summaryrefslogtreecommitdiff
path: root/magic
diff options
context:
space:
mode:
Diffstat (limited to 'magic')
-rw-r--r--magic/Localstuff2
-rw-r--r--magic/Magdir/adventure44
-rw-r--r--magic/Magdir/algol6819
-rw-r--r--magic/Magdir/amanda4
-rw-r--r--magic/Magdir/amigaos6
-rw-r--r--magic/Magdir/android20
-rw-r--r--magic/Magdir/animation51
-rwxr-xr-xmagic/Magdir/apache28
-rw-r--r--magic/Magdir/apple245
-rw-r--r--magic/Magdir/application7
-rw-r--r--magic/Magdir/apt52
-rw-r--r--magic/Magdir/archive362
-rw-r--r--magic/Magdir/att3b4
-rw-r--r--magic/Magdir/audio118
-rw-r--r--magic/Magdir/ber65
-rw-r--r--magic/Magdir/bhl10
-rw-r--r--magic/Magdir/bioinformatics178
-rw-r--r--magic/Magdir/blackberry4
-rw-r--r--magic/Magdir/blender6
-rw-r--r--magic/Magdir/c-lang71
-rw-r--r--magic/Magdir/c648
-rw-r--r--magic/Magdir/cad67
-rw-r--r--magic/Magdir/cafebabe21
-rw-r--r--magic/Magdir/cbor21
-rw-r--r--magic/Magdir/claris5
-rw-r--r--magic/Magdir/clipper8
-rw-r--r--magic/Magdir/coff77
-rw-r--r--magic/Magdir/commands18
-rw-r--r--magic/Magdir/compress61
-rw-r--r--magic/Magdir/console755
-rw-r--r--magic/Magdir/coverage91
-rw-r--r--magic/Magdir/cups8
-rw-r--r--magic/Magdir/database283
-rw-r--r--magic/Magdir/der116
-rw-r--r--magic/Magdir/diff14
-rw-r--r--magic/Magdir/dolby4
-rw-r--r--magic/Magdir/dump16
-rw-r--r--magic/Magdir/dyadic11
-rw-r--r--magic/Magdir/editors31
-rw-r--r--magic/Magdir/elf108
-rw-r--r--magic/Magdir/filesystems946
-rw-r--r--magic/Magdir/finger16
-rw-r--r--magic/Magdir/flash54
-rw-r--r--magic/Magdir/flif36
-rw-r--r--magic/Magdir/fonts271
-rw-r--r--magic/Magdir/fortran6
-rw-r--r--magic/Magdir/frame6
-rw-r--r--magic/Magdir/fsav24
-rw-r--r--magic/Magdir/games6
-rw-r--r--magic/Magdir/gcc6
-rw-r--r--magic/Magdir/gconv10
-rw-r--r--magic/Magdir/geo4
-rw-r--r--magic/Magdir/gnu15
-rw-r--r--magic/Magdir/gpt14
-rw-r--r--magic/Magdir/gpu28
-rw-r--r--magic/Magdir/gringotts10
-rw-r--r--magic/Magdir/hitachi-sh34
-rw-r--r--magic/Magdir/ibm37010
-rw-r--r--magic/Magdir/ibm60004
-rw-r--r--magic/Magdir/icc187
-rw-r--r--magic/Magdir/iff4
-rw-r--r--magic/Magdir/images530
-rw-r--r--magic/Magdir/intel20
-rw-r--r--magic/Magdir/isz4
-rw-r--r--magic/Magdir/java11
-rw-r--r--magic/Magdir/jpeg27
-rw-r--r--magic/Magdir/karma4
-rw-r--r--magic/Magdir/kerberos4
-rw-r--r--magic/Magdir/kml6
-rw-r--r--magic/Magdir/linux58
-rw-r--r--magic/Magdir/lisp39
-rw-r--r--magic/Magdir/m45
-rw-r--r--magic/Magdir/mach59
-rw-r--r--magic/Magdir/macintosh27
-rw-r--r--magic/Magdir/mail.news3
-rw-r--r--magic/Magdir/make28
-rw-r--r--magic/Magdir/map22
-rw-r--r--magic/Magdir/maple6
-rw-r--r--magic/Magdir/marc2118
-rw-r--r--magic/Magdir/mathematica17
-rw-r--r--magic/Magdir/metastore4
-rw-r--r--magic/Magdir/meteorological4
-rw-r--r--magic/Magdir/microfocus21
-rw-r--r--magic/Magdir/mime4
-rw-r--r--magic/Magdir/misctools43
-rw-r--r--magic/Magdir/modem57
-rw-r--r--magic/Magdir/mozilla5
-rw-r--r--magic/Magdir/msdos639
-rw-r--r--magic/Magdir/msvc38
-rw-r--r--magic/Magdir/msx232
-rw-r--r--magic/Magdir/mup14
-rw-r--r--magic/Magdir/nasa7
-rw-r--r--magic/Magdir/netbsd39
-rw-r--r--magic/Magdir/netscape9
-rw-r--r--magic/Magdir/nitpicker4
-rw-r--r--magic/Magdir/os213
-rw-r--r--magic/Magdir/os94
-rw-r--r--magic/Magdir/pbf8
-rw-r--r--magic/Magdir/pc8824
-rw-r--r--magic/Magdir/pc9877
-rw-r--r--magic/Magdir/pdf12
-rw-r--r--magic/Magdir/pdp6
-rw-r--r--magic/Magdir/perl52
-rw-r--r--magic/Magdir/pgf4
-rw-r--r--magic/Magdir/pgp67
-rw-r--r--magic/Magdir/polyml23
-rw-r--r--magic/Magdir/printer22
-rw-r--r--magic/Magdir/project4
-rw-r--r--magic/Magdir/psdbms14
-rw-r--r--magic/Magdir/psl14
-rw-r--r--magic/Magdir/python45
-rw-r--r--magic/Magdir/riff13
-rw-r--r--magic/Magdir/ruby41
-rw-r--r--magic/Magdir/sccs4
-rw-r--r--magic/Magdir/scientific11
-rw-r--r--magic/Magdir/sendmail27
-rw-r--r--magic/Magdir/sequent6
-rw-r--r--magic/Magdir/sereal24
-rw-r--r--magic/Magdir/sgi6
-rw-r--r--magic/Magdir/sgml80
-rw-r--r--magic/Magdir/sharc4
-rw-r--r--magic/Magdir/sinclair23
-rw-r--r--magic/Magdir/sketch4
-rw-r--r--magic/Magdir/sql108
-rw-r--r--magic/Magdir/ssl22
-rw-r--r--magic/Magdir/sysex4
-rw-r--r--magic/Magdir/terminfo51
-rw-r--r--magic/Magdir/vacuum-cleaner54
-rw-r--r--magic/Magdir/varied.script10
-rw-r--r--magic/Magdir/vms4
-rw-r--r--magic/Magdir/vmware4
-rw-r--r--magic/Magdir/vorbis32
-rw-r--r--magic/Magdir/webassembly15
-rw-r--r--magic/Magdir/windows318
-rw-r--r--magic/Magdir/wordprocessors274
-rw-r--r--magic/Magdir/x6800025
-rw-r--r--magic/Magdir/xenix27
-rw-r--r--magic/Magdir/xilinx10
-rw-r--r--magic/Magdir/xwindows4
-rw-r--r--magic/Magdir/yara17
-rw-r--r--magic/Makefile.am29
-rw-r--r--magic/Makefile.in51
142 files changed, 6520 insertions, 1889 deletions
diff --git a/magic/Localstuff b/magic/Localstuff
index 419855f..aef8095 100644
--- a/magic/Localstuff
+++ b/magic/Localstuff
@@ -2,6 +2,6 @@
#------------------------------------------------------------------------------
# Localstuff: file(1) magic for locally observed files
#
-# $File: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $
+# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
# Add any locally observed files here. Remember:
# text if readable, executable if runnable binary, data if unreadable.
diff --git a/magic/Magdir/adventure b/magic/Magdir/adventure
index 37b4cb3..6fae85a 100644
--- a/magic/Magdir/adventure
+++ b/magic/Magdir/adventure
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: adventure,v 1.14 2012/06/21 01:32:26 christos Exp $
+# $File: adventure,v 1.17 2017/07/03 16:03:40 christos Exp $
# adventure: file(1) magic for Adventure game files
#
# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
@@ -17,6 +17,7 @@
# Infocom (see z-machine)
#------------------------------------------------------------------------------
# Z-machine: file(1) magic for Z-machine binaries.
+# Sanity checks by David Griffith <dave@661.org>
# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
#
#http://www.gnelson.demon.co.uk/zspec/sect11.html
@@ -35,16 +36,19 @@
>0 ubyte <9
>>16 belong&0xfe00f0f0 0x3030
>>>0 ubyte < 10
->>>>2 ubeshort < 10
+>>>>2 ubeshort x
>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9]
->>>>>>0 ubyte < 10 Infocom (Z-machine %d,
->>>>>>>2 ubeshort < 10 Release %d /
->>>>>>>>18 string >\0 Serial %.6s)
+>>>>>>0 ubyte < 10 Infocom (Z-machine %d
+>>>>>>>2 ubeshort x \b, Release %d
+>>>>>>>>18 string >\0 \b, Serial %.6s
+>>>>>>>>18 string x \b)
!:strength + 40
+!:mime application/x-zmachine
#------------------------------------------------------------------------------
# Glulx: file(1) magic for Glulx binaries.
#
+# David Griffith <dave@661.org>
# I haven't checked for false matches yet.
#
0 string Glul Glulx game data
@@ -52,7 +56,7 @@
>>6 byte x \b.%d
>>8 byte x \b.%d)
>36 string Info Compiled by Inform
-
+!:mime application/x-glulx
# For Quetzal and blorb magic see iff
@@ -66,24 +70,28 @@
>9 belong !0x0A0D1A00 game data, CORRUPTED
>9 belong 0x0A0D1A00
>>13 string >\0 %s game data
+!:mime application/x-tads
# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
0 string TADS2\ rsc TADS
>9 belong !0x0A0D1A00 resource data, CORRUPTED
>9 belong 0x0A0D1A00
>>13 string >\0 %s resource data
+!:mime application/x-tads
# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
# 2-byte length N, the N-char name of the game file *without* a NUL (darn!),
-# "TADS2 save\n\r\032\0" and the interpreter version.
+# "TADS2 save\n\r\032\0" and the interpreter version.
0 string TADS2\ save/g TADS
>12 belong !0x0A0D1A00 saved game data, CORRUPTED
>12 belong 0x0A0D1A00
>>(16.s+32) string >\0 %s saved game data
+!:mime application/x-tads
# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
# version.
0 string TADS2\ save TADS
>10 belong !0x0A0D1A00 saved game data, CORRUPTED
>10 belong 0x0A0D1A00
>>14 string >\0 %s saved game data
+!:mime application/x-tads
# TADS (Text Adventure Development System) version 3
# Game files start with "T3-image\015\012\032"
@@ -97,14 +105,18 @@
>>11 byte x \b%c
>>12 byte x \b%c
>>13 byte x \b%c)
+!:mime application/x-t3vm-image
+# edited by David Griffith <dave@661.org>
# Danny Milosavljevic <danny.milo@gmx.net>
-# this are adrift (adventure game standard) game files, extension .taf
-# depending on version magic continues with 0x93453E6139FA (V 4.0)
-# 0x9445376139FA (V 3.90)
-# 0x9445366139FA (V 3.80)
-# this is from source (http://www.adrift.org.uk/) and I have some taf
-# files, and checked them.
-#0 belong 0x3C423FC9
-#>4 belong 0x6A87C2CF Adrift game file
-#!:mime application/x-adrift
+# These are ADRIFT (adventure game standard) game files, extension .taf
+# Checked from source at (http://www.adrift.co/) and various taf files
+# found at the Interactive Fiction Archive (http://ifarchive.org/)
+0 belong 0x3C423FC9
+>4 belong 0x6A87C2CF Adrift game file version
+>>8 belong 0x94453661 3.80
+>>8 belong 0x94453761 3.90
+>>8 belong 0x93453E61 4.0
+>>8 belong 0x92453E61 5.0
+>>8 default x unknown
+!:mime application/x-adrift
diff --git a/magic/Magdir/algol68 b/magic/Magdir/algol68
new file mode 100644
index 0000000..a9aad46
--- /dev/null
+++ b/magic/Magdir/algol68
@@ -0,0 +1,19 @@
+
+#------------------------------------------------------------------------------
+# $File: algol68,v 1.2 2016/10/17 14:17:48 christos Exp $
+# algol68: file(1) magic for Algol 68 source
+#
+0 search/8192 (input, Algol 68 source text
+!:mime text/x-Algol68
+0 regex \^PROC Algol 68 source text
+!:mime text/x-Algol68
+0 regex MODE[\t\ ] Algol 68 source text
+!:mime text/x-Algol68
+0 regex REF[\t\ ] Algol 68 source text
+!:mime text/x-Algol68
+0 regex FLEX[\t\ ]\*\\[ Algol 68 source text
+!:mime text/x-Algol68
+#0 regex [\t\ ]OD Algol 68 source text
+#!:mime text/x-Algol68
+#0 regex [\t\ ]FI Algol 68 source text
+#!:mime text/x-Algol68
diff --git a/magic/Magdir/amanda b/magic/Magdir/amanda
index 395ef54..e7fa539 100644
--- a/magic/Magdir/amanda
+++ b/magic/Magdir/amanda
@@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
-# $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $
+# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $
# amanda: file(1) magic for amanda file format
#
-0 string AMANDA:\ AMANDA
+0 string AMANDA:\ AMANDA
>8 string TAPESTART\ DATE tape header file,
>>23 string X
>>>25 string >\ Unused %s
diff --git a/magic/Magdir/amigaos b/magic/Magdir/amigaos
index 8fdf376..d9330bd 100644
--- a/magic/Magdir/amigaos
+++ b/magic/Magdir/amigaos
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: amigaos,v 1.15 2012/06/21 01:13:59 christos Exp $
+# $File: amigaos,v 1.16 2017/03/17 21:35:28 christos Exp $
# amigaos: file(1) magic for AmigaOS binary formats:
#
@@ -11,7 +11,7 @@
0 belong 0x000003e7 AmigaOS object/library data
#
0 beshort 0xe310 Amiga Workbench
->2 beshort 1
+>2 beshort 1
>>48 byte 1 disk icon
>>48 byte 2 drawer icon
>>48 byte 3 tool icon
@@ -49,7 +49,7 @@
0 string/c @database AmigaGuide file
# Amiga disk types
-#
+#
0 string RDSK Rigid Disk Block
>160 string x on %.24s
0 string DOS\0 Amiga DOS disk
diff --git a/magic/Magdir/android b/magic/Magdir/android
index da98b57..dca5c33 100644
--- a/magic/Magdir/android
+++ b/magic/Magdir/android
@@ -1,6 +1,6 @@
#------------------------------------------------------------
-# $File: android,v 1.7 2014/11/10 05:08:23 christos Exp $
+# $File: android,v 1.10 2017/03/17 21:35:28 christos Exp $
# Various android related magic entries
#------------------------------------------------------------
@@ -61,9 +61,9 @@
# http://forum.xda-developers.com/showthread.php?t=816449
# Partition Information Table for Samsung's smartphone with Android
# used by flash software Odin
-0 ulelong 0x12349876
+0 ulelong 0x12349876
# 1st pit entry marker
->0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
+>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
# minimal 13 and maximal 18 PIT entries found
>>4 ulelong <128 Partition Information Table for Samsung smartphone
>>>4 ulelong x \b, %d entries
@@ -109,9 +109,9 @@
0 name PIT-entry
# garbage value implies end of pit entries
->0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
+>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
# skip empty partition name
->>0x24 ubyte !0
+>>0x24 ubyte !0
# partition name
>>>0x24 string >\0 %-.32s
# flags
@@ -122,13 +122,13 @@
>>>0x08 ulelong x (0x%x)
# filename
>>>0x44 string >\0 "%-.64s"
-#>>>0x18 ulelong >0
+#>>>0x18 ulelong >0
# blocksize in 512 byte units ?
#>>>>0x18 ulelong x \b, %db
# partition size in blocks ?
#>>>>0x22 ulelong x \b*%d
-# Android bootimg format
+# Android sparse img format
# From https://android.googlesource.com/\
# platform/system/core/+/master/libsparse/sparse_format.h
0 lelong 0xed26ff3a Android sparse image
@@ -137,3 +137,9 @@
>16 lelong x \b, Total of %d
>12 lelong x \b %d-byte output blocks in
>20 lelong x \b %d input chunks.
+
+# Android binary XML magic
+# In include/androidfw/ResourceTypes.h:
+# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header),
+# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size).
+0 lelong 0x00080003 Android binary XML
diff --git a/magic/Magdir/animation b/magic/Magdir/animation
index 0445adc..a6e50ff 100644
--- a/magic/Magdir/animation
+++ b/magic/Magdir/animation
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: animation,v 1.56 2014/10/23 23:12:51 christos Exp $
+# $File: animation,v 1.63 2017/05/26 14:33:07 christos Exp $
# animation: file(1) magic for animation/movie formats
#
# animation formats
@@ -34,14 +34,23 @@
!:mime image/jp2
# http://www.ftyps.com/ with local additions
4 string ftyp ISO Media
+# http://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
+>8 string XAVC \b, MPEG v4 system, Sony XAVC Codec
+>>96 string x \b, Audio "%.4s"
+>>118 beshort x at %dHz
+>>140 string x \b, Video "%.4s"
+>>168 beshort x %d
+>>170 beshort x \bx%d
>8 string 3g2 \b, MPEG v4 system, 3GPP2
!:mime video/3gpp2
>>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
>>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
->>11 byte a \b C.S0050-0 V1.0
->>11 byte b \b C.S0050-0-A V1.0.0
->>11 byte c \b C.S0050-0-B V1.0
+# http://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf
+# Section 8.1.1, corresponds to a, b, c
+>>11 byte 0x61 \b C.S0050-0 V1.0
+>>11 byte 0x62 \b C.S0050-0-A V1.0.0
+>>11 byte 0x63 \b C.S0050-0-B V1.0
>8 string 3ge \b, MPEG v4 system, 3GPP
!:mime video/3gpp
>>11 byte 6 \b, Release 6 MBMS Extended Presentations
@@ -76,6 +85,8 @@
>8 string da2b \b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP
>8 string da3a \b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images
>8 string da3b \b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP
+>8 string dash \b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP
+!:mime video/mp4
>8 string dmb1 \b, DMB MAF supporting all the components defined in the spec
>8 string dmpf \b, Digital Media Project
>8 string drc1 \b, Dirac (wavelet compression), encap in ISO base media (MP4)
@@ -184,13 +195,13 @@
# MPEG sequences
# Scans for all common MPEG header start codes
-0 belong 0x00000001
+0 belong 0x00000001
>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video
>>5 byte 66 \b, baseline
>>5 byte 77 \b, main
>>5 byte 88 \b, extended
>>7 byte x \b @ L %u
-0 belong&0xFFFFFF00 0x00000100
+0 belong&0xFFFFFF00 0x00000100
>3 byte 0xBA MPEG sequence
!:mime video/mpeg
>>4 byte &0x40 \b, v2, program multiplex
@@ -491,8 +502,8 @@
# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
-#0 beshort&0xFFFE 0xFFFE
-#>2 ubyte&0xF0 >0x0F
+#0 beshort&0xFFFE 0xFFFE
+#>2 ubyte&0xF0 >0x0F
#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1
## rate
#>>>2 byte&0xF0 0x10 \b, 32 kbps
@@ -564,9 +575,9 @@
# MP2, M2A
0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
!:mime audio/mpeg
-# rate
+# rate
>2 byte&0xF0 0x10 \b, 8 kbps
->2 byte&0xF0 0x20 \b, 16 kbps
+>2 byte&0xF0 0x20 \b, 16 kbps
>2 byte&0xF0 0x30 \b, 24 kbps
>2 byte&0xF0 0x40 \b, 32 kbps
>2 byte&0xF0 0x50 \b, 40 kbps
@@ -634,7 +645,7 @@
# MP3, M25A
0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5
!:mime audio/mpeg
-# rate
+# rate
>2 byte&0xF0 0x10 \b, 8 kbps
>2 byte&0xF0 0x20 \b, 16 kbps
>2 byte&0xF0 0x30 \b, 24 kbps
@@ -853,10 +864,12 @@
# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
# From Michel Briand <michelbriand@free.fr>
-0 string/t \<?xml\ version="
-!:strength +1
->20 search/1000/cw \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text
-!:mime model/x3d
+# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml
+# Example http://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
+0 string/w \<?xml\ version=
+!:strength + 5
+>20 search/1000/w \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text
+!:mime model/x3d+xml
#---------------------------------------------------------------------------
# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
@@ -1006,3 +1019,11 @@
>4 lelong x %d x
>8 lelong x %d,
>12 lelong x %d frames
+
+# Material Exchange Format
+# More information:
+# https://en.wikipedia.org/wiki/Material_Exchange_Format
+# http://www.freemxf.org/
+0 string \x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02 Material exchange container format
+!:ext mxf
+!:mime application/mxf
diff --git a/magic/Magdir/apache b/magic/Magdir/apache
new file mode 100755
index 0000000..d896b50
--- /dev/null
+++ b/magic/Magdir/apache
@@ -0,0 +1,28 @@
+
+#------------------------------------------------------------------------------
+# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $
+# apache: file(1) magic for Apache Big Data formats
+
+# Avro files
+0 string Obj Apache Avro
+>3 byte x version %d
+
+# ORC files
+# Important information is in file footer, which we can't index to :(
+0 string ORC Apache ORC
+
+# Parquet files
+0 string PAR1 Apache Parquet
+
+# Hive RC files
+0 string RCF Apache Hive RC file
+>3 byte x version %d
+
+# Sequence files (and the careless first version of RC file)
+
+0 string SEQ
+>3 byte <6 Apache Hadoop Sequence file version %d
+>3 byte >6 Apache Hadoop Sequence file version %d
+>3 byte =6
+>>5 string org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer Apache Hive RC file version 0
+>>3 default x Apache Hadoop Sequence file version 6
diff --git a/magic/Magdir/apple b/magic/Magdir/apple
index e3dd059..391205f 100644
--- a/magic/Magdir/apple
+++ b/magic/Magdir/apple
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: apple,v 1.29 2014/04/30 21:41:02 christos Exp $
+# $File: apple,v 1.36 2017/03/17 21:35:28 christos Exp $
# apple: file(1) magic for Apple file formats
#
0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
@@ -65,18 +65,48 @@
# Eric Fischer <enf@pobox.com>
# AppleWorks word processor:
-#
-# This matches the standard tab stops for an AppleWorks file, but if
-# a file has a tab stop set in the first four columns this will fail.
-#
+# URL: https://en.wikipedia.org/wiki/AppleWorks
+# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
+# Update: Joerg Jenderek
+# NOTE:
# The "O" is really the magic number, but that's so common that it's
# necessary to check the tab stops that follow it to avoid false positives.
-
-4 string O==== AppleWorks word processor data
->85 byte&0x01 >0 \b, zoomed
->90 byte&0x01 >0 \b, paginated
->92 byte&0x01 >0 \b, with mail merge
-#>91 byte x \b, left margin %d
+# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
+# the newer AppleWorks is from claris with extension CWK
+4 string O
+# test for unused bits of zoom- , paginated-boolean bytes
+>84 ubequad ^0x00Fe00000000Fe00
+# look for tabstop definitions "=" no tab, "|" no tab
+# "<" left tab,"^" center tab,">" right tab, "." decimal tab,
+# unofficial "!" other , "\x8a" other
+# official only if SFMinVers is nonzero
+>>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor
+# AppleWorks Word Processor File (Apple II)
+# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data"
+# application/x-appleworks is mime type for claris version with cwk extension
+!:mime application/x-appleworks3
+# http://home.earthlink.net/~hughhood/appleiiworksenvoy/
+# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
+# $70 $1A $F8 $FF is this the apple type ?
+#:apple pdospøÿ
+!:ext awp
+# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
+>>>183 ubyte 30 3.0
+>>>183 ubyte !30
+>>>>183 ubyte !0 0x%x
+# usual tabstop start sequence "=====<"
+>>>5 string x \b, tabstop ruler "%6.6s"
+# tabstop ruler
+#>>>5 string >\0 \b, tabstops "%-79s"
+# zoom switch
+>>>85 byte&0x01 >0 \b, zoomed
+# whether paginated
+>>>90 byte&0x01 >0 \b, paginated
+# contains any mail-merge commands
+>>>92 byte&0x01 >0 \b, with mail merge
+# left margin in 1/10 inches ( normally 0 or 10 )
+>>>91 ubyte >0
+>>>>91 ubyte x \b, %d/10 inch left margin
# AppleWorks database:
#
@@ -110,13 +140,13 @@
# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
#0 belong&0xff00ff 0x80000 Applesoft BASIC program data
-0 belong&0x00ff00ff 0x00080000
+0 belong&0x00ff00ff 0x00080000
# assuming that line number must be positive
>2 leshort >0 Applesoft BASIC program data, first line number %d
#>2 leshort x \b, first line number %d
# ORCA/EZ assembler:
-#
+#
# This will not identify ORCA/M source files, since those have
# some sort of date code instead of the two zero bytes at 6 and 7
# XXX Conflicts with ELF
@@ -156,18 +186,18 @@
# From Johan Gade.
# These entries are disabled for now until we fix the following issues.
#
-# Note there might be some problems with the "VAX COFF executable"
-# entry. Note this entry should be placed before the mac filesystem section,
+# Note there might be some problems with the "VAX COFF executable"
+# entry. Note this entry should be placed before the mac filesystem section,
# particularly the "Apple Partition data" entry.
#
-# The intended meaning of these tests is, that the file is only of the
+# The intended meaning of these tests is, that the file is only of the
# specified type if both of the lines are correct - i.e. if the first
# line matches and the second doesn't then it is not of that type.
#
#0 long 0x7801730d
#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
#
-# Note that this entry is recognized correctly by the "Apple Partition
+# Note that this entry is recognized correctly by the "Apple Partition
# data" entry - however since this entry is more specific - this
# information seems to be more useful.
#0 long 0x45520200
@@ -255,48 +285,149 @@
# .vdi
4 string innotek\ VirtualBox\ Disk\ Image %s
-# Apple disk partition stuff, strengthen the magic using byte 4
+# Apple disk partition stuff
+# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
+# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
+# Update: Joerg Jenderek
+# "ER" is APPLE_DRVR_MAP_MAGIC signature
0 beshort 0x4552
->4 byte 0 Apple Driver Map
+# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
+#!:strength +0
+# strengthen the magic by looking for used blocksizes 512 2048
+>2 ubeshort&0xf1FF 0 Apple Driver Map
+# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
+#>>504 ubequad&0x0000FFffFFff0000 0
+!:mime application/x-apple-diskimage
+!:apple ????devr
+# https://en.wikipedia.org/wiki/Apple_Disk_Image
+!:ext dmg/iso
+# sbBlkSize for driver descriptor map 512 2048
>>2 beshort x \b, blocksize %d
->>4 belong x \b, blockcount %d
->>10 beshort x \b, devtype %d
->>12 beshort x \b, devid %d
->>20 beshort x \b, descriptors %d
-# Assume 8 partitions each at a multiple of the sector size.
-# We could glean this from the partition descriptors, but they are empty!?!?
->>(2.S*1) indirect \b, contains[@0x%x]:
->>(2.S*2) indirect \b, contains[@0x%x]:
->>(2.S*3) indirect \b, contains[@0x%x]:
->>(2.S*4) indirect \b, contains[@0x%x]:
->>(2.S*5) indirect \b, contains[@0x%x]:
->>(2.S*6) indirect \b, contains[@0x%x]:
->>(2.S*7) indirect \b, contains[@0x%x]:
->>(2.S*8) indirect \b, contains[@0x%x]:
-
-# Yes, the 3rd and 4th bytes are reserved, but we use them to make the
+# sbBlkCount sometimes garbish like
+# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
+# 0xf2720100 for bunziped Firefox 48.0-2.dmg
+# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
+# 0x00009090 by syslinux-6.03/utils/isohybrid.c
+>>4 ubelong x \b, blockcount %u
+# following device/driver information not very useful
+# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
+>>8 ubeshort x \b, devtype %u
+# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
+>>10 ubeshort x \b, devid %u
+# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
+>>12 ubelong >0
+>>>12 ubelong x \b, driver data %u
+# number of driver descriptors sbDrvrCount <= 61
+# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
+>>16 ubeshort x \b, driver count %u
+# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
+# >>18 use apple-driver-map
+# >>26 use apple-driver-map
+# # ...
+# >>500 use apple-driver-map
+# number of partitions is always same in every partition (map block count)
+#>>0x0204 ubelong x \b, %u partitions
+>>0x0204 ubelong >0 \b, contains[@0x200]:
+>>>0x0200 use apple-apm
+>>0x0204 ubelong >1 \b, contains[@0x400]:
+>>>0x0400 use apple-apm
+>>0x0204 ubelong >2 \b, contains[@0x600]:
+>>>0x0600 use apple-apm
+>>0x0204 ubelong >3 \b, contains[@0x800]:
+>>>0x0800 use apple-apm
+>>0x0204 ubelong >4 \b, contains[@0xA00]:
+>>>0x0A00 use apple-apm
+>>0x0204 ubelong >5 \b, contains[@0xC00]:
+>>>0x0C00 use apple-apm
+>>0x0204 ubelong >6 \b, contains[@0xE00]:
+>>>0x0E00 use apple-apm
+>>0x0204 ubelong >7 \b, contains[@0x1000]:
+>>>0x1000 use apple-apm
+# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
+0 name apple-driver-map
+>0 ubequad !0
+# descBlock first block of driver
+>>0 ubelong x \b, driver start block %u
+# descSize driver size in blocks
+>>4 ubeshort x \b, size %u
+# descType driver system type 1 701h F8FFh FFFFh
+>>6 ubeshort x \b, type 0x%x
+
+# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
+# Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
+# Update: Joerg Jenderek
+# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
# magic stronger.
-0 belong 0x504d0000 Apple Partition Map
->4 belong x \b, map block count %d
->8 belong x \b, start block %d
->12 belong x \b, block count %d
->16 string >0 \b, name %s
->48 string >0 \b, type %s
->124 string >0 \b, processor %s
->140 string >0 \b, boot arguments %s
->92 belong & 1 \b, valid
->92 belong & 2 \b, allocated
->92 belong & 4 \b, in use
->92 belong & 8 \b, has boot info
->92 belong & 16 \b, readable
->92 belong & 32 \b, writable
->92 belong & 64 \b, pic boot code
->92 belong & 128 \b, chain compatible driver
->92 belong & 256 \b, real driver
->92 belong & 512 \b, chain driver
->92 belong & 1024 \b, mount at startup
->92 belong & 2048 \b, is the startup partition
-
-#http://wiki.mozilla.org/DS_Store_File_Format`
+# for apple partition map stored as a single file
+0 belong 0x504d0000
+# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
+#!:strength +0
+>0 use apple-apm
+# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
+# file: could not find any valid magic files!
+#!:ext bin
+# display apple partition map. Normally called after Apple driver map
+0 name apple-apm
+>0 belong 0x504d0000 Apple Partition Map
+# number of partitions
+>>4 ubelong x \b, map block count %u
+# logical block (512 bytes) start of partition
+>>8 ubelong x \b, start block %u
+>>12 ubelong x \b, block count %u
+>>16 string >0 \b, name %s
+>>48 string >0 \b, type %s
+# processor type dpme_process_id[16] e.g. "68000" "68020"
+>>120 string >0 \b, processor %s
+# A/UX boot arguments BootArgs[128]
+>>136 string >0 \b, boot arguments %s
+# status of partition dpme_flags
+>>88 belong & 1 \b, valid
+>>88 belong & 2 \b, allocated
+>>88 belong & 4 \b, in use
+>>88 belong & 8 \b, has boot info
+>>88 belong & 16 \b, readable
+>>88 belong & 32 \b, writable
+>>88 belong & 64 \b, pic boot code
+>>88 belong & 128 \b, chain compatible driver
+>>88 belong & 256 \b, real driver
+>>88 belong & 512 \b, chain driver
+# mount automatically at startup APPLE_PS_AUTO_MOUNT
+>>88 ubelong &0x40000000 \b, mount at startup
+# is the startup partition APPLE_PS_STARTUP
+>>88 ubelong &0x80000000 \b, is the startup partition
+
+#http://wiki.mozilla.org/DS_Store_File_Format
#http://en.wikipedia.org/wiki/.DS_Store
0 string \0\0\0\1Bud1\0 Apple Desktop Services Store
+
+# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
+# Usually not in separate files, but have either filename rsrc with
+# no extension, or a filename corresponding to another file, with
+# extensions rsr/rsrc
+0 string \000\000\001\000
+>4 leshort 0
+>>16 lelong 0 Apple HFS/HFS+ resource fork
+
+#https://en.wikipedia.org/wiki/AppleScript
+0 string FasdUAS AppleScript compiled
+
+# AppleWorks/ClarisWorks
+# https://github.com/joshenders/appleworks_format
+# http://fileformats.archiveteam.org/wiki/AppleWorks
+0 name appleworks
+>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document
+>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document
+>0 default x
+>>0 belong x AppleWorks/ClarisWorks CWK Document
+>0 byte x \b, version %d
+>30 beshort x \b, %d
+>32 beshort x \bx%d
+!:ext cwk
+
+4 string BOBO
+>0 byte >4
+>>12 belong 0
+>>>26 belong 0
+>>>>0 use appleworks
+>0 belong 0x0481ad00
+>>0 use appleworks
diff --git a/magic/Magdir/application b/magic/Magdir/application
new file mode 100644
index 0000000..f316608
--- /dev/null
+++ b/magic/Magdir/application
@@ -0,0 +1,7 @@
+
+#------------------------------------------------------------------------------
+# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $
+# application: file(1) magic for applications on small devices
+#
+# Pebble Application
+0 string PBLAPP\000\000 Pebble application
diff --git a/magic/Magdir/apt b/magic/Magdir/apt
new file mode 100644
index 0000000..2d9f159
--- /dev/null
+++ b/magic/Magdir/apt
@@ -0,0 +1,52 @@
+
+#------------------------------------------------------------------------------
+# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $
+# apt: file(1) magic for APT Cache files
+# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html>
+# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292>
+
+# before version 10 ("old format"), data was in arch-specific long/short
+
+# old format 64 bit
+0 name apt-cache-64bit-be
+>12 beshort 1 \b, dirty
+>40 bequad x \b, %llu packages
+>48 bequad x \b, %llu versions
+
+# old format 32 bit
+0 name apt-cache-32bit-be
+>8 beshort 1 \b, dirty
+>40 belong x \b, %u packages
+>44 belong x \b, %u versions
+
+# new format
+0 name apt-cache-be
+>6 byte 1 \b, dirty
+>24 belong x \b, %u packages
+>28 belong x \b, %u versions
+
+0 bequad 0x98FE76DC
+>8 ubeshort <10 APT cache data, version %u
+>>10 beshort x \b.%u, 64 bit big-endian
+>>0 use apt-cache-64bit-be
+
+0 lequad 0x98FE76DC
+>8 uleshort <10 APT cache data, version %u
+>>10 leshort x \b.%u, 64 bit little-endian
+>>0 use \^apt-cache-64bit-be
+
+0 belong 0x98FE76DC
+>4 ubeshort <10 APT cache data, version %u
+>>6 ubeshort x \b.%u, 32 bit big-endian
+>>0 use apt-cache-32bit-be
+>4 ubyte >9 APT cache data, version %u
+>>5 ubyte x \b.%u, big-endian
+>>0 use apt-cache-be
+
+0 lelong 0x98FE76DC
+>4 uleshort <10 APT cache data, version %u
+>>6 uleshort x \b.%u, 32 bit little-endian
+>>0 use \^apt-cache-32bit-be
+>4 ubyte >9 APT cache data, version %u
+>>5 ubyte x \b.%u, little-endian
+>>0 use \^apt-cache-be
diff --git a/magic/Magdir/archive b/magic/Magdir/archive
index 4ef73a7..abecf71 100644
--- a/magic/Magdir/archive
+++ b/magic/Magdir/archive
@@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
-# $File: archive,v 1.88 2014/08/16 10:42:17 christos Exp $
+# $File: archive,v 1.108 2017/08/30 13:45:10 christos Exp $
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
@@ -246,7 +246,15 @@
# BA
# TODO: idarc says "bytes 0-2 == bytes 3-5"
# TTComp
-0 string \0\6 TTComp archive data
+# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive
+# Update: Joerg Jenderek
+# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others
+0 string \0\6
+# look for first keyword of Panorama database *.pan
+>12 search/261 DESIGN
+# skip keyword with low entropy
+>12 default x TTComp archive, binary, 4K dictionary
+# (version 5.25) labeled the above entry as "TTComp archive data"
# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
0 string ESP ESP archive data
# ZPack
@@ -434,16 +442,34 @@
# AIN
0 string \x33\x18 AIN archive data
0 string \x33\x17 AIN archive data
-# XPA32
-0 string xpa\0\1 XPA32 archive data
+# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015
# SZip (TODO: doesn't catch all versions)
0 string SZ\x0a\4 SZip archive data
# XPack DiskImage
-0 string jm XPack DiskImage archive data
+# *.XDI updated by Joerg Jenderek Sep 2015
+# ftp://ftp.sac.sk/pub/sac/pack/0index.txt
+# GRR: this test is still too general as it catches also text files starting with jm
+0 string jm
+# only found examples with this additional characteristic 2 bytes
+>2 string \x2\x4 Xpack DiskImage archive data
+#!:ext xdi
# XPack Data
-0 string xpa XPack archive data
+# *.xpa updated by Joerg Jenderek Sep 2015
+# ftp://ftp.elf.stuba.sk/pub/pc/pack/
+0 string xpa XPA
+!:ext xpa
+# XPA32
+# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip
+# created by XPA32.EXE version 1.0.2 for Windows
+>0 string xpa\0\1 \b32 archive data
+# created by XPACK.COM version 1.67m or 1.67r with short 0x1800
+>3 ubeshort !0x0001 \bck archive data
# XPack Single Data
-0 string \xc3\x8d\ jm XPack single archive data
+# changed by Joerg Jenderek Sep 2015 back to like in version 5.12
+# letter 'I'+ acute accent is equivalent to \xcd
+0 string \xcd\ jm Xpack single archive data
+#!:mime application/x-xpa-compressed
+!:ext xpa
# TODO: missing due to unknown magic/magic at end of file:
#DWC
@@ -526,55 +552,212 @@
>>0x36 string >\0 fstype %.8s
# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
-2 string -lh0- LHarc 1.x/ARX archive data [lh0]
-!:mime application/x-lharc
-2 string -lh1- LHarc 1.x/ARX archive data [lh1]
-!:mime application/x-lharc
-2 string -lz4- LHarc 1.x archive data [lz4]
-!:mime application/x-lharc
-2 string -lz5- LHarc 1.x archive data [lz5]
-!:mime application/x-lharc
+# Update: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
+# Reference: http://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
+#
+# check and display information of lharc (LHa,PMarc) file
+0 name lharc-file
+# check 1st character of method id like -lz4- -lh5- or -pm2-
+>2 string -
+# check 5th character of method id
+>>6 string -
+# check header level 0 1 2 3
+>>>20 ubyte <4
+# check 2nd, 3th and 4th character of method id
+>>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b
+!:mime application/x-lzh-compressed
+# creator type "LHA "
+!:apple ????LHA
+# display archive type name like "LHa/LZS archive data" or "LArc archive"
+>>>>>2 string -lz \b
+!:ext lzs
+# already known -lzs- -lz4- -lz5- with old names
+>>>>>>2 string -lzs LHa/LZS archive data
+>>>>>>3 regex \^lz[45] LHarc 1.x archive data
+# missing -lz?- with wikipedia names
+>>>>>>3 regex \^lz[2378] LArc archive
+# display archive type name like "LHa (2.x) archive data"
+>>>>>2 string -lh \b
+# already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
+>>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data
+# LHice archiver use ".ICE" as name extension instead usual one ".lzh"
+# FOOBAR archiver use ".foo" as name extension instead usual one
+# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment
+>>>>>>>2 string -lh1 \b
+!:ext lha/lzh/ice
+>>>>>>3 regex \^lh[23d] LHa 2.x? archive data
+>>>>>>3 regex \^lh[7] LHa (2.x)/LHark archive data
+>>>>>>3 regex \^lh[456] LHa (2.x) archive data
+>>>>>>>2 string -lh5 \b
+# https://en.wikipedia.org/wiki/BIOS
+# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like
+# bios.rom , kd7_v14.bin, 1010.004, ...
+!:ext lha/lzh/rom/bin
+# missing -lh?- variants (Joe Jared)
+>>>>>>3 regex \^lh[89a-ce] LHa (Joe Jared) archive
+# UNLHA32 2.67a
+>>>>>>2 string -lhx LHa (UNLHA32) archive
+# lha archives with standard file name extensions ".lha" ".lzh"
+>>>>>>3 regex !\^(lh1|lh5) \b
+!:ext lha/lzh
+# this should not happen if all -lh variants are described
+>>>>>>2 default x LHa (unknown) archive
+#!:ext lha
+# PMarc
+>>>>>3 regex \^pm[012] PMarc archive data
+!:ext pma
+# append method id without leading and trailing minus character
+>>>>>3 string x [%3.3s]
+>>>>>>0 use lharc-header
+#
+# check and display information of lharc header
+0 name lharc-header
+# header size 0x4 , 0x1b-0x61
+>0 ubyte x
+# compressed data size != compressed file size
+#>7 ulelong x \b, data size %d
+# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
+#>19 ubyte x \b, 19_0x%x
+# level identifier 0 1 2 3
+#>20 ubyte x \b, level %d
+# time stamp
+#>15 ubelong x DATE 0x%8.8x
+# OS ID for level 1
+>20 ubyte 1
+# 0x20 types find for *.rom files
+>>(21.b+24) ubyte <0x21 \b, 0x%x OS
+# ascii type like M for MSDOS
+>>(21.b+24) ubyte >0x20 \b, '%c' OS
+# OS ID for level 2
+>20 ubyte 2
+#>>23 ubyte x \b, OS ID 0x%x
+>>23 ubyte <0x21 \b, 0x%x OS
+>>23 ubyte >0x20 \b, '%c' OS
+# filename only for level 0 and 1
+>20 ubyte <2
+# length of filename
+>>21 ubyte >0 \b, with
+# filename
+>>>21 pstring x "%s"
+#
+#2 string -lh0- LHarc 1.x/ARX archive data [lh0]
+#!:mime application/x-lharc
+2 string -lh0-
+>0 use lharc-file
+#2 string -lh1- LHarc 1.x/ARX archive data [lh1]
+#!:mime application/x-lharc
+2 string -lh1-
+>0 use lharc-file
+# NEW -lz2- ... -lz8-
+2 string -lz2-
+>0 use lharc-file
+2 string -lz3-
+>0 use lharc-file
+2 string -lz4-
+>0 use lharc-file
+2 string -lz5-
+>0 use lharc-file
+2 string -lz7-
+>0 use lharc-file
+2 string -lz8-
+>0 use lharc-file
# [never seen any but the last; -lh4- reported in comp.compression:]
-2 string -lzs- LHa/LZS archive data [lzs]
-!:mime application/x-lha
-2 string -lh\40- LHa 2.x? archive data [lh ]
-!:mime application/x-lha
-2 string -lhd- LHa 2.x? archive data [lhd]
-!:mime application/x-lha
-2 string -lh2- LHa 2.x? archive data [lh2]
-!:mime application/x-lha
-2 string -lh3- LHa 2.x? archive data [lh3]
-!:mime application/x-lha
-2 string -lh4- LHa (2.x) archive data [lh4]
-!:mime application/x-lha
-2 string -lh5- LHa (2.x) archive data [lh5]
-!:mime application/x-lha
-2 string -lh6- LHa (2.x) archive data [lh6]
-!:mime application/x-lha
-2 string -lh7- LHa (2.x)/LHark archive data [lh7]
-!:mime application/x-lha
->20 byte x - header level %d
+#2 string -lzs- LHa/LZS archive data [lzs]
+2 string -lzs-
+>0 use lharc-file
+# According to wikipedia and others such a version does not exist
+#2 string -lh\40- LHa 2.x? archive data [lh ]
+#2 string -lhd- LHa 2.x? archive data [lhd]
+2 string -lhd-
+>0 use lharc-file
+#2 string -lh2- LHa 2.x? archive data [lh2]
+2 string -lh2-
+>0 use lharc-file
+#2 string -lh3- LHa 2.x? archive data [lh3]
+2 string -lh3-
+>0 use lharc-file
+#2 string -lh4- LHa (2.x) archive data [lh4]
+2 string -lh4-
+>0 use lharc-file
+#2 string -lh5- LHa (2.x) archive data [lh5]
+2 string -lh5-
+>0 use lharc-file
+#2 string -lh6- LHa (2.x) archive data [lh6]
+2 string -lh6-
+>0 use lharc-file
+#2 string -lh7- LHa (2.x)/LHark archive data [lh7]
+2 string -lh7-
+# !:mime application/x-lha
+# >20 byte x - header level %d
+>0 use lharc-file
+# NEW -lh8- ... -lhe- , -lhx-
+2 string -lh8-
+>0 use lharc-file
+2 string -lh9-
+>0 use lharc-file
+2 string -lha-
+>0 use lharc-file
+2 string -lhb-
+>0 use lharc-file
+2 string -lhc-
+>0 use lharc-file
+2 string -lhe-
+>0 use lharc-file
+2 string -lhx-
+>0 use lharc-file
# taken from idarc [JW]
2 string -lZ PUT archive data
-2 string -lz LZS archive data
+# already done by LHarc magics
+# this should never happen if all sub types of LZS archive are identified
+#2 string -lz LZS archive data
2 string -sw1- Swag archive data
-# RAR archiver (Greg Roelofs, newt@uchicago.edu)
-0 string Rar! RAR archive data,
+0 name rar-file-header
+>24 byte 15 \b, v1.5
+>24 byte 20 \b, v2.0
+>24 byte 29 \b, v4
+>15 byte 0 \b, os: MS-DOS
+>15 byte 1 \b, os: OS/2
+>15 byte 2 \b, os: Win32
+>15 byte 3 \b, os: Unix
+>15 byte 4 \b, os: Mac OS
+>15 byte 5 \b, os: BeOS
+
+0 name rar-archive-header
+>3 leshort&0x1ff >0 \b, flags:
+>>3 leshort &0x01 ArchiveVolume
+>>3 leshort &0x02 Commented
+>>3 leshort &0x04 Locked
+>>3 leshort &0x10 NewVolumeNaming
+>>3 leshort &0x08 Solid
+>>3 leshort &0x20 Authenticated
+>>3 leshort &0x40 RecoveryRecordPresent
+>>3 leshort &0x80 EncryptedBlockHeader
+>>3 leshort &0x100 FirstVolume
+
+# RAR (Roshal Archive) archive
+0 string Rar!\x1a\7\0 RAR archive data
!:mime application/x-rar
->44 byte x v%0x,
->10 byte >0 flags:
->>10 byte &0x01 Archive volume,
->>10 byte &0x02 Commented,
->>10 byte &0x04 Locked,
->>10 byte &0x08 Solid,
->>10 byte &0x20 Authenticated,
->35 byte 0 os: MS-DOS
->35 byte 1 os: OS/2
->35 byte 2 os: Win32
->35 byte 3 os: Unix
-# some old version? idarc says:
-0 string RE\x7e\x5e RAR archive data
+!:ext rar/cbr
+# file header
+>(0xc.l+9) byte 0x74
+>>(0xc.l+7) use rar-file-header
+# subblock seems to share information with file header
+>(0xc.l+9) byte 0x7a
+>>(0xc.l+7) use rar-file-header
+>9 byte 0x73
+>>7 use rar-archive-header
+
+0 string Rar!\x1a\7\1\0 RAR archive data, v5
+!:mime application/x-rar
+!:ext rar
+
+# Very old RAR archive
+# http://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
+0 string RE\x7e\x5e RAR archive data (<v1.5)
+!:mime application/x-rar
+!:ext rar/cbr
# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0 string SQSH squished archive data (Acorn RISCOS)
@@ -586,9 +769,12 @@
# PKZIP multi-volume archive
0 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract
!:mime application/zip
+!:ext zip/cbz
# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0 string PK\005\006 Zip archive data (empty)
+!:mime application/zip
+!:ext zip/cbz
0 string PK\003\004
# Specialised zip formats which start with a member named 'mimetype'
@@ -705,6 +891,14 @@
>(26.s+30) leshort 0xcafe Java archive data (JAR)
!:mime application/java-archive
+# iOS App
+>(26.s+30) leshort !0xcafe
+>>26 string !\x8\0\0\0mimetype
+>>>30 string Payload/
+>>>>38 search/64 .app/ iOS App
+!:mime application/x-ios-app
+
+
# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
# Next line excludes specialized formats:
>(26.s+30) leshort !0xcafe
@@ -714,7 +908,17 @@
>>>4 byte 0x0a \b, at least v1.0 to extract
>>>4 byte 0x0b \b, at least v1.1 to extract
>>>4 byte 0x14 \b, at least v2.0 to extract
->>>4 byte 0x2d \b, at least v3.0 to extract
+>>>4 byte 0x15 \b, at least v2.1 to extract
+>>>4 byte 0x19 \b, at least v2.5 to extract
+>>>4 byte 0x1b \b, at least v2.7 to extract
+>>>4 byte 0x2d \b, at least v4.5 to extract
+>>>4 byte 0x2e \b, at least v4.6 to extract
+>>>4 byte 0x32 \b, at least v5.0 to extract
+>>>4 byte 0x33 \b, at least v5.1 to extract
+>>>4 byte 0x34 \b, at least v5.2 to extract
+>>>4 byte 0x3d \b, at least v6.1 to extract
+>>>4 byte 0x3e \b, at least v6.2 to extract
+>>>4 byte 0x3f \b, at least v6.3 to extract
>>>0x161 string WINZIP \b, WinZIP self-extracting
# StarView Metafile
@@ -746,12 +950,24 @@
0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
#
# PMA (CP/M derivative of LHA)
+# Update: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
#
-2 string -pm0- PMarc archive data [pm0]
-2 string -pm1- PMarc archive data [pm1]
-2 string -pm2- PMarc archive data [pm2]
+#2 string -pm0- PMarc archive data [pm0]
+2 string -pm0-
+>0 use lharc-file
+#2 string -pm1- PMarc archive data [pm1]
+2 string -pm1-
+>0 use lharc-file
+#2 string -pm2- PMarc archive data [pm2]
+2 string -pm2-
+>0 use lharc-file
2 string -pms- PMarc SFX archive (CP/M, DOS)
+#!:mime application/x-foobar-exec
+!:ext com
5 string -pc1- PopCom compressed executable (CP/M)
+#!:mime application/x-
+#!:ext com
# From Rafael Laboissiere <rafael@laboissiere.net>
# The Project Revision Control System (see
@@ -784,6 +1000,9 @@
# Felix von Leitner <felix-file@fefe.de>
0 string d8:announce BitTorrent file
!:mime application/x-bittorrent
+# Durval Menezes, <jmgthbfile at durval dot com>
+0 string d13:announce-list BitTorrent file
+!:mime application/x-bittorrent
# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
0 beshort 0x0e0f Atari MSA archive data
@@ -871,19 +1090,16 @@
# From "Nelson A. de Oliveira" <naoliv@gmail.com>
0 string MPQ\032 MoPaQ (MPQ) archive
-# From: Dirk Jagdmann <doj@cubic.org>
-# xar archive format: http://code.google.com/p/xar/
-0 string xar! xar archive
->6 beshort x - version %d
-
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
# .kgb
0 string KGB_arch KGB Archiver file
>10 string x with compression level %.1s
# xar (eXtensible ARchiver) archive
+# xar archive format: http://code.google.com/p/xar/
# From: "David Remahl" <dremahl@apple.com>
0 string xar! xar archive
+!:mime application/x-xar
#>4 beshort x header size %d
>6 beshort x version %d,
#>8 quad x compressed TOC: %d,
@@ -911,6 +1127,9 @@
# ZPAQ: http://mattmahoney.net/dc/zpaq.html
0 string zPQ ZPAQ stream
>3 byte x \b, level %d
+# From: Barry Carter <carter.barry@gmail.com>
+# http://encode.ru/threads/456-zpaq-updates/page32
+0 string 7kSt ZPAQ file
# BBeB ebook, unencrypted (LRF format)
# URL: http://www.sven.de/librie/Librie/LrfFormat
@@ -936,12 +1155,12 @@
>3 ubyte 0 \b, no compression
>3 ubyte 2 \b, fast compression (Z1)
>3 ubyte 3 \b, medium compression (Z2)
->3 ubyte >3
+>3 ubyte >3
>>3 ubyte <11 \b, compression (Z%d-1)
->2 ubyte&0x08 0x00
+>2 ubyte&0x08 0x00
# ~ 30 byte password field only for *.gho
>>12 ubequad !0 \b, password protected
->>44 ubyte !1
+>>44 ubyte !1
# 1~Image All, sector-by-sector only for *.gho
>>>10 ubyte 1 \b, sector copy
# 1~Image Boot track only for *.gho
@@ -951,6 +1170,19 @@
# optional image description only *.gho
>>0xff string >\0 "%-.254s"
# look for DOS sector end sequence
->0xE08 search/7776 \x55\xAA
->>&-512 indirect x \b; contains
-
+>0xE08 search/7776 \x55\xAA
+>>&-512 indirect x \b; contains
+
+# Google Chrome extensions
+# https://developer.chrome.com/extensions/crx
+# https://developer.chrome.com/extensions/hosting
+0 string Cr24 Google Chrome extension
+!:mime application/x-chrome-extension
+>4 ulong x \b, version %u
+
+# SeqBox - Sequenced container
+# ext: sbx, seqbox
+# Marco Pontello marcopon@gmail.com
+# reference: https://github.com/MarcoPon/SeqBox
+0 string SBx SeqBox,
+>3 byte x version %d
diff --git a/magic/Magdir/att3b b/magic/Magdir/att3b
index a3ed9c0..b83ae2e 100644
--- a/magic/Magdir/att3b
+++ b/magic/Magdir/att3b
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: att3b,v 1.9 2014/04/30 21:41:02 christos Exp $
+# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $
# att3b: file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
@@ -36,6 +36,6 @@
#>18 beshort &00040000 and MAU hardware required
#>22 beshort >0 - version %d
#
-# core file for 3b2
+# core file for 3b2
0 string \000\004\036\212\200 3b2 core file
>364 string >\0 of '%s'
diff --git a/magic/Magdir/audio b/magic/Magdir/audio
index 338d8ae..0330bbf 100644
--- a/magic/Magdir/audio
+++ b/magic/Magdir/audio
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: audio,v 1.71 2014/05/14 23:30:28 christos Exp $
+# $File: audio,v 1.80 2017/08/13 00:21:47 christos Exp $
# audio: file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
@@ -300,7 +300,7 @@
>>5 byte &0x40 \b, extended header
>>5 byte &0x20 \b, experimental
>>5 byte &0x10 \b, footer present
->(6.I) indirect x \b, contains:
+>(6.I+10) indirect x \b, contains:
# NSF (NES sound file) magic
0 string NESM\x1a NES Sound File
@@ -313,6 +313,21 @@
>122 byte&0x1 =1 PAL
>122 byte&0x1 =0 NTSC
+# NSFE (Extended NES sound file) magic
+# http://slickproductions.org/docs/NSF/nsfespec.txt
+# From: David Pflug <david@pflug.email>
+0 string NSFE Extended NES Sound File
+>48 search/0x1000 auth
+>>&0 string >\0 ("%s"
+>>>&1 string >\0 by %s
+>>>>&1 string >\0 \b, copyright %s
+>>>>>&1 string >\0 \b, ripped by %s
+>20 byte x \b), %d tracks,
+>18 byte&0x2 =1 dual PAL/NTSC
+>18 byte&0x2 =0
+>>18 byte&0x1 =1 PAL
+>>18 byte&0x1 =0 NTSC
+
# Type: SNES SPC700 sound files
# From: Josh Triplett <josh@freedesktop.org>
0 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file
@@ -454,6 +469,8 @@
>>20 byte&0xe 0xc \b, 7 channels
>>20 byte&0xe 0xe \b, 8 channels
# some common sample rates
+>>17 belong&0xfffff0 0x2ee000 \b, 192 kHz
+>>17 belong&0xfffff0 0x158880 \b, 88.2 kHz
>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz
>>17 belong&0xfffff0 0x07d000 \b, 32 kHz
@@ -570,7 +587,7 @@
0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music
# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
-0 string MP+ Musepack audio
+0 string MP+ Musepack audio (MP+)
!:mime audio/x-musepack
>3 byte 255 \b, SV pre8
>3 byte&0xF 0x6 \b, SV 6
@@ -604,6 +621,9 @@
>>27 byte 114 \b, Beta 1.14
>>27 byte 115 \b, Alpha 1.15
+0 string MPCK Musepack audio (MPCK)
+!:mime audio/x-musepack
+
# IMY
# from http://filext.com/detaillist.php?extdetail=IMY
# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
@@ -640,7 +660,7 @@
# From Fabio R. Schmidlin <frs@pop.com.br>
# VGM music file
-0 string Vgm\
+0 string Vgm\040
>9 ubyte >0 VGM Video Game Music dump v
>>9 ubyte/16 >0 \b%d
>>9 ubyte&0x0F x \b%d
@@ -700,3 +720,93 @@
0 string ZBOT
>4 byte 0xc5 GVOX Encore music, version < 5.0
+# Summary: Garmin Voice Processing Module (WAVE audios)
+# From: Joerg Jenderek
+# URL: http://www.garmin.com/
+# Reference: http://turboccc.wikispaces.com/share/view/28622555
+# NOTE: there exist 2 other Garmin VPM formats
+0 string AUDIMG
+# skip text files starting with string "AUDIMG"
+>13 ubyte <13 Garmin Voice Processing Module
+!:mime audio/x-vpm-wav-garmin
+!:ext vpm
+# 3 bytes indicating the voice version (200,220)
+>>6 string x \b, version %3.3s
+# day of release (01-31)
+>>12 ubyte x \b, %.2d
+# month of release (01-12)
+>>13 ubyte x \b.%.2d
+# year of release (like 2006, 2007, 2008)
+>>14 uleshort x \b.%.4d
+# hour of release (0-23)
+>>11 ubyte x %.2d
+# minute of release (0-59)
+>>10 ubyte x \b:%.2d
+# second of release (0-59)
+>>9 ubyte x \b:%.2d
+# if you select a language like german on your garmin device
+# you can only select voice modules with corresponding language byte ID like 1
+>>18 ubyte x \b, language ID %d
+# pointer to 1st audio WAV sample
+>>16 uleshort >0
+>>>(16.s) ulelong >0 \b, at offset 0x%x
+# WAV length
+>>>>(16.s+4) ulelong >0 %d Bytes
+# look for magic
+>>>>>(&-8.l) string RIFF
+# determine type by ./riff
+>>>>>>&-4 indirect x \b
+# 2 - ~ 131 WAV samples following same way
+
+# From Martin Mueller Skarbiniks Pedersen
+0 string GDM
+>0x3 byte 0xFE General Digital Music.
+>0x4 string >\0 title: "%s"
+>0x24 string >\0 musician: "%s"
+>>0x44 beshort 0x0D0A
+>>>0x46 byte 0x1A
+>>>>0x47 string GMFS Version
+>>>>0x4B byte x %d.
+>>>>0x4C byte x \b%02d
+>>>>0x4D beshort 0x000 (2GDM v
+>>>>0x4F byte x \b%d.
+>>>>>0x50 byte x \b%d)
+
+0 string MTM Multitracker
+>0x3 byte/16 x Version %d.
+>0x3 byte&0x0F x \b%02d
+>>0x4 string >\0 title: "%s"
+
+0 string HVL
+>3 byte <2 Hively Tracker Song
+>3 byte 0 1 module data
+>3 byte 1 2 module data
+
+0 string MO3
+>3 ubyte <6 MOdule with MP3
+>>3 byte 0 Version 0 (With MP3 and lossless)
+>>3 byte 1 Version 1 (With ogg and lossless)
+>>3 byte 3 Version 2.2
+>>3 byte 4 (With no LAME header)
+>>3 byte 5 Version 2.4
+
+0 string ADRVPACK AProSys module
+
+# ftp://ftp.modland.com/pub/documents/format_documentation/\
+# Art%20Of%20Noise%20(.aon).txt
+0 string AON
+>4 string "ArtOfNoise by Bastian Spiegel(twice/lego)"
+>0x2e string NAME Art of Noise Tracker Song
+>3 string <9
+>3 string 4 (4 voices)
+>3 string 8 (8 voices)
+>>0x36 string >\0 Title: "%s"
+
+0 string FAR
+>0x2c byte 0x0d
+>0x2d byte 0x0a
+>0x2e byte 0x1a
+>>0x3 byte 0xFE Farandole Tracker Song
+>>>0x31 byte/16 x Version %d.
+>>>0x31 byte&0x0F x \b%02d
+>>>>0x4 string >\0 \b, title: "%s"
diff --git a/magic/Magdir/ber b/magic/Magdir/ber
new file mode 100644
index 0000000..db7a861
--- /dev/null
+++ b/magic/Magdir/ber
@@ -0,0 +1,65 @@
+
+#------------------------------------------------------------------------------
+# $File: ber,v 1.1 2016/06/05 00:21:30 christos Exp $
+# ber: file(1) magic for several BER formats used in the mobile
+# telecommunications industry (Georg Sauthoff)
+
+# The file formats are standardized by the GSMA (GSM association).
+# They are specified via ASN.1 schemas and some prose. Basic encoding
+# rules (BER) is the used encoding. The formats are used for exchanging
+# call data records (CDRs) between mobile operators and associated
+# parties for roaming clearing purposes and fraud detection.
+
+# The magic file covers:
+
+# - TAP files (TD.57) - CDR batches and notifications
+# - RAP files (TD.32) - return batches and acknowledgements
+# - NRT files (TD.35) - CDR batches for 'near real time' processing
+
+#
+# TAP 3 Files
+# TAP -> Transferred Account Procedure
+# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf
+# TransferBatch short tag
+0 byte 0x61
+# BatchControlInfo short tag
+>&1 search/b5 \x64
+# Sender long tag #TAP 3.x (BER encoded)
+>>&1 search/b8 \x5f\x81\x44
+# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
+>>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
+>>>>&0 byte x TAP 3.%d Batch (TD.57, Transferred Account)
+
+# Notification short tag
+0 byte 0x62
+# Sender long tag
+>2 search/b8 \x5f\x81\x44
+# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
+>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
+>>>&0 byte x TAP 3.%d Notification (TD.57, Transferred Account)
+
+
+# NRT Files
+# NRT a.k.a. NRTRDE
+0 byte 0x61
+# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block
+>&1 search/b8 \x5f\x29\x01\x02\x5f\x25\x01
+>>&0 byte x NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange)
+
+# RAP Files
+# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf
+# Long ReturnBatch tag
+0 string \x7f\x84\x16
+# Long RapBatchControlInfo tag
+>&1 search/b8 \x7f\x84\x19
+# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
+>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
+# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block
+>>>&1 string/b \x5f\x84\x20\x01\x01\x5f\x84\x1f\x01
+>>>>&0 byte x RAP 1.%d Batch (TD.32, Returned Account Procedure),
+>>>&0 byte x TAP 3.%d
+
+# Long Acknowledgement tag
+0 string \x7f\x84\x17
+# Long Sender tag
+>&1 search/b5 \x5f\x81\x44 RAP Acknowledgement (TD.32, Returned Account Procedure)
diff --git a/magic/Magdir/bhl b/magic/Magdir/bhl
new file mode 100644
index 0000000..6f57f03
--- /dev/null
+++ b/magic/Magdir/bhl
@@ -0,0 +1,10 @@
+
+#------------------------------------------------------------------------------
+# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $
+# BlockHashLoc
+# ext: bhl
+# Marco Pontello marcopon@gmail.com
+# reference: https://github.com/MarcoPon/BlockHashLoc
+0 string BlockHashLoc\x1a BlockHashLoc recovery info,
+>13 byte x version %d
+!:ext bhl
diff --git a/magic/Magdir/bioinformatics b/magic/Magdir/bioinformatics
new file mode 100644
index 0000000..0c761ed
--- /dev/null
+++ b/magic/Magdir/bioinformatics
@@ -0,0 +1,178 @@
+
+#------------------------------------------------------------------------------
+# $File: bioinformatics,v 1.4 2016/06/20 16:13:46 christos Exp $
+# bioinfomatics: file(1) magic for Bioinfomatics file formats
+
+###############################################################################
+# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable
+# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
+###############################################################################
+0 string \037\213
+>3 byte &0x04
+>>12 string BC
+>>>14 leshort &0x02 Blocked GNU Zip Format (BGZF; gzip compatible)
+>>>>16 leshort x \b, block length %d
+!:mime application/x-gzip
+
+
+###############################################################################
+# Tabix index file
+# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
+###############################################################################
+0 string TBI\1 SAMtools TBI (Tabix index format)
+>0x04 lelong =1 \b, with %d reference sequence
+>0x04 lelong >1 \b, with %d reference sequences
+>0x08 lelong &0x10000 \b, using half-closed-half-open coordinates (BED style)
+>0x08 lelong ^0x10000
+>>0x08 lelong =0 \b, using closed and one based coordinates (GFF style)
+>>0x08 lelong =1 \b, using SAM format
+>>0x08 lelong =2 \b, using VCF format
+>0x0c lelong x \b, sequence name column: %d
+>0x10 lelong x \b, region start column: %d
+>0x08 lelong =0
+>>0x14 lelong x \b, region end column: %d
+>0x18 byte x \b, comment character: %c
+>0x1c lelong x \b, skip line count: %d
+
+
+###############################################################################
+# BAM (Binary Sequence Alignment/Map format)
+# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
+# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
+###############################################################################
+0 string BAM\1 SAMtools BAM (Binary Sequence Alignment/Map)
+>0x04 lelong >0
+>>&0x00 regex =^[@]HD\t.*VN: \b, with SAM header
+>>>&0 regex =[0-9.]+ \b version %s
+>>&(0x04) lelong >0 \b, with %d reference sequences
+
+
+###############################################################################
+# BAI (BAM indexing format)
+# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
+###############################################################################
+0 string BAI\1 SAMtools BAI (BAM indexing format)
+>0x04 lelong >0 \b, with %d reference sequences
+
+
+###############################################################################
+# CRAM (Binary Sequence Alignment/Map format)
+###############################################################################
+0 string CRAM CRAM
+>0x04 byte >-1 version %d.
+>0x05 byte >-1 \b%d
+>0x06 string >\0 (identified as %s)
+
+
+###############################################################################
+# BCF (Binary Call Format), version 1
+# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf)
+# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
+###############################################################################
+0 string BCF\4
+# length of seqnm data in bytes is positive
+>&0x00 lelong >0
+# length of smpl data in bytes is positive
+>>&(&-0x04) lelong >0 SAMtools BCF (Binary Call Format)
+# length of meta in bytes
+>>>&(&-0x04) lelong >0
+# have meta text string
+>>>>&0x00 search ##samtoolsVersion=
+>>>>>&0x00 string x \b, generated by SAMtools version %s
+
+
+###############################################################################
+# BCF (Binary Call Format), version 2.1
+# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf)
+# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
+###############################################################################
+0 string BCF\2\1 Binary Call Format (BCF) version 2.1
+# length of header text
+>&0x00 lelong >0
+# have header string
+>>&0x00 search ##samtoolsVersion=
+>>>&0x00 string x \b, generated by SAMtools version %s
+
+
+###############################################################################
+# BCF (Binary Call Format), version 2.2
+# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf)
+# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
+###############################################################################
+0 string BCF\2\2 Binary Call Format (BCF) version 2.2
+# length of header text
+>&0x00 lelong >0
+# have header string
+>>&0x00 search ##samtoolsVersion=
+>>>&0x00 string x \b, generated by SAMtools version %s
+
+###############################################################################
+# VCF (Variant Call Format)
+# used by VCFtools (http://vcftools.sourceforge.net/)
+###############################################################################
+0 search ##fileformat=VCFv Variant Call Format (VCF)
+>&0 string x \b version %s
+
+###############################################################################
+# FASTQ
+# used by MAQ (http://maq.sourceforge.net/fastq.shtml)
+###############################################################################
+# XXX Broken?
+# @<seqname>
+#0 regex =^@[A-Za-z0-9_.:-]+\?\n
+# <seq>
+#>&1 regex =^[A-Za-z\n.~]++
+# +[<seqname>]
+#>>&1 regex =^[A-Za-z0-9_.:-]*\?\n
+# <qual>
+#>>>&1 regex =^[!-~\n]+\n FASTQ
+
+###############################################################################
+# FASTA
+# used by FASTA (http://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf)
+###############################################################################
+#0 byte 0x3e
+# q>0 regex =^[>][!-~\t\ ]+$
+# Amino Acid codes: [A-IK-Z*-]+
+#>>1 regex !=[!-'Jj;:=?@^`|~\\] FASTA
+# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+
+# not in IUPAC codes/gaps: [EFIJLOPQZ]
+#>>>1 regex !=[EFIJLOPQZefijlopqz] \b, with IUPAC nucleotide codes
+#>>>1 regex =^[EFIJLOPQZefijlopqz]+$ \b, with Amino Acid codes
+
+###############################################################################
+# SAM (Sequence Alignment/Map format)
+# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
+###############################################################################
+# Short-cut version to recognise SAM files with (optional) header at beginning
+###############################################################################
+0 string @HD\t
+>4 search VN: Sequence Alignment/Map (SAM), with header
+>>&0 regex [0-9.]+ \b version %s
+###############################################################################
+# Longer version to recognise SAM alignment lines using (many) regexes
+###############################################################################
+# SAM Alignment QNAME
+0 regex =^[!-?A-~]{1,255}(\t[^\t]+){11}
+# SAM Alignment FLAG
+>0 regex =^([^\t]+\t){1}[0-9]{1,5}\t
+# SAM Alignment RNAME
+>>0 regex =^([^\t]+\t){2}\\*|[^*=]*\t
+# SAM Alignment POS
+>>>0 regex =^([^\t]+\t){3}[0-9]{1,9}\t
+# SAM Alignment MAPQ
+>>>>0 regex =^([^\t]+\t){4}[0-9]{1,3}\t
+# SAM Alignment CIGAR
+>>>>>0 regex =\t(\\*|([0-9]+[MIDNSHPX=])+)\t
+# SAM Alignment RNEXT
+>>>>>>0 regex =\t(\\*|=|[!-()+->?-~][!-~]*)\t
+# SAM Alignment PNEXT
+>>>>>>>0 regex =^([^\t]+\t){7}[0-9]{1,9}\t
+# SAM Alignment TLEN
+>>>>>>>>0 regex =\t[+-]{0,1}[0-9]{1,9}\t.*\t
+# SAM Alignment SEQ
+>>>>>>>>>0 regex =^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t
+# SAM Alignment QUAL
+>>>>>>>>>>0 regex =^([^\t]+\t){10}[!-~]+ Sequence Alignment/Map (SAM)
+>>>>>>>>>>>0 regex =^[@]HD\t.*VN: \b, with header
+>>>>>>>>>>>>&0 regex =[0-9.]+ \b version %s
diff --git a/magic/Magdir/blackberry b/magic/Magdir/blackberry
index 4a61d4e..2e38a54 100644
--- a/magic/Magdir/blackberry
+++ b/magic/Magdir/blackberry
@@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
-# $File: blackberry,v 1.1 2014/01/31 01:51:32 christos Exp $
+# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $
# blackberry: file(1) magic for BlackBerry file formats
#
-5 belong 0
+5 belong 0
>8 belong 010010010 BlackBerry RIM ETP file
>>22 string x \b for %s
diff --git a/magic/Magdir/blender b/magic/Magdir/blender
index 5b9c855..0948570 100644
--- a/magic/Magdir/blender
+++ b/magic/Magdir/blender
@@ -1,11 +1,11 @@
#------------------------------------------------------------------------------
-# $File: blender,v 1.6 2014/08/30 08:34:17 christos Exp $
+# $File: blender,v 1.7 2017/03/17 21:35:28 christos Exp $
# blender: file(1) magic for Blender 3D related files
#
-# Native format rule v1.2. For questions use the developers list
+# Native format rule v1.2. For questions use the developers list
# http://lists.blender.org/mailman/listinfo/bf-committers
-# GLOB chunk was moved near start and provides subversion info since 2.42
+# GLOB chunk was moved near start and provides subversion info since 2.42
0 string =BLENDER Blender3D,
>7 string =_ saved as 32-bits
diff --git a/magic/Magdir/c-lang b/magic/Magdir/c-lang
index 39889ec..7b3f703 100644
--- a/magic/Magdir/c-lang
+++ b/magic/Magdir/c-lang
@@ -1,7 +1,8 @@
#------------------------------------------------------------------------------
-# $File: c-lang,v 1.19 2014/06/03 19:17:27 christos Exp $
+# $File: c-lang,v 1.26 2017/08/14 07:40:38 christos Exp $
# c-lang: file(1) magic for C and related languages programs
#
+# The strength is to beat standard HTML
# BCPL
0 search/8192 "libhdr" BCPL source text
@@ -10,42 +11,72 @@
!:mime text/x-bcpl
# C
-0 regex \^#include C source text
+# Check for class if include is found, otherwise class is beaten by include becouse of lowered strength
+0 regex \^#include C
+>0 regex \^class[[:space:]]+
+>>&0 regex \\{[\.\*]\\}(;)?$ \b++
+>&0 clear x source text
+!:strength + 13
!:mime text/x-c
-0 regex \^char[\ \t\n]+ C source text
+0 regex \^#[[:space:]]*pragma C source text
!:mime text/x-c
-0 regex \^double[\ \t\n]+ C source text
+0 regex \^#[[:space:]]*(if\|ifn)def
+>&0 regex \^#[[:space:]]*endif$ C source text
!:mime text/x-c
-0 regex \^extern[\ \t\n]+ C source text
+0 regex \^#[[:space:]]*(if\|ifn)def
+>&0 regex \^#[[:space:]]*define C source text
!:mime text/x-c
-0 regex \^float[\ \t\n]+ C source text
+0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
!:mime text/x-c
-0 regex \^struct[\ \t\n]+ C source text
+0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
!:mime text/x-c
-0 regex \^union[\ \t\n]+ C source text
+0 regex \^[[:space:]]*extern[[:space:]]+ C source text
!:mime text/x-c
-0 search/8192 main( C source text
+0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
+!:mime text/x-c
+0 regex \^struct[[:space:]]+ C source text
+!:mime text/x-c
+0 regex \^union[[:space:]]+ C source text
+!:mime text/x-c
+0 search/8192 main(
+>&0 regex \\)[[:space:]]*\\{ C source text
!:mime text/x-c
# C++
# The strength of these rules is increased so they beat the C rules above
-0 regex \^template[\ \t\n]+ C++ source text
-!:strength + 5
+0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text
+!:strength + 30
+!:mime text/x-c++
+# using namespace [namespace] or using std::[lib]
+0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text
+!:strength + 30
!:mime text/x-c++
-0 regex \^virtual[\ \t\n]+ C++ source text
-!:strength + 5
+0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text
+!:strength + 30
!:mime text/x-c++
-0 regex \^class[\ \t\n]+ C++ source text
-!:strength + 5
+0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text
+!:strength + 30
!:mime text/x-c++
-0 regex \^public: C++ source text
-!:strength + 5
+# But class alone is reduced to avoid beating php (Jens Schleusener)
+0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text
+!:strength + 13
!:mime text/x-c++
-0 regex \^private: C++ source text
-!:strength + 5
+0 regex \^[[:space:]]*public: C++ source text
+!:strength + 30
!:mime text/x-c++
+0 regex \^[[:space:]]*private: C++ source text
+!:strength + 30
+!:mime text/x-c++
+0 regex \^[[:space:]]*protected: C++ source text
+!:strength + 30
+!:mime text/x-c++
+
+# Objective-C
+0 regex \^#import Objective-C source text
+!:strength + 25
+!:mime text/x-objective-c
-# From: Mikhail Teterin <mi@aldan.algebra.com>
+# From: Mikhail Teterin <mi@aldan.algebra.com>
0 string cscope cscope reference data
>7 string x version %.2s
# We skip the path here, because it is often long (so file will
diff --git a/magic/Magdir/c64 b/magic/Magdir/c64
index eea3e31..eb79ac3 100644
--- a/magic/Magdir/c64
+++ b/magic/Magdir/c64
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: c64,v 1.5 2009/09/19 16:28:08 christos Exp $
+# $File: c64,v 1.6 2015/08/24 05:17:42 christos Exp $
# c64: file(1) magic for various commodore 64 related files
#
# From: Dirk Jagdmann <doj@cubic.org>
@@ -41,3 +41,9 @@
>32 leshort x Version:0x%x
>36 leshort !0 Entries:%i
>40 string x Name:%.24s
+
+# Raw tape file format (.tap files)
+# Esa Hyyti <esa@netlab.tkk.fi>
+0 string C64-TAPE-RAW C64 Raw Tape File (.tap),
+>0x0c byte x Version:%u,
+>0x10 lelong x Length:%u cycles
diff --git a/magic/Magdir/cad b/magic/Magdir/cad
index 9b09fd7..daafba9 100644
--- a/magic/Magdir/cad
+++ b/magic/Magdir/cad
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: cad,v 1.13 2014/03/23 18:05:38 christos Exp $
+# $File: cad,v 1.15 2017/06/24 15:24:56 christos Exp $
# autocad: file(1) magic for cad files
#
@@ -9,7 +9,7 @@
# DGN is the default file extension of Microstation/Intergraph CAD files.
# CIT is the proprietary raster format (similar to TIFF) used to attach
# raster underlays to Microstation DGN (vector) drawings.
-#
+#
# http://www.wotsit.org/search.asp
# http://filext.com/detaillist.php?extdetail=DGN
# http://filext.com/detaillist.php?extdetail=CIT
@@ -42,7 +42,7 @@
>4 string \030\000\000 CITFile
>4 string \030\000\003 CITFile
-# AutoCAD
+# AutoCAD
# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg
# and http://www.iana.org/assignments/media-types/image/vnd.dwg
0 string MC0.0 DWG AutoDesk AutoCAD Release 1.0
@@ -99,42 +99,42 @@
0 string AC1027 DWG AutoDesk AutoCAD 2013/2014
!:mime image/vnd.dwg
-# KOMPAS 2D drawing from ASCON
+# KOMPAS 2D drawing from ASCON
# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
# gathered nor specification
# ASCON http://ascon.net/main/ in English,
# http://ascon.ru/ main site in Russian
-# Extension is CDW for drawing and FRW for fragment of drawing
+# Extension is CDW for drawing and FRW for fragment of drawing
# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
# ICQ 358572321, http://vkontakte.ru/id16076543)
# From:
# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
# (in russian) and my experiments
0 string KF
->2 belong 0x4E00000C Kompas drawing 12.0 SP1
->2 belong 0x4D00000C Kompas drawing 12.0
->2 belong 0x3200000B Kompas drawing 11.0 SP1
->2 belong 0x3100000B Kompas drawing 11.0
->2 belong 0x2310000A Kompas drawing 10.0 SP1
->2 belong 0x2110000A Kompas drawing 10.0
->2 belong 0x08000009 Kompas drawing 9.0 SP1
->2 belong 0x05000009 Kompas drawing 9.0
->2 belong 0x33010008 Kompas drawing 8+
->2 belong 0x1A000008 Kompas drawing 8.0
->2 belong 0x2C010107 Kompas drawing 7+
->2 belong 0x05000007 Kompas drawing 7.0
->2 belong 0x32000006 Kompas drawing 6+
->2 belong 0x09000006 Kompas drawing 6.0
->2 belong 0x5C009005 Kompas drawing 5.11R03
->2 belong 0x54009005 Kompas drawing 5.11R02
->2 belong 0x51009005 Kompas drawing 5.11R01
->2 belong 0x22009005 Kompas drawing 5.10R03
->2 belong 0x22009005 Kompas drawing 5.10R02 mar
->2 belong 0x21009005 Kompas drawing 5.10R02 febr
->2 belong 0x19009005 Kompas drawing 5.10R01
->2 belong 0xF4008005 Kompas drawing 5.9R01.003
->2 belong 0x1C008005 Kompas drawing 5.9R01.002
->2 belong 0x11008005 Kompas drawing 5.8R01.003
+>2 belong 0x4E00000C Kompas drawing 12.0 SP1
+>2 belong 0x4D00000C Kompas drawing 12.0
+>2 belong 0x3200000B Kompas drawing 11.0 SP1
+>2 belong 0x3100000B Kompas drawing 11.0
+>2 belong 0x2310000A Kompas drawing 10.0 SP1
+>2 belong 0x2110000A Kompas drawing 10.0
+>2 belong 0x08000009 Kompas drawing 9.0 SP1
+>2 belong 0x05000009 Kompas drawing 9.0
+>2 belong 0x33010008 Kompas drawing 8+
+>2 belong 0x1A000008 Kompas drawing 8.0
+>2 belong 0x2C010107 Kompas drawing 7+
+>2 belong 0x05000007 Kompas drawing 7.0
+>2 belong 0x32000006 Kompas drawing 6+
+>2 belong 0x09000006 Kompas drawing 6.0
+>2 belong 0x5C009005 Kompas drawing 5.11R03
+>2 belong 0x54009005 Kompas drawing 5.11R02
+>2 belong 0x51009005 Kompas drawing 5.11R01
+>2 belong 0x22009005 Kompas drawing 5.10R03
+>2 belong 0x22009005 Kompas drawing 5.10R02 mar
+>2 belong 0x21009005 Kompas drawing 5.10R02 febr
+>2 belong 0x19009005 Kompas drawing 5.10R01
+>2 belong 0xF4008005 Kompas drawing 5.9R01.003
+>2 belong 0x1C008005 Kompas drawing 5.9R01.002
+>2 belong 0x11008005 Kompas drawing 5.8R01.003
# CAD: file(1) magic for computer aided design files
# Phillip Griffith <phillip dot griffith at gmail dot com>
@@ -147,8 +147,13 @@
>0x02 byte 0xfe
>>0x04 beshort 0x1800 CIT raster CAD
-# 3DS (3d Studio files) Conflicts with diff output 0x3d '='
-#16 beshort 0x3d3d image/x-3ds
+# 3DS (3d Studio files)
+0 leshort 0x4d4d
+>6 leshort 0x2
+>>8 lelong 0xa
+>>>16 leshort 0x3d3d 3D Studio model
+!:mime image/x-3ds
+!:extension 3ds
# MegaCAD 2D/3D drawing (.prt)
# http://megacad.de/
diff --git a/magic/Magdir/cafebabe b/magic/Magdir/cafebabe
index 4c58fc6..6482858 100644
--- a/magic/Magdir/cafebabe
+++ b/magic/Magdir/cafebabe
@@ -1,14 +1,14 @@
#------------------------------------------------------------------------------
-# $File: cafebabe,v 1.17 2015/01/01 17:07:00 christos Exp $
+# $File: cafebabe,v 1.23 2017/05/25 20:07:23 christos Exp $
# Cafe Babes unite!
#
# Since Java bytecode and Mach-O universal binaries have the same magic number,
# the test must be performed in the same "magic" sequence to get both right.
# The long at offset 4 in a Mach-O universal binary tells the number of
# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
-# version and the short at offset 6 is the JVM major version. Since there are only
-# only 18 labeled Mach-O architectures at current, and the first released
+# version and the short at offset 6 is the JVM major version. Since there are only
+# only 18 labeled Mach-O architectures at current, and the first released
# Java class format was version 43.0, we can safely choose any number
# between 18 and 39 to test the number of architectures against
# (and use as a hack). Let's not use 18, because the Mach-O people
@@ -28,6 +28,8 @@
>>4 belong 0x0030 (Java 1.4)
>>4 belong 0x0031 (Java 1.5)
>>4 belong 0x0032 (Java 1.6)
+>>4 belong 0x0033 (Java 1.7)
+>>4 belong 0x0034 (Java 1.8)
0 belong 0xcafed00d JAR compressed with pack200,
>5 byte x version %d.
@@ -45,19 +47,26 @@
0 name mach-o \b [
>0 use mach-o-cpu \b
->(8.L) indirect \b:
+>(8.L) indirect x \b:
>0 belong x \b]
0 belong 0xcafebabe
>4 belong 1 Mach-O universal binary with 1 architecture:
+!:mime application/x-mach-binary
>>8 use mach-o \b
>4 belong >1
>>4 belong <20 Mach-O universal binary with %d architectures:
+!:mime application/x-mach-binary
>>>8 use mach-o \b
+>>4 belong 2
>>>28 use mach-o \b
->>4 belong >2
+>>4 belong 3
>>>48 use mach-o \b
->>4 belong >3
+>>4 belong 4
>>>68 use mach-o \b
+>>4 belong 5
+>>>88 use mach-o \b
+>>4 belong 6
+>>>108 use mach-o \b
### MACH-O END ###
diff --git a/magic/Magdir/cbor b/magic/Magdir/cbor
new file mode 100644
index 0000000..c780dc6
--- /dev/null
+++ b/magic/Magdir/cbor
@@ -0,0 +1,21 @@
+
+#------------------------------------------------------------------------------
+# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $
+# cbor: file(1) magic for CBOR files as defined in RFC 7049
+
+0 string \xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container
+!:mime application/cbor
+>3 ubyte <0x20 (positive integer)
+>3 ubyte <0x40
+>>3 ubyte >0x1f (negative integer)
+>3 ubyte <0x60
+>>3 ubyte >0x3f (byte string)
+>3 ubyte <0x80
+>>3 ubyte >0x5f (text string)
+>3 ubyte <0xa0
+>3 ubyte >0x7f (array)
+>3 ubyte <0xc0
+>>3 ubyte >0x9f (map)
+>3 ubyte <0xe0
+>>3 ubyte >0xbf (tagged)
+>3 ubyte >0xdf (other)
diff --git a/magic/Magdir/claris b/magic/Magdir/claris
index 0f7b591..6a1b68f 100644
--- a/magic/Magdir/claris
+++ b/magic/Magdir/claris
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: claris,v 1.7 2014/06/03 19:17:27 christos Exp $
+# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $
# claris: file(1) magic for claris
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Claris Works a word processor, etc.
@@ -18,7 +18,8 @@
# Claris works files
# .cwk
-0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
+# Moved to Apple AppleWorks document
+#0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
# .plt
0 string \020\341\000\000\010\010 Claris Works palette files .plt
diff --git a/magic/Magdir/clipper b/magic/Magdir/clipper
index 98278eb..2768b3a 100644
--- a/magic/Magdir/clipper
+++ b/magic/Magdir/clipper
@@ -1,13 +1,13 @@
#------------------------------------------------------------------------------
-# $File: clipper,v 1.7 2014/04/30 21:41:02 christos Exp $
+# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $
# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what's the "!" stuff:
#
-# >18 short !074000,000000 C1 R1
+# >18 short !074000,000000 C1 R1
# >18 short !074000,004000 C2 R1
# >18 short !074000,010000 C3 R1
# >18 short !074000,074000 TEST
@@ -15,7 +15,7 @@
# I shall assume it's ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
-# >18 short&074000 000000 C1 R1
+# >18 short&074000 000000 C1 R1
# >18 short&074000 004000 C2 R1
# >18 short&074000 010000 C3 R1
# >18 short&074000 074000 TEST
@@ -37,7 +37,7 @@
>12 long >0 not stripped
>22 short >0 - version %d
0 short 0577 CLIPPER COFF executable
->18 short&074000 000000 C1 R1
+>18 short&074000 000000 C1 R1
>18 short&074000 004000 C2 R1
>18 short&074000 010000 C3 R1
>18 short&074000 074000 TEST
diff --git a/magic/Magdir/coff b/magic/Magdir/coff
new file mode 100644
index 0000000..b4addec
--- /dev/null
+++ b/magic/Magdir/coff
@@ -0,0 +1,77 @@
+
+#------------------------------------------------------------------------------
+# $File: coff,v 1.2 2017/03/17 21:35:28 christos Exp $
+# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
+#
+# COFF
+#
+# by Joerg Jenderek at Oct 2015
+# https://en.wikipedia.org/wiki/COFF
+# https://de.wikipedia.org/wiki/Common_Object_File_Format
+# http://www.delorie.com/djgpp/doc/coff/filhdr.html
+
+# display name+variables+flags of Common Object Files Format (32bit)
+# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel,
+# mips,motorola,msdos,osf1,sharc,varied.out,vax
+0 name display-coff
+# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
+>18 uleshort&0x8E80 0
+>>0 clear x
+# f_magic - magic number
+# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
+>>0 uleshort 0x014C Intel 80386
+# Hitachi SH big-endian COFF (./hitachi-sh)
+>>0 uleshort 0x0500 Hitachi SH big-endian
+# Hitachi SH little-endian COFF (./hitachi-sh)
+>>0 uleshort 0x0550 Hitachi SH little-endian
+# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
+#>>0 uleshort 0x01DF
+# TODO for other COFFs
+#>>0 uleshort 0xABCD COFF_TEMPLATE
+>>0 default x
+>>>0 uleshort x type 0x%04x
+>>0 uleshort x COFF
+# F_EXEC flag bit
+>>18 leshort ^0x0002 object file
+#!:mime application/x-coff
+#!:ext cof/o/obj/lib
+>>18 leshort &0x0002 executable
+#!:mime application/x-coffexec
+# F_RELFLG flag bit,static object
+>>18 leshort &0x0001 \b, no relocation info
+# F_LNNO flag bit
+>>18 leshort &0x0004 \b, no line number info
+# F_LSYMS flag bit
+>>18 leshort &0x0008 \b, stripped
+>>18 leshort ^0x0008 \b, not stripped
+# flags in other COFF versions
+#0x0010 F_FDPR_PROF
+#0x0020 F_FDPR_OPTI
+#0x0040 F_DSA
+# F_AR32WR flag bit
+#>>>18 leshort &0x0100 \b, 32 bit little endian
+#0x1000 F_DYNLOAD
+#0x2000 F_SHROBJ
+#0x4000 F_LOADONLY
+# f_nscns - number of sections
+>>2 uleshort <2 \b, %d section
+>>2 uleshort >1 \b, %d sections
+# f_timdat - file time & date stamp only for little endian
+#>>4 date x \b, %s
+# f_symptr - symbol table pointer, only for not stripped
+>>8 ulelong >0 \b, symbol offset=0x%x
+# f_nsyms - number of symbols, only for not stripped
+>>12 ulelong >0 \b, %d symbols
+# f_opthdr - optional header size
+>>16 uleshort >0 \b, optional header size %d
+# at offset 20 can be optional header, extra bytes FILHSZ-20 because
+# do not rely on sizeof(FILHDR) to give the correct size for header.
+# or first section header
+# additional variables for other COFF files
+# >20 beshort 0407 (impure)
+# >20 beshort 0410 (pure)
+# >20 beshort 0413 (demand paged)
+# >20 beshort 0421 (standalone)
+# >22 leshort >0 - version %d
+# >168 string .lowmem Apple toolbox
+
diff --git a/magic/Magdir/commands b/magic/Magdir/commands
index 3d97489..f6ad1c8 100644
--- a/magic/Magdir/commands
+++ b/magic/Magdir/commands
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: commands,v 1.51 2014/09/27 00:12:55 christos Exp $
+# $File: commands,v 1.59 2017/08/14 07:40:38 christos Exp $
# commands: file(1) magic for various shells and interpreters
#
#0 string/w : shell archive or script for antique kernel text
@@ -56,7 +56,7 @@
!:mime text/x-awk
0 string/wt #!\ /usr/bin/awk awk script text executable
!:mime text/x-awk
-0 regex/4096 =^\\s{0,100}BEGIN\\s{0,100}[{] awk or perl script text
+0 regex/4096 =^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{] awk or perl script text
# AT&T Bell Labs' Plan 9 shell
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
@@ -78,11 +78,13 @@
!:mime text/x-shellscript
0 string/wb #!\ /usr/local/bin/bash Bourne-Again shell script executable (binary data)
!:mime text/x-shellscript
+0 string/wt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable
+!:mime text/x-shellscript
# PHP scripts
# Ulf Harnhammar <ulfh@update.uu.se>
0 search/1/c =<?php PHP script text
-!:strength + 10
+!:strength + 30
!:mime text/x-php
0 search/1 =<?\n PHP script text
!:mime text/x-php
@@ -96,8 +98,10 @@
!:mime text/x-php
# Smarty compiled template, http://www.smarty.net/
# Elan Ruusamae <glen@delfi.ee>
-0 string =<?php\ /*\ Smarty\ version Smarty compiled template
->24 regex [0-9.]+ \b, version %s
+0 string =<?php
+>5 regex [\ \n]
+>>6 string /*\ Smarty\ version Smarty compiled template
+>>>24 regex [0-9.]+ \b, version %s
!:mime text/x-php
0 string Zend\x00 PHP script Zend Optimizer data
@@ -108,3 +112,7 @@
# URL: http://packages.debian.org/pdmenu
# From: Edward Betts <edward@debian.org>
0 string #!/usr/bin/pdmenu Pdmenu configuration file text
+
+# From Danny Weldon
+0 string \x0b\x13\x08\x00
+>0x04 uleshort <4 ksh byte-code version %d
diff --git a/magic/Magdir/compress b/magic/Magdir/compress
index beb8ebe..6fa8f32 100644
--- a/magic/Magdir/compress
+++ b/magic/Magdir/compress
@@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
-# $File: compress,v 1.62 2014/09/13 14:27:12 christos Exp $
+# $File: compress,v 1.68 2017/05/25 20:07:23 christos Exp $
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
@@ -188,6 +188,7 @@
>6 byte x version %d
>7 byte x \b.%d
!:mime application/x-7z-compressed
+!:ext 7z/cb7
# Type: LZMA
0 lelong&0xffffff =0x5d
@@ -201,6 +202,7 @@
# http://tukaani.org/xz/xz-file-format.txt
0 ustring \xFD7zXZ\x00 XZ compressed data
+!:strength * 2
!:mime application/x-xz
# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
@@ -218,6 +220,56 @@
0 lelong 0x184c2102 LZ4 compressed data (v0.1-v0.9)
!:mime application/x-lz4
+# Zstandard/LZ4 skippable frames
+# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
+0 lelong&0xFFFFFFF0 0x184D2A50
+>(4.l+8) indirect x
+
+# Zstandard Dictionary ID subroutine
+0 name zstd-dictionary-id
+# Single Segment = True
+>0 byte &0x20 \b, Dictionary ID:
+>>0 byte&0x03 0 None
+>>0 byte&0x03 1
+>>>1 byte x %u
+>>0 byte&0x03 2
+>>>1 leshort x %u
+>>0 byte&0x03 3
+>>>1 lelong x %u
+# Single Segment = False
+>0 byte ^0x20 \b, Dictionary ID:
+>>0 byte&0x03 0 None
+>>0 byte&0x03 1
+>>>2 byte x %u
+>>0 byte&0x03 2
+>>>2 leshort x %u
+>>0 byte&0x03 3
+>>>2 lelong x %u
+
+# Zstandard compressed data
+# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
+0 lelong 0xFD2FB522 Zstandard compressed data (v0.2)
+!:mime application/x-zstd
+0 lelong 0xFD2FB523 Zstandard compressed data (v0.3)
+!:mime application/x-zstd
+0 lelong 0xFD2FB524 Zstandard compressed data (v0.4)
+!:mime application/x-zstd
+0 lelong 0xFD2FB525 Zstandard compressed data (v0.5)
+!:mime application/x-zstd
+0 lelong 0xFD2FB526 Zstandard compressed data (v0.6)
+!:mime application/x-zstd
+0 lelong 0xFD2FB527 Zstandard compressed data (v0.7)
+!:mime application/x-zstd
+>4 use zstd-dictionary-id
+0 lelong 0xFD2FB528 Zstandard compressed data (v0.8+)
+!:mime application/x-zstd
+>4 use zstd-dictionary-id
+
+# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
+0 lelong 0xEC30A437 Zstandard dictionary
+!:mime application/x-zstd-dictionary
+>4 lelong x (ID %u)
+
# AFX compressed files (Wolfram Kleff)
2 string -afx- AFX compressed file data
@@ -257,7 +309,8 @@
!:mime application/x-qpress
# Zlib https://www.ietf.org/rfc/rfc6713.txt
-0 beshort%31 =0
->0 byte&0xf =8
->>0 byte&0x80 =0 zlib compressed data
+0 string/b x
+>0 beshort%31 =0
+>>0 byte&0xf =8
+>>>0 byte&0x80 =0 zlib compressed data
!:mime application/zlib
diff --git a/magic/Magdir/console b/magic/Magdir/console
index 27227a4..66f5dbd 100644
--- a/magic/Magdir/console
+++ b/magic/Magdir/console
@@ -1,53 +1,159 @@
#------------------------------------------------------------------------------
-# $File: console,v 1.19 2013/02/06 14:18:52 christos Exp $
+# $File: console,v 1.32 2017/08/13 00:21:47 christos Exp $
# Console game magic
# Toby Deshane <hac@shoelace.digivill.net>
-# ines: file(1) magic for Marat's iNES Nintendo Entertainment System
-# ROM dump format
-
-0 string NES\032 iNES ROM dump,
->4 byte x %dx16k PRG
->5 byte x \b, %dx8k CHR
->6 byte&0x01 =0x1 \b, [Vert.]
->6 byte&0x01 =0x0 \b, [Horiz.]
->6 byte&0x02 =0x2 \b, [SRAM]
->6 byte&0x04 =0x4 \b, [Trainer]
->6 byte&0x04 =0x8 \b, [4-Scr]
+
+# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format
+# Updated by David Korth <gerbilsoft@gerbilsoft.com>
+# References:
+# - http://wiki.nesdev.com/w/index.php/INES
+# - http://wiki.nesdev.com/w/index.php/NES_2.0
+
+# Common header for iNES, NES 2.0, and Wii U iNES.
+0 name nes-rom-image-ines
+>7 byte&0x0C =0x8 (NES 2.0)
+>4 byte x \b: %ux16k PRG
+>5 byte x \b, %ux8k CHR
+>6 byte&0x08 =0x8 [4-Scr]
+>6 byte&0x09 =0x0 [H-mirror]
+>6 byte&0x09 =0x1 [V-mirror]
+>6 byte&0x02 =0x2 [SRAM]
+>6 byte&0x04 =0x4 [Trainer]
+>7 byte&0x03 =0x2 [PC10]
+>7 byte&0x03 =0x1 [VS]
+>>7 byte&0x0C =0x8
+# NES 2.0: VS PPU
+>>>13 byte&0x0F =0x0 \b, RP2C03B
+>>>13 byte&0x0F =0x1 \b, RP2C03G
+>>>13 byte&0x0F =0x2 \b, RP2C04-0001
+>>>13 byte&0x0F =0x3 \b, RP2C04-0002
+>>>13 byte&0x0F =0x4 \b, RP2C04-0003
+>>>13 byte&0x0F =0x5 \b, RP2C04-0004
+>>>13 byte&0x0F =0x6 \b, RP2C03B
+>>>13 byte&0x0F =0x7 \b, RP2C03C
+>>>13 byte&0x0F =0x8 \b, RP2C05-01
+>>>13 byte&0x0F =0x9 \b, RP2C05-02
+>>>13 byte&0x0F =0xA \b, RP2C05-03
+>>>13 byte&0x0F =0xB \b, RP2C05-04
+>>>13 byte&0x0F =0xC \b, RP2C05-05
+# TODO: VS protection hardware?
+>>7 byte x \b]
+# NES 2.0-specific flags.
+>7 byte&0x0C =0x8
+>>12 byte&0x03 =0x0 [NTSC]
+>>12 byte&0x03 =0x1 [PAL]
+>>12 byte&0x02 =0x2 [NTSC+PAL]
+
+# Standard iNES ROM header.
+0 string NES\x1A NES ROM image (iNES)
+>0 use nes-rom-image-ines
+
+# Wii U Virtual Console iNES ROM header.
+0 belong 0x4E455300 NES ROM image (Wii U Virtual Console)
+>0 use nes-rom-image-ines
+
+#------------------------------------------------------------------------------
+# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images
+# Reference: http://wiki.nesdev.com/w/index.php/UNIF
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+#
+# NOTE: The UNIF format uses chunks instead of a fixed header,
+# so most of the data isn't easily parseable.
+#
+0 string UNIF
+>4 lelong <16 NES ROM image (UNIF v%d format)
+
+#------------------------------------------------------------------------------
+# fds: file(1) magic for Famciom Disk System disk images
+# Reference: http://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# TODO: Check "Disk info block" and get info from that in addition to the optional header.
+
+# Disk info block. (block 1)
+0 name nintendo-fds-disk-info-block
+>23 byte !1 FMC-
+>23 byte 1 FSC-
+>16 string x \b%.3s
+>15 byte x \b, mfr %02X
+>20 byte x (Rev.%02u)
+
+# Headered version.
+0 string FDS\x1A
+>0x11 string *NINTENDO-HVC* Famicom Disk System disk image:
+>>0x10 use nintendo-fds-disk-info-block
+>4 byte 1 (%u side)
+>4 byte !1 (%u sides)
+
+# Unheadered version.
+1 string *NINTENDO-HVC* Famicom Disk System disk image:
+>0 use nintendo-fds-disk-info-block
+
+#------------------------------------------------------------------------------
+# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images
+# Used by Nintendo 3DS NES Virtual Console games.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+#
+0 string TNES NES ROM image (Nintendo 3DS Virtual Console)
+>4 byte 100 \b: FDS,
+>>0x2010 use nintendo-fds-disk-info-block
+>4 byte !100 \b: TNES mapper %u
+>>5 byte x \b, %ux8k PRG
+>>6 byte x \b, %ux8k CHR
+>>7 byte&0x08 =1 [WRAM]
+>>8 byte&0x09 =1 [H-mirror]
+>>8 byte&0x09 =2 [V-mirror]
+>>8 byte&0x02 =3 [VRAM]
#------------------------------------------------------------------------------
-# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
+# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
+# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header
#
-0x104 belong 0xCEED6666 Gameboy ROM:
->0x134 string >\0 "%.16s"
->0x146 byte 0x03 \b,[SGB]
->0x147 byte 0x00 \b, [ROM ONLY]
->0x147 byte 0x01 \b, [ROM+MBC1]
->0x147 byte 0x02 \b, [ROM+MBC1+RAM]
->0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT]
->0x147 byte 0x05 \b, [ROM+MBC2]
->0x147 byte 0x06 \b, [ROM+MBC2+BATTERY]
->0x147 byte 0x08 \b, [ROM+RAM]
->0x147 byte 0x09 \b, [ROM+RAM+BATTERY]
->0x147 byte 0x0B \b, [ROM+MMM01]
->0x147 byte 0x0C \b, [ROM+MMM01+SRAM]
->0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT]
->0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT]
->0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT]
->0x147 byte 0x11 \b, [ROM+MBC3]
->0x147 byte 0x12 \b, [ROM+MBC3+RAM]
->0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT]
->0x147 byte 0x19 \b, [ROM+MBC5]
->0x147 byte 0x1A \b, [ROM+MBC5+RAM]
->0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT]
->0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE]
->0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM]
->0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
->0x147 byte 0x1F \b, [Pocket Camera]
->0x147 byte 0xFD \b, [Bandai TAMA5]
->0x147 byte 0xFE \b, [Hudson HuC-3]
->0x147 byte 0xFF \b, [Hudson HuC-1]
+0x104 bequad 0xCEED6666CC0D000B Game Boy ROM image
+>0x143 byte&0x80 0x80
+>>0x134 string >\0 \b: "%.15s"
+>0x143 byte&0x80 !0x80
+>>0x134 string >\0 \b: "%.16s"
+>0x14c byte x (Rev.%02u)
+
+# Machine type. (SGB, CGB, SGB+CGB)
+>0x14b byte 0x33
+>>0x146 byte 0x03
+>>>0x143 byte&0x80 0x80 [SGB+CGB]
+>>>0x143 byte&0x80 !0x80 [SGB]
+>>0x146 byte !0x03
+>>>0x143 byte&0xC0 0x80 [CGB]
+>>>0x143 byte&0xC0 0xC0 [CGB ONLY]
+# Mapper.
+>0x147 byte 0x00 [ROM ONLY]
+>0x147 byte 0x01 [MBC1]
+>0x147 byte 0x02 [MBC1+RAM]
+>0x147 byte 0x03 [MBC1+RAM+BATT]
+>0x147 byte 0x05 [MBC2]
+>0x147 byte 0x06 [MBC2+BATTERY]
+>0x147 byte 0x08 [ROM+RAM]
+>0x147 byte 0x09 [ROM+RAM+BATTERY]
+>0x147 byte 0x0B [MMM01]
+>0x147 byte 0x0C [MMM01+SRAM]
+>0x147 byte 0x0D [MMM01+SRAM+BATT]
+>0x147 byte 0x0F [MBC3+TIMER+BATT]
+>0x147 byte 0x10 [MBC3+TIMER+RAM+BATT]
+>0x147 byte 0x11 [MBC3]
+>0x147 byte 0x12 [MBC3+RAM]
+>0x147 byte 0x13 [MBC3+RAM+BATT]
+>0x147 byte 0x19 [MBC5]
+>0x147 byte 0x1A [MBC5+RAM]
+>0x147 byte 0x1B [MBC5+RAM+BATT]
+>0x147 byte 0x1C [MBC5+RUMBLE]
+>0x147 byte 0x1D [MBC5+RUMBLE+SRAM]
+>0x147 byte 0x1E [MBC5+RUMBLE+SRAM+BATT]
+>0x147 byte 0xFC [Pocket Camera]
+>0x147 byte 0xFD [Bandai TAMA5]
+>0x147 byte 0xFE [Hudson HuC-3]
+>0x147 byte 0xFF [Hudson HuC-1]
+
+# ROM size.
>0x148 byte 0 \b, ROM: 256Kbit
>0x148 byte 1 \b, ROM: 512Kbit
>0x148 byte 2 \b, ROM: 1Mbit
@@ -55,58 +161,198 @@
>0x148 byte 4 \b, ROM: 4Mbit
>0x148 byte 5 \b, ROM: 8Mbit
>0x148 byte 6 \b, ROM: 16Mbit
+>0x148 byte 7 \b, ROM: 32Mbit
>0x148 byte 0x52 \b, ROM: 9Mbit
>0x148 byte 0x53 \b, ROM: 10Mbit
>0x148 byte 0x54 \b, ROM: 12Mbit
+# RAM size.
>0x149 byte 1 \b, RAM: 16Kbit
>0x149 byte 2 \b, RAM: 64Kbit
>0x149 byte 3 \b, RAM: 128Kbit
>0x149 byte 4 \b, RAM: 1Mbit
-
-#>0x14e long x \b, CRC: %x
+>0x149 byte 5 \b, RAM: 512Kbit
#------------------------------------------------------------------------------
-# genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format
+# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats
+# Updated by David Korth <gerbilsoft@gerbilsoft.com>
+# References:
+# - http://www.retrodev.com/segacd.html
+# - http://devster.monkeeh.com/sega/32xguide1.txt
#
-0x100 string SEGA Sega MegaDrive/Genesis raw ROM dump
->0x120 string >\0 Name: "%.16s"
->0x110 string >\0 %.16s
->0x1B0 string RA with SRAM
+
+# Common Sega Mega Drive header format.
+# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s.
+0 name sega-mega-drive-header
+# ROM title. (Use domestic if present; if not, use international.)
+>0x120 byte >0x20
+>>0x120 string >\0 \b: "%.16s"
+>0x120 byte <0x21
+>>0x150 string >\0 \b: "%.16s"
+# Other information.
+>0x180 string >\0 (%.14s
+>>0x110 string >\0 \b, %.16s
+>0x180 byte 0
+>>0x110 string >\0 (%.16s
+>0 byte x \b)
+
+# TODO: Check for 32X CD?
+# Sega Mega CD disc images: 2048-byte sectors.
+0 string SEGADISCSYSTEM\ \ Sega Mega CD disc image
+>0 use sega-mega-drive-header
+>0 byte x \b, 2048-byte sectors
+0 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image
+>0 use sega-mega-drive-header
+>0 byte x \b, 2048-byte sectors
+# Sega Mega CD disc images: 2352-byte sectors.
+0x10 string SEGADISCSYSTEM\ \ Sega Mega CD disc image
+>0x10 use sega-mega-drive-header
+>0 byte x \b, 2352-byte sectors
+0x10 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image
+>0x10 use sega-mega-drive-header
+>0 byte x \b, 2352-byte sectors
+
+# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images.
+0x100 string SEGA
+>0x3C0 bequad 0x4D41525320434845 Sega 32X ROM image
+>>0 use sega-mega-drive-header
+>0x3C0 bequad !0x4D41525320434845
+>>0x105 belong 0x5049434F Sega Pico ROM image
+>>>0 use sega-mega-drive-header
+>>0x105 belong !0x5049434F
+>>>0x180 beshort 0x4252 Sega Mega CD Boot ROM image
+>>>0x180 beshort !0x4252 Sega Mega Drive / Genesis ROM image
+>>>0 use sega-mega-drive-header
#------------------------------------------------------------------------------
-# genesis: file(1) magic for the Super MegaDrive ROM dump format
+# genesis: file(1) magic for the Super MegaDrive ROM dump format
#
-0x280 string EAGN Super MagicDrive ROM dump
->0 byte x %dx16k blocks
->2 byte 0 \b, last in series or standalone
->2 byte >0 \b, split ROM
->8 byte 0xAA
->9 byte 0xBB
+
+# NOTE: Due to interleaving, we can't display anything
+# other than the copier header information.
+0 name sega-genesis-smd-header
+>0 byte x %dx16k blocks
+>2 byte 0 \b, last in series or standalone
+>2 byte >0 \b, split ROM
+
+# "Sega Genesis" header.
+0x280 string EAGN
+>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format):
+>>0 use sega-genesis-smd-header
+
+# "Sega Mega Drive" header.
+0x280 string EAMG
+>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format):
+>>0 use sega-genesis-smd-header
#------------------------------------------------------------------------------
-# genesis: file(1) alternate magic for the Super MegaDrive ROM dump format
+# smsgg: file(1) magic for Sega Master System and Game Gear ROM images
+# Detects all Game Gear and export Sega Master System ROM images,
+# and some Japanese Sega Master System ROM images.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: http://www.smspower.org/Development/ROMHeader
#
-0x280 string EAMG Super MagicDrive ROM dump
->0 byte x %dx16k blocks
->2 byte x \b, last in series or standalone
->8 byte 0xAA
->9 byte 0xBB
+
+# General SMS header rule.
+# The SMS boot ROM checks the header at three locations.
+0 name sega-master-system-rom-header
+# Machine type.
+>0x0F byte&0xF0 0x30 Sega Master System
+>0x0F byte&0xF0 0x40 Sega Master System
+>0x0F byte&0xF0 0x50 Sega Game Gear
+>0x0F byte&0xF0 0x60 Sega Game Gear
+>0x0F byte&0xF0 0x70 Sega Game Gear
+>0x0F byte&0xF0 <0x30 Sega Master System / Game Gear
+>0x0F byte&0xF0 >0x70 Sega Master System / Game Gear
+>0 byte x ROM image:
+# Product code.
+>0x0E byte&0xF0 0x10 1
+>0x0E byte&0xF0 0x20 2
+>0x0E byte&0xF0 0x30 3
+>0x0E byte&0xF0 0x40 4
+>0x0E byte&0xF0 0x50 5
+>0x0E byte&0xF0 0x60 6
+>0x0E byte&0xF0 0x70 7
+>0x0E byte&0xF0 0x80 8
+>0x0E byte&0xF0 0x90 9
+>0x0E byte&0xF0 0xA0 10
+>0x0E byte&0xF0 0xB0 11
+>0x0E byte&0xF0 0xC0 12
+>0x0E byte&0xF0 0xD0 13
+>0x0E byte&0xF0 0xE0 14
+>0x0E byte&0xF0 0xF0 15
+# If the product code is 5 digits, we'll need to backspace here.
+>0x0E byte&0xF0 !0
+>>0x0C leshort x \b%04x
+>0x0E byte&0xF0 0
+>>0x0C leshort x %04x
+# Revision.
+>0x0E byte&0x0F x (Rev.%02d)
+# ROM size. (Used for the boot ROM checksum routine.)
+>0x0F byte&0x0F 0x0A (8 KB)
+>0x0F byte&0x0F 0x0B (16 KB)
+>0x0F byte&0x0F 0x0C (32 KB)
+>0x0F byte&0x0F 0x0D (48 KB)
+>0x0F byte&0x0F 0x0E (64 KB)
+>0x0F byte&0x0F 0x0F (128 KB)
+>0x0F byte&0x0F 0x00 (256 KB)
+>0x0F byte&0x0F 0x01 (512 KB)
+>0x0F byte&0x0F 0x02 (1 MB)
+
+# SMS/GG header locations.
+0x7FF0 string TMR\ SEGA
+>0x7FF0 use sega-master-system-rom-header
+0x3FF0 string TMR\ SEGA
+>0x3FF0 use sega-master-system-rom-header
+0x1FF0 string TMR\ SEGA
+>0x1FF0 use sega-master-system-rom-header
#------------------------------------------------------------------------------
-# smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps
-#
-# Does not detect all images. Very preliminary guesswork. Need more data
-# on format.
+# saturn: file(1) magic for the Sega Saturn disc image format.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
#
-# FIXME: need a little more info...;P
+
+# Common Sega Saturn disc header format.
+# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding.
+# TODO: Release date, device information, region code, others?
+0 name sega-saturn-disc-header
+>0x60 string >\0 \b: "%.32s"
+>0x20 string >\0 (%.10s
+>>0x2A string >\0 \b, %.6s)
+>>0x2A byte 0 \b)
+
+# 2048-byte sector version.
+0 string SEGA\ SEGASATURN\ Sega Saturn disc image
+>0 use sega-saturn-disc-header
+>0 byte x (2048-byte sectors)
+# 2352-byte sector version.
+0x10 string SEGA\ SEGASATURN\ Sega Saturn disc image
+>0x10 use sega-saturn-disc-header
+>0 byte x (2352-byte sectors)
+
+#------------------------------------------------------------------------------
+# dreamcast: file(1) magic for the Sega Dreamcast disc image format.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: http://mc.pp.se/dc/ip0000.bin.html
#
-#0 byte 0xF3
-#>1 byte 0xED Sega Master System/Game Gear ROM dump
-#>1 byte 0x31 Sega Master System/Game Gear ROM dump
-#>1 byte 0xDB Sega Master System/Game Gear ROM dump
-#>1 byte 0xAF Sega Master System/Game Gear ROM dump
-#>1 byte 0xC3 Sega Master System/Game Gear ROM dump
+
+# Common Sega Dreamcast disc header format.
+# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding.
+# TODO: Release date, device information, region code, others?
+0 name sega-dreamcast-disc-header
+>0x80 string >\0 \b: "%.32s"
+>0x40 string >\0 (%.10s
+>>0x4A string >\0 \b, %.6s)
+>>0x4A byte 0 \b)
+
+# 2048-byte sector version.
+0 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image
+>0 use sega-dreamcast-disc-header
+>0 byte x (2048-byte sectors)
+# 2352-byte sector version.
+0x10 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image
+>0x10 use sega-dreamcast-disc-header
+>0 byte x (2352-byte sectors)
#------------------------------------------------------------------------------
# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format
@@ -115,27 +361,114 @@
0 string LCDi Dream Animator file
#------------------------------------------------------------------------------
-# v64: file(1) uncertain magic for the V64 format N64 ROM dumps
+# z64: file(1) magic for the Z64 format N64 ROM dumps
+# Reference: http://forum.pj64-emu.com/showthread.php?t=2239
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+#
+0 bequad 0x803712400000000F Nintendo 64 ROM image
+>0x20 string >\0 \b: "%.20s"
+>0x3B string x (%.4s
+>0x3F byte x \b, Rev.%02u)
+
+#------------------------------------------------------------------------------
+# v64: file(1) magic for the V64 format N64 ROM dumps
+# Same as z64 format, but with 16-bit byteswapping.
+#
+0 bequad 0x3780401200000F00 Nintendo 64 ROM image (V64)
+
+#------------------------------------------------------------------------------
+# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps
+# Same as z64 format, but with swapped 16-bit words.
+#
+0 bequad 0x12408037000F0000 Nintendo 64 ROM image (wordswapped)
+
+#------------------------------------------------------------------------------
+# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps
+# Same as z64 format, but with 32-bit byteswapping.
#
-0 belong 0x37804012 V64 Nintendo 64 ROM dump
+0 bequad 0x401237800F000000 Nintendo 64 ROM image (32-bit byteswapped)
-# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
-# Nintendo .nds
-192 string \044\377\256Qi\232 Nintendo DS Game ROM Image
-# Nintendo .gba
-0 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image
+#------------------------------------------------------------------------------
+# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format
+# Reference: http://problemkaputt.de/gbatek.htm#gbacartridgeheader
+#
+# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
+# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
+#
+4 bequad 0x24FFAE51699AA221 Game Boy Advance ROM image
+>0xA0 string >\0 \b: "%.12s"
+>0xAC string x (%.6s
+>0xBC byte x \b, Rev.%02u)
+
+#------------------------------------------------------------------------------
+# nds: file(1) magic for the Nintendo DS(i) raw ROM format
+# Reference: http://problemkaputt.de/gbatek.htm#dscartridgeheader
+#
+# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
+# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
+#
+0xC0 bequad 0x24FFAE51699AA221 Nintendo DS ROM image
+>0x00 string >\0 \b: "%.12s"
+>0x0C string x (%.6s
+>0x1E byte x \b, Rev.%02u)
+>0x12 byte 2 (DSi enhanced)
+>0x12 byte 3 (DSi only)
+# Secure Area check.
+>0x20 lelong <0x4000 (homebrew)
+>0x20 lelong >0x3FFF
+>>0x4000 lequad 0x0000000000000000 (multiboot)
+>>0x4000 lequad !0x0000000000000000
+>>>0x4000 lequad 0xE7FFDEFFE7FFDEFF (decrypted)
+>>>0x4000 lequad !0xE7FFDEFFE7FFDEFF
+>>>>0x1000 lequad 0x0000000000000000 (encrypted)
+>>>>0x1000 lequad !0x0000000000000000 (mask ROM)
+
+#------------------------------------------------------------------------------
+# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot.
+# This is also used for loading .nds files using the MSET exploit on 3DS.
+# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp
+0xC0 bequad 0xC8604FE201708FE2 Nintendo DS Slot-2 ROM image (PassMe)
+
+#------------------------------------------------------------------------------
+# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# References:
+# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp
+# - http://www.devrs.com/ngp/files/ngpctech.txt
+#
+0x0A string BY\ SNK\ CORPORATION Neo Geo Pocket
+>0x23 byte 0x10 Color
+>0 byte x ROM image
+>0x24 string >\0 \b: "%.12s"
+>0x1F byte 0xFF (debug mode enabled)
#------------------------------------------------------------------------------
# msx: file(1) magic for MSX game cartridge dumps
# Too simple - MPi
-#0 beshort 0x4142 MSX game cartridge dump
+#0 beshort 0x4142 MSX game cartridge dump
#------------------------------------------------------------------------------
# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
0 string PS-X\ EXE Sony Playstation executable
+>16 lelong x PC=0x%08x,
+>20 lelong !0 GP=0x%08x,
+>24 lelong !0 .text=[0x%08x,
+>>28 lelong x \b0x%x],
+>32 lelong !0 .data=[0x%08x,
+>>36 lelong x \b0x%x],
+>40 lelong !0 .bss=[0x%08x,
+>>44 lelong x \b0x%x],
+>48 lelong !0 Stack=0x%08x,
+>48 lelong =0 No Stack!,
+>52 lelong !0 StackSize=0x%x,
+#>76 string >\0 (%s)
# Area:
>113 string x (%s)
+# CPE executables
+0 string CPE CPE executable
+>3 byte x (version %d)
+
#------------------------------------------------------------------------------
# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
0 string XBEH XBE, Microsoft Xbox executable
@@ -167,7 +500,7 @@
# Double-check that the image type matches too, 0x8008 conflicts with
# 8 character OMF-86 object file headers.
-0 beshort 0x8008
+0 beshort 0x8008
>6 string BS93 Lynx homebrew cartridge
>>2 beshort x \b, RAM start $%04x
>6 string LYNX Lynx cartridge
@@ -177,9 +510,23 @@
# From: Serge van den Boom <svdb@stack.nl>
0 string \x01ZZZZZ\x01 3DO "Opera" file system
-# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
+# From: Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
+# From: David Pflug <david@pflug.email>
+# is the offset 12 or the offset 16 correct?
+# GBS (Game Boy Sound) magic
+# ftp://ftp.modland.com/pub/documents/format_documentation/\
+# Gameboy%20Sound%20System%20(.gbs).txt
0 string GBS Nintendo Gameboy Music/Audio Data
-12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module
+#12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module
+>16 string >\0 ("%s" by
+>48 string >\0 %s, copyright
+>80 string >\0 %s),
+>3 byte x version %d,
+>4 byte x %d tracks
+
+# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at>
+# see http://zerosoft.zophar.net/ips.php
+0 string PATCH IPS patch file
# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
0 string PPF30 Playstation Patch File version 3.0
@@ -208,7 +555,7 @@
# SNES9x .smv "movie" file format.
0 string SMV\x1A SNES9x input recording
>0x4 lelong x \b, version %d
-# version 4 is latest so far
+# version 4 is latest so far
>0x4 lelong <5
>>0x8 ledate x \b, recorded at %s
>>0xc lelong >0 \b, rerecorded %d times
@@ -262,3 +609,241 @@
# From: Sven Hartge <debian@ds9.argh.org>
0 string SCVM ScummVM savegame
>12 string >\0 "%s"
+
+#------------------------------------------------------------------------------
+# Nintendo GameCube / Wii file formats.
+#
+
+# Type: Nintendo GameCube/Wii common disc header data.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: http://wiibrew.org/wiki/Wii_Disc
+0 name nintendo-gcn-disc-common
+>0x20 string x "%.64s"
+>0x00 string x (%.6s
+>0x06 byte >0
+>>0x06 byte 1 \b, Disc 2
+>>0x06 byte 2 \b, Disc 3
+>>0x06 byte 3 \b, Disc 4
+>0x07 byte x \b, Rev.%02u)
+
+# Type: Nintendo GameCube disc image
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: http://wiibrew.org/wiki/Wii_Disc
+0x1C belong 0xC2339F3D Nintendo GameCube disc image:
+>0 use nintendo-gcn-disc-common
+
+# Type: Nintendo GameCube embedded disc image
+# Commonly found on demo discs.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8
+0 belong 0xAE0F38A2
+>0x0C belong 0x00100000
+>>(8.L+0x1C) belong 0xC2339F3D Nintendo GameCube embedded disc image:
+>>>(8.L) use nintendo-gcn-disc-common
+
+# Type: Nintendo Wii disc image
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: http://wiibrew.org/wiki/Wii_Disc
+0x18 belong 0x5D1C9EA3 Nintendo Wii disc image:
+>0 use nintendo-gcn-disc-common
+
+# Type: Nintendo Wii disc image (WBFS format)
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: http://wiibrew.org/wiki/Wii_Disc
+0 string WBFS
+>0x218 belong 0x5D1C9EA3 Nintendo Wii disc image (WBFS format):
+>>0x200 use nintendo-gcn-disc-common
+
+# Type: Nintendo GameCube/Wii disc image (CISO format)
+# NOTE: This is NOT the same as Compact ISO or PSP CISO,
+# though it has the same magic number.
+0 string CISO
+# Other fields are used to determine what type of CISO this is:
+# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
+# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
+# - None of the above: Compact ISO.
+>4 lelong 0x200000
+>>8 byte 1
+>>>0x801C belong 0xC2339F3D Nintendo GameCube disc image (CISO format):
+>>>>0x8000 use nintendo-gcn-disc-common
+>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii disc image (CISO format):
+>>>>0x8000 use nintendo-gcn-disc-common
+
+# Type: Nintendo GameCube/Wii disc image (GCZ format)
+# Due to zlib compression, we can't get the actual disc information.
+0 lelong 0xB10BC001
+>4 lelong 0 Nintendo GameCube disc image (GCZ format)
+>4 lelong 1 Nintendo Wii disc image (GCZ format)
+>4 lelong >1 Nintendo GameCube/Wii disc image (GCZ format)
+
+# Type: Nintendo GameCube/Wii disc image (WDF format)
+0 string WII\001DISC
+>8 belong 1
+# WDFv1
+>>0x54 belong 0xC2339F3D Nintendo GameCube disc image (WDFv1 format):
+>>>0x38 use nintendo-gcn-disc-common
+>>0x58 belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv1 format):
+>>>0x38 use nintendo-gcn-disc-common
+>8 belong 2
+# WDFv2
+>>(12.L+0x1C) belong 0xC2339F3D Nintendo GameCube disc image (WDFv2 format):
+>>>(12.L) use nintendo-gcn-disc-common
+>>(12.L+0x18) belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv2 format):
+>>>(12.L) use nintendo-gcn-disc-common
+
+# Type: Nintendo GameCube/Wii disc image (WIA format)
+0 string WIA\001 Nintendo
+>0x48 belong 0 GameCube/Wii
+>0x48 belong 1 GameCube
+>0x48 belong 2 Wii
+>0x48 belong >2 GameCube/Wii
+>0x48 belong x disc image (WIA format):
+>>0x58 use nintendo-gcn-disc-common
+
+#------------------------------------------------------------------------------
+# Nintendo 3DS file formats.
+#
+
+# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC)
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: https://www.3dbrew.org/wiki/NCSD
+0x100 string NCSD
+>0x118 lequad 0 Nintendo 3DS Game Card image
+# NCCH header for partition 0. (game data)
+>>0x1150 string >\0 \b: "%.16s"
+>>0x312 byte x (Rev.%02u)
+>>0x118C byte 2 (New3DS only)
+>>0x18D byte 0 (inner device)
+>>0x18D byte 1 (Card1)
+>>0x18D byte 2 (Card2)
+>>0x18D byte 3 (extended device)
+>0x118 bequad 0x0102020202000000 Nintendo 3DS eMMC dump (Old3DS)
+>0x118 bequad 0x0102020203000000 Nintendo 3DS eMMC dump (New3DS)
+
+# Nintendo 3DS version code.
+# Reference: https://www.3dbrew.org/wiki/Titles
+# Format: leshort containing three fields:
+# - 6-bit: Major
+# - 6-bit: Minor
+# - 4-bit: Revision
+# NOTE: Only supporting major/minor versions from 0-15 right now.
+# NOTE: Should be prefixed with "v".
+0 name nintendo-3ds-version-code
+# Raw version.
+>0 leshort x \b%u,
+# Major version.
+>0 leshort&0xFC00 0x0000 0
+>0 leshort&0xFC00 0x0400 1
+>0 leshort&0xFC00 0x0800 2
+>0 leshort&0xFC00 0x0C00 3
+>0 leshort&0xFC00 0x1000 4
+>0 leshort&0xFC00 0x1400 5
+>0 leshort&0xFC00 0x1800 6
+>0 leshort&0xFC00 0x1C00 7
+>0 leshort&0xFC00 0x2000 8
+>0 leshort&0xFC00 0x2400 9
+>0 leshort&0xFC00 0x2800 10
+>0 leshort&0xFC00 0x2C00 11
+>0 leshort&0xFC00 0x3000 12
+>0 leshort&0xFC00 0x3400 13
+>0 leshort&0xFC00 0x3800 14
+>0 leshort&0xFC00 0x3C00 15
+# Minor version.
+>0 leshort&0x03F0 0x0000 \b.0
+>0 leshort&0x03F0 0x0010 \b.1
+>0 leshort&0x03F0 0x0020 \b.2
+>0 leshort&0x03F0 0x0030 \b.3
+>0 leshort&0x03F0 0x0040 \b.4
+>0 leshort&0x03F0 0x0050 \b.5
+>0 leshort&0x03F0 0x0060 \b.6
+>0 leshort&0x03F0 0x0070 \b.7
+>0 leshort&0x03F0 0x0080 \b.8
+>0 leshort&0x03F0 0x0090 \b.9
+>0 leshort&0x03F0 0x00A0 \b.10
+>0 leshort&0x03F0 0x00B0 \b.11
+>0 leshort&0x03F0 0x00C0 \b.12
+>0 leshort&0x03F0 0x00D0 \b.13
+>0 leshort&0x03F0 0x00E0 \b.14
+>0 leshort&0x03F0 0x00F0 \b.15
+# Revision.
+>0 leshort&0x000F x \b.%u
+
+# Type: Nintendo 3DS "NCCH" container.
+# https://www.3dbrew.org/wiki/NCCH
+0x100 string NCCH Nintendo 3DS
+>0x18D byte&2 0 File Archive (CFA)
+>0x18D byte&2 2 Executable Image (CXI)
+>0x150 string >\0 \b: "%.16s"
+>0x18D byte 0x05
+>>0x10E leshort x (Old3DS System Update v
+>>0x10E use nintendo-3ds-version-code
+>>0x10E leshort x \b)
+>0x18D byte 0x15
+>>0x10E leshort x (New3DS System Update v
+>>0x10E use nintendo-3ds-version-code
+>>0x10E leshort x \b)
+>0x18D byte !0x05
+>>0x18D byte !0x15
+>>>0x112 byte x (v
+>>>0x112 use nintendo-3ds-version-code
+>>>0x112 byte x \b)
+>0x18C byte 2 (New3DS only)
+
+# Type: Nintendo 3DS "SMDH" file. (application description)
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: https://3dbrew.org/wiki/SMDH
+0 string SMDH Nintendo 3DS SMDH file
+>0x208 leshort !0
+>>0x208 lestring16 x \b: "%.128s"
+>>0x388 leshort !0
+>>>0x388 lestring16 x by %.128s
+>0x208 leshort 0
+>>0x008 leshort !0
+>>>0x008 lestring16 x \b: "%.128s"
+>>>0x188 leshort !0
+>>>>0x188 lestring16 x by %.128s
+
+# Type: Nintendo 3DS Homebrew Application.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: https://3dbrew.org/wiki/3DSX_Format
+0 string 3DSX Nintendo 3DS Homebrew Application (3DSX)
+
+#------------------------------------------------------------------------------
+# a7800: file(1) magic for the Atari 7800 raw ROM format.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: https://sites.google.com/site/atari7800wiki/a78-header
+
+0 byte >0
+>0 byte <3
+>>1 string ATARI7800 Atari 7800 ROM image
+>>>0x11 string >\0 \b: "%.32s"
+# Display type.
+>>>0x39 byte 0 (NTSC)
+>>>0x39 byte 1 (PAL)
+>>>0x36 byte&1 1 (POKEY)
+
+#------------------------------------------------------------------------------
+# vectrex: file(1) magic for the GCE Vectrex raw ROM format.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm
+#
+# NOTE: Title is terminated with 0x80, not 0.
+# The header is terminated with a 0, so that will
+# terminate the title as well.
+#
+0 string g\ GCE Vectrex ROM image
+>0x11 string >\0 \b: "%.16s"
+
+#------------------------------------------------------------------------------
+# amiibo: file(1) magic for Nintendo amiibo NFC dumps.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: https://www.3dbrew.org/wiki/Amiibo
+0x00 byte 0x04
+>0x0A beshort 0x0FE0
+>>0x0C belong 0xF110FFEE
+>>>0x208 beshort 0x0100
+>>>>0x020A byte 0x0F
+>>>>>0x020C bequad 0x000000045F000000
+>>>>>>0x5B byte 0x02
+>>>>>>>0x54 belong x Nintendo amiibo NFC dump - amiibo ID: %08X-
+>>>>>>>0x58 belong x \b%08X
diff --git a/magic/Magdir/coverage b/magic/Magdir/coverage
new file mode 100644
index 0000000..6dd36fa
--- /dev/null
+++ b/magic/Magdir/coverage
@@ -0,0 +1,91 @@
+
+#------------------------------------------------------------------------------
+# $File: coverage,v 1.1 2016/06/05 00:26:32 christos Exp $
+# xoverage: file(1) magic for test coverage data
+
+# File formats used to store test coverage data
+# 2016-05-21, Georg Sauthoff <mail@georg.so>
+
+
+# - GCC gcno - written by GCC at compile time when compiling with
+# gcc -ftest-coverage
+# - GCC gcda - written by a program that was compiled with
+# gcc -fprofile-arcs
+# - LLVM raw profiles - generated by a program compiled with
+# clang -fprofile-instr-generate -fcoverage-mapping ...
+# - LLVM indexed profiles - generated by
+# llvm-profdata
+# - GCOV reports, i.e. the annotated source code
+# - LCOV trace files, i.e. aggregated GCC profiles
+#
+# GCC coverage tracefiles
+# .gcno file are created during compile time,
+# while data collected during runtime is stored in .gcda files
+# cf. gcov-io.h
+# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html
+# Examples:
+# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35
+# Debian 8 PPC64/gcc-4.9.2 : 67 63 6e 6f 34 30 39 2a
+0 lelong 0x67636e6f GCC gcno coverage (-ftest-coverage),
+>&3 byte x version %c.
+>&1 byte x \b%c
+
+# big endian
+0 belong 0x67636e6f GCC gcno coverage (-ftest-coverage),
+>&0 byte x version %c.
+>&2 byte x \b%c (big-endian)
+
+# Examples:
+# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35
+# Debian 8 PPC64/gcc-4.9.2 : 67 63 64 61 34 30 39 2a
+0 lelong 0x67636461 GCC gcda coverage (-fprofile-arcs),
+>&3 byte x version %c.
+>&1 byte x \b%c
+
+# big endian
+0 belong 0x67636461 GCC gcda coverage (-fprofile-arcs),
+>&0 byte x version %c.
+>&2 byte x \b%c (big-endian)
+
+
+# LCOV tracefiles
+# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php
+0 string TN:
+>&0 search/64 \nSF:/ LCOV coverage tracefile
+
+
+# Coverage reports generated by gcov
+# i.e. source code annoted with coverage information
+0 string \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source:
+>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph:
+>>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data: GCOV coverage report
+
+
+# LLVM coverage files
+
+# raw data after running a program compiled with:
+# `clang -fprofile-instr-generate -fcoverage-mapping ...`
+# default name: default.profraw
+# magic is: \xFF lprofr \x81
+# cf. http://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html
+0 lequad 0xff6c70726f667281 LLVM raw profile data,
+>&0 byte x version %d
+
+# big endian
+0 bequad 0xff6c70726f667281 LLVM raw profile data,
+>&7 byte x version %d (big-endian)
+
+
+# LLVM indexed instruction profile (as generated by llvm-profdata)
+# magic is: reverse(\xFF lprofi \x81)
+# cf. http://llvm.org/docs/CoverageMappingFormat.html
+# http://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html
+# http://llvm.org/docs/CommandGuide/llvm-cov.html
+# http://llvm.org/docs/CommandGuide/llvm-profdata.html
+0 lequad 0x8169666f72706cff LLVM indexed profile data,
+>&0 byte x version %d
+
+# big endian
+0 bequad 0x8169666f72706cff LLVM indexed profile data,
+>&7 byte x version %d (big-endian)
+
diff --git a/magic/Magdir/cups b/magic/Magdir/cups
index 005a134..a065de3 100644
--- a/magic/Magdir/cups
+++ b/magic/Magdir/cups
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: cups,v 1.3 2014/05/28 19:50:41 christos Exp $
+# $File: cups,v 1.5 2017/03/17 21:35:28 christos Exp $
# Cups: file(1) magic for the cups raster file format
# From: Laurent Martelli <martellilaurent@gmail.com>
# http://www.cups.org/documentation.php/spec-raster.html
@@ -39,16 +39,16 @@
>404 lelong 20 ColorSpace=AdobeRGB
# Cups Raster image format, Big Endian
-0 string RaS
+0 string RaS
>3 string t Cups Raster version 1, Big Endian
>3 string 2 Cups Raster version 2, Big Endian
>3 string 3 Cups Raster version 3, Big Endian
!:mime application/vnd.cups-raster
->0 use ^cups-le
+>0 use \^cups-le
# Cups Raster image format, Little Endian
-1 string SaR
+1 string SaR
>0 string t Cups Raster version 1, Little Endian
>0 string 2 Cups Raster version 2, Little Endian
>0 string 3 Cups Raster version 3, Little Endian
diff --git a/magic/Magdir/database b/magic/Magdir/database
index b00252b..a0300ae 100644
--- a/magic/Magdir/database
+++ b/magic/Magdir/database
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: database,v 1.43 2014/10/28 15:47:39 christos Exp $
+# $File: database,v 1.52 2017/08/13 00:21:47 christos Exp $
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
@@ -84,7 +84,7 @@
# From Max Bowsher.
12 long 0x00040988 Berkeley DB
>16 long >0 (Log, version %d, native byte-order)
-12 belong 0x00040988 Berkeley DB
+12 belong 0x00040988 Berkeley DB
>16 belong >0 (Log, version %d, big-endian)
12 lelong 0x00040988 Berkeley DB
>16 lelong >0 (Log, version %d, little-endian)
@@ -103,7 +103,7 @@
>>>12 long !0 32bit aligned
>>>>12 bedouble 8.642135e+130 big-endian
>>>>>20 long 0 64bit long
->>>>>20 long !0 32bit long
+>>>>>20 long !0 32bit long
>>>>12 ledouble 8.642135e+130 little-endian
>>>>>24 long 0 64bit long
>>>>>24 long !0 32bit long (i386)
@@ -128,22 +128,22 @@
# XXX: Weak magic.
# Alex Ott <ott@jet.msk.su>
## Paradox file formats
-#2 leshort 0x0800 Paradox
-#>0x39 byte 3 v. 3.0
-#>0x39 byte 4 v. 3.5
-#>0x39 byte 9 v. 4.x
-#>0x39 byte 10 v. 5.x
-#>0x39 byte 11 v. 5.x
-#>0x39 byte 12 v. 7.x
-#>>0x04 byte 0 indexed .DB data file
-#>>0x04 byte 1 primary index .PX file
-#>>0x04 byte 2 non-indexed .DB data file
-#>>0x04 byte 3 non-incrementing secondary index .Xnn file
-#>>0x04 byte 4 secondary index .Ynn file
-#>>0x04 byte 5 incrementing secondary index .Xnn file
-#>>0x04 byte 6 non-incrementing secondary index .XGn file
-#>>0x04 byte 7 secondary index .YGn file
-#>>>0x04 byte 8 incrementing secondary index .XGn file
+#2 leshort 0x0800 Paradox
+#>0x39 byte 3 v. 3.0
+#>0x39 byte 4 v. 3.5
+#>0x39 byte 9 v. 4.x
+#>0x39 byte 10 v. 5.x
+#>0x39 byte 11 v. 5.x
+#>0x39 byte 12 v. 7.x
+#>>0x04 byte 0 indexed .DB data file
+#>>0x04 byte 1 primary index .PX file
+#>>0x04 byte 2 non-indexed .DB data file
+#>>0x04 byte 3 non-incrementing secondary index .Xnn file
+#>>0x04 byte 4 secondary index .Ynn file
+#>>0x04 byte 5 incrementing secondary index .Xnn file
+#>>0x04 byte 6 non-incrementing secondary index .XGn file
+#>>0x04 byte 7 secondary index .YGn file
+#>>>0x04 byte 8 incrementing secondary index .XGn file
## XBase database files
# updated by Joerg Jenderek at Feb 2013
@@ -151,33 +151,33 @@
# http://www.clicketyclick.dk/databases/xbase/format/dbf.html
# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
-0 ubelong&0x0000FFFF <0x00000C20
+0 ubelong&0x0000FFFF <0x00000C20
# skip Infocom game Z-machine
->2 ubyte >0
+>2 ubyte >0
# skip Androids *.xml
->>3 ubyte >0
->>>3 ubyte <32
+>>3 ubyte >0
+>>>3 ubyte <32
# 1 < version VV
->>>>0 ubyte >1
+>>>>0 ubyte >1
# skip HELP.CA3 by test for reserved byte ( NULL )
->>>>>27 ubyte 0
+>>>>>27 ubyte 0
# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
#>>>>>30 ubeshort x 30NULL?%x
-# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
->>>>>>24 ubelong&0xffFFFFff >0x01302000
+# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
+>>>>>>24 ubelong&0xffFFFFff >0x01302000
# .DBF or .MDX
->>>>>>24 ubelong&0xffFFFFff <0x01302001
+>>>>>>24 ubelong&0xffFFFFff <0x01302001
# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
->>>>>>>24 ubelong&0xffFFFFff =0
+>>>>>>>24 ubelong&0xffFFFFff =0
# test for 2 reserved NULL bytes,transaction and encryption byte flag
->>>>>>>>12 ubelong&0xFFFFfEfE 0
+>>>>>>>>12 ubelong&0xFFFFfEfE 0
# test for MDX flag
->>>>>>>>>28 ubyte x
->>>>>>>>>28 ubyte&0xf8 0
+>>>>>>>>>28 ubyte x
+>>>>>>>>>28 ubyte&0xf8 0
# header size >= 32
->>>>>>>>>>8 uleshort >31
+>>>>>>>>>>8 uleshort >31
# skip PIC15736.PCX by test for language driver name or field name
->>>>>>>>>>>32 ubyte >0
+>>>>>>>>>>>32 ubyte >0
#!:mime application/x-dbf; charset=unknown-8bit ??
#!:mime application/x-dbase
>>>>>>>>>>>>0 use xbase-type
@@ -202,22 +202,22 @@
>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
# 1st record offset + 1 = header size
->>>>>>>>>>>>8 uleshort >0
->>>>>>>>>>>>(8.s+1) ubyte >0
+>>>>>>>>>>>>8 uleshort >0
+>>>>>>>>>>>>(8.s+1) ubyte >0
>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d
->>>>>>>>>>>>>(8.s+1) ubyte >0
+>>>>>>>>>>>>>(8.s+1) ubyte >0
>>>>>>>>>>>>>>&-1 string >\0 1st record "%s"
-# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL)
->>>>>>>24 ubelong&0x0133f7ff >0
+# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
+>>>>>>>24 ubelong&0x0133f7ff >0
# test for reserved NULL byte
->>>>>>>>47 ubyte 0
+>>>>>>>>47 ubyte 0
# test for valid TAG key format (0x10 or 0)
->>>>>>>>>559 ubyte&0xeF 0
+>>>>>>>>>559 ubyte&0xeF 0
# test MM <= 12
->>>>>>>>>>45 ubeshort <0x0C20
->>>>>>>>>>>45 ubyte >0
->>>>>>>>>>>>46 ubyte <32
->>>>>>>>>>>>>46 ubyte >0
+>>>>>>>>>>45 ubeshort <0x0C20
+>>>>>>>>>>>45 ubyte >0
+>>>>>>>>>>>>46 ubyte <32
+>>>>>>>>>>>>>46 ubyte >0
#!:mime application/x-mdx
>>>>>>>>>>>>>>0 use xbase-type
>>>>>>>>>>>>>>0 ubyte x \b MDX
@@ -236,11 +236,11 @@
# 2nd tag name
#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s"
#
-# Print the xBase names of different version variants
+# Print the xBase names of different version variants
0 name xbase-type
->0 ubyte <2
+>0 ubyte <2
# 1 < version
->0 ubyte >1
+>0 ubyte >1
>>0 ubyte 0x02 FoxBase
# FoxBase+/dBaseIII+, no memo
>>0 ubyte 0x03 FoxBase+/dBase III
@@ -293,7 +293,7 @@
# dBASE IV with SQL table, with memo .DBT
>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
!:mime application/x-dbf
-# HiPer-Six format;Clipper SIX, with SMT memo file
+# HiPer-Six format;Clipper SIX, with SMT memo file
>>0 ubyte 0xE5 Clipper SIX with memo
!:mime application/x-dbf
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
@@ -318,12 +318,12 @@
# test and print the date of xBase .DBF .MDX
0 name xbase-date
# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
->0 ubelong x
->1 ubyte <13
->>1 ubyte >0
->>>2 ubyte >0
->>>>2 ubyte <32
->>>>>0 ubyte x
+>0 ubelong x
+>1 ubyte <13
+>>1 ubyte >0
+>>>2 ubyte >0
+>>>>2 ubyte <32
+>>>>>0 ubyte x
# YY is interpreted as 20YY or 19YY
>>>>>>0 ubyte <100 \b %.2d
# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
@@ -333,53 +333,56 @@
# dBase memo files .DBT or .FPT
# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
-16 ubyte <4
->16 ubyte !2
->>16 ubyte !1
+16 ubyte <4
+>16 ubyte !2
+>>16 ubyte !1
# next free block index is positive
->>>0 ulelong >0
+>>>0 ulelong >0
# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
->>>>17 ubelong&0xFFfdFE00 0x00000000
+>>>>17 ubelong&0xFFfdFE00 0x00000000
# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
->>>>>20 ubelong&0xFF01209B 0x00000000
+>>>>>20 ubelong&0xFF01209B 0x00000000
# dBASE III
->>>>>>16 ubyte 3
+>>>>>>16 ubyte 3
# dBASE III DBT
>>>>>>>0 use dbase3-memo-print
# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
->>>>>>16 ubyte 0
+>>>>>>16 ubyte 0
# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF
->>>>>>>20 uleshort 0
+>>>>>>>20 uleshort 0
# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
->>>>>>>>8 ulong =0
->>>>>>>>>6 ubeshort >0
+>>>>>>>>8 ulong =0
+>>>>>>>>>6 ubeshort >0
# skip emacs.PIF
->>>>>>>>>>4 ushort 0
+>>>>>>>>>>4 ushort 0
>>>>>>>>>>>0 use foxpro-memo-print
# dBASE III DBT , garbage
->>>>>>>>>6 ubeshort 0
+>>>>>>>>>6 ubeshort 0
# skip MM*DD*.bin by test for for reserved NULL byte
->>>>>>>>>>510 ubeshort 0
+>>>>>>>>>>510 ubeshort 0
# skip TK-DOS11.img image by looking for memo text
->>>>>>>>>>>512 ubelong <0xfeffff03
+>>>>>>>>>>>512 ubelong <0xfeffff03
# skip EFI executables by looking for memo text
->>>>>>>>>>>>512 ubelong >0x1F202020
->>>>>>>>>>>>>513 ubyte >0
+>>>>>>>>>>>>512 ubelong >0x1F202020
+>>>>>>>>>>>>>513 ubyte >0
# unusual dBASE III DBT like adressen.dbt
>>>>>>>>>>>>>>0 use dbase3-memo-print
# dBASE III DBT like angest.dbt, or garbage PCX DBF
->>>>>>>>8 ubelong !0
+>>>>>>>>8 ubelong !0
# skip PCX and some DBF by test for for reserved NULL bytes
->>>>>>>>>510 ubeshort 0
+>>>>>>>>>510 ubeshort 0
# skip some DBF by test of invalid version
->>>>>>>>>>0 ubyte >5
->>>>>>>>>>>0 ubyte <48
+>>>>>>>>>>0 ubyte >5
+>>>>>>>>>>>0 ubyte <48
>>>>>>>>>>>>0 use dbase3-memo-print
# dBASE IV DBT with positive block size
->>>>>>>20 uleshort >0
->>>>>>>>0 use dbase4-memo-print
+>>>>>>>20 uleshort >0
+# dBASE IV DBT with valid block length like 512, 1024
+# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
+>>>>>>>>20 uleshort&0x800f 0
+>>>>>>>>>0 use dbase4-memo-print
-# Print the information of dBase III DBT memo file
+# Print the information of dBase III DBT memo file
0 name dbase3-memo-print
>0 ubyte x dBase III DBT
# instead 3 as version number 0 for unusual examples like biblio.dbt
@@ -392,43 +395,45 @@
>20 uleshort !0 \b, block length %u
# dBase III memo field terminated by \032\032
>512 string >\0 \b, 1st item "%s"
-# Print the information of dBase IV DBT memo file
+# Print the information of dBase IV DBT memo file
0 name dbase4-memo-print
>0 lelong x dBase IV DBT
+!:mime application/x-dbt
+!:ext dbt
# 8 character shorted main name of coresponding dBASE IV DBF file
->8 ubelong >0x20000000
+>8 ubelong >0x20000000
# skip unusual like for angest.dbt
->>20 uleshort >0
+>>20 uleshort >0
>>>8 string >\0 \b of %-.8s.DBF
# value 0 implies 512 as size
#>4 ulelong =0 \b, blocks size %u
# size of blocks not reliable like 0x2020204C in angest.dbt
->4 ulelong !0
+>4 ulelong !0
>>4 ulelong&0x0000003f 0 \b, blocks size %u
# dBase IV DBT with positive block length (found 512 , 1024)
>20 uleshort >0 \b, block length %u
# next available block
#>0 lelong =0 \b, next free block index %u
>0 lelong !0 \b, next free block index %u
->20 uleshort >0
->>(20.s) ubelong x
+>20 uleshort >0
+>>(20.s) ubelong x
>>>&-4 use dbase4-memofield-print
# unusual dBase IV DBT without block length (implies 512 as length)
->20 uleshort =0
->>512 ubelong x
+>20 uleshort =0
+>>512 ubelong x
>>>&-4 use dbase4-memofield-print
-# Print the information of dBase IV memo field
+# Print the information of dBase IV memo field
0 name dbase4-memofield-print
# free dBase IV memo field
->0 ubelong !0xFFFF0800
+>0 ubelong !0xFFFF0800
>>0 lelong x \b, next free block %u
>>4 lelong x \b, next used block %u
# used dBase IV memo field
->0 ubelong =0xFFFF0800
+>0 ubelong =0xFFFF0800
# length of memo field
>>4 lelong x \b, field length %d
>>>8 string >\0 \b, 1st used item "%s"
-# Print the information of FoxPro FPT memo file
+# Print the information of FoxPro FPT memo file
0 name foxpro-memo-print
>0 belong x FoxPro FPT
# Size of blocks for FoxPro ( 64,256 )
@@ -436,14 +441,14 @@
# next available block
#>0 belong =0 \b, next free block index %u
>0 belong !0 \b, next free block index %u
-# field type ( 0~picture, 1~memo, 2~object )
+# field type ( 0~picture, 1~memo, 2~object )
>512 ubelong <3 \b, field type %u
# length of memo field
->512 ubelong 1
+>512 ubelong 1
>>516 belong >0 \b, field length %d
>>>520 string >\0 \b, 1st item "%s"
-# TODO:
+# TODO:
# DBASE index file *.NDX
# DBASE Compound Index file *.CDX
# dBASE IV Printer Driver *.PRF
@@ -455,6 +460,52 @@
4 string Standard\ ACE\ DB Microsoft Access Database
!:mime application/x-msaccess
+# From: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine
+# Reference: https://github.com/libyal/libesedb/archive/master.zip
+# libesedb-master/documentation/
+# Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
+# Note: also known as "JET Blue". Used by numerous Windows components such as
+# Windows Search, Mail, Exchange and Active Directory.
+4 ubelong 0xefcdab89
+# unknown1
+>132 ubelong 0 Extensible storage engine
+!:mime application/x-ms-ese
+# file_type 0~database 1~stream
+>>12 ulelong 0 DataBase
+# Security DataBase (sdb)
+!:ext edb/sdb
+>>12 ulelong 1 STreaMing
+!:ext stm
+# format_version 620h
+>>8 uleshort x \b, version 0x%x
+>>10 uleshort >0 revision 0x%4.4x
+>>0 ubelong x \b, checksum 0x%8.8x
+# Page size 4096 8192 32768
+>>236 ulequad x \b, page size %lld
+# database_state
+>>52 ulelong 1 \b, JustCreated
+>>52 ulelong 2 \b, DirtyShutdown
+#>>52 ulelong 3 \b, CleanShutdown
+>>52 ulelong 4 \b, BeingConverted
+>>52 ulelong 5 \b, ForceDetach
+# Windows NT major version when the databases indexes were updated.
+>>216 ulelong x \b, Windows version %d
+# Windows NT minor version
+>>220 ulelong x \b.%d
+
+# From: Joerg Jenderek
+# URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility
+# Note: files contain application compatibility fixes, application compatibility modes and application help messages.
+8 string sdbf
+>7 ubyte 0
+# TAG_TYPE_LIST+TAG_INDEXES
+>>12 uleshort 0x7802 Windows application compatibility Shim DataBase
+# version? 2 3
+#>>>0 ulelong x \b, version %d
+!:mime application/x-ms-sdb
+!:ext sdb
+
# TDB database from Samba et al - Martin Pool <mbp@samba.org>
0 string TDB\ file TDB database
>32 lelong 0x2601196D version 6, little-endian
@@ -533,9 +584,51 @@
# From: Stephane Blondon http://www.yaal.fr
# Database file for Zope (done by FileStorage)
-0 string FS21 Zope Object Database File Storage (data)
+0 string FS21 Zope Object Database File Storage v3 (data)
+0 string FS30 Zope Object Database File Storage v4 (data)
+
# Cache file for the database of Zope (done by ClientStorage)
0 string ZEC3 Zope Object Database Client Cache File (data)
# IDA (Interactive Disassembler) database
0 string IDA1 IDA (Interactive Disassembler) database
+
+# Hopper (reverse engineering tool) http://www.hopperapp.com/
+0 string hopperdb Hopper database
+
+# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)
+# Reference: http://www.provue.com/Panorama/
+# From: Joerg Jenderek
+# NOTE: test only versions 4 and 6.0 with Windows
+# length of Panorama database name
+5 ubyte >0
+# look after database name for "some" null bits
+>(5.B+7) ubelong&0xF3ffF000 0
+# look for first keyword
+>>&1 search/2 DESIGN Panorama database
+#!:mime application/x-panorama-database
+!:apple KASXZEPD
+!:ext pan
+# database name
+>>>5 pstring x \b, "%s"
+
+#
+#
+# askSam Database by Stefan A. Haubenthal <polluks@web.de>
+0 string askw40\0 askSam DB
+
+#
+#
+# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
+0 string MBSTV\040 MUIbase DB
+>6 string x version %s
+
+#
+# CDB database
+0 string NBCDB\012 NetBSD Constant Database
+>7 byte x \b, version %d
+>8 string x \b, for '%s'
+>24 lelong x \b, datasize %d
+>28 lelong x \b, entries %d
+>32 lelong x \b, index %d
+>36 lelong x \b, seed %#x
diff --git a/magic/Magdir/der b/magic/Magdir/der
new file mode 100644
index 0000000..9c25f00
--- /dev/null
+++ b/magic/Magdir/der
@@ -0,0 +1,116 @@
+#------------------------------------------------------------------------------
+# $File: der,v 1.2 2017/03/17 21:35:28 christos Exp $
+# der: file(1) magic for DER encoded files
+#
+
+# Certificate information piece
+0 name certinfo
+>0 der seq
+>>&0 der set
+>>>&0 der seq
+>>>>&0 der obj_id3=550406
+>>>>&0 der prt_str=x \b, countryName=%s
+>>&0 der set
+>>>&0 der seq
+>>>>&0 der obj_id3=550408
+>>>>&0 der utf8_str=x \b, stateOrProvinceName=%s
+>>&0 der set
+>>>&0 der seq
+>>>>&0 der obj_id3=55040a
+>>>>&0 der utf8_str=x \b, organizationName=%s
+>>&0 der set
+>>>&0 der seq
+>>>>&0 der obj_id3=550403
+>>>>&0 der utf8_str=x \b, commonName=%s
+>>&0 der seq
+
+# Certificate requests
+0 der seq
+>&0 der seq
+>>&0 der int1=00 DER Encoded Certificate request
+>>&0 use certinfo
+
+# Key Pairs
+0 der seq
+>&0 der int1=00
+>&0 der int65=x
+>&0 der int3=010001 DER Encoded Key Pair, 512 bits
+
+0 der seq
+>&0 der int1=00
+>&0 der int129=x
+>&0 der int3=010001 DER Encoded Key Pair, 1024 bits
+
+0 der seq
+>&0 der int1=00
+>&0 der int257=x
+>&0 der int3=010001 DER Encoded Key Pair, 2048 bits
+
+0 der seq
+>&0 der int1=00
+>&0 der int513=x
+>&0 der int3=010001 DER Encoded Key Pair, 4096 bits
+
+0 der seq
+>&0 der int1=00
+>&0 der int1025=x
+>&0 der int3=010001 DER Encoded Key Pair, 8192 bits
+
+0 der seq
+>&0 der int1=00
+>&0 der int2049=x
+>&0 der int3=010001 DER Encoded Key Pair, 16k bits
+
+0 der seq
+>&0 der int1=00
+>&0 der int4097=x
+>&0 der int3=010001 DER Encoded Key Pair, 32k bits
+
+# Certificates
+0 der seq
+>&0 der seq
+>>&0 der int2=0dfa DER Encoded Certificate, 512 bits
+>>&0 der int2=0dfb DER Encoded Certificate, 1024 bits
+>>&0 der int2=0dfc DER Encoded Certificate, 2048 bits
+>>&0 der int2=0dfd DER Encoded Certificate, 4096 bits
+>>&0 der int2=0dfe DER Encoded Certificate, 8192 bits
+>>&0 der int2=0dff DER Encoded Certificate, 16k bits
+>>&0 der int2=0e04 DER Encoded Certificate, 32k bits
+>>&0 der int2=x DER Encoded Certificate, ? bits (%s)
+>>&0 der seq
+>>>&0 der obj_id9=2a864886f70d010105 \b, sha1WithRSAEncryption
+>>>&0 der obj_id9=x \b, ? Encryption (%s)
+>>>&0 der null
+>>&0 der seq
+>>>&0 der set
+>>>>&0 der seq
+>>>>>&0 der obj_id3=550406
+>>>>>&0 der prt_str=x \b, countryName=%s
+>>>&0 der set
+>>>>&0 der seq
+>>>>>&0 der obj_id3=550408
+>>>>>&0 der prt_str=x \b, stateOrProvinceName=%s
+>>>&0 der set
+>>>>&0 der seq
+>>>>>&0 der obj_id3=550407
+>>>>>&0 der prt_str=x \b, localityName=%s
+>>>&0 der set
+>>>>&0 der seq
+>>>>>&0 der obj_id3=55040a
+>>>>>&0 der prt_str=x \b, organizationName=%s
+>>>&0 der set
+>>>>&0 der seq
+>>>>>&0 der obj_id3=55040b
+>>>>>&0 der prt_str=x \b, organizationUnitName=%s
+>>>&0 der set
+>>>>&0 der seq
+>>>>>&0 der obj_id3=550403
+>>>>>&0 der prt_str=x \b, commonName=%s
+>>>&0 der set
+>>>>&0 der seq
+>>>>>&0 der obj_id9=2a864886f70d010901
+>>>>>&0 der ia5_str=x \b, emailAddress=%s
+>>&0 der seq
+>>>&0 der utc_time=x \b, utcTime=%s
+>>>&0 der utc_time=x \b, utcTime=%s
+>>&0 use certinfo
diff --git a/magic/Magdir/diff b/magic/Magdir/diff
index 5924380..cd530d3 100644
--- a/magic/Magdir/diff
+++ b/magic/Magdir/diff
@@ -1,15 +1,15 @@
#------------------------------------------------------------------------------
-# $File: diff,v 1.14 2012/09/16 23:08:54 christos Exp $
+# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $
# diff: file(1) magic for diff(1) output
#
-0 search/1 diff\ diff output text
+0 search/1 diff\040 diff output text
!:mime text/x-diff
-0 search/1 ***\ diff output text
+0 search/1 ***\040 diff output text
!:mime text/x-diff
-0 search/1 Only\ in\ diff output text
+0 search/1 Only\040in\040 diff output text
!:mime text/x-diff
-0 search/1 Common\ subdirectories:\ diff output text
+0 search/1 Common\040subdirectories:\040 diff output text
!:mime text/x-diff
0 search/1 Index: RCS/CVS diff output text
@@ -20,9 +20,9 @@
# unified diff
-0 search/4096 ---\
+0 search/4096 ---\040
>&0 search/1024 \n
->>&0 search/1 +++\
+>>&0 search/1 +++\040
>>>&0 search/1024 \n
>>>>&0 search/1 @@ unified diff output text
!:mime text/x-diff
diff --git a/magic/Magdir/dolby b/magic/Magdir/dolby
index 573398f..8034edd 100644
--- a/magic/Magdir/dolby
+++ b/magic/Magdir/dolby
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: dolby,v 1.7 2014/01/08 22:37:23 christos Exp $
+# $File: dolby,v 1.8 2017/03/17 21:35:28 christos Exp $
# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
# from http://www.atsc.org/standards/a_52a.pdf
# corrections, additions, etc. are always welcome!
@@ -23,7 +23,7 @@
>5 byte&0x07 = 0x04 \b, dialogue (D)
>5 byte&0x07 = 0x05 \b, commentary (C)
>5 byte&0x07 = 0x06 \b, emergency (E)
->5 beshort&0x07e0 0x0720 \b, voiceover (VO)
+>5 beshort&0x07e0 0x0720 \b, voiceover (VO)
>5 beshort&0x07e0 >0x0720 \b, karaoke
# acmod
>6 byte&0xe0 = 0x00 1+1 front,
diff --git a/magic/Magdir/dump b/magic/Magdir/dump
index 1a20ace..73de3dc 100644
--- a/magic/Magdir/dump
+++ b/magic/Magdir/dump
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: dump,v 1.13 2014/04/30 21:41:02 christos Exp $
+# $File: dump,v 1.16 2017/07/22 19:21:02 christos Exp $
# dump: file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
@@ -62,23 +62,25 @@
>824 string >\0 Host %s,
>888 belong >0 Flags %x
-24 belong 60012 new-fs dump file (big endian),
+24 belong 60012 new-fs dump file (big endian),
>0 use new-dump-be
-24 belong 60011 old-fs dump file (big endian),
+24 belong 60011 old-fs dump file (big endian),
>0 use old-dump-be
-24 lelong 60012 new-fs dump file (little endian),
+24 lelong 60012 new-fs dump file (little endian),
+# to correctly recognize '*.mo' GNU message catalog (little endian)
+!:strength - 15
>0 use \^new-dump-be
-24 lelong 60011 old-fs dump file (little endian),
+24 lelong 60011 old-fs dump file (little endian),
>0 use \^old-dump-be
-24 belong 0x19540119 new-fs dump file (ufs2, big endian),
+24 belong 0x19540119 new-fs dump file (ufs2, big endian),
>0 use ufs2-dump-be
-24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
+24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
>0 use \^ufs2-dump-be
18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
diff --git a/magic/Magdir/dyadic b/magic/Magdir/dyadic
index 18f18bc..185970e 100644
--- a/magic/Magdir/dyadic
+++ b/magic/Magdir/dyadic
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: dyadic,v 1.6 2014/06/01 19:14:42 christos Exp $
+# $File: dyadic,v 1.8 2017/03/17 21:35:28 christos Exp $
# Dyadic: file(1) magic for Dyalog APL.
#
# updated by Joerg Jenderek at Oct 2013
@@ -10,9 +10,9 @@
# .DIN Dyalog APL Input Table
# .DOT Dyalog APL Output Table
# .DFT Dyalog APL Format File
-0 ubeshort&0xFF60 0xaa00
+0 ubeshort&0xFF60 0xaa00
# skip biblio.dbt
->1 byte !4
+>1 byte !4
# real Dyalog APL have non zero version numbers like 7.3 or 13.4
>>2 ubeshort >0x0000 Dyalog APL
>>>1 byte 0x00 aplcore
@@ -46,6 +46,11 @@
>>>1 byte 0x12 component file 64-bit level 3 journaled checksummed
>>>1 byte 0x13 component file 32-bit non-journaled checksummed
>>>1 byte 0x14 component file 64-bit non-journaled checksummed
+>>>1 byte 0x15 component file under construction
+>>>1 byte 0x16 DFS component file 64-bit level 1 journaled checksummed
+>>>1 byte 0x17 DFS component file 64-bit level 2 journaled checksummed
+>>>1 byte 0x18 DFS component file 64-bit level 3 journaled checksummed
+>>>1 byte 0x19 external workspace
>>>1 byte 0x80 DDB
>>>2 byte x version %d
>>>3 byte x \b.%d
diff --git a/magic/Magdir/editors b/magic/Magdir/editors
index 4c5b8a6..78f3a84 100644
--- a/magic/Magdir/editors
+++ b/magic/Magdir/editors
@@ -1,7 +1,7 @@
#------------------------------------------------------------------------------
-# $File: editors,v 1.8 2009/09/19 16:28:09 christos Exp $
-# T602 editor documents
+# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $
+# T602 editor documents
# by David Necas <yeti@physics.muni.cz>
0 string @CT\ T602 document data,
>4 string 0 Kamenicky
@@ -9,10 +9,31 @@
>4 string 2 KOI8-CS
>4 string >2 unknown encoding
-# Vi IMproved Encrypted file
+# Vi IMproved Encrypted file
# by David Necas <yeti@physics.muni.cz>
0 string VimCrypt~ Vim encrypted file data
+
+0 name vimnanoswap
+>67 byte 0
+>>107 byte 0
+#>>>2 string x %s swap file
+>>>24 ulelong x \b, pid %d
+>>>28 string >\0 \b, user %s
+>>>68 string >\0 \b, host %s
+>>>108 string >\0 \b, file %s
+>>>1007 byte 0x55 \b, modified
+
# Vi IMproved Swap file
# by Sven Wegener <swegener@gentoo.org>
-0 string b0VIM\ Vim swap file
->&0 string >\0 \b, version %s
+0 string b0VIM\ Vim swap file
+>&0 string >\0 \b, version %s
+>0 use vimnanoswap
+
+
+# Lock/swap file for several editors, at least
+# Vi IMproved and nano
+0 string b0nano Nano swap file
+>0 use vimnanoswap
+
+# kate (K Advanced Text Editor)
+0 string \x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00 Kate swap file
diff --git a/magic/Magdir/elf b/magic/Magdir/elf
index 04ee37e..0e0e6dc 100644
--- a/magic/Magdir/elf
+++ b/magic/Magdir/elf
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: elf,v 1.68 2014/09/19 19:05:57 christos Exp $
+# $File: elf,v 1.70 2016/06/02 12:36:30 christos Exp $
# elf: file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
@@ -15,6 +15,32 @@
# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
+0 name elf-mips
+>0 lelong&0xf0000000 0x00000000 MIPS-I
+>0 lelong&0xf0000000 0x10000000 MIPS-II
+>0 lelong&0xf0000000 0x20000000 MIPS-III
+>0 lelong&0xf0000000 0x30000000 MIPS-IV
+>0 lelong&0xf0000000 0x40000000 MIPS-V
+>0 lelong&0xf0000000 0x50000000 MIPS32
+>0 lelong&0xf0000000 0x60000000 MIPS64
+>0 lelong&0xf0000000 0x70000000 MIPS32 rel2
+>0 lelong&0xf0000000 0x80000000 MIPS64 rel2
+>0 lelong&0xf0000000 0x90000000 MIPS32 rel6
+>0 lelong&0xf0000000 0xa0000000 MIPS64 rel6
+
+0 name elf-sparc
+>0 lelong&0x00ffff00 0x00000100 V8+ Required,
+>0 lelong&0x00ffff00 0x00000200 Sun UltraSPARC1 Extensions Required,
+>0 lelong&0x00ffff00 0x00000400 HaL R1 Extensions Required,
+>0 lelong&0x00ffff00 0x00000800 Sun UltraSPARC3 Extensions Required,
+>0 lelong&0x3 0 total store ordering,
+>0 lelong&0x3 1 partial store ordering,
+>0 lelong&0x3 2 relaxed memory ordering,
+
+0 name elf-pa-risc
+>2 leshort 0x0214 2.0
+>0 leshort &0x0008 (LP64)
+
0 name elf-le
>16 leshort 0 no file type,
!:mime application/octet-stream
@@ -55,47 +81,26 @@
>18 leshort 8
# only for 32-bit
>>4 byte 1
->>>36 lelong&0xf0000000 0x00000000 MIPS-I
->>>36 lelong&0xf0000000 0x10000000 MIPS-II
->>>36 lelong&0xf0000000 0x20000000 MIPS-III
->>>36 lelong&0xf0000000 0x30000000 MIPS-IV
->>>36 lelong&0xf0000000 0x40000000 MIPS-V
->>>36 lelong&0xf0000000 0x50000000 MIPS32
->>>36 lelong&0xf0000000 0x60000000 MIPS64
->>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2
->>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2
+>>>36 use elf-mips
# only for 64-bit
>>4 byte 2
->>>48 lelong&0xf0000000 0x00000000 MIPS-I
->>>48 lelong&0xf0000000 0x10000000 MIPS-II
->>>48 lelong&0xf0000000 0x20000000 MIPS-III
->>>48 lelong&0xf0000000 0x30000000 MIPS-IV
->>>48 lelong&0xf0000000 0x40000000 MIPS-V
->>>48 lelong&0xf0000000 0x50000000 MIPS32
->>>48 lelong&0xf0000000 0x60000000 MIPS64
->>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2
->>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2
+>>>48 use elf-mips
>18 leshort 9 Amdahl,
>18 leshort 10 MIPS (deprecated),
>18 leshort 11 RS6000,
>18 leshort 15 PA-RISC,
# only for 32-bit
>>4 byte 1
->>>38 leshort 0x0214 2.0
->>>36 leshort &0x0008 (LP64)
+>>>36 use elf-pa-risc
# only for 64-bit
>>4 byte 2
->>>50 leshort 0x0214 2.0
->>>48 leshort &0x0008 (LP64)
+>>>48 use elf-pa-risc
>18 leshort 16 nCUBE,
>18 leshort 17 Fujitsu VPP500,
>18 leshort 18 SPARC32PLUS,
# only for 32-bit
>>4 byte 1
->>>36 lelong&0xffff00 0x000100 V8+ Required,
->>>36 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
->>>36 lelong&0xffff00 0x000400 HaL R1 Extensions Required,
->>>36 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
+>>>36 use elf-sparc
>18 leshort 19 Intel 80960,
>18 leshort 20 PowerPC or cisco 4500,
>18 leshort 21 64-bit PowerPC or cisco 7500,
@@ -117,12 +122,7 @@
>18 leshort 42 Renesas SH,
>18 leshort 43 SPARC V9,
>>4 byte 2
->>>48 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
->>>48 lelong&0xffff00 0x000400 HaL R1 Extensions Required,
->>>48 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
->>>48 lelong&0x3 0 total store ordering,
->>>48 lelong&0x3 1 partial store ordering,
->>>48 lelong&0x3 2 relaxed memory ordering,
+>>>48 use elf-sparc
>18 leshort 44 Siemens Tricore Embedded Processor,
>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
>18 leshort 46 Renesas H8/300,
@@ -301,25 +301,23 @@
>>0 use elf-le
>5 byte 2 MSB
>>0 use \^elf-le
-# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
-# like proper ELF, but extracting the string had bad results.
->4 byte <0x80
->>8 string >\0 (%s)
->8 string \0
->>7 byte 0 (SYSV)
->>7 byte 1 (HP-UX)
->>7 byte 2 (NetBSD)
->>7 byte 3 (GNU/Linux)
->>7 byte 4 (GNU/Hurd)
->>7 byte 5 (86Open)
->>7 byte 6 (Solaris)
->>7 byte 7 (Monterey)
->>7 byte 8 (IRIX)
->>7 byte 9 (FreeBSD)
->>7 byte 10 (Tru64)
->>7 byte 11 (Novell Modesto)
->>7 byte 12 (OpenBSD)
->8 string \2
->>7 byte 13 (OpenVMS)
->>7 byte 97 (ARM)
->>7 byte 255 (embedded)
+>7 byte 0 (SYSV)
+>7 byte 1 (HP-UX)
+>7 byte 2 (NetBSD)
+>7 byte 3 (GNU/Linux)
+>7 byte 4 (GNU/Hurd)
+>7 byte 5 (86Open)
+>7 byte 6 (Solaris)
+>7 byte 7 (Monterey)
+>7 byte 8 (IRIX)
+>7 byte 9 (FreeBSD)
+>7 byte 10 (Tru64)
+>7 byte 11 (Novell Modesto)
+>7 byte 12 (OpenBSD)
+>7 byte 13 (OpenVMS)
+>7 byte 14 (HP NonStop Kernel)
+>7 byte 15 (AROS Research Operating System)
+>7 byte 16 (FenixOS)
+>7 byte 17 (Nuxi CloudABI)
+>7 byte 97 (ARM)
+>7 byte 255 (embedded)
diff --git a/magic/Magdir/filesystems b/magic/Magdir/filesystems
index 939a092..48b74e0 100644
--- a/magic/Magdir/filesystems
+++ b/magic/Magdir/filesystems
@@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
-# $File: filesystems,v 1.108 2015/01/01 17:43:47 christos Exp $
+# $File: filesystems,v 1.122 2017/07/21 10:34:41 christos Exp $
# filesystems: file(1) magic for different filesystems
#
-0 name partid
+0 name partid
>0 ubyte 0x00 Unused
>0 ubyte 0x01 12-bit FAT
>0 ubyte 0x02 XENIX /
@@ -187,7 +187,7 @@
0 string \366\366\366\366 PC formatted floppy with no filesystem
# Sun disk labels
# From /usr/include/sun/dklabel.h:
-0774 beshort 0xdabe
+0774 beshort 0xdabe
# modified by Joerg Jenderek, because original test
# succeeds for Cabinet archive dao360.dl_ with negative blocks
>0770 long >0 Sun disk label
@@ -213,50 +213,50 @@
# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
0 string SBMBAKUP_ Smart Boot Manager backup file
>9 string x \b, version %-5.5s
->>14 string =_
+>>14 string =_
>>>15 string x %-.1s
>>>>16 string =_ \b.
>>>>>17 string x \b%-.1s
>>>>>>18 string =_ \b.
>>>>>>>19 string x \b%-.1s
->>>22 ubyte 0
+>>>22 ubyte 0
>>>>21 ubyte x \b, from drive 0x%x
->>>22 ubyte >0
+>>>22 ubyte >0
>>>>21 string x \b, from drive %s
->>>535 search/17 \x55\xAA
->>>>&-512 indirect x \b; contains
+>>>535 search/17 \x55\xAA
+>>>>&-512 indirect x \b; contains
# updated by Joerg Jenderek at Nov 2012
# DOS Emulator image is 128 byte, null right padded header + harddisc image
-0 string DOSEMU\0
->0x27E leshort 0xAA55
+0 string DOSEMU\0
+>0x27E leshort 0xAA55
#offset is 128
->>19 ubyte 128
+>>19 ubyte 128
>>>(19.b-1) ubyte 0x0 DOS Emulator image
>>>>7 ulelong >0 \b, %u heads
>>>>11 ulelong >0 \b, %d sectors/track
>>>>15 ulelong >0 \b, %d cylinders
->>>>128 indirect x \b; contains
+>>>>128 indirect x \b; contains
# added by Joerg Jenderek at Nov 2012
# http://www.thenakedpc.com/articles/v04/08/0408-05.html
# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
0 string PNCIHISK\0 Norton Utilities disc image data
# real x86 boot sector with jump instruction
->509 search/1026 \x55\xAA\xeb
->>&-1 indirect x \b; contains
+>509 search/1026 \x55\xAA\xeb
+>>&-1 indirect x \b; contains
# http://file-extension.net/seeker/file_extension_dat
0 string PNCIUNDO Norton Disk Doctor UnDo file
#
# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
# for any allowed sector sizes
-30 search/481 \x55\xAA
+30 search/481 \x55\xAA
# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
# DOS BPB information (70) and after DOS floppy (120) like in previous file version
!:strength +65
# for sector sizes < 512 Bytes
->11 uleshort <512
+>11 uleshort <512
>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector
# for sector sizes with 512 or more Bytes
>0x1FE leshort 0xAA55 DOS/MBR boot sector
@@ -270,18 +270,18 @@
>2 string OSBS OS/BS MBR
# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
# and http://en.wikipedia.org/wiki/Master_Boot_Record
-# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
+# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR
# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
->>8 ubequad 0x8bf45007501ffbfc
+>>8 ubequad 0x8bf45007501ffbfc
# http://thestarman.pcministry.com/asm/mbr/200MBR.htm
>>>0x16 ubyte 0xF3 \b,DOS 2
>>>>219 regex Author\ -\ Author:
# found "David Litton" , "A Pehrsson "
>>>>>&0 string x "%s"
->>>0x16 ubyte 0xF2
+>>>0x16 ubyte 0xF2
# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3
@@ -316,7 +316,7 @@
>>>>>>(0x79.b) string >\0 "%s"
# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b
->>8 ubequad 0x5007501ffcbe1b7c
+>>8 ubequad 0x5007501ffcbe1b7c
# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
>>>24 ubequad 0xf3a4cbbebe07b104 9M
# "Invalid partition table" nn=0x10F for english version
@@ -361,7 +361,7 @@
>>>>(0x1b7.b+0x100) string >\0 "%s"
# Microsoft Windows Vista or 7
# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
->>8 ubequad 0xc08ed8be007cbf00
+>>8 ubequad 0xc08ed8be007cbf00
# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
# assembler instructions: jnz 0729;cmp ebx,"TCPA"
>>>0xEC ubequad 0x753b6681fb544350 Vista
@@ -402,38 +402,38 @@
# http://en.wikipedia.org/wiki/MBR_disk_signature#ID
>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x
# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm
->>0xDA uleshort 0
+>>0xDA uleshort 0
>>>0xDC ulelong >0 \b, created
# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
>>>>0xDC ubyte x with driveID 0x%x
-# hours, minutes and seconds
+# hours, minutes and seconds
>>>>0xDf ubyte x at %x
>>>>0xDe ubyte x \b:%x
>>>>0xDd ubyte x \b:%x
# special case for Microsoft MS-DOS 3.21 spanish
-# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
->0 ubequad 0xfab830008ed0bc00
-# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
+# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
+>0 ubequad 0xfab830008ed0bc00
+# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish
# Microsoft MBR IPL end
# dr-dos with some upper-, lowercase variants
->0x9D string Invalid\ partition\ table$
->>181 string No\ Operating\ System$
+>0x9D string Invalid\ partition\ table$
+>>181 string No\ Operating\ System$
>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
->0x9D string Invalid\ partition\ table$
->>181 string No\ operating\ system$
+>0x9D string Invalid\ partition\ table$
+>>181 string No\ operating\ system$
>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
->342 string Invalid\ partition\ table$
->>366 string No\ operating\ system$
+>342 string Invalid\ partition\ table$
+>>366 string No\ operating\ system$
>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
->295 string NEWLDR\0
->>302 string Bad\ PT\ $
->>>310 string No\ OS\ $
->>>>317 string OS\ load\ err$
->>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
->>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
->>>>>>>387 string Copyright\ (c)\ 1984,1998
+>295 string NEWLDR\0
+>>302 string Bad\ PT\ $
+>>>310 string No\ OS\ $
+>>>>317 string OS\ load\ err$
+>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
+>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
+>>>>>>>387 string Copyright\ (c)\ 1984,1998
>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
#
# tests for different MS-DOS Master Boot Records (MBR) moved and merged
@@ -441,15 +441,15 @@
#>0x145 string Default:\ F \b, FREE-DOS MBR
#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR
>0x145 search/7 Default:\ F \b, FREE-DOS MBR
-#>>313 string F0\ .\ .\ .
-#>>>322 string disk\ 1
-#>>>>382 string FAT3
->64 string no\ active\ partition\ found
+#>>313 string F0\ .\ .\ .
+#>>>322 string disk\ 1
+#>>>>382 string FAT3
+>64 string no\ active\ partition\ found
>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
# Ranish Partition Manager http://www.ranish.com/part/
->387 search/4 \0\ Error!\r
->>378 search/7 Virus!
->>>397 search/4 Booting\
+>387 search/4 \0\ Error!\r
+>>378 search/7 Virus!
+>>>397 search/4 Booting\040
>>>>408 search/4 HD1/\0 \b, Ranish MBR (
>>>>>416 string Writing\ changes... \b2.37
>>>>>>438 ubyte x \b,0x%x dots
@@ -466,23 +466,23 @@
#
# SYSLINUX MBR moved
# http://www.acronis.de/
->362 string MBR\ Error\ \0\r
->>376 string ress\ any\ key\ to\
+>362 string MBR\ Error\ \0\r
+>>376 string ress\ any\ key\ to\040
>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
# added by Joerg Jenderek
# http://www.visopsys.org/
# http://partitionlogic.org.uk/
->309 string No\ bootable\ partition\ found\r
+>309 string No\ bootable\ partition\ found\r
>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
->349 string No\ bootable\ partition\ found\r
+>349 string No\ bootable\ partition\ found\r
>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
# bootloader, bootmanager
->0x40 string SBML
+>0x40 string SBML
# label with 11 characters of FAT 12 bit filesystem
->>43 string SMART\ BTMGR
+>>43 string SMART\ BTMGR
>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager
# OEM-ID not always "SBM"
-#>>>>3 strings SBM
+#>>>>3 strings SBM
>>>>6 string >\0 \b, version %s
>382 string XOSLLOADXCF \b, eXtended Operating System Loader
>6 string LILO \b, LInux i386 boot LOader
@@ -492,11 +492,11 @@
# variables according to grub-0.97/stage1/stage1.S or
# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
# usual values are marked with comments to get only informations of strange GRUB loaders
->342 search/60 \0Geom\0
+>342 search/60 \0Geom\0
#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0
->>0x41 ubyte <2
+>>0x41 ubyte <2
>>>0x3E ubyte >2 \b; GRand Unified Bootloader
-# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
+# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
>>>>0x3E ubyte x \b, stage1 version 0x%x
#If it is 0xFF, use a drive passed by BIOS
>>>>0x40 ubyte <0xFF \b, boot drive 0x%x
@@ -521,499 +521,497 @@
>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
>>>>>385 string GRUB\ \0 \b, GRUB version 0.97
# unknown version
->>>343 string Geom\0Read\0\ Error\0
+>>>343 string Geom\0Read\0\ Error\0
>>>>321 string Loading\ stage1.5 \b, GRUB version x.y
>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
>>>>374 string GRUB\ \0 \b, GRUB version n.m
# SYSLINUX bootloader moved
>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
# http://www.bcdwb.de/bcdw/index_e.htm
->3 string BCDL
+>3 string BCDL
>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
# mbr partition table entries updated by Joerg Jenderek at Sep 2013
# skip Norton Utilities disc image data
->3 string !IHISK
+>3 string !IHISK
# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
->>0 belong !0xb8c0078e
-# not Linux kernel
->>>514 string !HdrS
+>>0 belong !0xb8c0078e
+# not Linux kernel
+>>>514 string !HdrS
# not BeOS
->>>>422 string !Be\ Boot\ Loader
->>>>>32769 string CD001
->>>>>>0 use cdrom
-# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
->>>>>0 ubelong&0xFD000000 =0xE9000000
+>>>>422 string !Be\ Boot\ Loader
+# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
+>>>>>0 ubelong&0xFD000000 =0xE9000000
# AdvanceMAME mbr
->>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e
+>>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e
>>>>>>>446 use partition-table
# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
->>>>>0 ubelong&0xFD000000 !0xE9000000
+>>>>>0 ubelong&0xFD000000 !0xE9000000
# skip FSInfosector
->>>>>>0 string !RRaA
+>>>>>>0 string !RRaA
# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
->>>>>>>0 ubequad !0xfa660fb64610668b
+>>>>>>>0 ubequad !0xfa660fb64610668b
# skip 13rd sector of MS x86 bootloader
->>>>>>>>0 ubequad !0x660fb64610668b4e
+>>>>>>>>0 ubequad !0x660fb64610668b4e
# skip sector starting with DOS new line
->>>>>>>>>0 string !\r\n
+>>>>>>>>>0 string !\r\n
# allowed active flag 0,80h-FFh
->>>>>>>>>>446 ubyte 0
+>>>>>>>>>>446 ubyte 0
>>>>>>>>>>>446 use partition-table
->>>>>>>>>>446 ubyte >0x7F
+>>>>>>>>>>446 ubyte >0x7F
>>>>>>>>>>>446 use partition-table
# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
# mbr partition table entries end
# http://www.acronis.de/
#FAT label=ACRONIS\ SZ
#OEM-ID=BOOTWIZ0
->442 string Non-system\ disk,\
+>442 string Non-system\ disk,\040
>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
# updated by Joerg Jenderek at Nov 2012, Sep 2013
# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
# display 1 space
->>>447 ubyte x \b
+>>>447 ubyte x \b
>>>477 use DOS-filename
#
->185 string FDBOOT\ Version\
->>204 string \rNo\ Systemdisk.\
->>>220 string Booting\ from\ harddisk.\n\r
->>>245 string Cannot\ load\ from\ harddisk.\n\r
->>>>273 string Insert\ Systemdisk\
+>185 string FDBOOT\ Version\040
+>>204 string \rNo\ Systemdisk.\040
+>>>220 string Booting\ from\ harddisk.\n\r
+>>>245 string Cannot\ load\ from\ harddisk.\n\r
+>>>>273 string Insert\ Systemdisk\040
>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
>>>>>>200 string >\0 \b, version %-3s
->242 string Bootsector\ from\ C.H.\ Hochst\204
+>242 string Bootsector\ from\ C.H.\ Hochst\204
# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c
# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
->242 search/127 Bootsector\ from\ C.H.\ Hochst
->>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk
+>242 search/127 Bootsector\ from\ C.H.\ Hochst
+>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk
# followed by variants with point,CR-NL or NL-CR
->>>208 search/261 Cannot\ load\ from\ harddisk.
+>>>208 search/261 Cannot\ load\ from\ harddisk.
# followed by variants CR-NL or NL-CR
->>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key.
+>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key.
# followed by variants with point,CR-NL or NL-CR
>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader
# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
>>>>>>&0 string x \b, version %-4.4s
->(1.b+2) ubyte 0xe
->>(1.b+3) ubyte 0x1f
->>>(1.b+4) ubyte 0xbe
+>(1.b+2) ubyte 0xe
+>>(1.b+3) ubyte 0x1f
+>>>(1.b+4) ubyte 0xbe
# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
->>>>(1.b+5) ubyte&0xd3 0x53
->>>>>(1.b+6) ubyte 0x7c
+>>>>(1.b+5) ubyte&0xd3 0x53
+>>>>>(1.b+6) ubyte 0x7c
# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
->>>>>>(1.b+7) ubyte 0xac
->>>>>>>(1.b+8) ubyte 0x22
->>>>>>>>(1.b+9) ubyte 0xc0
->>>>>>>>>(1.b+10) ubyte 0x74
->>>>>>>>>>(1.b+11) ubyte 0x0b
->>>>>>>>>>>(1.b+12) ubyte 0x56
+>>>>>>(1.b+7) ubyte 0xac
+>>>>>>>(1.b+8) ubyte 0x22
+>>>>>>>>(1.b+9) ubyte 0xc0
+>>>>>>>>>(1.b+10) ubyte 0x74
+>>>>>>>>>>(1.b+11) ubyte 0x0b
+>>>>>>>>>>>(1.b+12) ubyte 0x56
>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
# FAT1X version
->>>>>>>>>>>>>(1.b+5) ubyte 0x5b
+>>>>>>>>>>>>>(1.b+5) ubyte 0x5b
>>>>>>>>>>>>>>0x5b string >\0 "%-s"
# FAT32 version
->>>>>>>>>>>>>(1.b+5) ubyte 0x77
+>>>>>>>>>>>>>(1.b+5) ubyte 0x77
>>>>>>>>>>>>>>0x77 string >\0 "%-s"
>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display
-#>>244 string from\ dosemu-freedos-*-bin.tgz\r
-#>>>170 string Sorry,\ could\ not\ load\ an\
-#>>>>195 string operating\ system.\r\n
+#>>244 string from\ dosemu-freedos-*-bin.tgz\r
+#>>>170 string Sorry,\ could\ not\ load\ an\040
+#>>>>195 string operating\ system.\r\n
#
->103 string This\ is\ not\ a\ bootable\ disk.\
->>132 string Please\ insert\ a\ bootable\
->>>157 string floppy\ and\r\n
+>103 string This\ is\ not\ a\ bootable\ disk.\040
+>>132 string Please\ insert\ a\ bootable\040
+>>>157 string floppy\ and\r\n
>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
#
->66 string Solaris\ Boot\ Sector
->>99 string Incomplete\ MDBoot\ load.
+>66 string Solaris\ Boot\ Sector
+>>99 string Incomplete\ MDBoot\ load.
>>>89 string Version \b, Sun Solaris Bootloader
>>>>97 byte x version %c
#
->408 string OS/2\ !!\ SYS01475\r\0
->>429 string OS/2\ !!\ SYS02025\r\0
->>>450 string OS/2\ !!\ SYS02027\r\0
+>408 string OS/2\ !!\ SYS01475\r\0
+>>429 string OS/2\ !!\ SYS02025\r\0
+>>>450 string OS/2\ !!\ SYS02027\r\0
>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
#
->409 string OS/2\ !!\ SYS01475\r\0
->>430 string OS/2\ !!\ SYS02025\r\0
->>>451 string OS/2\ !!\ SYS02027\r\0
+>409 string OS/2\ !!\ SYS01475\r\0
+>>430 string OS/2\ !!\ SYS02025\r\0
+>>>451 string OS/2\ !!\ SYS02027\r\0
>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
->112 string This\ disk\ is\ not\ bootable\r
->>142 string If\ you\ wish\ to\ make\ it\ bootable
->>>176 string run\ the\ DOS\ program\ SYS\
->>>200 string after\ the\r
->>>>216 string system\ has\ been\ loaded\r\n
->>>>>242 string Please\ insert\ a\ DOS\ diskette\
->>>>>271 string into\r\n\ the\ drive\ and\
+>112 string This\ disk\ is\ not\ bootable\r
+>>142 string If\ you\ wish\ to\ make\ it\ bootable
+>>>176 string run\ the\ DOS\ program\ SYS\040
+>>>200 string after\ the\r
+>>>>216 string system\ has\ been\ loaded\r\n
+>>>>>242 string Please\ insert\ a\ DOS\ diskette\040
+>>>>>271 string into\r\n\ the\ drive\ and\040
>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
# XP
->430 string NTLDR\ is\ missing\xFF\r\n
->>449 string Disk\ error\xFF\r\n
+>430 string NTLDR\ is\ missing\xFF\r\n
+>>449 string Disk\ error\xFF\r\n
>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
->>>>417 ubyte&0xDF >0
+>>>>417 ubyte&0xDF >0
>>>>>417 string x %-.5s
->>>>>>422 ubyte&0xDF >0
+>>>>>>422 ubyte&0xDF >0
>>>>>>>422 string x \b%-.3s
->>>>>425 ubyte&0xDF >0
+>>>>>425 ubyte&0xDF >0
>>>>>>425 string >\ \b.%-.3s
#
->>>>371 ubyte >0x20
->>>>>368 ubyte&0xDF >0
+>>>>371 ubyte >0x20
+>>>>>368 ubyte&0xDF >0
>>>>>>368 string x %-.5s
->>>>>>>373 ubyte&0xDF >0
+>>>>>>>373 ubyte&0xDF >0
>>>>>>>>373 string x \b%-.3s
->>>>>>376 ubyte&0xDF >0
+>>>>>>376 ubyte&0xDF >0
>>>>>>>376 string x \b.%-.3s
#
->430 string NTLDR\ nicht\ gefunden\xFF\r\n
->>453 string Datentr\204gerfehler\xFF\r\n
+>430 string NTLDR\ nicht\ gefunden\xFF\r\n
+>>453 string Datentr\204gerfehler\xFF\r\n
>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
->>>>417 ubyte&0xDF >0
+>>>>417 ubyte&0xDF >0
>>>>>417 string x %-.5s
->>>>>>422 ubyte&0xDF >0
+>>>>>>422 ubyte&0xDF >0
>>>>>>>422 string x \b%-.3s
->>>>>425 ubyte&0xDF >0
+>>>>>425 ubyte&0xDF >0
>>>>>>425 string >\ \b.%-.3s
# offset variant
->>>>379 string \0
->>>>>368 ubyte&0xDF >0
+>>>>379 string \0
+>>>>>368 ubyte&0xDF >0
>>>>>>368 string x %-.5s
->>>>>>>373 ubyte&0xDF >0
+>>>>>>>373 ubyte&0xDF >0
>>>>>>>>373 string x \b%-.3s
#
->430 string NTLDR\ fehlt\xFF\r\n
->>444 string Datentr\204gerfehler\xFF\r\n
+>430 string NTLDR\ fehlt\xFF\r\n
+>>444 string Datentr\204gerfehler\xFF\r\n
>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
->>>>417 ubyte&0xDF >0
+>>>>417 ubyte&0xDF >0
>>>>>417 string x %-.5s
->>>>>>422 ubyte&0xDF >0
+>>>>>>422 ubyte&0xDF >0
>>>>>>>422 string x \b%-.3s
->>>>>425 ubyte&0xDF >0
+>>>>>425 ubyte&0xDF >0
>>>>>>425 string >\ \b.%-.3s
# variant
->>>>371 ubyte >0x20
->>>>>368 ubyte&0xDF >0
+>>>>371 ubyte >0x20
+>>>>>368 ubyte&0xDF >0
>>>>>>368 string x %-.5s
->>>>>>>373 ubyte&0xDF >0
+>>>>>>>373 ubyte&0xDF >0
>>>>>>>>373 string x \b%-.3s
->>>>>>376 ubyte&0xDF >0
+>>>>>>376 ubyte&0xDF >0
>>>>>>>376 string x \b.%-.3s
#
->430 string NTLDR\ fehlt\xFF\r\n
->>444 string Medienfehler\xFF\r\n
+>430 string NTLDR\ fehlt\xFF\r\n
+>>444 string Medienfehler\xFF\r\n
>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
->>>>371 ubyte >0x20
->>>>>368 ubyte&0xDF >0
+>>>>371 ubyte >0x20
+>>>>>368 ubyte&0xDF >0
>>>>>>368 string x %-.5s
->>>>>>>373 ubyte&0xDF >0
+>>>>>>>373 ubyte&0xDF >0
>>>>>>>>373 string x \b%-.3s
->>>>>>376 ubyte&0xDF >0
+>>>>>>376 ubyte&0xDF >0
>>>>>>>376 string x \b.%-.3s
# variant
->>>>417 ubyte&0xDF >0
+>>>>417 ubyte&0xDF >0
>>>>>417 string x %-.5s
->>>>>>422 ubyte&0xDF >0
+>>>>>>422 ubyte&0xDF >0
>>>>>>>422 string x \b%-.3s
->>>>>425 ubyte&0xDF >0
+>>>>>425 ubyte&0xDF >0
>>>>>>425 string >\ \b.%-.3s
#
->430 string Datentr\204ger\ entfernen\xFF\r\n
->>454 string Medienfehler\xFF\r\n
+>430 string Datentr\204ger\ entfernen\xFF\r\n
+>>454 string Medienfehler\xFF\r\n
>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
->>>>379 string \0
->>>>>368 ubyte&0xDF >0
+>>>>379 string \0
+>>>>>368 ubyte&0xDF >0
>>>>>>368 string x %-.5s
->>>>>>>373 ubyte&0xDF >0
+>>>>>>>373 ubyte&0xDF >0
>>>>>>>>373 string x \b%-.3s
->>>>>>376 ubyte&0xDF >0
+>>>>>>376 ubyte&0xDF >0
>>>>>>>376 string x \b.%-.3s
# variant
->>>>417 ubyte&0xDF >0
+>>>>417 ubyte&0xDF >0
>>>>>417 string x %-.5s
->>>>>>422 ubyte&0xDF >0
+>>>>>>422 ubyte&0xDF >0
>>>>>>>422 string x \b%-.3s
->>>>>425 ubyte&0xDF >0
+>>>>>425 ubyte&0xDF >0
>>>>>>425 string >\ \b.%-.3s
#
-#>3 string NTFS\ \ \ \
->389 string Fehler\ beim\ Lesen\
+#>3 string NTFS\ \ \ \040
+>389 string Fehler\ beim\ Lesen\040
>>407 string des\ Datentr\204gers
->>>426 string NTLDR\ fehlt
+>>>426 string NTLDR\ fehlt
>>>>440 string NTLDR\ ist\ komprimiert
>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
-#>3 string NTFS\ \ \ \
+#>3 string NTFS\ \ \ \040
>313 string A\ disk\ read\ error\ occurred.\r
->>345 string A\ kernel\ file\ is\ missing\
->>>370 string from\ the\ disk.\r
->>>>484 string NTLDR\ is\ compressed
->>>>>429 string Insert\ a\ system\ diskette\
+>>345 string A\ kernel\ file\ is\ missing\040
+>>>370 string from\ the\ disk.\r
+>>>>484 string NTLDR\ is\ compressed
+>>>>>429 string Insert\ a\ system\ diskette\040
>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
# DOS loader variants different languages,offsets
>472 ubyte&0xDF >0
->>389 string Invalid\ system\ disk\xFF\r\n
->>>411 string Disk\ I/O\ error
->>>>428 string Replace\ the\ disk,\ and\
+>>389 string Invalid\ system\ disk\xFF\r\n
+>>>411 string Disk\ I/O\ error
+>>>>428 string Replace\ the\ disk,\ and\040
>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
#IO.SYS
->>>>>>472 ubyte&0xDF >0
+>>>>>>472 ubyte&0xDF >0
>>>>>>>472 string x \b %-.2s
->>>>>>>>474 ubyte&0xDF >0
+>>>>>>>>474 ubyte&0xDF >0
>>>>>>>>>474 string x \b%-.5s
->>>>>>>>>>479 ubyte&0xDF >0
+>>>>>>>>>>479 ubyte&0xDF >0
>>>>>>>>>>>479 string x \b%-.1s
->>>>>>>480 ubyte&0xDF >0
+>>>>>>>480 ubyte&0xDF >0
>>>>>>>>480 string x \b.%-.3s
#MSDOS.SYS
>>>>>>>483 ubyte&0xDF >0 \b+
>>>>>>>>483 string x \b%-.5s
->>>>>>>>>488 ubyte&0xDF >0
+>>>>>>>>>488 ubyte&0xDF >0
>>>>>>>>>>488 string x \b%-.3s
->>>>>>>>491 ubyte&0xDF >0
+>>>>>>>>491 ubyte&0xDF >0
>>>>>>>>>491 string x \b.%-.3s
#
->>390 string Invalid\ system\ disk\xFF\r\n
->>>412 string Disk\ I/O\ error\xFF\r\n
->>>>429 string Replace\ the\ disk,\ and\
+>>390 string Invalid\ system\ disk\xFF\r\n
+>>>412 string Disk\ I/O\ error\xFF\r\n
+>>>>429 string Replace\ the\ disk,\ and\040
>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
->>388 string Ungueltiges\ System\ \xFF\r\n
->>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
->>>>427 string Datentraeger\ wechseln\ und\
+>>388 string Ungueltiges\ System\ \xFF\r\n
+>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
+>>>>427 string Datentraeger\ wechseln\ und\040
>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
#WINBOOT.SYS only not spaces (0xDF)
->>>>>>497 ubyte&0xDF >0
+>>>>>>497 ubyte&0xDF >0
>>>>>>>497 string x %-.5s
->>>>>>>>502 ubyte&0xDF >0
+>>>>>>>>502 ubyte&0xDF >0
>>>>>>>>>502 string x \b%-.1s
->>>>>>>>>>503 ubyte&0xDF >0
+>>>>>>>>>>503 ubyte&0xDF >0
>>>>>>>>>>>503 string x \b%-.1s
->>>>>>>>>>>>504 ubyte&0xDF >0
+>>>>>>>>>>>>504 ubyte&0xDF >0
>>>>>>>>>>>>>504 string x \b%-.1s
->>>>>>505 ubyte&0xDF >0
+>>>>>>505 ubyte&0xDF >0
>>>>>>>505 string x \b.%-.3s
#IO.SYS
>>>>>>472 ubyte&0xDF >0 or
>>>>>>>472 string x \b %-.2s
->>>>>>>>474 ubyte&0xDF >0
+>>>>>>>>474 ubyte&0xDF >0
>>>>>>>>>474 string x \b%-.5s
->>>>>>>>>>479 ubyte&0xDF >0
+>>>>>>>>>>479 ubyte&0xDF >0
>>>>>>>>>>>479 string x \b%-.1s
->>>>>>>480 ubyte&0xDF >0
+>>>>>>>480 ubyte&0xDF >0
>>>>>>>>480 string x \b.%-.3s
#MSDOS.SYS
>>>>>>>483 ubyte&0xDF >0 \b+
>>>>>>>>483 string x \b%-.5s
->>>>>>>>>488 ubyte&0xDF >0
+>>>>>>>>>488 ubyte&0xDF >0
>>>>>>>>>>488 string x \b%-.3s
->>>>>>>>491 ubyte&0xDF >0
+>>>>>>>>491 ubyte&0xDF >0
>>>>>>>>>491 string x \b.%-.3s
#
->>390 string Ungueltiges\ System\ \xFF\r\n
->>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
->>>>429 string Datentraeger\ wechseln\ und\
+>>390 string Ungueltiges\ System\ \xFF\r\n
+>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
+>>>>429 string Datentraeger\ wechseln\ und\040
>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
#WINBOOT.SYS only not spaces (0xDF)
->>>>>>497 ubyte&0xDF >0
+>>>>>>497 ubyte&0xDF >0
>>>>>>>497 string x %-.7s
->>>>>>>>504 ubyte&0xDF >0
+>>>>>>>>504 ubyte&0xDF >0
>>>>>>>>>504 string x \b%-.1s
->>>>>>505 ubyte&0xDF >0
+>>>>>>505 ubyte&0xDF >0
>>>>>>>505 string x \b.%-.3s
#IO.SYS
>>>>>>472 ubyte&0xDF >0 or
>>>>>>>472 string x \b %-.2s
->>>>>>>>474 ubyte&0xDF >0
+>>>>>>>>474 ubyte&0xDF >0
>>>>>>>>>474 string x \b%-.6s
->>>>>>>480 ubyte&0xDF >0
+>>>>>>>480 ubyte&0xDF >0
>>>>>>>>480 string x \b.%-.3s
#MSDOS.SYS
>>>>>>>483 ubyte&0xDF >0 \b+
>>>>>>>>483 string x \b%-.5s
->>>>>>>>>488 ubyte&0xDF >0
+>>>>>>>>>488 ubyte&0xDF >0
>>>>>>>>>>488 string x \b%-.3s
->>>>>>>>491 ubyte&0xDF >0
+>>>>>>>>491 ubyte&0xDF >0
>>>>>>>>>491 string x \b.%-.3s
#
->>389 string Ungueltiges\ System\ \xFF\r\n
->>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
->>>>428 string Datentraeger\ wechseln\ und\
+>>389 string Ungueltiges\ System\ \xFF\r\n
+>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
+>>>>428 string Datentraeger\ wechseln\ und\040
>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
>>>>>>472 string x %-.2s
->>>>>>>474 ubyte&0xDF >0
+>>>>>>>474 ubyte&0xDF >0
>>>>>>>>474 string x \b%-.5s
->>>>>>>>479 ubyte&0xDF >0
+>>>>>>>>479 ubyte&0xDF >0
>>>>>>>>>479 string x \b%-.1s
->>>>>>480 ubyte&0xDF >0
+>>>>>>480 ubyte&0xDF >0
>>>>>>>480 string x \b.%-.3s
>>>>>>483 ubyte&0xDF >0 \b+
>>>>>>>483 string x \b%-.5s
->>>>>>>488 ubyte&0xDF >0
+>>>>>>>488 ubyte&0xDF >0
>>>>>>>>488 string x \b%-.2s
->>>>>>>>490 ubyte&0xDF >0
+>>>>>>>>490 ubyte&0xDF >0
>>>>>>>>>490 string x \b%-.1s
->>>>>>>491 ubyte&0xDF >0
+>>>>>>>491 ubyte&0xDF >0
>>>>>>>>491 string x \b.%-.3s
>479 ubyte&0xDF >0
->>416 string Kein\ System\ oder\
->>>433 string Laufwerksfehler
+>>416 string Kein\ System\ oder\040
+>>>433 string Laufwerksfehler
>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
#IO.SYS
>>>>>479 string x \b %-.2s
->>>>>>481 ubyte&0xDF >0
+>>>>>>481 ubyte&0xDF >0
>>>>>>>481 string x \b%-.6s
->>>>>487 ubyte&0xDF >0
+>>>>>487 ubyte&0xDF >0
>>>>>>487 string x \b.%-.3s
#MSDOS.SYS
>>>>>>490 ubyte&0xDF >0 \b+
>>>>>>>490 string x \b%-.5s
->>>>>>>>495 ubyte&0xDF >0
+>>>>>>>>495 ubyte&0xDF >0
>>>>>>>>>495 string x \b%-.3s
->>>>>>>498 ubyte&0xDF >0
+>>>>>>>498 ubyte&0xDF >0
>>>>>>>>498 string x \b.%-.3s
#
->376 search/41 Non-System\ disk\ or\
->>395 search/41 disk\ error\r
->>>407 search/41 Replace\ and\
+>376 search/41 Non-System\ disk\ or\040
+>>395 search/41 disk\ error\r
+>>>407 search/41 Replace\ and\040
>>>>419 search/41 press\ \b,
>>>>419 search/41 strike\ \b, old
>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader
#449 Disk\ Boot\ failure\r MS 3.21
#466 Boot\ Failure\r MS 3.30
->>>>>468 search/18 \0
+>>>>>468 search/18 \0
#IO.SYS,IBMBIO.COM
>>>>>>&0 string x \b %-.2s
->>>>>>>&-20 ubyte&0xDF >0
+>>>>>>>&-20 ubyte&0xDF >0
>>>>>>>>&-1 string x \b%-.4s
->>>>>>>>>&-16 ubyte&0xDF >0
+>>>>>>>>>&-16 ubyte&0xDF >0
>>>>>>>>>>&-1 string x \b%-.2s
>>>>>>&8 ubyte&0xDF >0 \b.
>>>>>>>&-1 string x \b%-.3s
#MSDOS.SYS,IBMDOS.COM
>>>>>>&11 ubyte&0xDF >0 \b+
>>>>>>>&-1 string x \b%-.5s
->>>>>>>>&-6 ubyte&0xDF >0
+>>>>>>>>&-6 ubyte&0xDF >0
>>>>>>>>>&-1 string x \b%-.1s
->>>>>>>>>>&-5 ubyte&0xDF >0
+>>>>>>>>>>&-5 ubyte&0xDF >0
>>>>>>>>>>>&-1 string x \b%-.2s
>>>>>>>&7 ubyte&0xDF >0 \b.
>>>>>>>>&-1 string x \b%-.3s
>441 string Cannot\ load\ from\ harddisk.\n\r
->>469 string Insert\ Systemdisk\
+>>469 string Insert\ Systemdisk\040
>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader
-#>43 string \224R-LOADER\ \ SYS =label
+#>43 string \224R-LOADER\ \ SYS =label
>54 string SYS
>>324 string VASKK
>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
#
->98 string Press\ a\ key\ to\ retry\0\r
->>120 string Cannot\ find\ file\ \0\r
->>>139 string Disk\ read\ error\0\r
+>98 string Press\ a\ key\ to\ retry\0\r
+>>120 string Cannot\ find\ file\ \0\r
+>>>139 string Disk\ read\ error\0\r
>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader
#DRBIOS.SYS
->>>>>44 ubyte&0xDF >0
+>>>>>44 ubyte&0xDF >0
>>>>>>44 string x \b %-.6s
->>>>>>>50 ubyte&0xDF >0
+>>>>>>>50 ubyte&0xDF >0
>>>>>>>>50 string x \b%-.2s
->>>>>>52 ubyte&0xDF >0
+>>>>>>52 ubyte&0xDF >0
>>>>>>>52 string x \b.%-.3s
#
->70 string IBMBIO\ \ COM
->>472 string Cannot\ load\ DOS!\
+>70 string IBMBIO\ \ COM
+>>472 string Cannot\ load\ DOS!\040
>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
->>471 string Cannot\ load\ DOS\
+>>471 string Cannot\ load\ DOS\040
>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
#??
->444 string KERNEL\ \ SYS
+>444 string KERNEL\ \ SYS
>>314 string BOOT\ error! \b, FREE-DOS Bootloader
->499 string KERNEL\ \ SYS
+>499 string KERNEL\ \ SYS
>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
->449 string KERNEL\ \ SYS
+>449 string KERNEL\ \ SYS
>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
#
->449 string Loading\ FreeDOS
+>449 string Loading\ FreeDOS
>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader
->>>497 ubyte&0xDF >0
+>>>497 ubyte&0xDF >0
>>>>497 string x \b %-.6s
->>>>>503 ubyte&0xDF >0
+>>>>>503 ubyte&0xDF >0
>>>>>>503 string x \b%-.1s
->>>>>>>504 ubyte&0xDF >0
+>>>>>>>504 ubyte&0xDF >0
>>>>>>>>504 string x \b%-.1s
->>>>505 ubyte&0xDF >0
+>>>>505 ubyte&0xDF >0
>>>>>505 string x \b.%-.3s
#
>331 string Error!.0 \b, FREE-DOS 1.0 bootloader
#
->125 string Loading\ FreeDOS...\r
+>125 string Loading\ FreeDOS...\r
>>311 string BOOT\ error!\r \b, FREE-DOS bootloader
->>>441 ubyte&0xDF >0
+>>>441 ubyte&0xDF >0
>>>>441 string x \b %-.6s
->>>>>447 ubyte&0xDF >0
+>>>>>447 ubyte&0xDF >0
>>>>>>447 string x \b%-.1s
->>>>>>>448 ubyte&0xDF >0
+>>>>>>>448 ubyte&0xDF >0
>>>>>>>>448 string x \b%-.1s
->>>>449 ubyte&0xDF >0
+>>>>449 ubyte&0xDF >0
>>>>>449 string x \b.%-.3s
->124 string FreeDOS\0
+>124 string FreeDOS\0
>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
->>>497 ubyte&0xDF >0
+>>>497 ubyte&0xDF >0
>>>>497 string x \b %-.6s
->>>>>503 ubyte&0xDF >0
+>>>>>503 ubyte&0xDF >0
>>>>>>503 string x \b%-.1s
->>>>>>>504 ubyte&0xDF >0
+>>>>>>>504 ubyte&0xDF >0
>>>>>>>>504 string x \b%-.1s
->>>>505 ubyte&0xDF >0
+>>>>505 ubyte&0xDF >0
>>>>>505 string x \b.%-.3s
>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
->>>497 ubyte&0xDF >0
+>>>497 ubyte&0xDF >0
>>>>497 string x \b %-.6s
->>>>>503 ubyte&0xDF >0
+>>>>>503 ubyte&0xDF >0
>>>>>>503 string x \b%-.1s
->>>>>>>504 ubyte&0xDF >0
+>>>>>>>504 ubyte&0xDF >0
>>>>>>>>504 string x \b%-.1s
->>>>505 ubyte&0xDF >0
+>>>>505 ubyte&0xDF >0
>>>>>505 string x \b.%-.3s
>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
->>>497 ubyte&0xDF >0
+>>>497 ubyte&0xDF >0
>>>>497 string x \b %-.6s
->>>>>503 ubyte&0xDF >0
+>>>>>503 ubyte&0xDF >0
>>>>>>503 string x \b%-.1s
->>>>>>>504 ubyte&0xDF >0
+>>>>>>>504 ubyte&0xDF >0
>>>>>>>>504 string x \b%-.1s
->>>>505 ubyte&0xDF >0
+>>>>505 ubyte&0xDF >0
>>>>>505 string x \b.%-.3s
->336 string Error!\
+>336 string Error!\040
>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
->>>497 ubyte&0xDF >0
+>>>497 ubyte&0xDF >0
>>>>497 string x \b %-.6s
->>>>>503 ubyte&0xDF >0
+>>>>>503 ubyte&0xDF >0
>>>>>>503 string x \b%-.1s
->>>>>>>504 ubyte&0xDF >0
+>>>>>>>504 ubyte&0xDF >0
>>>>>>>>504 string x \b%-.1s
->>>>505 ubyte&0xDF >0
+>>>>505 ubyte&0xDF >0
>>>>>505 string x \b.%-.3s
# added by Joerg Jenderek
# http://www.visopsys.org/
# http://partitionlogic.org.uk/
# OEM-ID=Visopsys
->478 ulelong 0
->>(1.b+326) string I/O\ Error\ reading\
->>>(1.b+344) string Visopsys\ loader\r
+>478 ulelong 0
+>>(1.b+326) string I/O\ Error\ reading\040
+>>>(1.b+344) string Visopsys\ loader\r
>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
# http://alexfru.chat.ru/epm.html#bootprog
->494 ubyte >0x4D
->>495 string >E
->>>495 string <S
+>494 ubyte >0x4D
+>>495 string >E
+>>>495 string <S
#OEM-ID is not reliable
->>>>3 string BootProg
+>>>>3 string BootProg
# It just looks for a program file name at the root directory
# and loads corresponding file with following execution.
# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
->>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
+>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
>>>>>499 use DOS-filename
#If the boot sector fails to read any other sector,
#it prints a very short message ("RE") to the screen and hangs the computer.
@@ -1027,23 +1025,23 @@
# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
->0 string RRaA
+>0 string RRaA
>>0x1E4 string rrAa \b, FSInfosector
#>>0x1FC uleshort =0 SHOULD BE ZERO
>>>0x1E8 ulelong <0xffffffff \b, %u free clusters
>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u
# updated by Joerg Jenderek at Sep 2007
->3 ubyte 0
+>3 ubyte 0
#no active flag
->>446 ubyte 0
+>>446 ubyte 0
# partition 1 not empty
->>>450 ubyte >0
+>>>450 ubyte >0
# partitions 3,4 empty
->>>>482 ubyte 0
->>>>>498 ubyte 0
+>>>>482 ubyte 0
+>>>>>498 ubyte 0
# partition 2 ID=0,5,15
->>>>>>466 ubyte <0x10
+>>>>>>466 ubyte <0x10
>>>>>>>466 ubyte 0x05 \b, extended partition table
>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
>>>>>>>466 ubyte 0x0 \b, extended partition table (last)
@@ -1056,35 +1054,35 @@
# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
0 name DOS-filename
-# space=0x20 (00100000b) means empty
->0 ubyte&0xDF >0
+# space=0x20 (00100000b) means empty
+>0 ubyte&0xDF >0
>>0 ubyte x \b%c
->>>1 ubyte&0xDF >0
+>>>1 ubyte&0xDF >0
>>>>1 ubyte x \b%c
->>>>>2 ubyte&0xDF >0
+>>>>>2 ubyte&0xDF >0
>>>>>>2 ubyte x \b%c
->>>>>>>3 ubyte&0xDF >0
+>>>>>>>3 ubyte&0xDF >0
>>>>>>>>3 ubyte x \b%c
->>>>>>>>>4 ubyte&0xDF >0
+>>>>>>>>>4 ubyte&0xDF >0
>>>>>>>>>>4 ubyte x \b%c
->>>>>>>>>>>5 ubyte&0xDF >0
+>>>>>>>>>>>5 ubyte&0xDF >0
>>>>>>>>>>>>5 ubyte x \b%c
->>>>>>>>>>>>>6 ubyte&0xDF >0
+>>>>>>>>>>>>>6 ubyte&0xDF >0
>>>>>>>>>>>>>>6 ubyte x \b%c
->>>>>>>>>>>>>>>7 ubyte&0xDF >0
+>>>>>>>>>>>>>>>7 ubyte&0xDF >0
>>>>>>>>>>>>>>>>7 ubyte x \b%c
# DOS filename extension
>>8 ubyte&0xDF >0 \b.
>>>8 ubyte x \b%c
->>>>9 ubyte&0xDF >0
+>>>>9 ubyte&0xDF >0
>>>>>9 ubyte x \b%c
->>>>>>10 ubyte&0xDF >0
+>>>>>>10 ubyte&0xDF >0
>>>>>>>10 ubyte x \b%c
# Print 2 following DOS filenames from directory entry form
# like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
0 name 2xDOS-filename
# display 1 space
->0 ubyte x \b
+>0 ubyte x \b
>0 use DOS-filename
>11 ubyte x \b+
>11 use DOS-filename
@@ -1103,10 +1101,10 @@
# partition type ID > 0
>4 ubyte >0
# active flag 0
->>0 ubyte 0
+>>0 ubyte 0
>>>0 use partition-entry
-# active flag 0x80, 0x81, ...
->>0 ubyte >0x7F
+# active flag 0x80, 0x81, ...
+>>0 ubyte >0x7F
>>>0 use partition-entry
# Print entry of partition table
0 name partition-entry
@@ -1138,7 +1136,7 @@
# sector
>1 ubyte&0x3F x \b,%u
-# FATX
+# FATX
0 string FATX FATX filesystem data
# romfs filesystems - Juan Cespedes <cespedes@debian.org>
@@ -1159,7 +1157,7 @@
# http://syslinux.zytor.com/iso.php
# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
-0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
+0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
>631 search/689 ISOLINUX\ isolinux Loader
>>&0 string x (version %-4.4s)
# http://syslinux.zytor.com/pxe.php
@@ -1176,88 +1174,88 @@
>11 string x (version %-4.4s)
# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
-0 ulelong&0x80909bEB 0x009018EB
+0 ulelong&0x80909bEB 0x009018EB
# OEM-ID not always "SYSLINUX"
->434 search/47 Boot\ failed
-# followed by \r\n\0 or :\
+>434 search/47 Boot\ failed
+# followed by \r\n\0 or :\
>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older)
>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9)
->459 search/30 Boot\ error\r\n\0
+>459 search/30 Boot\ error\r\n\0
>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer)
# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
# assembler instructions: mov di,0600h;mov cx,0100h
-16 search/4 \xbf\x00\x06\xb9\x00\x01
+16 search/4 \xbf\x00\x06\xb9\x00\x01
# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
!:strength +36
->94 search/249 Missing\ operating\ system
+>94 search/249 Missing\ operating\ system
# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
# skip Ranish MBR
->>408 search/4 HD1/\0
->>408 default x
+>>408 search/4 HD1/\0
+>>408 default x
>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR
# followed by "ing " or space
->>>>292 search/98 error
+>>>>292 search/98 error
>>>>>&0 string \r (version 3.35 or older)
>>>>>&0 string .\r (version 3.52 or newer)
>>>>>&0 default x (version 3.36-3.51 )
>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR
->>156 search/10 \0Boot\ partition\ not\ found\r\n
+>>156 search/10 \0Boot\ partition\ not\ found\r\n
>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older)
->>174 search/10 \0Missing\ OS\r\n
+>>174 search/10 \0Missing\ OS\r\n
>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer)
# SYSLINUX END
# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax,
-0 ubequad 0x31c08ed0bc007c8e
+0 ubequad 0x31c08ed0bc007c8e
# mbr_bootsel magic before partition table not reliable with small ipl fragments
-#>444 uleshort 0xb5e1
->0004 uleshort x
+#>444 uleshort 0xb5e1
+>0004 uleshort x
# ERRorTeXT
>>181 search/166 Error\ \0\r\n NetBSD mbr
# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x
# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector
-# BOOT_EXTENDED definitions contains assembler instructions:
+# BOOT_EXTENDED definitions contains assembler instructions:
# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended
# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO
# not TERSE_ERROR
->>>196 search/106 No\ active\ partition\0
->>>>&0 string Disk\ read\ error\0
+>>>196 search/106 No\ active\ partition\0
+>>>>&0 string Disk\ read\ error\0
>>>>>&0 string No\ operating\ system\0 \b,verbose
# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS
# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13
>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check
# assembler instructions: movw nametab,bx
->>>0x26 search/21 \xBB\x94\x07
+>>>0x26 search/21 \xBB\x94\x07
# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
->>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94
->>>>>181 search/166 Error\ \0
+>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94
+>>>>>181 search/166 Error\ \0
# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
>>>>>>&3 string x \b,"%s"
>>>446 use partition-table
# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
# assembler instructions: jmp short 0x58;nop;ASCII
-0 ubequad&0xeb58908000000000 0xeb58900000000000
+0 ubequad&0xeb58908000000000 0xeb58900000000000
# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
->(1.b+2) ubequad 0xfa31c08ed88ec08e
+>(1.b+2) ubequad 0xfa31c08ed88ec08e
# Error messages at end of code
->>376 string No\ operating\ system\r\n\0
->>>398 string Disk\ error\r\n\0FDD\0HDD\0
+>>376 string No\ operating\ system\r\n\0
+>>>398 string Disk\ error\r\n\0FDD\0HDD\0
>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr
-# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
+# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
-0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC
+0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC
# pointer to the data starting with Neil Turton signature string
->(0x1BC.s) string NDTmbr
+>(0x1BC.s) string NDTmbr
>>&-14 string 1234F\0 Turton mbr (
# parameters also viewed by install-mbr --list
>>>(0x1BC.s+7) ubyte x \b%u<=
@@ -1271,23 +1269,23 @@
#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x
# for older versions
->>>(0x1BC.s+9) ubyte <2
+>>>(0x1BC.s+9) ubyte <2
#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds
>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
# floppy A: or B:
>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x
->>>>(0x1BC.s+13) ubyte >1
+>>>>(0x1BC.s+13) ubyte >1
# 1st hard disc
#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x
# not 1st hard disc
>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x
# for version >= 2 maximal timeout can be 65534
->>>(0x1BC.s+9) ubyte >1
+>>>(0x1BC.s+9) ubyte >1
#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds
>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds
# floppy A: or B:
>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x
->>>>(0x1BC.s+14) ubyte >1
+>>>>(0x1BC.s+14) ubyte >1
# 1st hard disc
#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x
# not 1st hard disc
@@ -1299,14 +1297,14 @@
# grub-1.94/kern/i386/pc/startup.S
# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
# usual values are marked with comments to get only informations of strange GRUB loaders
-0x200 uleshort 0x70EA
+0x200 uleshort 0x70EA
# found only version 3.{1,2}
->0x206 ubeshort >0x0300
+>0x206 ubeshort >0x0300
# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
->>0x212 ubyte >0x29
->>>0x213 ubyte >0x29
+>>0x212 ubyte >0x29
+>>>0x213 ubyte >0x29
# not iso9660_stage1_5
-#>>>0 ulelong&0x00BE5652 0x00BE5652
+#>>>0 ulelong&0x00BE5652 0x00BE5652
>>>>0x213 ubyte >0x29 GRand Unified Bootloader
# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
>>>>0x217 ubyte 0xFF stage1_5
@@ -1318,7 +1316,7 @@
#>>>>0x208 ulelong =0xffffff \b, %lu (default)
>>>>0x208 ulelong >0xffffff \b, installed partition %u
# GRUB 0.5.95 unofficial
->>>>0x20C ulelong&0x2E300000 0x2E300000
+>>>>0x20C ulelong&0x2E300000 0x2E300000
# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
>>>>>0x20C ubyte x \b, identifier 0x%x
#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
@@ -1326,17 +1324,17 @@
# GRUB version as string
>>>>>0x20E string >\0 \b, GRUB version %-s
# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
->>>>>>0x215 ulong 0xffffffff
+>>>>>>0x215 ulong 0xffffffff
>>>>>>>0x219 string >\0 \b, configuration file %-s
->>>>>>0x215 ulong !0xffffffff
+>>>>>>0x215 ulong !0xffffffff
>>>>>>>0x215 string >\0 \b, configuration file %-s
# newer GRUB versions
->>>>0x20C ulelong&0x2E300000 !0x2E300000
+>>>>0x20C ulelong&0x2E300000 !0x2E300000
##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
>>>>>0x20C ulelong >0 \b, saved entry %d
# for 1.94 contains kernel image size
# for 0.93,0.94,0.96,0.97
-# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
+# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
>>>>>0x210 ubyte x \b, identifier 0x%x
# The flag for LBA forcing is in most cases 0
#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
@@ -1344,9 +1342,9 @@
# GRUB version as string
>>>>>0x212 string >\0 \b, GRUB version %-s
# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
->>>>>0x217 ulong 0xffffffff
+>>>>>0x217 ulong 0xffffffff
>>>>>>0x21b string >\0 \b, configuration file %-s
->>>>>0x217 ulong !0xffffffff
+>>>>>0x217 ulong !0xffffffff
>>>>>>0x217 string >\0 \b, configuration file %-s
# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
@@ -1362,13 +1360,13 @@
# mtools-3.9.8/msdos.h
# usual values are marked with comments to get only informations of strange FAT systems
# valid sectorsize must be a power of 2 from 32 to 32768
->11 uleshort&0x001f 0
->>11 uleshort <32769
->>>11 uleshort >31
->>>>21 ubyte&0xf0 0xF0
+>11 uleshort&0x001f 0
+>>11 uleshort <32769
+>>>11 uleshort >31
+>>>>21 ubyte&0xf0 0xF0
>>>>>0 ubyte 0xEB DOS/MBR boot sector
>>>>>>1 ubyte x \b, code offset 0x%x+2
->>>>>0 ubyte 0xE9
+>>>>>0 ubyte 0xE9
>>>>>>1 uleshort x \b, code offset 0x%x+3
>>>>>3 string >\0 \b, OEM-ID "%-.8s"
#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
@@ -1379,10 +1377,10 @@
>>>>>13 ubyte >1 \b, sectors/cluster %u
#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
# for lazy FAT32 implementation like Transcend digital photo frame PF830
->>>>>82 string/c fat32
+>>>>>82 string/c fat32
>>>>>>14 uleshort !32 \b, reserved sectors %u
#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
->>>>>82 string/c !fat32
+>>>>>82 string/c !fat32
>>>>>>14 uleshort >1 \b, reserved sectors %u
#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS)
@@ -1392,7 +1390,7 @@
>>>>>16 ubyte >0
>>>>>17 uleshort >0 \b, root entries %u
#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32)
->>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
+>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32)
>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
@@ -1404,20 +1402,20 @@
#>>>>>26 ubyte =2 \b, heads %u (usual floppy)
>>>>>26 ubyte =1 \b, heads %u
# valid only for sector sizes with more then 32 Bytes
->>>>>11 uleshort >32
+>>>>>11 uleshort >32
# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
# skip for values 2,2Ah,70h,73h,DFh
# and continue for extended boot signature values 0,28h,29h,80h
->>>>>>38 ubyte&0x56 =0
+>>>>>>38 ubyte&0x56 =0
>>>>>>>28 ulelong >0 \b, hidden sectors %u
#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
->>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
+>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
-# FAT<32 bit specific
->>>>>>>82 string/c !fat32
+# FAT<32 bit specific
+>>>>>>>82 string/c !fat32
#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
->>>>>>>>36 ubyte !0x80
+>>>>>>>>36 ubyte !0x80
>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x
# VGA-copy CRC or
# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
@@ -1437,27 +1435,27 @@
# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
# otherwise FAT is 16 bit.
# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
->>>>>82 string/c !fat32
+>>>>>82 string/c !fat32
>>>>>>54 string FAT12 \b, FAT (12 bit)
>>>>>>54 string FAT16 \b, FAT (16 bit)
->>>>>>54 default x
+>>>>>>54 default x
# determinate FAT bit size by media descriptor
# small floppies implies FAT12
>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor)
# with media descriptor F0h floppy or maybe superfloppy with FAT16
->>>>>>>21 ubyte =0xF0
+>>>>>>>21 ubyte =0xF0
# superfloppy (many sectors) implies FAT16
>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors)
# no superfloppy with media descriptor F0h implies FAT12
>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors)
# with media descriptor F8h floppy or hard disc with FAT12 or FAT16
->>>>>>>21 ubyte =0xF8
+>>>>>>>21 ubyte =0xF8
# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry)
# hard disc with FAT12 or FAT16
>>>>>>>>19 default x \b, FAT (1Y bit by descriptor)
# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
->>>>>>>21 ubyte =0xFA
+>>>>>>>21 ubyte =0xFA
# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry)
# RAM disc with FAT12 or FAT16 or Tandy hard disc
@@ -1481,17 +1479,17 @@
# 0 or 0xFFFF instead of usual 6 means no backup sector
>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector
>>>>>>50 uleshort =0 \b, no Backup boot sector
-#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
->>>>>>50 default x
+#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
+>>>>>>50 default x
>>>>>>>50 uleshort x \b, Backup boot sector %u
# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
>>>>>>52 ulelong >0 \b, reserved1 0x%x
>>>>>>56 ulelong >0 \b, reserved2 0x%x
>>>>>>60 ulelong >0 \b, reserved3 0x%x
-# same structure as FAT1X
+# same structure as FAT1X
#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
->>>>>>64 ubyte !0x80
+>>>>>>64 ubyte !0x80
>>>>>>>64 ubyte >0 \b, physical drive 0x%x
# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
>>>>>>65 ubyte >0 \b, reserved 0x%x
@@ -1502,10 +1500,10 @@
>>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
>>>>>>>71 string =NO\ NAME \b, unlabeled
# additional tests for floppy image added by Joerg Jenderek
-# no fixed disk
->>>>>21 ubyte !0xF8
+# no fixed disk
+>>>>>21 ubyte !0xF8
# floppy media with 12 bit FAT
->>>>>>54 string !FAT16
+>>>>>>54 string !FAT16
# test for FAT after bootsector
>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT
# floppy image
@@ -1513,11 +1511,11 @@
# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
# 0 FATs
->>>>>16 ubyte =0
+>>>>>16 ubyte =0
# 0 root entries
->>>>>>17 uleshort =0
+>>>>>>17 uleshort =0
# 0 DOS sectors
->>>>>>>19 uleshort =0
+>>>>>>>19 uleshort =0
# 0 sectors/FAT
# dos < 4.0 BootSector value found is 0x80
#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x)
@@ -1528,33 +1526,43 @@
>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld
>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld
# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
-# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
->>>>>>>>>64 lelong <256
+# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
+>>>>>>>>>64 lelong <256
>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d
>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i)
# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
# Values 128 to 255 represent index block sizes of 2^(256-N) byte
->>>>>>>>>68 ulelong <256
+>>>>>>>>>68 ulelong <256
>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d
#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d)
>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i)
>>>>>>>>>72 ulequad x \b, serial number 0%llx
>>>>>>>>>80 ulelong >0 \b, checksum 0x%x
#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual)
->>>>>>>>>0x258 ulelong&0x00009090 =0x00009090
->>>>>>>>>>&-92 indirect x \b; contains
+>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090
+>>>>>>>>>>&-92 indirect x \b; contains
# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
# unused assembler instructions JMP y2;NOP;NOP
-0x056 ulelong&0xFFFF0FFF 0x909002EB
+0x056 ulelong&0xFFFF0FFF 0x909002EB
# unicode loadername terminated by CTRL-D
->(0.s*2) ulelong&0xFFFFFF00 0x00040000
+>(0.s*2) ulelong&0xFFFFFF00 0x00040000
# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s
->>0x12 string $
+>>0x12 string $
>>>0x0c lestring16 x \b%-2.2s
### DOS,NTFS boot sectors end
+# ntfsclone-image is a special save format for NTFS volumes,
+# created and restored by the ntfsclone program
+0 string \0ntfsclone-image ntfsclone image,
+>0x10 byte x version %d.
+>0x11 byte x \b%d,
+>0x12 lelong x cluster size %d,
+>0x16 lequad x device size %lld,
+>0x1e lequad x %lld total clusters,
+>0x26 lequad x %lld clusters in use
+
9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
>8404 string x last mounted on %s,
#>9504 ledate x last checked at %s,
@@ -1671,6 +1679,13 @@
>&-1248 belong 0 TIME optimization
>&-1248 belong 1 SPACE optimization
+0 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian),
+>0x90 lelong+1 x volume %d
+>0x94 lelong x (of %d),
+>0x50 string x name %s,
+>0x98 ulelong x version %u,
+>0xa0 ulelong x flags 0x%x
+
# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
# volume label and UUID Russell Coker
@@ -1721,7 +1736,7 @@
0x410 leshort 0x137f
!:strength / 2
>0x402 beshort < 100
->0x402 beshort > -1 Minix filesystem, V1, %d zones
+>0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones
>0x1e string minix \b, bootable
0x410 beshort 0x137f
!:strength / 2
@@ -1738,29 +1753,30 @@
>0x402 beshort < 100
>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones
>0x1e string minix \b, bootable
-0x410 leshort 0x2468
->0x402 beshort < 100
->>0x402 beshort > -1 Minix filesystem, V2, %d zones
->0x1e string minix \b, bootable
-0x410 beshort 0x2468
->0x402 beshort < 100
->0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones
->0x1e string minix \b, bootable
-
-0x410 leshort 0x2478
->0x402 beshort < 100
->0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones
->0x1e string minix \b, bootable
-0x410 leshort 0x2478
->0x402 beshort < 100
->0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones
->0x1e string minix \b, bootable
-0x410 beshort 0x2478
->0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones
->0x1e string minix \b, bootable
-0x410 leshort 0x4d5a
->0x402 beshort !0 Minix filesystem, V3, %d zones
->0x1e string minix \b, bootable
+# Weak Magic: this is $x
+#0x410 leshort 0x2468
+#>0x402 beshort < 100
+#>>0x402 beshort > -1 Minix filesystem, V2, 14 char names
+#>0x1e string minix \b, bootable
+#0x410 beshort 0x2468
+#>0x402 beshort < 100
+#>0x402 beshort > -1 Minix filesystem, V2 (big endian)
+#>0x1e string minix \b, bootable
+#0x410 leshort 0x2478
+#>0x402 beshort < 100
+#>0x402 beshort > -1 Minix filesystem, V2, 30 char names
+#>0x1e string minix \b, bootable
+#0x410 leshort 0x2478
+#>0x402 beshort < 100
+#>0x402 beshort > -1 Minix filesystem, V2, 30 char names
+#>0x1e string minix \b, bootable
+#0x410 beshort 0x2478
+#>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian)
+#>0x1e string minix \b, bootable
+# Weak Magic! this is MD
+#0x418 leshort 0x4d5a
+#>0x402 beshort <100
+#>>0x402 beshort > -1 Minix filesystem, V3, 60 char names
# SGI disk labels - Nathan Scott <nathans@debian.org>
0 belong 0x0BE5A941 SGI disk label (volume header)
@@ -1819,7 +1835,7 @@
# FE 250K 8-inch, 1-sided, single-density
# FD 500K 8-inch, 2-sided, single-density
# FE 1.2 MB 8-inch, 2-sided, double-density
-# F8 ----- Fixed disk
+# F8 ----- Fixed disk
#
# FC xxxK Apricot 70x1x9 boot disk.
#
@@ -1847,7 +1863,7 @@
# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
# Too Weak.
-#512 ubelong&0xE0ffff00 0xE0ffff00
+#512 ubelong&0xE0ffff00 0xE0ffff00
# without valid Media descriptor in place of BPB, cases with are done at other places
#>21 ubyte <0xE5 floppy with old FAT filesystem
# but valid Media descriptor at begin of FAT
@@ -1859,61 +1875,61 @@
#>>512 ubyte =0xfb 640k
#>>512 ubyte =0xfc 180k
# look like an an old DOS directory entry
-#>>>0xA0E ubequad 0
-#>>>>0xA00 ubequad !0
+#>>>0xA0E ubequad 0
+#>>>>0xA00 ubequad !0
#!:mime application/x-ima
-#>>512 ubyte =0xfd
+#>>512 ubyte =0xfd
# look for 2nd FAT at different location to distinguish between 360k and 500k
#>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k
#>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k
-#>>>0xA0E ubequad 0
+#>>>0xA0E ubequad 0
#!:mime application/x-ima
-#>>512 ubyte =0xfe
+#>>512 ubyte =0xfe
#>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k
-#>>>>0x60E ubequad 0
-#>>>>>0x600 ubequad !0
+#>>>>0x60E ubequad 0
+#>>>>>0x600 ubequad !0
#!:mime application/x-ima
#>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k
#>>512 ubyte =0xff 320k
-#>>>0x60E ubequad 0
-#>>>>0x600 ubequad !0
+#>>>0x60E ubequad 0
+#>>>>0x600 ubequad !0
#!:mime application/x-ima
#>>512 ubyte x \b, Media descriptor 0x%x
# without x86 jump instruction
-#>>0 ulelong&0x804000E9 !0x000000E9
-# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
+#>>0 ulelong&0x804000E9 !0x000000E9
+# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
#>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader
# IOSYS.COM+MSDOS.COM
#>>>>0xc4 use 2xDOS-filename
-#>>0 ulelong&0x804000E9 =0x000000E9
+#>>0 ulelong&0x804000E9 =0x000000E9
# only x86 short jump instruction found
#>>>0 ubyte =0xEB
#>>>>1 ubyte x \b, code offset 0x%x+2
# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm
-# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
-#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader
+# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
+#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader
# ibmbio.com+ibmdos.com
#>>>>>0x176 use DOS-filename
#>>>>>0x181 ubyte x \b+
#>>>>>0x182 use DOS-filename
# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm
-# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
-#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader
+# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
+#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader
# ibmbio.com+ibmdos.com
#>>>>>0x18b use DOS-filename
#>>>>>0x196 ubyte x \b+
#>>>>>0x197 use DOS-filename
# http://en.wikipedia.org/wiki/Zenith_Data_Systems
-# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
+# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
#>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader
# IO.SYS+MSDOS.SYS
#>>>>>0x20 use 2xDOS-filename
# http://en.wikipedia.org/wiki/Corona_Data_Systems
-# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
+# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
#>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader
# IO.SYS+MSDOS.SYS
#>>>>>0x69 use 2xDOS-filename
-# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
+# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
#>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader
# defect IO.SYS+MSDOS.SYS ?
#>>>>>0x162 use 2xDOS-filename
@@ -1928,6 +1944,8 @@
>>38917 string 3 (version 2.0)
>>38917 byte >0x33 (unknown version, ID 0x%X)
>>38917 byte <0x31 (unknown version, ID 0x%X)
+# The next line is not necessary because the MBR staff is done looking for boot signature
+>0x1FE leshort 0xAA55 (DOS/MBR boot sector)
# "application id" which appears to be used as a volume label
>32808 string/T >\0 '%s'
>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
@@ -1941,14 +1959,25 @@
32769 string CD001
# mime line at that position does not work
# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
-!:strength -11
+#!:strength -11
# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
-# does not work
-#!:strength +33
->0 use cdrom
+!:strength +34
+>0 use cdrom
# .cso files
-0 string CISO Compressed ISO CD image
+# Reference: http://pismotec.com/ciso/ciso.h
+# NOTE: There are two other formats with the same magic but
+# completely incompatible specifications:
+# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
+# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
+0 string CISO
+# Other fields are used to determine what type of CISO this is:
+# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
+# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
+# - None of the above: Compact ISO.
+>4 lelong !0
+>>4 lelong !0x200000
+>>>0x10 lelong !0x800 Compressed ISO CD image
# cramfs filesystem - russell@coker.com.au
0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
@@ -2040,6 +2069,13 @@
>29 byte 16 \bBlackfin,
>29 byte 17 \bAVR32,
>29 byte 18 \bSTMicroelectronics ST200,
+>29 byte 19 \bSandbox architecture,
+>29 byte 20 \bANDES Technology NDS32,
+>29 byte 21 \bOpenRISC 1000,
+>29 byte 22 \bARM 64-bit,
+>29 byte 23 \bDesignWare ARC,
+>29 byte 24 \bx86_64,
+>29 byte 25 \bXtensa,
>30 byte 0 Invalid Image
>30 byte 1 Standalone Program
>30 byte 2 OS Kernel Image
@@ -2113,7 +2149,7 @@
>>8 ledate x created: %s
# AFS Dump Magic
-# From: Ty Sarna <tsarna@sarna.org>
+# From: Ty Sarna <tsarna@sarna.org>
0 string \x01\xb3\xa1\x13\x22 AFS Dump
>&0 belong x (v%d)
>>&0 byte 0x76
@@ -2208,19 +2244,27 @@
>>0x10024 belong x (blocksize %d,
>>0x10060 string >\0 lockproto %s)
-# BTRFS
-0x10040 string _BHRfS_M BTRFS Filesystem
->0x1012b string >\0 (label "%s",
->0x10090 lelong x sectorsize %d,
->0x10094 lelong x nodesize %d,
->0x10098 lelong x leafsize %d)
-
+# Russell Coker <russell@coker.com.au>
+0x10040 string _BHRfS_M BTRFS Filesystem
+>0x1012b string >\0 label "%s",
+>0x10090 lelong x sectorsize %d,
+>0x10094 lelong x nodesize %d,
+>0x10098 lelong x leafsize %d,
+>0x10020 belong x UUID=%08x-
+>0x10024 beshort x \b%04x-
+>0x10026 beshort x \b%04x-
+>0x10028 beshort x \b%04x-
+>0x1002a beshort x \b%04x
+>0x1002c belong x \b%08x,
+>0x10078 lequad x %lld/
+>0x10070 lequad x \b%lld bytes used,
+>0x10088 lequad x %lld devices
# dvdisaster's .ecc
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
0 string *dvdisaster* dvdisaster error correction file
-# xfs metadump image
+# xfs metadump image
# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
# but can we do the << ? For now it's always 512 (0x200) anyway.
0 string XFSM
@@ -2292,8 +2336,8 @@
0 string td\000 floppy image data (TeleDisk, compressed)
0 string TD\000 floppy image data (TeleDisk)
-0 string CQ\024 floppy image data (CopyQM,
->16 leshort x %d sectors,
+0 string CQ\024 floppy image data (CopyQM,
+>16 leshort x %d sectors,
>18 leshort x %d heads.)
0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk)
@@ -2343,3 +2387,13 @@
>>>>>>>>0x1B ubyte 0x30 \b, media=1D
>>>>>>>>0x1B ubyte 0x40 \b, media=1DD
>>>>>>>>0x1A ubyte 0x10 \b, write-protected
+
+# HDD Raw Copy Tool disk image, file extension: .imgc
+# From Benjamin Vanheuverzwijn <bvanheu@gmail.com>
+0 pstring HDD\ Raw\ Copy\ Tool %s
+>0x100 pstring x %s
+>0x200 pstring x - HD model: %s
+#>0x300 pstring x unknown %s
+>0x400 pstring x serial: %s
+#>0x500 pstring x unknown: %s
+!:ext imgc
diff --git a/magic/Magdir/finger b/magic/Magdir/finger
new file mode 100644
index 0000000..d8611f6
--- /dev/null
+++ b/magic/Magdir/finger
@@ -0,0 +1,16 @@
+
+#------------------------------------------------------------------------------
+# $File: finger,v 1.2 2015/10/07 02:37:57 christos Exp $
+# fingerprint: file(1) magic for fingerprint data
+# XPM bitmaps)
+#
+
+# http://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c
+
+0 string FP1 libfprint fingerprint data V1
+>3 beshort x \b, driver_id %x
+>5 belong x \b, devtype %x
+
+0 string FP2 libfprint fingerprint data V2
+>3 beshort x \b, driver_id %x
+>5 belong x \b, devtype %x
diff --git a/magic/Magdir/flash b/magic/Magdir/flash
index b06f879..b48abe9 100644
--- a/magic/Magdir/flash
+++ b/magic/Magdir/flash
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: flash,v 1.11 2014/05/02 00:26:49 christos Exp $
+# $File: flash,v 1.14 2017/05/25 20:09:55 christos Exp $
# flash: file(1) magic for Macromedia Flash file format
#
# See
@@ -10,23 +10,45 @@
# en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
#
-0 name swf-details
->0 string F Macromedia Flash data
+0 name swf-details
+
+>0 string F
+>>8 byte&0xfd 0x08 Macromedia Flash data
+!:mime application/x-shockwave-flash
+>>>3 byte x \b, version %d
+>>8 byte&0xfe 0x10 Macromedia Flash data
+!:mime application/x-shockwave-flash
+>>>3 byte x \b, version %d
+>>8 byte 0x18 Macromedia Flash data
+!:mime application/x-shockwave-flash
+>>>3 byte x \b, version %d
+>>8 beshort&0xff87 0x2000 Macromedia Flash data
!:mime application/x-shockwave-flash
->0 string C Macromedia Flash data (compressed)
+>>>3 byte x \b, version %d
+>>8 beshort&0xffe0 0x3000 Macromedia Flash data
!:mime application/x-shockwave-flash
->0 string Z Macromedia Flash data (lzma compressed)
+>>>3 byte x \b, version %d
+>>8 byte&0x7 0
+>>>8 ubyte >0x2f
+>>>>9 ubyte <0x20 Macromedia Flash data
+!:mime application/x-shockwave-flash
+>>>>>3 byte x \b, version %d
+
+>0 string C
+>>8 byte 0x78 Macromedia Flash data (compressed)
+!:mime application/x-shockwave-flash
+>>>3 byte x \b, version %d
+
+>0 string Z
+>>8 byte 0x5d Macromedia Flash data (lzma compressed)
!:mime application/x-shockwave-flash
->3 byte x \b, version %d
+>>>3 byte x \b, version %d
-1 string WS
->4 lelong !0
->>3 byte 255 Suspicious
->>>0 use swf-details
->>3 ubyte <32
->>>3 ubyte !0
->>>>0 use swf-details
+1 string WS
+>4 ulelong >14
+>>3 ubyte !0
+>>>0 use swf-details
# From: Cal Peake <cp@absolutedigital.net>
0 string FLV\x01 Macromedia Flash Video
@@ -34,7 +56,7 @@
#
# Yosu Gomez
-0 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document
-0 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document
+0 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document
+0 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document
# From Dave Wilson
-0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document
+0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document
diff --git a/magic/Magdir/flif b/magic/Magdir/flif
new file mode 100644
index 0000000..9406208
--- /dev/null
+++ b/magic/Magdir/flif
@@ -0,0 +1,36 @@
+
+#------------------------------------------------------------------------------
+# $File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $
+# flif: Magic data for file(1) command.
+# FLIF (Free Lossless Image Format)
+
+0 string FLIF FLIF
+>4 string <H image data
+>>6 beshort x \b, %u
+>>8 beshort x \bx%u
+>>5 string 1 \b, 8-bit/color,
+>>5 string 2 \b, 16-bit/color,
+>>4 string 1 \b, grayscale, non-interlaced
+>>4 string 3 \b, RGB, non-interlaced
+>>4 string 4 \b, RGBA, non-interlaced
+>>4 string A \b, grayscale
+>>4 string C \b, RGB, interlaced
+>>4 string D \b, RGBA, interlaced
+>4 string >H \b, animation data
+>>5 ubyte <255 \b, %i frames
+>>>7 beshort x \b, %u
+>>>9 beshort x \bx%u
+>>>6 string =1 \b, 8-bit/color
+>>>6 string =2 \b, 16-bit/color
+>>5 ubyte 0xFF
+>>>6 beshort x \b, %i frames,
+>>>9 beshort x \b, %u
+>>>11 beshort x \bx%u
+>>>8 string =1 \b, 8-bit/color
+>>>8 string =2 \b, 16-bit/color
+>>4 string =Q \b, grayscale, non-interlaced
+>>4 string =S \b, RGB, non-interlaced
+>>4 string =T \b, RGBA, non-interlaced
+>>4 string =a \b, grayscale
+>>4 string =c \b, RGB, interlaced
+>>4 string =d \b, RGBA, interlaced
diff --git a/magic/Magdir/fonts b/magic/Magdir/fonts
index 4b3173c..7e9b0da 100644
--- a/magic/Magdir/fonts
+++ b/magic/Magdir/fonts
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: fonts,v 1.27 2014/04/30 21:41:02 christos Exp $
+# $File: fonts,v 1.37 2017/06/24 00:39:00 christos Exp $
# fonts: file(1) magic for font data
#
0 search/1 FONT ASCII vfont text
@@ -15,6 +15,56 @@
6 string %!FontType1 PostScript Type 1 font program data
0 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text
+# Summary: PostScript Type 1 Printer Font Metrics
+# URL: https://en.wikipedia.org/wiki/PostScript_fonts
+# Reference: http://partners.adobe.com/public/developer/en/font/5178.PFM.pdf
+# Modified by: Joerg Jenderek
+# Note: moved from ./msdos magic
+# dfVersion 256=0100h
+0 uleshort 0x0100
+# GRR: line above is too general as it catches also TrueType font,
+# raw G3 data FAX, WhatsApp encrypted and Panorama database
+# dfType 129=0081h
+>66 uleshort 0x0081
+# dfVertRes 300=012Ch not needed as additional test
+#>>70 uleshort 0x012c
+# dfHorizRes 300=012Ch
+#>>>72 uleshort 0x012c
+# dfDriverInfo points to postscript information section
+>>(101.l) string/c Postscript Printer Font Metrics
+# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID
+!:mime application/x-font-pfm
+# AppleShare Print Server
+#!:apple ASPS????
+!:ext pfm
+# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking
+#>>>6 string >\060 - %-.60s
+# dfDriverInfo
+>>>139 ulelong >0
+# often abbreviated and same as filename
+>>>>(139.l) string x %s
+# dfSize
+>>>2 ulelong x \b, %d bytes
+# dfFace 210=D2h 9Eh
+>>>105 ulelong >0
+# Windows font name
+>>>>(105.l) string x \b, %s
+# dfItalic
+>>>80 ubyte 1 italic
+# dfUnderline
+>>>81 ubyte 1 underline
+# dfStrikeOut
+>>>82 ubyte 1 strikeout
+# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc
+>>>83 uleshort >699 bold
+# dfPitchAndFamily 16 17 48 49 64 65
+>>>90 ubyte 16 serif
+>>>90 ubyte 17 serif proportional
+#>>>90 ubyte 48 other
+>>>90 ubyte 49 proportional
+>>>90 ubyte 64 script
+>>>90 ubyte 65 script proportional
+
# X11 font files in SNF (Server Natural Format) format
# updated by Joerg Jenderek at Feb 2013
# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
@@ -22,18 +72,39 @@
#>104 belong 00000004 X11 SNF font data, MSB first
!:mime application/x-font-sfn
# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
-0 lelong 00000004
+0 lelong 00000004
>104 lelong 00000004 X11 SNF font data, LSB first
!:mime application/x-font-sfn
# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
0 search/1 STARTFONT\ X11 BDF font text
+# From: Joerg Jenderek
+# URL: http://grub.gibibit.com/New_font_format
+# Reference: util/grub-mkfont.c
+# include/grub/fontformat.h
+# FONT_FORMAT_SECTION_NAMES_FILE
+0 string FILE
+# FONT_FORMAT_PFF2_MAGIC
+>8 string PFF2
+# leng 4 only at the moment
+>>4 ubelong 4
+# FONT_FORMAT_SECTION_NAMES_FONT_NAME
+>>>12 string NAME GRUB2 font
+!:mime application/x-font-pf2
+!:ext pf2
+# length of font_name
+>>>>16 ubelong >0
+# font_name
+>>>>>20 string >\0 "%-s"
+
# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
-0 string \001fcp X11 Portable Compiled Font data
->12 byte 0x02 \b, LSB first
->12 byte 0x0a \b, MSB first
+0 string \001fcp X11 Portable Compiled Font data,
+>12 lelong ^0x08 bit: LSB,
+>12 lelong &0x08 bit: MSB,
+>12 lelong ^0x04 byte: LSB first
+>12 lelong &0x04 byte: MSB first
0 string D1.0\015 X11 Speedo font data
#------------------------------------------------------------------------------
@@ -58,43 +129,205 @@
4098 string DOSFONT DOSFONT2 encrypted font data
# downloadable fonts for browser (prints type) anthon@mnt.org
-0 string PFR1 PFR1 font
+# https://tools.ietf.org/html/rfc3073
+0 string PFR1 Portable Font Resource font data (new)
>102 string >0 \b: %s
+0 string PFR0 Portable Font Resource font data (old)
+>4 beshort >0 version %d
# True Type fonts
-0 string \000\001\000\000\000 TrueType font data
-!:mime application/x-font-ttf
+# Modified by: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/TrueType
+# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/
+#
+# sfnt version "typ1" used by some Apple, but no example found
+0 string typ1
+>0 use sfnt-font
+>0 use sfnt-names
+# sfnt version "true" used by some Apple
+0 string true
+>0 use sfnt-font
+>0 use sfnt-names
+# GRR: below test is too general
+# sfnt version often 0x00010000
+0 string \000\001\000\000
+>0 use sfnt-font
+>0 use sfnt-names
+# validate and display sfnt font data like number of tables
+0 name sfnt-font
+# file 5.30 version assumes 00FFh as maximal number of tables
+#>4 ubeshort <0x0100
+# maximal 27 tables found like in Skia.ttf
+# 46 different table names mentioned on Apple specification
+# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number
+>4 ubeshort <47
+# skip bad examples with garbage table names like in a5.show HYPERC MAC
+# tag names consist of up to four characters padded with spaces at end like
+# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ...
+>>12 regex/4l \^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ]
+#>>>0 ubelong x \b, sfnt version 0x%x
+>>>0 ubelong !0x4f54544f TrueType
+!:mime application/font-sfnt
+#!:mime font/ttf
+!:apple ????tfil
+# .ttf for TrueType font
+# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe
+!:ext ttf/tte
+# sfnt version 4F54544Fh~OTTO
+>>>0 ubelong =0x4f54544f OpenType
+!:mime application/font-sfnt
+#!:mime font/otf
+!:apple ????OTTO
+!:ext otf
+>>>0 ubelong x Font data
+# DSIG=44454947h table name implies a digitally signed font
+# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432
+>>>12 search/432 DSIG \b, digitally signed
+>>>4 ubeshort x \b, %d tables
+# minimal 9 tables found like in NISC18030.ttf
+#>>>4 ubeshort <10 TMIN
+#>>>4 ubeshort >24 TBIG
+# table directory entries
+>>>12 string x \b, 1st "%4.4s"
+
+# search and display 1st name in sfnt font which is often copyright text
+# does not work inside font collections
+0 name sfnt-names
+# search for naming table
+>12 search/432/s name
+# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf
+#>>>>&8 ubelong >0x0100bd27 BIGGEST OFFSET
+>>&8 ubelong >0x00100000
+# offset of name table
+>>>&-4 ubelong x \b, name offset 0x%x
+# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h
+>>&8 ubelong <0x00100000
+>>>&-16 ubelong x
+# name table
+>>>>(&8.L) ubequad x
+# invalid format selector
+#>>>>>&-8 ubeshort !0 \b, invalid selector %x
+# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf
+# maximal 1227 name records found like in Apple Chancery.ttf
+#>>>>>&-6 ubeshort <0x4 mincount
+#>>>>>&-6 ubeshort >130 maxcount
+>>>>>&-6 ubeshort x \b, %d names
+# offset to start of string storage from start of table
+#>>>>>&-4 ubeshort x \b, record offset %d
+# 1st name record
+# string offset from start of storage area
+#>>>>>&8 ubeshort x \b, string offset %d
+# string length
+#>>>>>&6 ubeshort x \b, string length %d
+# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf
+# also found 0 like in SWZCONLN.TTF
+#>>>>>&6 ubeshort <8 MIN STRING
+# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf
+#>>>>>&6 ubeshort >805 MAX STRING
+# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft
+#>>>>>&-2 ubeshort >3 BAD PLATFORM
+>>>>>&-2 ubeshort 0 \b, Unicode
+>>>>>&-2 ubeshort 1 \b, Macintosh
+>>>>>&-2 ubeshort 3 \b, Microsoft
+# languageID (0~english Macintosh, 0409h~english Microsoft, ...)
+>>>>>&2 ubeshort >0 \b, language 0x%x
+# name identifiers
+# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ...
+>>>>>&4 ubeshort >0 \b, type %d string
+# platform specific encoding:
+# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0
+#>>>>>&0 ubeshort x \b, %d encoding
+>>>>>&0 ubeshort 0
+# handle only name string offset 0 because do not know how to add 2 relative offsets
+>>>>>>&6 ubeshort 0
+>>>>>>>&(&-14.S-18) ubyte !0
+# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h
+# often copyright string that starts like \251 2006 The Monotype Corporation
+>>>>>>>>&-1 string x \b, %-11.96s
+# test for unicode string
+>>>>>>>&(&-14.S-18) ubyte 0
+>>>>>>>>&0 lestring16 x \b, %-11.96s
+# unicode encoding
+>>>>>&0 ubeshort >0
+>>>>>>&6 ubeshort 0
+>>>>>>>&(&-14.S-17) lestring16 x \b, %-11.96s
0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
# TrueType/OpenType font collections (.ttc)
+# URL: https://en.wikipedia.org/wiki/OpenType
# http://www.microsoft.com/typography/otspec/otff.htm
-0 string ttcf TrueType font collection data
->4 belong 0x00010000 \b, 1.0
->>8 belong >0 \b, %d fonts
->4 belong 0x00020000 \b, 2.0
->>8 belong >0 \b, %d fonts
+# Modified by: Joerg Jenderek
+# Note: container for TrueType, OpenType font
+0 string ttcf
+# skip ASCII text
+>4 ubyte 0
+# sfnt version often 0x00010000 of 1st table is TrueType
+>>(12.L) ubelong !0x4f54544f TrueType
+#!:mime font/ttf
+!:apple ????tfil
+!:ext ttc
+# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font
+>>(12.L) ubelong =0x4f54544f OpenType
+#!:mime font/otf
+!:apple ????OTTO
+# no example found for otc
+!:ext ttc/otc
+>>4 ubyte x font collection data
+!:mime application/font-sfnt
+#!:mime font/collection
+# TCC version
+>>4 belong 0x00010000 \b, 1.0
+>>4 belong 0x00020000 \b, 2.0
+>>8 ubelong >0 \b, %d fonts
+# array offset size = fonts * offsetsize = fonts * 4
+>>(8.L*4) ubequad x
# 0x44454947 = 'DSIG'
->>>16 belong 0x44534947 \b, digitally signed
+>>>&4 belong 0x44534947 \b, digitally signed
+# offset to 1st font
+>>12 ubelong x \b, at 0x%x
+# point to 1st font that starts with sfnt version
+>>(12.L) use sfnt-font
# Opentype font data from Avi Bercovich
0 string OTTO OpenType font data
!:mime application/vnd.ms-opentype
-# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
-0 string SplineFontDB: Spline Font Database
+# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
+0 string SplineFontDB: Spline Font Database
!:mime application/vnd.font-fontforge-sfd
>14 string x version %s
# EOT
-34 string LP Embedded OpenType (EOT)
+0x40 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+>0x22 string LP Embedded OpenType (EOT)
+# workaround until there's lepstring16
+# >>0x52 lepstring16/h >\0 \b, %s family
+>>0x52 short !0
+>>>0x54 lestring16 x \b, %s family
!:mime application/vnd.ms-fontobject
# Web Open Font Format (.woff)
+0 name woff
+>4 belong 0x00010000 \b, TrueType
+>4 belong 0x4F54544F \b, CFF
+>4 belong 0x74727565 \b, TrueType
+>4 default x
+>>4 belong x \b, flavor %d
+>8 belong x \b, length %d
+#>12 beshort x \b, numTables %d
+#>14 beshort x \b, reserved %d
+#>16 belong x \b, totalSfntSize %d
+
# http://www.w3.org/TR/WOFF/
0 string wOFF Web Open Font Format
->4 belong x \b, flavor %d
->8 belong x \b, length %d
+>0 use woff
>20 beshort x \b, version %d
>22 beshort x \b.%d
+# http://www.w3.org/TR/WOFF2/
+0 string wOF2 Web Open Font Format (Version 2)
+>0 use woff
+#>20 belong x \b, totalCompressedSize %d
+>24 beshort x \b, version %d
+>26 beshort x \b.%d
diff --git a/magic/Magdir/fortran b/magic/Magdir/fortran
index 921beec..6abc2f7 100644
--- a/magic/Magdir/fortran
+++ b/magic/Magdir/fortran
@@ -1,7 +1,9 @@
#------------------------------------------------------------------------------
-# $File: fortran,v 1.8 2014/06/03 19:01:34 christos Exp $
+# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $
# FORTRAN source
-0 regex/100l \^[Cc][\ \t] FORTRAN program
+# Check that the first 100 lines start with C or whitespace first.
+0 regex/100l !\^[^Cc\ \t].*$
+>0 regex/100l \^[Cc][\ \t] FORTRAN program text
!:mime text/x-fortran
!:strength - 5
diff --git a/magic/Magdir/frame b/magic/Magdir/frame
index babe890..08f884d 100644
--- a/magic/Magdir/frame
+++ b/magic/Magdir/frame
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $
+# $File: frame,v 1.13 2015/08/29 07:10:35 christos Exp $
# frame: file(1) magic for FrameMaker files
#
# This stuff came on a FrameMaker demo tape, most of which is
@@ -41,10 +41,10 @@
>10 string 1.0 (1.0
>13 byte x %c)
# XXX - this book entry should be verified, if you find one, uncomment this
-#0 string \<Book\ FrameMaker Book (ASCII) file
+#0 string \<Book\040 FrameMaker Book (ASCII) file
#!:mime application/x-mif
#>6 string 3.0 (3.0)
#>6 string 2.0 (2.0)
#>6 string 1.0 (1.0)
-0 string \<Maker Intermediate Print File FrameMaker IPL file
+0 string \<Maker\040Intermediate\040Print\040File FrameMaker IPL file
!:mime application/x-mif
diff --git a/magic/Magdir/fsav b/magic/Magdir/fsav
index ecdc4f6..5714798 100644
--- a/magic/Magdir/fsav
+++ b/magic/Magdir/fsav
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: fsav,v 1.13 2013/03/25 17:18:47 christos Exp $
+# $File: fsav,v 1.14 2017/03/17 21:35:28 christos Exp $
# fsav: file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon@mnt.org)
@@ -29,11 +29,11 @@
#>>>>10 byte 11 \b12-
#>>>>9 ubyte >0 \b%02d)
# ftp://ftp.f-prot.com/pub/sign2.zip
-#0 ubyte 0x62
-#>1 ubyte 0xF5
-#>>2 ubyte 0x1
-#>>>3 ubyte 0x1
-#>>>>4 ubyte 0x0e
+#0 ubyte 0x62
+#>1 ubyte 0xF5
+#>>2 ubyte 0x1
+#>>>3 ubyte 0x1
+#>>>>4 ubyte 0x0e
#>>>>>13 ubyte >0 fsav virus signatures
#>>>>>>11 ubyte x size 0x%02x
#>>>>>>12 ubyte x \b%02x
@@ -44,16 +44,16 @@
# .cvd files start with a 512 bytes colon separated header
# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
# + gzipped tarball files
-0 string ClamAV-VDB:
+0 string ClamAV-VDB:
>11 string >\0 Clam AntiVirus database %-.23s
->>34 string :
->>>35 string !: \b, version
+>>34 string :
+>>>35 string !: \b, version
>>>>35 string x \b%-.1s
->>>>>36 string !:
+>>>>>36 string !:
>>>>>>36 string x \b%-.1s
->>>>>>>37 string !:
+>>>>>>>37 string !:
>>>>>>>>37 string x \b%-.1s
->>>>>>>>>38 string !:
+>>>>>>>>>38 string !:
>>>>>>>>>>38 string x \b%-.1s
>512 string \037\213 \b, gzipped
>769 string ustar\0 \b, tarred
diff --git a/magic/Magdir/games b/magic/Magdir/games
index 779bc6c..9f72661 100644
--- a/magic/Magdir/games
+++ b/magic/Magdir/games
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: games,v 1.14 2014/04/30 21:41:02 christos Exp $
+# $File: games,v 1.15 2017/03/17 21:35:28 christos Exp $
# games: file(1) for games
# Fabio Bonelli <fabiobonelli@libero.it>
@@ -39,7 +39,7 @@
#0 string -1\x0a Quake I demo
#>30 string x version %.4s
-#>61 string x level %s
+#>61 string x level %s
#0 string 5\x0a Quake I save
@@ -240,7 +240,7 @@
# Summary: NetImmerse game engine file
# Extension .nif
# Created by: Abel Cheung <abelcheung@gmail.com>
-0 string NetImmerse\ File\ Format,\ Versio
+0 string NetImmerse\ File\ Format,\ Versio
>&0 string n\ NetImmerse game engine file
>>&0 regex [0-9a-z.]+ \b, version %s
diff --git a/magic/Magdir/gcc b/magic/Magdir/gcc
index 893d0d9..ae98dc7 100644
--- a/magic/Magdir/gcc
+++ b/magic/Magdir/gcc
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: gcc,v 1.4 2009/09/19 16:28:09 christos Exp $
+# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $
# gcc: file(1) magic for GCC special files
#
0 string gpch GCC precompiled header
@@ -12,6 +12,6 @@
# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
>4 byte 67 for C
->4 byte 111 for Objective C
+>4 byte 111 for Objective-C
>4 byte 43 for C++
->4 byte 79 for Objective C++
+>4 byte 79 for Objective-C++
diff --git a/magic/Magdir/gconv b/magic/Magdir/gconv
new file mode 100644
index 0000000..eec5ddc
--- /dev/null
+++ b/magic/Magdir/gconv
@@ -0,0 +1,10 @@
+
+#------------------------------------------------------------------------------
+# $File: gconv
+# gconv: file(1) magic for iconv/gconv module configuration cache
+#
+# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC
+#
+# From: Marek Cermak <macermak@redhat.com>
+#
+0 lelong 0x20010324 gconv module configuration cache data
diff --git a/magic/Magdir/geo b/magic/Magdir/geo
index 9a765fe..f93abd8 100644
--- a/magic/Magdir/geo
+++ b/magic/Magdir/geo
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: geo,v 1.3 2013/01/04 00:47:02 christos Exp $
+# $File: geo,v 1.4 2017/03/17 21:35:28 christos Exp $
# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
######################################################################
@@ -57,7 +57,7 @@
4 beshort 0x2002 GeoSwath RDF
0 string Start:- GeoSwatch auf text file
-# Seabeam 2100
+# Seabeam 2100
# mbsystem code mb41
0 string SB2100 SeaBeam 2100 multibeam sonar
0 string SB2100DR SeaBeam 2100 DR multibeam sonar
diff --git a/magic/Magdir/gnu b/magic/Magdir/gnu
index e4a0a16..8d5c972 100644
--- a/magic/Magdir/gnu
+++ b/magic/Magdir/gnu
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: gnu,v 1.15 2014/02/06 14:21:02 christos Exp $
+# $File: gnu,v 1.18 2017/03/17 21:35:28 christos Exp $
# gnu: file(1) magic for various GNU tools
#
# GNU nlsutils message catalog file format
@@ -34,8 +34,11 @@
# This magic is not particularly good, as the keyrings don't have true
# magic. Nevertheless, it covers many keyrings.
-0 beshort 0x9901 GPG key public ring
-!:mime application/x-gnupg-keyring
+0 ubeshort-0x9901 <2
+>3 byte 4
+>>4 bedate x GPG key public ring, created %s
+!:mime application/x-gnupg-keyring
+
# Symmetric encryption
0 leshort 0x0d8c
@@ -68,7 +71,7 @@
# they will ordinarily reported as "compressed", but at least -z helps
39 string =<gmr:Workbook Gnumeric spreadsheet
-# From: James Youngman <jay@gnu.org>
+# From: James Youngman <jay@gnu.org>
# gnu find magic
0 string \0LOCATE GNU findutils locate database data
>7 string >\0 \b, format %s
@@ -79,5 +82,7 @@
0 long 0x950412DE GNU-format message catalog data
# gettext message catalogue
-0 regex \^msgid\ GNU gettext message catalogue text
+0 search/1024 \nmsgid
+>&0 search/1024 \nmsgstr GNU gettext message catalogue text
+!:strength +100
!:mime text/x-po
diff --git a/magic/Magdir/gpt b/magic/Magdir/gpt
index c48a58f..76a223c 100644
--- a/magic/Magdir/gpt
+++ b/magic/Magdir/gpt
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: gpt,v 1.3 2014/04/30 21:41:02 christos Exp $
+# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $
#
# GPT Partition table patterns.
# Author: Rogier Goossens (goossens.rogier@gmail.com)
@@ -36,7 +36,7 @@
>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
->>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
@@ -66,7 +66,7 @@
>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
->>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
@@ -96,7 +96,7 @@
>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
->>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
@@ -126,7 +126,7 @@
>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
->>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
@@ -166,7 +166,7 @@
##>(8.l*8192) string EFI\ PART
##>>(8.l*8192) use gpt-mbr-type
##>>&-8 use gpt-table
-##>>0 ubyte x of 8192 bytes
+##>>0 ubyte x of 8192 bytes
##>(8.l*8192) string !EFI\ PART
##>>(8.l*4096) string EFI\ PART GPT partition table
##>>>0 use gpt-mbr-type
@@ -212,7 +212,7 @@
>>486 ulelong !1 \b (nonstandard: not at LBA 1)
# GPT with protective MBR entry in partition 4
>498 ubyte 0xee
->>502 ulelong 1
+>>502 ulelong 1
>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
>>502 ulelong !1 \b (nonstandard: not at LBA 1)
diff --git a/magic/Magdir/gpu b/magic/Magdir/gpu
new file mode 100644
index 0000000..62e30d0
--- /dev/null
+++ b/magic/Magdir/gpu
@@ -0,0 +1,28 @@
+
+#------------------------------------------------------------------------------
+# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $
+# gpu: file(1) magic for GPU input files
+
+# Standard Portable Intermediate Representation (SPIR)
+# Documentation: https://www.khronos.org/spir
+# Typical file extension: .spv
+
+0 belong 0x07230203 Khronos SPIR-V binary, big-endian
+>4 belong x \b, version 0x%08x
+>8 belong x \b, generator 0x%08x
+
+0 lelong 0x07230203 Khronos SPIR-V binary, little-endian
+>4 lelong x \b, version 0x%08x
+>8 lelong x \b, generator 0x%08x
+
+# Vulkan Trace file
+# Documentation:
+# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\
+# vktrace_trace_packet_identifiers.h
+# Typical file extension: .vktrace
+
+8 lequad 0xABADD068ADEAFD0C Vulkan trace file, little-endian
+>0 leshort x \b, version %d
+
+8 bequad 0xABADD068ADEAFD0C Vulkan trace file, big-endian
+>0 beshort x \b, version %d
diff --git a/magic/Magdir/gringotts b/magic/Magdir/gringotts
index 2bfef1b..b674754 100644
--- a/magic/Magdir/gringotts
+++ b/magic/Magdir/gringotts
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: gringotts,v 1.5 2009/09/19 16:28:09 christos Exp $
+# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $
# gringotts: file(1) magic for Gringotts
# http://devel.pluto.linux.it/projects/Gringotts/
# author: Germano Rizzo <mano@pluto.linux.it>
@@ -9,10 +9,10 @@
#file format 1
>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
#file format 2
->3 string 2 v.2, MCRYPT S2K,
+>3 string 2 v.2, MCRYPT S2K,
>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
>>8 byte&0x70 0x10 SERPENT crypt,
->>8 byte&0x70 0x20 TWOFISH crypt,
+>>8 byte&0x70 0x20 TWOFISH crypt,
>>8 byte&0x70 0x30 CAST-256 crypt,
>>8 byte&0x70 0x40 SAFER+ crypt,
>>8 byte&0x70 0x50 LOKI97 crypt,
@@ -27,10 +27,10 @@
>>8 byte&0x03 0x02 lvl.6
>>8 byte&0x03 0x03 lvl.9
#file format 3
->3 string 3 v.3, OpenPGP S2K,
+>3 string 3 v.3, OpenPGP S2K,
>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
>>8 byte&0x70 0x10 SERPENT crypt,
->>8 byte&0x70 0x20 TWOFISH crypt,
+>>8 byte&0x70 0x20 TWOFISH crypt,
>>8 byte&0x70 0x30 CAST-256 crypt,
>>8 byte&0x70 0x40 SAFER+ crypt,
>>8 byte&0x70 0x50 LOKI97 crypt,
diff --git a/magic/Magdir/hitachi-sh b/magic/Magdir/hitachi-sh
index 213d2d6..0238ed7 100644
--- a/magic/Magdir/hitachi-sh
+++ b/magic/Magdir/hitachi-sh
@@ -1,22 +1,28 @@
#------------------------------------------------------------------------------
-# $File: hitachi-sh,v 1.6 2013/01/29 19:31:33 christos Exp $
+# $File: hitachi-sh,v 1.8 2017/03/17 21:35:28 christos Exp $
# hitach-sh: file(1) magic for Hitachi Super-H
#
# Super-H COFF
#
-# below test line conflicts with 2nd NTFS filesystem sector
-0 beshort 0x0500 Hitachi SH big-endian COFF
+# updated by Joerg Jenderek at Oct 2015
+# https://en.wikipedia.org/wiki/COFF
+# https://de.wikipedia.org/wiki/Common_Object_File_Format
+# http://www.delorie.com/djgpp/doc/coff/filhdr.html
+# below test line conflicts with 2nd NTFS filesystem sector
# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
-#0 ubelong&0xFFFFNMPQ 0x0500NMPQ Hitachi SH big-endian COFF
->18 beshort&0x0002 =0x0000 object
->18 beshort&0x0002 =0x0002 executable
->18 beshort&0x0008 =0x0008 \b, stripped
->18 beshort&0x0008 =0x0000 \b, not stripped
-#
-0 leshort 0x0550 Hitachi SH little-endian COFF
->18 leshort&0x0002 =0x0000 object
->18 leshort&0x0002 =0x0002 executable
->18 leshort&0x0008 =0x0008 \b, stripped
->18 leshort&0x0008 =0x0000 \b, not stripped
+# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/)
+0 beshort 0x0500
+# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
+>18 ubeshort&0x8E80 0
+# use big endian variant of subroutine to display name+variables+flags
+# for common object formated files
+>>0 use \^display-coff
+
+0 leshort 0x0550
+# test for unused flag bits in f_flags
+>18 uleshort&0x8E80 0
+# use little endian variant of subroutine to
+# display name+variables+flags for common object formated files
+>>0 use display-coff
diff --git a/magic/Magdir/ibm370 b/magic/Magdir/ibm370
index 7887dc3..a49b28f 100644
--- a/magic/Magdir/ibm370
+++ b/magic/Magdir/ibm370
@@ -1,28 +1,28 @@
#------------------------------------------------------------------------------
-# $File: ibm370,v 1.9 2014/04/30 21:41:02 christos Exp $
+# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $
# ibm370: file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
# AIX 4.1's "/etc/magic" has
#
-# 0 short 0535 370 sysV executable
+# 0 short 0535 370 sysV executable
# >12 long >0 not stripped
# >22 short >0 - version %d
# >30 long >0 - 5.2 format
-# 0 short 0530 370 sysV pure executable
+# 0 short 0530 370 sysV pure executable
# >12 long >0 not stripped
# >22 short >0 - version %d
# >30 long >0 - 5.2 format
#
# instead of the "USS/370" versions of the same magic numbers.
#
-0 beshort 0537 370 XA sysV executable
+0 beshort 0537 370 XA sysV executable
>12 belong >0 not stripped
>22 beshort >0 - version %d
>30 belong >0 - 5.2 format
-0 beshort 0532 370 XA sysV pure executable
+0 beshort 0532 370 XA sysV pure executable
>12 belong >0 not stripped
>22 beshort >0 - version %d
>30 belong >0 - 5.2 format
diff --git a/magic/Magdir/ibm6000 b/magic/Magdir/ibm6000
index 7f45072..8b48f37 100644
--- a/magic/Magdir/ibm6000
+++ b/magic/Magdir/ibm6000
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: ibm6000,v 1.12 2013/09/16 15:12:42 christos Exp $
+# $File: ibm6000,v 1.13 2017/03/17 21:35:28 christos Exp $
# ibm6000: file(1) magic for RS/6000 and the RT PC.
#
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
@@ -21,7 +21,7 @@
0 beshort 0x01f7 64-bit XCOFF executable or object module
>20 belong 0 not stripped
# GRR: this test is still too general as it catches also many FATs of DOS filesystems
-4 belong &0x0feeddb0
+4 belong &0x0feeddb0
# real core dump could not be 32-bit and 64-bit together
>7 byte&0x03 !3 AIX core file
>>1 byte &0x01 fulldump
diff --git a/magic/Magdir/icc b/magic/Magdir/icc
index 37fa30e..55583b7 100644
--- a/magic/Magdir/icc
+++ b/magic/Magdir/icc
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: icc,v 1.1 2013/01/08 01:43:18 christos Exp $
+# $File: icc,v 1.5 2017/08/13 00:21:47 christos Exp $
# icc: file(1) magic for International Color Consortium file formats
#
@@ -11,41 +11,204 @@
# http://www.color.org/specification/ICC1v43_2010-12.pdf
#
# for Specification ICC.1:2010 (Profile version 4.3.0.0).
+# URL: http://fileformats.archiveteam.org/wiki/ICC_profile
+# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf
+# Update: Joerg Jenderek
#
# Bytes 36 to 39 contain a generic profile file signature of "acsp";
# bytes 40 to 43 "may be used to identify the primary platform/operating
# system framework for which the profile was created".
#
-# There are other fields that might be worth dumping as well.
-#
+# check and display ICC/ICM color profile
+0 name color-profile
+>36 string acsp
+# skip ASCII like Cognacspirit.txt by month <= 12
+>>26 ubeshort <13
+# platform/operating system. Only 5 mentioned
+#
# This appears to be what's used for Apple ColorSync profiles.
# Instead of adding that, Apple just changed the generic "acsp" entry
# to be for "ColorSync ICC Color Profile" rather than "Kodak Color
# Management System, ICC Profile".
# Yes, it's "APPL", not "AAPL"; see the spec.
-36 string acspAPPL ColorSync ICC Profile
-!:mime application/vnd.iccprofile
+>>>40 string APPL ColorSync
# Microsoft ICM color profile
-36 string acspMSFT Microsoft ICM Color Profile
-!:mime application/vnd.iccprofile
+>>>40 string MSFT Microsoft
# Yes, that's a blank after "SGI".
-36 string acspSGI\ SGI ICC Profile
-!:mime application/vnd.iccprofile
+>>>40 string SGI\ SGI
# XXX - is this what's used for the Sun KCMS or not? The standard file
# uses just "acsp" for that, but Apple's file uses it for "ColorSync",
# and there *is* an identified "primary platform" value of SUNW.
-36 string acspSUNW Sun KCMS ICC Profile
+>>>40 string SUNW Sun KCMS
+
+# 5th platform
+>>>40 string TGNT Taligent
+
+# remaining "l" "e" of "color profile" printed later to avoid error
+>>>40 string x color profi
+#>>>40 string x (%.4s)
!:mime application/vnd.iccprofile
+# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found
+>>>8 ubyte =2
+# do not use empty message text to a avoid error like
+# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type
+# file.exe: could not find any valid magic files!
+>>>>9 ubyte !0 \ble
+!:ext icc/icm
+# minor version
+>>>>9 ubyte =0 \bl
+# Kodak colour management system
+>>>>>4 string =KCMS \be
+!:ext icc/icm/cc
+>>>>>4 string !KCMS \be
+!:ext icc/icm
+>>>8 ubyte !2 \ble
+!:ext icc
+# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h)
+>>>8 ubyte x %u
+>>>9 ubyte/16 x \b.%u
+# reserved and shall be null but 205.205 in umx1220u.icm
+>>>10 ubyte >0 \b.%u
+>>>>11 ubyte >0 \b.%u
+# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF "
+# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm
+>>>4 string >\ \b, type %.2s
+>>>>6 string >\ \b%.1s
+>>>>>7 string >\ \b%.1s
+# colour space "XYZ " "Lab " "RGB " CMYK GRAY ...
+>>>16 string x \b, %.3s
+>>>19 string >\ \b%.1s
+# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes
+# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc
+>>>20 string >\0 \b/%.3s
+>>>>23 string >\ \b%.1s
+# eleven device classes
+>>>12 string x \b-%.4s device
+# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm
+>>>52 string >\040
+# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm"
+>>>>52 ubelong !0x6e6f6e65
+# device manufacturer field like "HP " "IBM " EPSO
+>>>>>48 string x \b, %.2s
+>>>>>50 string >\ \b%.1s
+>>>>>51 string >\ \b%.1s
+# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC
+>>>>>52 string >\ \ \b/%.3s
+>>>>>>55 string >\ \b%.1s
+>>>>>52 string x model
+# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm
+>>>80 string >\0 by %.2s
+>>>>82 string >\ \b%.1s
+>>>>>83 string >\ \b%.1s
+# profile size
+>>>0 ubelong x \b, %u bytes
+# skip invalid date 0 like in linearSRGB.icc
+>>>24 ubequad !0
+# datetime dd-mm-yyyy hh:mm:ss
+>>>>28 ubeshort x \b, %u
+# month <= 12
+>>>>26 ubeshort x \b-%u
+# year
+>>>>24 ubeshort x \b-%u
+# do not display midnight time like in CNHP8308.ICC
+>>>>30 ubequad&0xFFffFFffFFff0000 !0
+# hour <= 24
+>>>>>30 ubeshort x %u
+# minutes <= 59
+>>>>>32 ubeshort x \b:%.2u
+# seconds <= 59
+>>>>>34 ubeshort x \b:%.2u
+# vendor specific flags like 2 in HPCLJ5.ICM
+>>>44 ubeshort >0 \b, 0x%x vendor flags
+# profile flags bits 0-2 of least 16 used by ICC
+#>>>44 ubelong >0 \b, 0x%x flags
+# icEmbeddedProfileTrue
+>>>44 ubelong &1 \b, embedded
+# icEmbeddedProfileFalse
+#>>>44 ubelong ^1 \b, not embedded
+# icUseWithEmbeddedDataOnly
+>>>44 ubelong &2 \b, dependently
+# icUseAnywhere
+#>>>44 ubelong ^2 \b, independently
+>>>44 ubelong &4 \b, MCS
+#>>>44 ubelong ^4 \b, no MCS
+# vendor specific device attributes 1~srgb.icc
+# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM
+>>>56 ubelong >0 \b, 0x%x vendor attribute
+# ICC device attributes bits 0-7 used
+#>>>60 ubelong x \b, 0x%x attribute
+# http://www.color.org/icc34.h
+>>>60 ubelong &0x01 \b, transparent
+#>>>60 ubelong ^0x01 \b, reflective
+>>>60 ubelong &0x02 \b, matte
+#>>>60 ubelong ^0x02 \b, glossy
+>>>60 ubelong &0x04 \b, negative
+#>>>60 ubelong ^0x04 \b, positive
+>>>60 ubelong &0x08 \b, black&white
+#>>>60 ubelong ^0x08 \b, colour
+>>>60 ubelong &0x10 \b, non-paper
+#>>>60 ubelong ^0x10 \b, paper
+>>>60 ubelong &0x20 \b, non-textured
+#>>>60 ubelong ^0x20 \b, textured
+>>>60 ubelong &0x40 \b, non-isotropic
+#>>>60 ubelong ^0x40 \b, isotropic
+>>>60 ubelong &0x80 \b, self-luminous
+#>>>60 ubelong ^0x80 \b, non-self-luminous
+# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM
+>>>64 ubelong >3 \b, 0x%x rendering intent
+#>>>64 ubelong =0 \b, perceptual
+>>>64 ubelong =1 \b, relative colorimetric
+>>>64 ubelong =2 \b, saturation
+>>>64 ubelong =3 \b, absolute colorimetric
+# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d
+>>>71 ubequad !0xd6000100000000d3 \b, PCS
+# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found
+# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm
+>>>>68 ubelong !0x0000f6d5 X=0x%x
+# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm
+>>>>72 ubelong !0x00010000 Y=0x%x
+# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found
+# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm
+>>>>76 ubelong !0x0000d32d Z=0x%x
+# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321.
+>>>84 ubequad >0 \b, 0x%llx MD5
+# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD
+#>>100 ubequad x \b 0x%llx reserved
+# tag table
+# 6 <= tags count <= 43
+#>>>128 ubelong >43 \b, %u tags
+>>>128 ubelong x
+# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt"
+# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508
+>>>>132 search/508 cprt
+# but no copyright tag in linearSRGB.icc
+# beneath /System/Library/Frameworks/WebKit.framework/
+# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources
+>>>>132 default x \b, no copyright tag
+# 1st tag
+#>>>132 string x \b, 1st tag %.4s
+#>>>136 ubelong x 0x%x offset
+#>>>140 ubelong x 0x%x len
+# 2nd tag,...
+# look also for profileDescriptionTag "desc"
+>>>132 search/508 desc
+# look further for TextDescriptionType "desc" signature
+>>>>(&0.L) string =desc
+>>>>>&4 pstring/l x "%s"
+# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc
+>>>>(&0.L) string =mluc
+>>>>>&(&8.L) ubequad x
+>>>>>>&4 bestring16 x '%s'
# Any other profile.
# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
# and use "acsp" for everything else and dump the "primary platform"
# string in those cases?
-36 string acsp ICC Profile
-!:mime application/vnd.iccprofile
+36 string acsp
+>0 use color-profile
diff --git a/magic/Magdir/iff b/magic/Magdir/iff
index b991ab7..9437dd6 100644
--- a/magic/Magdir/iff
+++ b/magic/Magdir/iff
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: iff,v 1.13 2011/09/06 11:00:06 christos Exp $
+# $File: iff,v 1.14 2015/09/07 10:03:21 christos Exp $
# iff: file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
@@ -62,6 +62,7 @@
# These go at the end of the iff rules
#
+# David Griffith <dave@661.org>
# I don't see why these might collide with anything else.
#
# Interactive Fiction related formats
@@ -69,3 +70,4 @@
>8 string IFRS \b, Blorb Interactive Fiction
>>24 string Exec with executable chunk
>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal)
+!:mime application/x-blorb
diff --git a/magic/Magdir/images b/magic/Magdir/images
index 672dd88..f0d087b 100644
--- a/magic/Magdir/images
+++ b/magic/Magdir/images
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: images,v 1.102 2015/01/02 02:36:35 christos Exp $
+# $File: images,v 1.126 2017/06/11 22:25:44 christos Exp $
# images: file(1) magic for image formats (see also "iff", and "c-lang" for
# XPM bitmaps)
#
@@ -12,66 +12,211 @@
# Targa - matches `povray', `ppmtotga' and `xv' outputs
# by Philippe De Muyter <phdm@macqel.be>
+# URL: http://justsolve.archiveteam.org/wiki/TGA
+# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf
+# Update: Joerg Jenderek
# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
+# ,32 or 33 (both not observed)
# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
+# or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications
# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
# `tgatoppm' recognizes a superset (Index may be anything)
-1 belong&0xfff7ffff 0x01010000 Targa image data - Map
-!:strength + 2
->2 byte&8 8 - RLE
->12 leshort >0 %d x
->14 leshort >0 %d
-1 belong&0xfff7ffff 0x00020000 Targa image data - RGB
-!:strength + 2
->2 byte&8 8 - RLE
->12 leshort >0 %d x
->14 leshort >0 %d
-1 belong&0xfff7ffff 0x00030000 Targa image data - Mono
-!:strength + 2
->2 byte&8 8 - RLE
->12 leshort >0 %d x
->14 leshort >0 %d
+#
+# test of Color Map Type 0~no 1~color map
+# and Image Type 1 2 3 9 10 11 32 33
+# and Color Map Entry Size 0 15 16 24 32
+0 ubequad&0x00FeC400000000C0 0
+# skip more garbage by looking for positive image type
+>2 ubyte >0
+# skip some compiled terminfo by looking for image type less equal 33
+>>2 ubyte <34
+# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel sizes 15 16 24 32
+>>>16 ubyte <33
+# skip more by looking for pixel size 0Fh 10h 18h 20h
+>>>>16 ubyte&0xC0 0x00
+# Color Map
+>>>>>1 belong&0xfff7ffff 0x01010000
+>>>>>>0 use tga-image
+>>>>>1 belong&0xfff7ffff 0x00020000
+>>>>>>0 use tga-image
+>>>>>1 belong&0xfff7ffff 0x00030000
+>>>>>>0 use tga-image
+>>>>>1 default x
+# skip 260-16.ico by looking for no color map
+>>>>>>1 ubyte 0
+# implies no first map entry
+>>>>>>>3 uleshort 0
+>>>>>>>>0 use tga-image
+# display tga bitmap image information
+0 name tga-image
+>2 ubyte <34 Targa image data
+!:mime image/x-tga
+!:apple ????TPIC
+# normal extension .tga but some Truevision products used others:
+# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that)
+!:ext tga/tpic/icb/vda/vst
+# image type 1 2 3 9 10 11 32 33
+>2 ubyte&0xF7 1 - Map
+>2 ubyte&0xF7 2 - RGB
+# alpha channel
+>>17 ubyte&0x0F >0 \bA
+>2 ubyte&0xF7 3 - Mono
+# type not found, but by http://www.fileformat.info/format/tga/corion.htm
+# Compressed color-mapped data, using Huffman, Delta, and runlength encoding
+>2 ubyte 32 - Color
+# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process
+>2 ubyte 33 - Color
+# Color Map Type 0~no 1~color map
+>1 ubyte 1 (
+# first color map entry, 0 normal
+>>3 uleshort >0 \b%d-
+# color map length 0 2 1dh 3bh d9h 100h
+>>5 uleshort x \b%d)
+# 8~run length encoding bit
+>2 ubyte&0x08 8 - RLE
+# gimp can create big pictures!
+>12 uleshort >0 %d x
+>12 uleshort =0 65536 x
+# image height. 0 interpreted as 65536
+>14 uleshort >0 %d
+>14 uleshort =0 65536
+# Image Pixel Size 15 16 24 32
+>16 ubyte x x %d
+# X origin of image. 0 normal
+>8 uleshort >0 +%d
+# Y origin of image. 0 normal; positive for top
+>10 uleshort >0 +%d
+# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction
+>17 ubyte&0x0F >0 - %d-bit alpha
+# bits 5-4 give direction. normal bottom left
+>17 ubyte &0x20 - top
+#>17 ubyte ^0x20 - bottom
+>17 ubyte &0x10 - right
+#>17 ubyte ^0x10 - left
+# some info say other bits 6-7 should be zero
+# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm
+# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved
+#>17 ubyte&0xC0 0x00 - no interleave
+>17 ubyte&0xC0 0x40 - interleave
+>17 ubyte&0xC0 0x80 - four way interleave
+>17 ubyte&0xC0 0xC0 - reserved
+# positive length implies identification field
+>0 ubyte >0
+>>18 string x "%s"
+# last 18 bytes of newer tga file footer signature
+>18 search/4261301/s TRUEVISION-XFILE.\0
+# extension area offset if not 0
+>>&-8 ulelong >0
+# length of the extension area. normal 495 for version 2.0
+>>>(&-4.l) uleshort 0x01EF
+# AuthorName[41]
+>>>>&0 string >\0 - author "%-.40s"
+# Comment[324]=4 * 80 null terminated
+>>>>&41 string >\0 - comment "%-.80s"
+# date
+>>>>&365 ubequad&0xffffFFFFffff0000 !0
+# Day
+>>>>>&-6 uleshort x %d
+# Month
+>>>>>&-8 uleshort x \b-%d
+# Year
+>>>>>&-4 uleshort x \b-%d
+# time
+>>>>&371 ubequad&0xffffFFFFffff0000 !0
+# hour
+>>>>>&-8 uleshort x %d
+# minutes
+>>>>>&-6 uleshort x \b:%.2d
+# second
+>>>>>&-4 uleshort x \b:%.2d
+# JobName[41]
+>>>>&377 string >\0 - job "%-.40s"
+# JobHour Jobminute Jobsecond
+>>>>&418 ubequad&0xffffFFFFffff0000 !0
+>>>>>&-8 uleshort x %d
+>>>>>&-6 uleshort x \b:%.2d
+>>>>>&-4 uleshort x \b:%.2d
+# SoftwareId[41]
+>>>>&424 string >\0 - %-.40s
+# SoftwareVersionNumber
+>>>>&424 ubyte >0
+>>>>>&40 uleshort/100 x %d
+>>>>>&40 uleshort%100 x \b.%d
+# VersionLetter
+>>>>>&42 ubyte >0x20 \b%c
+# KeyColor
+>>>>&468 ulelong >0 - keycolor 0x%8.8x
+# Denominator of Pixel ratio. 0~no pixel aspect
+>>>>&474 uleshort >0
+# Numerator
+>>>>>&-4 uleshort >0 - aspect %d
+>>>>>&-2 uleshort x \b/%d
+# Denominator of Gamma ratio. 0~no Gamma value
+>>>>&478 uleshort >0
+# Numerator
+>>>>>&-4 uleshort >0 - gamma %d
+>>>>>&-2 uleshort x \b/%d
+# ColorOffset
+#>>>>&480 ulelong x - col offset 0x%8.8x
+# StampOffset
+#>>>>&484 ulelong x - stamp offset 0x%8.8x
+# ScanOffset
+#>>>>&488 ulelong x - scan offset 0x%8.8x
+# AttributesType
+#>>>>&492 ubyte x - Attributes 0x%x
+## EndOfTGA
# PBMPLUS images
# The next byte following the magic is always whitespace.
# strength is changed to try these patterns before "x86 boot sector"
-0 search/1 P1
->3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PBM image text
->3 regex =[0-9]{1,50}\ \b, size = %sx
->>3 regex =\ [0-9]{1,50} \b%s
+0 name netpbm
+>3 regex/s =[0-9]{1,50}\ [0-9]{1,50} Netpbm image data
+>>&0 regex =[0-9]{1,50} \b, size = %s x
+>>>&0 regex =[0-9]{1,50} \b %s
+
+0 search/1 P1
+>0 regex/4 P1[\040\t\f\r\n]
+>>0 use netpbm
+>>>0 string x \b, bitmap
!:strength + 45
!:mime image/x-portable-bitmap
-0 search/1 P2
->3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PGM image text
->3 regex =[0-9]{1,50}\ \b, size = %sx
->>3 regex =\ [0-9]{1,50} \b%s
+
+0 search/1 P2
+>0 regex/4 P2[\040\t\f\r\n]
+>>0 use netpbm
+>>>0 string x \b, greymap
!:strength + 45
!:mime image/x-portable-greymap
+
0 search/1 P3
->3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PPM image text
->3 regex =[0-9]{1,50}\ \b, size = %sx
->>3 regex =\ [0-9]{1,50} \b%s
+>0 regex/4 P3[\040\t\f\r\n]
+>>0 use netpbm
+>>>0 string x \b, pixmap
!:strength + 45
!:mime image/x-portable-pixmap
-0 string P4
->3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PBM "rawbits" image data
->3 regex =[0-9]{1,50}\ \b, size = %sx
->>3 regex =\ [0-9]{1,50} \b%s
+
+0 string P4
+>0 regex/4 P4[\040\t\f\r\n]
+>>0 use netpbm
+>>>0 string x \b, rawbits, bitmap
!:strength + 45
!:mime image/x-portable-bitmap
-0 string P5
->3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PGM "rawbits" image data
->3 regex =[0-9]{1,50}\ \b, size = %sx
->>3 regex =\ [0-9]{1,50} \b%s
+
+0 string P5
+>0 regex/4 P5[\040\t\f\r\n]
+>>0 use netpbm
+>>>0 string x \b, rawbits, greymap
!:strength + 45
!:mime image/x-portable-greymap
-0 string P6
->3 regex =[0-9]{0,50}\ [0-9]{0,50} Netpbm PPM "rawbits" image data
->3 regex =[0-9]{1,50}\ \b, size = %sx
->>3 regex =\ [0-9]{1,50} \b%s
+
+0 string P6
+>0 regex/4 P6[\040\t\f\r\n]
+>>0 use netpbm
+>>>0 string x \b, rawbits, pixmap
!:strength + 45
!:mime image/x-portable-pixmap
+
0 string P7 Netpbm PAM image file
!:mime image/x-portable-pixmap
@@ -163,10 +308,11 @@
>>>8 leshort 0x8765 \bJBIG
>>>8 leshort 0x8798 \bJPEG2000
>>>8 leshort 0x8799 \bNikon NEF Compressed
->>>8 default x
+>>>8 default x
>>>>8 leshort x \b(unknown 0x%x)
>>>12 use tiff_entry
>0 leshort 0x106 \b, PhotometricIntepretation=
+>>8 clear x
>>8 leshort 0 \bWhiteIsZero
>>8 leshort 1 \bBlackIsZero
>>8 leshort 2 \bRGB
@@ -175,6 +321,7 @@
>>8 leshort 5 \bCMYK
>>8 leshort 6 \bYCbCr
>>8 leshort 8 \bCIELab
+>>8 default x
>>>8 leshort x \b(unknown=0x%x)
>>12 use tiff_entry
# FillOrder
@@ -272,21 +419,35 @@
# (Greg Roelofs, newt@uchicago.edu)
# (Albert Cahalan, acahalan@cs.uml.edu)
#
-# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
+# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ...
#
-0 string \x89PNG\x0d\x0a\x1a\x0a PNG image data
+
+# IHDR parser
+0 name png-ihdr
+>0 belong x \b, %d x
+>4 belong x %d,
+>8 byte x %d-bit
+>9 byte 0 grayscale,
+>9 byte 2 \b/color RGB,
+>9 byte 3 colormap,
+>9 byte 4 gray+alpha,
+>9 byte 6 \b/color RGBA,
+#>10 byte 0 deflate/32K,
+>12 byte 0 non-interlaced
+>12 byte 1 interlaced
+
+# Standard PNG image.
+0 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR PNG image data
+!:mime image/png
+!:strength +10
+>16 use png-ihdr
+
+# Apple CgBI PNG image.
+0 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI
+>24 string \x00\x00\x00\x0DIHDR PNG image data (CgBI)
!:mime image/png
->16 belong x \b, %d x
->20 belong x %d,
->24 byte x %d-bit
->25 byte 0 grayscale,
->25 byte 2 \b/color RGB,
->25 byte 3 colormap,
->25 byte 4 gray+alpha,
->25 byte 6 \b/color RGBA,
-#>26 byte 0 deflate/32K,
->28 byte 0 non-interlaced
->28 byte 1 interlaced
+!:strength +10
+>>32 use png-ihdr
# possible GIF replacements; none yet released!
# (Greg Roelofs, newt@uchicago.edu)
@@ -296,13 +457,13 @@
!:mime image/x-unknown
#
# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better):
-#
+#
0 string FGF95a FGF image (GIF+deflate beta)
!:mime image/x-unknown
#
# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal
# (best; not yet implemented):
-#
+#
0 string PBF PBF image (deflate compression)
!:mime image/x-unknown
@@ -386,19 +547,19 @@
# http://www.blackfiveservices.co.uk/awbmtools.shtml
# http://biosgfx.narod.ru/v3/
# http://biosgfx.narod.ru/abr-2/
-0 string AWBM
+0 string AWBM
>4 leshort <1981 Award BIOS bitmap
!:mime image/x-award-bmp
# image width is a multiple of 4
->>4 leshort&0x0003 0
+>>4 leshort&0x0003 0
>>>4 leshort x \b, %d
>>>6 leshort x x %d
>>4 leshort&0x0003 >0 \b,
->>>4 leshort&0x0003 =1
+>>>4 leshort&0x0003 =1
>>>>4 leshort x %d+3
->>>4 leshort&0x0003 =2
+>>>4 leshort&0x0003 =2
>>>>4 leshort x %d+2
->>>4 leshort&0x0003 =3
+>>>4 leshort&0x0003 =3
>>>>4 leshort x %d+1
>>>6 leshort x x %d
# at offset 8 starts imagedata followed by "RGB " marker
@@ -538,8 +699,12 @@
0 beshort 0x1010 PEX Binary Archive
# DICOM medical imaging data
+# URL: https://en.wikipedia.org/wiki/DICOM#Data_format
+# Note: "dcm" is the official file name extension
+# XnView mention also "dc3" and "acr" as file name extension
128 string DICM DICOM medical imaging data
!:mime application/dicom
+!:ext dcm/dicom/dic
# XWD - X Window Dump file.
# As described in /usr/X11R6/include/X11/XWDFile.h
@@ -618,11 +783,11 @@
# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
-0 ubelong&0xffF8fe00 0x0a000000
-# for PCX bit depth > 0
->3 ubyte >0
+0 ubelong&0xffF8fe00 0x0a000000
+# for PCX bit depth > 0
+>3 ubyte >0
# test for valid versions
->>1 ubyte <6
+>>1 ubyte <6
>>>1 ubyte !1 PCX
!:mime image/x-pcx
#!:mime image/pcx
@@ -678,12 +843,68 @@
>25 string >\0 dated %.14s
# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
-0 belong 0x00010008 GEM Image data
->12 beshort x %d x
->14 beshort x %d,
->4 beshort x %d planes,
->8 beshort x %d x
->10 beshort x %d pixelsize
+# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de>
+# Update: Joerg Jenderek
+# See http://fileformats.archiveteam.org/wiki/GEM_Raster
+# For variations, also see:
+# http://www.seasip.info/Gem/ff_img.html (Ventura)
+# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
+# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
+# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
+0 beshort 0x0001
+# header_size
+>2 beshort 0x0008
+>>0 use gem_info
+>2 beshort 0x0009
+>>0 use gem_info
+# no example for NOSIG
+>2 beshort 24
+>>0 use gem_info
+# no example for HYPERPAINT
+>2 beshort 25
+>>0 use gem_info
+16 string XIMG\0
+>0 use gem_info
+# no example
+16 string STTT\0\x10
+>0 use gem_info
+# no example or description
+16 string TIMG\0
+>0 use gem_info
+
+0 name gem_info
+# version is 2 for some XIMG and 1 for all others
+>0 beshort <0x0003 GEM
+# http://www.snowstone.org.uk/riscos/mimeman/mimemap.txt
+!:mime image/x-gem
+# header_size 24 25 27 59 779 words for colored bitmaps
+>>2 beshort >9
+>>>16 string STTT\0\x10 STTT
+>>>16 string TIMG\0 TIMG
+# HYPERPAINT or NOSIG variant
+>>>16 string \0\x80
+>>>>2 beshort =24 NOSIG
+>>>>2 beshort !24 HYPERPAINT
+# NOSIG or XIMG variant
+>>>16 default x
+>>>>16 string !XIMG\0 NOSIG
+>>16 string =XIMG\0 XIMG Image data
+!:ext img/ximg
+# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type
+>>16 string !XIMG\0 Image data
+!:ext img
+# header_size is 9 for Ventura files and 8 for other GEM Paint files
+>>2 beshort 9 (Ventura)
+#>>2 beshort 8 (Paint)
+>>12 beshort x %d x
+>>14 beshort x %d,
+# 1 4 8
+>>4 beshort x %d planes,
+# in tenths of a millimetre
+>>8 beshort x %d x
+>>10 beshort x %d pixelsize
+# pattern_size 1-8. 2 for GEM Paint
+>>6 beshort !2 \b, pattern size %d
# GEM Metafile (Wolfram Kleff)
0 lelong 0x0018FFFF GEM Metafile data
@@ -972,7 +1193,22 @@
!:mime image/x-polar-monitor-bitmap
# From: Rick Richardson <rickrich@gmail.com>
+# updated by: Joerg Jenderek
+# URL: http://techmods.net/nuvi/
0 string GARMIN\ BITMAP\ 01 Garmin Bitmap file
+# extension is also used for
+# Sony SRF raw image (image/x-sony-srf)
+# SRF map
+# Terragen Surface Map (http://www.planetside.co.uk/terragen)
+# FileLocator Pro search criteria file (http://www.mythicsoft.com/filelocatorpro)
+!:ext srf
+#!:mime image/x-garmin-srf
+# version 1.00,2.00,2.10,2.40,2.50
+>0x2f string >0 \b, version %4.4s
+# width (2880,2881,3240)
+>0x55 uleshort >0 \b, %dx
+# height (80,90)
+>>0x53 uleshort x \b%d
# Type: Ulead Photo Explorer5 (.pe5)
# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
@@ -1036,11 +1272,6 @@
# From: "Tano M. Fotang" <mfotang@quanteq.com>
0 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR)
-# WEBP https://developers.google.com/speed/webp/docs/riff_container
-#0 string RIFF
-#>8 string WEBP Web/P image data
-#>>4 lelong x \b, %d bytes
-
# doc: http://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip
# example: http://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip
90 bequad 0x574D50484F544F00 JPEG-XR Image
@@ -1099,3 +1330,152 @@
#
0 string \x42\x50\x47\xFB BPG (Better Portable Graphics)
!:mime image/bpg
+
+# From: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format
+0 string icns Mac OS X icon
+!:mime image/x-icns
+!:apple ????icns
+!:ext icns
+>4 ubelong >0
+# file size
+>>4 ubelong x \b, %d bytes
+# icon type
+>>8 string x \b, "%4.4s" type
+
+# TIM images
+0 lelong 0x00000010 TIM image,
+>4 lelong 0x8 4-Bit,
+>4 lelong 0x9 8-Bit,
+>4 lelong 0x2 15-Bit,
+>4 lelong 0x3 24-Bit,
+>4 lelong &8
+>>(8.l+12) leshort x Pixel at (%d,
+>>(8.l+14) leshort x \b%d)
+>>(8.l+16) leshort x Size=%dx
+>>(8.l+18) leshort x \b%d,
+>>4 lelong 0x8 16 CLUT Entries at
+>>4 lelong 0x9 256 CLUT Entries at
+>>12 leshort x (%d,
+>>14 leshort x \b%d)
+>4 lelong ^8
+>>12 leshort x Pixel at (%d,
+>>14 leshort x \b%d)
+>>16 leshort x Size=%dx
+>>18 leshort x \b%d
+
+# MDEC streams
+0 lelong 0x80010160 MDEC video stream,
+>16 leshort x %dx
+>18 leshort x \b%d
+#>8 lelong x %d frames
+#>4 leshort x secCount=%d;
+#>6 leshort x nSectors=%d;
+#>12 lelong x frameSize=%d;
+
+# BS encoded bitstreams
+2 leshort 0x3800 BS image,
+>6 leshort x Version %d,
+>4 leshort x Quantization %d,
+>0 leshort x (Decompresses to %d words)
+
+# Type: farbfeld image.
+# Url: http://tools.suckless.org/farbfeld/
+# From: Ian D. Scott <ian@iandouglasscott.com>
+#
+0 string farbfeld farbfeld image data,
+>8 ubelong x %dx
+>12 ubelong x \b%d
+
+# Type: Sega PVR image.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# References:
+# - http://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt
+# - https://github.com/yazgoo/pvrx2png
+# - https://github.com/nickworonekin/puyotools
+
+# Sega PVR header.
+0 name sega-pvr-image-header
+>0x0C leshort x %d x
+>0x0E leshort x %d
+# Image format.
+>0x08 byte 0 \b, ARGB1555
+>0x08 byte 1 \b, RGB565
+>0x08 byte 2 \b, ARGB4444
+>0x08 byte 3 \b, YUV442
+>0x08 byte 4 \b, Bump
+>0x08 byte 5 \b, 4bpp
+>0x08 byte 6 \b, 8bpp
+# Image data type.
+>0x09 byte 0x01 \b, square twiddled
+>0x09 byte 0x02 \b, square twiddled & mipmap
+>0x09 byte 0x03 \b, VQ
+>0x09 byte 0x04 \b, VQ & mipmap
+>0x09 byte 0x05 \b, 8-bit CLUT twiddled
+>0x09 byte 0x06 \b, 4-bit CLUT twiddled
+>0x09 byte 0x07 \b, 8-bit direct twiddled
+>0x09 byte 0x08 \b, 4-bit direct twiddled
+>0x09 byte 0x09 \b, rectangle
+>0x09 byte 0x0B \b, rectangular stride
+>0x09 byte 0x0D \b, rectangular twiddled
+>0x09 byte 0x10 \b, small VQ
+>0x09 byte 0x11 \b, small VQ & mipmap
+>0x09 byte 0x12 \b, square twiddled & mipmap
+
+# Sega PVR (Xbox) image header.
+# Contains an embedded DirectDraw surface instead of PVR data.
+0 name sega-pvr-xbox-dds-header
+>16 lelong x %d x
+>12 lelong x %d,
+>84 string x %.4s
+
+# Sega PVR image.
+0 string PVRT
+>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image:
+>>0x20 use sega-pvr-xbox-dds-header
+>0x10 belong !0x44445320 Sega PVR image:
+>>0 use sega-pvr-image-header
+
+# Sega PVR image with GBIX.
+0 string GBIX
+>0x10 string PVRT
+>>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image:
+>>>0x20 use sega-pvr-xbox-dds-header
+>>0x10 belong !0x44445320 Sega PVR image:
+>>>0x10 use sega-pvr-image-header
+>>0x08 lelong x \b, global index = %u
+
+# Sega GVR header.
+0 name sega-gvr-image-header
+>0x0C beshort x %d x
+>0x0E beshort x %d
+# Image data format.
+>0x0B byte 0 \b, I4
+>0x0B byte 1 \b, I8
+>0x0B byte 2 \b, IA4
+>0x0B byte 3 \b, IA8
+>0x0B byte 4 \b, RGB565
+>0x0B byte 5 \b, RGB5A3
+>0x0B byte 6 \b, ARGB8888
+>0x0B byte 8 \b, CI4
+>0x0B byte 9 \b, CI8
+>0x0B byte 14 \b, DXT1
+
+# Sega GVR image.
+0 string GVRT Sega GVR image:
+>0x10 use sega-gvr-image-header
+
+# Sega GVR image with GBIX.
+0 string GBIX
+>0x10 string GVRT Sega GVR image:
+>>0x10 use sega-gvr-image-header
+>>0x08 belong x \b, global index = %u
+
+# Light Field Picture
+# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx
+# Typical file extensions: .lfp .lfr .lfx
+
+0 belong 0x894C4650
+>4 belong 0x0D0A1A0A
+>12 belong 0x00000000 Lytro Light Field Picture
+>8 belong x \b, version %d
diff --git a/magic/Magdir/intel b/magic/Magdir/intel
index 9fa90f4..c4f0254 100644
--- a/magic/Magdir/intel
+++ b/magic/Magdir/intel
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: intel,v 1.12 2014/04/30 21:41:02 christos Exp $
+# $File: intel,v 1.15 2017/03/17 21:35:28 christos Exp $
# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
@@ -30,15 +30,27 @@
0 leshort =0522 iAPX 286 executable large model (COFF)
>12 lelong >0 not stripped
#>22 leshort >0 - version %d
+# updated by Joerg Jenderek at Oct 2015
+# https://de.wikipedia.org/wiki/Common_Object_File_Format
+# http://www.delorie.com/djgpp/doc/coff/filhdr.html
+# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file"
+# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable"
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
-0 leshort =0514 80386 COFF executable
->12 lelong >0 not stripped
->22 leshort >0 - version %d
+0 leshort =0514
+# use subroutine to display name+flags+variables for common object formated files
+>0 use display-coff
+#>12 lelong >0 not stripped
+# no hint found, that at offset 22 is version
+#>22 leshort >0 - version %d
# rom: file(1) magic for BIOS ROM Extensions found in intel machines
# mapped into memory between 0xC0000 and 0xFFFFF
# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
+# updated by Joerg Jenderek
+# https://en.wikipedia.org/wiki/Option_ROM
0 beshort 0x55AA BIOS (ia32) ROM Ext.
+!:mime application/octet-stream
+!:ext rom/bin
>5 string USB USB
>7 string LDR UNDI image
>30 string IBM IBM comp. Video
diff --git a/magic/Magdir/isz b/magic/Magdir/isz
index 3388a82..af68db2 100644
--- a/magic/Magdir/isz
+++ b/magic/Magdir/isz
@@ -1,7 +1,7 @@
#------------------------------------------------------------------------------
-# $File: isz,v 1.3 2014/04/30 21:41:02 christos Exp $
-# ISO Zipped file format
+# $File: isz,v 1.4 2017/03/17 21:35:28 christos Exp $
+# ISO Zipped file format
# http://www.ezbsystems.com/isz/iszspec.txt
0 string IsZ! ISO Zipped file
>4 byte x \b, header size %u
diff --git a/magic/Magdir/java b/magic/Magdir/java
index b09302e..21acf29 100644
--- a/magic/Magdir/java
+++ b/magic/Magdir/java
@@ -1,6 +1,6 @@
#------------------------------------------------------------
-# $File: java,v 1.16 2013/09/24 20:22:03 christos Exp $
+# $File: java,v 1.18 2015/11/29 22:08:14 christos Exp $
# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
# same magic number, 0xcafebabe, so they are both handled
# in the entry called "cafebabe".
@@ -16,5 +16,12 @@
!:mime application/x-java-jce-keystore
# Java source
-0 regex ^import.*;$ Java source
+0 regex \^import.*;$ Java source
!:mime text/x-java
+
+# Java HPROF dumps
+# https://java.net/downloads/heap-snapshot/hprof-binary-format.html
+0 string JAVA\x20PROFILE\x201.0.
+>0x12 short 0
+>>0x11 ushort-0x31 <2 Java HPROF dump,
+>>0x17 beqdate/1000 x created %s
diff --git a/magic/Magdir/jpeg b/magic/Magdir/jpeg
index cfe8973..57adb1e 100644
--- a/magic/Magdir/jpeg
+++ b/magic/Magdir/jpeg
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: jpeg,v 1.25 2015/01/02 16:56:50 christos Exp $
+# $File: jpeg,v 1.31 2017/03/17 21:35:28 christos Exp $
# JPEG images
# SunOS 5.5.1 had
#
@@ -12,7 +12,8 @@
0 beshort 0xffd8 JPEG image data
!:mime image/jpeg
!:apple 8BIMJPEG
-!:strength +2
+!:strength *3
+!:ext jpeg/jpg/jpe/jfif
>6 string JFIF \b, JFIF standard
# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
# in a vain attempt to add image size reporting for JFIF. Note that these
@@ -41,7 +42,8 @@
# This uses recursion...
0 name jpeg_segment
>0 beshort 0xFFFE
->>(2.S+2) use jpeg_segment
+# Recursion handled by FFE0
+#>>(2.S+2) use jpeg_segment
>>2 pstring/HJ x \b, comment: "%s"
>0 beshort 0xFFC0
@@ -51,14 +53,14 @@
>>5 beshort x \b%d
>>9 byte x \b, frames %d
->0 beshort 0xFFC1
+>0 beshort 0xFFC1
>>(2.S+2) use jpeg_segment
>>4 byte x \b, extended sequential, precision %d
>>7 beshort x \b, %dx
>>5 beshort x \b%d
>>9 byte x \b, frames %d
->0 beshort 0xFFC2
+>0 beshort 0xFFC2
>>(2.S+2) use jpeg_segment
>>4 byte x \b, progressive, precision %d
>>7 beshort x \b, %dx
@@ -69,10 +71,11 @@
>0 beshort 0xFFC4
>>(2.S+2) use jpeg_segment
->0 beshort 0xFFE1
+>0 beshort 0xFFE1
+# Recursion handled by FFE0
#>>(2.S+2) use jpeg_segment
>>4 string Exif \b, Exif Standard: [
->>>10 indirect/r x
+>>>10 indirect/r x
>>>10 string x \b]
# Application specific markers
@@ -85,7 +88,8 @@
# D9: End of image
# Dn: Restart
>0 beshort&0xFFD0 =0xFFD0
->>(2.S+2) use jpeg_segment
+>>0 beshort&0xFFE0 !0xFFE0
+>>>(2.S+2) use jpeg_segment
#>0 beshort x unknown 0x%x
#>>(2.S+2) use jpeg_segment
@@ -113,3 +117,10 @@
# From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
0 belong 0xff4fff51 JPEG 2000 codestream
45 beshort 0xff52
+
+# JPEG extended range
+0 string \x49\x49\xbc
+>3 byte 1
+>>4 lelong%2 0 JPEG-XR
+!:mime image/jxr
+!:ext jxr
diff --git a/magic/Magdir/karma b/magic/Magdir/karma
index 47d5d97..938a51d 100644
--- a/magic/Magdir/karma
+++ b/magic/Magdir/karma
@@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
-# $File: karma,v 1.7 2014/04/30 21:41:02 christos Exp $
+# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $
# karma: file(1) magic for Karma data files
#
# From <rgooch@atnf.csiro.au>
-0 string KarmaRHD Version Karma Data Structure Version
+0 string KarmaRHD\040Version Karma Data Structure Version
>16 belong x %u
diff --git a/magic/Magdir/kerberos b/magic/Magdir/kerberos
index cb07fed..93b8f79 100644
--- a/magic/Magdir/kerberos
+++ b/magic/Magdir/kerberos
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: kerberos,v 1.1 2014/12/10 18:45:43 christos Exp $
+# $File: kerberos,v 1.2 2017/03/17 21:35:28 christos Exp $
# kerberos: MIT kerberos file binary formats
#
@@ -38,7 +38,7 @@
>>>>>&0 bedate x \b, date=%s
>>>>>>&0 byte x \b, kvno=%u
#>>>>>>>&0 pstring/H x
-#>>>>>>>>&0 belong x
+#>>>>>>>>&0 belong x
#>>>>>>>>>>&0 use keytab_entry
0 belong 0x05020000 Kerberos Keytab file
diff --git a/magic/Magdir/kml b/magic/Magdir/kml
index ed0f42e..d603ea8 100644
--- a/magic/Magdir/kml
+++ b/magic/Magdir/kml
@@ -1,13 +1,13 @@
#------------------------------------------------------------------------------
-# $File: kml,v 1.3 2010/11/25 15:00:12 christos Exp $
+# $File: kml,v 1.4 2017/03/17 21:35:28 christos Exp $
# Type: Google KML, formerly Keyhole Markup Language
# Future development of this format has been handed
# over to the Open Geospatial Consortium.
# http://www.opengeospatial.org/standards/kml/
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
0 string/t \<?xml
->20 search/400 \ xmlns=
+>20 search/400 \ xmlns=
>>&0 regex ['"]http://earth.google.com/kml Google KML document
!:mime application/vnd.google-earth.kml+xml
>>>&1 string 2.0' \b, version 2.0
@@ -25,7 +25,7 @@
>>>&1 string/t 2.2 \b, version 2.2
#------------------------------------------------------------------------------
-# Type: Google KML Archive (ZIP based)
+# Type: Google KML Archive (ZIP based)
# http://code.google.com/apis/kml/documentation/kml_tut.html
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
0 string PK\003\004
diff --git a/magic/Magdir/linux b/magic/Magdir/linux
index d3f6a9d..0630a8a 100644
--- a/magic/Magdir/linux
+++ b/magic/Magdir/linux
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: linux,v 1.59 2014/11/03 21:03:36 christos Exp $
+# $File: linux,v 1.64 2017/03/17 21:35:28 christos Exp $
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
@@ -199,7 +199,7 @@
############################################################################
# Linux 8086 executable
0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless
->5 string .
+>5 string .
>>4 string >\0 \b, libc version %s
0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable
@@ -213,7 +213,7 @@
>2 byte&0x40 !0 \b, A_PURE
>2 byte&0x80 !0 \b, A_TOVLY
>28 long !0 \b, not stripped
->37 string .
+>37 string .
>>36 string >\0 \b, libc version %s
# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable
@@ -241,7 +241,7 @@
>24 lelong x %d symbols
>28 lelong x %d ocons
-# Linux Logical Volume Manager (LVM)
+# Linux Logical Volume Manager (LVM)
# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
#
# System ID, UUID and volume group name are 128 bytes long
@@ -301,7 +301,7 @@
>>&0x20 lequad x \b, size: %lld
0x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
->&(&-12.l-0x21) byte x
+>&(&-12.l-0x21) byte x
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
>>&0x0 string >\x2f \b, UUID: %.6s
>>&0x6 string >\x2f \b-%.4s
@@ -340,7 +340,7 @@
# Summary: Xen saved domain file
# Created by: Radek Vokal <rvokal@redhat.com>
0 string LinuxGuestRecord Xen saved domain
->20 search/256 (name
+>20 search/256 (name
>>&1 string x (name %s)
# Type: Xen, the virtual machine monitor
@@ -397,7 +397,7 @@
>>0x1046 ubeshort x \b%04x
# Linux device tree:
-# File format description can be found in the Linux kernel sources at
+# File format description can be found in the Linux kernel sources at
# Documentation/devicetree/booting-without-of.txt
# From Christoph Biedl
0 belong 0xd00dfeed
@@ -417,6 +417,25 @@
0 lelong 0xde020109 locale archive
>24 lelong x %d strings
+# Linux Software RAID (mdadm)
+# Russell Coker <russell@coker.com.au>
+0 name linuxraid
+>16 belong x UUID=%8x:
+>20 belong x \b%8x:
+>24 belong x \b%8x:
+>28 belong x \b%8x
+>32 string x name=%s
+>72 lelong x level=%d
+>92 lelong x disks=%d
+
+4096 lelong 0xa92b4efc Linux Software RAID
+>4100 lelong x version 1.2 (%d)
+>4096 use linuxraid
+
+0 lelong 0xa92b4efc Linux Software RAID
+>4 lelong x version 1.1 (%d)
+>0 use linuxraid
+
# Summary: Database file for mlocate
# Description: A database file as used by mlocate, a fast implementation
# of locate/updatedb. It uses merging to reuse the existing
@@ -432,3 +451,28 @@
>12 byte x \b, version %d
>13 byte 1 \b, require visibility
>16 string x \b, root %s
+
+# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL:
+# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2
+# From: Pavel Emelyanov <xemul@parallels.com>
+0 lelong 0x45311224 iproute2 routes dump
+0 lelong 0x47361222 iproute2 addresses dump
+
+# Image and service files for CRIU tool.
+# URL: http://criu.org
+# From: Pavel Emelyanov <xemul@parallels.com>
+0 lelong 0x54564319 CRIU image file v1.1
+0 lelong 0x55105940 CRIU service file
+0 lelong 0x58313116 CRIU inventory
+
+# Kdump compressed dump files
+# http://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION
+
+0 string KDUMP Kdump compressed dump
+>8 long x v%d
+>12 string >\0 \b, system %s
+>77 string >\0 \b, node %s
+>142 string >\0 \b, release %s
+>207 string >\0 \b, version %s
+>272 string >\0 \b, machine %s
+>337 string >\0 \b, domain %s
diff --git a/magic/Magdir/lisp b/magic/Magdir/lisp
index 1109880..43d102e 100644
--- a/magic/Magdir/lisp
+++ b/magic/Magdir/lisp
@@ -1,13 +1,13 @@
#------------------------------------------------------------------------------
-# $File: lisp,v 1.23 2009/09/19 16:28:10 christos Exp $
+# $File: lisp,v 1.25 2017/03/17 21:35:28 christos Exp $
# lisp: file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
# updated by Joerg Jenderek
# GRR: This lot is too weak
-#0 string ;;
+#0 string ;;
# windows INF files often begin with semicolon and use CRLF as line end
# lisp files are mainly created on unix system with LF as line end
#>2 search/4096 !\r Lisp/Scheme program text
@@ -26,16 +26,39 @@
0 search/4096 (custom-set-variables\ Lisp/Scheme program text
!:mime text/x-lisp
+# URL: https://en.wikipedia.org/wiki/Emacs_Lisp
+# Reference: http://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz
+# Update: Joerg Jenderek
# Emacs 18 - this is always correct, but not very magical.
-0 string \012( Emacs v18 byte-compiled Lisp data
+0 string \012(
+# look for emacs lisp keywords
+# GRR: split regex because it is too long or get error like
+# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|'
+>&0 regex \^(defun|defvar|defconst|defmacro|setq|fset) Emacs v18 byte-compiled Lisp data
!:mime application/x-elc
+# https://searchcode.com/codesearch/view/2173420/
+# not really pure text
+!:apple EMAxTEXT
+!:ext elc
+# remaining regex
+>&0 regex \^(put|provide|require|random) Emacs v18 byte-compiled Lisp data
+!:mime application/x-elc
+!:apple EMAxTEXT
+!:ext elc
+# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;;
+
# Emacs 19+ - ver. recognition added by Ian Springer
# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
# - Chris Chittleborough <cchittleborough@yahoo.com.au>
-0 string ;ELC
->4 byte >18
->4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data
-!:mime application/x-elc
+# Update: Joerg Jenderek
+0 string ;ELC
+# version\0\0\0
+>4 byte >18 Emacs/XEmacs v%d byte-compiled Lisp data
+# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015
+#>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data
+!:mime application/x-elc
+!:apple EMAxTEXT
+!:ext elc
# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27)
@@ -44,7 +67,7 @@
0 long 0x70768BD2 CLISP memory image data
0 long 0xD28B7670 CLISP memory image data, other endian
-#.com and .bin for MIT scheme
+#.com and .bin for MIT scheme
0 string \372\372\372\372 MIT scheme (library?)
# From: David Allouche <david@allouche.net>
diff --git a/magic/Magdir/m4 b/magic/Magdir/m4
index f6b5e52..3a1c6d1 100644
--- a/magic/Magdir/m4
+++ b/magic/Magdir/m4
@@ -1,6 +1,9 @@
#------------------------------------------------------------------------------
-# $File: m4,v 1.1 2011/12/08 12:12:46 rrt Exp $
+# $File: m4,v 1.2 2017/08/14 07:40:38 christos Exp $
# make: file(1) magic for M4 scripts
#
0 regex \^dnl\ M4 macro processor script text
!:mime text/x-m4
+0 regex \^AC_DEFUN\\(\\[ M4 macro processor script text
+!:strength + 15
+!:mime text/x-m4
diff --git a/magic/Magdir/mach b/magic/Magdir/mach
index 23b9f8a..c1bec07 100644
--- a/magic/Magdir/mach
+++ b/magic/Magdir/mach
@@ -1,6 +1,6 @@
#------------------------------------------------------------
-# $File: mach,v 1.19 2014/04/30 21:41:02 christos Exp $
+# $File: mach,v 1.23 2015/10/15 21:51:22 christos Exp $
# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
# Unfortunately the first, cafebabe, is shared with
# Java ByteCode, so they are both handled in the file "cafebabe".
@@ -106,15 +106,19 @@
>>>4 belong&0x00ffffff 2 subarchitecture=%d
>>>4 belong&0x00ffffff 3 subarchitecture=%d
>>>4 belong&0x00ffffff 4 subarchitecture=%d
->>>4 belong&0x00ffffff 5 \b_v4t
->>>4 belong&0x00ffffff 6 \b_v6
->>>4 belong&0x00ffffff 7 \b_v5tej
->>>4 belong&0x00ffffff 8 \b_xscale
->>>4 belong&0x00ffffff 9 \b_v7
->>>4 belong&0x00ffffff 10 \b_v7f
->>>4 belong&0x00ffffff 11 subarchitecture=%d
->>>4 belong&0x00ffffff 12 \b_v7k
->>>4 belong&0x00ffffff >12 subarchitecture=%d
+>>>4 belong&0x00ffffff 5 \bv4t
+>>>4 belong&0x00ffffff 6 \bv6
+>>>4 belong&0x00ffffff 7 \bv5tej
+>>>4 belong&0x00ffffff 8 \bxscale
+>>>4 belong&0x00ffffff 9 \bv7
+>>>4 belong&0x00ffffff 10 \bv7f
+>>>4 belong&0x00ffffff 11 \bv7s
+>>>4 belong&0x00ffffff 12 \bv7k
+>>>4 belong&0x00ffffff 13 \bv8
+>>>4 belong&0x00ffffff 14 \bv6m
+>>>4 belong&0x00ffffff 15 \bv7m
+>>>4 belong&0x00ffffff 16 \bv7em
+>>>4 belong&0x00ffffff >16 subarchitecture=%d
# 13 m88k
>>0 belong&0x00ffffff 13
>>>4 belong&0x00ffffff 0 mc88000
@@ -158,12 +162,15 @@
>>>4 belong&0x00ffffff 2 subarchitecture=%d
>>>4 belong&0x00ffffff 3
>>>4 belong&0x00ffffff 4 \b_arch1
+>>>4 belong&0x00ffffff 8 \b_haswell
>>>4 belong&0x00ffffff >4 subarchitecture=%d
>>0 belong&0x00ffffff 8 64-bit architecture=%d
>>0 belong&0x00ffffff 9 64-bit architecture=%d
>>0 belong&0x00ffffff 10 64-bit architecture=%d
>>0 belong&0x00ffffff 11 64-bit architecture=%d
->>0 belong&0x00ffffff 12 64-bit architecture=%d
+>>0 belong&0x00ffffff 12 arm64
+>>>4 belong&0x00ffffff 0
+>>>4 belong&0x00ffffff 1 \bv8
>>0 belong&0x00ffffff 13 64-bit architecture=%d
>>0 belong&0x00ffffff 14 64-bit architecture=%d
>>0 belong&0x00ffffff 15 64-bit architecture=%d
@@ -203,12 +210,42 @@
>12 belong 11 kext bundle
>12 belong >11
>>12 belong x filetype=%d
+>24 belong >0 \b, flags:<
+>>24 belong &0x0000001 \bNOUNDEFS
+>>24 belong &0x0000002 \b|INCRLINK
+>>24 belong &0x0000004 \b|DYLDLINK
+>>24 belong &0x0000008 \b|BINDATLOAD
+>>24 belong &0x0000010 \b|PREBOUND
+>>24 belong &0x0000020 \b|SPLIT_SEGS
+>>24 belong &0x0000040 \b|LAZY_INIT
+>>24 belong &0x0000080 \b|TWOLEVEL
+>>24 belong &0x0000100 \b|FORCE_FLAT
+>>24 belong &0x0000200 \b|NOMULTIDEFS
+>>24 belong &0x0000400 \b|NOFIXPREBINDING
+>>24 belong &0x0000800 \b|PREBINDABLE
+>>24 belong &0x0001000 \b|ALLMODSBOUND
+>>24 belong &0x0002000 \b|SUBSECTIONS_VIA_SYMBOLS
+>>24 belong &0x0004000 \b|CANONICAL
+>>24 belong &0x0008000 \b|WEAK_DEFINES
+>>24 belong &0x0010000 \b|BINDS_TO_WEAK
+>>24 belong &0x0020000 \b|ALLOW_STACK_EXECUTION
+>>24 belong &0x0040000 \b|ROOT_SAFE
+>>24 belong &0x0080000 \b|SETUID_SAFE
+>>24 belong &0x0100000 \b|NO_REEXPORTED_DYLIBS
+>>24 belong &0x0200000 \b|PIE
+>>24 belong &0x0400000 \b|DEAD_STRIPPABLE_DYLIB
+>>24 belong &0x0800000 \b|HAS_TLV_DESCRIPTORS
+>>24 belong &0x1000000 \b|NO_HEAP_EXECUTION
+>>24 belong &0x2000000 \b|APP_EXTENSION_SAFE
+>>24 belong x \b>
#
0 lelong&0xfffffffe 0xfeedface Mach-O
!:strength +1
+!:mime application/x-mach-binary
>0 use \^mach-o-be
0 belong&0xfffffffe 0xfeedface Mach-O
!:strength +1
+!:mime application/x-mach-binary
>0 use mach-o-be
diff --git a/magic/Magdir/macintosh b/magic/Magdir/macintosh
index 3ca2cab..e7c0e5e 100644
--- a/magic/Magdir/macintosh
+++ b/magic/Magdir/macintosh
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: macintosh,v 1.25 2014/09/03 13:34:16 christos Exp $
+# $File: macintosh,v 1.27 2017/03/17 21:35:28 christos Exp $
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
@@ -109,9 +109,9 @@
# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
# and that 74 will be 0. So something like
-#
+#
# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
-#
+#
# >73 byte&0x01 0x01 \b, inited
# >73 byte&0x02 0x02 \b, changed
# >73 byte&0x04 0x04 \b, busy
@@ -254,7 +254,7 @@
>0x9C string INDEX data file index
>0x9C string VIEW data view
-# spss magic for SPSS system and portable files,
+# spss magic for SPSS system and portable files,
# from Bruce Foster (bef@nwu.edu).
0 long 0xc1e2c3c9 SPSS Portable File
@@ -273,7 +273,7 @@
# entries depend on the data arithmetic added after v.35
# There's also some Pascal strings in here, ditto...
-# The boot block signature, according to IM:Files, is
+# The boot block signature, according to IM:Files, is
# "for HFS volumes, this field always contains the value 0x4C4B."
# But if this is true for MFS or HFS+ volumes, I don't know.
# Alternatively, the boot block is supposed to be zeroed if it's
@@ -291,17 +291,20 @@
# *.hfs updated by Joerg Jenderek
# http://en.wikipedia.org/wiki/Hierarchical_File_System
# "BD" gives many false positives
-0x400 beshort 0x4244
+0x400 beshort 0x4244
# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
# first block of volume bit map (always 3)
->0x40e ubeshort 0x0003
+>0x40e ubeshort 0x0003
# maximal length of volume name is 27
>>0x424 ubyte <28 Macintosh HFS data
-#!:mime application/octet-stream
-# these mime and apple types are not sure
!:mime application/x-apple-diskimage
#!:apple hfsdINIT
#!:apple MACSdisk
+# http://www.macdisk.com/macsigen.php
+#!:apple ddskdevi
+!:apple ????devi
+# https://en.wikipedia.org/wiki/Apple_Disk_Image
+!:ext hfs/dmg
>>>0 beshort 0x4C4B (bootable)
#>>>0 beshort 0x0000 (not bootable)
>>>0x40a beshort &0x8000 (locked)
@@ -348,15 +351,15 @@
#>0x230 string x first type: %s,
#>0x210 string x name: %s,
#>0x254 belong x number of blocks: %d,
-#>0x400 beshort 0x504D
+#>0x400 beshort 0x504D
#>>0x430 string x second type: %s,
#>>0x410 string x name: %s,
#>>0x454 belong x number of blocks: %d,
-#>>0x800 beshort 0x504D
+#>>0x800 beshort 0x504D
#>>>0x830 string x third type: %s,
#>>>0x810 string x name: %s,
#>>>0x854 belong x number of blocks: %d,
-#>>>0xa00 beshort 0x504D
+#>>>0xa00 beshort 0x504D
#>>>>0xa30 string x fourth type: %s,
#>>>>0xa10 string x name: %s,
#>>>>0xa54 belong x number of blocks: %d
diff --git a/magic/Magdir/mail.news b/magic/Magdir/mail.news
index 7a8123a..a61bc72 100644
--- a/magic/Magdir/mail.news
+++ b/magic/Magdir/mail.news
@@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
-# $File: mail.news,v 1.22 2013/01/04 14:22:07 christos Exp $
+# $File: mail.news,v 1.23 2015/06/29 14:44:26 christos Exp $
# mail.news: file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
@@ -41,6 +41,7 @@
# From: Simon Matter <simon.matter@invoca.ch>
0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB
+0 string \241\002\213\015twoskip\ file\0\0\0\0 Cyrus twoskip DB
# JAM(mbp) Fidonet message area databases
# JHR file
diff --git a/magic/Magdir/make b/magic/Magdir/make
index ba7630d..2895325 100644
--- a/magic/Magdir/make
+++ b/magic/Magdir/make
@@ -1,15 +1,29 @@
#------------------------------------------------------------------------------
-# $File: make,v 1.1 2011/12/08 12:12:46 rrt Exp $
+# $File: make,v 1.3 2016/12/10 14:21:29 christos Exp $
# make: file(1) magic for makefiles
#
-0 regex \^CFLAGS makefile script text
+# URL: https://en.wikipedia.org/wiki/Make_(software)
+0 regex/100l \^CFLAGS makefile script text
!:mime text/x-makefile
-0 regex \^LDFLAGS makefile script text
+0 regex/100l \^VPATH makefile script text
!:mime text/x-makefile
-0 regex \^all: makefile script text
+0 regex/100l \^LDFLAGS makefile script text
!:mime text/x-makefile
-0 regex \^.PRECIOUS makefile script text
+0 regex/100l \^all: makefile script text
!:mime text/x-makefile
-
-0 regex \^SUBDIRS automake makefile script text
+0 regex/100l \^\\.PRECIOUS makefile script text
+!:mime text/x-makefile
+# Update: Joerg Jenderek
+# Reference: https://www.freebsd.org/cgi/man.cgi?make(1)
+# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST"
+# by additional escaping point character
+0 regex/100l \^\\.BEGIN BSD makefile script text with "%s"
+!:mime text/x-makefile
+!:ext /mk
+# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT"
+# and NSIS script with "!include" by additional escaping point character
+0 regex/100l \^\\.include BSD makefile script text with "%s"
+!:mime text/x-makefile
+!:ext /mk
+0 regex/100l \^SUBDIRS automake makefile script text
!:mime text/x-makefile
diff --git a/magic/Magdir/map b/magic/Magdir/map
index d9471fe..e02b205 100644
--- a/magic/Magdir/map
+++ b/magic/Magdir/map
@@ -1,7 +1,7 @@
#------------------------------------------------------------------------------
-# $File: map,v 1.1 2014/06/03 18:22:25 christos Exp $
+# $File: map,v 1.4 2015/08/10 05:18:27 christos Exp $
# map: file(1) magic for Map data
#
@@ -9,9 +9,11 @@
8 string .FIT FIT Map data
>15 byte 0
>>35 belong x \b, unit id %d
-# 20 years after unix epoch
>>39 lelong x \b, serial %u
->>43 ledate/631152000 x \b, %s
+# http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
+# 20 years after unix epoch
+# TZ=GMT date -d '1989-12-31 0:00' +%s
+>>43 leldate+631065600 x \b, %s
>>47 leshort x \b, manufacturer %d
>>47 leshort 1 \b (garmin)
@@ -23,3 +25,17 @@
>>53 byte 4 \b (Activity)
>>53 byte 8 \b (Elevations)
>>53 byte 10 \b (Totals)
+
+# TOM TOM GPS watches ttbin files:
+# http://github.com/ryanbinns/ttwatch/tree/master/ttbin
+# From: Daniel Lenski
+0 byte 0x20
+>1 leshort 0x0007
+>>0x76 byte 0x20
+>>>0x77 leshort 0x0075 TomTom activity file, v7
+>>>>8 leldate x (%s,
+>>>>3 byte x device firmware %d.
+>>>>4 byte x \b%d.
+>>>>5 byte x \b%d,
+>>>>6 leshort x product ID %04d)
+
diff --git a/magic/Magdir/maple b/magic/Magdir/maple
index 05a8eaf..44ab284 100644
--- a/magic/Magdir/maple
+++ b/magic/Magdir/maple
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: maple,v 1.7 2013/01/11 16:45:23 christos Exp $
+# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $
# maple: file(1) magic for maple files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Maple V release 4, a multi-purpose math program
@@ -13,7 +13,7 @@
# no magic for these :-(
# they are compiled indexes for maple files
-# .hdb
+# .hdb
0 string \000\004\000\000 Maple help database
# .mhp
@@ -40,7 +40,7 @@
# from byte 4 it is either 'nul E' or 'soh R'
# I think 'nul E' means a file that was saved as a different name
# a sort of revision marking
-# 'soh R' means new
+# 'soh R' means new
>4 string \000\105 An old revision
>4 string \001\122 The latest save
diff --git a/magic/Magdir/marc21 b/magic/Magdir/marc21
index 7e859a3..fd509ec 100644
--- a/magic/Magdir/marc21
+++ b/magic/Magdir/marc21
@@ -2,27 +2,29 @@
# marc21: file(1) magic for MARC 21 Format
#
# Kevin Ford (kefo@loc.gov)
-#
+#
# MARC21 formats are for the representation and communication
# of bibliographic and related information in machine-readable
# form. For more info, see http://www.loc.gov/marc/
# leader position 20-21 must be 45
-20 string 45
+# and 22-23 also 00 so far, but we check that later.
+20 string 45
+>0 search/2048 \x1e
# leader starts with 5 digits, followed by codes specific to MARC format
->0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic
+>>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic
!:mime application/marc
->0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority
+>>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority
!:mime application/marc
->0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings
+>>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings
!:mime application/marc
-0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification
+>>0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification
!:mime application/marc
->0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community
+>>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community
!:mime application/marc
# leader position 22-23, should be "00" but is it?
->0 regex/1l (^.{21})([^0]{2}) (non-conforming)
+>>0 regex/1l (^.{21})([^0]{2}) (non-conforming)
!:mime application/marc
diff --git a/magic/Magdir/mathematica b/magic/Magdir/mathematica
index 3c10a57..e76957e 100644
--- a/magic/Magdir/mathematica
+++ b/magic/Magdir/mathematica
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $
+# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $
# mathematica: file(1) magic for mathematica files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Mathematica a multi-purpose math program
@@ -8,13 +8,16 @@
#mathematica .mb
0 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook
+!:ext mb
0 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook
+!:ext mb
# .ma
# multiple possibilites:
0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook
#>41 string >\0 %s
+!:ext mb
#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x
@@ -25,20 +28,28 @@
# generic:
0 string (*^\r\r::[\011 Mathematica notebook version 2.x
+!:ext mb
0 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x
+!:ext mb
0 string (*^\015 Mathematica notebook version 2.x
+!:ext mb
0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x
+!:ext mb
0 string (*^\r::[\011 Mathematica notebook version 2.x
+!:ext mb
0 string (*^\r\n::[\011 Mathematica notebook version 2.x
+!:ext mb
0 string (*^\n\n::[\011 Mathematica notebook version 2.x
+!:ext mb
0 string (*^\n::[\011 Mathematica notebook version 2.x
+!:ext mb
# Mathematica .mx files
#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file
0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file
-#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
+#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
# >71... is optional
>88 string >\0 from %s
@@ -48,7 +59,7 @@
0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think)
# .ml files These are menu resources I think
-# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
+# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
# how to put that into a magic rule?
4 string \ A~ MAthematica .ml file
diff --git a/magic/Magdir/metastore b/magic/Magdir/metastore
index 285c3cf..53f5b37 100644
--- a/magic/Magdir/metastore
+++ b/magic/Magdir/metastore
@@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
-# $File: metastore,v 1.1 2011/04/06 12:37:44 christos Exp $
+# $File: metastore,v 1.2 2017/03/17 21:35:28 christos Exp $
# metastore: file(1) magic for metastore files
# From: Thomas Wissen
# see http://david.hardeman.nu/software.php#metastore
-0 string MeTaSt00r3 Metastore data file,
+0 string MeTaSt00r3 Metastore data file,
>10 bequad x version %0llx
diff --git a/magic/Magdir/meteorological b/magic/Magdir/meteorological
index 541bbbf..9e7a3f1 100644
--- a/magic/Magdir/meteorological
+++ b/magic/Magdir/meteorological
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: meteorological,v 1.1 2014/08/04 06:26:16 christos Exp $
+# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $
# rinex: file(1) magic for RINEX files
# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
@@ -34,7 +34,7 @@
>>&32 string x \b, date %15.15s
>>5 string x \b, version %6.6s
!:mime rinex/meteorological
->80 search/256 XXRINEXN RINEX Data, Navigation
+>80 search/256 XXRINEXN RINEX Data, Navigation
>>&32 string x \b, date %15.15s
>>5 string x \b, version %6.6s
!:mime rinex/navigation
diff --git a/magic/Magdir/microfocus b/magic/Magdir/microfocus
new file mode 100644
index 0000000..e5b247c
--- /dev/null
+++ b/magic/Magdir/microfocus
@@ -0,0 +1,21 @@
+
+#------------------------------------------------------------------------------
+# $File: microfocus,v 1.2 2017/03/17 21:35:28 christos Exp $
+# Micro Focus COBOL data files.
+
+# http://documentation.microfocus.com/help/index.jsp?topic=\
+# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html
+# http://www.cobolproducts.com/datafile/data-viewer.html
+# https://github.com/miracle2k/mfcobol-export
+
+0 string \x30\x00\x00\x7C
+>36 string \x00\x3E Micro Focus File with Header (DAT)
+!:mime application/octet-stream
+
+0 string \x30\x7E\x00\x00
+>36 string \x00\x3E Micro Focus File with Header (DAT)
+!:mime application/octet-stream
+
+39 string \x02
+>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX)
+!:mime application/octet-stream
diff --git a/magic/Magdir/mime b/magic/Magdir/mime
index 42ca52d..57b2dd5 100644
--- a/magic/Magdir/mime
+++ b/magic/Magdir/mime
@@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
-# $File: mime,v 1.6 2010/11/25 15:00:12 christos Exp $
+# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $
# mime: file(1) magic for MIME encoded files
#
-0 string/t Content-Type:\
+0 string/t Content-Type:\040
>14 string >\0 %s
0 string/t Content-Type:
>13 string >\0 %s
diff --git a/magic/Magdir/misctools b/magic/Magdir/misctools
index 0367ec0..3ce91b5 100644
--- a/magic/Magdir/misctools
+++ b/magic/Magdir/misctools
@@ -1,13 +1,22 @@
#-----------------------------------------------------------------------------
-# $File: misctools,v 1.14 2014/03/06 16:08:58 christos Exp $
+# $File: misctools,v 1.17 2017/03/17 21:35:28 christos Exp $
# misctools: file(1) magic for miscellaneous UNIX tools.
#
0 search/1 %%!! X-Post-It-Note text
0 string/c BEGIN:VCALENDAR vCalendar calendar file
!:mime text/calendar
+# updated by Joerg Jenderek at Apr 2015
+# Extension: .vcf
+# http://en.wikipedia.org/wiki/VCard
0 string/c BEGIN:VCARD vCard visiting card
-!:mime text/x-vcard
+# deprecated
+#!:mime text/x-vcard
+!:mime text/vcard
+# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
+>12 search/14000/c VERSION:
+# VERSION 2.1 , 3.0 or 4.0
+>>&0 string x \b, version %-.3s
# Summary: Libtool library file
# Extension: .la
@@ -20,7 +29,35 @@
0 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file
# From: Daniel Novotny <dnovotny@redhat.com>
-0 string MDMP\x93\xA7 MDMP crash report data
+# Update: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps
+# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx
+#
+# "Windows Minidump" by TrID
+# ./misctools (version 5.25) labeled the entry as "MDMP crash report data"
+0 string MDMP Mini DuMP crash report
+# http://filext.com/file-extension/DMP
+!:mime application/x-dmp
+!:ext dmp/mdmp
+# The high-order word is an internal value that is implementation specific.
+# The low-order word is MINIDUMP_VERSION 0xA793
+>4 ulelong&0x0000FFFF !0xA793 \b, version 0x%4.4x
+# NumberOfStreams 8,9,10,13
+>8 ulelong x \b, %d streams
+# StreamDirectoryRva 0x20
+>12 ulelong !0x20 \b, 0x%8.8x RVA
+# CheckSum 0
+>16 ulelong !0 \b, CheckSum 0x%8.8x
+# Reserved or TimeDateStamp
+>20 ledate x \b, %s
+# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
+# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800
+>24 ulelong x \b, 0x%x type
+# >24 ulelong >0 \b; include
+# >>24 ulelong &0x00000001 \b data sections,
+# >>24 ulelong &0x00000020 \b list of unloaded modules,
+# >>24 ulelong &0x00000100 \b process and thread information,
+# >>24 ulelong &0x00000800 \b memory information,
# Summary: abook addressbook file
# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu>
diff --git a/magic/Magdir/modem b/magic/Magdir/modem
index 84bdb28..d988e90 100644
--- a/magic/Magdir/modem
+++ b/magic/Magdir/modem
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: modem,v 1.5 2010/09/20 18:55:20 rrt Exp $
+# $File: modem,v 1.8 2017/03/17 21:35:28 christos Exp $
# modem: file(1) magic for modem programs
#
# From: Florian La Roche <florian@knorke.saar.de>
@@ -8,8 +8,48 @@
>29 byte 1 \b, fine resolution
>29 byte 0 \b, normal resolution
-0 short 0x0100 raw G3 data, byte-padded
-0 short 0x1400 raw G3 data
+# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header).
+# Modified by: Joerg Jenderek
+# URL: https://de.wikipedia.org/wiki/Fax
+# Reference: http://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
+# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others
+0 short 0x0100
+# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER
+>2 search/9 \0\0
+# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
+>2 default x
+# skip IRCAM file (VAX big-endian) ./audio
+>>0 belong !0x0001a364
+# skip GEM Image data ./images
+>>>2 beshort !0x0008
+# look for first keyword of Panorama database *.pan
+>>>>11 search/262 \x06DESIGN
+# skip Panorama database
+>>>>11 default x
+# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files
+>>>>>27118 search/1864 DreamWorld
+>>>>>27118 default x
+# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom
+>>>>>>8 ubequad !0x2e01010454010203
+# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom
+>>>>>>>8 ubequad !0x5dee74ad1aa56394 raw G3 (Group 3) FAX, byte-padded
+# version 5.25 labeled the entry above "raw G3 data, byte-padded"
+!:mime image/g3fax
+#!:apple ????TIFF
+!:ext g3
+# unusual image starting with black pixel
+#0 short 0x1300 raw G3 (Group 3) FAX
+0 short 0x1400
+# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom
+>2 search/9 \0\0
+# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
+>2 default x raw G3 (Group 3) FAX
+# version 5.25 labeled the above entry as "raw G3 data"
+!:mime image/g3fax
+!:ext g3
+# unusual image with black pixel near beginning
+#0 short 0x1900 raw G3 (Group 3) FAX
+
#
# Magic data for vgetty voice formats
# (Martin Seine & Marc Eberhard)
@@ -33,3 +73,14 @@
0 string PVF2\n portable voice format
>5 string >\0 (ascii %s)
+# From: Bernd Nuernberger <bernd.nuernberger@web.de>
+# Brooktrout G3 fax data incl. 128 byte header
+# Common suffixes: 3??, BRK, BRT, BTR
+0 leshort 0x01bb
+>2 leshort 0x0100 Brooktrout 301 fax image,
+>>9 leshort x %d x
+>>0x2d leshort x %d
+>>6 leshort 200 \b, fine resolution
+>>6 leshort 100 \b, normal resolution
+>>11 byte 1 \b, G3 compression
+>>11 byte 2 \b, G32D compression
diff --git a/magic/Magdir/mozilla b/magic/Magdir/mozilla
index 1f89589..2328801 100644
--- a/magic/Magdir/mozilla
+++ b/magic/Magdir/mozilla
@@ -1,9 +1,10 @@
#------------------------------------------------------------------------------
-# $File: mozilla,v 1.4 2009/09/19 16:28:11 christos Exp $
-# mozilla: file(1) magic for Mozilla XUL fastload files
+# $File: mozilla,v 1.7 2017/03/17 21:35:28 christos Exp $
+# mozilla: file(1) magic for Mozilla XUL fastload files
# (XUL.mfasl and XPC.mfasl)
# URL: http://www.mozilla.org/
# From: Josh Triplett <josh@freedesktop.org>
0 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data
+0 string mozLz4a Mozilla lz4 compressed bookmark data
diff --git a/magic/Magdir/msdos b/magic/Magdir/msdos
index 64d4862..6eb12c2 100644
--- a/magic/Magdir/msdos
+++ b/magic/Magdir/msdos
@@ -1,12 +1,12 @@
#------------------------------------------------------------------------------
-# $File: msdos,v 1.100 2014/06/03 19:17:27 christos Exp $
+# $File: msdos,v 1.120 2017/08/13 00:21:47 christos Exp $
# msdos: file(1) magic for MS-DOS files
#
# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
# updated by Joerg Jenderek at Oct 2008,Apr 2011
-0 string/t @
+0 string/t @
>1 string/cW \ echo\ off DOS batch file text
!:mime text/x-msdos-batch
>1 string/cW echo\ off DOS batch file text
@@ -24,7 +24,11 @@
100 search/0xffff say
>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text
-0 leshort 0x14c MS Windows COFF Intel 80386 object file
+# updated by Joerg Jenderek at Oct 2015
+# https://de.wikipedia.org/wiki/Common_Object_File_Format
+# http://www.delorie.com/djgpp/doc/coff/filhdr.html
+# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable"
+#0 leshort 0x14c MS Windows COFF Intel 80386 object file
#>4 ledate x stamp %s
0 leshort 0x166 MS Windows COFF MIPS R4000 object file
#>4 ledate x stamp %s
@@ -226,7 +230,7 @@
>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
>>(8.s*16) string emx
>>>&1 string x for DOS, Win or OS/2, emx %s
->>&(&0x42.l-3) byte x
+>>&(&0x42.l-3) byte x
>>>&0x26 string UPX \b, UPX compressed
# and yet another guess: small .text, and after large .data is unusal, could be 32lite
>>&0x2c search/0xa0 .text
@@ -236,8 +240,8 @@
>(8.s*16) string $WdX \b, WDos/X DOS extender
# By now an executable type should have been printed out. The executable
-# may be a self-uncompressing archive, so look for evidence of that and
-# print it out.
+# may be a self-uncompressing archive, so look for evidence of that and
+# print it out.
#
# Some signatures below from Greg Roelofs, newt@uchicago.edu.
#
@@ -279,8 +283,8 @@
# Skip to the end of the EXE. This will usually work fine in the PE case
# because the MZ image is hardcoded into the toolchain and almost certainly
# won't match any of these signatures.
->(4.s*512) long x
->>&(2.s-517) byte x
+>(4.s*512) long x
+>>&(2.s-517) byte x
>>>&0 string PK\3\4 \b, ZIP self-extracting archive
>>>&0 string Rar! \b, RAR self-extracting archive
>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive
@@ -308,80 +312,77 @@
# only version=0x100 found
>3 uleshort x \b, version 0x%x
# length of string containing author,info and special characters
->6 ubyte >0
+>6 ubyte >0
#>>6 pstring x \b, name=%s
>>7 string >\0 \b, author=%-.14s
>>7 search/254 \xff \b, info=
#>>>&0 string x \b%-s
>>>&0 string x \b%-.15s
-# for FreeDOS *.KL files
+# for FreeDOS *.KL files
0 string/b KLF FreeDOS KEYBoard Layout file
# only version=0x100 or 0x101 found
>3 uleshort x \b, version 0x%x
# stringlength
->5 ubyte >0
+>5 ubyte >0
>>8 string x \b, name=%-.2s
-0 string \xffKEYB\ \ \ \0\0\0\0
+0 string \xffKEYB\ \ \ \0\0\0\0
>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file
-# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
-# Uncommenting only the first two lines will cover about 2/3 of COM files,
-# but it isn't feasible to match all COM files since there must be at least
-# two dozen different one-byte "magics".
-# test too generic ?
-0 byte 0xe9 DOS executable (COM)
->0x1FE leshort 0xAA55 \b, boot code
->6 string SFX\ of\ LHarc (%s)
-
-# DOS device driver updated by Joerg Jenderek at May 2011
-# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
-0 ulequad&0x07a0ffffffff 0xffffffff DOS executable (
->40 search/7 UPX! \bUPX compressed
+# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017
+# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
+0 ulequad&0x07a0ffffffff 0xffffffff
+>0 use msdos-driver
+0 name msdos-driver DOS executable (
+#!:mime application/octet-stream
+!:mime application/x-dosdriver
+# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
+!:ext sys/dev/bin
+>40 search/7 UPX! \bUPX compressed
# DOS device driver attributes
>4 uleshort&0x8000 0x0000 \bblock device driver
# character device
>4 uleshort&0x8000 0x8000 \b
->>4 uleshort&0x0008 0x0008 \bclock
+>>4 uleshort&0x0008 0x0008 \bclock
# fast video output by int 29h
->>4 uleshort&0x0010 0x0010 \bfast
+>>4 uleshort&0x0010 0x0010 \bfast
# standard input/output device
->>4 uleshort&0x0003 >0 \bstandard
+>>4 uleshort&0x0003 >0 \bstandard
>>>4 uleshort&0x0001 0x0001 \binput
>>>4 uleshort&0x0003 0x0003 \b/
->>>4 uleshort&0x0002 0x0002 \boutput
+>>>4 uleshort&0x0002 0x0002 \boutput
>>4 uleshort&0x8000 0x8000 \bcharacter device driver
->0 ubyte x
+>0 ubyte x
# upx compressed device driver has garbage instead of real in name field of header
->>40 search/7 UPX!
->>40 default x
+>>40 search/7 UPX!
+>>40 default x
# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
->>>12 ubyte >0x27 \b
->>>>10 ubyte >0x20
->>>>>10 ubyte !0x2E
+>>>12 ubyte >0x2E \b
+>>>>10 ubyte >0x20
+>>>>>10 ubyte !0x2E
>>>>>>10 ubyte !0x2A \b%c
->>>>11 ubyte >0x20
+>>>>11 ubyte >0x20
>>>>>11 ubyte !0x2E \b%c
->>>>12 ubyte >0x20
->>>>>12 ubyte !0x39
+>>>>12 ubyte >0x20
+>>>>>12 ubyte !0x39
>>>>>>12 ubyte !0x2E \b%c
->>>13 ubyte >0x20
+>>>13 ubyte >0x20
>>>>13 ubyte !0x2E \b%c
->>>>14 ubyte >0x20
+>>>>14 ubyte >0x20
>>>>>14 ubyte !0x2E \b%c
->>>>15 ubyte >0x20
+>>>>15 ubyte >0x20
>>>>>15 ubyte !0x2E \b%c
->>>>16 ubyte >0x20
->>>>>16 ubyte !0x2E
+>>>>16 ubyte >0x20
+>>>>>16 ubyte !0x2E
>>>>>>16 ubyte <0xCB \b%c
->>>>17 ubyte >0x20
->>>>>17 ubyte !0x2E
+>>>>17 ubyte >0x20
+>>>>>17 ubyte !0x2E
>>>>>>17 ubyte <0x90 \b%c
# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
->>>4 uleshort&0x8000 0x8000
->>>>12 ubyte <0x2F
+>>>12 ubyte <0x2F
# they have their real name at offset 22
->>>>>22 string >\0 \b%-.5s
->4 uleshort&0x8000 0x0000
+# also block device drivers like DUMBDRV.SYS
+>>>>22 string >\056 %-.6s
+>4 uleshort&0x8000 0x0000
# 32 bit sector addressing ( > 32 MB) for block devices
>>4 uleshort&0x0002 0x0002 \b,32-bit sector-
# support by driver functions 13h, 17h, 18h
@@ -389,54 +390,129 @@
# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
>4 uleshort&0x0800 0x0800 \b,close media-
# output until busy support by int 10h for character device driver
->4 uleshort&0x8000 0x8000
+>4 uleshort&0x8000 0x8000
>>4 uleshort&0x2000 0x2000 \b,until busy-
# direct read/write support by driver functions 03h,0Ch
>4 uleshort&0x4000 0x4000 \b,control strings-
->4 uleshort&0x8000 0x8000
+>4 uleshort&0x8000 0x8000
>>4 uleshort&0x6840 >0 \bsupport
->4 uleshort&0x8000 0x0000
+>4 uleshort&0x8000 0x0000
>>4 uleshort&0x4842 >0 \bsupport
>0 ubyte x \b)
-# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
-# Too weak, matches files that only contain 0's
-#0 ulequad&0x000007a0ffffffed 0x0000000000000000 DOS-executable (
-#>4 uleshort&0x8000 0x8000 \bcharacter device driver
-#>>10 string x %-.8s
-#>4 uleshort&0x4000 0x4000 \b,control strings-support)
-
-# test too generic ?
-0 byte 0x8c DOS executable (COM)
+# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
+0 ulequad 0x0513c00000000012
+>0 use msdos-driver
+# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
+0 ulequad 0x32f28000ffff0016
+>0 use msdos-driver
+0 ulequad 0x007f00000000ffff
+>0 use msdos-driver
+0 ulequad 0x001600000000ffff
+>0 use msdos-driver
+# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
+0 ulequad 0x0bf708c2ffffffff
+>0 use msdos-driver
+0 ulequad 0x07bd08c2ffffffff
+>0 use msdos-driver
+
+# updated by Joerg Jenderek
+# GRR: line below too general as it catches also
+# rt.lib DYADISKS.PIC and many more
+# start with assembler instruction MOV
+0 ubyte 0x8c
+# skip "AppleWorks word processor data" like ARTICLE.1 ./apple
+>4 string !O====
+# skip some unknown basic binaries like RocketRnger.SHR
+>>5 string !MAIN
+# skip "GPG symmetrically encrypted data" ./gnu
+# skip "PGP symmetric key encrypted data" ./pgp
+# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type
+>>>4 ubyte >13 DOS executable (COM, 0x8C-variant)
+# the remaining files should be DOS *.COM executables
+# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd
+# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4
+# UNDELETE.COM 8cca 2e8916 6503 b430 cd21 8b 2e0200 8b
+# BOOTFIX.COM 8cca 2e8916 9603 b430 cd21 8b 2e0200 8b
+# RAWRITE3.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
+# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
+# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e
+# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e
+!:mime application/x-dosexec
+!:ext com
+
# updated by Joerg Jenderek at Oct 2008
0 ulelong 0xffff10eb DR-DOS executable (COM)
# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
-0 ubeshort&0xeb8d >0xeb00
+0 ubeshort&0xeb8d >0xeb00
# DR-DOS STACKER.COM SCREATE.SYS missed
->0 byte 0xeb
->>0x1FE leshort 0xAA55 DOS executable (COM), boot code
->>85 string UPX DOS executable (COM), UPX compressed
->>4 string \ $ARX DOS executable (COM), ARX self-extracting archive
->>4 string \ $LHarc DOS executable (COM), LHarc self-extracting archive
->>0x20e string SFX\ by\ LARC DOS executable (COM), LARC self-extracting archive
-# updated by Joerg Jenderek at Oct 2008
-#0 byte 0xb8 COM executable
-0 uleshort&0x80ff 0x00b8
+
+0 name msdos-com
+>0 byte x DOS executable (COM)
+>6 string SFX\ of\ LHarc \b, %s
+>0x1FE leshort 0xAA55 \b, boot code
+>85 string UPX \b, UPX compressed
+>4 string \ $ARX \b, ARX self-extracting archive
+>4 string \ $LHarc \b, LHarc self-extracting archive
+>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
+
+# JMP 8bit
+0 byte 0xeb
+# allow forward jumps only
+>1 byte >-1
+# that offset must be accessible
+>>(1.b+2) byte x
+>>>0 use msdos-com
+
+# JMP 16bit
+0 byte 0xe9
+# forward jumps
+>1 short >-1
+# that offset must be accessible
+>>(1.s+3) byte x
+>>>0 use msdos-com
+# negative offset, must not lead into PSP
+>1 short <-259
+# that offset must be accessible
+>>(1,s+65539) byte x
+>>>0 use msdos-com
+
+# updated by Joerg Jenderek at Oct 2008,2015
+# following line is too general
+0 ubyte 0xb8
+# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux
+>0 string !\xb8\xc0\x07\x8e
# modified by Joerg Jenderek
->1 lelong !0x21cd4cff COM executable for DOS
+# syslinux COM32 or COM32R executable
+>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT
+# http://www.syslinux.org/wiki/index.php/Comboot_API
+# Since version 5.00 c32 modules switched from the COM32 object format to ELF
+!:mime application/x-c32-comboot-syslinux-exec
+!:ext c32
# http://syslinux.zytor.com/comboot.php
+# older syslinux version ( <4 )
# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
# start with assembler instructions mov eax,21cd4cffh
-0 uleshort&0xc0ff 0xc0b8
->1 lelong 0x21cd4cff COM executable (32-bit COMBOOT)
+>>>1 lelong 0x21CD4CFf \b)
# syslinux:doc/comboot.txt
# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
# eax,21cd4cfeh) as a magic number.
-0 string/b \xb8\xfe\x4c\xcd\x21 COM executable (COM32R)
-# start with assembler instructions mov eax,21cd4cfeh
-0 uleshort&0xc0ff 0xc0b8
->1 lelong 0x21cd4cfe COM executable (32-bit COMBOOT, relocatable)
-0 string/b \x81\xfc
->4 string \x77\x02\xcd\x20\xb9
+# syslinux version (4.x)
+# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID
+>>>1 lelong 0x21CD4CFe \b, relocatable)
+# remaining are DOS COM executables starting with assembler instruction MOV
+# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM
+# MS-DOS SYS.COM RESTART.COM
+# SYSLINUX.COM (version 1.40 - 2.13)
+# GFXBOOT.COM (version 3.75)
+# COPYBS.COM POWEROFF.COM INT18.COM
+>>1 default x COM executable for DOS
+!:mime application/x-dosexec
+#!:mime application/x-ms-dos-executable
+#!:mime application/x-msdos-program
+!:ext com
+
+0 string/b \x81\xfc
+>4 string \x77\x02\xcd\x20\xb9
>>36 string UPX! FREE-DOS executable (COM), UPX compressed
252 string Must\ have\ DOS\ version DR-DOS executable (COM)
# added by Joerg Jenderek at Oct 2008
@@ -453,10 +529,10 @@
#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
5 string \xcd\x21 COM executable for DOS
#DELTMP.COm HASFAT32.cOM
-7 string \xcd\x21
+7 string \xcd\x21
>0 byte !0xb8 COM executable for DOS
#COMP.cOM MORE.COm
-10 string \xcd\x21
+10 string \xcd\x21
>5 string !\xcd\x21 COM executable for DOS
#comecho.com
13 string \xcd\x21 COM executable for DOS
@@ -504,10 +580,23 @@
0 string/b PO^Q` Microsoft Word 6.0 Document
!:mime application/msword
#
-0 string/b \376\067\0\043 Microsoft Office Document
+4 long 0
+>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0
+!:mime application/msword
+!:ext mcw
+>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0
+!:mime application/msword
+!:ext mcw
+>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0
!:mime application/msword
-0 string/b \333\245-\0\0\0 Microsoft Office Document
+!:ext mcw
+>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0
!:mime application/msword
+!:ext mcw
+
+0 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document
+!:mime application/msword
+!:ext doc
512 string/b \354\245\301 Microsoft Word Document
!:mime application/msword
@@ -533,17 +622,158 @@
0 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
!:mime application/vnd.ms-excel
#
-0 belong 0x00001a00 Lotus 1-2-3
-!:mime application/x-123
->4 belong 0x00100400 wk3 document data
->4 belong 0x02100400 wk4 document data
->4 belong 0x07800100 fm3 or fmb document data
->4 belong 0x07800000 fm3 or fmb document data
+# Update: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3
+# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
+# Note: newer Lotus versions >2 use longer BOF record
+# record type (BeginningOfFile=0000h) + length (001Ah)
+0 belong 0x00001a00
+# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3
+#>18 uleshort&0x73E0 0
+# Lotus Multi Byte Character Set (LMBCS=1-31)
+>20 ubyte >0
+>>20 ubyte <32 Lotus 1-2-3
+#!:mime application/x-123
+!:mime application/vnd.lotus-1-2-3
+!:apple ????L123
+# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data"
+>>>4 uleshort 0x1000 WorKsheet, version 3
+!:ext wk3
+# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data"
+>>>4 uleshort 0x1002 WorKsheet, version 4
+# also worksheet template 4 (.wt4)
+!:ext wk4/wt4
+# no example or documentation for wk5
+#>>4 uleshort 0x???? WorKsheet, version 4
+#!:ext wk5
+# only MacrotoScript.123 example
+>>>4 uleshort 0x1003 WorKsheet, version 97
+# also worksheet template Smartmaster (.12M)?
+!:ext 123
+# only Set_Y2K.123 example
+>>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium
+!:ext 123
+# no example for this version
+>>>4 uleshort 0x8001 FoRMatting data
+!:ext frm
+# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data"
+# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet"
+>>>4 uleshort 0x8007 ForMatting data, version 3
+!:ext fm3
+>>>4 default x unknown
+# file revision sub code 0004h for worksheets
+>>>>6 uleshort =0x0004 worksheet
+!:ext wXX
+>>>>6 uleshort !0x0004 formatting data
+!:ext fXX
+# main revision number
+>>>>4 uleshort x \b, revision 0x%x
+>>>6 uleshort =0x0004 \b, cell range
+# active cellcoord range (start row, page,column ; end row, page, column)
+# start values normally 0~1st sheet A1
+>>>>8 ulelong !0
+>>>>>10 ubyte >0 \b%d*
+>>>>>8 uleshort x \b%d,
+>>>>>11 ubyte x \b%d-
+# end page mostly 0
+>>>>14 ubyte >0 \b%d*
+# end raw, column normally not 0
+>>>>12 uleshort x \b%d,
+>>>>15 ubyte x \b%d
+# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??)
+>>>>20 ubyte >1 \b, character set 0x%x
+# flags
+>>>>21 ubyte x \b, flags 0x%x
+>>>6 uleshort !0x0004
+# record type (FONTNAME=00AEh)
+>>>>30 search/29 \0\xAE
+# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
+>>>>>&4 string >\0 \b, 1st font "%s"
#
-0 belong 0x00000200 Lotus 1-2-3
-!:mime application/x-123
->4 belong 0x06040600 wk1 document data
->4 belong 0x06800200 fmt document data
+# Update: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3
+# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
+# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
+# record type (BeginningOfFile=0000h) + length (0002h)
+0 belong 0x00000200
+# GRR: line above is too general as it catches also MS Windows CURsor
+# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
+!:strength -1
+# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
+>7 ubyte 0
+# skip Windows cursors with image width 256 and keep Lotus with positiv opcode
+>>6 ubyte >0 Lotus
+# !:mime application/x-123
+!:mime application/vnd.lotus-1-2-3
+!:apple ????L123
+# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...)
+# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3"
+>>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF)
+!:ext cnf
+>>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J
+!:ext cnf
+>>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1
+!:ext cnf
+>>>4 uleshort 0x0802 Symphony CoNFiguration
+!:ext cnf
+>>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2
+!:ext cnf
+>>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4
+!:ext cnf
+>>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x
+!:ext cnf
+>>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x
+!:ext cnf
+# (version 5.26) labeled the entry as "Lotus 123"
+# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
+>>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1
+# extension "wks" also for Microsoft Works document
+!:ext wks
+# (version 5.26) labeled the entry as "Lotus 123"
+# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
+>>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0
+!:ext wrk/wr1
+# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data"
+# TrID labeles the entry as "Lotus 123 Worksheet (V2)"
+>>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2
+# Symphony (.wr1)
+!:ext wk1/wr1
+# no example for this japan version
+>>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ
+!:ext wj1
+# no example or documentation for wk2
+#>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2
+#!:ext wk2
+# undocumented japan version
+>>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J
+!:ext wj3
+# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data"
+>>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x
+# japan version 2.4J (fj3)
+!:ext fmt/fj3
+# no example for this version
+>>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0
+!:ext frm
+# (version 5.26) labeled the entry as "Lotus 1-2-3"
+>>>4 default x unknown worksheet or configuration
+!:ext cnf
+>>>>4 uleshort x \b, revision 0x%x
+# 2nd record for most worksheets describes cells range
+>>>6 use lotus-cells
+# 3nd record for most japan worksheets describes cells range
+>>>(8.s+10) use lotus-cells
+# check and then display Lotus worksheet cells range
+0 name lotus-cells
+# look for type (RANGE=0006h) + length (0008h) at record begin
+>0 ubelong 0x06000800 \b, cell range
+# cell range (start column, row, end column, row) start values normally 0,0~A1 cell
+>>4 ulong !0
+>>>4 uleshort x \b%d,
+>>>6 uleshort x \b%d-
+# end of cell range
+>>8 uleshort x \b%d,
+>>10 uleshort x \b%d
+# EndOfLotus123
0 string/b WordPro\0 Lotus WordPro
!:mime application/vnd.lotus-wordpro
0 string/b WordPro\r\373 Lotus WordPro
@@ -588,56 +818,95 @@
0 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
# Windows icons
-0 name ico-dir
-# not entirely accurate, the number of icons is part of the header
->0 byte 1 - 1 icon
->0 ubyte >1 - %d icons
->2 byte 0 \b, 256x
->2 byte !0 \b, %dx
->3 byte 0 \b256
->3 byte !0 \b%d
->4 ubyte !0 \b, %d colors
-
+# Update: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
+# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG
0 belong 0x00000100
>9 byte 0
->>0 byte x MS Windows icon resource
-!:mime image/x-icon
->>4 use ico-dir
+>>0 byte x
+>>0 use cur-ico-dir
>9 ubyte 0xff
->>0 byte x MS Windows icon resource
-!:mime image/x-icon
->>4 use ico-dir
+>>0 byte x
+>>0 use cur-ico-dir
+# displays number of icons and information for icon or cursor
+0 name cur-ico-dir
+# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
+# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
+>18 ulelong &0x00000006
+# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
+>>(18.l) ulelong x MS Windows
+>>>0 ubelong 0x00000100 icon resource
+#!:mime image/vnd.microsoft.icon
+!:mime image/x-icon
+!:ext ico
+>>>>4 uleshort x - %d icon
+# plural s
+>>>>4 uleshort >1 \bs
+# 1st icon
+>>>>0x06 use ico-entry
+# 2nd icon
+>>>>4 uleshort >1
+>>>>>0x16 use ico-entry
+>>>0 ubelong 0x00000200 cursor resource
+#!:mime image/x-cur
+!:mime image/x-win-bitmap
+!:ext cur
+>>>>4 uleshort x - %d icon
+>>>>4 uleshort >1 \bs
+# 1st cursor
+>>>>0x06 use cur-entry
+#>>>>0x16 use cur-entry
+# display information of one cursor entry
+0 name cur-entry
+>0 use cur-ico-entry
+>4 uleshort x \b, hotspot @%dx
+>6 uleshort x \b%d
+# display information of one icon entry
+0 name ico-entry
+>0 use cur-ico-entry
+# normally 0 1 but also found 14
+>4 uleshort >1 \b, %d planes
+# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256
+>6 uleshort >1 \b, %d bits/pixel
+# display shared information of cursor or icon entry
+0 name cur-ico-entry
+>0 byte =0 \b, 256x
+>0 byte !0 \b, %dx
+>1 byte =0 \b256
+>1 byte !0 \b%d
+# number of colors in palette
+>2 ubyte !0 \b, %d colors
+# reserved 0 FFh
+#>3 ubyte x \b, reserved %x
+#>8 ulelong x \b, image size %d
+# offset of PNG or DIB image
+#>12 ulelong x \b, offset 0x%x
+# PNG header (\x89PNG)
+>(12.l) ubelong =0x89504e47
+>>&-4 indirect x \b with
+# DIB image
+>(12.l) ubelong !0x89504e47
+#>>&-4 use dib-image
# Windows non-animated cursors
-0 name cur-dir
-# not entirely accurate, the number of icons is part of the header
->0 byte 1 - 1 icon
->0 ubyte >1 - %d icons
->2 byte 0 \b, 256x
->2 byte !0 \b, %dx
->3 byte 0 \b256
->3 byte !0 \b%d
->6 uleshort x \b, hotspot @%dx
->8 uleshort x \b%d
-
+# Update: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
+# Note: similar to Windows ICOn. container for BMP ( only DIB part)
+# GRR: line below is too general as it catches also Lotus 1-2-3 files
0 belong 0x00000200
>9 byte 0
->>0 byte x MS Windows cursor resource
-!:mime image/x-cur
->>4 use cur-dir
+>>0 use cur-ico-dir
>9 ubyte 0xff
->>0 byte x MS Windows cursor resource
-!:mime image/x-cur
->>4 use cur-dir
+>>0 use cur-ico-dir
# .chr files
-0 string/b PK\010\010BGI Borland font
+0 string/b PK\010\010BGI Borland font
>4 string >\0 %s
# then there is a copyright notice
# .bgi files
-0 string/b pk\010\010BGI Borland device
+0 string/b pk\010\010BGI Borland device
>4 string >\0 %s
# then there is a copyright notice
@@ -654,24 +923,6 @@
0 lelong 0x00000005
>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP)
-
-##### put in Either Magic/font or Magic/news
-# Acroread or something files wrongly identified as G3 .pfm
-# these have the form \000 \001 any? \002 \000 \000
-# or \000 \001 any? \022 \000 \000
-0 belong&0xffff00ff 0x00010012 PFM data
->4 string \000\000
->6 string >\060 - %s
-
-0 belong&0xffff00ff 0x00010002 PFM data
->4 string \000\000
->6 string >\060 - %s
-#0 string \000\001 pfm?
-#>3 string \022\000\000Copyright\ yes
-#>3 string \002\000\000Copyright\ yes
-#>3 string >\0 oops, not a font file. Cancel that.
-#it clashes with ttf files so put it lower down.
-
# From Doug Lee via a FreeBSD pr
9 string GERBILDOC First Choice document
9 string GERBILDB First Choice database
@@ -686,7 +937,7 @@
0 lelong 0x08086b70 TurboC BGI file
0 lelong 0x08084b50 TurboC Font file
-# Debian#712046: The magic below identifies "Delphi compiled form data".
+# Debian#712046: The magic below identifies "Delphi compiled form data".
# An additional source of information is available at:
# http://www.woodmann.com/fravia/dafix_t1.htm
0 string TPF0
@@ -695,7 +946,7 @@
# tests for DBase files moved, updated and merged to database
0 string PMCC Windows 3.x .GRP file
-1 string RDC-meg MegaDots
+1 string RDC-meg MegaDots
>8 byte >0x2F version %c
>9 byte >0x2F \b.%c file
0 lelong 0x4C
@@ -712,16 +963,16 @@
#>0x181 leshort x \b, offset %x
#>0x183 leshort x \b, offsetdata %x
#>0x185 leshort x \b, section length %x
->0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0
->>&0x5e ubyte >0
+>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0
+>>&0x5e ubyte >0
>>>&-1 string <PIFMGR.DLL \b, icon=%s
#>>>&-1 string PIFMGR.DLL \b, icon=%s
>>>&-1 string >PIFMGR.DLL \b, icon=%s
->>&0xF0 ubyte >0
+>>&0xF0 ubyte >0
>>>&-1 string <Terminal \b, font=%.32s
#>>>&-1 string =Terminal \b, font=%.32s
>>>&-1 string >Terminal \b, font=%.32s
->>&0x110 ubyte >0
+>>&0x110 ubyte >0
>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s
#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s
>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s
@@ -737,6 +988,7 @@
# DOS EPS Binary File Header
# From: Ed Sznyter <ews@Black.Market.NET>
0 belong 0xC5D0D3C6 DOS EPS Binary File
+!:mime image/x-eps
>4 long >0 Postscript starts at byte %d
>>8 long >0 length %d
>>>12 long >0 Metafile starts at byte %d
@@ -744,15 +996,15 @@
>>>20 long >0 TIFF starts at byte %d
>>>>24 long >0 length %d
-# TNEF magic From "Joomy" <joomy@se-ed.net>
+# TNEF magic From "Joomy" <joomy@se-ed.net>
# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
-0 leshort 0x223e9f78 TNEF
+0 lelong 0x223e9f78 TNEF
!:mime application/vnd.ms-tnef
# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
# of http://www.davep.org/norton-guides/ng2h-105.tgz
# http://en.wikipedia.org/wiki/Norton_Guides
-0 string NG\0\001
+0 string NG\0\001
# only value 0x100 found at offset 2
>2 ulelong 0x00000100 Norton Guide
# Title[40]
@@ -762,7 +1014,7 @@
>>48 string >\0 \b, %-.66s
>>114 string >\0 %-.66s
-# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
+# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
# of http://www.4dos.info/
# pointer,HelpID[8]=4DHnnnmm
0 ulelong 0x48443408 4DOS help file
@@ -772,7 +1024,7 @@
0 ulequad 0x3a000000024e4c MS Advisor help file
# HtmlHelp files (.chm)
-0 string/b ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data
+0 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data
# GFA-BASIC (Wolfram Kleff)
2 string/b GFA-BASIC3 GFA-BASIC 3 data
@@ -810,7 +1062,7 @@
# Windows Enhanced Metafile (EMF)
-# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
+# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
# for further information.
0 ulelong 1
>40 string \ EMF Windows Enhanced Metafile (EMF) image data
@@ -856,7 +1108,8 @@
# Type: Microsoft Document Imaging Format (.mdi)
# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
# From: Daniele Sempione <scrows@oziosi.org>
-0 short 0x5045 Microsoft Document Imaging Format
+# Too weak (EP)
+#0 short 0x5045 Microsoft Document Imaging Format
# MS eBook format (.lit)
0 string/b ITOLITLS Microsoft Reader eBook Data
@@ -869,8 +1122,9 @@
# Windows Imaging (WIM) Image
0 string/b MSWIM\000\000\000 Windows imaging (WIM) image
+0 string/b WLPWM\000\000\000 Windows imaging (WIM) image, wimlib pipable format
-# The second byte of these signatures is a file version; I don't know what,
+# The second byte of these signatures is a file version; I don't know what,
# if anything, produced files with version numbers 0-2.
# From: John Elliott <johne@seasip.demon.co.uk>
0 string \xfc\x03\x00 Mallard BASIC program data (v1.11)
@@ -881,3 +1135,66 @@
0 string MIOPEN Mallard BASIC Jetsam data
0 string Jetsam0 Mallard BASIC Jetsam index data
+# DOS backup 2.0 to 3.2
+
+# backupid.@@@
+
+# plausibility check for date
+0x3 ushort >1979
+>0x5 ubyte-1 <31
+>>0x6 ubyte-1 <12
+# actually 121 nul bytes
+>>>0x7 string \0\0\0\0\0\0\0\0
+>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d
+!:ext @@@
+>>>>0x0 ubyte 0xff \b, last disk
+
+# backed up file
+
+# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
+# by looking for trailing nul of maximal file name string
+0x52 ubyte 0
+# test for flag byte: FFh~complete file, 00h~split file
+# FFh -127 = -1 -127 = -128
+# 00h -127 = 0 -127 = -127
+>0 byte-127 <-126
+# plausibility check for file name length
+>>0x53 ubyte-1 <78
+# looking for terminating nul of file name string
+>>>(0x53.b+4) ubyte 0
+# looking if last char of string is valid DOS file name
+>>>>(0x53.b+3) ubyte >0x1F
+# actually 44 nul bytes
+# but sometimes garbage according to Ralf Quint. So can not be used as test
+#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
+# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
+>>>>>5 ubyte&0x8C 0x0C
+# ./msdos (version 5.30) labeled the entry as
+# "DOS 2.0 backed up file %s, split file, sequence %d" or
+# "DOS 2.0 backed up file %s, complete file"
+>>>>>>0 ubyte x DOS 2.0-3.2 backed up
+#>>>>>>0 ubyte 0xff complete
+>>>>>>0 ubyte 0
+>>>>>>>1 uleshort x sequence %d of
+# full file name with path but without drive letter and colon stored from 0x05 til 0x52
+>>>>>>0x5 string x file %s
+# backup name is original filename
+#!:ext *
+# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*'
+# file: line 1169: Bad magic entry ' *'
+# after header original file content
+>>>>>>128 indirect x \b;
+
+
+# DOS backup 3.3 to 5.x
+
+# CONTROL.nnn files
+0 string \x8bBACKUP\x20
+# actually 128 nul bytes
+>0xa string \0\0\0\0\0\0\0\0
+>>0x9 ubyte x DOS 3.3 backup control file, sequence %d
+>>0x8a ubyte 0xff \b, last disk
+
+# NB: The BACKUP.nnn files consist of the files backed up,
+# concatenated.
diff --git a/magic/Magdir/msvc b/magic/Magdir/msvc
index 1095d05..13f847f 100644
--- a/magic/Magdir/msvc
+++ b/magic/Magdir/msvc
@@ -1,10 +1,10 @@
#------------------------------------------------------------------------------
-# $File: msvc,v 1.5 2009/09/19 16:28:11 christos Exp $
+# $File: msvc,v 1.9 2017/08/02 08:15:20 christos Exp $
# msvc: file(1) magic for msvc
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Microsoft visual C
-#
+#
# I have version 1.0
# .aps
@@ -27,11 +27,35 @@
#.pch
0 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch
-# .pdb
-# too long 0 string Microsoft\ C/C++\ program\ database\
-0 string Microsoft\ C/C++\ MSVC program database
->18 string program\ database\
->33 string >\0 ver %s
+# Summary: Symbol Table / Debug info used by Microsoft compilers
+# URL: https://en.wikipedia.org/wiki/Program_database
+# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format
+# Update: Joerg Jenderek
+# Note: test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86
+# info does only applies partly for older files like msvbvm50.pdb about year 2001
+0 string Microsoft\ C/C++\040
+# "Microsoft Program DataBase" by TrID
+>24 search/14 \r\n\x1A MSVC program database
+!:mime application/x-ms-pdb
+!:ext pdb
+# "MSF 7.00" "program database 2.00" for msvbvm50.pdb
+>>16 regex \([0-9.]+\) ver %s
+#>>>0x38 search/128123456 /LinkInfo \b with linkinfo
+# "MSF 7.00" variant
+>>0x1e leshort 0
+# PageSize 400h 1000h
+>>>0x20 lelong x \b, %d
+# Page Count
+>>>0x28 lelong x \b*%d bytes
+# "program database 2.00" variant
+>>0x1e leshort !0
+# PageSize 400h
+>>>0x2c lelong x \b, %d
+# Page Count for msoo-dll.pdb 4379h
+>>>0x32 leshort x \b*%d bytes
+
+# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d
+0 string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0 Microsoft Rosyln C# debugging symbols version 1.0
#.sbr
0 string \000\002\000\007\000 MSVC .sbr
diff --git a/magic/Magdir/msx b/magic/Magdir/msx
index 0eacbe5..69df641 100644
--- a/magic/Magdir/msx
+++ b/magic/Magdir/msx
@@ -1,26 +1,26 @@
#------------------------------------------------------------------------------
# msx: file(1) magic for the MSX Home Computer
-# v1.1
+# v1.3
# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
############## MSX Music file formats ##############
# Gigamix MGSDRV music file
-0 string MGS MSX Gigamix MGSDRV3 music file,
+0 string/b MGS MSX Gigamix MGSDRV3 music file,
>6 ubeshort 0x0D0A
>>3 byte x \bv%c
>>4 byte x \b.%c
>>5 byte x \b%c
>>8 string >\0 \b, title: %s
-1 string mgs2\ MSX Gigamix MGSDRV2 music file
+1 string/b mgs2\ MSX Gigamix MGSDRV2 music file
>6 uleshort 0x80
>>0x2E uleshort 0
>>>0x30 string >\0 \b, title: %s
# KSS music file
-0 string KSCC KSS music file v1.03
+0 string/b KSCC KSS music file v1.03
>0xE byte 0
>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+)
>>0xF byte&0x02 2 \b, soundchip(s): SN76489
@@ -28,25 +28,25 @@
>>0xF byte&0x01 1 \b, YM2413
>>0xF byte&0x08 8 \b, Y8950
-0 string KSSX KSS music file v1.20
+0 string/b KSSX KSS music file v1.20
>0xE byte&0xEF 0
>>0xF byte&0x40 0x00 \b, 60Hz
>>0xF byte&0x40 0x40 \b, 50Hz
>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+)
>>0xF byte&0x02 0x02 \b, soundchips: SN76489
>>>0xF byte&0x04 0x04 stereo
->>0xF byte&0x01 0x01 \b,
+>>0xF byte&0x01 0x01 \b,
>>>0xF byte&0x18 0x00 \bYM2413
>>>0xF byte&0x18 0x08 \bYM2413, Y8950
>>>0xF byte&0x18 0x18 \bYM2413+Y8950 pseudostereo
>>0xF byte&0x18 0x10 \b, Majyutsushi DAC
# Moonblaster for Moonsound
-0 string MBMS
+0 string/b MBMS
>4 byte 0x10 MSX Moonblaster for MoonSound music
# Music Player K-kaz
-0 string MPK MSX Music Player K-kaz song
+0 string/b MPK MSX Music Player K-kaz song
>6 ubeshort 0x0D0A
>>3 byte x v%c
>>4 byte x \b.%c
@@ -70,7 +70,7 @@
>>>>>0 string >\32 \b, title: %s
# SCMD music file
-0x8B string SCMD
+0x8B string/b SCMD
>0xCE uleshort 0 MSX SCMD Music file
#>>-2 uleshort 0x6a71 ; The file must end with this value. How to code this here?
>>0x8F string >\0 \b, title: %s
@@ -99,36 +99,8 @@
>>5 uleshort 0
>>>3 uleshort >0x013D MSX Graph Saurus compressed image
-# Maki-chan Graphic format
-0 string MAKI02\ \ Maki-chan image,
->8 byte x system ID: %c
->9 byte x \b%c
->10 byte x \b%c
->11 byte x \b%c,
->13 search/0x200 \x1A
-# >>&3 ubyte 0 , video mode: PC-98 400 lines, 16 analog colors
-# >>&3 ubyte 1 , video mode: MSX SC7, 16 analog colors
-# >>&3 ubyte 2 , video mode: VM-98 400 lines, 8 analog colors
-# >>&3 ubyte 3 , video mode: PC-88 analog, 200 lines, 8 analog colors
-# >>&3 ubyte 4 , video mode: 400 lines, 16 digital colors
-# >>&3 ubyte 5 , video mode: 200 lines, 16 digital colors
-# >>&3 ubyte 6 , video mode: old PC-98 digital 400 lines, 8 colors
-# >>&3 ubyte 7 , video mode: PC-88 400 lines, 8 digital colors
->>&8 uleshort+1 x %dx
->>&10 uleshort+1 x \b%d,
->>&3 ubyte&0x82 0x80 256 colors
->>&3 ubyte&0x82 0x00 16 colors
->>&3 ubyte&0x82 0x01 8 colors
->>&3 ubyte&0x04 4 digital
->>&3 ubyte&0x04 0 analog
->>&3 ubyte&0x01 1 \b, 2:1 dot aspect ratio
-
-# Japanese PIC file
-0 string PIC\x1A
->4 lelong 0 Japanese PIC image file
-
# MSX G9B image file
-0 string G9B
+0 string/b G9B
>1 uleshort 11
>>3 uleshort >10
>>>5 ubyte >0 MSX G9B image, depth=%d
@@ -146,70 +118,152 @@
############## Other MSX file formats ##############
-# MSX ROMs
-0 string AB
+# MSX internal ROMs
+0 ubeshort 0xF3C3
+>2 uleshort <0x4000
+>>8 ubyte 0xC3
+>>>9 uleshort <0x4000
+>>>>0x0B ubeshort 0x00C3
+>>>>>0x0D uleshort <0x4000
+>>>>>>0x0F ubeshort 0x00C3
+>>>>>>>0x11 uleshort <0x4000
+>>>>>>>>0x13 ubeshort 0x00C3
+>>>>>>>>>0x15 uleshort <0x4000
+>>>>>>>>>>0x50 ubyte 0xC3
+>>>>>>>>>>>0x51 uleshort <0x4000
+>>>>>>>>>>>>(9.s) ubyte 0xC3
+>>>>>>>>>>>>>&0 uleshort >0x4000
+>>>>>>>>>>>>>>&0 ubyte 0xC3 MSX BIOS+BASIC
+>>>>>>>>>>>>>>>0x002D ubyte+1 <3 \b. version=MSX%d
+>>>>>>>>>>>>>>>0x002D ubyte 2 \b, version=MSX2+
+>>>>>>>>>>>>>>>0x002D ubyte 3 \b, version=MSX Turbo-R
+>>>>>>>>>>>>>>>0x002D ubyte >3 \b, version=Unknown MSX %d version
+>>>>>>>>>>>>>>>0x0006 ubyte x \b, VDP.DR=0x%2x
+>>>>>>>>>>>>>>>0x0007 ubyte x \b, VDP.DW=0x%2x
+>>>>>>>>>>>>>>>0x002B ubyte&0xF 0 \b, charset=Japanese
+>>>>>>>>>>>>>>>0x002B ubyte&0xF 1 \b, charset=International
+>>>>>>>>>>>>>>>0x002B ubyte&0xF 2 \b, charset=Korean
+>>>>>>>>>>>>>>>0x002B ubyte&0xF >2 \b, charset=Unknown id:%d
+>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x00 \b, date format=Y-M-D
+>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x10 \b, date format=M-D-Y
+>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x20 \b, date format=D-M-Y
+>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x00 \b, vfreq=60Hz
+>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x80 \b, vfreq=50Hz
+>>>>>>>>>>>>>>>0x002C ubyte&0x0F 0 \b, keyboard=Japanese
+>>>>>>>>>>>>>>>0x002C ubyte&0x0F 1 \b, keyboard=International
+>>>>>>>>>>>>>>>0x002C ubyte&0x0F 2 \b, keyboard=French
+>>>>>>>>>>>>>>>0x002C ubyte&0x0F 3 \b, keyboard=UK
+>>>>>>>>>>>>>>>0x002C ubyte&0x0F 4 \b, keyboard=German
+>>>>>>>>>>>>>>>0x002C ubyte&0x0F 5 \b, keyboard=Unknown id:%d
+>>>>>>>>>>>>>>>0x002C ubyte&0x0F 6 \b, keyboard=Spanish
+>>>>>>>>>>>>>>>0x002C ubyte&0x0F >6 \b, keyboard=Unknown id:%d
+>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x00 \b, basic=Japanese
+>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x10 \b, basic=International
+>>>>>>>>>>>>>>>0x002C ubyte&0xF0 >0x10 \b, basic=Unknown id:%d
+>>>>>>>>>>>>>>>0x002E ubyte&1 1 \b, built-in MIDI
+
+
+0 string/b CD
+>2 uleshort >0x10
+>>2 uleshort <0x4000
+>>>4 uleshort <0x4000
+>>>>6 uleshort <0x4000
+>>>>>8 ubyte 0xC3
+>>>>>>9 uleshort <0x4000
+>>>>>>>0x10 ubyte 0xC3
+>>>>>>>>0x11 uleshort <0x4000
+>>>>>>>>>0x14 ubyte 0xC3
+>>>>>>>>>>0x15 uleshort <0x4000 MSX2/2+/TR SubROM
+
+0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+>0x5F0 ubequad 0x8282828244380000
+>>0x150 ubyte 0x38
+>>>0x170 string \20\20\20
+>>>>0x1E32 string ())
+>>>>>0x2130 ubequad 0xA5A5594924231807
+>>>>>0x2138 ubequad 0x4A4A3424488830C0 MSX Kanji Font
+
+
+
+# MSX extension ROMs
+0 string/b AB
>2 uleshort 0x0010 MSX ROM
>>2 uleshort x \b, init=0x%4x
->>4 uleshort >0 \b, stat=0x%4x
->>6 uleshort >0 \b, dev=0x%4x
+>>4 uleshort >0 \b, stahdl=0x%4x
+>>6 uleshort >0 \b, devhdl=0x%4x
>>8 uleshort >0 \b, bas=0x%4x
>2 uleshort 0x4010 MSX ROM
>>2 uleshort x \b, init=0x%04x
->>4 uleshort >0 \b, stat=0x%04x
->>6 uleshort >0 \b, dev=0x%04x
+>>4 uleshort >0 \b, stahdl=0x%04x
+>>6 uleshort >0 \b, devhdl=0x%04x
>>8 uleshort >0 \b, bas=0x%04x
>2 uleshort 0x8010 MSX ROM
>>2 uleshort x \b, init=0x%04x
->>4 uleshort >0 \b, stat=0x%04x
->>6 uleshort >0 \b, dev=0x%04x
+>>4 uleshort >0 \b, stahdl=0x%04x
+>>6 uleshort >0 \b, devhdl=0x%04x
>>8 uleshort >0 \b, bas=0x%04x
+0 string/b AB\0\0
+>6 uleshort 0
+>>4 uleshort >0x400F MSX-BASIC extension ROM
+>>>4 uleshort >0 \b, stahdl=0x%04x
+>>>6 uleshort >0 \b, devhdl=0x%04x
+>>>0x1C string OPLL \b, MSX-Music
+>>>>0x18 string PAC2 \b (external)
+>>>>0x18 string APRL \b (internal)
+
+0 string/b AB\0\0\0\0
+>6 uleshort >0x400F MSX device BIOS
+>>6 uleshort >0 \b, devhdl=0x%04x
+
-0 string AB
+0 string/b AB
#>2 string 5JSuperLAYDOCK MSX Super Laydock ROM
#>3 string @HYDLIDE3MSX MSX Hydlide-3 ROM
#>3 string @3\x80IA862 Golvellius MSX1 ROM
->2 uleshort >10
->>10 string \0\0\0\0\0\0 MSX ROM
->>>0x10 string YZ\0\0\0\0 Konami Game Master 2 MSX ROM
->>>0x10 string CD \b, Konami RC-
->>>>0x12 ubyte x \b%d
->>>>0x13 ubyte/16 x \b%d
->>>>0x13 ubyte&0xF x \b%d
->>>0x10 string EF \b, Konami RC-
->>>>0x12 ubyte x \b%d
->>>>0x13 ubyte/16 x \b%d
->>>>0x13 ubyte&0xF x \b%d
->>>2 uleshort x \b, init=0x%04x
->>>4 uleshort >0 \b, stat=0x%04x
->>>6 uleshort >0 \b, dev=0x%04x
->>>8 uleshort >0 \b, bas=0x%04x
->2 uleshort 0
->>4 uleshort 0
->>>6 uleshort 0
->>>>8 uleshort >0 MSX BASIC program in ROM, bas=0x%04x
-
-0x4000 string AB
->0x4002 uleshort >0x4010
->>0x400A string \0\0\0\0\0\0 MSX MegaROM with nonstandard page order
->>0x4002 uleshort x \b, init=0x%04x
->>0x4004 uleshort >0 \b, stat=0x%04x
->>0x4006 uleshort >0 \b, dev=0x%04x
->>0x4008 uleshort >0 \b, bas=0x%04x
-
-0x8000 string AB
->0x8002 uleshort >0x4010
->>0x800A string \0\0\0\0\0\0 MSX MegaROM with nonstandard page order
->>0x8002 uleshort x \b, init=0x%04x
->>0x8004 uleshort >0 \b, stat=0x%04x
->>0x8006 uleshort >0 \b, dev=0x%04x
->>0x8008 uleshort >0 \b, bas=0x%04x
-
-
-0x3C000 string AB
+>2 uleshort >15
+>>2 uleshort <0xC000
+>>>8 string \0\0\0\0\0\0\0\0
+>>>>(2.s&0x3FFF) uleshort >0 MSX ROM
+>>>>>0x10 string YZ\0\0\0\0 Konami Game Master 2 MSX ROM
+>>>>>0x10 string CD \b, Konami RC-
+>>>>>>0x12 ubyte x \b%d
+>>>>>>0x13 ubyte/16 x \b%d
+>>>>>>0x13 ubyte&0xF x \b%d
+>>>>>0x10 string EF \b, Konami RC-
+>>>>>>0x12 ubyte x \b%d
+>>>>>>0x13 ubyte/16 x \b%d
+>>>>>>0x13 ubyte&0xF x \b%d
+>>>>>2 uleshort x \b, init=0x%04x
+>>>>>4 uleshort >0 \b, stahdl=0x%04x
+>>>>>6 uleshort >0 \b, devhdl=0x%04x
+>>>>>8 uleshort >0 \b, bas=0x%04x
+>>>2 uleshort 0
+>>>>4 uleshort 0
+>>>>>6 uleshort 0
+>>>>>>8 uleshort >0 MSX BASIC program in ROM, bas=0x%04x
+
+0x4000 string/b AB
+>0x4002 uleshort >0x400F
+>>0x400A string \0\0\0\0\0\0 MSX ROM with nonstandard page order
+>>>0x4002 uleshort x \b, init=0x%04x
+>>>0x4004 uleshort >0 \b, stahdl=0x%04x
+>>>0x4006 uleshort >0 \b, devhdl=0x%04x
+>>>0x4008 uleshort >0 \b, bas=0x%04x
+
+0x8000 string/b AB
+>0x8002 uleshort >0x400F
+>>0x800A string \0\0\0\0\0\0 MSX ROM with nonstandard page order
+>>>0x8002 uleshort x \b, init=0x%04x
+>>>0x8004 uleshort >0 \b, stahdl=0x%04x
+>>>0x8006 uleshort >0 \b, devhdl=0x%04x
+>>>0x8008 uleshort >0 \b, bas=0x%04x
+
+
+0x3C000 string/b AB
>0x3C008 string \0\0\0\0\0\0\0\0 MSX MegaROM with nonstandard page order
>>0x3C002 uleshort x \b, init=0x%04x
->>0x3C004 uleshort >0 \b, stat=0x%04x
->>0x3C006 uleshort >0 \b, dev=0x%04x
+>>0x3C004 uleshort >0 \b, stahdl=0x%04x
+>>0x3C006 uleshort >0 \b, devhdl=0x%04x
>>0x3C008 uleshort >0 \b, bas=0x%04x
# MSX BIN file
@@ -224,7 +278,7 @@
>>1 uleshort >0x8000 MSX-BASIC program
# MSX .CAS file
-0 string \x1F\xA6\xDE\xBA\xCC\x13\x7D\x74 MSX cassette archive
+0 string/b \x1F\xA6\xDE\xBA\xCC\x13\x7D\x74 MSX cassette archive
# Mega-Assembler file
0 byte 0xFE
@@ -242,7 +296,7 @@
4 uleshort 0x0900
>0xF byte 1
>>0x14 byte 0
->>>0x1E string \ \ \
+>>>0x1E string \040\040\040
>>>>0x23 byte 1
>>>>>0x25 byte 0
>>>>>>0x15 string >\x30
diff --git a/magic/Magdir/mup b/magic/Magdir/mup
index 5060c01..05b9471 100644
--- a/magic/Magdir/mup
+++ b/magic/Magdir/mup
@@ -1,6 +1,6 @@
# ------------------------------------------------------------------------
-# $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $
+# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $
# mup: file(1) magic for Mup (Music Publisher) input file.
#
# From: Abel Cheung <abel (@) oaka.org>
@@ -12,13 +12,13 @@
#
0 search/1 //!Mup Mup music publication program input text
>6 string -Arkkra (Arkkra)
->>13 string -
->>>16 string .
+>>13 string -
+>>>16 string .
>>>>14 string x \b, need V%.4s
->>>15 string .
+>>>15 string .
>>>>14 string x \b, need V%.3s
->6 string -
->>9 string .
+>6 string -
+>>9 string .
>>>7 string x \b, need V%.4s
->>8 string .
+>>8 string .
>>>7 string x \b, need V%.3s
diff --git a/magic/Magdir/nasa b/magic/Magdir/nasa
new file mode 100644
index 0000000..de3545f
--- /dev/null
+++ b/magic/Magdir/nasa
@@ -0,0 +1,7 @@
+
+#------------------------------------------------------------------------------
+# nasa: file(1) magic
+
+# From: Barry Carter <carter.barry@gmail.com>
+0 string DAF/SPK NASA SPICE file (binary format)
+0 string DAFETF\ NAIF\ DAF\ ENCODED NASA SPICE file (transfer format)
diff --git a/magic/Magdir/netbsd b/magic/Magdir/netbsd
index aa933ff..5ee2d71 100644
--- a/magic/Magdir/netbsd
+++ b/magic/Magdir/netbsd
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: netbsd,v 1.22 2014/12/08 20:53:52 christos Exp $
+# $File: netbsd,v 1.24 2017/03/17 21:35:28 christos Exp $
# netbsd: file(1) magic for NetBSD objects
#
# All new-style magic numbers are in network byte order.
@@ -10,7 +10,7 @@
#
0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
@@ -32,7 +32,7 @@
>32 lelong !0 (signal %d)
0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
@@ -54,7 +54,7 @@
>32 belong !0 (signal %d)
0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
@@ -76,7 +76,7 @@
>32 belong !0 (signal %d)
0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
@@ -101,7 +101,7 @@
>12 string >\0 from '%s'
0 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
@@ -123,7 +123,7 @@
>32 belong !0 (signal %d)
0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
@@ -145,7 +145,7 @@
>32 lelong !0 (signal %d)
0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
@@ -167,7 +167,7 @@
>32 lelong !0 (signal %d)
0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
@@ -189,7 +189,7 @@
>32 lelong !0 (signal %d)
# NetBSD/alpha does not support (and has never supported) a.out objects,
-# so no rules are provided for them. NetBSD/alpha ELF objects are
+# so no rules are provided for them. NetBSD/alpha ELF objects are
# dealt with in "elf".
0 lelong 0x00070185 ECOFF NetBSD/alpha binary
>10 leshort 0x0001 not stripped
@@ -199,7 +199,7 @@
>32 lelong !0 (signal %d)
0 belong&0377777777 043400413 a.out NetBSD/mips demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
@@ -286,3 +286,20 @@
>4 leshort x \b, (headersize = %d
>6 leshort x \b, segmentsize = %d
>6 lelong x \b, segments = %d)
+
+# little endian only for now.
+0 name ktrace
+>4 leshort 7
+>>6 leshort <3 NetBSD ktrace file version %d
+>>>12 string x from %s
+>>>56 string x \b, emulation %s
+>>>8 lelong <65536 \b, pid=%d
+
+56 string netbsd
+>0 use ktrace
+56 string linux
+>0 use ktrace
+56 string sunos
+>0 use ktrace
+56 string hpux
+>0 use ktrace
diff --git a/magic/Magdir/netscape b/magic/Magdir/netscape
index 942f08a..0e1ca61 100644
--- a/magic/Magdir/netscape
+++ b/magic/Magdir/netscape
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $
+# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $
# netscape: file(1) magic for Netscape files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# version 3 and 4 I think
@@ -15,11 +15,12 @@
# .snm Caches
0 string #\ Netscape\ folder\ cache Netscape folder cache
0 string \000\036\204\220\000 Netscape folder cache
-# .n2p
-# Net 2 Phone
+# .n2p
+# Net 2 Phone
#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
0 string SX961999 Net2phone
#
#This is files ending in .art, FIXME add more rules
-0 string JG\004\016\0\0\0\0 ART
+0 string JG\004\016\0\0\0\0 AOL ART image
+0 string JG\003\016\0\0\0\0 AOL ART image
diff --git a/magic/Magdir/nitpicker b/magic/Magdir/nitpicker
index 2486dee..48c3d63 100644
--- a/magic/Magdir/nitpicker
+++ b/magic/Magdir/nitpicker
@@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
-# $File: nitpicker,v 1.6 2014/04/30 21:41:02 christos Exp $
+# $File: nitpicker,v 1.7 2017/03/17 21:35:28 christos Exp $
# nitpicker: file(1) magic for Flowfiles.
# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
-0 string NPFF NItpicker Flow File
+0 string NPFF NItpicker Flow File
>4 byte x V%d.
>5 byte x %d
>6 bedate x started: %s
diff --git a/magic/Magdir/os2 b/magic/Magdir/os2
index 8643adc..ace69cb 100644
--- a/magic/Magdir/os2
+++ b/magic/Magdir/os2
@@ -1,13 +1,14 @@
#------------------------------------------------------------------------------
-# $File: os2,v 1.7 2009/09/19 16:28:11 christos Exp $
+# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $
# os2: file(1) magic for OS/2 files
#
# Provided 1998/08/22 by
# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
-1 search/1 InternetShortcut MS Windows 95 Internet shortcut text
->24 search/1 >\ (URL=<%s>)
+1 search/100 InternetShortcut MS Windows 95 Internet shortcut text
+>17 search/100 URL= (URL=<
+>>&0 string x \b%s>)
# OS/2 URL objects
# Provided 1998/08/22 by
@@ -24,7 +25,7 @@
#>5 string >\ (Local file) <%s>
# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)
-# Carl Hauser (chauser.parc@xerox.com) and
+# Carl Hauser (chauser.parc@xerox.com) and
# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
# list the following header format in inf02a.doc:
#
@@ -34,11 +35,11 @@
# // bit 0: set if INF style file
# // bit 4: set if HLP style file
# // patching this byte allows reading HLP files
-# // using the VIEW command, while help files
+# // using the VIEW command, while help files
# // seem to work with INF settings here as well.
# int16 hdrsize; // total size of header
# int16 unknown2; // unknown purpose
-#
+#
0 string HSP\x01\x9b\x00 OS/2 INF
>107 string >0 (%s)
0 string HSP\x10\x9b\x00 OS/2 HLP
diff --git a/magic/Magdir/os9 b/magic/Magdir/os9
index 52b04be..74b47f3 100644
--- a/magic/Magdir/os9
+++ b/magic/Magdir/os9
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: os9,v 1.7 2011/05/13 22:15:54 christos Exp $
+# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $
#
# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
#
@@ -15,7 +15,7 @@
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
diff --git a/magic/Magdir/pbf b/magic/Magdir/pbf
index d133d12..8de6db0 100644
--- a/magic/Magdir/pbf
+++ b/magic/Magdir/pbf
@@ -1,11 +1,11 @@
#------------------------------------------------------------------------------
-# $File: pbf,v 1.1 2013/12/21 14:27:24 christos Exp $
+# $File: pbf,v 1.2 2017/01/18 16:16:21 christos Exp $
# file(1) magic(5) data for OpenStreetMap
# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf)
# http://wiki.openstreetmap.org/wiki/PBF_Format
# From: Markus Heidelberg <markus.heidelberg@web.de>
-0 belong 0x0000000D
->4 beshort 0x0A09
->>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format
+0 belong&0xfffffff0 0
+>4 beshort 0x0A09
+>>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format
diff --git a/magic/Magdir/pc88 b/magic/Magdir/pc88
new file mode 100644
index 0000000..03822f5
--- /dev/null
+++ b/magic/Magdir/pc88
@@ -0,0 +1,24 @@
+#------------------------------------------------------------------------------
+# pc88: file(1) magic for the NEC Home Computer
+# v1.0
+# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
+
+# PC88 2D disk image
+0x20 ulelong&0xFFFFFEFF 0x2A0
+>0x10 string \0\0\0\0\0\0\0\0\0\0
+>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+>>>0x1A ubyte&0xEF 0
+>>>>0x1B ubyte&0x8F 0
+>>>>>0x1B ubyte&70 <0x40
+>>>>>>0x1C ulelong >0x21
+>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s
+>>>>>>>>0x1B ubyte 0 \b, media=2D
+>>>>>>>>0x1B ubyte 0x10 \b, media=2DD
+>>>>>>>>0x1B ubyte 0x20 \b, media=2HD
+>>>>>>>>0x1B ubyte 0x30 \b, media=1D
+>>>>>>>>0x1B ubyte 0x40 \b, media=1DD
+>>>>>>>>0x1A ubyte 0x10 \b, write-protected
+
+
+
+
diff --git a/magic/Magdir/pc98 b/magic/Magdir/pc98
new file mode 100644
index 0000000..3b995ed
--- /dev/null
+++ b/magic/Magdir/pc98
@@ -0,0 +1,77 @@
+#------------------------------------------------------------------------------
+# pc98: file(1) magic for the MSX Home Computer
+# v1.0
+# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
+
+# Maki-chan v1 Graphic format
+# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so
+# http://www.jisyo.com/viewer/faq/maki_tech.htm
+0 string/b MAKI01 Maki-chan v1.
+>6 ubyte|0x20 x \b%c image
+>8 ubelong >0x40404040 \b, system ID:
+>>8 byte x %c
+>>9 byte x \b%c
+>>10 byte x \b%c
+>>11 byte x \b%c
+>44 ubeshort x \b, %dx
+>46 ubeshort x \b%d
+>38 ubeshort&2 0 \b, 16 paletted RGB colors
+>38 ubeshort&2 2 \b, 8 fixed RGB colors
+>38 ubeshort&1 1 \b, 2:1 dot aspect ratio
+
+# Maki-chan v2 Graphic format
+# http://www.jisyo.com/viewer/faq/mag_tech.htm
+# http://mooncore.eu/bunny/txt/makichan.htm
+# http://metanest.jp/mag/mag.xhtml
+0 string/b MAKI02\ \ Maki-chan v2 image,
+>8 byte x system ID: %c
+>9 byte x \b%c
+>10 byte x \b%c
+>11 byte x \b%c,
+>13 search/0x200 \x1A
+#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing:
+#1) When offset1(ubeshort) !=0x0344:
+# 1.1) And offset3(ubyte).b7=0:
+# - b0=pixel aspect ratio: 1=2:1 (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1)
+# - b1=number of colors: 0=16 colors, 1=8 colors
+# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data
+# 1.2) And offset3(ubyte).B7=1:
+# - b0=256 paletted colors
+# - b1=256 fixed colors using the MSX SCR8 palette
+#2) When offset1(ubeshort) =0x0344:
+# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored
+>>&1 ubeshort 0x0344 256x212, 19268 fixed YJK colors
+>>&1 ubeshort !0x0344
+>>>&5 uleshort+1 x %dx
+>>>&7 uleshort+1 x \b%d,
+>>>&0 ubyte&0x86 0x00 16 paletted RGB colors
+>>>&0 ubyte&0x86 0x02 8 paletted RGB colors
+>>>&0 ubyte&0x86 0x04 16 fixed RGB colors
+>>>&0 ubyte&0x86 0x06 8 fixed RGB colors
+>>>&0 ubyte&0x81 0x80 256 paletted RGB colors
+>>>&0 ubyte&0x81 0x81 256 fixed MSX-SCR8 colors
+>>>&0 ubyte&0x01 1 \b, 2:1 dot aspect ratio
+
+# XLD4 (Q4) picture
+11 string/b MAJYO XLD4(Q4) picture
+
+# Yanagisawa Pi picture
+#0 string Pi\x1A\0 Yanagisawa Pi picture
+#>3 search/0x200 \x04
+0 string Pi
+>2 search/0x200 \x1A
+>>&0 ubyte 0
+>>>&3 ubyte 4 Yanagisawa Pi 16 color picture,
+>>>&4 byte x system ID: %c
+>>>&5 byte x \b%c
+>>>&6 byte x \b%c
+>>>&7 byte x \b%c,
+>>>&10 ubeshort x %dx
+>>>&12 ubeshort x \b%d
+>>>&3 ubyte 8 Yanagisawa Pi 256 color picture
+>>>&4 byte x system ID: %c
+>>>&5 byte x \b%c
+>>>&6 byte x \b%c
+>>>&7 byte x \b%c,
+>>>&10 ubeshort x %dx
+>>>&12 ubeshort x \b%d
diff --git a/magic/Magdir/pdf b/magic/Magdir/pdf
index dc2f799..04b564d 100644
--- a/magic/Magdir/pdf
+++ b/magic/Magdir/pdf
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: pdf,v 1.7 2013/08/22 07:47:26 christos Exp $
+# $File: pdf,v 1.9 2017/05/24 17:35:20 christos Exp $
# pdf: file(1) magic for Portable Document Format
#
@@ -9,9 +9,19 @@
>5 byte x \b, version %c
>7 byte x \b.%c
+0 string \012%PDF- PDF document
+!:mime application/pdf
+>6 byte x \b, version %c
+>8 byte x \b.%c
+
# From: Nick Schmalenberger <nick@schmalenberger.us>
# Forms Data Format
0 string %FDF- FDF document
!:mime application/vnd.fdf
>5 byte x \b, version %c
>7 byte x \b.%c
+
+0 search/256 %PDF- PDF document
+!:mime application/pdf
+>&0 byte x \b, version %c
+>&2 byte x \b.%c
diff --git a/magic/Magdir/pdp b/magic/Magdir/pdp
index 0afee0c..2d18b62 100644
--- a/magic/Magdir/pdp
+++ b/magic/Magdir/pdp
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: pdp,v 1.10 2014/04/30 21:41:02 christos Exp $
+# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $
# pdp: file(1) magic for PDP-11 executable/object and APL workspace
#
0 lelong 0101555 PDP-11 single precision APL workspace
@@ -14,8 +14,8 @@
# updated by Joerg Jenderek at Mar 2013
# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
-0 leshort 0401
-# skip *.PNF with WinDirPathOffset 58h
+0 leshort 0401
+# skip *.PNF with WinDirPathOffset 58h
>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp
# skip *.PNF with high byte of InfVersionDatumCount zero
#>>15 byte !0 PDP-11 UNIX/RT ldp
diff --git a/magic/Magdir/perl b/magic/Magdir/perl
index b5b54fb..c391d4a 100644
--- a/magic/Magdir/perl
+++ b/magic/Magdir/perl
@@ -1,47 +1,57 @@
#------------------------------------------------------------------------------
-# $File: perl,v 1.22 2014/04/28 12:04:35 christos Exp $
+# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $
# perl: file(1) magic for Larry Wall's perl language.
#
# The `eval' lines recognizes an outrageously clever hack.
# Keith Waclena <keith@cerberus.uchicago.edu>
# Send additions to <perl5-porters@perl.org>
-0 search/1 eval\ "exec\ /bin/perl Perl script text
+0 search/1024 eval\ "exec\ perl Perl script text
!:mime text/x-perl
-0 search/1 eval\ "exec\ /usr/bin/perl Perl script text
+0 search/1024 eval\ "exec\ /bin/perl Perl script text
!:mime text/x-perl
-0 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text
+0 search/1024 eval\ "exec\ /usr/bin/perl Perl script text
!:mime text/x-perl
-0 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text
+0 search/1024 eval\ "exec\ /usr/local/bin/perl Perl script text
!:mime text/x-perl
-0 search/1 #!/usr/bin/env\ perl Perl script text executable
+0 search/1024 eval\ 'exec\ perl Perl script text
!:mime text/x-perl
-0 search/1 #!\ /usr/bin/env\ perl Perl script text executable
+0 search/1024 eval\ 'exec\ /bin/perl Perl script text
!:mime text/x-perl
-0 search/1 #!
->0 regex \^#!.*/bin/perl$ Perl script text executable
+0 search/1024 eval\ 'exec\ /usr/bin/perl Perl script text
+!:mime text/x-perl
+0 search/1024 eval\ 'exec\ /usr/local/bin/perl Perl script text
+!:mime text/x-perl
+0 search/1024 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text
+!:mime text/x-perl
+0 string #!/usr/bin/env\ perl Perl script text executable
+!:mime text/x-perl
+0 string #!\ /usr/bin/env\ perl Perl script text executable
+!:mime text/x-perl
+0 string #!
+>0 regex \^#!.*/bin/perl([[:space:]].*)*$ Perl script text executable
!:mime text/x-perl
# by Dmitry V. Levin and Alexey Tourbin
# check the first line
-0 search/1 package
+0 search/8192 package
>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text
-!:strength + 10
+!:strength + 40
# not 'p', check other lines
-0 search/1 !p
+0 search/8192 !p
>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *;
>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text
-!:strength + 10
+!:strength + 75
# Perl POD documents
# From: Tom Hukins <tom@eborcom.com>
-0 search/1/W \=pod\n Perl POD document text
-0 search/1/W \n\=pod\n Perl POD document text
-0 search/1/W \=head1\ Perl POD document text
-0 search/1/W \n\=head1\ Perl POD document text
-0 search/1/W \=head2\ Perl POD document text
-0 search/1/W \n\=head2\ Perl POD document text
-0 search/1/W \=encoding\ Perl POD document text
-0 search/1/W \n\=encoding\ Perl POD document text
+0 search/1024/W \=pod\n Perl POD document text
+0 search/1024/W \n\=pod\n Perl POD document text
+0 search/1024/W \=head1\ Perl POD document text
+0 search/1024/W \n\=head1\ Perl POD document text
+0 search/1024/W \=head2\ Perl POD document text
+0 search/1024/W \n\=head2\ Perl POD document text
+0 search/1024/W \=encoding\ Perl POD document text
+0 search/1024/W \n\=encoding\ Perl POD document text
# Perl Storable data files.
diff --git a/magic/Magdir/pgf b/magic/Magdir/pgf
index 825f5f6..b5a251e 100644
--- a/magic/Magdir/pgf
+++ b/magic/Magdir/pgf
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: pgf,v 1.1 2013/04/22 15:19:49 christos Exp $
+# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $
# pgf: file(1) magic for Progressive Graphics File (PGF)
#
# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
@@ -42,7 +42,7 @@
>>20 byte 19 RGB color 12,
>>20 byte 20 RGB color 16,
>>20 byte 255 unknown format,
->>20 default x format
+>>20 default x format
>>>20 byte x \b %d,
>>21 byte x %d bpc
# PGFPostHeader
diff --git a/magic/Magdir/pgp b/magic/Magdir/pgp
index 95a6766..585475d 100644
--- a/magic/Magdir/pgp
+++ b/magic/Magdir/pgp
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: pgp,v 1.11 2014/11/11 21:32:38 christos Exp $
+# $File: pgp,v 1.14 2017/03/17 21:35:28 christos Exp $
# pgp: file(1) magic for Pretty Good Privacy
# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
#
@@ -19,15 +19,15 @@
#>15 string SIGNED\040MESSAGE- signed message
#>15 string PGP\040SIGNATURE- signature
-2 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block
+2 string ---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK- PGP public key block
!:mime application/pgp-keys
>10 search/100 \n\n
>>&0 use pgp
-0 string -----BEGIN\040PGP\40MESSAGE- PGP message
+0 string -----BEGIN\040PGP\040MESSAGE- PGP message
!:mime application/pgp
>10 search/100 \n\n
>>&0 use pgp
-0 string -----BEGIN\040PGP\40SIGNATURE- PGP signature
+0 string -----BEGIN\040PGP\040SIGNATURE- PGP signature
!:mime application/pgp-signature
>10 search/100 \n\n
>>&0 use pgp
@@ -77,7 +77,7 @@
>0 byte 0x30
>>1 byte&0xc0 0x00 Unused [0%x]
>>1 byte&0xc0 0x40 User Attribute
->>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data
+>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data
>>1 byte&0xc0 0xc0 Modification Detection Code
# magic signatures to detect PGP crypto material (from stef)
@@ -194,6 +194,23 @@
>0 byte 0x0a SHA512
>0 byte 0x0b SHA224
+# display public key algorithms as human readable text
+0 name key_algo
+>0 byte 0x01 RSA (Encrypt or Sign)
+# keep old look of version 5.28 without parentheses
+>0 byte 0x02 RSA Encrypt-Only
+>0 byte 0x03 RSA (Sign-Only)
+>0 byte 16 ElGamal (Encrypt-Only)
+>0 byte 17 DSA
+>0 byte 18 Elliptic Curve
+>0 byte 19 ECDSA
+>0 byte 20 ElGamal (Encrypt or Sign)
+>0 byte 21 Diffie-Hellman
+>0 default x
+>>0 ubyte <22 unknown (pub %d)
+# this should never happen
+>>0 ubyte >21 invalid (%d)
+
# pgp symmetric encrypted data
0 byte 0x8c PGP symmetric key encrypted data -
@@ -465,5 +482,41 @@
>1 use pgpkey
0 byte 0x97 PGP Secret Sub-key -
>1 use pgpkey
-0 byte 0x9d PGP Secret Sub-key -
->1 use pgpkey
+0 byte 0x9d
+# Update: Joerg Jenderek
+# secret subkey packet (tag 7) with same structure as secret key packet (tag 5)
+# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len
+>1 ubeshort >0
+#>1 ubeshort x \b, body length 0x%x
+# next packet type often 88h,89h~(tag 2)~Signature Packet
+#>>(1.S+3) ubyte x \b, next packet type 0x%x
+# skip Dragon.SHR DEMO.INIT by looking for positive version
+>>3 ubyte >0
+# skip BUISSON.13 GUITAR1 by looking for low version number
+>>>3 ubyte <5 PGP Secret Sub-key
+# sub-key are normally part of secret key. So it does not occur as standalone file
+#!:ext bin
+# version 2,3~old 4~new . Comment following line for version 5.28 look
+>>>>3 ubyte x (v%d)
+>>>>3 ubyte x -
+# old versions 2 or 3 but no real example found
+>>>>3 ubyte <4
+# 2 byte for key bits in version 5.28 look
+>>>>>11 ubeshort x %db
+>>>>>4 beldate x created on %s -
+# old versions use 2 additional bytes after time stamp
+#>>>>>8 ubeshort x 0x%x
+# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman
+>>>>>10 use key_algo
+>>>>>(11.S/8) ubequad x
+# look after first key
+>>>>>>&5 use keyend
+# new version
+>>>>3 ubyte >3
+>>>>>9 ubeshort x %db
+>>>>>4 beldate x created on %s -
+# display key algorithm
+>>>>>8 use key_algo
+>>>>>(9.S/8) ubequad x
+# look after first key for something like s2k
+>>>>>>&3 use keyend
diff --git a/magic/Magdir/polyml b/magic/Magdir/polyml
new file mode 100644
index 0000000..0af9baf
--- /dev/null
+++ b/magic/Magdir/polyml
@@ -0,0 +1,23 @@
+
+#------------------------------------------------------------------------------
+# $File: polyml,v 1.1 2016/02/26 15:52:45 christos Exp $
+# polyml: file(1) magic for PolyML
+#
+# PolyML
+# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
+# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
+
+# [0]: http://www.polyml.org/
+# [1]: https://github.com/polyml/polyml/blob/master/\
+# libpolyml/savestate.cpp#L146-L147
+# [2]: https://github.com/polyml/polyml/blob/master/\
+# libpolyml/savestate.cpp#L1262-L1263
+
+# Type: Poly/ML saved data
+# From: Matthew Fernandez <matthew.fernandez@gmail.com>
+
+0 string POLYSAVE Poly/ML saved state
+>8 long x version %u
+
+0 string POLYMODU Poly/ML saved module
+>8 long x version %u
diff --git a/magic/Magdir/printer b/magic/Magdir/printer
index 1016826..98fc1df 100644
--- a/magic/Magdir/printer
+++ b/magic/Magdir/printer
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: printer,v 1.26 2014/04/12 14:51:52 christos Exp $
+# $File: printer,v 1.28 2017/03/17 22:20:22 christos Exp $
# printer: file(1) magic for printer-formatted files
#
@@ -13,7 +13,7 @@
>>>15 string EPS \b, type %s
>>>15 string Query \b, type %s
>>>15 string ExitServer \b, type %s
->>>15 search/1000 %%LanguageLevel:\
+>>>15 search/1000 %%LanguageLevel:\040
>>>>&0 string >\0 \b, Level %s
# Some PCs have the annoying habit of adding a ^D as a document separator
0 string \004%! PostScript document text
@@ -24,7 +24,7 @@
>>>16 string EPS \b, type %s
>>>16 string Query \b, type %s
>>>16 string ExitServer \b, type %s
->>>16 search/1000 %%LanguageLevel:\
+>>>16 search/1000 %%LanguageLevel:\040
>>>>&0 string >\0 \b, Level %s
0 string \033%-12345X%!PS PostScript document
@@ -49,18 +49,18 @@
# HP Printer Job Language
0 string \033%-12345X@PJL HP Printer Job Language data
# HP Printer Job Language
-# The header found on Win95 HP plot files is the "Silliest Thing possible"
+# The header found on Win95 HP plot files is the "Silliest Thing possible"
# (TM)
# Every driver puts the language at some random position, with random case
# (LANGUAGE and Language)
# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
-#
+#
0 string \033%-12345X@PJL HP Printer Job Language data
->&0 string >\0 %s
->>&0 string >\0 %s
->>>&0 string >\0 %s
->>>>&0 string >\0 %s
+>&0 string >\0 %s
+>>&0 string >\0 %s
+>>>&0 string >\0 %s
+>>>>&0 string >\0 %s
#>15 string \ ENTER\ LANGUAGE\ =
#>31 string PostScript PostScript
@@ -143,8 +143,8 @@
#------------------------------------------------------------------------------
# HP LaserJet 1000 series downloadable firmware file
-0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
+0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
# From: Paolo <oopla@users.sf.net>
-# Epson ESC/Page, ESC/PageColor
+# Epson ESC/Page, ESC/PageColor
0 string \x1b\x01@EJL Epson ESC/Page language printer data
diff --git a/magic/Magdir/project b/magic/Magdir/project
index efa5d40..9180b57 100644
--- a/magic/Magdir/project
+++ b/magic/Magdir/project
@@ -1,8 +1,8 @@
#------------------------------------------------------------------------------
-# $File: project,v 1.4 2009/09/19 16:28:11 christos Exp $
+# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $
# project: file(1) magic for Project management
-#
+#
# Magic strings for ftnchek project files. Alexander Mai
0 string FTNCHEK_\ P project file for ftnchek
>10 string 1 version 2.7
diff --git a/magic/Magdir/psdbms b/magic/Magdir/psdbms
index 09c733f..3eec965 100644
--- a/magic/Magdir/psdbms
+++ b/magic/Magdir/psdbms
@@ -1,8 +1,14 @@
#------------------------------------------------------------------------------
-# $File: psdbms,v 1.6 2009/09/19 16:28:11 christos Exp $
+# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $
# psdbms: file(1) magic for psdatabase
#
-0 belong&0xff00ffff 0x56000000 ps database
->1 string >\0 version %s
->4 string >\0 from kernel %s
+# Update: Joerg Jenderek
+# GRR: line below too general as it catches also some Panorama database *.pan ,
+# AppleWorks word processor
+0 belong&0xff00ffff 0x56000000
+# assume version starts with digit
+>1 regex/s =^[0-9] ps database
+>>1 string >\0 version %s
+# kernel name
+>>4 string >\0 from kernel %s
diff --git a/magic/Magdir/psl b/magic/Magdir/psl
new file mode 100644
index 0000000..1f88df1
--- /dev/null
+++ b/magic/Magdir/psl
@@ -0,0 +1,14 @@
+
+#------------------------------------------------------------------------------
+# $File: psl,v 1.2 2016/07/14 17:34:27 christos Exp $
+# psl: file(1) magic for Public Suffix List representations
+# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+# URL: https://publicsuffix.org
+# see also: http://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166
+
+0 search/512 \n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data
+
+0 string .DAFSA@PSL_
+>15 string \n Public Suffix List data (optimized)
+>>11 byte >0x2f
+>>>11 byte <0x3a (Version %c)
diff --git a/magic/Magdir/python b/magic/Magdir/python
index 36cdfd8..f21ff65 100644
--- a/magic/Magdir/python
+++ b/magic/Magdir/python
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: python,v 1.26 2014/08/04 05:58:40 christos Exp $
+# $File: python,v 1.34 2017/08/14 07:40:38 christos Exp $
# python: file(1) magic for python
#
# Outlook puts """ too for urgent messages
@@ -9,7 +9,7 @@
0 string/t """ Python script text executable
# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming
# that Py_UnicodeFlag is off for Python 2)
-# 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n"
+# two bytes of magic followed by "\r\n" in little endian order
0 belong 0x994e0d0a python 1.5/1.6 byte-compiled
0 belong 0x87c60d0a python 2.0 byte-compiled
0 belong 0x2aeb0d0a python 2.1 byte-compiled
@@ -24,24 +24,46 @@
0 belong 0x6c0c0d0a python 3.2 byte-compiled
0 belong 0x9e0c0d0a python 3.3 byte-compiled
0 belong 0xee0c0d0a python 3.4 byte-compiled
+0 belong 0x160d0d0a python 3.5.1- byte-compiled
+0 belong 0x170d0d0a python 3.5.2+ byte-compiled
+0 belong 0x330d0d0a python 3.6 byte-compiled
+0 belong 0x3e0d0d0a python 3.7 byte-compiled
+
0 search/1/w #!\ /usr/bin/python Python script text executable
+!:strength + 15
!:mime text/x-python
0 search/1/w #!\ /usr/local/bin/python Python script text executable
+!:strength + 15
!:mime text/x-python
0 search/1 #!/usr/bin/env\ python Python script text executable
+!:strength + 15
!:mime text/x-python
-0 search/1 #!\ /usr/bin/env\ python Python script text executable
+0 search/10 #!\ /usr/bin/env\ python Python script text executable
+!:strength + 15
!:mime text/x-python
# from module.submodule import func1, func2
-0 regex \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable
+0 regex \^from[\040\t\f\r\n]+([A-Za-z0-9_]|\\.)+[\040\t\f\r\n]+import.*$ Python script text executable
+!:strength + 15
!:mime text/x-python
# def __init__ (self, ...):
0 search/4096 def\ __init__
>&0 search/64 self Python script text executable
+!:strength + 15
+!:mime text/x-python
+
+# if __name__ == "__main__":
+0 search/4096 if\ __name__
+>&0 search/64 '__main__' Python script text executable
+>&0 search/64 "__main__" Python script text executable
+!:strength + 15
+!:mime text/x-python
+
+# import module [as abrev]
+0 regex \^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
!:mime text/x-python
# comments
@@ -57,12 +79,19 @@
# except: or finally:
# block
0 search/4096 try:
->&0 regex \^\\s*except.*: Python script text executable
+>&0 regex \^[[:space:]]*except.*:$ Python script text executable
+!:strength + 15
!:mime text/x-python
>&0 search/4096 finally: Python script text executable
!:mime text/x-python
-# def name(args, args):
-0 regex \^(\ |\\t){0,50}def\ {1,50}[a-zA-Z]{1,100}
->&0 regex \ {0,50}\\(([a-zA-Z]|,|\ ){1,255}\\):$ Python script text executable
+# class name[(base classes,)]: [pass]
+0 regex \^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$ Python script text executable
+!:strength + 15
+!:mime text/x-python
+
+# def name(*args, **kwargs):
+0 regex \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100}
+>&0 regex \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable
+!:strength + 15
!:mime text/x-python
diff --git a/magic/Magdir/riff b/magic/Magdir/riff
index e551292..adf0fc9 100644
--- a/magic/Magdir/riff
+++ b/magic/Magdir/riff
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: riff,v 1.30 2014/09/23 17:02:12 christos Exp $
+# $File: riff,v 1.32 2017/03/17 21:35:28 christos Exp $
# riff: file(1) magic for RIFF format
# See
#
@@ -75,7 +75,7 @@
>>18 leshort x \b, %d entries
# RIFF Device Independent Bitmap format
>8 string RDIB \b, device-independent bitmap
->>16 string BM
+>>16 string BM
>>>30 leshort 12 \b, OS/2 1.x format
>>>>34 leshort x \b, %d x
>>>>36 leshort x %d
@@ -226,10 +226,11 @@
>8 string sfbk SoundFont/Bank
# MPEG-1 wrapped in a RIFF, apparently
>8 string CDXA \b, wrapped MPEG-1 (CDXA)
->8 string 4XMV \b, 4X Movie file
+>8 string 4XMV \b, 4X Movie file
# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV
->8 string AMV\040 \b, AMV
+>8 string AMV\040 \b, AMV
>8 string WEBP \b, Web/P image
+!:mime image/webp
>>12 use riff-walk
#
@@ -245,7 +246,7 @@
>>18 beshort x \b, %d entries
# RIFF Device Independent Bitmap format
>8 string RDIB \b, device-independent bitmap
->>16 string BM
+>>16 string BM
>>>30 beshort 12 \b, OS/2 1.x format
>>>>34 beshort x \b, %d x
>>>>36 beshort x %d
@@ -283,7 +284,7 @@
#------------------------------------------------------------------------------
# Sony Wave64
# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
-# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
+# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
0 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data
# 128 bit + total file size (64 bits) so 24 bytes
# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }
diff --git a/magic/Magdir/ruby b/magic/Magdir/ruby
index 26630f3..45a253c 100644
--- a/magic/Magdir/ruby
+++ b/magic/Magdir/ruby
@@ -1,28 +1,51 @@
#------------------------------------------------------------------------------
-# $File: ruby,v 1.5 2010/07/21 16:47:17 christos Exp $
+# $File: ruby,v 1.7 2017/08/14 13:39:18 christos Exp $
# ruby: file(1) magic for Ruby scripting language
# URL: http://www.ruby-lang.org/
# From: Reuben Thomas <rrt@sc3d.org>
# Ruby scripts
-0 search/1/w #!\ /usr/bin/ruby Ruby script text executable
+0 search/1/w #!\ /usr/bin/ruby Ruby script text executable
+!:strength + 15
!:mime text/x-ruby
0 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable
+!:strength + 15
!:mime text/x-ruby
-0 search/1 #!/usr/bin/env\ ruby Ruby script text executable
+0 search/1 #!/usr/bin/env\ ruby Ruby script text executable
+!:strength + 15
!:mime text/x-ruby
-0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable
+0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable
+!:strength + 15
!:mime text/x-ruby
# What looks like ruby, but does not have a shebang
# (modules and such)
# From: Lubomir Rintel <lkundrak@v3.sk>
-0 regex \^[\ \t]*require[\ \t]'[A-Za-z_/]+'
->0 regex include\ [A-Z]|def\ [a-z]|\ do$
->>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby script text
+0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'
+>0 regex def\ [a-z]|\ do$
+>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text
+!:strength + 30
!:mime text/x-ruby
-0 regex \^[\ \t]*(class|module)[\ \t][A-Z]
+0 regex \^[[:space:]]*(class|module)[[:space:]][A-Z]
>0 regex (modul|includ)e\ [A-Z]|def\ [a-z]
->>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby module source text
+>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text
+!:strength + 30
+!:mime text/x-ruby
+# Classes with no modules or defs, beats simple ASCII
+0 regex \^[[:space:]]*(class|module)[[:space:]][A-Z]
+>&0 regex \^[[:space:]]*end([[:space:]]+[;#if].*)?$ Ruby script text
+!:strength + 10
+!:mime text/x-ruby
+# Looks for function definition to balance python magic
+# def name (args)
+# end
+0 regex \^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
+>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text
+!:strength + 10
+!:mime text/x-ruby
+
+0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+' Ruby script text
+!:mime text/x-ruby
+0 regex \^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+ Ruby script text
!:mime text/x-ruby
diff --git a/magic/Magdir/sccs b/magic/Magdir/sccs
index 95b3a5d..4717948 100644
--- a/magic/Magdir/sccs
+++ b/magic/Magdir/sccs
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: sccs,v 1.6 2009/09/19 16:28:12 christos Exp $
+# $File: sccs,v 1.7 2017/03/17 21:35:28 christos Exp $
# sccs: file(1) magic for SCCS archives
#
# SCCS archive structure:
@@ -17,6 +17,6 @@
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can't just say '\001h0', because the five-digit number
# is a checksum that could (presumably) have any leading digit,
-# and we don't have regular expression matching yet.
+# and we don't have regular expression matching yet.
# Hence the following official kludge:
8 string \001s\ SCCS archive data
diff --git a/magic/Magdir/scientific b/magic/Magdir/scientific
index f780743..2e0cf49 100644
--- a/magic/Magdir/scientific
+++ b/magic/Magdir/scientific
@@ -1,7 +1,7 @@
#------------------------------------------------------------------------------
-# $File: scientific,v 1.9 2014/06/03 19:01:34 christos Exp $
-# scientific: file(1) magic for scientific formats
+# $File: scientific,v 1.12 2017/03/17 22:20:22 christos Exp $
+# scientific: file(1) magic for scientific formats
#
# From: Joe Krahn <krahn@niehs.nih.gov>
@@ -90,7 +90,7 @@
# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
# uppercase letters. However, examples have been seen without the date string,
# e.g., the example on the chemime site.
-0 string HEADER\ \ \ \
+0 string HEADER\ \ \ \040
>&0 regex/1l \^.{40}
>>&0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
>>>&0 regex/1ls [A-Z0-9]{4}.{14}$
@@ -104,3 +104,8 @@
>>5 byte x version %d.0
>4 byte >0x00 version %d
>>5 byte x \b.%d
+
+# Type: LXT (interLaced eXtensible Trace)
+# chrysn <chrysn@fsfe.org>
+0 beshort 0x0138 interLaced eXtensible Trace (LXT) file
+>2 beshort >0 (Version %u)
diff --git a/magic/Magdir/sendmail b/magic/Magdir/sendmail
index aeb6203..840859c 100644
--- a/magic/Magdir/sendmail
+++ b/magic/Magdir/sendmail
@@ -1,14 +1,31 @@
#------------------------------------------------------------------------------
-# $File: sendmail,v 1.7 2009/09/19 16:28:12 christos Exp $
+# $File: sendmail,v 1.10 2017/08/13 00:21:47 christos Exp $
# sendmail: file(1) magic for sendmail config files
#
# XXX - byte order?
#
-0 byte 046 Sendmail frozen configuration
->16 string >\0 - version %s
-0 short 0x271c Sendmail frozen configuration
->16 string >\0 - version %s
+# Update: Joerg Jenderek
+# GRR: this test is too general as it catches also
+# READ.ME.FIRST.AWP Sendmail frozen configuration
+# - version ====|====|====|====|====|====|====|====|====|====|====|====|===
+# Email_23_f217153422.ts Sendmail frozen configuration
+# - version \330jK\354
+0 byte 046
+# http://www.sendmail.com/sm/open_source/docs/older_release_notes/
+# freezed configuration file (dbm format?) created from sendmal.cf with -bz
+# by older sendmail. til version 8.6 support for frozen configuration files is removed
+# valid version numbers look like "7.14.4" and should be similar to output of commands
+# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf"
+>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration
+# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc
+!:ext fc
+>>16 string >\0 - version %s
+0 short 0x271c
+# look for valid version number
+>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration
+!:ext fc
+>>16 string >\0 - version %s
#------------------------------------------------------------------------------
# sendmail: file(1) magic for sendmail m4(1) files
diff --git a/magic/Magdir/sequent b/magic/Magdir/sequent
index 5137c0e..780d77e 100644
--- a/magic/Magdir/sequent
+++ b/magic/Magdir/sequent
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: sequent,v 1.12 2014/08/16 16:07:12 christos Exp $
+# $File: sequent,v 1.13 2017/03/17 21:35:28 christos Exp $
# sequent: file(1) magic for Sequent machines
#
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
@@ -33,9 +33,9 @@
# http://en.wikipedia.org/wiki/Sequent_Computer_Systems
# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader
#0 leshort 0x42eb SYMMETRY i386 standalone executable
-0 leshort 0x42eb
+0 leshort 0x42eb
# skip unlike negative version
->124 lelong >-1
+>124 lelong >-1
# assuming version 28867614 is very low probable
>>124 lelong !28867614 SYMMETRY i386 standalone executable
>>>16 lelong >0 not stripped
diff --git a/magic/Magdir/sereal b/magic/Magdir/sereal
index 7fa4503..ead78d5 100644
--- a/magic/Magdir/sereal
+++ b/magic/Magdir/sereal
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: sereal,v 1.2 2014/11/11 20:10:49 christos Exp $
+# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $
# sereal: file(1) magic the Sereal binary serialization format
#
# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
@@ -16,10 +16,20 @@
#
# See https://github.com/Sereal/Sereal/commit/35372ae01d in the
# Sereal.git repository for test Sereal data.
-0 string \=srl Sereal data
+0 name sereal
+>4 byte&0x0F x (version %d,
+>4 byte&0xF0 0x00 uncompressed)
+>4 byte&0xF0 0x10 compressed with non-incremental Snappy)
+>4 byte&0xF0 0x20 compressed with incremental Snappy)
+>4 byte&0xF0 >0x20 unknown subformat, flag: %d>>4)
+
+0 string/b \=srl Sereal data packet
+!:mime application/sereal
+>&0 use sereal
+0 string/b \=\xF3rl Sereal data packet
!:mime application/sereal
->4 byte&0x0F x (version %d,
->4 byte&0xF0 0x00 uncompressed)
->4 byte&0xF0 0x10 compressed with non-incremental Snappy)
->4 byte&0xF0 0x20 compressed with incremental Snappy)
->4 byte&0xF0 >0x20 unknown subformat, flag: %d>>4)
+>&0 use sereal
+0 string/b \=\xC3\xB3rl Sereal data packet, UTF-8 encoded
+!:mime application/sereal
+>&0 use sereal
+
diff --git a/magic/Magdir/sgi b/magic/Magdir/sgi
index a6223d7..ece9988 100644
--- a/magic/Magdir/sgi
+++ b/magic/Magdir/sgi
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: sgi,v 1.21 2014/04/30 21:41:02 christos Exp $
+# $File: sgi,v 1.22 2015/08/29 07:10:35 christos Exp $
# sgi: file(1) magic for Silicon Graphics operating systems and applications
#
# Executable images are handled either in aout (for old-style a.out
@@ -55,8 +55,8 @@
0 string WNGZWZSS Wingz spreadsheet
0 string WNGZWZHP Wingz help file
#
-0 string #Inventor V IRIS Inventor 1.0 file
-0 string #Inventor V2 Open Inventor 2.0 file
+0 string #Inventor\040V IRIS Inventor 1.0 file
+0 string #Inventor\040V2 Open Inventor 2.0 file
# GLF is OpenGL stream encoding
0 string glfHeadMagic(); GLF_TEXT
4 belong 0x7d000000 GLF_BINARY_LSB_FIRST
diff --git a/magic/Magdir/sgml b/magic/Magdir/sgml
index f9cab08..34edd3c 100644
--- a/magic/Magdir/sgml
+++ b/magic/Magdir/sgml
@@ -1,39 +1,42 @@
+
#------------------------------------------------------------------------------
-# $File: sgml,v 1.30 2013/12/21 14:27:24 christos Exp $
+# $File: sgml,v 1.37 2017/07/23 08:23:33 christos Exp $
# Type: SVG Vectorial Graphics
# From: Noel Torres <tecnico@ejerciciosresueltos.com>
-0 string \<?xml\ version="
->15 string >\0
+0 string \<?xml\ version=
+>14 regex ['"\ \t]*[0-9.]+['"\ \t]*
>>19 search/4096 \<svg SVG Scalable Vector Graphics image
!:mime image/svg+xml
>>19 search/4096 \<gnc-v2 GnuCash file
!:mime application/x-gnucash
+0 string \<svg SVG Scalable Vector Graphics image
+!:mime image/svg
# Sitemap file
-0 string/t \<?xml\ version="
->15 string >\0
+0 string/t \<?xml\ version=
+>14 regex ['"\ \t]*[0-9.]+['"\ \t]*
>>19 search/4096 \<urlset XML Sitemap document text
!:mime application/xml-sitemap
# OpenStreetMap XML (.osm)
# http://wiki.openstreetmap.org/wiki/OSM_XML
# From: Markus Heidelberg <markus.heidelberg@web.de>
-0 string \<?xml\ version="
->15 string >\0
+0 string \<?xml\ version=
+>14 regex ['"\ \t]*[0-9.]+['"\ \t]*
>>19 search/4096 \<osm OpenStreetMap XML data
# xhtml
0 string/t \<?xml\ version="
->15 string >\0
->>19 search/4096/cWbt \<!doctype\ html XHTML document text
+>19 search/4096/cWbt \<!doctype\ html XHTML document text
+>>15 string >\0 (version %.3s)
!:mime text/html
0 string/t \<?xml\ version='
->15 string >\0
->>19 search/4096/cWbt \<!doctype\ html XHTML document text
+>19 search/4096/cWbt \<!doctype\ html XHTML document text
+>>15 string >\0 (version %.3s)
!:mime text/html
0 string/t \<?xml\ version="
->15 string >\0
->>19 search/4096/cWbt \<html broken XHTML document text
+>19 search/4096/cWbt \<html broken XHTML document text
+>>15 string >\0 (version %.3s)
!:mime text/html
#------------------------------------------------------------------------------
@@ -44,24 +47,50 @@
0 search/4096/cWt \<!doctype\ html HTML document text
!:mime text/html
!:strength + 5
-0 search/4096/cwt \<head HTML document text
+
+# SVG document
+# https://www.w3.org/TR/SVG/single-page.html
+0 search/4096/cWbt \<!doctype\ svg SVG XML document
+!:mime image/svg+xml
+!:strength + 5
+
+0 search/4096/cwt \<head\> HTML document text
+!:mime text/html
+!:strength + 5
+0 search/4096/cWt \<head\ HTML document text
!:mime text/html
!:strength + 5
-0 search/4096/cwt \<title HTML document text
+0 search/4096/cwt \<title\> HTML document text
!:mime text/html
!:strength + 5
-0 search/4096/cwt \<html HTML document text
+0 search/4096/cWt \<title\ HTML document text
!:mime text/html
!:strength + 5
-0 search/4096/cwt \<script HTML document text
+0 search/4096/cwt \<html\> HTML document text
!:mime text/html
!:strength + 5
-0 search/4096/cwt \<style HTML document text
+0 search/4096/cWt \<html\ HTML document text
!:mime text/html
!:strength + 5
-0 search/4096/cwt \<table HTML document text
+0 search/4096/cwt \<script\> HTML document text
!:mime text/html
!:strength + 5
+0 search/4096/cWt \<script\ HTML document text
+!:mime text/html
+!:strength + 5
+0 search/4096/cwt \<style\> HTML document text
+!:mime text/html
+!:strength + 5
+0 search/4096/cWt \<style\ HTML document text
+!:mime text/html
+!:strength + 5
+0 search/4096/cwt \<table\> HTML document text
+!:mime text/html
+!:strength + 5
+0 search/4096/cWt \<table\ HTML document text
+!:mime text/html
+!:strength + 5
+
0 search/4096/cwt \<a\ href= HTML document text
!:mime text/html
!:strength + 5
@@ -69,28 +98,25 @@
# Extensible markup language (XML), a subset of SGML
# from Marc Prud'hommeaux (marc@apocalypse.org)
0 search/1/cwt \<?xml XML document text
-!:mime application/xml
+!:mime text/xml
!:strength + 5
0 string/t \<?xml\ version\ " XML
-!:mime application/xml
+!:mime text/xml
!:strength + 5
0 string/t \<?xml\ version=" XML
-!:mime application/xml
+!:mime text/xml
!:strength + 5
>15 string/t >\0 %.3s document text
>>23 search/1 \<xsl:stylesheet (XSL stylesheet)
>>24 search/1 \<xsl:stylesheet (XSL stylesheet)
0 string \<?xml\ version=' XML
-!:mime application/xml
+!:mime text/xml
!:strength + 5
>15 string/t >\0 %.3s document text
>>23 search/1 \<xsl:stylesheet (XSL stylesheet)
>>24 search/1 \<xsl:stylesheet (XSL stylesheet)
-0 search/1/wbt \<?xml XML document text
-!:mime application/xml
-!:strength - 10
0 search/1/wt \<?XML broken XML document text
-!:mime application/xml
+!:mime text/xml
!:strength - 10
diff --git a/magic/Magdir/sharc b/magic/Magdir/sharc
index b40e652..e54088b 100644
--- a/magic/Magdir/sharc
+++ b/magic/Magdir/sharc
@@ -1,9 +1,9 @@
#------------------------------------------------------------------------
-# $File: sharc,v 1.7 2014/04/30 21:41:02 christos Exp $
+# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $
# file(1) magic for sharc files
#
-# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
+# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
# FutureGroove Music (dsp@futuregroove.de)
#------------------------------------------------------------------------
diff --git a/magic/Magdir/sinclair b/magic/Magdir/sinclair
index 5882a64..6008892 100644
--- a/magic/Magdir/sinclair
+++ b/magic/Magdir/sinclair
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: sinclair,v 1.5 2009/09/19 16:28:12 christos Exp $
+# $File: sinclair,v 1.6 2015/11/14 13:38:35 christos Exp $
# sinclair: file(1) sinclair QL
# additions to /etc/magic by Thomas M. Ott (ThMO)
@@ -13,20 +13,13 @@
>4 string >\0 label:%.10s
# Sinclair QL OS dump (ThMO)
-# (NOTE: if `file' would be able to use indirect references in a endian format
-# differing from the natural host format, this could be written more
-# reliably and faster...)
-#
-# we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more
-# than the first 8K of a file... #-(
-#
-#0 belong =0x30000
-#>49124 belong <47104
-#>>49128 belong <47104
-#>>>49132 belong <47104
-#>>>>49136 belong <47104 QL OS dump data,
-#>>>>>49148 string >\0 type %.3s,
-#>>>>>49142 string >\0 version %.4s
+0 belong =0x30000
+>49124 belong <47104
+>>49128 belong <47104
+>>>49132 belong <47104
+>>>>49136 belong <47104 QL OS dump data,
+>>>>>49148 string >\0 type %.3s,
+>>>>>49142 string >\0 version %.4s
# Sinclair QL firmware executables (ThMO)
0 string NqNqNq`\004 QL firmware executable (BCPL)
diff --git a/magic/Magdir/sketch b/magic/Magdir/sketch
index 82dacb8..ee731dd 100644
--- a/magic/Magdir/sketch
+++ b/magic/Magdir/sketch
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: sketch,v 1.4 2009/09/19 16:28:12 christos Exp $
-# Sketch Drawings: http://sketch.sourceforge.net/
+# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $
+# Sketch Drawings: http://sketch.sourceforge.net/
# From: Edwin Mons <e@ik.nu>
0 search/1 ##Sketch Sketch document text
diff --git a/magic/Magdir/sql b/magic/Magdir/sql
index c69f44f..acc4529 100644
--- a/magic/Magdir/sql
+++ b/magic/Magdir/sql
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: sql,v 1.15 2014/04/30 21:41:02 christos Exp $
+# $File: sql,v 1.21 2017/03/17 21:35:28 christos Exp $
# sql: file(1) magic for SQL files
#
# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
@@ -10,28 +10,70 @@
#
0 beshort 0xfe01 MySQL table definition file
>2 byte x Version %d
+>3 byte 0 \b, type UNKNOWN
+>3 byte 1 \b, type DIAM_ISAM
+>3 byte 2 \b, type HASH
+>3 byte 3 \b, type MISAM
+>3 byte 4 \b, type PISAM
+>3 byte 5 \b, type RMS_ISAM
+>3 byte 6 \b, type HEAP
+>3 byte 7 \b, type ISAM
+>3 byte 8 \b, type MRG_ISAM
+>3 byte 9 \b, type MYISAM
+>3 byte 10 \b, type MRG_MYISAM
+>3 byte 11 \b, type BERKELEY_DB
+>3 byte 12 \b, type INNODB
+>3 byte 13 \b, type GEMINI
+>3 byte 14 \b, type NDBCLUSTER
+>3 byte 15 \b, type EXAMPLE_DB
+>3 byte 16 \b, type CSV_DB
+>3 byte 17 \b, type FEDERATED_DB
+>3 byte 18 \b, type BLACKHOLE_DB
+>3 byte 19 \b, type PARTITION_DB
+>3 byte 20 \b, type BINLOG
+>3 byte 21 \b, type SOLID
+>3 byte 22 \b, type PBXT
+>3 byte 23 \b, type TABLE_FUNCTION
+>3 byte 24 \b, type MEMCACHE
+>3 byte 25 \b, type FALCON
+>3 byte 26 \b, type MARIA
+>3 byte 27 \b, type PERFORMANCE_SCHEMA
+>3 byte 127 \b, type DEFAULT
+>0x0033 ulong x \b, MySQL version %d
+0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file
+>3 byte x Version %d
+0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file
+>3 byte x Version %d
0 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file
>3 byte x Version %d
+>14 beshort x \b, %d key parts
+>16 beshort x \b, %d unique key parts
+>18 byte x \b, %d keys
+>28 bequad x \b, %lld records
+>36 bequad x \b, %lld deleted records
0 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file
>3 byte x Version %d
0 belong&0xffffff00 0xfefe0900 MySQL Maria index file
>3 byte x Version %d
-0 belong&0xffffff00 0xfefe0A00 MySQL Maria compressed data file
->3 byte x Version %d
-0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file
->3 byte x Version %d
-0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file
+0 belong&0xffffff00 0xfefe0a00 MySQL Maria compressed data file
>3 byte x Version %d
-0 string \376bin MySQL replication log
-0 belong&0xffffff00 0xfefe0b00
->4 string MARIALOG MySQL Maria transaction log file
->>3 byte x Version %d
0 belong&0xffffff00 0xfefe0c00
>4 string MACF MySQL Maria control file
>>3 byte x Version %d
+0 string \376bin MySQL replication log,
+>9 long x server id %d
+>8 byte 1
+>>13 long 69 \b, MySQL V3.2.3
+>>>19 string x \b, server version %s
+>>13 long 75 \b, MySQL V4.0.2-V4.1
+>>>25 string x \b, server version %s
+>8 byte 15 MySQL V5+,
+>>25 string x server version %s
+>4 string MARIALOG MySQL Maria transaction log file
+>>3 byte x Version %d
#------------------------------------------------------------------------------
-# iRiver H Series database file
+# iRiver H Series database file
# From Ken Guest <ken@linux.ie>
# As observed from iRivNavi.iDB and unencoded firmware
#
@@ -54,21 +96,32 @@
# at offset 68 that is preferred over "user version" for indicating the
# associated application.
#
-0 string SQLite\ format\ 3
->60 belong =0x5f4d544e Monotone source repository - SQLite3 database
->68 belong =0x0f055112 Fossil checkout - SQLite3 database
->68 belong =0x0f055113 Fossil global configuration - SQLite3 database
->68 belong =0x0f055111 Fossil repository - SQLite3 database
->68 belong =0x42654462 Bentley Systems BeSQLite Database - SQLite3 database
->68 belong =0x42654c6e Bentley Systems Localization File - SQLite3 database
->68 belong =0x47504b47 OGC GeoPackage file - SQLite3 database
->68 default x SQLite 3.x database
+0 string SQLite\ format\ 3 SQLite 3.x database
+!:mime application/x-sqlite3
+# seldom found extension sqlite3 like in SyncData.sqlite3
+# db
+# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe
+# Unfortunately extension sqlite also used for other databases starting with string
+# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite
+# and with string "ZV-zlib" in like extra.sqlite
+!:ext sqlite/sqlite3/db/dbe
+>60 belong =0x5f4d544e (Monotone source repository)
+>68 belong =0x0f055112 (Fossil checkout)
+>68 belong =0x0f055113 (Fossil global configuration)
+>68 belong =0x0f055111 (Fossil repository)
+>68 belong =0x42654462 (Bentley Systems BeSQLite Database)
+>68 belong =0x42654c6e (Bentley Systems Localization File)
+>68 belong =0x47504b47 (OGC GeoPackage file)
+>68 default x
>>68 belong !0 \b, application id %u
>>60 belong !0 \b, user version %d
+>96 belong x \b, last written using SQLite version %d
+
# SQLite Write-Ahead Log from SQLite version >= 3.7.0
# http://www.sqlite.org/fileformat.html#walformat
0 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log,
+!:ext sqlite-wal/db-wal
>4 belong x version %d
# SQLite Rollback Journal
@@ -76,8 +129,13 @@
0 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal
# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
-# http://www.ullrich.es/job/service-menue/panasonic/panasonic-sendersortierung-sat-am-pc/
-# pceditor_V2003.jar
-0 string PSDB\0 Panasonic channel list database
->126 string SQLite\ format\ 3
->>&-15 indirect x \b; contains
+# https://github.com/PredatH0r/ChanSort
+0 string PSDB\0 Panasonic channel list DataBase
+!:ext db/bin
+#!:mime application/x-db-svl-panasonic
+>126 string SQLite\ format\ 3
+#!:mime application/x-panasonic-sqlite3
+>>&-15 indirect x \b; contains
+
+# H2 Database from http://www.h2database.com/
+0 string --\ H2\ 0.5/B\ --\ \n H2 Database file
diff --git a/magic/Magdir/ssl b/magic/Magdir/ssl
index 5d5daee..2094ef5 100644
--- a/magic/Magdir/ssl
+++ b/magic/Magdir/ssl
@@ -1,8 +1,20 @@
+
+#------------------------------------------------------------------------------
+# $File: ssl,v 1.4 2017/01/22 21:14:25 christos Exp $
+# ssl: file(1) magic for SSL file formats
+
# Type: OpenSSL certificates/key files
# From: Nicolas Collignon <tsointsoin@gmail.com>
-0 string -----BEGIN\ CERTIFICATE----- PEM certificate
-0 string -----BEGIN\ CERTIFICATE\ REQ PEM certificate request
-0 string -----BEGIN\ RSA\ PRIVATE PEM RSA private key
-0 string -----BEGIN\ DSA\ PRIVATE PEM DSA private key
-0 string -----BEGIN\ EC\ PRIVATE PEM EC private key
+0 string -----BEGIN\040CERTIFICATE----- PEM certificate
+0 string -----BEGIN\040CERTIFICATE\040REQ PEM certificate request
+0 string -----BEGIN\040RSA\040PRIVATE PEM RSA private key
+0 string -----BEGIN\040DSA\040PRIVATE PEM DSA private key
+0 string -----BEGIN\040EC\040PRIVATE PEM EC private key
+0 string -----BEGIN\040ECDSA\040PRIVATE PEM ECDSA private key
+
+# From Luc Gommans
+# OpenSSL enc file (recognized by a magic string preceding the password's salt)
+0 string Salted__ openssl enc'd data with salted password
+# Using the -a or -base64 option, OpenSSL will base64-encode the data.
+0 string U2FsdGVkX19 openssl enc'd data with salted password, base64 encoded
diff --git a/magic/Magdir/sysex b/magic/Magdir/sysex
index 97472e2..fc9cbf4 100644
--- a/magic/Magdir/sysex
+++ b/magic/Magdir/sysex
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------
-# $File: sysex,v 1.8 2014/06/03 19:17:27 christos Exp $
+# $File: sysex,v 1.9 2017/03/17 21:35:28 christos Exp $
# sysex: file(1) magic for MIDI sysex files
#
# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
@@ -256,7 +256,7 @@
>1 belong&0xffffff00 0x00011d00 Nemesys
>1 belong&0xffffff00 0x00011e00 DBX
>1 belong&0xffffff00 0x00011f00 Syndyne
->1 belong&0xffffff00 0x00012000 Bitheadz
+>1 belong&0xffffff00 0x00012000 Bitheadz
>1 belong&0xffffff00 0x00012100 Cakewalk
>1 belong&0xffffff00 0x00012200 Staccato
>1 belong&0xffffff00 0x00012300 National Semicon.
diff --git a/magic/Magdir/terminfo b/magic/Magdir/terminfo
index 97ea429..43e9d43 100644
--- a/magic/Magdir/terminfo
+++ b/magic/Magdir/terminfo
@@ -1,10 +1,51 @@
#------------------------------------------------------------------------------
-# $File: terminfo,v 1.6 2009/09/19 16:28:12 christos Exp $
+# $File: terminfo,v 1.9 2017/04/28 16:28:58 christos Exp $
# terminfo: file(1) magic for terminfo
#
-# XXX - byte order for screen images?
+# URL: http://invisible-island.net/ncurses/man/term.5.html
+# URL: http://invisible-island.net/ncurses/man/scr_dump.5.html
#
-0 string \032\001 Compiled terminfo entry
-0 short 0433 Curses screen image
-0 short 0434 Curses screen image
+# Workaround for Targa image type by Joerg Jenderek
+# GRR: line below too general as it catches also
+# Targa image type 1 with 26 long identification field
+# and HELP.DSK
+0 string \032\001
+# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32)
+>16 ubyte >32
+# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1"
+>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled terminfo entry "%-s"
+!:mime application/x-terminfo
+# no extension
+#!:ext
+#
+# While the compiled terminfo uses little-endian format irregardless of
+# platform, SystemV screen dumps do not. They came later, and that detail was
+# overlooked.
+#
+# AIX and HPUX use the SVr4 big-endian format
+# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness)
+0 beshort 0433 SVr2 curses screen image, big-endian
+0 beshort 0434 SVr3 curses screen image, big-endian
+0 beshort 0435 SVr4 curses screen image, big-endian
+#
+0 leshort 0433 SVr2 curses screen image, little-endian
+0 leshort 0434 SVr3 curses screen image, little-endian
+0 leshort 0435 SVr4 curses screen image, little-endian
+#
+# Rather than SVr4, Solaris "xcurses" writes this header:
+0 regex \^MAX=[0-9]+,[0-9]+$
+>1 regex \^BEG=[0-9]+,[0-9]+$
+>2 regex \^SCROLL=[0-9]+,[0-9]+$
+>3 regex \^VMIN=[0-9]+$
+>4 regex \^VTIME=[0-9]+$
+>5 regex \^FLAGS=0x[[:xdigit:]]+$
+>6 regex \^FG=[0-9],[0-9]+$
+>7 regex \^BG=[0-9]+,[0-9]+, Solaris xcurses screen image
+#
+# ncurses5 (and before) did not use a magic number, making screen dumps "data".
+# ncurses6 (2015) uses this format, ignoring byte-order
+0 string \210\210\210\210ncurses ncurses6 screen image
+#
+# PDCurses added this in 2005
+0 string PDC\001 PDCurses screen image
diff --git a/magic/Magdir/vacuum-cleaner b/magic/Magdir/vacuum-cleaner
new file mode 100644
index 0000000..eef78f2
--- /dev/null
+++ b/magic/Magdir/vacuum-cleaner
@@ -0,0 +1,54 @@
+
+#------------------------------------------------------------------------------
+# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $
+# vacuum cleaner magic by Thomas M. Ott (ThMO)
+#
+# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx
+# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk
+# -> yyyymmdd: year, month, day of cleaning
+# -> hhmmss: hour, minute, second of cleaning
+# -> xxxxxx: 6 digits
+# -> cc: cleaning runs counter
+# size: 136044 bytes
+#
+# struct maphdr {
+# int32_t map_cnt; /* 0: single map */
+# int32_t min_ceil; /* 4: 100 mm == 10 cm == min. ceil */
+# int32_t max_ceil; /* 8: 10000 mm == 100 m == max. ceil */
+# int32_t max_climb; /* 12: 50 mm = 5 cm == max. height to climb */
+# int32_t unknown; /* 16: 50000 ??? */
+# int32_t cell_bytes; /* 20: # of bytes for cells per block */
+# int32_t block_max; /* 24: 1000 == max. # of blocks */
+# int32_t route_max; /* 28: 1000 == max. # of routes */
+# int32_t used_blocks; /* 32: 5/45/33/... == # of block entries used! */
+# int32_t cell_dim; /* 36: 10 == cell dimension */
+# int32_t clock_tick; /* 40: 100 == clock ticks */
+# #if 0
+# struct { /* 44: 1000 blocks for 10x10 cells */
+# int32_t yoffset;
+# int32_t xoffset;
+# int32_t posxy;
+# int32_t timecode;
+# } blocks[ 1000];
+# char cells[ 1000* 100]; /* 16044: 1000 10x10 cells */
+# int16_t routes[ 1000* 10]; /* 116044: 1000 10-routes */
+# #endif
+# };
+
+0 lelong =1
+>4 lelong =100
+>>8 lelong =10000
+>>>12 lelong =50
+>>>>16 lelong =50000
+>>>>>20 lelong =100
+>>>>>>24 lelong =1000
+>>>>>>>28 lelong =1000
+>>>>>>>>36 lelong =10
+>>>>>>>>>40 lelong =100
+>>>>>>>>>>32 lelong x LG robot VR6[234]xx %dm^2 navigation
+>>>>>>>>>>136040 lelong =-1 reuse map data
+>>>>>>>>>>136040 lelong =0 map data
+>>>>>>>>>>136040 lelong >0 spurious map data
+>>>>>>>>>>136040 lelong <-1 spurious map data
+
+
diff --git a/magic/Magdir/varied.script b/magic/Magdir/varied.script
index eb71b2f..7f4e405 100644
--- a/magic/Magdir/varied.script
+++ b/magic/Magdir/varied.script
@@ -1,38 +1,30 @@
#------------------------------------------------------------------------------
-# $File: varied.script,v 1.10 2014/03/01 22:32:39 christos Exp $
+# $File: varied.script,v 1.11 2015/03/27 17:59:39 christos Exp $
# varied.script: file(1) magic for various interpreter scripts
0 string/t #!\ / a
>3 string >\0 %s script text executable
-!:strength / 2
0 string/b #!\ / a
>3 string >\0 %s script executable (binary data)
-!:strength / 2
0 string/t #!\t/ a
>3 string >\0 %s script text executable
-!:strength / 2
0 string/b #!\t/ a
>3 string >\0 %s script executable (binary data)
-!:strength / 2
0 string/t #!/ a
>2 string >\0 %s script text executable
-!:strength / 2
0 string/b #!/ a
>2 string >\0 %s script executable (binary data)
-!:strength / 2
0 string/t #!\ script text executable
>3 string >\0 for %s
-!:strength / 3
0 string/b #!\ script executable
>3 string >\0 for %s (binary data)
-!:strength / 3
# using env
0 string/t #!/usr/bin/env a
diff --git a/magic/Magdir/vms b/magic/Magdir/vms
index 4939303..56d57ae 100644
--- a/magic/Magdir/vms
+++ b/magic/Magdir/vms
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: vms,v 1.9 2014/08/17 13:47:59 christos Exp $
+# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $
# vms: file(1) magic for VMS executables (experimental)
#
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
@@ -25,6 +25,6 @@
# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................
#
# GRR this test is still too general as it catches example adressen.dbt
-0 belong 0x03000000
+0 belong 0x03000000
>8 ubelong 0xec020000 VMS Alpha executable
>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
diff --git a/magic/Magdir/vmware b/magic/Magdir/vmware
index b6b6a61..cd1a9d9 100644
--- a/magic/Magdir/vmware
+++ b/magic/Magdir/vmware
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: vmware,v 1.7 2009/09/19 16:28:13 christos Exp $
+# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $
# VMware specific files (deducted from version 1.1 and log file entries)
# Anthon van der Neut (anthon@mnt.org)
-0 belong 0x4d52564e VMware nvram
+0 belong 0x4d52564e VMware nvram
diff --git a/magic/Magdir/vorbis b/magic/Magdir/vorbis
index d337398..5335ca8 100644
--- a/magic/Magdir/vorbis
+++ b/magic/Magdir/vorbis
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: vorbis,v 1.20 2014/09/23 16:35:08 christos Exp $
+# $File: vorbis,v 1.23 2017/03/17 21:35:28 christos Exp $
# vorbis: file(1) magic for Ogg/Vorbis files
#
# From Felix von Leitner <leitner@fefe.de>
@@ -47,8 +47,8 @@
# non-Vorbis content: Skeleton
>>28 string fishead\0 \b, Skeleton
!:mime video/ogg
->>>36 short x v%u
->>>40 short x \b.%u
+>>>36 leshort x v%u
+>>>40 leshort x \b.%u
# non-Vorbis content: Speex
>>28 string Speex\ \ \ \b, Speex audio
!:mime audio/ogg
@@ -95,7 +95,7 @@
# in a different place, so we must use an indirect offset.
>>>(84.b+85) string \x03vorbis
>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I
->>>>>(84.b+120) string >00000000
+>>>>>(84.b+120) string >00000000
# Map to beta version numbers:
>>>>>>(84.b+120) string <20000508 (<beta1, prepublic)
>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2)
@@ -117,8 +117,30 @@
>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS)
# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I
->>>>>(84.b+117) string >00000000
+>>>>>(84.b+117) string >00000000
>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS)
>>>>>>(84.b+117) string 20020717 (1.0)
>>>>>>(84.b+117) string 20030909 (1.0.1)
>>>>>>(84.b+117) string 20040629 (1.1.0 RC1)
+
+# non-Vorbis content: Opus https://tools.ietf.org/html/draft-ietf-codec-oggopus-06#section-5
+>>28 string OpusHead \b, Opus audio,
+!:mime audio/ogg
+>>>36 ubyte >0x0F UNKNOWN VERSION %u,
+>>>36 ubyte &0x0F version 0.%d
+>>>>46 ubyte >1
+>>>>>46 ubyte !255 unknown channel mapping family %u,
+>>>>>37 ubyte x %u channels
+>>>>46 ubyte 0
+>>>>>37 ubyte 1 mono
+>>>>>37 ubyte 2 stereo
+>>>>46 ubyte 1
+>>>>>37 ubyte 1 mono
+>>>>>37 ubyte 2 stereo
+>>>>>37 ubyte 3 linear surround
+>>>>>37 ubyte 4 quadraphonic
+>>>>>37 ubyte 5 5.0 surround
+>>>>>37 ubyte 6 5.1 surround
+>>>>>37 ubyte 7 6.1 surround
+>>>>>37 ubyte 8 7.1 surround
+>>>>40 lelong !0 \b, %u Hz
diff --git a/magic/Magdir/webassembly b/magic/Magdir/webassembly
new file mode 100644
index 0000000..8a4ce1b
--- /dev/null
+++ b/magic/Magdir/webassembly
@@ -0,0 +1,15 @@
+#------------------------------------------------------------------------------
+# $File: webassembly,v 1.2 2017/05/02 14:05:29 christos Exp $
+# webassembly: file(1) magic for WebAssembly modules
+#
+# WebAssembly is a virtual architecture developed by a W3C Community
+# Group at http://webassembly.org/. The file extension is .wasm, and
+# the MIME type is application/wasm.
+#
+# http://webassembly.org/docs/binary-encoding/ is the main
+# document describing the binary format.
+# From: Pip Cet <pipcet@gmail.com> and Joel Martin
+
+0 string \0asm WebAssembly (wasm) binary module
+>4 lelong =1 version %#x (MVP)
+>4 lelong >1 version %#x
diff --git a/magic/Magdir/windows b/magic/Magdir/windows
index 3f7bded..169d4f8 100644
--- a/magic/Magdir/windows
+++ b/magic/Magdir/windows
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: windows,v 1.10 2014/09/24 19:52:46 christos Exp $
+# $File: windows,v 1.16 2017/03/17 22:20:22 christos Exp $
# windows: file(1) magic for Microsoft Windows
#
# This file is mainly reserved for files where programs
@@ -29,7 +29,7 @@
# Created by: Andreas Schuster (http://computer.forensikblog.de/)
# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
-0 string PAGE
+0 string PAGE
>4 string DUMP MS Windows 32bit crash dump
>>0x05c byte 0 \b, no PAE
>>0x05c byte 1 \b, PAE
@@ -64,18 +64,156 @@
# Summary: Old format help files
-# Extension: .hlp
+# URL: https://en.wikipedia.org/wiki/WinHelp
+# Reference: http://www.oocities.org/mwinterhoff/helpfile.htm
+# Update: Joerg Jenderek
# Created by: Dirk Jagdmann <doj@cubic.org>
-0 lelong 0x00035f3f MS Windows 3.x help file
+#
+# check and then display version and date inside MS Windows HeLP file fragment
+0 name help-ver-date
+# look for Magic of SYSTEMHEADER
+>0 leshort 0x036C
+# version Major 1 for right file fragment
+>>4 leshort 1 Windows
+# print non empty string above to avoid error message
+# Warning: Current entry does not yet have a description for adding a MIME type
+!:mime application/winhelp
+!:ext hlp
+# version Minor of help file format is hint for windows version
+>>>2 leshort 0x0F 3.x
+>>>2 leshort 0x15 3.0
+>>>2 leshort 0x21 3.1
+>>>2 leshort 0x27 x.y
+>>>2 leshort 0x33 95
+>>>2 default x y.z
+>>>>2 leshort x 0x%x
+# to complete message string like "MS Windows 3.x help file"
+>>>2 leshort x help
+# GenDate often older than file creation date
+>>>6 ldate x \b, %s
+#
+# Magic for HeLP files
+0 lelong 0x00035f3f
+# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file"
+# file header magic 0x293B at DirectoryStart+9
+>(4.l+9) uleshort 0x293B MS
+# look for @VERSION bmf.. like IBMAVW.ANN
+>>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation
+!:mime application/x-winhelp
+!:ext ann
+>>0xD4 string !\x62\x6D\x66\x01\x00
+# "GID Help index" by TrID
+>>>(4.l+0x65) string =|Pete Windows help Global Index
+!:mime application/x-winhelp
+!:ext gid
+# HeLP Bookmark or
+# "Windows HELP File" by TrID
+>>>(4.l+0x65) string !|Pete
+# maybe there exist a cleaner way to detect HeLP fragments
+# brute search for Magic 0x036C with matching Major maximal 7 iterations
+# discapp.hlp
+>>>>16 search/0x49AF/s \x6c\x03
+>>>>>&0 use help-ver-date
+>>>>>&4 leshort !1
+# putty.hlp
+>>>>>>&0 search/0x69AF/s \x6c\x03
+>>>>>>>&0 use help-ver-date
+>>>>>>>&4 leshort !1
+>>>>>>>>&0 search/0x49AF/s \x6c\x03
+>>>>>>>>>&0 use help-ver-date
+>>>>>>>>>&4 leshort !1
+>>>>>>>>>>&0 search/0x49AF/s \x6c\x03
+>>>>>>>>>>>&0 use help-ver-date
+>>>>>>>>>>>&4 leshort !1
+>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03
+>>>>>>>>>>>>>&0 use help-ver-date
+>>>>>>>>>>>>>&4 leshort !1
+>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03
+>>>>>>>>>>>>>>>&0 use help-ver-date
+>>>>>>>>>>>>>>>&4 leshort !1
+>>>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03
+# GCC.HLP is detected after 7 iterations
+>>>>>>>>>>>>>>>>>&0 use help-ver-date
+# this only happens if bigger hlp file is detected after used search iterations
+>>>>>>>>>>>>>>>>>&4 leshort !1 Windows y.z help
+!:mime application/winhelp
+!:ext hlp
+# repeat search again or following default line does not work
+>>>>16 search/0x49AF/s \x6c\x03
+# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit)
+>>>>16 default x Windows help Bookmark
+!:mime application/x-winhelp
+!:ext /bmk
+## FirstFreeBlock normally FFFFFFFFh 10h for *ANN
+##>>8 lelong x \b, FirstFreeBlock 0x%8.8x
+# EntireFileSize
+>>12 lelong x \b, %d bytes
+## ReservedSpace normally 042Fh AFh for *.ANN
+#>>(4.l) lelong x \b, ReservedSpace 0x%8.8x
+## UsedSpace normally 0426h A6h for *.ANN
+#>>(4.l+4) lelong x \b, UsedSpace 0x%8.8x
+## FileFlags normally 04...
+#>>(4.l+5) lelong x \b, FileFlags 0x%8.8x
+## file header magic 0x293B
+#>>(4.l+9) uleshort x \b, file header magic 0x%4.4x
+## file header Flags 0x0402
+#>>(4.l+11) uleshort x \b, file header Flags 0x%4.4x
+## file header PageSize 0400h 80h for *.ANN
+#>>(4.l+13) uleshort x \b, PageSize 0x%4.4x
+## Structure[16] z4
+#>>(4.l+15) string >\0 \b, Structure_"%-.16s"
+## MustBeZero 0
+#>>(4.l+31) uleshort x \b, MustBeZero 0x%4.4x
+## PageSplits
+#>>(4.l+33) uleshort x \b, PageSplits 0x%4.4x
+## RootPage
+#>>(4.l+35) uleshort x \b, RootPage 0x%4.4x
+## MustBeNegOne 0xffff
+#>>(4.l+37) uleshort x \b, MustBeNegOne 0x%4.4x
+## TotalPages 1
+#>>(4.l+39) uleshort x \b, TotalPages 0x%4.4x
+## NLevels 0x0001
+#>>(4.l+41) uleshort x \b, NLevels 0x%4.4x
+## TotalBtreeEntries
+#>>(4.l+43) ulelong x \b, TotalBtreeEntries 0x%8.8x
+## pages of the B+ tree
+#>>(4.l+47) ubequad x \b, PageStart 0x%16.16llx
+# start with colon or semicolon for comment line like Back2Life.cnt
+0 regex \^(:|;)
+# look for first keyword Base
+>0 search/45 :Base
+>>&0 use cnt-name
+# only solution to search again from beginning , because relative offsets changes when use is called
+>0 search/45 :Base
+>0 default x
+# look for other keyword Title like in putty.cnt
+>>0 search/45 :Title
+>>>&0 use cnt-name
+#
+# display mime type and name of Windows help Content source
+0 name cnt-name
+# skip space at beginning
+>0 string \040
+# name without extension and greater character or name with hlp extension
+>>1 regex/c \^([^\xd>]*|.*\.hlp) MS Windows help file Content, based "%s"
+!:mime text/plain
+!:apple ????TEXT
+!:ext cnt
+#
+# Windows creates an full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing
+0 string tfMR MS Windows help Full Text Search index
+!:mime application/x-winhelp-fts
+!:ext fts
+>16 string >\0 for "%s"
# Summary: Hyper terminal
# Extension: .ht
# Created by: unknown
-0 string HyperTerminal\
+0 string HyperTerminal\040
>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile
-# http://ithreats.files.wordpress.com/2009/05/\
+# http://ithreats.files.wordpress.com/2009/05/\040
# lnk_the_windows_shortcut_file_format.pdf
# Summary: Windows shortcut
# Extension: .lnk
@@ -89,7 +227,7 @@
>20 lelong&16 16 \b, Has Working directory
>20 lelong&32 32 \b, Has command line arguments
>20 lelong&64 64 \b, Icon
->>56 lelong \b number=%d
+>>56 lelong x \b number=%d
>24 lelong&1 1 \b, Read-Only
>24 lelong&2 2 \b, Hidden
>24 lelong&4 4 \b, System
@@ -155,7 +293,7 @@
# Extension: .reg
# Submitted by: Abel Cheung <abelcheung@gmail.com>
0 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above)
-0 string Windows\ Registry\ Editor\
+0 string Windows\ Registry\ Editor\040
>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above)
# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013
@@ -163,10 +301,10 @@
# PR/383: remove unicode BOM because it is not portable across regex impls
0 regex/s \\`(\\r\\n|;|[[])
# left bracket in section line
->&0 search/8192 [
+>&0 search/8192 [
# http://en.wikipedia.org/wiki/Autorun.inf
# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
->>&0 regex/c \^(autorun)]\r\n
+>>&0 regex/c \^(autorun)]\r\n
>>>&0 ubyte =0x5b INItialization configuration
!:mime application/x-wine-extension-ini
# From: Pal Tamas <folti@balabit.hu>
@@ -205,31 +343,31 @@
# http://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information
>>&0 regex/c \^(boot\x20loader)] Windows boot.ini
!:mime application/x-wine-extension-ini
->>>&0 ubyte x
+>>>&0 ubyte x
# http://en.wikipedia.org/wiki/CONFIG.SYS
>>&0 regex/c \^(menu)]\r\n MS-DOS CONFIG.SYS
# http://support.microsoft.com/kb/118579/
>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS
# VERS string unicoded case-independent
->>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
+>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
# ION] string unicoded case-independent
->>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
+>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
!:mime application/x-setupscript
# STRI string unicoded case-independent
->>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0053005400520049
+>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0053005400520049
# NGS] string unicoded case-independent
->>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x004e00470053005D Windows setup INFormation
+>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x004e00470053005D Windows setup INFormation
!:mime application/x-setupscript
# unknown keyword after opening bracket
->>&0 default x
->>>&0 search/8192 [
+>>&0 default x
+>>>&0 search/8192 [
# version Strings FileIdentification
->>>>&0 string/c version Windows setup INFormation
+>>>>&0 string/c version Windows setup INFormation
!:mime application/x-setupscript
# VERS string unicoded case-independent
->>>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
+>>>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
# ION] string unicoded case-independent
->>>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
+>>>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
!:mime application/x-setupscript
# http://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other
#>>>>&0 default x Generic INItialization configuration
@@ -238,20 +376,21 @@
# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp
-0 leshort&0xFeFe 0x0000
+0 leshort&0xFeFe 0x0000
+!:strength -5
# test for unused null bits in PNF_FLAGs
->4 ulelong&0xFCffFe00 0x00000000
+>4 ulelong&0xFCffFe00 0x00000000
# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure
->>68 ulelong >0x57
+>>68 ulelong >0x57
# test for zero high byte of InfValueBlockSize, followed by WinDirPath like
# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT
>>>(68.l-1) ubelong&0xffE0C519 =0x00400018 Windows Precompiled iNF
!:mime application/x-pnf
# currently only found Major Version=1 and Minor Version=1
-#>>>>0 uleshort =0x0101
+#>>>>0 uleshort =0x0101
#>>>>>1 ubyte x \b, version %u
#>>>>>0 ubyte x \b.%u
->>>>0 uleshort !0x0101
+>>>>0 uleshort !0x0101
>>>>>1 ubyte x \b, version %u
>>>>>0 ubyte x \b.%u
# 1 ,2 (windows 98 SE)
@@ -277,10 +416,10 @@
#>>>>16 ulelong x \b, InfVersionDataSize 0x%x
# only found positive values lower 0x00ffFFff for InfVersionDataOffset
>>>>20 ulelong x \b, at 0x%x
->>>>4 ulelong&0x00000001 =0x00000001
-# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
+>>>>4 ulelong&0x00000001 =0x00000001
+# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
>>>>>(20.l) lestring16 x "%s"
->>>>4 ulelong&0x00000001 !0x00000001
+>>>>4 ulelong&0x00000001 !0x00000001
>>>>>(20.l) string x "%s"
# FILETIME is number of 100-nanosecond intervals since 1 January 1601
#>>>>24 ulequad x \b, InfVersionLastWriteTime %16.16llx
@@ -296,23 +435,23 @@
#>>>>64 ulelong x \b, InfValueBlockSize 0x%x
# WinDirPathOffset
#>>>>68 ulelong x \b, at 0x%x
->>>>68 ulelong >0x57
->>>>>4 ulelong&0x00000001 =0x00000001
->>>>>>(68.l) ubequad =0x43003a005c005700
+>>>>68 ulelong >0x57
+>>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>>(68.l) ubequad =0x43003a005c005700
# normally unicoded C:\Windows
#>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s"
->>>>>>(68.l) ubequad !0x43003a005c005700
+>>>>>>(68.l) ubequad !0x43003a005c005700
>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s"
->>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>4 ulelong&0x00000001 !0x00000001
# normally ASCII C:\WINDOWS
#>>>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s"
>>>>>>(68.l) string !C:\\WINDOWS \b, WinDirPath "%s"
-# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
+# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
#>>>>72 ulelong >0 \b, at 0x%x
>>>>72 ulelong >0 \b,
->>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>4 ulelong&0x00000001 =0x00000001
>>>>>>(72.l) lestring16 x OsLoaderPath "%s"
->>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>4 ulelong&0x00000001 !0x00000001
# seldom C:\ instead empty
>>>>>>(72.l) string x OsLoaderPath "%s"
# 1fdh
@@ -323,15 +462,114 @@
# InfSourcePathOffset often 0
#>>>>80 ulelong >0 \b, at 0x%x
>>>>80 ulelong >0 \b,
->>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>4 ulelong&0x00000001 =0x00000001
>>>>>>(80.l) lestring16 x SourcePath "%s"
->>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>4 ulelong&0x00000001 !0x00000001
>>>>>>(80.l) string >\0 SourcePath "%s"
# OriginalInfNameOffset often 0
#>>>>84 ulelong >0 \b, at 0x%x
>>>>84 ulelong >0 \b,
->>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>4 ulelong&0x00000001 =0x00000001
>>>>>>(84.l) lestring16 x InfName "%s"
->>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>4 ulelong&0x00000001 !0x00000001
>>>>>>(84.l) string >\0 InfName "%s"
+# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003
+# Extension: .bkf
+# Created by: Joerg Jenderek
+# URL: http://en.wikipedia.org/wiki/NTBackup
+# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF
+# Descriptor BloCK name of Microsoft Tape Format
+0 string TAPE
+# Format Logical Address is zero
+>20 ulequad 0
+# Reserved for MBC is zero
+>>28 uleshort 0
+# Control Block ID is zero
+>>>36 ulelong 0
+# BIT4-BIT15, BIT18-BIT31 of block attributes are unused
+>>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive
+#!:mime application/x-ntbackup
+!:ext bkf
+# OS ID
+>>>>>10 ubyte 1 \b NetWare
+>>>>>10 ubyte 13 \b NetWare SMS
+>>>>>10 ubyte 14 \b NT
+>>>>>10 ubyte 24 \b 3
+>>>>>10 ubyte 25 \b OS/2
+>>>>>10 ubyte 26 \b 95
+>>>>>10 ubyte 27 \b Macintosh
+>>>>>10 ubyte 28 \b UNIX
+# OS Version (2)
+#>>>>>11 ubyte x OS V=%x
+# MTF_CONTINUATION Media Sequence Number > 1
+#>>>>>4 ulelong&0x00000001 !0 \b, continued
+# MTF_COMPRESSION
+>>>>>4 ulelong&0x00000004 !0 \b, compressed
+# MTF_EOS_AT_EOM End Of Medium was hit during end of set processing
+>>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit
+>>>>>4 ulelong&0x00020000 0
+# MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape
+>>>>>>4 ulelong&0x00010000 !0 \b, with catalog
+# MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present
+>>>>>4 ulelong&0x00020000 !0 \b, with file catalog
+# Offset To First Event 238h,240h,28Ch
+#>>>>>8 uleshort x \b, event offset %4.4x
+# Displayable Size (20e0230h 20e024ch 20e0224h)
+#>>>>>8 ulequad x dis. size %16.16llx
+# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h)
+#>>>>>52 ulelong x family ID %8.8x
+# TAPE Attributes (3)
+#>>>>>56 ulelong x TAPE %8.8x
+# Media Sequence Number
+>>>>>60 uleshort >1 \b, sequence %u
+# Password Encryption Algorithm (3)
+>>>>>62 uleshort >0 \b, 0x%x encrypted
+# Soft Filemark Block Size * 512 (2)
+#>>>>>64 uleshort =2 \b, soft size %u*512
+>>>>>64 uleshort !2 \b, soft size %u*512
+# Media Based Catalog Type (1,2)
+#>>>>>66 uleshort x \b, catalog type %4.4x
+# size of Media Name (66,68,6Eh)
+>>>>>68 uleshort >0
+# offset of Media Name (5Eh)
+>>>>>>70 uleshort >0
+# 0~, 1~ANSI, 2~UNICODE
+>>>>>>>48 ubyte 1
+# size terminated ansi coded string normally followed by "MTF Media Label"
+>>>>>>>>(70.s) string >\0 \b, name: %s
+>>>>>>>48 ubyte 2
+# Not null, but size terminated unicoded string
+>>>>>>>>(70.s) lestring16 x \b, name: %s
+# size of Media Label (104h)
+>>>>>72 uleshort >0
+# offset of Media Label (C4h,C6h,CCh)
+>>>>>74 uleshort >0
+>>>>>>48 ubyte 1
+#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields
+>>>>>>>(74.s) string >\0 \b, label: %s
+>>>>>>48 ubyte 2
+>>>>>>>(74.s) lestring16 x \b, label: %s
+# size of password name (0,1Ch)
+#>>>>>76 uleshort >0 \b, password size %4.4x
+# Software Vendor ID (CBEh)
+>>>>>86 uleshort x \b, software (0x%x)
+# size of Software Name (6Eh)
+>>>>>80 uleshort >0
+# offset of Software Name (1C8h,1CAh,1D0h)
+>>>>>>82 uleshort >0
+# 1~ANSI, 2~UNICODE
+>>>>>>>48 ubyte 1
+>>>>>>>>(82.s) string >\0 \b: %s
+>>>>>>>48 ubyte 2
+# size terminated unicoded coded string normally followed by "SPAD"
+>>>>>>>>(82.s) lestring16 x \b: %s
+# Format Logical Block Size (512,1024)
+#>>>>>84 uleshort =1024 \b, block size %u
+>>>>>84 uleshort !1024 \b, block size %u
+# Media Date of MTF_DATE_TIME type with 5 bytes
+#>>>>>>88 ubequad x DATE %16.16llx
+# MTF Major Version (1)
+#>>>>>>93 ubyte x \b, MFT version %x
+#
+
diff --git a/magic/Magdir/wordprocessors b/magic/Magdir/wordprocessors
index 951f603..a7cfab7 100644
--- a/magic/Magdir/wordprocessors
+++ b/magic/Magdir/wordprocessors
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: wordprocessors,v 1.18 2013/06/03 19:07:29 christos Exp $
+# $File: wordprocessors,v 1.19 2015/10/16 15:11:07 christos Exp $
# wordprocessors: file(1) magic fo word processors.
#
####### PWP file format used on Smith Corona Personal Word Processors:
@@ -12,97 +12,187 @@
>25 byte 0x54 \b, legal
>26 byte 0x46 \b, A4
-#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
-0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable file
->15 byte 0 Optimized for Intel
->15 byte 1 Optimized for Non-Intel
-1 string WPC (Corel/WP)
->8 short 257 WordPerfect macro
->8 short 258 WordPerfect help file
->8 short 259 WordPerfect keyboard file
->8 short 266 WordPerfect document
->8 short 267 WordPerfect dictionary
->8 short 268 WordPerfect thesaurus
->8 short 269 WordPerfect block
->8 short 270 WordPerfect rectangular block
->8 short 271 WordPerfect column block
->8 short 272 WordPerfect printer data
->8 short 275 WordPerfect printer data
->8 short 276 WordPerfect driver resource data
->8 short 279 WordPerfect hyphenation code
->8 short 280 WordPerfect hyphenation data
->8 short 281 WordPerfect macro resource data
->8 short 283 WordPerfect hyphenation lex
->8 short 285 WordPerfect wordlist
->8 short 286 WordPerfect equation resource data
->8 short 289 WordPerfect spell rules
->8 short 290 WordPerfect dictionary rules
->8 short 295 WordPerfect spell rules (Microlytics)
->8 short 299 WordPerfect settings file
->8 short 301 WordPerfect 4.2 document
->8 short 325 WordPerfect dialog file
->8 short 332 WordPerfect button bar
->8 short 513 Shell macro
->8 short 522 Shell definition
->8 short 769 Notebook macro
->8 short 770 Notebook help file
->8 short 771 Notebook keyboard file
->8 short 778 Notebook definition
->8 short 1026 Calculator help file
->8 short 1538 Calendar help file
->8 short 1546 Calendar data file
->8 short 1793 Editor macro
->8 short 1794 Editor help file
->8 short 1795 Editor keyboard file
->8 short 1817 Editor macro resource file
->8 short 2049 Macro editor macro
->8 short 2050 Macro editor help file
->8 short 2051 Macro editor keyboard file
->8 short 2305 PlanPerfect macro
->8 short 2306 PlanPerfect help file
->8 short 2307 PlanPerfect keyboard file
->8 short 2314 PlanPerfect worksheet
->8 short 2319 PlanPerfect printer definition
->8 short 2322 PlanPerfect graphic definition
->8 short 2323 PlanPerfect data
->8 short 2324 PlanPerfect temporary printer
->8 short 2329 PlanPerfect macro resource data
->8 byte 11 Mail
->8 short 2818 help file
->8 short 2821 distribution list
->8 short 2826 out box
->8 short 2827 in box
->8 short 2836 users archived mailbox
->8 short 2837 archived message database
->8 short 2838 archived attachments
->8 short 3083 Printer temporary file
->8 short 3330 Scheduler help file
->8 short 3338 Scheduler in file
->8 short 3339 Scheduler out file
->8 short 3594 GroupWise settings file
->8 short 3601 GroupWise directory services
->8 short 3627 GroupWise settings file
->8 short 4362 Terminal resource data
->8 short 4363 Terminal resource data
->8 short 4395 Terminal resource data
->8 short 4619 GUI loadable text
->8 short 4620 graphics resource data
->8 short 4621 printer settings file
->8 short 4622 port definition file
->8 short 4623 print queue parameters
->8 short 4624 compressed file
->8 short 5130 Network service msg file
->8 short 5131 Network service msg file
->8 short 5132 Async gateway login msg
->8 short 5134 GroupWise message file
->8 short 7956 GroupWise admin domain database
->8 short 7957 GroupWise admin host database
->8 short 7959 GroupWise admin remote host database
->8 short 7960 GroupWise admin ADS deferment data file
->8 short 8458 IntelliTAG (SGML) compiled DTD
->8 long 18219264 WordPerfect graphic image (1.0)
->8 long 18219520 WordPerfect graphic image (2.0)
-#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
+# Corel/WordPerfect
+0 string \xffWPC
+# WordPerfect
+>8 byte 1
+>>9 byte 1 WordPerfect macro
+>>9 byte 2 WordPerfect help file
+>>9 byte 3 WordPerfect keyboard file
+>>9 byte 10 WordPerfect document
+>>9 byte 11 WordPerfect dictionary
+>>9 byte 12 WordPerfect thesaurus
+>>9 byte 13 WordPerfect block
+>>9 byte 14 WordPerfect rectangular block
+>>9 byte 15 WordPerfect column block
+>>9 byte 16 WordPerfect printer data
+>>9 byte 19 WordPerfect printer data
+>>9 byte 20 WordPerfect driver resource data
+>>9 byte 22 WordPerfect graphic image
+>>9 byte 23 WordPerfect hyphenation code
+>>9 byte 24 WordPerfect hyphenation data
+>>9 byte 25 WordPerfect macro resource data
+>>9 byte 27 WordPerfect hyphenation lex
+>>9 byte 29 WordPerfect wordlist
+>>9 byte 30 WordPerfect equation resource data
+>>9 byte 33 WordPerfect spell rules
+>>9 byte 34 WordPerfect dictionary rules
+>>9 byte 39 WordPerfect spell rules (Microlytics)
+>>9 byte 43 WordPerfect settings file
+>>9 byte 44 WordPerfect 3.5 document
+>>9 byte 45 WordPerfect 4.2 document
+>>9 byte 69 WordPerfect dialog file
+>>9 byte 76 WordPerfect button bar
+>>9 default x
+>>>9 byte x Corel WordPerfect: Unknown filetype %d
+# Corel Shell
+>8 byte 2
+>>9 byte 1 Corel shell macro
+>>9 byte 10 Corel shell definition
+>>9 default x
+>>>9 byte x Corel Shell: Unknown filetype %d
+# Corel Notebook
+>8 byte 3
+>>9 byte 1 Corel Notebook macro
+>>9 byte 2 Corel Notebook help file
+>>9 byte 3 Corel Notebook keyboard file
+>>9 byte 10 Corel Notebook definition
+>>9 default x
+>>>9 byte x Corel Notebook: Unknown filetype %d
+# Corel Calculator
+>8 byte 4
+>>9 byte 2 Corel Calculator help file
+>>9 default x
+>>>9 byte x Corel Calculator: Unknown filetype %d
+# Corel File Manager
+>8 byte 5
+>>9 default x
+>>>9 byte x Corel File Manager: Unknown filetype %d
+# Corel Calendar
+>8 byte 6
+>>9 byte 2 Corel Calendar help file
+>>9 byte 10 Corel Calendar data file
+>>9 default x
+>>>9 byte x Corel Calendar: Unknown filetype %d
+# Corel Program Editor/Ed Editor
+>8 byte 7
+>>9 byte 1 Corel Editor macro
+>>9 byte 2 Corel Editor help file
+>>9 byte 3 Corel Editor keyboard file
+>>9 byte 25 Corel Editor macro resource file
+>>9 default x
+>>>9 byte x Corel Program Editor/Ed Editor: Unknown filetype %d
+# Corel Macro Editor
+>8 byte 8
+>>9 byte 1 Corel Macro editor macro
+>>9 byte 2 Corel Macro editor help file
+>>9 byte 3 Corel Macro editor keyboard file
+>>9 default x
+>>>9 byte x Corel Macro Editor: Unknown filetype %d
+# Corel Plan Perfect
+>8 byte 9
+>>9 default x
+>>>9 byte x Corel Plan Perfect: Unknown filetype %d
+# Corel DataPerfect
+>8 byte 10
+# CHECK: Don't these belong into product 9?
+>>9 byte 1 Corel PlanPerfect macro
+>>9 byte 2 Corel PlanPerfect help file
+>>9 byte 3 Corel PlanPerfect keyboard file
+>>9 byte 10 Corel PlanPerfect worksheet
+>>9 byte 15 Corel PlanPerfect printer definition
+>>9 byte 18 Corel PlanPerfect graphic definition
+>>9 byte 19 Corel PlanPerfect data
+>>9 byte 20 Corel PlanPerfect temporary printer
+>>9 byte 25 Corel PlanPerfect macro resource data
+>>9 default x
+>>>9 byte x Corel DataPerfect: Unknown filetype %d
+# Corel Mail
+>8 byte 11
+>>9 byte 2 Corel Mail help file
+>>9 byte 5 Corel Mail distribution list
+>>9 byte 10 Corel Mail out box
+>>9 byte 11 Corel Mail in box
+>>9 byte 20 Corel Mail users archived mailbox
+>>9 byte 21 Corel Mail archived message database
+>>9 byte 22 Corel Mail archived attachments
+>>9 default x
+>>>9 byte x Corel Mail: Unknown filetype %d
+# Corel Printer
+>8 byte 12
+>>9 byte 11 Corel Printer temporary file
+>>9 default x
+>>>9 byte x Corel Printer: Unknown filetype %d
+# Corel Scheduler
+>8 byte 13
+>>9 byte 2 Corel Scheduler help file
+>>9 byte 10 Corel Scheduler in file
+>>9 byte 11 Corel Scheduler out file
+>>9 default x
+>>>9 byte x Corel Scheduler: Unknown filetype %d
+# Corel WordPerfect Office
+>8 byte 14
+>>9 byte 10 Corel GroupWise settings file
+>>9 byte 17 Corel GroupWise directory services
+>>9 byte 43 Corel GroupWise settings file
+>>9 default x
+>>>9 byte x Corel WordPerfect Office: Unknown filetype %d
+# Corel DrawPerfect
+>8 byte 15
+>>9 default x
+>>>9 byte x Corel DrawPerfect: Unknown filetype %d
+# Corel LetterPerfect
+>8 byte 16
+>>9 default x
+>>>9 byte x Corel LetterPerfect: Unknown filetype %d
+# Corel Terminal
+>8 byte 17
+>>9 byte 10 Corel Terminal resource data
+>>9 byte 11 Corel Terminal resource data
+>>9 byte 43 Corel Terminal resource data
+>>9 default x
+>>>9 byte x Corel Terminal: Unknown filetype %d
+# Corel loadable file
+>8 byte 18
+>>9 byte 10 Corel loadable file
+>>9 byte 11 Corel GUI loadable text
+>>9 byte 12 Corel graphics resource data
+>>9 byte 13 Corel printer settings file
+>>9 byte 14 Corel port definition file
+>>9 byte 15 Corel print queue parameters
+>>9 byte 16 Corel compressed file
+>>9 default x
+>>>9 byte x Corel loadable file: Unknown filetype %d
+>>15 byte 0 \b, optimized for Intel
+>>15 byte 1 \b, optimized for Non-Intel
+# Network service
+>8 byte 20
+>>9 byte 10 Corel Network service msg file
+>>9 byte 11 Corel Network service msg file
+>>9 byte 12 Corel Async gateway login msg
+>>9 byte 14 Corel GroupWise message file
+>>9 default x
+>>>9 byte x Corel Network service: Unknown filetype %d
+# GroupWise
+>8 byte 31
+>>9 byte 20 GroupWise admin domain database
+>>9 byte 21 GroupWise admin host database
+>>9 byte 23 GroupWise admin remote host database
+>>9 byte 24 GroupWise admin ADS deferment data file
+>>9 default x
+>>>9 byte x GroupWise: Unknown filetype %d
+# IntelliTAG
+>8 byte 33
+>>9 byte 10 IntelliTAG (SGML) compiled DTD
+>>9 default x
+>>>9 byte x IntelliTAG: Unknown filetype %d
+# everything else
+>8 default x
+>>8 byte x Unknown Corel/Wordperfect product %d,
+>>>9 byte x file type %d
+>10 byte 0 \b, v5.
+>10 byte !0 \b, v%d.
+>11 byte x \b%d
# Hangul (Korean) Word Processor File
0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0
diff --git a/magic/Magdir/x68000 b/magic/Magdir/x68000
new file mode 100644
index 0000000..927b96d
--- /dev/null
+++ b/magic/Magdir/x68000
@@ -0,0 +1,25 @@
+#------------------------------------------------------------------------------
+# x68000: file(1) magic for the Sharp Home Computer
+# v1.0
+# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
+
+# Yanagisawa PIC picture
+0 string PIC
+>3 search/0x200 \x1A
+>>&0 search/0x200 \x0
+>>>&0 ubyte 0 Yanagisawa PIC image file,
+>>>>&0 ubyte&15 0 model: X68000,
+>>>>&0 ubyte&15 1 model: PC-88VA,
+>>>>&0 ubyte&15 2 model: FM-TOWNS,
+>>>>&0 ubyte&15 3 model: MAC,
+>>>>&0 ubyte&15 15 model: Generic,
+>>>>&3 ubeshort x %dx
+>>>>&5 ubeshort x \b%d,
+>>>>&1 ubeshort 4 colors: 16
+>>>>&1 ubeshort 8 colors: 256
+>>>>&1 ubeshort 12 colors: 4096
+>>>>&1 ubeshort 15 colors: 32768
+>>>>&1 ubeshort 16 colors: 65536
+>>>>&1 ubeshort >16 colors: %d-bit
+
+
diff --git a/magic/Magdir/xenix b/magic/Magdir/xenix
index 3d238df..fb83faa 100644
--- a/magic/Magdir/xenix
+++ b/magic/Magdir/xenix
@@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
-# $File: xenix,v 1.9 2009/09/19 16:28:13 christos Exp $
+# $File: xenix,v 1.11 2017/03/17 21:35:28 christos Exp $
# xenix: file(1) magic for Microsoft Xenix
#
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
@@ -12,7 +12,26 @@
# XXX - "x.out" collides with PDP-11 archives
#
0 string core core file (Xenix)
-0 byte 0x80 8086 relocatable (Microsoft)
+# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix
+# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf
+# Update: Joerg Jenderek
+# recordtype~TranslatorHEADerRecord
+0 byte 0x80
+# GRR: line above is too general as it catches also Extensible storage engine DataBase
+# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3
+>1 uleshort <1022
+# skip examples like GAME.PICTURE Strange.Pic by looking for positiv record length
+>>1 uleshort >0
+# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positiv string length
+>>>3 ubyte >0
+# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c"
+>>>>4 regex [a-zA-Z_/]{1,8}[.] 8086 relocatable (Microsoft)
+#!:mime application/octet-stream
+!:mime application/x-object
+!:ext o/a
+>>>>>3 pstring x \b, "%s"
+# checksum
+#>>>>>(3.b+4) ubyte x \b, checksum 0x%2.2x
0 leshort 0xff65 x.out
>2 string __.SYMDEF randomized
>0 byte x archive
@@ -35,8 +54,8 @@
>0x1c byte &0x9 286
>0x1c byte &0xa 386
>0x1f byte <0x040 small model
->0x1f byte =0x048 large model
->0x1f byte =0x049 huge model
+>0x1f byte =0x048 large model
+>0x1f byte =0x049 huge model
>0x1e leshort &0x1 executable
>0x1e leshort ^0x1 object file
>0x1e leshort &0x40 Large Text
diff --git a/magic/Magdir/xilinx b/magic/Magdir/xilinx
index 91e84d9..a521977 100644
--- a/magic/Magdir/xilinx
+++ b/magic/Magdir/xilinx
@@ -1,12 +1,12 @@
#------------------------------------------------------------------------------
-# $File: xilinx,v 1.7 2014/04/30 21:41:02 christos Exp $
+# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $
# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
# Xilinx-Magic@RevRagnarok.com
# Got the info from FPGA-FAQ 0026
#
-# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth,
-# fixes at least reading of bitfiles from Spartan 2, 3, 6.
+# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth,
+# fixes at least reading of bitfiles from Spartan 2, 3, 6.
# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm
#
# First there is the sync header and its length
@@ -20,7 +20,7 @@
>>>>&0 pstring/H x - from %s
# And then 'b'
>>>>>&1 string b
-# Then the model / part number:
+# Then the model / part number:
>>>>>>&0 pstring/H x - for %s
# Then 'c'
>>>>>>>&1 string c
@@ -36,5 +36,5 @@
>>>>>>>>>>>>&0 belong x - data length 0x%x
# Raw bitstream files
-0 long 0xffffffff
+0 long 0xffffffff
>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN)
diff --git a/magic/Magdir/xwindows b/magic/Magdir/xwindows
index eb20892..85f64c8 100644
--- a/magic/Magdir/xwindows
+++ b/magic/Magdir/xwindows
@@ -1,9 +1,9 @@
#------------------------------------------------------------------------------
-# $File: xwindows,v 1.9 2014/04/30 21:41:02 christos Exp $
+# $File: xwindows,v 1.10 2017/03/17 21:35:28 christos Exp $
# xwindows: file(1) magic for various X/Window system file formats.
-# Compiled X Keymap
+# Compiled X Keymap
# XKM (compiled X keymap) files (including version and byte ordering)
1 string mkx Compiled XKB Keymap: lsb,
>0 byte >0 version %d
diff --git a/magic/Magdir/yara b/magic/Magdir/yara
new file mode 100644
index 0000000..523a2d0
--- /dev/null
+++ b/magic/Magdir/yara
@@ -0,0 +1,17 @@
+
+
+#------------------------------------------------------------------------------
+# $File: yara,v 1.2 2017/05/25 20:07:23 christos Exp $
+# yara: file(1) magic for http://virustotal.github.io/yara/
+#
+
+0 string YARA
+>4 lelong >2047
+>8 byte <20 YARA 3.x compiled rule set
+# version
+>>8 clear x
+>>8 byte 6 created with version 3.3.0
+>>8 byte 8 created with version 3.4.0
+>>8 byte 11 created with version 3.5.0
+>>8 default x
+>>>8 byte x development version 0x%02x
diff --git a/magic/Makefile.am b/magic/Makefile.am
index 7bc327d..5259a47 100644
--- a/magic/Makefile.am
+++ b/magic/Makefile.am
@@ -1,5 +1,5 @@
#
-# $File: Makefile.am,v 1.101 2014/12/12 16:48:39 christos Exp $
+# $File: Makefile.am,v 1.126 2017/08/10 11:01:38 christos Exp $
#
MAGIC_FRAGMENT_BASE = Magdir
MAGIC_DIR = $(top_srcdir)/magic
@@ -13,6 +13,7 @@ $(MAGIC_DIR)/Localstuff \
$(MAGIC_FRAGMENT_DIR)/acorn \
$(MAGIC_FRAGMENT_DIR)/adi \
$(MAGIC_FRAGMENT_DIR)/adventure \
+$(MAGIC_FRAGMENT_DIR)/algol68 \
$(MAGIC_FRAGMENT_DIR)/allegro \
$(MAGIC_FRAGMENT_DIR)/alliant \
$(MAGIC_FRAGMENT_DIR)/amanda \
@@ -20,16 +21,22 @@ $(MAGIC_FRAGMENT_DIR)/amigaos \
$(MAGIC_FRAGMENT_DIR)/android \
$(MAGIC_FRAGMENT_DIR)/animation \
$(MAGIC_FRAGMENT_DIR)/aout \
+$(MAGIC_FRAGMENT_DIR)/apache \
$(MAGIC_FRAGMENT_DIR)/apl \
$(MAGIC_FRAGMENT_DIR)/apple \
+$(MAGIC_FRAGMENT_DIR)/application \
$(MAGIC_FRAGMENT_DIR)/applix \
+$(MAGIC_FRAGMENT_DIR)/apt \
$(MAGIC_FRAGMENT_DIR)/archive \
$(MAGIC_FRAGMENT_DIR)/assembler \
$(MAGIC_FRAGMENT_DIR)/asterix \
$(MAGIC_FRAGMENT_DIR)/att3b \
$(MAGIC_FRAGMENT_DIR)/audio \
$(MAGIC_FRAGMENT_DIR)/basis \
+$(MAGIC_FRAGMENT_DIR)/ber \
$(MAGIC_FRAGMENT_DIR)/bflt \
+$(MAGIC_FRAGMENT_DIR)/bhl \
+$(MAGIC_FRAGMENT_DIR)/bioinformatics \
$(MAGIC_FRAGMENT_DIR)/blackberry \
$(MAGIC_FRAGMENT_DIR)/blcr \
$(MAGIC_FRAGMENT_DIR)/blender \
@@ -42,6 +49,7 @@ $(MAGIC_FRAGMENT_DIR)/c-lang \
$(MAGIC_FRAGMENT_DIR)/c64 \
$(MAGIC_FRAGMENT_DIR)/cad \
$(MAGIC_FRAGMENT_DIR)/cafebabe \
+$(MAGIC_FRAGMENT_DIR)/cbor \
$(MAGIC_FRAGMENT_DIR)/cddb \
$(MAGIC_FRAGMENT_DIR)/chord \
$(MAGIC_FRAGMENT_DIR)/cisco \
@@ -49,11 +57,13 @@ $(MAGIC_FRAGMENT_DIR)/citrus \
$(MAGIC_FRAGMENT_DIR)/clarion \
$(MAGIC_FRAGMENT_DIR)/claris \
$(MAGIC_FRAGMENT_DIR)/clipper \
+$(MAGIC_FRAGMENT_DIR)/coff \
$(MAGIC_FRAGMENT_DIR)/commands \
$(MAGIC_FRAGMENT_DIR)/communications \
$(MAGIC_FRAGMENT_DIR)/compress \
$(MAGIC_FRAGMENT_DIR)/console \
$(MAGIC_FRAGMENT_DIR)/convex \
+$(MAGIC_FRAGMENT_DIR)/coverage \
$(MAGIC_FRAGMENT_DIR)/cracklib \
$(MAGIC_FRAGMENT_DIR)/ctags \
$(MAGIC_FRAGMENT_DIR)/ctf \
@@ -61,6 +71,7 @@ $(MAGIC_FRAGMENT_DIR)/cubemap \
$(MAGIC_FRAGMENT_DIR)/cups \
$(MAGIC_FRAGMENT_DIR)/dact \
$(MAGIC_FRAGMENT_DIR)/database \
+$(MAGIC_FRAGMENT_DIR)/der \
$(MAGIC_FRAGMENT_DIR)/diamond \
$(MAGIC_FRAGMENT_DIR)/diff \
$(MAGIC_FRAGMENT_DIR)/digital \
@@ -77,7 +88,9 @@ $(MAGIC_FRAGMENT_DIR)/erlang \
$(MAGIC_FRAGMENT_DIR)/esri \
$(MAGIC_FRAGMENT_DIR)/fcs \
$(MAGIC_FRAGMENT_DIR)/filesystems \
+$(MAGIC_FRAGMENT_DIR)/finger \
$(MAGIC_FRAGMENT_DIR)/flash \
+$(MAGIC_FRAGMENT_DIR)/flif \
$(MAGIC_FRAGMENT_DIR)/fonts \
$(MAGIC_FRAGMENT_DIR)/fortran \
$(MAGIC_FRAGMENT_DIR)/frame \
@@ -86,6 +99,7 @@ $(MAGIC_FRAGMENT_DIR)/fsav \
$(MAGIC_FRAGMENT_DIR)/fusecompress \
$(MAGIC_FRAGMENT_DIR)/games \
$(MAGIC_FRAGMENT_DIR)/gcc \
+$(MAGIC_FRAGMENT_DIR)/gconv \
$(MAGIC_FRAGMENT_DIR)/geo \
$(MAGIC_FRAGMENT_DIR)/geos \
$(MAGIC_FRAGMENT_DIR)/gimp \
@@ -93,6 +107,7 @@ $(MAGIC_FRAGMENT_DIR)/gnome \
$(MAGIC_FRAGMENT_DIR)/gnu \
$(MAGIC_FRAGMENT_DIR)/gnumeric \
$(MAGIC_FRAGMENT_DIR)/gpt \
+$(MAGIC_FRAGMENT_DIR)/gpu \
$(MAGIC_FRAGMENT_DIR)/grace \
$(MAGIC_FRAGMENT_DIR)/graphviz \
$(MAGIC_FRAGMENT_DIR)/gringotts \
@@ -144,6 +159,7 @@ $(MAGIC_FRAGMENT_DIR)/mcrypt \
$(MAGIC_FRAGMENT_DIR)/mercurial \
$(MAGIC_FRAGMENT_DIR)/metastore \
$(MAGIC_FRAGMENT_DIR)/meteorological \
+$(MAGIC_FRAGMENT_DIR)/microfocus \
$(MAGIC_FRAGMENT_DIR)/mime \
$(MAGIC_FRAGMENT_DIR)/mips \
$(MAGIC_FRAGMENT_DIR)/mirage \
@@ -160,6 +176,7 @@ $(MAGIC_FRAGMENT_DIR)/msx \
$(MAGIC_FRAGMENT_DIR)/msvc \
$(MAGIC_FRAGMENT_DIR)/mup \
$(MAGIC_FRAGMENT_DIR)/music \
+$(MAGIC_FRAGMENT_DIR)/nasa \
$(MAGIC_FRAGMENT_DIR)/natinst \
$(MAGIC_FRAGMENT_DIR)/ncr \
$(MAGIC_FRAGMENT_DIR)/neko \
@@ -183,6 +200,8 @@ $(MAGIC_FRAGMENT_DIR)/parrot \
$(MAGIC_FRAGMENT_DIR)/pascal \
$(MAGIC_FRAGMENT_DIR)/pbf \
$(MAGIC_FRAGMENT_DIR)/pbm \
+$(MAGIC_FRAGMENT_DIR)/pc88 \
+$(MAGIC_FRAGMENT_DIR)/pc98 \
$(MAGIC_FRAGMENT_DIR)/pdf \
$(MAGIC_FRAGMENT_DIR)/pdp \
$(MAGIC_FRAGMENT_DIR)/perl \
@@ -191,9 +210,11 @@ $(MAGIC_FRAGMENT_DIR)/pgp \
$(MAGIC_FRAGMENT_DIR)/pkgadd \
$(MAGIC_FRAGMENT_DIR)/plan9 \
$(MAGIC_FRAGMENT_DIR)/plus5 \
+$(MAGIC_FRAGMENT_DIR)/polyml \
$(MAGIC_FRAGMENT_DIR)/printer \
$(MAGIC_FRAGMENT_DIR)/project \
$(MAGIC_FRAGMENT_DIR)/psdbms \
+$(MAGIC_FRAGMENT_DIR)/psl \
$(MAGIC_FRAGMENT_DIR)/pulsar \
$(MAGIC_FRAGMENT_DIR)/pwsafe \
$(MAGIC_FRAGMENT_DIR)/pyramid \
@@ -245,6 +266,7 @@ $(MAGIC_FRAGMENT_DIR)/unknown \
$(MAGIC_FRAGMENT_DIR)/uterus \
$(MAGIC_FRAGMENT_DIR)/uuencode \
$(MAGIC_FRAGMENT_DIR)/varied.out \
+$(MAGIC_FRAGMENT_DIR)/vacuum-cleaner \
$(MAGIC_FRAGMENT_DIR)/varied.script \
$(MAGIC_FRAGMENT_DIR)/vax \
$(MAGIC_FRAGMENT_DIR)/vicar \
@@ -257,15 +279,18 @@ $(MAGIC_FRAGMENT_DIR)/vorbis \
$(MAGIC_FRAGMENT_DIR)/vxl \
$(MAGIC_FRAGMENT_DIR)/warc \
$(MAGIC_FRAGMENT_DIR)/weak \
+$(MAGIC_FRAGMENT_DIR)/webassembly \
$(MAGIC_FRAGMENT_DIR)/windows \
$(MAGIC_FRAGMENT_DIR)/wireless \
$(MAGIC_FRAGMENT_DIR)/wordprocessors \
$(MAGIC_FRAGMENT_DIR)/wsdl \
+$(MAGIC_FRAGMENT_DIR)/x68000 \
$(MAGIC_FRAGMENT_DIR)/xdelta \
$(MAGIC_FRAGMENT_DIR)/xenix \
$(MAGIC_FRAGMENT_DIR)/xilinx \
$(MAGIC_FRAGMENT_DIR)/xo65 \
$(MAGIC_FRAGMENT_DIR)/xwindows \
+$(MAGIC_FRAGMENT_DIR)/yara \
$(MAGIC_FRAGMENT_DIR)/zfs \
$(MAGIC_FRAGMENT_DIR)/zilog \
$(MAGIC_FRAGMENT_DIR)/zyxel
@@ -289,7 +314,7 @@ ${MAGIC}: $(EXTRA_DIST) $(FILE_COMPILE_DEP)
@(if expr "${FILE_COMPILE}" : '.*/.*' > /dev/null; then \
echo "Using ${FILE_COMPILE} to generate ${MAGIC}" > /dev/null; \
else \
- v=$$(file --version | sed -e s/file-// -e q); \
+ v=$$(${FILE_COMPILE} --version | sed -e s/file-// -e q); \
if [ "$$v" != "${PACKAGE_VERSION}" ]; then \
echo "Cannot use the installed version of file ($$v) to"; \
echo "cross-compile file ${PACKAGE_VERSION}"; \
diff --git a/magic/Makefile.in b/magic/Makefile.in
index 43f42c6..3555f9e 100644
--- a/magic/Makefile.in
+++ b/magic/Makefile.in
@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.14 from Makefile.am.
+# Makefile.in generated by automake 1.15 from Makefile.am.
# @configure_input@
-# Copyright (C) 1994-2013 Free Software Foundation, Inc.
+# Copyright (C) 1994-2014 Free Software Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
@@ -15,7 +15,17 @@
@SET_MAKE@
VPATH = @srcdir@
-am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
+am__is_gnu_make = { \
+ if test -z '$(MAKELEVEL)'; then \
+ false; \
+ elif test -n '$(MAKE_HOST)'; then \
+ true; \
+ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+ true; \
+ else \
+ false; \
+ fi; \
+}
am__make_running_with_option = \
case $${target_option-} in \
?) ;; \
@@ -78,7 +88,6 @@ POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
subdir = magic
-DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
@@ -86,6 +95,7 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
$(top_srcdir)/acinclude.m4 $(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = $(top_builddir)/config.h
CONFIG_CLEAN_FILES =
@@ -139,6 +149,7 @@ am__uninstall_files_from_dir = { \
am__installdirs = "$(DESTDIR)$(pkgdatadir)"
DATA = $(pkgdata_DATA)
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+am__DIST_COMMON = $(srcdir)/Makefile.in
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
pkgdatadir = @pkgdatadir@
ACLOCAL = @ACLOCAL@
@@ -262,7 +273,7 @@ top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
#
-# $File: Makefile.am,v 1.101 2014/12/12 16:48:39 christos Exp $
+# $File: Makefile.am,v 1.126 2017/08/10 11:01:38 christos Exp $
#
MAGIC_FRAGMENT_BASE = Magdir
MAGIC_DIR = $(top_srcdir)/magic
@@ -274,6 +285,7 @@ $(MAGIC_DIR)/Localstuff \
$(MAGIC_FRAGMENT_DIR)/acorn \
$(MAGIC_FRAGMENT_DIR)/adi \
$(MAGIC_FRAGMENT_DIR)/adventure \
+$(MAGIC_FRAGMENT_DIR)/algol68 \
$(MAGIC_FRAGMENT_DIR)/allegro \
$(MAGIC_FRAGMENT_DIR)/alliant \
$(MAGIC_FRAGMENT_DIR)/amanda \
@@ -281,16 +293,22 @@ $(MAGIC_FRAGMENT_DIR)/amigaos \
$(MAGIC_FRAGMENT_DIR)/android \
$(MAGIC_FRAGMENT_DIR)/animation \
$(MAGIC_FRAGMENT_DIR)/aout \
+$(MAGIC_FRAGMENT_DIR)/apache \
$(MAGIC_FRAGMENT_DIR)/apl \
$(MAGIC_FRAGMENT_DIR)/apple \
+$(MAGIC_FRAGMENT_DIR)/application \
$(MAGIC_FRAGMENT_DIR)/applix \
+$(MAGIC_FRAGMENT_DIR)/apt \
$(MAGIC_FRAGMENT_DIR)/archive \
$(MAGIC_FRAGMENT_DIR)/assembler \
$(MAGIC_FRAGMENT_DIR)/asterix \
$(MAGIC_FRAGMENT_DIR)/att3b \
$(MAGIC_FRAGMENT_DIR)/audio \
$(MAGIC_FRAGMENT_DIR)/basis \
+$(MAGIC_FRAGMENT_DIR)/ber \
$(MAGIC_FRAGMENT_DIR)/bflt \
+$(MAGIC_FRAGMENT_DIR)/bhl \
+$(MAGIC_FRAGMENT_DIR)/bioinformatics \
$(MAGIC_FRAGMENT_DIR)/blackberry \
$(MAGIC_FRAGMENT_DIR)/blcr \
$(MAGIC_FRAGMENT_DIR)/blender \
@@ -303,6 +321,7 @@ $(MAGIC_FRAGMENT_DIR)/c-lang \
$(MAGIC_FRAGMENT_DIR)/c64 \
$(MAGIC_FRAGMENT_DIR)/cad \
$(MAGIC_FRAGMENT_DIR)/cafebabe \
+$(MAGIC_FRAGMENT_DIR)/cbor \
$(MAGIC_FRAGMENT_DIR)/cddb \
$(MAGIC_FRAGMENT_DIR)/chord \
$(MAGIC_FRAGMENT_DIR)/cisco \
@@ -310,11 +329,13 @@ $(MAGIC_FRAGMENT_DIR)/citrus \
$(MAGIC_FRAGMENT_DIR)/clarion \
$(MAGIC_FRAGMENT_DIR)/claris \
$(MAGIC_FRAGMENT_DIR)/clipper \
+$(MAGIC_FRAGMENT_DIR)/coff \
$(MAGIC_FRAGMENT_DIR)/commands \
$(MAGIC_FRAGMENT_DIR)/communications \
$(MAGIC_FRAGMENT_DIR)/compress \
$(MAGIC_FRAGMENT_DIR)/console \
$(MAGIC_FRAGMENT_DIR)/convex \
+$(MAGIC_FRAGMENT_DIR)/coverage \
$(MAGIC_FRAGMENT_DIR)/cracklib \
$(MAGIC_FRAGMENT_DIR)/ctags \
$(MAGIC_FRAGMENT_DIR)/ctf \
@@ -322,6 +343,7 @@ $(MAGIC_FRAGMENT_DIR)/cubemap \
$(MAGIC_FRAGMENT_DIR)/cups \
$(MAGIC_FRAGMENT_DIR)/dact \
$(MAGIC_FRAGMENT_DIR)/database \
+$(MAGIC_FRAGMENT_DIR)/der \
$(MAGIC_FRAGMENT_DIR)/diamond \
$(MAGIC_FRAGMENT_DIR)/diff \
$(MAGIC_FRAGMENT_DIR)/digital \
@@ -338,7 +360,9 @@ $(MAGIC_FRAGMENT_DIR)/erlang \
$(MAGIC_FRAGMENT_DIR)/esri \
$(MAGIC_FRAGMENT_DIR)/fcs \
$(MAGIC_FRAGMENT_DIR)/filesystems \
+$(MAGIC_FRAGMENT_DIR)/finger \
$(MAGIC_FRAGMENT_DIR)/flash \
+$(MAGIC_FRAGMENT_DIR)/flif \
$(MAGIC_FRAGMENT_DIR)/fonts \
$(MAGIC_FRAGMENT_DIR)/fortran \
$(MAGIC_FRAGMENT_DIR)/frame \
@@ -347,6 +371,7 @@ $(MAGIC_FRAGMENT_DIR)/fsav \
$(MAGIC_FRAGMENT_DIR)/fusecompress \
$(MAGIC_FRAGMENT_DIR)/games \
$(MAGIC_FRAGMENT_DIR)/gcc \
+$(MAGIC_FRAGMENT_DIR)/gconv \
$(MAGIC_FRAGMENT_DIR)/geo \
$(MAGIC_FRAGMENT_DIR)/geos \
$(MAGIC_FRAGMENT_DIR)/gimp \
@@ -354,6 +379,7 @@ $(MAGIC_FRAGMENT_DIR)/gnome \
$(MAGIC_FRAGMENT_DIR)/gnu \
$(MAGIC_FRAGMENT_DIR)/gnumeric \
$(MAGIC_FRAGMENT_DIR)/gpt \
+$(MAGIC_FRAGMENT_DIR)/gpu \
$(MAGIC_FRAGMENT_DIR)/grace \
$(MAGIC_FRAGMENT_DIR)/graphviz \
$(MAGIC_FRAGMENT_DIR)/gringotts \
@@ -405,6 +431,7 @@ $(MAGIC_FRAGMENT_DIR)/mcrypt \
$(MAGIC_FRAGMENT_DIR)/mercurial \
$(MAGIC_FRAGMENT_DIR)/metastore \
$(MAGIC_FRAGMENT_DIR)/meteorological \
+$(MAGIC_FRAGMENT_DIR)/microfocus \
$(MAGIC_FRAGMENT_DIR)/mime \
$(MAGIC_FRAGMENT_DIR)/mips \
$(MAGIC_FRAGMENT_DIR)/mirage \
@@ -421,6 +448,7 @@ $(MAGIC_FRAGMENT_DIR)/msx \
$(MAGIC_FRAGMENT_DIR)/msvc \
$(MAGIC_FRAGMENT_DIR)/mup \
$(MAGIC_FRAGMENT_DIR)/music \
+$(MAGIC_FRAGMENT_DIR)/nasa \
$(MAGIC_FRAGMENT_DIR)/natinst \
$(MAGIC_FRAGMENT_DIR)/ncr \
$(MAGIC_FRAGMENT_DIR)/neko \
@@ -444,6 +472,8 @@ $(MAGIC_FRAGMENT_DIR)/parrot \
$(MAGIC_FRAGMENT_DIR)/pascal \
$(MAGIC_FRAGMENT_DIR)/pbf \
$(MAGIC_FRAGMENT_DIR)/pbm \
+$(MAGIC_FRAGMENT_DIR)/pc88 \
+$(MAGIC_FRAGMENT_DIR)/pc98 \
$(MAGIC_FRAGMENT_DIR)/pdf \
$(MAGIC_FRAGMENT_DIR)/pdp \
$(MAGIC_FRAGMENT_DIR)/perl \
@@ -452,9 +482,11 @@ $(MAGIC_FRAGMENT_DIR)/pgp \
$(MAGIC_FRAGMENT_DIR)/pkgadd \
$(MAGIC_FRAGMENT_DIR)/plan9 \
$(MAGIC_FRAGMENT_DIR)/plus5 \
+$(MAGIC_FRAGMENT_DIR)/polyml \
$(MAGIC_FRAGMENT_DIR)/printer \
$(MAGIC_FRAGMENT_DIR)/project \
$(MAGIC_FRAGMENT_DIR)/psdbms \
+$(MAGIC_FRAGMENT_DIR)/psl \
$(MAGIC_FRAGMENT_DIR)/pulsar \
$(MAGIC_FRAGMENT_DIR)/pwsafe \
$(MAGIC_FRAGMENT_DIR)/pyramid \
@@ -506,6 +538,7 @@ $(MAGIC_FRAGMENT_DIR)/unknown \
$(MAGIC_FRAGMENT_DIR)/uterus \
$(MAGIC_FRAGMENT_DIR)/uuencode \
$(MAGIC_FRAGMENT_DIR)/varied.out \
+$(MAGIC_FRAGMENT_DIR)/vacuum-cleaner \
$(MAGIC_FRAGMENT_DIR)/varied.script \
$(MAGIC_FRAGMENT_DIR)/vax \
$(MAGIC_FRAGMENT_DIR)/vicar \
@@ -518,15 +551,18 @@ $(MAGIC_FRAGMENT_DIR)/vorbis \
$(MAGIC_FRAGMENT_DIR)/vxl \
$(MAGIC_FRAGMENT_DIR)/warc \
$(MAGIC_FRAGMENT_DIR)/weak \
+$(MAGIC_FRAGMENT_DIR)/webassembly \
$(MAGIC_FRAGMENT_DIR)/windows \
$(MAGIC_FRAGMENT_DIR)/wireless \
$(MAGIC_FRAGMENT_DIR)/wordprocessors \
$(MAGIC_FRAGMENT_DIR)/wsdl \
+$(MAGIC_FRAGMENT_DIR)/x68000 \
$(MAGIC_FRAGMENT_DIR)/xdelta \
$(MAGIC_FRAGMENT_DIR)/xenix \
$(MAGIC_FRAGMENT_DIR)/xilinx \
$(MAGIC_FRAGMENT_DIR)/xo65 \
$(MAGIC_FRAGMENT_DIR)/xwindows \
+$(MAGIC_FRAGMENT_DIR)/yara \
$(MAGIC_FRAGMENT_DIR)/zfs \
$(MAGIC_FRAGMENT_DIR)/zilog \
$(MAGIC_FRAGMENT_DIR)/zyxel
@@ -555,7 +591,6 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign magic/Makefile'; \
$(am__cd) $(top_srcdir) && \
$(AUTOMAKE) --foreign magic/Makefile
-.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
*config.status*) \
@@ -755,6 +790,8 @@ uninstall-am: uninstall-pkgdataDATA
mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \
ps ps-am tags-am uninstall uninstall-am uninstall-pkgdataDATA
+.PRECIOUS: Makefile
+
${MAGIC}: $(EXTRA_DIST) $(FILE_COMPILE_DEP)
@rm -fr magic
@@ -762,7 +799,7 @@ ${MAGIC}: $(EXTRA_DIST) $(FILE_COMPILE_DEP)
@(if expr "${FILE_COMPILE}" : '.*/.*' > /dev/null; then \
echo "Using ${FILE_COMPILE} to generate ${MAGIC}" > /dev/null; \
else \
- v=$$(file --version | sed -e s/file-// -e q); \
+ v=$$(${FILE_COMPILE} --version | sed -e s/file-// -e q); \
if [ "$$v" != "${PACKAGE_VERSION}" ]; then \
echo "Cannot use the installed version of file ($$v) to"; \
echo "cross-compile file ${PACKAGE_VERSION}"; \