AMTAR = @AMTAR@ +AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ +AR = @AR@ +AUTOCONF = @AUTOCONF@ +AUTOHEADER = @AUTOHEADER@ +AUTOMAKE = @AUTOMAKE@ +AWK = @AWK@ +CC = @CC@ +CCDEPMODE = @CCDEPMODE@ +CFLAGS = @CFLAGS@ +CFLAG_VISIBILITY = @CFLAG_VISIBILITY@ +CPP = @CPP@ +CPPFLAGS = @CPPFLAGS@ +CYGPATH_W = @CYGPATH_W@ +DEFS = @DEFS@ +DEPDIR = @DEPDIR@ +DSYMUTIL = @DSYMUTIL@ +DUMPBIN = @DUMPBIN@ +ECHO_C = @ECHO_C@ +ECHO_N = @ECHO_N@ +ECHO_T = @ECHO_T@ +EGREP = @EGREP@ +EXEEXT = @EXEEXT@ +FGREP = @FGREP@ +GREP = @GREP@ +HAVE_VISIBILITY = @HAVE_VISIBILITY@ +INSTALL = @INSTALL@ +INSTALL_DATA = @INSTALL_DATA@ +INSTALL_PROGRAM = @INSTALL_PROGRAM@ +INSTALL_SCRIPT = @INSTALL_SCRIPT@ +INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +LD = @LD@ +LDFLAGS = @LDFLAGS@ +LIBOBJS = @LIBOBJS@ +LIBS = @LIBS@ +LIBTOOL = @LIBTOOL@ +LIPO = @LIPO@ +LN_S = @LN_S@ +LTLIBOBJS = @LTLIBOBJS@ +MAKEINFO = @MAKEINFO@ +MINGW = @MINGW@ +MKDIR_P = @MKDIR_P@ +NM = @NM@ +NMEDIT = @NMEDIT@ +OBJDUMP = @OBJDUMP@ +OBJEXT = @OBJEXT@ +OTOOL = @OTOOL@ +OTOOL64 = @OTOOL64@ +PACKAGE = @PACKAGE@ +PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ +PACKAGE_NAME = @PACKAGE_NAME@ +PACKAGE_STRING = @PACKAGE_STRING@ +PACKAGE_TARNAME = @PACKAGE_TARNAME@ +PACKAGE_URL = @PACKAGE_URL@ +PACKAGE_VERSION = @PACKAGE_VERSION@ +PATH_SEPARATOR = @PATH_SEPARATOR@ +RANLIB = @RANLIB@ +SED = @SED@ +SET_MAKE = @SET_MAKE@ +SHELL = @SHELL@ +STRIP = @STRIP@ +VERSION = @VERSION@ +WARNINGS = @WARNINGS@ +abs_builddir = @abs_builddir@ +abs_srcdir = @abs_srcdir@ +abs_top_builddir = @abs_top_builddir@ +abs_top_srcdir = @abs_top_srcdir@ +ac_ct_CC = @ac_ct_CC@ +ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ +am__include = @am__include@ +am__leading_dot = @am__leading_dot@ +am__quote = @am__quote@ +am__tar = @am__tar@ +am__untar = @am__untar@ +bindir = @bindir@ +build = @build@ +build_alias = @build_alias@ +build_cpu = @build_cpu@ +build_os = @build_os@ +build_vendor = @build_vendor@ +builddir = @builddir@ +datadir = @datadir@ +datarootdir = @datarootdir@ +docdir = @docdir@ +dvidir = @dvidir@ +exec_prefix = @exec_prefix@ +fsect = @fsect@ +host = @host@ +host_alias = @host_alias@ +host_cpu = @host_cpu@ +host_os = @host_os@ +host_vendor = @host_vendor@ +htmldir = @htmldir@ +includedir = @includedir@ +infodir = @infodir@ +install_sh = @install_sh@ +libdir = @libdir@ +libexecdir = @libexecdir@ +localedir = @localedir@ +localstatedir = @localstatedir@ +lt_ECHO = @lt_ECHO@ +mandir = @mandir@ +mkdir_p = @mkdir_p@ +oldincludedir = @oldincludedir@ +pdfdir = @pdfdir@ +prefix = @prefix@ +program_transform_name = @program_transform_name@ +psdir = @psdir@ +sbindir = @sbindir@ +sharedstatedir = @sharedstatedir@ +srcdir = @srcdir@ +sysconfdir = @sysconfdir@ +target_alias = @target_alias@ +top_build_prefix = @top_build_prefix@ +top_builddir = @top_builddir@ +top_srcdir = @top_srcdir@ + +# +# $File: Makefile.am,v 1.89 2013/02/18 18:31:09 christos Exp $ +# +MAGIC_FRAGMENT_BASE = Magdir +MAGIC_DIR = $(top_srcdir)/magic +MAGIC_FRAGMENT_DIR = $(MAGIC_DIR)/$(MAGIC_FRAGMENT_BASE) +pkgdata_DATA = magic.mgc +EXTRA_DIST = \ +$(MAGIC_DIR)/Header \ +$(MAGIC_DIR)/Localstuff \ +$(MAGIC_FRAGMENT_DIR)/acorn \ +$(MAGIC_FRAGMENT_DIR)/adi \ +$(MAGIC_FRAGMENT_DIR)/adventure \ +$(MAGIC_FRAGMENT_DIR)/allegro \ +$(MAGIC_FRAGMENT_DIR)/alliant \ +$(MAGIC_FRAGMENT_DIR)/amanda \ +$(MAGIC_FRAGMENT_DIR)/amigaos \ +$(MAGIC_FRAGMENT_DIR)/animation \ +$(MAGIC_FRAGMENT_DIR)/aout \ +$(MAGIC_FRAGMENT_DIR)/apl \ +$(MAGIC_FRAGMENT_DIR)/apple \ +$(MAGIC_FRAGMENT_DIR)/applix \ +$(MAGIC_FRAGMENT_DIR)/archive \ +$(MAGIC_FRAGMENT_DIR)/assembler \ +$(MAGIC_FRAGMENT_DIR)/asterix \ +$(MAGIC_FRAGMENT_DIR)/att3b \ +$(MAGIC_FRAGMENT_DIR)/audio \ +$(MAGIC_FRAGMENT_DIR)/basis \ +$(MAGIC_FRAGMENT_DIR)/bflt \ +$(MAGIC_FRAGMENT_DIR)/blcr \ +$(MAGIC_FRAGMENT_DIR)/blender \ +$(MAGIC_FRAGMENT_DIR)/blit \ +$(MAGIC_FRAGMENT_DIR)/bout \ +$(MAGIC_FRAGMENT_DIR)/bsdi \ +$(MAGIC_FRAGMENT_DIR)/bsi \ +$(MAGIC_FRAGMENT_DIR)/btsnoop \ +$(MAGIC_FRAGMENT_DIR)/c-lang \ +$(MAGIC_FRAGMENT_DIR)/c64 \ +$(MAGIC_FRAGMENT_DIR)/cad \ +$(MAGIC_FRAGMENT_DIR)/cafebabe \ +$(MAGIC_FRAGMENT_DIR)/cddb \ +$(MAGIC_FRAGMENT_DIR)/chord \ +$(MAGIC_FRAGMENT_DIR)/cisco \ +$(MAGIC_FRAGMENT_DIR)/citrus \ +$(MAGIC_FRAGMENT_DIR)/clarion \ +$(MAGIC_FRAGMENT_DIR)/claris \ +$(MAGIC_FRAGMENT_DIR)/clipper \ +$(MAGIC_FRAGMENT_DIR)/commands \ +$(MAGIC_FRAGMENT_DIR)/communications \ +$(MAGIC_FRAGMENT_DIR)/compress \ +$(MAGIC_FRAGMENT_DIR)/console \ +$(MAGIC_FRAGMENT_DIR)/convex \ +$(MAGIC_FRAGMENT_DIR)/cracklib \ +$(MAGIC_FRAGMENT_DIR)/ctags \ +$(MAGIC_FRAGMENT_DIR)/cubemap \ +$(MAGIC_FRAGMENT_DIR)/cups \ +$(MAGIC_FRAGMENT_DIR)/dact \ +$(MAGIC_FRAGMENT_DIR)/database \ +$(MAGIC_FRAGMENT_DIR)/diamond \ +$(MAGIC_FRAGMENT_DIR)/diff \ +$(MAGIC_FRAGMENT_DIR)/digital \ +$(MAGIC_FRAGMENT_DIR)/dolby \ +$(MAGIC_FRAGMENT_DIR)/dump \ +$(MAGIC_FRAGMENT_DIR)/dyadic \ +$(MAGIC_FRAGMENT_DIR)/ebml \ +$(MAGIC_FRAGMENT_DIR)/editors \ +$(MAGIC_FRAGMENT_DIR)/efi \ +$(MAGIC_FRAGMENT_DIR)/elf \ +$(MAGIC_FRAGMENT_DIR)/encore \ +$(MAGIC_FRAGMENT_DIR)/epoc \ +$(MAGIC_FRAGMENT_DIR)/erlang \ +$(MAGIC_FRAGMENT_DIR)/esri \ +$(MAGIC_FRAGMENT_DIR)/fcs \ +$(MAGIC_FRAGMENT_DIR)/filesystems \ +$(MAGIC_FRAGMENT_DIR)/flash \ +$(MAGIC_FRAGMENT_DIR)/fonts \ +$(MAGIC_FRAGMENT_DIR)/fortran \ +$(MAGIC_FRAGMENT_DIR)/frame \ +$(MAGIC_FRAGMENT_DIR)/freebsd \ +$(MAGIC_FRAGMENT_DIR)/fsav \ +$(MAGIC_FRAGMENT_DIR)/fusecompress \ +$(MAGIC_FRAGMENT_DIR)/games \ +$(MAGIC_FRAGMENT_DIR)/gcc \ +$(MAGIC_FRAGMENT_DIR)/geo \ +$(MAGIC_FRAGMENT_DIR)/geos \ +$(MAGIC_FRAGMENT_DIR)/gimp \ +$(MAGIC_FRAGMENT_DIR)/gnome \ +$(MAGIC_FRAGMENT_DIR)/gnu \ +$(MAGIC_FRAGMENT_DIR)/gnumeric \ +$(MAGIC_FRAGMENT_DIR)/gpt \ +$(MAGIC_FRAGMENT_DIR)/grace \ +$(MAGIC_FRAGMENT_DIR)/graphviz \ +$(MAGIC_FRAGMENT_DIR)/gringotts \ +$(MAGIC_FRAGMENT_DIR)/guile \ +$(MAGIC_FRAGMENT_DIR)/hitachi-sh \ +$(MAGIC_FRAGMENT_DIR)/hp \ +$(MAGIC_FRAGMENT_DIR)/human68k \ +$(MAGIC_FRAGMENT_DIR)/ibm370 \ +$(MAGIC_FRAGMENT_DIR)/ibm6000 \ +$(MAGIC_FRAGMENT_DIR)/icc \ +$(MAGIC_FRAGMENT_DIR)/iff \ +$(MAGIC_FRAGMENT_DIR)/images \ +$(MAGIC_FRAGMENT_DIR)/inform \ +$(MAGIC_FRAGMENT_DIR)/intel \ +$(MAGIC_FRAGMENT_DIR)/interleaf \ +$(MAGIC_FRAGMENT_DIR)/island \ +$(MAGIC_FRAGMENT_DIR)/ispell \ +$(MAGIC_FRAGMENT_DIR)/isz \ +$(MAGIC_FRAGMENT_DIR)/java \ +$(MAGIC_FRAGMENT_DIR)/javascript \ +$(MAGIC_FRAGMENT_DIR)/jpeg \ +$(MAGIC_FRAGMENT_DIR)/karma \ +$(MAGIC_FRAGMENT_DIR)/kde \ +$(MAGIC_FRAGMENT_DIR)/keepass \ +$(MAGIC_FRAGMENT_DIR)/kml \ +$(MAGIC_FRAGMENT_DIR)/lecter \ +$(MAGIC_FRAGMENT_DIR)/lex \ +$(MAGIC_FRAGMENT_DIR)/lif \ +$(MAGIC_FRAGMENT_DIR)/linux \ +$(MAGIC_FRAGMENT_DIR)/lisp \ +$(MAGIC_FRAGMENT_DIR)/llvm \ +$(MAGIC_FRAGMENT_DIR)/lua \ +$(MAGIC_FRAGMENT_DIR)/luks \ +$(MAGIC_FRAGMENT_DIR)/m4 \ +$(MAGIC_FRAGMENT_DIR)/mach \ +$(MAGIC_FRAGMENT_DIR)/macos \ +$(MAGIC_FRAGMENT_DIR)/macintosh \ +$(MAGIC_FRAGMENT_DIR)/magic \ +$(MAGIC_FRAGMENT_DIR)/mail.news \ +$(MAGIC_FRAGMENT_DIR)/make \ +$(MAGIC_FRAGMENT_DIR)/maple \ +$(MAGIC_FRAGMENT_DIR)/marc21 \ +$(MAGIC_FRAGMENT_DIR)/mathcad \ +$(MAGIC_FRAGMENT_DIR)/mathematica \ +$(MAGIC_FRAGMENT_DIR)/matroska \ +$(MAGIC_FRAGMENT_DIR)/mcrypt \ +$(MAGIC_FRAGMENT_DIR)/mercurial \ +$(MAGIC_FRAGMENT_DIR)/metastore \ +$(MAGIC_FRAGMENT_DIR)/mime \ +$(MAGIC_FRAGMENT_DIR)/mips \ +$(MAGIC_FRAGMENT_DIR)/mirage \ +$(MAGIC_FRAGMENT_DIR)/misctools \ +$(MAGIC_FRAGMENT_DIR)/mkid \ +$(MAGIC_FRAGMENT_DIR)/mlssa \ +$(MAGIC_FRAGMENT_DIR)/mmdf \ +$(MAGIC_FRAGMENT_DIR)/modem \ +$(MAGIC_FRAGMENT_DIR)/motorola \ +$(MAGIC_FRAGMENT_DIR)/mozilla \ +$(MAGIC_FRAGMENT_DIR)/msdos \ +$(MAGIC_FRAGMENT_DIR)/msooxml \ +$(MAGIC_FRAGMENT_DIR)/msvc \ +$(MAGIC_FRAGMENT_DIR)/mup \ +$(MAGIC_FRAGMENT_DIR)/music \ +$(MAGIC_FRAGMENT_DIR)/natinst \ +$(MAGIC_FRAGMENT_DIR)/ncr \ +$(MAGIC_FRAGMENT_DIR)/netbsd \ +$(MAGIC_FRAGMENT_DIR)/netscape \ +$(MAGIC_FRAGMENT_DIR)/netware \ +$(MAGIC_FRAGMENT_DIR)/news \ +$(MAGIC_FRAGMENT_DIR)/nitpicker \ +$(MAGIC_FRAGMENT_DIR)/oasis \ +$(MAGIC_FRAGMENT_DIR)/ocaml \ +$(MAGIC_FRAGMENT_DIR)/octave \ +$(MAGIC_FRAGMENT_DIR)/ole2compounddocs \ +$(MAGIC_FRAGMENT_DIR)/olf \ +$(MAGIC_FRAGMENT_DIR)/os2 \ +$(MAGIC_FRAGMENT_DIR)/os400 \ +$(MAGIC_FRAGMENT_DIR)/os9 \ +$(MAGIC_FRAGMENT_DIR)/osf1 \ +$(MAGIC_FRAGMENT_DIR)/palm \ +$(MAGIC_FRAGMENT_DIR)/parix \ +$(MAGIC_FRAGMENT_DIR)/parrot \ +$(MAGIC_FRAGMENT_DIR)/pascal \ +$(MAGIC_FRAGMENT_DIR)/pbm \ +$(MAGIC_FRAGMENT_DIR)/pdf \ +$(MAGIC_FRAGMENT_DIR)/pdp \ +$(MAGIC_FRAGMENT_DIR)/perl \ +$(MAGIC_FRAGMENT_DIR)/pgp \ +$(MAGIC_FRAGMENT_DIR)/pkgadd \ +$(MAGIC_FRAGMENT_DIR)/plan9 \ +$(MAGIC_FRAGMENT_DIR)/plus5 \ +$(MAGIC_FRAGMENT_DIR)/printer \ +$(MAGIC_FRAGMENT_DIR)/project \ +$(MAGIC_FRAGMENT_DIR)/psdbms \ +$(MAGIC_FRAGMENT_DIR)/pulsar \ +$(MAGIC_FRAGMENT_DIR)/pwsafe \ +$(MAGIC_FRAGMENT_DIR)/pyramid \ +$(MAGIC_FRAGMENT_DIR)/python \ +$(MAGIC_FRAGMENT_DIR)/revision \ +$(MAGIC_FRAGMENT_DIR)/riff \ +$(MAGIC_FRAGMENT_DIR)/rinex \ +$(MAGIC_FRAGMENT_DIR)/rpm \ +$(MAGIC_FRAGMENT_DIR)/rtf \ +$(MAGIC_FRAGMENT_DIR)/ruby \ +$(MAGIC_FRAGMENT_DIR)/sc \ +$(MAGIC_FRAGMENT_DIR)/sccs \ +$(MAGIC_FRAGMENT_DIR)/scientific \ +$(MAGIC_FRAGMENT_DIR)/securitycerts \ +$(MAGIC_FRAGMENT_DIR)/selinux \ +$(MAGIC_FRAGMENT_DIR)/sendmail \ +$(MAGIC_FRAGMENT_DIR)/sequent \ +$(MAGIC_FRAGMENT_DIR)/sgi \ +$(MAGIC_FRAGMENT_DIR)/sgml \ +$(MAGIC_FRAGMENT_DIR)/sharc \ +$(MAGIC_FRAGMENT_DIR)/sinclair \ +$(MAGIC_FRAGMENT_DIR)/sisu \ +$(MAGIC_FRAGMENT_DIR)/sketch \ +$(MAGIC_FRAGMENT_DIR)/smalltalk \ +$(MAGIC_FRAGMENT_DIR)/smile \ +$(MAGIC_FRAGMENT_DIR)/sniffer \ +$(MAGIC_FRAGMENT_DIR)/softquad \ +$(MAGIC_FRAGMENT_DIR)/spec \ +$(MAGIC_FRAGMENT_DIR)/spectrum \ +$(MAGIC_FRAGMENT_DIR)/sql \ +$(MAGIC_FRAGMENT_DIR)/ssh \ +$(MAGIC_FRAGMENT_DIR)/ssl \ +$(MAGIC_FRAGMENT_DIR)/sun \ +$(MAGIC_FRAGMENT_DIR)/sysex \ +$(MAGIC_FRAGMENT_DIR)/tcl \ +$(MAGIC_FRAGMENT_DIR)/teapot \ +$(MAGIC_FRAGMENT_DIR)/terminfo \ +$(MAGIC_FRAGMENT_DIR)/tex \ +$(MAGIC_FRAGMENT_DIR)/tgif \ +$(MAGIC_FRAGMENT_DIR)/ti-8x \ +$(MAGIC_FRAGMENT_DIR)/timezone \ +$(MAGIC_FRAGMENT_DIR)/troff \ +$(MAGIC_FRAGMENT_DIR)/tuxedo \ +$(MAGIC_FRAGMENT_DIR)/typeset \ +$(MAGIC_FRAGMENT_DIR)/unicode \ +$(MAGIC_FRAGMENT_DIR)/unknown \ +$(MAGIC_FRAGMENT_DIR)/uterus \ +$(MAGIC_FRAGMENT_DIR)/uuencode \ +$(MAGIC_FRAGMENT_DIR)/varied.out \ +$(MAGIC_FRAGMENT_DIR)/varied.script \ +$(MAGIC_FRAGMENT_DIR)/vax \ +$(MAGIC_FRAGMENT_DIR)/vicar \ +$(MAGIC_FRAGMENT_DIR)/virtual \ +$(MAGIC_FRAGMENT_DIR)/virtutech \ +$(MAGIC_FRAGMENT_DIR)/visx \ +$(MAGIC_FRAGMENT_DIR)/vms \ +$(MAGIC_FRAGMENT_DIR)/vmware \ +$(MAGIC_FRAGMENT_DIR)/vorbis \ +$(MAGIC_FRAGMENT_DIR)/vxl \ +$(MAGIC_FRAGMENT_DIR)/warc \ +$(MAGIC_FRAGMENT_DIR)/weak \ +$(MAGIC_FRAGMENT_DIR)/windows \ +$(MAGIC_FRAGMENT_DIR)/wireless \ +$(MAGIC_FRAGMENT_DIR)/wordprocessors \ +$(MAGIC_FRAGMENT_DIR)/wsdl \ +$(MAGIC_FRAGMENT_DIR)/xdelta \ +$(MAGIC_FRAGMENT_DIR)/xenix \ +$(MAGIC_FRAGMENT_DIR)/xilinx \ +$(MAGIC_FRAGMENT_DIR)/xo65 \ +$(MAGIC_FRAGMENT_DIR)/xwindows \ +$(MAGIC_FRAGMENT_DIR)/zfs \ +$(MAGIC_FRAGMENT_DIR)/zilog \ +$(MAGIC_FRAGMENT_DIR)/zyxel + +MAGIC = magic.mgc +CLEANFILES = ${MAGIC} $(MAGIC_FRAGMENT_DIR)/Localstuff +@IS_CROSS_COMPILE_FALSE@FILE_COMPILE = $(top_builddir)/src/file + +# FIXME: Build file natively as well so that it can be used to compile +# the target's magic file; for now we bail if the local version does not match +@IS_CROSS_COMPILE_TRUE@FILE_COMPILE = file +@IS_CROSS_COMPILE_FALSE@FILE_COMPILE_DEP = $(FILE_COMPILE) +@IS_CROSS_COMPILE_TRUE@FILE_COMPILE_DEP = +all: all-am + +.SUFFIXES: +$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) + @for dep in $?; do \ + case '$(am__configure_deps)' in \ + *$$dep*) \ + ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ + && { if test -f $@; then exit 0; else break; fi; }; \ + exit 1;; \ + esac; \ + done; \ + echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign magic/Makefile'; \ + $(am__cd) $(top_srcdir) && \ + $(AUTOMAKE) --foreign magic/Makefile +.PRECIOUS: Makefile +Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status + @case '$?' in \ + *config.status*) \ + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ + *) \ + echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ + esac; + +$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh + +$(top_srcdir)/configure: $(am__configure_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(ACLOCAL_M4): $(am__aclocal_m4_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(am__aclocal_m4_deps): + +mostlyclean-libtool: + -rm -f *.lo + +clean-libtool: + -rm -rf .libs _libs +install-pkgdataDATA: $(pkgdata_DATA) + @$(NORMAL_INSTALL) + test -z "$(pkgdatadir)" || $(MKDIR_P) "$(DESTDIR)$(pkgdatadir)" + @list='$(pkgdata_DATA)'; test -n "$(pkgdatadir)" || list=; \ + for p in $$list; do \ + if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \ + echo "$$d$$p"; \ + done | $(am__base_list) | \ + while read files; do \ + echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(pkgdatadir)'"; \ + $(INSTALL_DATA) $$files "$(DESTDIR)$(pkgdatadir)" || exit $$?; \ + done + +uninstall-pkgdataDATA: + @$(NORMAL_UNINSTALL) + @list='$(pkgdata_DATA)'; test -n "$(pkgdatadir)" || list=; \ + files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \ + test -n "$$files" || exit 0; \ + echo " ( cd '$(DESTDIR)$(pkgdatadir)' && rm -f" $$files ")"; \ + cd "$(DESTDIR)$(pkgdatadir)" && rm -f $$files +tags: TAGS +TAGS: + +ctags: CTAGS +CTAGS: + + +distdir: $(DISTFILES) + @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + list='$(DISTFILES)'; \ + dist_files=`for file in $$list; do echo $$file; done | \ + sed -e "s|^$$srcdirstrip/||;t" \ + -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ + case $$dist_files in \ + */*) $(MKDIR_P) `echo "$$dist_files" | \ + sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ + sort -u` ;; \ + esac; \ + for file in $$dist_files; do \ + if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ + if test -d $$d/$$file; then \ + dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ + if test -d "$(distdir)/$$file"; then \ + find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ + fi; \ + if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ + cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ + find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ + fi; \ + cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ + else \ + test -f "$(distdir)/$$file" \ + || cp -p $$d/$$file "$(distdir)/$$file" \ + || exit 1; \ + fi; \ + done +check-am: all-am +check: check-am +all-am: Makefile $(DATA) +installdirs: + for dir in "$(DESTDIR)$(pkgdatadir)"; do \ + test -z "$$dir" || $(MKDIR_P) "$$dir"; \ + done +install: install-am +install-exec: install-exec-am +install-data: install-data-am +uninstall: uninstall-am + +install-am: all-am + @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am + +installcheck: installcheck-am +install-strip: + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + `test -z '$(STRIP)' || \ + echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install +mostlyclean-generic: + +clean-generic: + -test -z "$(CLEANFILES)" || rm -f $(CLEANFILES) + +distclean-generic: + -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) + -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) + +maintainer-clean-generic: + @echo "This command is intended for maintainers to use" + @echo "it deletes files that may require special tools to rebuild." +clean: clean-am + +clean-am: clean-generic clean-libtool mostlyclean-am + +distclean: distclean-am + -rm -f Makefile +distclean-am: clean-am distclean-generic + +dvi: dvi-am + +dvi-am: + +html: html-am + +html-am: + +info: info-am + +info-am: + +install-data-am: install-pkgdataDATA + +install-dvi: install-dvi-am + +install-dvi-am: + +install-exec-am: + +install-html: install-html-am + +install-html-am: + +install-info: install-info-am + +install-info-am: + +install-man: + +install-pdf: install-pdf-am + +install-pdf-am: + +install-ps: install-ps-am + +install-ps-am: + +installcheck-am: + +maintainer-clean: maintainer-clean-am + -rm -f Makefile +maintainer-clean-am: distclean-am maintainer-clean-generic + +mostlyclean: mostlyclean-am + +mostlyclean-am: mostlyclean-generic mostlyclean-libtool + +pdf: pdf-am + +pdf-am: + +ps: ps-am + +ps-am: + +uninstall-am: uninstall-pkgdataDATA + +.MAKE: install-am install-strip + +.PHONY: all all-am check check-am clean clean-generic clean-libtool \ + distclean distclean-generic distclean-libtool distdir dvi \ + dvi-am html html-am info info-am install install-am \ + install-data install-data-am install-dvi install-dvi-am \ + install-exec install-exec-am install-html install-html-am \ + install-info install-info-am install-man install-pdf \ + install-pdf-am install-pkgdataDATA install-ps install-ps-am \ + install-strip installcheck installcheck-am installdirs \ + maintainer-clean maintainer-clean-generic mostlyclean \ + mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \ + uninstall uninstall-am uninstall-pkgdataDATA + + +${MAGIC}: $(EXTRA_DIST) $(FILE_COMPILE_DEP) + @rm -fr magic + @mkdir magic && cp -p $(EXTRA_DIST) magic + @(if expr "${FILE_COMPILE}" : '.*/.*' > /dev/null; then \ + echo "Using ${FILE_COMPILE} to generate ${MAGIC}" > /dev/null; \ + else \ + v=$$(file --version | sed -e s/file-// -e q); \ + if [ "$$v" != "${PACKAGE_VERSION}" ]; then \ + echo "Cannot use the installed version of file ($$v) to"; \ + echo "cross-compile file ${PACKAGE_VERSION}"; \ + echo "Please install file ${PACKAGE_VERSION} locally first"; \ + exit 1; \ + fi; \ + fi) + $(FILE_COMPILE) -C -m magic + @rm -fr magic + +# Tell versions [3.59,3.63) of GNU make to not export all variables. +# Otherwise a system limit (for SysV at least) may be exceeded. +.NOEXPORT: |